fix: activation WebAuthn impossible BUG-070 (rp_id/origines derives requete, challenges multiples)

fix: login 2FA bloque sans erreur BUG-069 (challenge montait dans .login-box inexistant -> .login-card + erreur visible)
fix: section Securite du compte incomplete BUG-068 (boutons theme, QR local, mot de passe, recovery WebAuthn)
2026-09-22 20:54:01 -04:00 · 2026-09-22 20:38:37 -04:00 · 2026-09-22 20:07:25 -04:00 · 2026-09-22 19:04:26 -04:00 · 2026-09-22 14:48:51 -04:00
33 changed files with 2107 additions and 139 deletions
@@ -16,7 +16,7 @@ OBSIGATE_ADMIN_PASSWORD=chab30
 # OBSIGATE_SECURE_COOKIES=false

 # Tokens TTL en secondes
-# OBSIGATE_ACCESS_TOKEN_TTL=900
+# OBSIGATE_ACCESS_TOKEN_TTL=31536000000  # 1000 ans
 # OBSIGATE_REFRESH_TOKEN_TTL=604800

 # Rate limiting
@@ -51,7 +51,10 @@ OBSIGATE_ADMIN_PASSWORD=chab30
 # OBSIGATE_PDF_MAX_SIZE_MB=50        # PDFs plus volumineux = texte non indexé
 # OBSIGATE_PDF_EXTRACT_TIMEOUT=30    # secondes avant abandon de l'extraction

-# WebAuthn / MFA (ROADMAP #64) — nécessaire hors localhost
+# WebAuthn / MFA (ROADMAP #64) — par défaut rp_id/origines sont dérivés de la
+# requête (hôte exact, port inclus) : rien à configurer en accès direct.
+# À renseigner uniquement pour un accès via reverse-proxy sous un autre nom
+# (avec OBSIGATE_TRUST_PROXY=true pour X-Forwarded-Host/Proto) :
 # OBSIGATE_WEBAUTHN_RP_ID=obsigate.example.com
 # OBSIGATE_WEBAUTHN_RP_NAME=ObsiGate
 # OBSIGATE_WEBAUTHN_ORIGINS=https://obsigate.example.com
@@ -6,7 +6,7 @@ Format basé sur [Keep a Changelog](https://keepachangelog.com/fr/1.1.0/),
 et [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

 > **En cours de développement** : les changements à venir sont listés dans la section
-> [Unreleased](#unreleased). La dernière version livrée est **2.14.1**.
+> [Unreleased](#unreleased). La dernière version livrée est **2.16.3**.

 ---

@@ -14,6 +14,103 @@ et [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

 ---

+## [2.16.3] — 2026-09-22
+
+### Corrigé
+
+- **BUG-070 - Activation clé physique WebAuthn impossible (« Validation du
+  credential WebAuthn échouée »)** : deux causes. (1) Les valeurs par défaut
+  (`rp_id localhost`, origines `http://localhost` sans port) rejetaient toute
+  URL réelle — logs : `Unexpected client data origin "http://localhost:2020",
+  expected one of ['http://localhost']`. `rp_id`/origines sont désormais
+  dérivés de la requête (hôte exact, port inclus ; `X-Forwarded-Host/Proto`
+  si `OBSIGATE_TRUST_PROXY=true`), la config explicite restant prioritaire
+  (`backend/auth/webauthn_mfa.py::resolve_relying_party`, appliqué aux 4
+  endpoints d'enregistrement et de login). (2) Challenge à usage unique
+  fragile au double-clic/retry (`challenge was not expected`) : les 5
+  derniers challenges sont conservés et la vérification accepte le challenge
+  correspondant à la cérémonie en cours. `.env.example` documente le nouveau
+  comportement. Vérifié au navigateur avec authentificateur virtuel
+  (Playwright CDP, instance Docker) : enregistrement 200 + clé listée, puis
+  clé de test retirée. Tests : `tests/test_webauthn.py` (+8 : résolution RP,
+  forwarded, retry, roundtrip sans config).
+
+---
+
+## [2.16.2] — 2026-09-22
+
+### Corrigé
+
+- **BUG-069 - Login 2FA bloqué sans erreur** : après user+mot de passe corrects
+  sur un compte avec 2FA, la page de login restait affichée sans erreur et le
+  challenge MFA n'apparaissait jamais. Cause : `showMfaChallenge`
+  (`frontend/js/auth.js`) montait le challenge dans `.login-box`, inexistant
+  dans `index.html` (marquage réel : `#login-screen > .login-card`) →
+  `return` silencieux. Correctif : montage dans `.login-card` (repli
+  `#login-screen`) + erreur visible (`mfa.challenge_unavailable`, FR/EN) au
+  lieu d'un retour silencieux si le point de montage manque. Vérifié de bout
+  en bout au navigateur (Playwright, instance Docker) : challenge affiché,
+  code erroné → erreur, code valide → connecté. Tests :
+  `tests/frontend/mfa-settings.test.mjs` (+2 contrôles d'ancrage DOM).
+
+---
+
+## [2.16.1] — 2026-09-22
+
+### Corrigé
+
+- **BUG-068 - Configuration : section « 🔒 Sécurité du compte » inachevée** :
+  boutons `config-btn-primary` / `config-btn-danger` définis depuis les
+  variables du thème (`frontend/style.css`) ; QR code TOTP généré en local par
+  le backend (`POST /api/auth/mfa/totp/setup` → `qr_data_url`, SVG `data:`
+  via `segno`, `backend/requirements.txt`) au lieu de l'image tierce bloquée
+  par la CSP (`img-src 'self' data: blob:`, secret TOTP exposé) ; codes de
+  récupération affichés aussi à la première activation WebAuthn ; carte
+  « Mot de passe » (changement via `POST /api/auth/change-password`) et
+  échappement des libellés de clés WebAuthn. Tests :
+  `tests/test_mfa.py::test_mfa_setup_returns_local_qr_data_url`,
+  `tests/frontend/mfa-settings.test.mjs` (nouveau, 9 contrôles).
+
+---
+
+## [2.16.0] — 2026-09-22
+
+### Modifié
+
+- **#86 - Optimisation globale des performances (phase 3)** : ferme les deux derniers
+  points de la phase 3 (recherche via inverted index, PDF lazy et caps regex déjà livrés
+  via BUG-033/BUG-040/BUG-025). Scan **différentiel** : `_scan_vault` réutilise les
+  entrées inchangées (`size` + `modified`) d'un snapshot précédent — seuls `os.walk` +
+  `stat` tournent à chaque rebuild (`build_index`, `reload_single_vault`). Extraction
+  **excalidraw différée** : le scan ne lit plus les `.excalidraw` / `.excalidraw.md`
+  (flag `excalidraw_text_pending`), `enrich_pdf_texts()` extrait leur texte après index
+  comme pour les PDF. Garde-fou `MAX_REPLACE_FILE_BYTES` (5 Mio) sur `replace_in_files`.
+  Tests : `tests/test_perf_phase3.py` (9). Voir
+  [docs/features/perf-phase3-86.md](./docs/features/perf-phase3-86.md).
+
+---
+
+## [2.15.0] — 2026-09-22
+
+### Ajouté
+
+- **#107 - Configuration : gestion des clés API & MCP** — nouvelle section
+  « 🔑 Clés API & MCP » dans le panneau de configuration : création, liste
+  (créée / expire / dernière utilisation) et révocation de jetons longue
+  durée utilisables aussi bien sur l'API REST que sur le serveur MCP
+  (`/mcp`) — un seul et même jeton Bearer pour les deux. Choix
+  d'expiration à la création : 1 jour, 1 mois, 6 mois, 1 an, sans fin.
+  Le secret n'est affiché qu'une fois (jamais persisté en clair,
+  `data/api_tokens.json` ne contient que les métadonnées) ; révocation
+  immédiate des deux côtés, plafond 50 clés par utilisateur, isolation
+  par utilisateur, audit `config_change`. Corrigé au passage : le store
+  de révocation (`revoked_tokens.json`) bornait toute entrée à 7 jours —
+  un jeton longue durée révoqué « reprenait vie » après purge ; il est
+  désormais calé sur l'expiration réelle du jeton. Voir
+  [docs/features/api-mcp-tokens-107.md](./docs/features/api-mcp-tokens-107.md).
+
+---
+
 ## [2.14.1] — 2026-09-22

 ---
@@ -4,7 +4,7 @@

 **Porte d'entrée web ultra-léger pour vos vaults Obsidian** — Accédez, naviguez et recherchez dans toutes vos notes Obsidian depuis n'importe quel appareil via une interface web moderne et responsive.

-[![Version](https://img.shields.io/badge/Version-2.14.1-blue.svg)]()
+[![Version](https://img.shields.io/badge/Version-2.16.3-blue.svg)]()
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Docker](https://img.shields.io/badge/Docker-Ready-blue.svg)](https://www.docker.com/)
 [![Python](https://img.shields.io/badge/Python-3.11+-green.svg)](https://www.python.org/)
@@ -927,8 +927,8 @@ Ce projet est sous licence **MIT** — voir le fichier [LICENSE](LICENSE) pour l

 ## 📝 Changelog

-Consultez le [CHANGELOG.md](./CHANGELOG.md) pour l'historique complet de toutes les versions (v1.0.0 → v2.14.1).
+Consultez le [CHANGELOG.md](./CHANGELOG.md) pour l'historique complet de toutes les versions (v1.0.0 → v2.16.3).

 ---

-*Projet : ObsiGate | Version : 2.14.1 | Dernière mise à jour : Juin 2026*
+*Projet : ObsiGate | Version : 2.16.3 | Dernière mise à jour : Juin 2026*
@@ -2,7 +2,7 @@

 **Ultra-light web gateway for your Obsidian vaults** — Access, browse, and search all your Obsidian notes from any device via a modern, responsive web interface.

-[![Version](https://img.shields.io/badge/Version-2.14.1-blue.svg)]()
+[![Version](https://img.shields.io/badge/Version-2.16.3-blue.svg)]()
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Docker](https://img.shields.io/badge/Docker-Ready-blue.svg)](https://www.docker.com/)
 [![Python](https://img.shields.io/badge/Python-3.11+-green.svg)](https://www.python.org/)
@@ -1096,8 +1096,8 @@ This project is licensed under the **MIT License** - see the [LICENSE](LICENSE)

 ## 📝 Changelog

-See [CHANGELOG.md](./CHANGELOG.md) for the complete version history (v1.0.0 → v2.14.1).
+See [CHANGELOG.md](./CHANGELOG.md) for the complete version history (v1.0.0 → v2.16.3).

 ---

-*Project: ObsiGate | Version: 2.14.1 | Last updated: May 2026*
+*Project: ObsiGate | Version: 2.16.3 | Last updated: May 2026*
@@ -1 +1 @@
-2.14.1
+2.16.3
@@ -7,6 +7,7 @@ import json
 import logging
 import os
 import secrets
+import threading
 import time
 import uuid
 from pathlib import Path
@@ -23,6 +24,22 @@ ALGORITHM = "HS256"
 ACCESS_TOKEN_EXPIRE_SECONDS = int(os.environ.get("OBSIGATE_ACCESS_TOKEN_TTL", "3600"))       # default 1 hour
 REFRESH_TOKEN_EXPIRE_SECONDS = int(os.environ.get("OBSIGATE_REFRESH_TOKEN_TTL", "604800"))   # default 7 days

+#: Persistent API/MCP access tokens (user-managed, shown in the config panel).
+API_TOKENS_FILE = Path("data/api_tokens.json")
+#: Accepted values for the expiry selector in the UI (1 day, 1 month, 6 months,
+#: 1 year, never). "never" → no ``exp`` claim → token valid until revoked.
+API_TOKEN_EXPIRY_CHOICES = {
+    "1d": 24 * 3600,
+    "30d": 30 * 24 * 3600,
+    "180d": 180 * 24 * 3600,
+    "365d": 365 * 24 * 3600,
+    "never": None,
+}
+#: Max active tokens per user (anti hoarding; revoking frees a slot).
+API_TOKEN_MAX_PER_USER = 50
+#: AES-GCM key derived once from the JWT secret to encrypt stored tokens.
+_API_TOKEN_KEY: bytes | None = None
+
 # In-memory revoked token set (loaded from disk on startup)
 _revoked_jtis: set = set()
 _revoked_loaded = False
@@ -92,43 +109,61 @@ def decode_token(token: str) -> dict | None:
 # ---------------------------------------------------------------------------
 # Token revocation
 # ---------------------------------------------------------------------------
+# The store is a dict {jti: valid_until}: the revocation record may be dropped
+# once the underlying token's own expiry has passed (by then the JWT is dead
+# anyway). Long-lived API/MCP tokens (see create_api_token) must therefore be
+# revoked with their real expiry — a 1-year token revoked last week must not
+# silently come back to life when a 7-day cleanup purges the record (BUG in
+# the previous set-based store, fixed with feature #107).
+
+_revoked_map: dict[str, int] = {}
+_revoked_loaded = False
+

 def _load_revoked():
    """Load revoked token JTIs from disk into memory (once)."""
-    global _revoked_loaded, _revoked_jtis
+    global _revoked_loaded, _revoked_map
    if _revoked_loaded:
        return
    if REVOKED_TOKENS_FILE.exists():
        try:
            data = json.loads(REVOKED_TOKENS_FILE.read_text())
-            # Clean expired entries (older than 7 days)
+            # Drop entries whose underlying token has itself expired.
            now = int(time.time())
-            _revoked_jtis = {
-                jti for jti, exp in data.items()
-                if exp > now
+            _revoked_map = {
+                jti: int(exp) for jti, exp in data.items()
+                if int(exp) > now
            }
        except Exception as e:
            logger.warning(f"Failed to load revoked tokens: {e}")
-            _revoked_jtis = set()
+            _revoked_map = {}
    _revoked_loaded = True


 def _save_revoked():
-    """Persist revoked JTIs to disk."""
+    """Persist revoked JTIs to disk with their per-token expiry."""
    REVOKED_TOKENS_FILE.parent.mkdir(parents=True, exist_ok=True)
-    # Store with expiry timestamp for cleanup
-    now = int(time.time())
-    # Keep entries for 7 days max
-    data = {jti: now + REFRESH_TOKEN_EXPIRE_SECONDS for jti in _revoked_jtis}
    tmp = REVOKED_TOKENS_FILE.with_suffix(".tmp")
-    tmp.write_text(json.dumps(data))
+    tmp.write_text(json.dumps(_revoked_map))
    tmp.replace(REVOKED_TOKENS_FILE)


