Release 2.16.1

docs/technical/schema.md

@@ -194,7 +194,8 @@ Tables generally use a numeric auto-increment `id` primary key. The relationship
 
 - `i_rss_feeds` - RSS feed definitions and refresh cadence.
 - `i_rss_feed_items` - cached RSS feed items.
-- `i_api_sources` - API source definitions and last response snapshot.
+- `i_api_source_groups` - API source names and shared authentication settings.
+- `i_api_sources` - named requests, independent refresh settings, and last response snapshots.
 - `i_weather_locations` - configured weather locations and last response snapshot.
 - `i_timetable_groups` - grouped timetable definitions used by the timetable region.
 - `i_timetable_entries` - dated entries that belong to a timetable group.
@@ -211,9 +212,18 @@ Tables generally use a numeric auto-increment `id` primary key. The relationship
 - Unique key:
         - `(rss_feed_id, position)`
 
+### `i_api_source_groups`
+
+- `id`, `name`, `auth_method`, `auth_username`, `auth_password`, `auth_bearer_token`, `auth_header_name`, `auth_header_value`, `token_url`, `token_request_body_json`, `token_response_path`, `token_refresh_url`, `token_refresh_request_body_json`, `token_refresh_response_path`, `token_header_name`, `token_header_prefix`, `created_at`, `created_by`, `modified_at`, `modified_by`
+- Unique group name; authentication applies to every child request. `auth_method = 'none'` supports public endpoints. Token caches are keyed by group and authentication configuration.
+
 ### `i_api_sources`
 
-- `id`, `name`, `api_url`, `auth_method`, `auth_username`, `auth_password`, `auth_bearer_token`, `auth_header_name`, `auth_header_value`, `token_url`, `token_request_body_json`, `token_response_path`, `token_refresh_url`, `token_refresh_request_body_json`, `token_refresh_response_path`, `token_header_name`, `token_header_prefix`, `items_path`, `update_interval_value`, `update_interval_unit`, `enabled`, `last_pulled_at`, `last_pull_error`, `last_response_status`, `last_response_content_type`, `last_response_json`, `created_at`, `created_by`, `modified_at`, `modified_by`
+- `id`, `auth_source_id`, `name`, `api_url`, `request_method`, `request_body_json`, `items_path`, `update_interval_value`, `update_interval_unit`, `enabled`, `last_pulled_at`, `last_pull_error`, `last_response_status`, `last_response_content_type`, `last_response_json`, `created_at`, `created_by`, `modified_at`, `modified_by`
+- `auth_source_id` references `i_api_source_groups.id` with restricted parent deletion. The web application requires at least one request per group and unique request names within each group.
+- Request IDs remain the `source_id` stored in slide regions and the keys used by scheduled refreshes. Removing a request used by a slide is blocked.
+- The 2.16.1 migration copies each existing source's authentication into a same-ID parent group and links the original request without changing its ID or response snapshot. Legacy authentication columns remain on request rows for schema compatibility but runtime authentication is loaded from the parent.
+- Editor/player request lists exclude authentication credentials. Refreshes resolve current parent authentication at execution time.
 
 ### `i_weather_locations`
 
@@ -321,6 +331,8 @@ erDiagram
         }
         I_API_SOURCES {
         }
+        I_API_SOURCE_GROUPS {
+        }
         I_WEATHER_LOCATIONS {
         }
         I_TIMETABLE_GROUPS {
@@ -343,6 +355,7 @@ erDiagram
         A_USERS ||--o{ A_SESSIONS : owns
         A_USERS ||--o{ A_ACCOUNT_TOKENS : has
         A_USERS o|--o{ O_AUDIT_EVENTS : acts
+        I_API_SOURCE_GROUPS ||--o{ I_API_SOURCES : contains
 
         C_CANVAS_SIZES o|--o{ C_TEMPLATES : used_by
         C_CANVAS_SIZES o|--o{ C_PLAYLISTS : used_by