v0.8.0: dep prune, memtest introspection fix, concurrent uploads, x-api-key

Dependency cleanup (ponytail audit):
- Drop 14 unused dependency declarations across 7 crates; quick-xml and
  x509-parser leave the tree entirely (SAML cert/XML work is handled by
  bergshamra + roxmltree).

Fixes:
- introspect: drop the over-broad "microsoft" UTF-16 bulk-scan marker that
  mislabeled Secure-Boot-signed non-Windows bootables (memtest86, signed
  BSDs, firmware tools) as Windows — the string lives in their MS-signed
  EFI loader's FAT long-filename entries. INTROSPECT_REV 3 -> 4 re-probes
  existing local ISOs on startup so the bogus label clears on upgrade.
- upload: begin_upload now reclaims an abandoned <id>.partial instead of
  rejecting the re-upload with "already uploading". Robust against browser
  refresh, tab close, and dropped connections (the chunked protocol can't
  resume a dead session anyway).

Features:
- Storage upload: multi-file + concurrent. Each dropped/selected .iso gets
  its own progress row and uploads independently; a single page-leave guard
  plus a pagehide keepalive-abort replace the old shared singletons.
- Operator API key (x-api-key): a persisted key authenticates /api/* exactly
  like an operator session, for Postman/scripts. New core ApiKeyStore
  (generated on first run, regenerable), accepted in require_auth alongside
  the session cookie, surfaced in Settings -> Advanced with copy + regenerate
  and a usage reference. GET /api/api-key + POST /api/api-key/regenerate.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

crates/http-api/Cargo.toml

@@ -25,11 +25,9 @@ time.workspace = true
 axum.workspace = true
 tower.workspace = true
 tower-http.workspace = true
-hyper.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 tracing.workspace = true
-thiserror.workspace = true
 anyhow.workspace = true
 bytes.workspace = true
 futures.workspace = true

crates/http-api/src/app.rs

@@ -147,6 +147,14 @@ pub fn build_router(state: AppState) -> Router {
         .route("/api/logout", post(auth_api::api_logout))
         .route("/api/me", get(auth_api::api_me))
         .route("/api/me/credentials", put(auth_api::api_update_credentials))
+        // v0.8.0: operator API key surface (read current + regenerate).
+        // Gated by require_auth like the rest of /api/*; a logged-in
+        // operator or an x-api-key holder can read/rotate it.
+        .route("/api/api-key", get(auth_api::api_api_key_get))
+        .route(
+            "/api/api-key/regenerate",
+            post(auth_api::api_api_key_regenerate),
+        )
         // SAML SSO configuration (FleetDM-shaped). Gated behind auth — the
         // operator pastes their IdP metadata, Entity ID, and toggles here.
         .route("/api/sso", get(api_sso_get).put(api_sso_put))
@@ -1944,6 +1952,10 @@ async fn api_docs() -> Json<serde_json::Value> {
                      "summary": "Auth status — { setup_required, authenticated, user }. Always 200."},
                     {"method": "PUT", "path": "/api/me/credentials",
                      "summary": "Rotate the admin's credentials. Body: { current_password, new_username?, new_password? }. Revokes all other sessions on success."},
+                    {"method": "GET", "path": "/api/api-key",
+                     "summary": "Return the operator API key + the header to send it in (x-api-key). That header authenticates API calls without a browser session — full operator access."},
+                    {"method": "POST", "path": "/api/api-key/regenerate",
+                     "summary": "Mint a fresh API key, invalidating the previous one immediately."},
                 ],
             },
             {

crates/http-api/src/auth.rs

@@ -52,6 +52,12 @@ const SESSION_TTL: Duration = Duration::from_hours(24);
 /// to avoid collisions with anything else sharing the host.
 pub const SESSION_COOKIE: &str = "openpxe_session";
 
+/// Header an API client sends to authenticate without a browser session.
+/// Matches the de-facto `x-api-key` convention operators already use with
+/// other appliances. A valid key grants the same access as a logged-in
+/// operator. See [`crate::state::AppState::api_key`].
+pub const API_KEY_HEADER: &str = "x-api-key";
+
 #[derive(Debug, Clone)]
 struct Session {
     username: String,
@@ -223,13 +229,18 @@ pub async fn require_auth(
     if is_public_path(path) {
         return next.run(req).await;
     }
-    // Authenticated path. The cookie must be present, map to a live
-    // session, and the TTL refresh happens as a side-effect.
-    let token = parse_cookie(req.headers());
-    if let Some(t) = token {
-        if state.sessions.touch(&t).is_some() {
-            return next.run(req).await;
-        }
+    // Authenticated path: either a live operator session cookie (the
+    // browser) or the x-api-key header (scripts / Postman). Touching the
+    // cookie refreshes its idle TTL as a side-effect.
+    let session_ok =
+        parse_cookie(req.headers()).is_some_and(|t| state.sessions.touch(&t).is_some());
+    let key_ok = req
+        .headers()
+        .get(API_KEY_HEADER)
+        .and_then(|v| v.to_str().ok())
+        .is_some_and(|k| state.api_key.verify(k));
+    if session_ok || key_ok {
+        return next.run(req).await;
     }
     (
         StatusCode::UNAUTHORIZED,
@@ -447,6 +458,28 @@ pub async fn api_update_credentials(
     }
 }
 