-def revoke_token(jti: str):
-    """Add a token JTI to the revocation list."""
+def revoke_token(jti: str, expires_at: int | None = None):
+    """Add a token JTI to the revocation list.
+
+    ``expires_at`` is the revoked token's own ``exp`` (unix seconds) — the
+    record is kept at least that long so a long-lived API token cannot
+    outlive its revocation. ``None`` means the token never expires (API/MCP
+    "sans fin") → the record is kept forever (capped at ~100 years, the JWT
+    store's practical infinity). Default keeps 7 days (session tokens).
+    """
    _load_revoked()
-    _revoked_jtis.add(jti)
+    now = int(time.time())
+    if expires_at is None:
+        until = now + 100 * 365 * 24 * 3600
+    else:
+        until = max(int(expires_at), now + REFRESH_TOKEN_EXPIRE_SECONDS)
+    _revoked_map[jti] = until
    _save_revoked()
    logger.debug(f"Revoked token JTI: {jti[:8]}...")

@@ -136,4 +171,128 @@ def revoke_token(jti: str):
 def is_token_revoked(jti: str) -> bool:
    """Check if a token JTI has been revoked."""
    _load_revoked()
-    return jti in _revoked_jtis
+    return jti in _revoked_map
+
+
+# ---------------------------------------------------------------------------
+# API / MCP tokens (feature #107)
+# ---------------------------------------------------------------------------
+# Long-lived access tokens the user creates from the config panel. They are
+# plain HS256 access-type JWTs (``api: true`` claim), so they authenticate
+# against BOTH the REST API and the MCP endpoint (/mcp) — which share
+# ``get_current_user``. The raw token is shown exactly once at creation; the
+# store keeps metadata only (name, owner, expiry, last use) — no secret
+# material is written to disk.
+#
+# File: data/api_tokens.json
+#   {"version": 1, "tokens": {jti: {name, username, created_at, expires_at, last_used_at}}}
+
+_api_tokens_lock = threading.RLock()
+_touch_last_write: dict[str, float] = {}
+
+
+def _load_api_tokens() -> dict:
+    if not API_TOKENS_FILE.exists():
+        return {"version": 1, "tokens": {}}
+    try:
+        return json.loads(API_TOKENS_FILE.read_text(encoding="utf-8"))
+    except (json.JSONDecodeError, OSError) as e:
+        logger.error(f"Failed to read api_tokens.json: {e}")
+        return {"version": 1, "tokens": {}}
+
+
+def _save_api_tokens(data: dict):
+    API_TOKENS_FILE.parent.mkdir(parents=True, exist_ok=True)
+    tmp = API_TOKENS_FILE.with_suffix(".tmp")
+    tmp.write_text(json.dumps(data, indent=2, default=str), encoding="utf-8")
+    tmp.replace(API_TOKENS_FILE)
+
+
+def create_api_token(user: dict, name: str, expiry_key: str) -> tuple[dict, str]:
+    """Create a persistent API/MCP token. Returns (record, jwt_string).
+
+    ``expiry_key`` must be one of API_TOKEN_EXPIRY_CHOICES; "never" omits the
+    ``exp`` claim (valid until explicitly revoked).
+    """
+    if expiry_key not in API_TOKEN_EXPIRY_CHOICES:
+        raise ValueError("Expiration invalide")
+    seconds = API_TOKEN_EXPIRY_CHOICES[expiry_key]
+    with _api_tokens_lock:
+        data = _load_api_tokens()
+        tokens = data["tokens"]
+        mine = sum(1 for t in tokens.values() if t["username"] == user["username"])
+        if mine >= API_TOKEN_MAX_PER_USER:
+            raise ValueError(f"Maximum {API_TOKEN_MAX_PER_USER} tokens par utilisateur")
+        now = int(time.time())
+        jti = str(uuid.uuid4())
+        payload = {
+            "sub": user["username"],
+            "role": user.get("role", "user"),
+            "vaults": user.get("vaults", []),
+            "jti": jti,
+            "iat": now,
+            "type": "access",
+            "api": True,
+        }
+        if seconds is not None:
+            payload["exp"] = now + seconds
+        token = jwt.encode(payload, get_secret_key(), algorithm=ALGORITHM)
+        record = {
+            "jti": jti,
+            "name": name[:64] or "API token",
+            "username": user["username"],
+            "created_at": now,
+            "expires_at": payload.get("exp"),
+            "expiry_key": expiry_key,
+            "last_used_at": None,
+        }
+        tokens[jti] = record
+        _save_api_tokens(data)
+    return record, token
+
+
+def list_api_tokens(username: str) -> list[dict]:
+    """Token metadata for one user, newest first."""
+    data = _load_api_tokens()
+    now = int(time.time())
+    items = [
+        {**t, "expired": t.get("expires_at") is not None and t["expires_at"] < now}
+        for t in data["tokens"].values()
+        if t["username"] == username
+    ]
+    return sorted(items, key=lambda t: t["created_at"], reverse=True)
+
+
+def delete_api_token(jti: str, username: str) -> dict:
+    """Revoke and remove an API token. Raises KeyError when unknown/not owned."""
+    with _api_tokens_lock:
+        data = _load_api_tokens()
+        record = data["tokens"].get(jti)
+        if not record or record["username"] != username:
+            raise KeyError(jti)
+        # Revoke by jti so the presented JWT stops working even though it is
+        # stateless — kept until its natural expiry (no-expiry → forever).
+        revoke_token(jti, record.get("expires_at"))
+        del data["tokens"][jti]
+        _save_api_tokens(data)
+    return record
+
+
+def maybe_touch_api_token(jti: str | None, created_or_expires: bool = False):
+    """Record last usage of an API token, throttled to one disk write/hour."""
+    if not jti:
+        return
+    now = time.time()
+    if now - _touch_last_write.get(jti, 0) < 3600:
+        return
+    _touch_last_write[jti] = now
+    try:
+        with _api_tokens_lock:
+            data = _load_api_tokens()
+            record = data["tokens"].get(jti)
+            if record is None:
+                return
+            record["last_used_at"] = int(now)
+            _save_api_tokens(data)
+    except Exception as e:  # never fail an authenticated request over stats
+        logger.debug(f"api_token touch failed: {e}")
@@ -11,7 +11,7 @@ from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer

 from backend.services.net import get_client_ip

-from .jwt_handler import decode_token, is_token_revoked
+from .jwt_handler import decode_token, is_token_revoked, maybe_touch_api_token
 from .user_store import get_user

 logger = logging.getLogger("obsigate.auth.middleware")
@@ -115,6 +115,10 @@ def get_current_user(
    user["_token_vaults"] = payload.get("vaults", [])
    # Attach the token id for per-token rate limiting (AI tool layer).
    user["_token_jti"] = payload.get("jti")
+    # Feature #107: track last usage of user-managed API/MCP tokens
+    # (throttled write — this dependency runs on both REST and /mcp paths).
+    if payload.get("api"):
+        maybe_touch_api_token(payload.get("jti"))
    # BUG-030: expose the real client IP to the audit log.
    user["_request_ip"] = get_client_ip(request)
    return user
@@ -17,10 +17,14 @@ from backend.services.net import get_client_ip

 from .jwt_handler import (
    ACCESS_TOKEN_EXPIRE_SECONDS,
+    API_TOKEN_EXPIRY_CHOICES,
    create_access_token,
+    create_api_token,
    create_refresh_token,
    decode_token,
+    delete_api_token,
    is_token_revoked,
+    list_api_tokens,
    revoke_token,
 )
 from .mfa import (
@@ -444,7 +448,9 @@ class MfaEnableRequest(BaseModel):
 async def mfa_totp_setup(current_user=Depends(require_auth)):
    """Generate a TOTP secret and QR URI for MFA setup.

-    Returns the secret and otpauth URI — client displays QR code.
+    Returns the secret, the otpauth URI and a ready-to-display QR code
+    (`qr_data_url`, SVG `data:` URI — no third-party service, CSP-safe).
+
    Does NOT enable MFA yet; call /mfa/totp/enable after first successful verify.
    """
    from .user_store import update_user
@@ -454,10 +460,21 @@ async def mfa_totp_setup(current_user=Depends(require_auth)):
    update_user(current_user["username"], {
        "mfa_secret_pending": secret,
    })
+    # BUG-068: the QR code is generated locally (segno, stdlib-free SVG data
+    # URI). The previous client-side https://api.qrserver.com image was blocked
+    # by the CSP (img-src 'self' data: blob:) and leaked the otpauth URI —
+    # including the TOTP secret — to a third party.
+    qr_data_url: str | None = None
+    try:
+        import segno
+        qr_data_url = segno.make(qr_uri).svg_data_uri(scale=5)
+    except Exception:
+        qr_data_url = None
    return {
        "secret": secret,
        "qr_uri": qr_uri,
        "otpauth_uri": qr_uri,
+        "qr_data_url": qr_data_url,
    }


@@ -559,18 +576,25 @@ class WebauthnRemoveRequest(BaseModel):


@router.post("/mfa/webauthn/register/options")
-async def mfa_webauthn_register_options(current_user=Depends(require_auth)):
+async def mfa_webauthn_register_options(request: Request,
+                                        current_user=Depends(require_auth)):
    """Start WebAuthn key enrolment — returns publicKey creation options for the browser."""
-    from .webauthn_mfa import begin_registration
+    from .webauthn_mfa import begin_registration, resolve_relying_party

+    # BUG-070: rp_id/origins derive from the request (exact host incl. port)
+    # unless explicitly configured — the old localhost defaults rejected
+    # every real access URL ("Unexpected client data origin").
+    rp, _ = resolve_relying_party(request)
    options = begin_registration(current_user["username"],
-                                 current_user.get("display_name", ""))
+                                 current_user.get("display_name", ""),
+                                 rp_id_override=rp)
    return {"options": options}


@router.post("/mfa/webauthn/register")
 async def mfa_webauthn_register(
    req: WebauthnRegisterRequest,
+    request: Request,
    current_user=Depends(require_auth),
 ):
    """Verify the created credential, store it, and enable MFA if not already on.
@@ -580,14 +604,17 @@ async def mfa_webauthn_register(
    from datetime import datetime, timezone

    from .user_store import get_user, update_user
-    from .webauthn_mfa import complete_registration
+    from .webauthn_mfa import complete_registration, resolve_relying_party

    user = get_user(current_user["username"])
    if user is None:
        raise HTTPException(404, "Utilisateur introuvable")
+    rp, origins = resolve_relying_party(request)
    try:
        record = complete_registration(current_user["username"], req.credential,
-                                       label=req.label)
+                                       label=req.label,
+                                       rp_id_override=rp,
+                                       origins_override=origins)
    except ValueError as e:
        raise HTTPException(400, str(e))
    except Exception as e:
@@ -666,7 +693,7 @@ async def mfa_webauthn_remove(


@router.post("/mfa/webauthn/options")
-async def mfa_webauthn_login_options(body: dict = Body(...)):
+async def mfa_webauthn_login_options(request: Request, body: dict = Body(...)):
    """Unauthenticated: begin the login assertion for a user with registered keys.

    Enumeration-safe: always 200 — returns null options (caller falls back to
@@ -678,8 +705,9 @@ async def mfa_webauthn_login_options(body: dict = Body(...)):
    if not user or not user.get("mfa_enabled") or not creds:
        return {"mfa_method": "totp", "options": None}

-    from .webauthn_mfa import begin_authentication
-    options = begin_authentication(username, creds)
+    from .webauthn_mfa import begin_authentication, resolve_relying_party
+    rp, _ = resolve_relying_party(request)
+    options = begin_authentication(username, creds, rp_id_override=rp)
    if options is None:
        return {"mfa_method": "totp", "options": None}
    return {"mfa_method": "webauthn", "options": options}
@@ -693,7 +721,7 @@ async def mfa_webauthn_verify(
 ):
    """Unauthenticated: verify the WebAuthn assertion and issue JWT tokens."""
    from .user_store import get_user, update_user
-    from .webauthn_mfa import complete_authentication
+    from .webauthn_mfa import complete_authentication, resolve_relying_party

    client_ip = _enforce_mfa_rate_limit(request, body.username)

@@ -704,13 +732,16 @@ async def mfa_webauthn_verify(
    if not user.get("mfa_enabled"):
        raise HTTPException(400, "MFA non activé pour cet utilisateur")

+    rp, origins = resolve_relying_party(request)
    creds = user.get("webauthn_credentials", [])
    try:
        credential_id = body.credential.get("id", "")
        stored = next((c for c in creds if c.get("credential_id") == credential_id), None)
        if stored is None:
            raise ValueError("Credential non enregistré")
-        new_count = complete_authentication(body.username, body.credential, stored)
+        new_count = complete_authentication(body.username, body.credential, stored,
+                                            rp_id_override=rp,
+                                            origins_override=origins)
    except ValueError as e:
        _record_mfa_failure(client_ip, body.username)
        raise HTTPException(401, str(e))
@@ -861,3 +892,58 @@ async def delete_user_endpoint(
        return {"message": f"Utilisateur '{username}' supprimé"}
    except ValueError as e:
        raise HTTPException(404, str(e))
+
+
+# ── API / MCP tokens (feature #107) ──────────────────────────────────
+# One long-lived token authenticates BOTH the REST API and the MCP
+# endpoint (/mcp): the MCP server resolves the caller through the same
+# get_current_user() dependency, so the same Bearer JWT works everywhere.
+
+class CreateApiTokenRequest(BaseModel):
+    name: str
+    expiry: str  # 1d | 30d | 180d | 365d | never
+
+
+@router.get("/tokens")
+async def list_user_tokens(current_user=Depends(require_auth)):
+    """List the caller's API/MCP tokens (metadata only — the secret is never stored)."""
+    return {
+        "tokens": list_api_tokens(current_user["username"]),
+        "expiry_choices": list(API_TOKEN_EXPIRY_CHOICES.keys()),
+    }
+
+
+@router.post("/tokens")
+async def create_user_token(
+    req: CreateApiTokenRequest,
+    request: Request,
+    current_user=Depends(require_auth),
+):
+    """Create a long-lived API/MCP token. The raw JWT is returned ONCE."""
+    try:
+        record, token = create_api_token(current_user, req.name.strip(), req.expiry)
+    except ValueError as e:
+        raise HTTPException(400, str(e))
+    from backend.audit import log_config_change
+    log_config_change(current_user["username"],
+                      {"action": "api_token_create", "name": record["name"],
+                       "expiry": record["expiry_key"]}, ip=get_client_ip(request))
+    return {"token": token, **record}
+
+
+@router.delete("/tokens/{jti}")
+async def delete_user_token(
+    jti: str,
+    request: Request,
+    current_user=Depends(require_auth),
+):
+    """Revoke + delete an API/MCP token (immediate effect on API and MCP)."""
+    try:
+        record = delete_api_token(jti, current_user["username"])
+    except KeyError:
+        raise HTTPException(404, "Token introuvable")
+    from backend.audit import log_config_change
+    log_config_change(current_user["username"],
+                      {"action": "api_token_revoke", "name": record["name"]},
+                      ip=get_client_ip(request))
+    return {"message": f"Token '{record['name']}' révoqué"}
@@ -38,8 +38,16 @@ logger = logging.getLogger("obsigate.auth.webauthn")
 # Challenge lifetime: clients have 3 minutes to complete the ceremony.
 CHALLENGE_TTL_SECONDS = 180

-# In-memory pending challenges: key -> (challenge_bytes, expires_at)
-_pending: dict[str, tuple[bytes, float]] = {}
+# How many outstanding challenges to keep per key. BUG-070: a single slot made
+# the flow fragile — a double-click on "add key" (or any retry) overwrote the
+# pending challenge and the in-flight ceremony failed with
+# "Client data challenge was not expected challenge". The verifier now accepts
+# any recent challenge for the key.
+MAX_PENDING_PER_KEY = 5
+
+# In-memory pending challenges: key -> [(challenge_bytes, expires_at), ...]
+# (newest last)
+_pending: dict[str, list[tuple[bytes, float]]] = {}


 def rp_id() -> str:
@@ -55,24 +63,100 @@ def expected_origins() -> list[str]:
    return [o.strip() for o in raw.split(",") if o.strip()]


+def resolve_relying_party(request: Any = None) -> tuple[str, list[str]]:
+    """Resolve the WebAuthn (rp_id, expected_origins) for a ceremony.
+
+    BUG-070: the previous defaults (rp_id ``localhost``, origins
+    ``http://localhost``) rejected every real-world access URL — any port
+    (``http://localhost:2020``), ``127.0.0.1``, a LAN host or a public domain
+    failed verification with "Unexpected client data origin".
+
+    Explicit configuration still wins: when ``OBSIGATE_WEBAUTHN_RP_ID`` /
+    ``OBSIGATE_WEBAUTHN_ORIGINS`` are set they are used unchanged.  Otherwise
+    the values are derived from the incoming request (exact ``Host``, port
+    included, since the browser origin carries non-default ports).
+
+    Behind a reverse proxy the external host/proto come from
+    ``X-Forwarded-Host`` / ``X-Forwarded-Proto``, honored only when
+    ``OBSIGATE_TRUST_PROXY=true`` (same rule as ``get_client_ip``).
+    """
+    env_rp = os.environ.get("OBSIGATE_WEBAUTHN_RP_ID")
+    env_raw = os.environ.get("OBSIGATE_WEBAUTHN_ORIGINS")
+    if request is None:
+        return (env_rp or "localhost",
+                [o.strip() for o in env_raw.split(",") if o.strip()]
+                if env_raw else ["http://localhost"])
+
+    from backend.services.net import is_trusted_proxy
+
+    if is_trusted_proxy():
+        fwd_host = request.headers.get("x-forwarded-host", "")
+        host = fwd_host.split(",")[0].strip() or request.headers.get("host", "")
+        fwd_proto = request.headers.get("x-forwarded-proto", "")
+        scheme = fwd_proto.split(",")[0].strip() or request.url.scheme
+    else:
+        host = request.headers.get("host", "")
+        scheme = request.url.scheme
+    if not host:
+        url = request.url
+        host = url.netloc or url.hostname or ""
+        scheme = scheme or url.scheme or "http"
+    rp = env_rp or _hostname_only(host) or "localhost"
+    if env_raw:
+        origins = [o.strip() for o in env_raw.split(",") if o.strip()]
+    else:
+        origins = [f"{scheme or 'http'}://{host}"] if host else ["http://localhost"]
+    return rp, origins
+
+
+def _hostname_only(host: str) -> str:
+    """Strip the port (and IPv6 brackets) from a Host header value."""
+    host = host.strip()
+    if host.startswith("["):  # [::1]:8080 or [::1]
+        end = host.find("]")
+        return host[1:end] if end > 0 else host
+    if host.count(":") == 1:
+        name, _, port = host.partition(":")
+        return name if port.isdigit() else host
+    return host
+
+
 def _prune_expired() -> None:
    now = time.time()
-    for key in [k for k, (_, exp) in _pending.items() if exp < now]:
-        _pending.pop(key, None)
+    for key in list(_pending):
+        remaining = [(c, exp) for c, exp in _pending[key] if exp >= now]
+        if remaining:
+            _pending[key] = remaining
+        else:
+            _pending.pop(key, None)


 def _store_challenge(key: str) -> bytes:
    _prune_expired()
    challenge = secrets.token_bytes(32)
-    _pending[key] = (challenge, time.time() + CHALLENGE_TTL_SECONDS)
+    slot = _pending.setdefault(key, [])
+    slot.append((challenge, time.time() + CHALLENGE_TTL_SECONDS))
+    del slot[:-MAX_PENDING_PER_KEY]  # keep only the most recent ones
    return challenge


 def _take_challenge(key: str) -> bytes | None:
-    """Pop a challenge (single-use). Returns None if missing/expired."""
+    """Pop the newest challenge (single-use). Returns None if missing/expired."""
    _prune_expired()
-    entry = _pending.pop(key, None)
-    return entry[0] if entry else None
+    slot = _pending.get(key)
+    if not slot:
+        return None
+    challenge, _ = slot.pop()
+    if not slot:
+        _pending.pop(key, None)
+    return challenge
+
+
+def _take_all_challenges(key: str) -> list[bytes]:
+    """Pop every outstanding challenge for *key* (newest last)."""
+    _prune_expired()
+    slot = _pending.pop(key, None)
+    return [c for c, _ in slot] if slot else []


 def clear_pending(username: str) -> None:
@@ -83,9 +167,12 @@ def clear_pending(username: str) -> None:

 # ── Registration (enrol a key in settings) ─────────────────────────────

-def begin_registration(username: str, display_name: str) -> dict:
+def begin_registration(username: str, display_name: str,
+                       rp_id_override: str | None = None,
+                       origins_override: list[str] | None = None) -> dict:
+    _ = origins_override  # origins only matter at verification time
    options = generate_registration_options(
-        rp_id=rp_id(),
+        rp_id=rp_id_override or rp_id(),
        rp_name=rp_name(),
        user_name=username,
        user_display_name=display_name or username,
@@ -98,19 +185,44 @@ def begin_registration(username: str, display_name: str) -> dict:
    return _finalize_options(options)


-def complete_registration(username: str, credential_json: dict[str, Any],
-                          label: str = "") -> dict:
-    challenge = _take_challenge(f"{username}:register")
-    if challenge is None:
-        raise ValueError("Session d'enregistrement expirée — recommencez")
+def _verify_with_any_challenge(key: str, verify_one: Any, empty_message: str) -> Any:
+    """Run *verify_one(challenge)* against every outstanding challenge.

+    Returns the first success; re-raises the last error when all fail.
+    BUG-070: lets an in-flight ceremony survive a re-requested options call
+    (double-click / retry) that stored a newer challenge afterwards.
+    """
+    challenges = _take_all_challenges(key)
+    if not challenges:
+        raise ValueError(empty_message)
+    last_error: Exception | None = None
+    for challenge in challenges:
+        try:
+            return verify_one(challenge)
+        except Exception as e:  # try the next candidate challenge
+            last_error = e
+    assert last_error is not None
+    raise last_error
+
+
+def complete_registration(username: str, credential_json: dict[str, Any],
+                          label: str = "", rp_id_override: str | None = None,
+                          origins_override: list[str] | None = None) -> dict:
    credential = parse_registration_credential_json(credential_json)
-    verification = verify_registration_response(
-        credential=credential,
-        expected_challenge=challenge,
-        expected_rp_id=rp_id(),
-        expected_origin=expected_origins(),
-    )
+    effective_rp = rp_id_override or rp_id()
+    effective_origins = origins_override or expected_origins()
+
+    def _verify(challenge: bytes) -> Any:
+        return verify_registration_response(
+            credential=credential,
+            expected_challenge=challenge,
+            expected_rp_id=effective_rp,
+            expected_origin=effective_origins,
+        )
+
+    verification = _verify_with_any_challenge(
+        f"{username}:register", _verify,
+        "Session d'enregistrement expirée — recommencez")

    transports = credential.response.transports or []
    label = (label or str(credential_json.get("label") or "")).strip() or "Security key"
@@ -126,9 +238,12 @@ def complete_registration(username: str, credential_json: dict[str, Any],

 # ── Authentication (assertion at login) ────────────────────────────────

-def begin_authentication(username: str, credentials: list[dict]) -> dict | None:
+def begin_authentication(username: str, credentials: list[dict],
+                       rp_id_override: str | None = None,
+                       origins_override: list[str] | None = None) -> dict | None:
    if not credentials:
        return None
+    _ = origins_override  # origins only matter at verification time
    from webauthn.helpers.structs import PublicKeyCredentialDescriptor

    allow = [
@@ -136,7 +251,7 @@ def begin_authentication(username: str, credentials: list[dict]) -> dict | None:
        for c in credentials
    ]
    options = generate_authentication_options(
-        rp_id=rp_id(),
+        rp_id=rp_id_override or rp_id(),
        challenge=_store_challenge(f"{username}:login"),
        allow_credentials=allow,
    )
@@ -147,21 +262,27 @@ def complete_authentication(
    username: str,
    credential_json: dict[str, Any],
    stored: dict,
+    rp_id_override: str | None = None,
+    origins_override: list[str] | None = None,
 ) -> int:
-    """Verify an assertion. Returns the new sign_count. Raises ValueError on failure."""
-    challenge = _take_challenge(f"{username}:login")
-    if challenge is None:
-        raise ValueError("Session expirée — rechargez la page")
-
+    """Verify an assertion. Returns the new sign_count. Raises on failure."""
    credential = parse_authentication_credential_json(credential_json)
-    verification = verify_authentication_response(
-        credential=credential,
-        expected_challenge=challenge,
-        expected_rp_id=rp_id(),
-        expected_origin=expected_origins(),
-        credential_public_key=base64url_to_bytes(stored["public_key"]),
-        credential_current_sign_count=int(stored.get("sign_count", 0)),
-    )
+    effective_rp = rp_id_override or rp_id()
+    effective_origins = origins_override or expected_origins()
+
+    def _verify(challenge: bytes) -> Any:
+        return verify_authentication_response(
+            credential=credential,
+            expected_challenge=challenge,
+            expected_rp_id=effective_rp,
+            expected_origin=effective_origins,
+            credential_public_key=base64url_to_bytes(stored["public_key"]),
+            credential_current_sign_count=int(stored.get("sign_count", 0)),
+        )
+
+    verification = _verify_with_any_challenge(
+        f"{username}:login", _verify,
+        "Session expirée — rechargez la page")
    return int(verification.new_sign_count)


@@ -397,31 +397,52 @@ def parse_markdown_file(raw: str) -> frontmatter.Post:
        return frontmatter.Post(content)


-def _scan_vault(vault_name: str, vault_path: str, vault_cfg: dict[str, Any] | None = None) -> dict[str, Any]:
+def _scan_vault(
+    vault_name: str,
+    vault_path: str,
+    vault_cfg: dict[str, Any] | None = None,
+    previous_files: dict[str, dict[str, Any]] | None = None,
+) -> dict[str, Any]:
    """Synchronously scan a single vault directory and build file index.

