8a574de915
The API key used to live only in process memory, so restarting Studio, switching models, or toggling Disable/Enable silently invalidated every external client that was using it. Users had to reopen the dialog, copy the new key, and update their scripts each time. Key state is now stored at ~/.unsloth/studio/auth/access_endpoint.json (atomic write, mode 0600). The file survives backend restarts and model load/unload. Disable preserves the key on disk and only clears it from app.state, so Enable brings the same key back. Loading a different GGUF keeps the endpoint running transparently under the new model identifier. Rotation is an explicit user action: a new JWT-protected POST /access-endpoint/regenerate route mints a fresh key and is wired to a "Regenerate" button next to the API Key field in the dialog. Deliberately not dual-auth so a leaked key cannot rotate itself. |
||
|---|---|---|
| .. | ||
| assets | ||
| auth | ||
| core | ||
| loggers | ||
| models | ||
| plugins | ||
| requirements | ||
| routes | ||
| state | ||
| storage | ||
| tests | ||
| utils | ||
| __init__.py | ||
| _platform_compat.py | ||
| colab.py | ||
| main.py | ||
| run.py | ||
| startup_banner.py | ||