mirror of
https://github.com/DeBrosOfficial/orama.git
synced 2026-08-06 21:29:28 +00:00
481e32df5d
Validate API keys against the gateway's OWN namespace RQLite instead of the core cluster. `orama namespace keys create` writes keys to the namespace DB (:10000), but validation read the core DB (:5001), so every namespace key returned 401. Auth now binds explicitly to the namespace-bound handle via a narrow apiKeyQuerier interface, and the duplicate core-bound lookup in jwt_handler.go — the cause of POST /v1/auth/token 401s — uses the same handle. Underlying cause is that client.DefaultClientConfig pre-populates DatabaseEndpoints from bootstrap peers on port 5001, so the `if len(...) == 0` override in dependencies.go silently discards rqlite_dsn. That default is left alone here: g.client feeds 26 call sites (ACME, domains, vault, push), so flipping it needs its own change with each consumer audited. Also in this release: - WebRTC role reconciliation: node replacement left turn/sfu allocations on the departed node. Allocation-sourced ports, spawn gating, 60s reconciler. - TURNS certs: single-label turn-<ns> host so the LE wildcard actually covers it, plus a warm ReconcileTURN patch. SFU media_port=0 crash-loop fixed. - DNS: purge inactive TURN/namespace host records, retract foreign records. - Serverless: nested invokes from system parents carry the internal trigger type. - Storage: evict handler, unpin idempotency. API-key auth verified end-to-end on devnet 0.122.97: token exchange returns 200 with correct namespace and scope claims; bogus keys still 401. Full suite green. Co-Authored-By: Claude <noreply@anthropic.com>