    Walks the vault tree, reads supported files, extracts metadata
    (tags, title, content preview) and stores a capped content snapshot
    for in-memory full-text search.
-    
+
    All files and directories are indexed, including hidden files (starting with '.').

+    Differential scan (#86): when ``previous_files`` maps a relative path to
+    its previous ``file_info`` dict, entries whose ``size`` and ``modified``
+    timestamp are unchanged are reused verbatim (no disk read, no re-parse).
+    Only the cheap ``os.walk`` + ``stat`` runs on every pass; heavy content
+    extraction (PDF metadata excepted — always cheap) is skipped for
+    unchanged files. This replaces the full ``rglob`` re-read on rebuilds.
+
+    Excalidraw diagrams (#86, like PDFs since BUG-040) are deferred: the scan
+    only records the title and sets ``excalidraw_text_pending``; the expensive
+    JSON/lz-string text extraction runs in ``enrich_pdf_texts()`` after the
+    index is queryable.
+
    Args:
        vault_name: Display name of the vault.
        vault_path: Absolute filesystem path to the vault root.
        vault_cfg: Optional vault configuration dict (unused for indexing, kept for compatibility).
+        previous_files: Optional ``{relative_path: file_info}`` snapshot from a
+            previous scan used for differential reuse.

    Returns:
-        Dict with keys ``files`` (list), ``tags`` (counter dict), ``path`` (str), ``paths`` (list).
+        Dict with keys ``files`` (list), ``tags`` (counter dict), ``path`` (str),
+        ``paths`` (list) and ``reused`` (int, differential hits).
    """
    vault_root = Path(vault_path)
    files: list[dict[str, Any]] = []
    tag_counts: dict[str, int] = {}
    paths: list[dict[str, str]] = []
+    reused = 0

    if not vault_root.exists():
        logger.warning(f"Vault path does not exist: {vault_path}")
-        return {"files": [], "tags": {}, "path": vault_path, "paths": []}
+        return {"files": [], "tags": {}, "path": vault_path, "paths": [], "reused": 0}

    root_resolved = vault_root.resolve(strict=False)

@@ -479,9 +500,37 @@ def _scan_vault(vault_name: str, vault_path: str, vault_cfg: dict[str, Any] | No
                stat = fpath.stat()
                modified = datetime.fromtimestamp(stat.st_mtime, tz=timezone.utc).isoformat()

+                # #86 differential scan: reuse the previous entry when neither
+                # size nor mtime changed — skips the disk read + parse below.
+                if previous_files:
+                    prev = previous_files.get(rel_path_str)
+                    if (
+                        prev is not None
+                        and prev.get("size") == stat.st_size
+                        and prev.get("modified") == modified
+                    ):
+                        file_info = {**prev, "tags": list(prev.get("tags", []))}
+                        files.append(file_info)
+                        for tag in file_info.get("tags", []):
+                            tag_counts[tag] = tag_counts.get(tag, 0) + 1
+                        reused += 1
+                        # The global backlink index is rebuilt on every scan,
+                        # so re-register this file's wikilinks from its
+                        # (cached) content instead of re-reading the disk.
+                        if file_info.get("extension") == ".md" and file_info.get("content"):
+                            try:
+                                _extract_wikilinks_for_backlinks(
+                                    vault_name, file_info["path"],
+                                    file_info.get("title", ""), file_info["content"],
+                                )
+                            except Exception:
+                                pass
+                        continue
+
                # PDF handling — special path (binary, uses pdf_reader)
                tags: list[str] = []
                pdf_text_pending = False
+                excalidraw_text_pending = False
                if ext == ".pdf":
                    from backend.pdf_reader import extract_pdf_metadata
                    # BUG-040: only the (cheap) metadata is read during the
@@ -494,10 +543,13 @@ def _scan_vault(vault_name: str, vault_path: str, vault_cfg: dict[str, Any] | No
                    content_preview = ""
                    pdf_text_pending = True
                elif ext == ".excalidraw" or fpath.name.lower().endswith(".excalidraw.md"):
-                    raw = fpath.read_text(encoding="utf-8", errors="replace")
-                    raw = extract_excalidraw_indexable(raw)
+                    # #86: defer the expensive JSON/lz-string text extraction
+                    # (read + decompress + element walk) to ``enrich_pdf_texts``
+                    # so the scan stays cheap; title comes from the filename.
+                    raw = ""
                    title = fpath.stem.replace(".excalidraw", "").replace("-", " ").replace("_", " ")
-                    content_preview = raw[:200].strip()
+                    content_preview = ""
+                    excalidraw_text_pending = True
                else:
                    raw = fpath.read_text(encoding="utf-8", errors="replace")
                    title = fpath.stem.replace("-", " ").replace("_", " ")
@@ -528,6 +580,8 @@ def _scan_vault(vault_name: str, vault_path: str, vault_cfg: dict[str, Any] | No
                }
                if pdf_text_pending:
                    file_info["pdf_text_pending"] = True
+                if excalidraw_text_pending:
+                    file_info["excalidraw_text_pending"] = True
                files.append(file_info)

                for tag in tags:
@@ -540,28 +594,49 @@ def _scan_vault(vault_name: str, vault_path: str, vault_cfg: dict[str, Any] | No
                logger.error(f"Error indexing {fpath}: {e}")
                continue

-    logger.info(f"Vault '{vault_name}': indexed {len(files)} files, {len(paths)} paths, {len(tag_counts)} unique tags")
-    return {"files": files, "tags": tag_counts, "path": vault_path, "paths": paths, "config": {}}
+    logger.info(
+        f"Vault '{vault_name}': indexed {len(files)} files "
+        f"({reused} reused), {len(paths)} paths, {len(tag_counts)} unique tags"
+    )
+    return {"files": files, "tags": tag_counts, "path": vault_path, "paths": paths, "config": {}, "reused": reused}
+
+
+def _read_excalidraw_indexable_text(file_path: Path) -> str:
+    """Read an excalidraw file and return its indexable text (blocking helper).
+
+    Runs inside an executor via ``enrich_pdf_texts`` so the lz-string
+    decompression of large diagrams never blocks the event loop.
+    """
+    try:
+        raw = file_path.read_text(encoding="utf-8", errors="replace")
+    except OSError:
+        return ""
+    try:
+        return extract_excalidraw_indexable(raw)
+    except Exception:  # pragma: no cover - defensive
+        return ""


 async def enrich_pdf_texts(vault_name: str | None = None) -> int:
-    """Extract text from PDFs whose extraction was deferred during the scan (BUG-040).
+    """Extract text deferred during the scan: PDFs (BUG-040) + excalidraw (#86).

-    ``_scan_vault`` only reads PDF metadata so a vault with many or large PDFs
-    starts serving immediately. This coroutine runs *after* the index (and the
-    inverted index) is ready, extracts the missing text off the event loop and
-    updates the in-memory entry plus the incremental index hooks.
+    ``_scan_vault`` only reads PDF metadata and excalidraw filenames so a vault
+    with many or large heavy files starts serving immediately. This coroutine
+    runs *after* the index (and the inverted index) is ready, extracts the
+    missing text off the event loop and updates the in-memory entry plus the
+    incremental index hooks.

    Args:
        vault_name: Restrict the pass to a single vault; ``None`` covers every
            indexed vault.

    Returns:
-        Number of deferred PDFs whose text extraction was attempted.
+        Number of deferred files (PDF + excalidraw) whose text extraction was
+        attempted.
    """
    from backend.pdf_reader import extract_pdf_text

-    pending: list[tuple[str, dict[str, Any], Path]] = []
+    pending: list[tuple[str, dict[str, Any], Path, str]] = []
    with _index_lock:
        for name, vault_data in index.items():
            if vault_name is not None and name != vault_name:
@@ -569,32 +644,38 @@ async def enrich_pdf_texts(vault_name: str | None = None) -> int:
            vault_root = Path(vault_data.get("path", ""))
            for file_info in vault_data.get("files", []):
                if file_info.get("pdf_text_pending"):
-                    pending.append((name, file_info, vault_root / file_info["path"]))
+                    pending.append((name, file_info, vault_root / file_info["path"], "pdf"))
+                elif file_info.get("excalidraw_text_pending"):
+                    pending.append((name, file_info, vault_root / file_info["path"], "excalidraw"))

    if not pending:
        return 0

    loop = asyncio.get_running_loop()
    enriched = 0
-    for name, file_info, file_path in pending:
+    for name, file_info, file_path, kind in pending:
        try:
-            raw = await loop.run_in_executor(None, extract_pdf_text, file_path, 100000)
+            if kind == "pdf":
+                raw = await loop.run_in_executor(None, extract_pdf_text, file_path, 100000)
+            else:
+                raw = await loop.run_in_executor(None, _read_excalidraw_indexable_text, file_path)
        except Exception as exc:  # pragma: no cover - defensive
-            logger.warning("PDF enrichment failed for %s: %s", file_path, exc)
+            logger.warning("Deferred text enrichment failed for %s: %s", file_path, exc)
            raw = ""
        file_info["content"] = raw[:SEARCH_CONTENT_LIMIT]
        file_info["content_preview"] = raw[:200].strip()
        file_info.pop("pdf_text_pending", None)
+        file_info.pop("excalidraw_text_pending", None)
        enriched += 1
        if _on_index_change:
            try:
                _on_index_change("add", name, file_info["path"], file_info)
            except Exception as exc:  # pragma: no cover - defensive
                logger.warning(
-                    "Index hook failed after PDF enrichment for %s: %s", file_path, exc
+                    "Index hook failed after deferred enrichment for %s: %s", file_path, exc
                )

-    logger.info("PDF enrichment: extracted text for %d deferred PDF(s)", enriched)
+    logger.info("Deferred text enrichment: extracted text for %d file(s)", enriched)
    return enriched


@@ -603,16 +684,24 @@ async def build_index(progress_callback=None) -> None:

    Runs vault scans concurrently, inserting them incrementally into the global index.
    Notifies progress via the provided callback.
+
+    #86 differential rebuild: the previous per-vault ``{path: file_info}``
+    snapshots are captured before the clear and handed to ``_scan_vault`` so
+    unchanged files (same size + mtime) are reused without disk re-reads.
    """
    global index, vault_config
    vault_config.clear()
    vault_config.update(load_vault_config())
-    
+
    # Note: vault_settings are now only used for UI display preferences (hideHiddenFiles)
    # Indexing always includes all files regardless of settings
-    
+
    global _index_generation
    with _index_lock:
+        previous_snapshot: dict[str, dict[str, dict[str, Any]]] = {
+            name: {f["path"]: f for f in vdata.get("files", [])}
+            for name, vdata in index.items()
+        }
        index.clear()
        _file_lookup.clear()
        path_index.clear()
@@ -631,8 +720,13 @@ async def build_index(progress_callback=None) -> None:
    loop = asyncio.get_event_loop()

    async def _process_vault(name: str, config: dict[str, Any]):
+        import functools
+
        vault_path = config["path"]
-        vault_data = await loop.run_in_executor(None, _scan_vault, name, vault_path, config)
+        scan = functools.partial(
+            _scan_vault, name, vault_path, config, previous_snapshot.get(name)
+        )
+        vault_data = await loop.run_in_executor(None, scan)
        vault_data["config"] = config

        # Build lookup entries for the new vault
@@ -695,7 +789,7 @@ async def reload_index() -> dict[str, Any]:
        Dict mapping vault names to their file/tag counts.
    """
    await build_index()
-    # BUG-040: complete the deferred PDF extraction for the rebuilt index.
+    # BUG-040/#86: complete the deferred PDF + excalidraw extraction.
    await enrich_pdf_texts()
    stats = {}
    for name, data in index.items():
@@ -724,14 +818,22 @@ async def reload_single_vault(vault_name: str) -> dict[str, Any]:
        raise ValueError(f"Vault '{vault_name}' not found in configuration")
    
    config = vault_config[vault_name]
-    
+
+    # #86 differential rescan: snapshot this vault's entries before removal so
+    # unchanged files are reused without disk re-reads.
+    with _index_lock:
+        _previous = {f["path"]: f for f in index.get(vault_name, {}).get("files", [])}
+
    # Remove old vault data from index structures
    await remove_vault_from_index(vault_name)
-    
+
    # Re-add the vault with updated configuration
+    import functools
+
    vault_path = config["path"]
    loop = asyncio.get_event_loop()
-    vault_data = await loop.run_in_executor(None, _scan_vault, vault_name, vault_path, config)
+    scan = functools.partial(_scan_vault, vault_name, vault_path, config, _previous)
+    vault_data = await loop.run_in_executor(None, scan)
    vault_data["config"] = config
    
    # Build lookup entries for the vault
@@ -761,7 +863,7 @@ async def reload_single_vault(vault_name: str) -> dict[str, Any]:
    from backend.attachment_indexer import build_attachment_index
    await build_attachment_index({vault_name: config})

