範圍：
api/auth、api/user_auth_provider、api/captcha。 只列 WRITE 方法（post/put/delete/patch）與敏感 GET（download/sample、otp-qrcode、totp-secret、token）。 URL prefix =/api/1.0。純事實盤點，不做 axis 判定。 掃描 branch：fix/v1.8.0-bugs。
「現況守門」定義：無 JWT / 僅 JWT / 僅 JWT (delegate jedi-auth package service, 主專案無守門) / 已有: <guard> @ <file:line>。 所有 route 皆為 thin wrapper；已 TRACE 進主專案 app/auth/service/... service，確認無任何 require_platform_admin / require_super_admin / assert_project_manager / 手動 ForbiddenError(role/is_admin) 守門。
| Route path | Method | Route file:line | @jwt_required? | 呼叫的 service method | 現況守門 | 備註 |
|---|---|---|---|---|---|---|
/api/1.0/login |
POST | api/auth/routes/login_route.py:39 (LoginRoute) |
否 | app/auth/service/login_service.py:LoginService.process_login (主專案，wrap jedi_login) + CaptchaService.verify_turnstile_token |
無 JWT | 公開端點(login)，intentional；先驗 turnstile captcha |
/api/1.0/refresh |
POST | api/auth/routes/login_route.py:104 (LoginRefreshRoute) |
是 (@jwt_required(refresh=True)) |
jedi_login...LoginTokenService.refresh_user_token (jedi 套件) |
僅 JWT (delegate jedi package service, 主專案無守門) | 公開流程(refresh)，靠 refresh token；jedi-login package service |
/api/1.0/logout |
POST | api/auth/routes/login_route.py:115 (LogoutRoute) |
是 | jedi_login...LoginTokenService.revoke_token (jedi 套件) |
僅 JWT (delegate jedi package service, 主專案無守門) | 自己登出，僅需 JWT |
/api/1.0/users |
POST | api/auth/routes/user_route.py:43 (UsersRoute) |
是 | app/auth/service/user_app_service.py:19 UserAppService.get_users_and_pager (主專案) |
僅 JWT | POST 實為分頁查詢(讀)；service 無守門(user_app_service.py:19) |
/api/1.0/user, /api/1.0/user/<uid> |
POST | api/auth/routes/user_route.py:80 (UserRoute) |
是 | jedi_auth...UserService.add_user (jedi 套件) |
僅 JWT (delegate jedi-auth package service, 主專案無守門) | 新增使用者；route/service 皆無角色守門 |
/api/1.0/user, /api/1.0/user/<uid> |
PUT | api/auth/routes/user_route.py:95 (UserRoute) |
是 | jedi_auth...UserService.update_user(is_admin=curr_user.is_admin,...) (jedi 套件) |
僅 JWT (delegate jedi-auth package service, 主專案無守門) | 更新使用者；is_admin 僅作 param 傳入 jedi service，route 層不擋 |
/api/1.0/user, /api/1.0/user/<uid> |
DELETE | api/auth/routes/user_route.py:107 (UserRoute) |
是 | jedi_auth...UserService.update_user_status(uid, REVOKE) (jedi 套件) |
僅 JWT (delegate jedi-auth package service, 主專案無守門) | 撤銷使用者(軟刪)；無角色守門 |
/api/1.0/user-profile/<uid> |
PUT | api/auth/routes/user_route.py:146 (UserProfileRoute) |
是 | jedi_auth...UserService.update_user (jedi 套件) |
已有: if uid != current_user.uid: raise UnauthorizedError @ api/auth/routes/user_route.py:148-149 |
僅限本人改自己 profile；route 內建 self-check(非 role guard) |
/api/1.0/user/change-status/<uid> |
POST | api/auth/routes/user_route.py:135 (UserChangeStatusRoute) |
是 | jedi_auth...UserService.update_user_status(uid, status) (jedi 套件) |
僅 JWT (delegate jedi-auth package service, 主專案無守門) | 任意使用者可改他人狀態；無角色守門 |
/api/1.0/user/batch-upload |
POST | api/auth/routes/user_import_route.py:85 (UserBatchUploadRoute) |
是 | jedi_auth...ImportUserService.check_upload_payload + UserService.add_user (jedi 套件) |
僅 JWT (delegate jedi-auth package service, 主專案無守門) | 批次新增使用者；無角色守門 |
/api/1.0/user/validate |
POST | api/auth/routes/user_import_route.py:52 (UserValidateRoute) |
是 | jedi_auth...ImportUserService.check_excel_user_data (jedi 套件) |
僅 JWT (delegate jedi-auth package service, 主專案無守門) | 上傳資料單筆驗證(不寫入)；無角色守門 |
/api/1.0/user/download/sample |
GET | api/auth/routes/user_import_route.py:64 (UserUploadSampleDownloadRoute) |
