- Successful SSO /auth/api/validate responses are cached per credential
and perm/renew URL for 10s, so watch websocket re-checks do not hammer
the auth backend. A POST to the logout endpoint purges all cached
entries for the request's credentials immediately, so logout/login
flows are not served stale successes.
- The watch websocket now re-validates auth before each forwarded
message and every 10s when idle (SSO and built-in sessions alike).
When the session is gone the client gets an auth error message and
the socket is closed, instead of streaming updates forever.
- Token-authenticated (API/share token) sockets are exempt from
re-validation; they are checked once at handshake.
Implement complete WebDAV file serving compatible with various clients from Windows File Explorer to more specialized sync tools. The old control WebSocket has been updated to part-DAV, part REST API instead. Implemented user:pass BASIC auth. Added UI and backend for creating tokens that avoid the need to use actual username and password for requests from CLI or DAV.
LeoVasanko