Release 2.16.1

docs/technical/schema.md

@@ -194,7 +194,8 @@ Tables generally use a numeric auto-increment `id` primary key. The relationship
 
 - `i_rss_feeds` - RSS feed definitions and refresh cadence.
 - `i_rss_feed_items` - cached RSS feed items.
-- `i_api_sources` - API source definitions and last response snapshot.
+- `i_api_source_groups` - API source names and shared authentication settings.
+- `i_api_sources` - named requests, independent refresh settings, and last response snapshots.
 - `i_weather_locations` - configured weather locations and last response snapshot.
 - `i_timetable_groups` - grouped timetable definitions used by the timetable region.
 - `i_timetable_entries` - dated entries that belong to a timetable group.
@@ -211,9 +212,18 @@ Tables generally use a numeric auto-increment `id` primary key. The relationship
 - Unique key:
         - `(rss_feed_id, position)`
 
+### `i_api_source_groups`
+
+- `id`, `name`, `auth_method`, `auth_username`, `auth_password`, `auth_bearer_token`, `auth_header_name`, `auth_header_value`, `token_url`, `token_request_body_json`, `token_response_path`, `token_refresh_url`, `token_refresh_request_body_json`, `token_refresh_response_path`, `token_header_name`, `token_header_prefix`, `created_at`, `created_by`, `modified_at`, `modified_by`
+- Unique group name; authentication applies to every child request. `auth_method = 'none'` supports public endpoints. Token caches are keyed by group and authentication configuration.
+
 ### `i_api_sources`
 
-- `id`, `name`, `api_url`, `auth_method`, `auth_username`, `auth_password`, `auth_bearer_token`, `auth_header_name`, `auth_header_value`, `token_url`, `token_request_body_json`, `token_response_path`, `token_refresh_url`, `token_refresh_request_body_json`, `token_refresh_response_path`, `token_header_name`, `token_header_prefix`, `items_path`, `update_interval_value`, `update_interval_unit`, `enabled`, `last_pulled_at`, `last_pull_error`, `last_response_status`, `last_response_content_type`, `last_response_json`, `created_at`, `created_by`, `modified_at`, `modified_by`
+- `id`, `auth_source_id`, `name`, `api_url`, `request_method`, `request_body_json`, `items_path`, `update_interval_value`, `update_interval_unit`, `enabled`, `last_pulled_at`, `last_pull_error`, `last_response_status`, `last_response_content_type`, `last_response_json`, `created_at`, `created_by`, `modified_at`, `modified_by`
+- `auth_source_id` references `i_api_source_groups.id` with restricted parent deletion. The web application requires at least one request per group and unique request names within each group.
+- Request IDs remain the `source_id` stored in slide regions and the keys used by scheduled refreshes. Removing a request used by a slide is blocked.
+- The 2.16.1 migration copies each existing source's authentication into a same-ID parent group and links the original request without changing its ID or response snapshot. Legacy authentication columns remain on request rows for schema compatibility but runtime authentication is loaded from the parent.
+- Editor/player request lists exclude authentication credentials. Refreshes resolve current parent authentication at execution time.
 
 ### `i_weather_locations`
 
@@ -321,6 +331,8 @@ erDiagram
         }
         I_API_SOURCES {
         }
+        I_API_SOURCE_GROUPS {
+        }
         I_WEATHER_LOCATIONS {
         }
         I_TIMETABLE_GROUPS {
@@ -343,6 +355,7 @@ erDiagram
         A_USERS ||--o{ A_SESSIONS : owns
         A_USERS ||--o{ A_ACCOUNT_TOKENS : has
         A_USERS o|--o{ O_AUDIT_EVENTS : acts
+        I_API_SOURCE_GROUPS ||--o{ I_API_SOURCES : contains
 
         C_CANVAS_SIZES o|--o{ C_TEMPLATES : used_by
         C_CANVAS_SIZES o|--o{ C_PLAYLISTS : used_by

docs/user/guide-data-sources.md

@@ -25,7 +25,9 @@ When an RSS feed fails, open the latest-items preview and check the reported pul
 
 ## API Sources
 
-An API source connects to a JSON endpoint and can use either GET or POST:
+An API source groups one or more named requests under shared authentication. Use **Add request** to create separate cards for endpoints such as event information and donors. Each request has its own URL, method, items path, enabled state, refresh interval, latest response, and **Test Connection** / **Refresh now** actions. Save the source to persist added, edited, or removed requests. A request used by a slide cannot be removed.
+
+Each request can use either GET or POST:
 
 - **GET:** retrieve data directly from the API URL.
 - **POST:** send a JSON request body with the request.
@@ -40,10 +42,18 @@ API authentication supports:
 - An API key sent in a named header.
 - A login-then-token flow for services that issue a token from a login request.
 
+Authentication applies to every request in the source. Choose **None** for public endpoints. Token-login requests share one cached token and refresh it as needed. **Test Authentication** checks the shared settings without calling a data endpoint; Basic, Bearer, and API-key settings also need a request test to verify provider acceptance. Slides select a request by its **source / request** name. Existing request IDs and slide bindings are preserved when upgrading.
+
 For a login-then-token source, configure the login URL, JSON login body, token response path, and token header. If the service supports token refresh, configure the refresh URL, refresh-token response path, refresh body, and token prefix as required by that service. Keep credentials and tokens out of slide content and request examples that will be shared with other users.
 
 After a pull, review the latest response details, including the last-pulled time, HTTP status, content type, and stored JSON response. Use the response structure to choose the item number, items path, and fields used by an API region.
 
+Use **Test Connection** on the add or edit form to test the current field values without saving them or replacing the stored response. Token-login tests obtain a fresh token without replacing the token used by scheduled refreshes. Results separate authentication, the data request, and JSON/items extraction, with HTTP status, duration, content type, sanitised JSON previews, and a sample of available field paths. Each request has a 15-second timeout.
+
+An **Authentication: HTTP 404** means the token request received a not-found response before the data endpoint was called. Check the **Login / token URL**, API version, and provider documentation first. For a 401, check credentials; for a 403, check token scopes and application permissions. Token requests currently use POST with a JSON body, so confirm that format is supported by the provider.
+
+Use **Copy diagnostic report** to share the results. Known credentials and token values are redacted, URL query strings are omitted, and non-JSON response bodies are withheld. Previews are limited to 12,000 characters. Review reports for other private application data before sharing them.
+
 ## Timetables
 
 A timetable group contains the events that a timetable region displays. Configure: