Suphonchai Phoonsawat 98b370c925 feat(docver): add access token endpoint and Bearer auth on all endpoints ... - POST /api/documents/token issues JWT HS256 (claims userid/username/fid/template) after x-api-key check against new env DOCVER_API_KEY (fail-closed, timing-safe, uniform 401) - all docver endpoints now require Authorization: Bearer, verified with env DOCVER_TOKEN_SECRET (TTL via DOCVER_TOKEN_TTL_SECONDS, default 3600); secret unset = 401 on verify / 500 on issue - identity (userId/userName) + templateId extracted from token claims instead of request payload; removed from multipart form (legacy fields now 400) - lib/docver-token.ts: hand-rolled JWT via node:crypto only — alg pinned to HS256 (anti alg-confusion), timing-safe compare with both sides hashed, exp enforced, identical 401 for all bearer failure modes - openapi spec: /api/documents/token path + DocverBearer scheme; PLAN-DOCVER.md / CLAUDE.md / .env.example updated - tests: new tests/lib/docver-token.test.ts + adjusted parseVersionUploadForm tests (258 pass, no DB env needed) - package-lock.json: sync minio (^8.0.7) that was missing from the earlier docver commit Co-Authored-By: Claude Code <noreply@anthropic.com>		2026-10-26 06:29:19 +07:00
..
document-versioning.test.ts	feat(docver): add access token endpoint and Bearer auth on all endpoints	2026-10-26 06:29:19 +07:00
docver-token.test.ts	feat(docver): add access token endpoint and Bearer auth on all endpoints	2026-10-26 06:29:19 +07:00
external-api-auth.test.ts	refactor(routes): move routes under /note, APIs under /api/note	2026-10-06 14:55:07 +07:00
pdf-actual-text.test.ts	refactor(routes): move routes under /note, APIs under /api/note	2026-10-06 14:55:07 +07:00