-    # BUG-040: complete the deferred PDF extraction for this vault.
+    # BUG-040/#86: complete the deferred PDF + excalidraw extraction.
    await enrich_pdf_texts(vault_name)

    stats = {"file_count": len(vault_data["files"]), "tag_count": len(vault_data["tags"])}
@@ -15,6 +15,7 @@ weasyprint>=60.0
 httpx>=0.27.0
 pypdf>=4.0
 pyotp>=2.10.0
+segno>=1.5.0
 webauthn==2.6.0
 psutil>=5.9
 pywebpush>=2.3.0
@@ -26,6 +26,11 @@ from backend.services.vaults import get_vault_root

 logger = logging.getLogger("obsigate.services.mutations")

+# #86: per-file size cap for find/replace passes (CPU guard — complements the
+# BUG-025 regex caps). Files larger than this are skipped instead of being
+# read fully into memory and scanned with a user-supplied pattern.
+MAX_REPLACE_FILE_BYTES = 5_000_000
+
 # Skeleton injected into empty ``.excalidraw`` files (mirrors the route logic).
 _EXCALIDRAW_SKELETON = (
    '{"type":"excalidraw","version":2,"elements":[],'
@@ -509,6 +514,16 @@ def replace_in_files(
            continue
        if not file_path.exists() or not file_path.is_file():
            continue
+        # #86 CPU guard: skip files too large to scan safely in one pass.
+        try:
+            if file_path.stat().st_size > MAX_REPLACE_FILE_BYTES:
+                logger.warning(
+                    "replace_in_files: skipping oversized file %s/%s (%d bytes)",
+                    result_vault, result["path"], file_path.stat().st_size,
+                )
+                continue
+        except OSError:
+            continue
        try:
            original = file_path.read_text(encoding="utf-8", errors="replace")
        except OSError:
@@ -2626,7 +2626,7 @@ dependencies = [

 [[package]]
 name = "obsigate-desktop"
-version = "2.14.1"
+version = "2.16.3"
 dependencies = [
 "chrono",
 "env_logger",
@@ -1,6 +1,6 @@
 [package]
 name = "obsigate-desktop"
-version = "2.14.1"
+version = "2.16.3"
 description = "ObsiGate Desktop — Porte d'entrée native pour vos vaults Obsidian"
 authors = ["Bruno Charest"]
 edition = "2021"
@@ -1,7 +1,7 @@
 {
  "$schema": "https://raw.githubusercontent.com/nicedoc/obsigate/main/desktop/tauri.conf.schema.json",
  "productName": "ObsiGate",
-  "version": "2.14.1",
+  "version": "2.16.3",
  "identifier": "com.obsigate.desktop",
  "build": {
    "frontendDist": "../frontend",
@@ -176,6 +176,9 @@ Avant de corriger quoi que ce soit, un agent IA doit :
 | *BUG-065* | [🟡 IMPORTANT] Éditeur Excalidraw : l'auto-save recharge la page en pleine édition | 🟢 corrigé | P1 | 📱 frontend | IA | `frontend/js/excalidraw-viewer.js`, `frontend/js/utils.js`, `frontend/excalidraw-editor.html`, `tests/frontend/excalidraw-viewer.test.mjs` | Ouvrir un `.excalidraw` puis modifier un élément : au bout de 2 s la vue se recharge | Chaque modification déclenchait un `PUT save` 2 s plus tard → SSE `index_updated` → `reloadExternalWrite` → `openFile` → **recréation de l'iframe** (refresh visible). Auto-save supprimée : sauvegarde explicite (bouton 💾 / Ctrl+S). `reloadExternalWrite` ignore le fichier si un iframe Excalidraw est ouvert (`iframe[data-excalidraw-vault/path]`). Le badge « Modified » ne réagit plus aux changements d'`appState` (resize/zoom) mais à la signature des éléments. | Vérifié Playwright : plus de refresh, badge stable après bascule plein écran. Test statique (absence de `requestSave`/`saveTimer`). |
 | *BUG-066* | [🔵 MINEUR] Configuration : icônes manquantes dans la table des matières (« Fichiers cachés », « Partages publics ») | 🟢 corrigé | P3 | 📱 frontend | IA | `frontend/locales/{fr,en}.json` | Ouvrir Configuration → observer le sommaire : les entrées « Fichiers cachés » et « Partages publics » n'ont pas d'icône | `config.section_hidden` → « 🗂️ Fichiers cachés » / « 🗂️ Hidden files », `config.section_shares` → « 📤 Partages publics » (EN avait déjà l'icône). Test : `tests/frontend/unit.test.mjs` (+1 : toutes les entrées du sommaire portent une icône FR/EN) | Les libellés du sommaire utilisent des clés i18n distinctes des titres de section (`auto.f8ba6127`, `config.section_partages-publics`) qui, elles, avaient l'icône |
 | *BUG-067* | [🔵 MINEUR] Guide d'utilisation : l'entrée « 📱 Mobile » du sommaire ne fait rien (section absente) | 🟢 corrigé | P3 | 📱 frontend | IA | `frontend/index.html` | Ouvrir le Guide → cliquer « 📱 Mobile » dans le sommaire : rien ne se passe | L'ancre `#help-mobile-editor` était présente dans la TOC mais aucune section `id="help-mobile-editor"` n'existait (l'édition mobile n'était qu'un h3 de `help-edition`). Fix #105 : section dédiée créée avec ancre + entrée de nav cohérente. | Vérifié par test statique `tests/test_guide.py::test_nav_anchors_resolve` |
+| *BUG-068* | Configuration — section « 🔒 Sécurité du compte » inachevée : boutons hors thème, QR code invisible, fiabilité des fonctions à valider | 🟢 corrigé | P1 | 📱 frontend + ⚙️ backend | IA | `frontend/js/auth.js`, `frontend/style.css`, `backend/auth/router.py` | Configuration → 🔒 Sécurité du compte | `frontend/style.css` (+`config-btn-primary`/`danger` thème), `backend/auth/router.py` (`qr_data_url` segno local), `frontend/js/auth.js` (QR local + fallback, recovery WebAuthn, carte mot de passe, escapeHtml labels), locales FR/EN, `backend/requirements.txt` (+segno) ; tests `tests/test_mfa.py` (+1) + `tests/frontend/mfa-settings.test.mjs` (nouveau, 9) | pytest 1241 passed / 6 skipped, ruff 0, mypy 0, frontend unit + validate-imports verts |
+| *BUG-069* | Login 2FA bloqué sans erreur : après user+pwd corrects, la page de login reste affichée et le challenge MFA n'apparaît jamais | 🟢 corrigé | P0 | 📱 frontend | IA | `frontend/js/auth.js`, `frontend/index.html` | Activer 2FA → logout → login (bon user+pwd) | `frontend/js/auth.js` (`showMfaChallenge` → `.login-card` + erreur `mfa.challenge_unavailable` si montage impossible), locales FR/EN ; tests `tests/frontend/mfa-settings.test.mjs` (+2) | Reproduit au navigateur avant correctif (challenge jamais affiché), vérifié après : challenge affiché, code erroné → erreur, code valide (200) → app ; frontend mfa-settings 11/11, unit + validate-imports verts |
+| *BUG-070* | Activation clé physique WebAuthn impossible : « Validation du credential WebAuthn échouée » à chaque tentative | 🟢 corrigé | P0 | ⚙️ backend | IA | `backend/auth/webauthn_mfa.py`, `backend/auth/router.py` | Config → Sécurité → Ajouter une clé → cérémonie navigateur → 400 | `resolve_relying_party()` (rp_id/origines dérivés de la requête, config explicite prioritaire, forwarded si TRUST_PROXY) sur les 4 endpoints ; challenges multiples (5 derniers) acceptés ; `.env.example` ; tests `tests/test_webauthn.py` (+8) | Logs : origin `http://localhost:2020` rejetée + challenge mismatch au retry. Vérifié navigateur (authentificateur virtuel CDP) : register 200 + clé listée, clé de test retirée (admin de nouveau TOTP seul) ; pytest 1249 passed, ruff/mypy 0 |
 |  | | | | | | | | | | |

 ### TODOs techniques (améliorations / nouvelles tâches)
@@ -249,6 +252,9 @@ Avant de corriger quoi que ce soit, un agent IA doit :
 | 2026-09-18 | BUG-066 | Correction | `frontend/locales/fr.json`, `frontend/locales/en.json`, `tests/frontend/unit.test.mjs`, `CHANGELOG.md`, `docs/ISSUES_TODOLIST.md` | **BUG-066** : la table des matières de la page de configuration n'affichait aucune icône pour « Fichiers cachés » et « Partages publics ». Les libellés du sommaire proviennent de clés i18n (`config.section_hidden`, `config.section_shares`) distinctes des titres de section qui, eux, portaient déjà l'icône. Alignement : 🗂️ / 📤 en FR **et** EN. Test de non-régression : `unit.test.mjs` vérifie que **toutes** les entrées `.help-nav-link` du sommaire portent une icône dans les deux langues (17/17). Vérifié : `unit.test.mjs` 10/10, `validate-imports` 38 modules. | 🟢 corrigé (en attente vérif utilisateur) |
 | 2026-09-18 | #105, BUG-067 | Documentation + correction | `frontend/index.html`, `frontend/js/config.js`, `frontend/style.css`, `frontend/locales/{fr,en}.json`, `backend/guide_export.py`, `backend/main.py`, `tests/test_guide.py`, `docs/features/guide-coverage-105.md`, `CHANGELOG.md`, `docs/ROADMAP.md`, `docs/ISSUES_TODOLIST.md` | **#105** : audit complet de couverture du Guide d'utilisation — 8 nouvelles sections (Architecture + diagramme Mermaid, API & intégrations, Diagrammes Mermaid & Excalidraw, Hors-ligne & synchronisation, Collaboration temps réel, Application desktop, Bibliothèque & signets, Multilingue) et compléments (recherche sémantique, MFA/WebAuthn, notifications push, exports HTML/ePub/ZIP, PDF, vue multi-panneaux, admin). Téléchargement du guide en Markdown et PDF (`GET /api/guide/download?format=md|pdf`, FR/EN, rendu par le moteur d'export existant). Guide plus large en desktop. **BUG-067** : ancre morte `#help-mobile-editor` → section dédiée créée. | 🟢 corrigé (en attente vérif utilisateur)
 | 2026-09-18 | #105 (ajustements) | Amélioration | `frontend/index.html`, `frontend/js/config.js`, `frontend/sw.js`, `frontend/locales/{fr,en}.json`, `backend/guide_export.py`, `backend/pdf_export.py`, `Dockerfile`, `scripts/build_guide_diagrams.py`, `scripts/render_guide_diagram.mjs`, `scripts/guide_content.py`, `backend/assets/guide_diagrams/df7366a40db6a5a2.png`, `tests/test_guide.py`, `docs/features/guide-coverage-105.md`, `CHANGELOG.md` | **#105 (retour utilisateur)** : 1) boutons de téléchargement du guide passés en icônes seules (tooltips i18n conservés) ; 2) le diagramme Mermaid de la section Architecture est désormais rendu en **vraie image** dans le PDF (pipeline de pré-rendu PNG Chromium+mermaid v11, PNG commité sous `backend/assets/guide_diagrams/<sha1>.png`, résolu par `diagram_png_for()` ; le Markdown garde le fenced mermaid) ; 3) emoji du PDF rendus **en couleur** au lieu de rectangles : `fonts-noto-color-emoji` ajouté au Dockerfile + `"Noto Color Emoji"` en fin de pile de polices PDF. Vérifié : pytest 1218 (test_guide ×13), ruff/mypy 0, validate-imports 38, unit 10/10 ; PDF live conteneur 2020 : 24 pages, 0 glyphes tofu, diagramme 3568x1174 embarqué. | 🟢 livré
+| 2026-09-22 | BUG-068 | Correction | `backend/auth/router.py`, `backend/requirements.txt`, `frontend/js/auth.js`, `frontend/style.css`, `frontend/locales/{fr,en}.json`, `tests/test_mfa.py`, `tests/frontend/mfa-settings.test.mjs` (nouveau), `CHANGELOG.md`, `docs/ISSUES_TODOLIST.md` | **BUG-068** : section « 🔒 Sécurité du compte » finalisée. (1) Boutons hors thème : `config-btn-primary`/`config-btn-danger` n'existaient pas en CSS → définis depuis les variables du thème (+ états disabled). (2) QR invisible : l'image tierce était bloquée par la CSP (`img-src 'self' data: blob:`) et exposait le secret TOTP → QR SVG `data:` généré en local par le backend (`qr_data_url`, segno) avec repli saisie manuelle. (3) Codes de récupération perdus à la 1re activation WebAuthn → `_showRecoveryCodes(codes, targetId)` avec repli `webauthn-flow-area`. (4) Carte « Mot de passe » ajoutée (endpoint `change-password` existant, jusque-là sans UI) + échappement des libellés de clés WebAuthn. Vérifié : pytest 1241 passed / 6 skipped, ruff 0, mypy 0 (78 fichiers), `mfa-settings.test.mjs` 9/9, unit 10/10, validate-imports 39 modules. | 🟢 corrigé (en attente vérif utilisateur) |
+| 2026-09-23 | BUG-069 | Correction | `frontend/js/auth.js`, `frontend/locales/{fr,en}.json`, `tests/frontend/mfa-settings.test.mjs`, `CHANGELOG.md`, `docs/ISSUES_TODOLIST.md` | **BUG-069** : login 2FA bloqué sans erreur — après user+pwd corrects, `showMfaChallenge` cherchait `.login-box` (inexistant dans `index.html`, marquage réel `#login-screen > .login-card`) et faisait un `return` silencieux : page de login figée, aucune erreur. Correctif : montage dans `.login-card` (repli `#login-screen`) + erreur visible `mfa.challenge_unavailable` (FR/EN) si le point de montage manque. **Reproduit au navigateur** (Playwright, instance Docker `obsigate-test`, compte jetable avec TOTP) : avant → challenge jamais affiché ; après → challenge affiché, code erroné → erreur, code valide (verify 200) → app. Tests : `mfa-settings.test.mjs` 11/11 (+2 ancrage DOM), unit 10/10, validate-imports 39 modules. | 🟢 corrigé (en attente vérif utilisateur) |
+| 2026-09-23 | BUG-070 | Correction | `backend/auth/webauthn_mfa.py`, `backend/auth/router.py`, `.env.example`, `tests/test_webauthn.py`, `CHANGELOG.md`, `docs/ISSUES_TODOLIST.md` | **BUG-070** : activation WebAuthn rejetée en 400. (1) Défauts `localhost` sans port → `resolve_relying_party()` dérive rp_id/origines de la requête (config explicite prioritaire, forwarded sous TRUST_PROXY), appliqué aux endpoints register + login. (2) Challenge single-use → 5 derniers conservés, vérification contre le challenge de la cérémonie en cours. **Vérifié au navigateur** (authentificateur virtuel CDP, instance Docker) : register 200, clé listée, clé de test retirée. Tests : `test_webauthn.py` 19/19 (+8), suite complète 1249 passed / 6 skipped, ruff/mypy 0. | 🟢 corrigé (en attente vérif utilisateur) |

