- loadAuthToken now falls back to local validation for _superusers tokens
when JWKS validation fails in external-only mode. Non-superuser local
tokens are still rejected. Fixes seeding with IAM enabled.
- Scrub PocketBase references from docs, SDK, and UI config
When IAM_ENDPOINT is empty or set to 'disabled'/'none', skip JWKS
registration and ExternalAuthOnly enforcement. This allows PB superuser
tokens to work for all collections, enabling data seeding and migration
without requiring a running IAM instance.
Replace "Hanzo Base" fallbacks with generic "Base" in all Svelte UI
components. When $appName is set (e.g. "<tenant>"), it displays
that instead. Help text uses "the application" rather than a brand.
Files: App.svelte, FullPage.svelte, PageWrapper.svelte, index.html,
PageBackups, PageStorage, PageMail, TrustedProxyAccordion,
CollectionRulesTab, LarkOptions, PageExportCollections
DBPoolManager: LRU cache of dual-pool SQLite connections (read pool
with 20 conns + write pool with 1 conn per database file). Evicts
least-recently-used pools when capacity is reached.
platformOrgDBResolver middleware (priority loadAuthToken+4):
- Reads X-Org-Id and X-User-Id headers (set by upstream middleware)
- Resolves or auto-provisions the org/user SQLite file
- Stores DBPool in request context via re.Set("orgDB"/"userDB")
- Services are fully stateless — any instance serves any org/user
File layout:
{DataDir}/orgs/{orgId}/org.db
{DataDir}/orgs/{orgId}/users/{userId}/data.db
Activated when OrgIsolation="sqlite" in PlatformConfig.
Publishable keys (pk-) are restricted to GET/HEAD/OPTIONS.
Any write method (POST/PUT/DELETE) returns 403 with clear error.
Secret keys (sk-), IAM keys (hk-), and JWTs have no method restriction.
Enforcement runs at priority +3 (after identity resolution, before handlers).
Every Base app gets this for free — zero per-route code needed.
Every Base app now supports IAM-managed API keys (hk-/pk-/sk-) natively.
Keys are created and managed in IAM — Base resolves them via IAM's
GET /api/get-user?accessKey= endpoint (cached 5min).
Auth chain: JWKS JWT → IAM API key → unauthenticated
Key types:
pk-/pk_ = publishable (frontend-safe, read-only)
sk-/sk_ = secret (backend-only, full access)
hk- = IAM key (legacy, full access)
Gateway validates JWTs statelessly via JWKS.
Base validates API keys via IAM (one canonical key store).
One way to do auth. IAM is the source of truth.
Optional luxfi/compliance integration for KYC/AML, sanctions screening,
and payment validation. Enabled by setting ComplianceEndpoint in
PlatformConfig. Adds 5 API routes under /api/platform/compliance/*.
No new Go dependencies — uses HTTP client to call compliance service.
zeekay