What changed
New
- New endpoints for the atglance CLI v2: meta, whoami, systems (register + self-service self/deregister, self/reactivate, self/rotate-key), config-files (store/index/show), and force deregister/reactivate.
- System-scoped routes authenticate the host with X-Atglance-System-Id + X-Atglance-System-Key (atglance.system middleware, after auth.pat).
- Kong routes /api/v1/ to the app; same path on the gateway (:8002) and the app (:8000).
- Documented in docs/api-reference.md.
Improved
- v1 system key scoped to the system owner, org admins and workspace members.
- v1 reads require an active user; ids capped at 18 digits.
- Force actions (email + password/pin, no bearer): named rate limiters — 10/min per IP+email, plus a 30/min per-IP cap; hardened against inactive admins and probing.
- Config uploads for deregistered systems refused (409).
- System keys redacted from activity logs; masked (last 4) in the console; key copy removed; safe download filename.
- Stored key copies rotated; legacy config-show org-scoped.
Fixed
- Fix: unauthenticated user CRUD. /api/users (apiResource) had no middleware and was exposed on the Kong gateway — GET returned the full user table, and create/update/delete were open. Now: removed from the gateway, behind auth.pat + active.user, admin-only (rbac 100/101), scoped to the caller's org, with super-admin modify/delete guards. New UserApiAuthTest (7 tests).