 ---

@@ -1,6 +1,6 @@
 # ObsiGate — Roadmap

-> **Version :** 2.14.1 | **Dernière mise à jour :** 2026-09-22
+> **Version :** 2.16.3 | **Dernière mise à jour :** 2026-09-22
 > **Ce fichier ne contient que le travail à venir** (🔵 En cours + ⚪ Backlog) et un index compact
 > vers les fonctionnalités livrées.
 > - **Méthode de livraison à appliquer pour toute tâche : [DELIVERY_WORKFLOW.md](./DELIVERY_WORKFLOW.md)**
@@ -107,15 +107,6 @@
  - [ ] Persister index, JTI révoqués et compteurs de rate-limit (SQLite/Redis)
  - [ ] Verrous asyncio autour de l'index global et des stores JSON ; service de partage public (expiration, révocation, quotas)

-### 86. Optimisation globale des performances (phase 3)
-
- **Effort :** 4-6 jours | **Impact :** 🟡 | **Zone :** backend (`search.py`, `indexer.py`, `mutations.py`)
- **Description :** brancher l'inverted index (déjà construit) sur la recherche simple et le tool IA `search_fulltext`, indexation incrémentale, extraction PDF lazy.
- **Sous-tâches :**
-  - [ ] Recherche simple + tool IA via l'inverted index (suppression du balayage O(N) en mémoire)
-  - [ ] Indexation incrémentale + scan différentiel au démarrage (remplace le `rglob` complet)
-  - [ ] Extraction PDF/excalidraw différée (hors scan) ; caps CPU sur les opérations regex
-
 ### 87. Amélioration continue — tests, CI/CD, revues de sécurité (phase 4)

 - **Effort :** 3-5 jours | **Impact :** 🟡 | **Zone :** `.gitea/workflows/`, `tests/`
@@ -189,6 +180,8 @@
 | 104 | Configuration — Redesign UI de la section « Clés API IA » : recherche fournisseurs, carte défaut 2 colonnes + badges de capacités, cartes dépliables, footer d'actions sticky | 2.12.0 | [features/ai-keys-ui.md](./features/ai-keys-ui.md) |
 | 105 | Guide d'utilisation — audit de couverture complet, téléchargement Markdown/PDF, guide desktop élargi, section Architecture (Mermaid) + BUG-067 | 2.13.0 | [features/guide-coverage-105.md](./features/guide-coverage-105.md) |
 | 106 | Assistant IA — Actions instantanées contextuelles, catalogue « Toutes les actions » & frontmatter complet | 2.14.0 | [features/ai-quick-actions.md](./features/ai-quick-actions.md) |
+| 107 | Configuration — Gestion des clés API & MCP : création/révocation de jetons longue durée (1 j, 1 mois, 6 mois, 1 an, sans fin), une seule clé pour l'API REST et le serveur MCP, « dernière utilisation », store `data/api_tokens.json` sans secret persisté | 2.15.0 | [features/api-mcp-tokens-107.md](./features/api-mcp-tokens-107.md) |
+| 86 | Optimisation globale des performances (phase 3) — scan différentiel, excalidraw différé, garde-fou `replace` (inverted index / PDF lazy / caps regex déjà livrés via BUG-033/040/025) | 2.16.0 | [features/perf-phase3-86.md](./features/perf-phase3-86.md) |

 ---

@@ -196,11 +189,11 @@

 | Priorité | Items | Effort total estimé |
 |---|---|---|
-| ✅ Complété | #1 → #59, #61–72, #74–76, #78–84, #88–93, #94–100, #102–106, #92 | ~115 jours réalisés |
+| ✅ Complété | #1 → #59, #61–72, #74–76, #78–84, #86, #88–93, #94–100, #102–107, #92 | ~120 jours réalisés |
 | 🔵 P2 restant | #77 Desktop : signature de code (non retenue), 6 tests E2E **manuels** ([protocole](./DESKTOP_E2E_CHECKLIST.md)) | ~0,5-1 jour |
 | ⚪ P4 restant | #73 Sync (6-8j) | 6-8 jours |
-| ⚪ P0/P1 restant | #85-87 Refonte architecturale, performance, CI/CD (BUG-035 → BUG-040 corrigés) | ~15-23 jours |
-| **Total restant** | **7 items + finitions** | **~27-42 jours** |
+| ⚪ P0/P1 restant | #85, #87 Refonte architecturale, CI/CD (BUG-035 → BUG-040 corrigés, #86 livré) | ~11-17 jours |
+| **Total restant** | **6 items + finitions** | **~23-36 jours** |

 ---

@@ -0,0 +1,95 @@
+# #107 — Clés API & MCP (panneau de configuration)
+
+**Version : 2.15.0 — statut : complété (septembre 2026)**
+
+## Problème
+
+Pour brancher un client MCP externe (Claude Desktop, Cursor…) ou scripter
+l'API REST, il fallait soit se connecter et voler le JWT de session de 1 h
+dans le navigateur, soit générer un token à la main via `docker exec`
+(`generer_access_token.sh`) — sans expiration maîtrisable ni révocation.
+
+## Décision : une seule clé pour l'API ET le MCP
+
+Le serveur MCP (`/mcp`, `backend/mcp/server.py::_authenticate`) résout
+l'appelant via la même dépendance `get_current_user()` que l'API REST.
+Un jeton HS256 `type=access` authentifie donc **les deux surfaces** — il
+n'y a pas de famille de clés séparée à exposer dans l'UI. C'est dit
+explicitement dans la section (« la même clé fonctionne pour les deux »)
+et verrouillé par tests (REST 200 + MCP initialize 200 avec la même clé ;
+révocation → 401 des deux côtés).
+
+## Conception
+
+### Store — `data/api_tokens.json`
+
+```json
+{"version": 1, "tokens": {"<jti>": {
+  "name": "Claude Desktop", "username": "admin",
+  "created_at": 1790000000, "expires_at": 1792592000,
+  "expiry_key": "30d", "last_used_at": null
+}}}
+```
+
+Le JWT brut n'est **jamais persisté** : affiché une seule fois à la
+création, sinon perdu (pattern GitHub). La révocation fonctionne par
+`jti` : le JWT présenté est rejeté par `is_token_revoked` même s'il est
+encore valide dans sa signature.
+
+### Expirations (choix UI)
+
+| Clé | Durée | `exp` dans le JWT |
+|---|---|---|
+| `1d` | 1 jour | iat + 86 400 |
+| `30d` | 1 mois | iat + 2 592 000 |
+| `180d` | 6 mois | iat + 15 552 000 |
+| `365d` | 1 an | iat + 31 536 000 |
+| `never` | sans fin | **aucun claim exp** |
+
+Plafond : 50 tokens actifs par utilisateur (`API_TOKEN_MAX_PER_USER`).
+
+### Correction induite — révocation longue durée
+
+L'ancien `revoked_tokens.json` bornait toute entrée à 7 jours ; une clé
+1 an révoquée aurait « repris vie » au nettoyage suivant. Le store devient
+un dict `{jti: valid_until}` calé sur l'expiration réelle du jeton
+(« sans fin » → 100 ans). Session tokens inchangés (7 j).
+
+### « Dernière utilisation »
+
+`get_current_user` appelle `maybe_touch_api_token(jti)` pour les jetons
+`api: true` — écriture disque throttlée à 1 h par jti, silencieuse si le
+dossier est en lecture seule ; ne fait jamais échouer une requête.
+
+## Endpoints (`/api/auth`, auth requise, périmètre = l'appelant)
+
+- `GET /api/auth/tokens` → `{tokens: [...], expiry_choices: [...]}`
+- `POST /api/auth/tokens` `{name, expiry}` → `{token, ...record}` (secret unique)
+- `DELETE /api/auth/tokens/{jti}` → révocation immédiate API + MCP
+- Audit : `config_change` / `api_token_create|revoke`.
+
+## UI — panneau Configuration
+
+Nouvelle section `#cfg-tokens` « 🔑 Clés API & MCP » (après Sécurité) :
+liste (badge Active/Expirée, créée/expire/dernière utilisation), champ
+nom + sélecteur d'expiration + Créer, zone secrète en tirets avec Copier,
+bloc « Utilisation » : header `Authorization: Bearer <clé>` + exemple de
+config MCP avec headers sur `<base>/mcp`. 28 clés i18n FR/EN, SW v24.
+
+## Tests — `tests/test_api_tokens.py` (13)
+
+Création/liste (secret jamais restitué), les 5 durées dont l'absence
+d'`exp` pour `never`, expiration invalide → 400, clé identique acceptée
+par REST **et** `/mcp`, refus MCP anonyme, isolation par utilisateur,
+révocation → 401 immédiat des deux côtés, survie de la révocation
+longue durée après reload disque, drapeau `expired`, migration de format
+`revoked_tokens.json`. Suite auth + MCP complète verte (77).
+
+## Config MCP externe (exemple)
+
+```json
+{"mcpServers": {"obsigate": {
+  "url": "http://localhost:2020/mcp",
+  "headers": {"Authorization": "***"}
+}}}
+```
@@ -0,0 +1,69 @@
+# #86 — Optimisation globale des performances (phase 3)
+
+> **Statut :** ✅ livré | **Zone :** backend (`indexer.py`, `mutations.py`)
+> **Prérequis déjà livrés :** BUG-033 (recherche via inverted index), BUG-040 (PDF lazy),
+> BUG-025 (caps regex).
+
+## Contexte
+
+La roadmap #86 demandait : recherche simple + tool IA via l'inverted index, indexation
+incrémentale + scan différentiel au démarrage, extraction PDF/excalidraw différée et caps
+CPU sur les opérations regex. Trois de ces cinq points étaient déjà couverts par des
+correctifs antérieurs ; cette livraison ferme les deux points restants.
+
+## Ce qui était déjà livré (rappel)
+
+| Point #86 | Livré par | État |
+|---|---|---|
+| Recherche simple + `search_fulltext` via inverted index | BUG-033 | `search()` récupère ses candidats via l'inverted index (intersection + expansion de préfixes), repli scan pendant la construction |
+| Extraction PDF différée | BUG-040 | `_scan_vault` ne lit que les métadonnées ; `enrich_pdf_texts()` extrait après index |
+| Caps CPU regex | BUG-025 | `validate_regex` (longueur ≤ 500, rejet quantificateurs imbriqués), contenu tronqué à 200 kio, matchs plafonnés à 1 000 |
+
+## Livré ici
+
+### 1. Scan différentiel au démarrage (`backend/indexer.py`)
+
+- `_scan_vault(..., previous_files)` : quand un snapshot `{relative_path: file_info}` est
+  fourni, toute entrée dont `size` **et** `modified` sont inchangés est réutilisée sans
+  lecture disque ni re-parse (copie du dict, tags recomptés, wikilinks ré-enregistrés
+  depuis le contenu caché pour reconstruire l'index de backlinks).
+- `build_index()` capture le snapshot précédent avant le `clear()` et le transmet à
+  chaque scan de vault (via `functools.partial` pour l'executor) ; `reload_single_vault()`
+  fait de même pour son vault. Seuls le `os.walk` + `stat` (bon marché) tournent à
+  chaque passe ; le retour inclut `reused` (hits différentiels, loggé par vault).
+- Premier démarrage (aucun snapshot) : comportement identique à avant.
+
+### 2. Extraction excalidraw différée (`backend/indexer.py`)
+
+- Le scan ne lit plus les `.excalidraw` / `.excalidraw.md` : titre dérivé du nom de
+  fichier, `content` vide, flag `excalidraw_text_pending` (plus de décompression
+  lz-string pendant le scan).
+- `enrich_pdf_texts()` traite désormais les deux flags (`pdf` + `excalidraw`) via
+  `_read_excalidraw_indexable_text()` exécuté dans l'executor, avec notification du hook
+  d'index incrémental comme pour les PDF. Nom conservé pour compatibilité (tests,
+  `main.py`, `reload_index`, `reload_single_vault` inchangés côté appel).
+- Le chemin incrémental fichier-à-fichier (`_index_single_file_sync`, watcher) reste
+  immédiat : un seul fichier ne justifie pas le différé.
+
+### 3. Garde-fou taille sur `replace_in_files` (`backend/services/mutations.py`)
+
+- Nouvelle constante `MAX_REPLACE_FILE_BYTES` (5 Mio) : tout fichier dépassant le plafond
+  est sauté (warning loggé) au lieu d'être lu intégralement puis balayé par le pattern
+  utilisateur. Complète les caps BUG-025 (qui couvrent la recherche, pas le remplacement
+  qui opère sur le contenu disque complet par nature).
+
+## Tests
+
+`tests/test_perf_phase3.py` (9 tests) : différé excalidraw au scan (`.excalidraw` +
+`.excalidraw.md`), remplissage par l'enrichissement, `reused == 0` au premier scan,
+réutilisation à l'identique, re-parse du fichier modifié, ajout/suppression, skip
+`replace` sur fichier surdimensionné + cas passant nominal.
+
+## Limites connues
+
+- Pas de persistance disque de l'index : le différentiel joue sur les rebuilds dans le
+  même processus (`reload_index`, `reload_single_vault`), pas entre deux redémarrages
+  (persistance = #85, phase 2).
+- La comparaison `size + mtime` ne détecte pas une modification qui conserverait taille
+  et mtime à la milliseconde près (cas pathologique, le watcher temps réel couvre les
+  modifications en cours d'exécution).
@@ -1547,6 +1547,7 @@
 <li><a href="#cfg-themes" class="help-nav-link" data-i18n="settings.themes"></a></li>
 <li><a href="#cfg-profile" class="help-nav-link" data-i18n="settings.profile"></a></li>
 <li><a href="#cfg-security" class="help-nav-link" data-i18n="settings.security"></a></li>
+<li><a href="#cfg-tokens" class="help-nav-link" data-i18n="config.nav_tokens">🔑 Clés API & MCP</a></li>
 <li><a href="#cfg-push" class="help-nav-link" data-i18n="config.section_push">Notifications push</a></li>
 <li><a href="#cfg-plugins" class="help-nav-link" data-i18n="config.section_plugins">🧩 Plugins</a></li>
 <li><a href="#cfg-about" class="help-nav-link" data-i18n="settings.about"></a></li>
@@ -2335,6 +2336,46 @@
                                </div>
                            </section>

