arc53-machine 3b44b6851d Let a wiki's owner decide whether API, widget and public-link runs edit it ...

A run from an agent's API key or widget acts as the agent's owner, so it
could rewrite any wiki the owner can edit. A new per-wiki setting,
wiki_outside_edits (off by default), decides whether such runs, and runs
from the agent's public link, get the wiki's edit actions. While it is off
they are offered only wiki_view, and the tool refuses writes itself after
reading the live setting. The owner changes it through the owner-only
/api/sources/<id>/wiki/settings route; tokens can read it but not change it.

2026-09-29 16:07:57 +01:00

..

__init__.py

feat(pat): authenticate personal access tokens

2026-09-19 23:39:58 +01:00

routes.py

feat(audit): split actor from subject on auth events

2026-09-22 10:18:16 +01:00

rules.py

Let a wiki's owner decide whether API, widget and public-link runs edit it

2026-09-29 16:07:57 +01:00

tokens.py

feat(pat): regenerate a token's secret and reset its expiry

2026-09-21 10:32:17 +01:00