+/// Return the current operator API key plus the header to send it in.
+/// Gated by the auth middleware, so only a logged-in operator (or a
+/// caller already holding the key) can read it.
+pub async fn api_api_key_get(State(state): State<AppState>) -> Response {
+    (
+        StatusCode::OK,
+        Json(json!({ "key": state.api_key.current(), "header": API_KEY_HEADER })),
+    )
+        .into_response()
+}
+
+/// Mint a fresh operator API key, invalidating the previous one, and
+/// return it. Same gating as the GET.
+pub async fn api_api_key_regenerate(State(state): State<AppState>) -> Response {
+    let key = state.api_key.regenerate();
+    (
+        StatusCode::OK,
+        Json(json!({ "key": key, "header": API_KEY_HEADER })),
+    )
+        .into_response()
+}
+
 #[derive(Debug, Serialize)]
 struct LoginPayload<'a> {
     user: &'a AdminPublic,

crates/http-api/src/state.rs

@@ -2,7 +2,7 @@ use crate::auth::SessionStore;
 use crate::saml_routes::SamlRuntime;
 use crate::uploads::UploadSessions;
 use openpxe_core::{
-    AdminStore, BootLog, BootRulesStore, BootTokens, BrandingStore, ClientRegistry,
+    AdminStore, ApiKeyStore, BootLog, BootRulesStore, BootTokens, BrandingStore, ClientRegistry,
     DeploymentQueue, HostBindings, LogBus, Metrics, NotifyStore, SettingsStore, SsoStore,
 };
 use openpxe_iso_store::{
@@ -55,6 +55,11 @@ pub struct AppState {
     /// process restart (sessions are tied to UI state, not persisted —
     /// matches Sonarr/Radarr behaviour).
     pub sessions: SessionStore,
+    /// v0.8.0: persisted operator API key. A request carrying a matching
+    /// `x-api-key` header authenticates exactly like an operator session,
+    /// so scripts / Postman can drive `/api/*` without a browser login.
+    /// Generated on first run; regenerable from Settings → Advanced.
+    pub api_key: ApiKeyStore,
     /// SAML SSO configuration (persisted IdP metadata, Entity ID, toggles).
     pub sso: SsoStore,
     /// v0.5.1: in-memory SAML runtime state — outstanding AuthnRequest IDs

crates/http-api/tests/full_flow.rs

@@ -99,6 +99,7 @@ async fn build_state() -> (AppState, tempfile::TempDir) {
     let admin = openpxe_core::AdminStore::load_or_default(dir.path());
     let sso = openpxe_core::SsoStore::load_or_default(dir.path());
     let notify = openpxe_core::NotifyStore::load_or_default(dir.path());
+    let api_key = openpxe_core::ApiKeyStore::load_or_init(dir.path());
     let sessions = openpxe_http_api::auth::SessionStore::default();
     let metrics = Metrics::new();
     let state = AppState {
@@ -114,6 +115,7 @@ async fn build_state() -> (AppState, tempfile::TempDir) {
         pxe_bg_cache: openpxe_http_api::state::PxeBgCache::default(),
         admin,
         sessions,
+        api_key,
         sso,
         saml: openpxe_http_api::saml_routes::SamlRuntime::default(),
         notify,
@@ -135,6 +137,60 @@ async fn build_state() -> (AppState, tempfile::TempDir) {
     (state, dir)
 }
 
+#[tokio::test]
+async fn api_key_authenticates_gated_endpoints() {
+    // v0.8.0: the x-api-key header authenticates /api/* like an operator
+    // session. The middleware only enforces once an admin is configured
+    // (before that everything is open), so bootstrap one first.
+    let (state, _dir) = build_state().await;
+    state
+        .admin
+        .bootstrap("admin", "correct-horse-battery-staple")
+        .unwrap();
+    let key = state.api_key.current();
+    let app = build_router(state);
+
+    // No credentials → 401.
+    let res = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .uri("/api/isos")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(res.status(), StatusCode::UNAUTHORIZED, "no auth must 401");
+
+    // Wrong key → 401.
+    let res = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .uri("/api/isos")
+                .header("x-api-key", "not-the-key")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(res.status(), StatusCode::UNAUTHORIZED, "wrong key must 401");
+
+    // Correct key → 200 (operator-equivalent access).
+    let res = app
+        .oneshot(
+            Request::builder()
+                .uri("/api/isos")
+                .header("x-api-key", key)
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(res.status(), StatusCode::OK, "valid key must authenticate");
+}
+
 #[tokio::test]
 async fn health_and_ready_endpoints() {
     let (state, _dir) = build_state().await;