+                            <!-- Clés API / MCP (#107) -->
+                            <section id="cfg-tokens" class="config-section help-section">
+                                <h2 data-i18n="config.section_tokens">🔑 Clés API &amp; MCP</h2>
+                                <p class="config-description" data-i18n="config.tokens_desc">
+                                    Jetons longue durée pour l'API REST et le serveur MCP.
+                                    La même clé fonctionne pour les deux (en-tête Authorization: Bearer).
+                                </p>
+                                <div id="tokens-list"></div>
+                                <div class="config-add-row" id="tokens-create-row">
+                                    <input
+                                        type="text"
+                                        id="token-name-input"
+                                        data-i18n-placeholder="config.token_name_placeholder"
+                                        placeholder="Nom (ex: Claude Desktop)"
+                                        class="config-input"
+                                        style="width: 180px"
+                                    />
+                                    <select id="token-expiry-select" class="config-input" style="width: 140px">
+                                        <option value="1d" data-i18n="config.token_expiry_1d">1 jour</option>
+                                        <option value="30d" selected data-i18n="config.token_expiry_30d">1 mois</option>
+                                        <option value="180d" data-i18n="config.token_expiry_180d">6 mois</option>
+                                        <option value="365d" data-i18n="config.token_expiry_365d">1 an</option>
+                                        <option value="never" data-i18n="config.token_expiry_never">Sans fin</option>
+                                    </select>
+                                    <button class="config-btn-add" id="token-create-btn" data-i18n="config.token_create">Créer une clé</button>
+                                </div>
+                                <div id="token-secret-area" class="token-secret-area hidden">
+                                    <p class="config-description" data-i18n="config.token_secret_warning">Copiez cette clé maintenant — elle ne sera plus jamais affichée.</p>
+                                    <textarea id="token-secret-value" class="config-input token-secret-text" rows="3" readonly></textarea>
+                                    <div class="config-add-row">
+                                        <button class="config-btn-add" id="token-copy-btn" data-i18n="config.token_copy">Copier</button>
+                                        <button class="config-btn-add" id="token-dismiss-btn" data-i18n="config.token_done">Terminé</button>
+                                    </div>
+                                </div>
+                                <div class="qh-tip" style="margin-top:10px">
+                                    <strong data-i18n="config.token_usage">Utilisation</strong>
+                                    <span data-i18n="config.token_usage_detail">: en-tête `Authorization: Bearer ` sur l'API, et config MCP (`claude_desktop_config.json`) : `{"mcpServers":{"obsigate":{"url":"<base>/mcp","headers":{"Authorization":"Bearer "}}}}`.</span>
+                                </div>
+                            </section>
+
                                                        <!-- Notifications push -->
                                                        <section
                                                            class="config-section help-section"
@@ -1,6 +1,6 @@
 /* ObsiGate — Authentication: API helper, AuthManager, login form, AdminPanel */
 import { state } from './state.js';
-import { safeCreateIcons } from './utils.js';
+import { safeCreateIcons, escapeHtml } from './utils.js';
 import { showToast, closeHeaderMenu } from './ui.js';
 import { t, getLocale, setLocale } from './i18n.js';
 import { showWelcome } from './viewer.js';
@@ -266,6 +266,13 @@ const AuthManager = {
    });
  },

+  async changePassword(currentPassword, newPassword) {
+    return await api("/api/auth/change-password", {
+      method: "POST",
+      body: JSON.stringify({ current_password: currentPassword, new_password: newPassword }),
+    });
+  },
+
  async logout() {
    try {
      const token = this.getToken();
@@ -545,8 +552,22 @@ function _startWebauthnLogin(mfaSection, username, rememberMe) {


 function showMfaChallenge(username, rememberMe, loginBtn, loginErrorEl, mfaMethod) {
-  const loginBox = document.querySelector(".login-box");
-  if (!loginBox) return;
+  // BUG-069: the challenge used to mount into `.login-box`, which does not
+  // exist in index.html (the login markup is `#login-screen > .login-card >
+  // #login-form`) — querySelector returned null and the function silently
+  // returned, leaving the user stuck on the login page with no error after
+  // entering correct credentials. Mount into the real card, and never fail
+  // silently: surface the problem in the login error box instead.
+  const loginBox = document.querySelector(".login-card")
+    || document.getElementById("login-screen");
+  if (!loginBox) {
+    const fallback = loginErrorEl || document.getElementById("login-error");
+    if (fallback) {
+      fallback.textContent = t("mfa.challenge_unavailable");
+      fallback.classList.remove("hidden");
+    }
+    return;
+  }

  // Hide the normal login form
  const loginForm = document.getElementById("login-form");
@@ -1058,11 +1079,79 @@ async function initMfaSettings() {
    });
  }

+  // Password change (BUG-068: the "Sécurité du compte" section had no way to
+  // change the password although POST /api/auth/change-password exists).
+  _renderPasswordSection(area);
+
  // WebAuthn security keys section (ROADMAP #64)
  _renderWebauthnSection(area);
 }


+function _renderPasswordSection(container) {
+  if (!container || document.getElementById("password-settings")) return;
+  const section = document.createElement("div");
+  section.id = "password-settings";
+  section.className = "password-settings";
+  section.innerHTML = `
+    <h4 class="webauthn-title">${t("mfa.password_change_title")}</h4>
+    <p class="mfa-info-text">${t("mfa.password_change_desc")}</p>
+    <div class="form-group">
+      <label>${t("mfa.current_password_label")}</label>
+      <input type="password" id="pwd-current" class="config-input"
+             placeholder="${t('mfa.current_password_placeholder')}" autocomplete="current-password">
+    </div>
+    <div class="form-group">
+      <label>${t("mfa.new_password_label")}</label>
+      <input type="password" id="pwd-new" class="config-input"
+             placeholder="${t('mfa.new_password_placeholder')}" autocomplete="new-password">
+    </div>
+    <div class="form-group">
+      <label>${t("mfa.new_password_confirm_label")}</label>
+      <input type="password" id="pwd-confirm" class="config-input"
+             placeholder="${t('mfa.new_password_confirm_placeholder')}" autocomplete="new-password">
+    </div>
+    <div class="mfa-recovery-actions">
+      <button class="config-btn-primary" id="pwd-change-btn">${t("mfa.password_change_btn")}</button>
+    </div>
+    <p class="mfa-error hidden" id="pwd-change-error"></p>
+  `;
+  container.appendChild(section);
+
+  section.querySelector("#pwd-change-btn").addEventListener("click", async () => {
+    const errEl = section.querySelector("#pwd-change-error");
+    const current = section.querySelector("#pwd-current").value;
+    const next = section.querySelector("#pwd-new").value;
+    const confirm = section.querySelector("#pwd-confirm").value;
+    const btn = section.querySelector("#pwd-change-btn");
+    errEl.classList.add("hidden");
+    if (!current || !next || !confirm) {
+      errEl.textContent = t("mfa.fill_all_fields");
+      errEl.classList.remove("hidden");
+      return;
+    }
+    if (next !== confirm) {
+      errEl.textContent = t("mfa.password_mismatch");
+      errEl.classList.remove("hidden");
+      return;
+    }
+    btn.disabled = true;
+    try {
+      await AuthManager.changePassword(current, next);
+      showToast(t("mfa.password_changed"), "success");
+      section.querySelector("#pwd-current").value = "";
+      section.querySelector("#pwd-new").value = "";
+      section.querySelector("#pwd-confirm").value = "";
+    } catch (err) {
+      errEl.textContent = err.message || String(err);
+      errEl.classList.remove("hidden");
+    } finally {
+      btn.disabled = false;
+    }
+  });
+}
+
+
 async function _renderWebauthnSection(container) {
  if (!container || !window.PublicKeyCredential) return;

@@ -1085,10 +1174,10 @@ async function _renderWebauthnSection(container) {
  const listHtml = keys.length
    ? `<ul class="webauthn-key-list">${keys.map((k) => `
        <li class="webauthn-key-item">
-          <span class="webauthn-key-label">🔑 ${k.label || "Security key"}</span>
-          <span class="webauthn-key-meta">${(k.transports || []).join(", ") || "—"}</span>
+          <span class="webauthn-key-label">🔑 ${escapeHtml(k.label || "Security key")}</span>
+          <span class="webauthn-key-meta">${escapeHtml((k.transports || []).join(", ") || "—")}</span>
          <button class="config-btn-secondary config-btn-sm webauthn-key-remove"
-                  data-id="${k.credential_id}">${t("mfa.webauthn_remove")}</button>
+                  data-id="${escapeHtml(k.credential_id)}">${t("mfa.webauthn_remove")}</button>
        </li>`).join("")}</ul>`
    : `<p class="mfa-info-text">${t("mfa.webauthn_none")}</p>`;

@@ -1111,7 +1200,10 @@ async function _renderWebauthnSection(container) {
      const label = prompt(t("mfa.webauthn_label_prompt"), "Ma clé");
      const result = await AuthManager.webauthnRegister(credential, label || "Security key");
      if (result.recovery_codes && result.recovery_codes.length) {
-        _showRecoveryCodes(result.recovery_codes);
+        // BUG-068: first-time WebAuthn enable issues recovery codes. There is
+        // no #mfa-setup-flow-area in the "already enabled" view, so render
+        // them into the WebAuthn flow area instead of losing them.
+        _showRecoveryCodes(result.recovery_codes, "webauthn-flow-area");
      } else {
        showToast(t("mfa.webauthn_added"), "success");
      }
@@ -1145,16 +1237,28 @@ async function _startMfaSetup() {

  try {
    const data = await AuthManager.mfaSetup();
+    // BUG-068: the QR code comes from the backend as a local SVG data: URI
+    // (see POST /api/auth/mfa/totp/setup → qr_data_url). The previous
+    // third-party QR image was blocked by the CSP
+    // (img-src 'self' data: blob:) so it never displayed — and it leaked the
+    // otpauth URI (TOTP secret) to a third party. Fall back to the manual
+    // secret when the backend has no QR generator available.
+    const qrImg = data.qr_data_url
+      ? `<img id="mfa-qr-img" alt="QR Code" class="mfa-qr-code-img"
+              src="${data.qr_data_url}"
+              onerror="this.style.display='none';document.getElementById('mfa-qr-fallback').style.display='block';">`
+      : "";
+    const fallbackStyle = data.qr_data_url ? "display:none" : "";
    flowArea.innerHTML = `
      <div class="mfa-setup-card">
        <h4>${t("mfa.scan_qr")}</h4>
        <div class="mfa-qr-container">
-          <img id="mfa-qr-img" alt="QR Code" class="mfa-qr-code"
-               src="https://api.qrserver.com/v1/create-qr-code/?size=200x200&data=${encodeURIComponent(data.otpauth_uri)}">
+          ${qrImg}
+          <p class="mfa-info-text" id="mfa-qr-fallback" style="${fallbackStyle}">${t("mfa.qr_unavailable")}</p>
        </div>
-        <details class="mfa-secret-details">
+        <details class="mfa-secret-details" ${data.qr_data_url ? "" : "open"}>
          <summary>${t("mfa.manual_entry")}</summary>
-          <code class="mfa-secret-code">${data.secret}</code>
+          <code class="mfa-secret-code">${escapeHtml(data.secret)}</code>
        </details>
        <div class="mfa-verify-section">
          <label>${t("mfa.enter_code")}</label>
@@ -1201,12 +1305,16 @@ async function _startMfaSetup() {
 }


