MarioGLealPandClaude Opus 5.5 c658f640fa feat: callers need an Authentik token and a permission ...

Tokens checked per the security standard (issuer, audience, algorithm,
JWKS key, expiry/not-before, required claims); permissions thoth.read,
thoth.report:<source>@<scope> (must match the scan's path), thoth.manual,
thoth.verdict. Changes are recorded under the bot's name. Retiring now needs
the verdict flag the API sets only for thoth.verdict, checked by the
trigger. House rule: every operation but the probes declares security.

API-Break: every route but the probes now needs a token - nothing has called Thoth yet
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01MdS1Hfahkh27nfbtRVZ4CR

2026-10-29 13:10:07 +00:00

63 KiB

Raw Permalink Blame History