GET /api/public/v1/me existiert bereits — OpenAPI-Summary nennt jetzt
ausdrücklich die User-ID, api-guide (en+de) ebenso. MCP war bereits
paritätisch (list_ponds + Token-Identität); kein neuer Endpoint nötig.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0155v2aT8AG1kZDQEZiCLBWC
Neues pageListQuerySchema (ISO 8601, Kulanz für Datum ohne Zeit),
Query-Parameter auf interner und Public-API-Seitenliste, Prisma-where
mit gte; neue Indizes (pondId, createdAt)/(pondId, updatedAt) als
Migration. OpenAPI-Parameter, MCP-Parität (list_pages
created_since/updated_since), Doku (api-guide, mcp-guide,
public-api.md), DB-Test inkl. 400 bei ungültigem Datum.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0155v2aT8AG1kZDQEZiCLBWC
The slug-based machine surfaces now see and shape the hierarchy:
- REST: page list/detail carry parent (the parent page's slug, nulled
when the token's user may not read it — same no-leak rule as the
internal list); create accepts parent; PATCH accepts parent
(slug nests, null moves to the top level, appended at the end of the
new sibling group via the new PagesService.moveToEnd). Cycle/depth
refusals keep their regular error codes. OpenAPI updated.
- MCP: list_pages returns parent, create_page takes an optional parent
slug, update_page moves with parent (slug|null); tool errors carry
the api code (page_cycle covered in the e2e pack).
- ZIP export deliberately stays flat — noted in features.md; the
hierarchy is organizational only.
e2e: REST pack covers nested create, list shape, move/root-move, 409
page_cycle, 404 unknown parent; MCP pack covers nested create, list
parent, and the cycle tool error.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Token-authenticated machine access at /api/public/v1 — the foundation for
the built-in MCP endpoint (#105).
Personal access tokens:
- api_tokens table (SHA-256 hash, scope read|write, optional pond
restriction, expiry, revocation, throttled last-used) + migration;
secrets are dt_pat_<random>, shown exactly once
- lifecycle endpoints under /users/me/api-tokens (session-only — a leaked
token can never mint more tokens) with audit entries
api.token_created/api.token_revoked
- settings UI section (create with scope/expiry/pond restriction,
one-time reveal with copy, list with status + revoke), de+en
Activation (404 semantics per #60 on both levels):
- instance setting api.enabled (default off, admin settings switch)
- pond setting apiEnabled (default off, pond settings toggle; the
PondsService settings-merge learned the key — the #92 lesson)
Surface (/api/public/v1, excluded from the SPA's global prefix):
- me, ponds, pages (list/read as Markdown+HTML, create from Markdown via
the shared pipeline, PATCH title/content, DELETE to trash), search
(permission-filtered + narrowed to exposed ponds, highlights as **…**),
markdown ZIP export, labels (tree, create/rename/recolour/move/delete,
assign/unassign), comments (threads, create, resolve/reopen)
- content replacement travels the collab-owned document path: the new
state lands as a MANUAL version "API update", then the established
restore NOTIFY applies it — open editors converge, history stays
append-only, no second lineage (VersionsService.replaceContent)
- hand-maintained OpenAPI 3.1 document at /openapi.json, pinned to the
controller by a route-coverage test in both directions
Enforcement:
- PublicApiGuard: instance switch → bearer PAT auth (request.user is the
token's user) → per-token rate limit (429 + Retry-After) → scope
(403 scope_required) → pond opt-in + token restriction
- the shared PermissionGuard then applies the unchanged permission model;
PageParamSource gained pondSlugParam for the slug+slug routes
- no cookies anywhere → no CSRF surface (pinned by a hostile-Origin test)
- every write audit-logged as api.write with the token attributed
Tests/verification:
- 12-test e2e pack: lifecycle, switches, permission matrix
(reader/editor/outsider × scopes), restriction, page roundtrip incl.
restore-NOTIFY assertion, labels, comments incl. policy, search
narrowing, ZIP export, rate limit; full api suite 60/60 green
(quota fixture via per-user override — never the instance default)
- new collab-pack test proves an open editor converges onto an API
content replacement (green against a local seeded stack)
- UI smoke against the built SPA: token create/reveal/revoke, pond
opt-in persists, admin switch persists (10/10)
- docs/self-hosting/public-api.md + README link
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1