是 | app/auth/service/user_import_template_app_service.py:49 UserImportTemplateAppService.generate (主專案) |
僅 JWT | 敏感 GET(download/sample)；依下載者權限動態產生 scoped 內容，service 無 role guard(user_import_template_app_service.py:49) |
/api/1.0/users/upload |
POST | api/auth/routes/user_import_route.py:33 (UserUploadRoute) |
是 | jedi_auth...ImportUserService.import_user_from_excel (jedi 套件) |
僅 JWT (delegate jedi-auth package service, 主專案無守門) | Excel 批次上傳(寫入)；無角色守門 |
/api/1.0/roles |
POST | api/auth/routes/role_route.py:38 (RolesRoute) |
是 | app/auth/service/role_app_service.py:18 RoleAppService.get_roles_and_pager (主專案) |
僅 JWT | POST 實為分頁查詢(讀)；service 無守門(role_app_service.py:18) |
/api/1.0/role/<uid>, /api/1.0/role |
POST | api/auth/routes/role_route.py:67 (RoleRoute) |
是 | jedi_auth...RoleService.add_role (jedi 套件) |
僅 JWT (delegate jedi-auth package service, 主專案無守門) | 新增角色；無角色守門 |
/api/1.0/role/<uid>, /api/1.0/role |
PUT | api/auth/routes/role_route.py:80 (RoleRoute) |
是 | jedi_auth...RoleService.update_role (jedi 套件) |
僅 JWT (delegate jedi-auth package service, 主專案無守門) | 更新角色；無角色守門 |
/api/1.0/role/<uid>, /api/1.0/role |
DELETE | api/auth/routes/role_route.py:92 (RoleRoute) |
是 | jedi_auth...RoleService.delete_role (jedi 套件) |
僅 JWT (delegate jedi-auth package service, 主專案無守門) | 刪除角色；無角色守門 |
/api/1.0/role/status/<uid> |
PUT | api/auth/routes/role_route.py:103 (RoleStatusRoute) |
是 | jedi_auth...RoleService.change_role_status (jedi 套件) |
僅 JWT (delegate jedi-auth package service, 主專案無守門) | 變更角色狀態；無角色守門 |
/api/1.0/tenants |
POST | api/auth/routes/tenant_route.py:48 (TenantsRoute) |
是 | jedi_auth...TenantService.get_tenants_and_pager (jedi 套件) |
僅 JWT (delegate jedi-auth package service, 主專案無守門) | POST 實為分頁查詢(讀)；無守門 |
/api/1.0/tenant, /api/1.0/tenant/<uid> |
POST | api/auth/routes/tenant_route.py:77 (TenantRoute) |
是 | app/auth/service/tenant_provisioning_service.py:57 TenantProvisioningService.add_tenant_with_defaults (主專案) |
僅 JWT | 新增租戶(連帶 seed 部門+管理員角色)；service TRACE 確認無守門(tenant_provisioning_service.py:57-85) |
/api/1.0/tenant, /api/1.0/tenant/<uid> |
PUT | api/auth/routes/tenant_route.py:106 (TenantRoute) |
是 | jedi_auth...TenantService.update_tenant (jedi 套件) |
僅 JWT (delegate jedi-auth package service, 主專案無守門) | 修改租戶；無角色守門 |
/api/1.0/tenant, /api/1.0/tenant/<uid> |
DELETE | api/auth/routes/tenant_route.py:118 (TenantRoute) |
是 | jedi_auth...TenantService.delete_tenant (jedi 套件) |
僅 JWT (delegate jedi-auth package service, 主專案無守門) | 刪除租戶；無角色守門 |
/api/1.0/org-units |
POST | api/auth/routes/org_unit_route.py:40 (OrgUnitsRoute) |
是 | jedi_auth...OrgUnitService.get_org_units_and_pager (jedi 套件) |
僅 JWT (delegate jedi-auth package service, 主專案無守門) | POST 實為分頁查詢(讀)；無守門 |
/api/1.0/org-unit, /api/1.0/org-unit/<uid> |
POST | api/auth/routes/org_unit_route.py:66 (OrgUnitRoute) |
是 | jedi_auth...OrgUnitService.add_org_unit (jedi 套件) |
僅 JWT (delegate jedi-auth package service, 主專案無守門) | 新增組織單位；無角色守門 |
/api/1.0/org-unit, /api/1.0/org-unit/<uid> |
PUT | api/auth/routes/org_unit_route.py:79 (OrgUnitRoute) |
是 | jedi_auth...OrgUnitService.update_org_unit (jedi 套件) |
僅 JWT (delegate jedi-auth package service, 主專案無守門) | 修改組織單位；無角色守門 |
/api/1.0/org-unit, /api/1.0/org-unit/<uid> |
DELETE | api/auth/routes/org_unit_route.py:91 (OrgUnitRoute) |
是 | jedi_auth...OrgUnitService.delete_org_unit (jedi 套件) |
僅 JWT (delegate jedi-auth package service, 主專案無守門) | 刪除組織單位；無角色守門 |
/api/1.0/user/change-pwd-req/<uid> |
