API

Autentifikatsiya

Browser session, CSRF, API key, RBAC va ownership talablari.

Browser session

/api/auth/login email va parolni qabul qilib opaque session cookie yaratadi. Keyingi protected /api route’lar cookie bilan autentifikatsiya qilinadi. State-changing requestlar qo‘shimcha X-CSRF-Token talab qiladi.

curl -sS -c cookies.txt \
  -H 'Content-Type: application/json' \
  -d '{"email":"admin@example.uz","password":"••••••••"}' \
  "$APP_URL/api/auth/login"

Himoyalangan mutation

curl -sS -b cookies.txt \
  -H "X-CSRF-Token: $CSRF_TOKEN" \
  -H 'Content-Type: application/json' \
  -X PATCH -d '{"title":"Yangi nom"}' \
  "$APP_URL/api/conversations/$CONVERSATION_ID"

Machine API key

/v1 route’lar Authorization: Bearer edubase_live_… bilan ishlaydi. Kalit faqat yaratish javobida bir marta qaytariladi. Server prefix + SHA-256 digestni saqlaydi.

Bearer auth

curl -sS "$APP_URL/v1/models" \
  -H "Authorization: Bearer $EDUBASE_API_KEY"

Siyosat	Tekshiruv
Scope	Endpoint uchun kerakli scope kalitda mavjud
Model	Kalit va user modelga ruxsatli
User	Bog‘langan hisob active
IP	Allowlist bo‘lsa trusted client IP mos
Expiry	Kalit muddati tugamagan
Revoke	Revoked timestamp yo‘q

Route siyosati

Route guruhi	Auth	Qo‘shimcha siyosat
`/health`, `/ready`	Public	GET only
`/api/auth/login`	Public	Rate/body limit
`/api/public/shares/*`	Public token	Snapshot only
`/api/*`	Session	CSRF mutationlarda, ownership/RBAC
`/api/admin/*`	Session	Admin role + CSRF mutationlarda
`/v1/*`	API key	Scope/model/IP/idempotency/limits
`/metrics`	Private network	Public edge’da expose qilinmaydi

Session boshqaruvi

Foydalanuvchi aktiv sessiyalarini ko‘radi va joriy bo‘lmagan sessiyani revoke qiladi. Logout joriy sessiyani bekor qiladi. Productionda session TTL default 24 soat, lekin environment orqali boshqariladi.