- Parse JWT 'exp' claim to track token expiry (token_expires_at)
- Proactively refresh Bearer tokens 1 hour before expiry in
ensure_authenticated()
- Refresh response without expires_in now falls back to JWT exp for
expiry derivation
- Support custom refresh_path via bearer auth_config whitelist
- Unify 401 fallback: all bearer types (including Sub2API) now go
through _refresh_bearer_token() instead of separate old path
- Remove dead _is_sub2api_bearer() / _refresh_sub2api_bearer_token()
- Add 2 new tests: refresh_path override + JWT exp backfill
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Add linked_upstream_id to CustomPage model with DB migration
- New POST /api/custom-pages/{pid}/refresh-auth endpoint extracts
credentials from active remote browser and updates linked upstream
- PageViewer toolbar shows key icon button when page has linked upstream
- CustomPages form adds upstream dropdown for remote_browser pages
- Auth capture extracts New-Api-User from localStorage uid/user/self API
- Upstream client sends New-Api-User header in cookie auth mode
- Fix auth capture dialog: transparent background, field persistence,
login URL defaults to base_url/login, focus on click for keyboard input
- Fix upstream test ASCII encoding with non-header characters validation
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- UpstreamClient & Sub2ApiWebsiteClient: add __enter__/__exit__
- Convert all call sites to `with Client(...) as c:` pattern
- Remove unused `upstream_name`/`upstream_base_url` locals in scheduler
- Fix stale _decimal_str→decimal_string in _rate_from_group
Enable managed remote browser custom pages with login autofill and add website sync workflows so external admin surfaces can be handled inside SmartUp.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