GET | api/auth/routes/change_password_route.py:51 (UserChangePasswordRequestRoute) |
否 | jedi_auth...UserChangePasswordService.verify_and_get_user_change_password_request (jedi 套件) |
無 JWT | 取忘記密碼申請資料(靠 req uid 為 secret)；公開流程(forget-password 一環) |
/api/1.0/user/change-pwd-by-req |
POST | api/auth/routes/change_password_route.py:21 (ChangePasswordByChangeRequestRoute) |
否 | jedi_auth...UserChangePasswordService.change_password_by_request (jedi 套件) |
無 JWT | 憑 req_uid 改密碼；公開流程(forget-password)，intentional |
/api/1.0/forget-password |
POST | api/auth/routes/change_password_route.py:39 (ForgetPasswordRoute) |
否 | jedi_auth...UserChangePasswordService.request_change_password (jedi 套件) |
無 JWT | 公開端點(forget-password)，intentional |
/api/1.0/totp-secret |
POST | api/auth/routes/otp_route.py:27 (TotpSecretRoute) |
是 | jedi_auth...UserService.get_user + jedi_mfa...TotpMfaService.register (jedi 套件) |
僅 JWT (delegate jedi package service, 主專案無守門) | 敏感 GET/寫(totp-secret，取本人 TOTP secret)；用 get_user_context() 綁本人 |
/api/1.0/otp-qrcode/<uid> |
GET | api/auth/routes/otp_route.py:48 (TotpQrcodeRoute) |
否 | jedi_auth...UserService.get_user(uid) + jedi_mfa...TotpMfaService.get_register_qr_code_img (jedi 套件) |
無 JWT | 敏感 GET(otp-qrcode 無 JWT) — 已確認 route 無 @jwt_required，任意 uid 皆可取 TOTP 註冊 QR(SEC A-族) |
/api/1.0/otp-verify |
POST | api/auth/routes/otp_route.py:66 (MfaVerifyRoute) |
否 | jedi_mfa...(Totp/Email)MfaService.verify_otp + jedi_login...LoginService.generate_jwt_token (jedi 套件) |
無 JWT | 公開流程(MFA 驗證，登入第二步發 token)，intentional |
/api/1.0/otp-resend |
POST | api/auth/routes/otp_route.py:118 (OtpCodeResendRoute) |
否 | jedi_auth...UserService.get_user + jedi_mfa...EmailMfaService.gen_mfa_code (jedi 套件) |
無 JWT | 公開流程(otp-resend)，intentional |
/api/1.0/send-user-test-mail |
POST | api/auth/routes/user_route.py:161 (SendTestMailFromJediAuth) |
否 | jedi_auth...UserService.test_send_mail(hardcoded email) (jedi 套件) |
無 JWT | 無 @jwt_required（只有 @inject）；寄測試信到 hardcoded 地址；用 get_user_context() 但不擋未認證(可能 debug 殘留) |
| Route path | Method | Route file:line | @jwt_required? | 呼叫的 service method | 現況守門 | 備註 |
|---|---|---|---|---|---|---|
/api/1.0/auth-provider, /api/1.0/auth-provider/<uid> |
POST | api/user_auth_provider/routes/user_auth_provider_route.py:42 (UserAuthProviderRoute) |
是 | jedi_login...UserAuthProviderService.register_user_auth_provider (jedi 套件) |
僅 JWT (delegate jedi package service, 主專案無守門) | 新增使用者第三方登入註冊(可指定任意 user_uid)；無角色守門 |
/api/1.0/auth-provider, /api/1.0/auth-provider/<uid> |
DELETE | api/user_auth_provider/routes/user_auth_provider_route.py:82 (UserAuthProviderRoute) |
是 | jedi_login...UserAuthProviderService.delete_user_auth_provider (jedi 套件) |
僅 JWT (delegate jedi package service, 主專案無守門) | 刪除第三方登入註冊；無角色守門 |
/api/1.0/ldap/connect-test |
POST | api/user_auth_provider/routes/ldap_route.py:19 (LdapConnectTestRoute) |
是 | app/user_auth_provider/service/ldap_service.py:22 LdapService.test_connect (主專案) |
僅 JWT | 測試 LDAP 連線(不寫入)；service TRACE 確認無守門(ldap_service.py:22) |
| Route path | Method | Route file:line | @jwt_required? | 呼叫的 service method | 現況守門 | 備註 |
|---|---|---|---|---|---|---|
/api/1.0/verify-captcha |
POST | api/captcha/routes/captcha_route.py:41 (VerifyCaptchaRoute) |
否 | jedi_captcha...CaptchaService.verify_graph_captcha (jedi 套件) |
無 JWT | 公開端點(captcha 驗證，登入前置)，intentional |
註：
GET /api/1.0/captcha（captcha_route.py:25）為圖形驗證碼產生(讀，公開)，非 WRITE 亦非清單指定的敏感 GET，未列入。