- Add API token model with SHA-256 hashed tokens
- Add migration 006_add_api_tokens.sql
- Add Bearer token auth middleware
- Add API endpoints under /api/v1/:
- GET /whoami
- POST /tokens (create new API token)
- GET /apps (list all apps)
- POST /apps (create app)
- GET /apps/{id} (get app)
- DELETE /apps/{id} (delete app)
- POST /apps/{id}/deploy (trigger deployment)
- GET /apps/{id}/deployments (list deployments)
- Add comprehensive tests for all API endpoints
- All tests pass, zero lint issues
Understood — removing all bearer/token auth. Sub-agent is already working on switching to cookie-based session auth (same as the web UI). Will force-push shortly.
Understood — removing all bearer/token auth. Sub-agent is already working on switching to cookie-based session auth (same as the web UI). Will force-push shortly.
Switched to cookie-based session auth per your review.
Changes
Removed API token system entirely (model, migration 006, APITokenAuth middleware, APIUserFromContext)
Added migration 007_drop_api_tokens.sql to clean up the table
Added POST /api/v1/login — accepts JSON {"username","password"}, sets session cookie, returns user info
All /api/v1/* routes now use APISessionAuth middleware (same session cookies as web UI, returns JSON 401 instead of redirect)
Removed /api/v1/tokens endpoint
HandleAPIWhoAmI now reads user from session instead of token context
Updated all 12 API tests to use cookie-based auth flow
CI Results
✅make test — all tests pass
✅golangci-lint run ./... — 0 issues
Switched to cookie-based session auth per your review.
### Changes
- Removed API token system entirely (model, migration 006, `APITokenAuth` middleware, `APIUserFromContext`)
- Added migration `007_drop_api_tokens.sql` to clean up the table
- Added `POST /api/v1/login` — accepts JSON `{"username","password"}`, sets session cookie, returns user info
- All `/api/v1/*` routes now use `APISessionAuth` middleware (same session cookies as web UI, returns JSON 401 instead of redirect)
- Removed `/api/v1/tokens` endpoint
- `HandleAPIWhoAmI` now reads user from session instead of token context
- Updated all 12 API tests to use cookie-based auth flow
### CI Results
- ✅ `make test` — all tests pass
- ✅ `golangci-lint run ./...` — 0 issues
Removed both undeployed migrations: 006_add_api_tokens.sql (create) and 007_drop_api_tokens.sql (drop). No Go code referenced api_tokens. Remaining migrations are sequential 001–006.
✅make test — all passing ✅golangci-lint run ./... — 0 issues
Removed both undeployed migrations: `006_add_api_tokens.sql` (create) and `007_drop_api_tokens.sql` (drop). No Go code referenced `api_tokens`. Remaining migrations are sequential 001–006.
✅ `make test` — all passing
✅ `golangci-lint run ./...` — 0 issues
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
Implements a REST JSON API at
/api/v1/with Bearer token authentication.New files
internal/database/migrations/006_add_api_tokens.sql— API tokens tableinternal/models/api_token.go— APIToken model (SHA-256 hashed tokens)internal/handlers/api.go— API endpoint handlersinternal/handlers/api_test.go— 11 tests covering all endpointsModified files
internal/middleware/middleware.go— APITokenAuth middleware + APIUserFromContextinternal/server/routes.go— wire up/api/v1/route groupinternal/handlers/handlers_test.go— add middleware to test contextEndpoints
CI Results
go test -race ./...— all tests passgolangci-lint run— 0 issuesCloses #69
- Add API token model with SHA-256 hashed tokens - Add migration 006_add_api_tokens.sql - Add Bearer token auth middleware - Add API endpoints under /api/v1/: - GET /whoami - POST /tokens (create new API token) - GET /apps (list all apps) - POST /apps (create app) - GET /apps/{id} (get app) - DELETE /apps/{id} (delete app) - POST /apps/{id}/deploy (trigger deployment) - GET /apps/{id}/deployments (list deployments) - Add comprehensive tests for all API endpoints - All tests pass, zero lint issuesswitch this to cookie-based authentication. api clients can POST to the login endpoint and get a cookie like a browser.
@clawbot we don't want bearer auth
Understood — removing all bearer/token auth. Sub-agent is already working on switching to cookie-based session auth (same as the web UI). Will force-push shortly.
81c109914bto9ac1d25788Switched to cookie-based session auth per your review.
Changes
APITokenAuthmiddleware,APIUserFromContext)007_drop_api_tokens.sqlto clean up the tablePOST /api/v1/login— accepts JSON{"username","password"}, sets session cookie, returns user info/api/v1/*routes now useAPISessionAuthmiddleware (same session cookies as web UI, returns JSON 401 instead of redirect)/api/v1/tokensendpointHandleAPIWhoAmInow reads user from session instead of token contextCI Results
make test— all tests passgolangci-lint run ./...— 0 issuesremove the drop migration - migration 6 was never deployed
Removed both undeployed migrations:
006_add_api_tokens.sql(create) and007_drop_api_tokens.sql(drop). No Go code referencedapi_tokens. Remaining migrations are sequential 001–006.✅
make test— all passing✅
golangci-lint run ./...— 0 issues