Add per-user API keys and a read-only /api/v1 surface for scripted access, served with your stored Reddit credential.
- Per-user API keys, generated, rotated, and revoked from the dashboard, authenticating
/api/v1without a browser session - API requests reuse the key owner's stored Reddit credential (burner bearer token or cookie), so automations share lurker's authenticated session instead of hitting Reddit anonymously and getting rate limited
- Endpoints for subreddit listings, the subscription home feed, comment threads, search, subreddit metadata, and subscriptions, each available as an Atom feed shaped like Reddit's own
.rss, as normalized JSON, or as Reddit's raw listing JSON via?raw=1 API_WHITELISTgates the API by source address, matching the direct TCP peer rather than the caller-controlledX-Forwarded-For, and defaults to loopback only so a fresh install is reachable only from inside the container; accepts plain IPs, IPv4/IPv6 CIDR ranges,off, or*API_RATE_LIMITgives the API its own budget (default 600 per 15 minutes), keyed on that same peer address so a forwarded header cannot rotate around it- Keys passed as
?api_key=are redacted from logs, error messages, and the Atomrel="self"link so they do not persist in feed readers - Listing params are allowlisted (
limit1-100,after/before,t,raw); an unknown sort in the path is rejected rather than silently serving a different listing - Database migration:
add-api-key-column
Validation:
- 63/63 Bun tests pass (34 new, covering the whitelist, key lifecycle, credential passthrough, feed rendering, and input validation)
- All 20 Pug templates compile
- Biome clean on every file this release touches; the remaining findings are pre-existing and unchanged
- Nix package build passes, producing
lurker-0.3.0 - Generated Atom feeds parse as well-formed XML, with quoted markup staying inert
- Docker amd64/arm64 publish and CodeQL completed successfully
Full changelog: v0.2.4...v0.3.0