4.1 Two isolated API surfaces
momo-ticket-system exposes two completely separate route trees with no shared middleware:
/api/* (JWT) | /api/ext/* (API key) | |
|---|---|---|
| Users | people signed in on the web (Zitadel SSO) | service-account-style external clients (e.g. cogwork, Jenkins pipelines) |
| Authentication | Authorization JWT, expires after 9 hours | X-API-Key: mtk_xxxx…, with an optional expiry, revocable |
| Permission model | roles (General_User / Deploy_User / Admin) | scopes (releases:read, config-server:write, …) |
| Who uses it | momo-ticket-system's own web front-end | momo-cogwork, Jenkins pipeline reporting |
momo-cogwork only uses /api/ext/*: it is a desktop client with no user session, so it inherently does not fit the JWT middleware's assumption that "there is a signed-in user".