Adds a scope-based access control layer to all 81 existing API routes.
Sits alongside existing session-cookie auth (does not replace it).
What this PR does:
- Audits every existing route and documents required scope per route
(see documentation/auth/route-scope-audit.md)
- Adds classes/auth/scope.php with 10 scope constants and role→scope defaults
- Adds classes/auth/scope_middleware.php with requireScope/requireAnyScope/requireRole
- Applies require*() calls to all 81 existing routes
- Adds ScopeMiddlewareTest (unit, 178 lines) and RouteScopeTest (integration, 212 lines)
Coexistence note:
This branch's classes/auth/scope.php is a stub that will be replaced
by classes/auth/scope_registry.php (from TRU-145 / PR #396) when that
PR merges first. The two have compatible APIs.
Refs: TRU-149
- Introduced `uploadRoute` to handle image uploads with MIME type validation and size restrictions.
- Added `upload_store` class for managing file storage and generating presigned URLs for upload/download.
- Enhanced file server to differentiate between PDFs and uploaded files, supporting dynamic content delivery.
- Integrated OpenAI module for License Plate Recognition (LPR), including API configuration and schema validation.
- Updated core structure with new interfaces (`minio_uploads_i`, `openai_i`) and classes (`openai`, `upload_store`).
- Adjusted `index.php` and file routes to support dynamic MIME checks and direct link generation.
OpenClaw