Zac Gaetano 8028c4c4dd feat(auth): bound-hostname tokens for node-agent + return role from /me ... - requireAuth bearer path now selects api_tokens.bound_hostname and users.role, populates req.tokenBoundHostname and req.user.role. /cluster/heartbeat can now authenticate via a bound api_token (issued via POST /auth/tokens with bound_hostname). - routes/tokens.js POST accepts bound_hostname; GET returns it so users can see which tokens are bound. - Remove /cluster/heartbeat from SERVICE_PATHS so requireAuth runs on it (the bearer auth handles the gate; the heartbeat handler still enforces the body.hostname === bound match). - /auth/me now returns role (final-review I2). Closes the gap where every signed-in user appeared as 'viewer' in the UI regardless of actual role. - loadUser SELECTs role for session auth. - Backend tests still 37/15/0/22 — no test changes needed; existing token CRUD tests stay passing since bound_hostname is optional.		2026-05-27 19:27:59 -04:00
..
auth.js	feat(auth): bound-hostname tokens for node-agent + return role from /me	2026-05-27 19:27:59 -04:00
errors.js	chore: 1.2 ship-prep sweep — close 38 issues	2026-05-27 02:06:14 +00:00