OpenSparrow Files

Added

• External API module (Admin → System → API) — admins define read-only API keys, each bound to one schema table with a chosen column set, fixed server-side filters and a row limit.
• public/api/external.php endpoint — external services authenticate with Authorization: Bearer <key> and receive JSON rows; the endpoint accepts no table, column or filter names from the client.
• Encrypted key storage — keys are stored encrypted (key_enc) plus an HMAC key_hash for constant-time lookup, and are never returned to the browser after generation (shown once in a modal).
• Usage statistics — a new spw_external_api_log table records each successful request (API, table, rows returned, duration), with a stats/log view and purge action in the admin module.

Changed

• includes/db.php gained sys_table_prefix() / is_system_table() helpers so the endpoint can refuse system (spw_) tables.
• includes/crypto.php gained secret_hash() (HMAC-SHA256) for key matching without decrypting every entry.

Removed

• Nothing.

Fixed

• nginx and Apache configs now forward the Authorization header to PHP (fastcgi_param HTTP_AUTHORIZATION / SetEnvIf), so Bearer auth works out of the box.

Upgrade notes

• No database migration and no configuration keys are removed by this release. The external_api config key is created on first save; an unknown key is ignored, so the document upgrades itself.

Full changelog: https://github.com/wrobeltomasz/OpenSparrow/compare/3.5...3.6