v0.10.0
thevoiceguy/siphon-aiv0.10.0Jun 19, 2026by thevoiceguy
Upgrading?
AI Summary
Introduces native authentication and role-based access control (RBAC) for the admin API, separating it from the metrics listener. This release enhances security by requiring bearer tokens for admin access and introduces audit logging capabilities.
Key Highlights
- Native Admin Auth + RBAC with three nested roles (readonly, operator, admin).
- Tokens are hashed (SHA-256) and never logged to prevent credential leakage.
- Separation of concerns: Admin API moved to a dedicated `[admin].listen` port.
- Audit logging enabled for all admin requests with Prometheus metrics.
Breaking Changes
- /admin/* routes moved off the metrics listener to a dedicated admin port.
- Admin endpoints now require bearer token authentication (401/403 responses).
- Admin listener defaults to plain HTTP until TLS support is added.
New Features
- Bearer token authentication with role enforcement (readonly, operator, admin).
- Structured audit logging tracking actor, role, endpoint, and result.
- Prometheus metrics (`siphon_ai_admin_requests_total`) for monitoring.
- Dedicated HTTP listener configuration block (`[[admin.token]]`).
Full Release Notes
Native authentication + role-based access control for the admin API. **This is a breaking release** — see the migration note below.
## Added
- **Admin auth + RBAC.** `/admin/*` is gated by bearer tokens with three nested roles — `readonly` ⊂ `operator` ⊂ `admin`. Tokens live under a new `[admin]` config block (`[[admin.token]] { name, token, role }`), are hashed (SHA-256) at load and compared in constant time, and the secret is never logged. Endpoint→minimum-role:
- `readonly` — all GET/list routes (calls, registrations, log, conferences, parked)
- `operator` — hangup, park/retrieve, conference create/end/add/remove
- `admin` — **billable** origination (`POST /admin/v1/calls`), `PUT /admin/log`, `POST /admin/hep/test`
Missing/invalid token → `401` (+ `WWW-Authenticate: Bearer`); role below the minimum → `403`. Config validated at load (no tokens / empty or duplicate name / empty secret / unknown role / bad listen → fail at startup).
- **Audit + metric.** Every admin request emits a structured log line (actor = token *name*, role, endpoint template, result, peer — never the secret) and ticks `siphon_ai_admin_requests_total{endpoint, role, result}`.
## Changed — BREAKING
- **`/admin/*` moved off the metrics listener** onto the dedicated `[admin].listen`. The `[observability].http_listen` port now serves only `/metrics`, `/health`, `/ready` and returns `404` for `/admin/*`.
**Migration:** add an `[admin]` block with ≥1 token, repoint admin tooling at the new port with an `Authorization: Bearer …` header, and drop any `/admin/*` allow rules (or front-proxy auth) from the metrics port. **Omit `[admin]` and `/admin/*` is not served at all** (secure default) — the daemon still starts and serves metrics/health. The admin listener is plain HTTP for now (`[admin].tls` is a planned follow-up); bind it on loopback or front it with TLS termination.
Docs: `docs/CONFIG.md` `[admin]`; `docs/DEPLOY.md` → *Admin API* / *Admin auth & RBAC*.
🤖 Generated with [Claude Code](https://claude.com/claude-code)Related Repositories
A cross-platform desktop All-in-One assistant for Claude Code, Codex, OpenCode, OpenClaw, Grok Build & Hermes Agent. Only official website: ccswitch.io
An open-source remote desktop application designed for self-hosting, as an alternative to TeamViewer.
Build smaller, faster, and more secure desktop and mobile applications with a web frontend.
π RuView turns commodity WiFi signals into real-time spatial intelligence, vital sign monitoring, and presence detection — all without a single pixel of video.
Incredibly fast JavaScript runtime, bundler, test runner, and package manager – all in one