jwinterm 56c8dd463a feat(openapi): document bearer auth on the 28 token-gated routes ...

The spec carried no security scheme, so generated clients/docs could not tell
which endpoints require a session token — e.g. /wallet/utxo/balance read as
public while its handler enforces auth via extract_user_id_from_token. Add a
`bearer_auth` HTTP/JWT scheme through a Modify addon and annotate every route
that resolves a session; auth-bootstrap, public username/key lookups, and
system routes stay open. Regenerated openapi.json (drift clean).

2026-06-28 21:42:32 -04:00

96 KiB

Raw Blame History