-function _showRecoveryCodes(codes) {
-  const flowArea = document.getElementById("mfa-setup-flow-area");
-  const area = document.getElementById("mfa-setup-area");
+function _showRecoveryCodes(codes, targetId) {
+  // BUG-068: the recovery codes must be visible wherever the enable flow ran.
+  // The TOTP flow owns #mfa-setup-flow-area, but the WebAuthn first-enable
+  // path (#webauthn-flow-area) has none — previously those codes were lost.
+  const flowArea = document.getElementById(targetId || "mfa-setup-flow-area")
+    || document.getElementById("webauthn-flow-area")
+    || document.getElementById("mfa-setup-area");
  if (!flowArea) return;

-  const codesHtml = codes.map(c => `<code class="mfa-recovery-code">${c}</code>`).join("\n");
+  const codesHtml = codes.map(c => `<code class="mfa-recovery-code">${escapeHtml(c)}</code>`).join("\n");
  flowArea.innerHTML = `
    <div class="mfa-recovery-card">
      <h4>🔑 ${t("mfa.recovery_codes_title")}</h4>
@@ -773,6 +773,7 @@ function initConfigModal() {
    loadAbout();
    await loadHiddenFilesSettings();
    loadWebhooksUI();
+    loadTokensUI();
    loadSharesUI();
    loadToolKeys();
    safeCreateIcons();
@@ -1346,6 +1347,109 @@ document.addEventListener("click", function(e) {
  }
 });

+// ── API / MCP tokens UI (#107) ──
+let _tokensBound = false;
+
+async function loadTokensUI() {
+  const list = document.getElementById("tokens-list");
+  if (!list) return;
+  try {
+    const data = await api("/api/auth/tokens");
+    renderTokensUI(data.tokens || []);
+    bindTokenEvents();
+  } catch (err) {
+    list.innerHTML = '<div class="config-description">' + escapeHtml(t("config.error_prefix") + ": " + (err.message || "")) + "</div>";
+  }
+}
+
+function _formatTokenDate(unixSec) {
+  if (!unixSec) return "";
+  return new Date(unixSec * 1000).toLocaleDateString(undefined, { day: "numeric", month: "short", year: "numeric" });
+}
+
+function _tokenExpiryLabel(tok) {
+  if (!tok.expires_at) return t("config.token_expiry_never");
+  const map = { "1d": "config.token_expiry_1d", "30d": "config.token_expiry_30d", "180d": "config.token_expiry_180d", "365d": "config.token_expiry_365d" };
+  return map[tok.expiry_key] ? t(map[tok.expiry_key]) : _formatTokenDate(tok.expires_at);
+}
+
+function renderTokensUI(tokens) {
+  const list = document.getElementById("tokens-list");
+  if (!list) return;
+  if (!tokens.length) {
+    list.innerHTML = '<div class="config-description">' + escapeHtml(t("config.tokens_empty")) + "</div>";
+    return;
+  }
+  list.innerHTML = tokens.map(tok => {
+    const expired = tok.expired || (tok.expires_at && tok.expires_at * 1000 < Date.now());
+    const status = expired
+      ? '<span class="token-badge token-badge-expired">' + escapeHtml(t("config.token_status_expired")) + "</span>"
+      : '<span class="token-badge token-badge-active">' + escapeHtml(t("config.token_status_active")) + "</span>";
+    const meta = [
+      t("config.token_created") + " " + _formatTokenDate(tok.created_at),
+      t("config.token_expires") + " " + _tokenExpiryLabel(tok),
+      tok.last_used_at ? t("config.token_last_used") + " " + _formatTokenDate(tok.last_used_at) : t("config.token_never_used")
+    ].join(" · ");
+    return '<div class="token-item" data-jti="' + escapeHtml(tok.jti) + '">' +
+      '<span class="token-name">' + escapeHtml(tok.name) + "</span>" +
+      status +
+      '<span class="token-meta">' + escapeHtml(meta) + "</span>" +
+      '<button class="token-delete" data-jti="' + escapeHtml(tok.jti) + '" data-name="' + escapeHtml(tok.name) + '" title="' + escapeHtml(t("config.token_revoke")) + '">✕</button>' +
+      "</div>";
+  }).join("");
+  list.querySelectorAll(".token-delete").forEach(btn => btn.addEventListener("click", async () => {
+    const name = btn.dataset.name;
+    if (!confirm(t("config.token_revoke_confirm") + " \"" + name + "\" ?")) return;
+    try {
+      await api("/api/auth/tokens/" + btn.dataset.jti, { method: "DELETE" });
+      showToast(t("config.token_revoked_toast"), "success");
+      loadTokensUI();
+    } catch (err) {
+      showToast(err.message || t("config.error_unknown"), "error");
+    }
+  }));
+}
+
+function bindTokenEvents() {
+  if (_tokensBound) return;
+  _tokensBound = true;
+  const createBtn = document.getElementById("token-create-btn");
+  if (!createBtn) return;
+  createBtn.addEventListener("click", async () => {
+    const name = document.getElementById("token-name-input").value.trim();
+    const expiry = document.getElementById("token-expiry-select").value;
+    if (!name) { showToast(t("config.token_name_required"), "error"); return; }
+    createBtn.disabled = true;
+    try {
+      const res = await api("/api/auth/tokens", { method: "POST", body: JSON.stringify({ name, expiry }) });
+      const area = document.getElementById("token-secret-area");
+      const ta = document.getElementById("token-secret-value");
+      ta.value = res.token;
+      area.classList.remove("hidden");
+      ta.select();
+      document.getElementById("token-name-input").value = "";
+      showToast(t("config.token_created_toast"), "success");
+      loadTokensUI();
+    } catch (err) {
+      showToast(err.message || t("config.error_unknown"), "error");
+    } finally {
+      createBtn.disabled = false;
+    }
+  });
+  const copyBtn = document.getElementById("token-copy-btn");
+  if (copyBtn) copyBtn.addEventListener("click", async () => {
+    const ta = document.getElementById("token-secret-value");
+    try { await navigator.clipboard.writeText(ta.value); }
+    catch { ta.select(); document.execCommand("copy"); }
+    showToast(t("config.token_copied"), "success");
+  });
+  const dismissBtn = document.getElementById("token-dismiss-btn");
+  if (dismissBtn) dismissBtn.addEventListener("click", () => {
+    document.getElementById("token-secret-area").classList.add("hidden");
+    document.getElementById("token-secret-value").value = "";
+  });
+}
+
 // ── Shares UI ──
 async function loadSharesUI() {
  const list = document.getElementById("shares-list");
@@ -572,6 +572,34 @@
  "config.title_boost": "Title boost",
  "config.title_boost_hint": "Relevance multiplier for title matches",
  "config.title_boost_label": "Title boost",
+  "config.nav_tokens": "🔑 API & MCP keys",
+  "config.section_tokens": "🔑 API & MCP keys",
+  "config.tokens_desc": "Long-lived tokens for the REST API and the MCP server — the same key works for both (Authorization: Bearer header).",
+  "config.tokens_empty": "No API keys created.",
+  "config.token_name_placeholder": "Name (e.g. Claude Desktop)",
+  "config.token_name_required": "A name is required",
+  "config.token_expiry_1d": "1 day",
+  "config.token_expiry_30d": "1 month",
+  "config.token_expiry_180d": "6 months",
+  "config.token_expiry_365d": "1 year",
+  "config.token_expiry_never": "Never",
+  "config.token_create": "Create key",
+  "config.token_secret_warning": "Copy this key now — it will never be shown again.",
+  "config.token_copy": "Copy",
+  "config.token_copied": "Key copied to clipboard",
+  "config.token_done": "Done",
+  "config.token_usage": "Usage",
+  "config.token_usage_detail": ": \"Authorization: Bearer <key>\" header on the API; for MCP, declare it in the headers of the /mcp URL.",
+  "config.token_created": "Created",
+  "config.token_expires": "Expires",
+  "config.token_last_used": "Last used",
+  "config.token_never_used": "Never used",
+  "config.token_status_active": "Active",
+  "config.token_status_expired": "Expired",
+  "config.token_revoke": "Revoke",
+  "config.token_revoke_confirm": "Revoke key",
+  "config.token_revoked_toast": "Key revoked (immediate effect on API + MCP)",
+  "config.token_created_toast": "Key created",
  "config.url_required": "URL required",
  "config.watcher_debounce_label": "Debounce (s)",
  "config.watcher_enabled_label": "Enable watcher",
@@ -1859,6 +1887,19 @@
  "mfa.disable_confirm_btn": "Disable 2FA",
  "mfa.disabled_success": "2FA has been disabled.",
  "mfa.fill_all_fields": "Please fill in all fields.",
+  "mfa.qr_unavailable": "QR code unavailable — use manual entry below.",
+  "mfa.password_change_title": "Password",
+  "mfa.password_change_desc": "Change your account password (min. 8 characters). All other sessions are invalidated.",
+  "mfa.current_password_label": "Current password",
+  "mfa.current_password_placeholder": "Your current password",
+  "mfa.new_password_label": "New password",
+  "mfa.new_password_placeholder": "Min. 8 characters",
+  "mfa.new_password_confirm_label": "Confirm new password",
+  "mfa.new_password_confirm_placeholder": "Repeat the new password",
+  "mfa.password_change_btn": "Change password",
+  "mfa.password_mismatch": "The two passwords do not match.",
+  "mfa.password_changed": "Password updated.",
+  "mfa.challenge_unavailable": "Verification screen unavailable — please reload the page.",
  "bookslm.title": "BooksLM",
  "bookslm.files_indexed": "{count} files indexed",
  "bookslm.chars_loaded": "{chars} chars loaded",
@@ -572,6 +572,34 @@
  "config.title_boost": "Boost titre",
  "config.title_boost_hint": "Multiplicateur de pertinence pour les correspondances dans le titre",
  "config.title_boost_label": "Boost titre",
+  "config.nav_tokens": "🔑 Clés API & MCP",
+  "config.section_tokens": "🔑 Clés API & MCP",
+  "config.tokens_desc": "Jetons longue durée pour l'API REST et le serveur MCP — la même clé fonctionne pour les deux (en-tête Authorization: Bearer).",
+  "config.tokens_empty": "Aucune clé API créée.",
+  "config.token_name_placeholder": "Nom (ex: Claude Desktop)",
+  "config.token_name_required": "Un nom est requis",
+  "config.token_expiry_1d": "1 jour",
+  "config.token_expiry_30d": "1 mois",
+  "config.token_expiry_180d": "6 mois",
+  "config.token_expiry_365d": "1 an",
+  "config.token_expiry_never": "Sans fin",
+  "config.token_create": "Créer une clé",
+  "config.token_secret_warning": "Copiez cette clé maintenant — elle ne sera plus jamais affichée.",
+  "config.token_copy": "Copier",
+  "config.token_copied": "Clé copiée dans le presse-papiers",
+  "config.token_done": "Terminé",
+  "config.token_usage": "Utilisation",
+  "config.token_usage_detail": ": en-tête « Authorization: Bearer <clé> » sur l'API ; pour MCP, déclarez-la dans les headers de l'URL /mcp.",
+  "config.token_created": "Créée le",
+  "config.token_expires": "Expire",
+  "config.token_last_used": "Dernière utilisation",
+  "config.token_never_used": "Jamais utilisée",
+  "config.token_status_active": "Active",
+  "config.token_status_expired": "Expirée",
+  "config.token_revoke": "Révoquer",
+  "config.token_revoke_confirm": "Révoquer la clé",
+  "config.token_revoked_toast": "Clé révoquée (effet immédiat API + MCP)",
+  "config.token_created_toast": "Clé créée",
  "config.url_required": "URL requise",
  "config.watcher_debounce_label": "Debounce (s)",
  "config.watcher_enabled_label": "Activer la surveillance",
@@ -1859,6 +1887,19 @@
  "mfa.disable_confirm_btn": "Désactiver la 2FA",
  "mfa.disabled_success": "La 2FA a été désactivée.",
  "mfa.fill_all_fields": "Veuillez remplir tous les champs.",
+  "mfa.qr_unavailable": "QR code indisponible — utilisez la saisie manuelle ci-dessous.",
+  "mfa.password_change_title": "Mot de passe",
+  "mfa.password_change_desc": "Modifiez le mot de passe de votre compte (min. 8 caractères). Toutes les autres sessions sont invalidées.",
+  "mfa.current_password_label": "Mot de passe actuel",
+  "mfa.current_password_placeholder": "Votre mot de passe actuel",
+  "mfa.new_password_label": "Nouveau mot de passe",
+  "mfa.new_password_placeholder": "Min. 8 caractères",
+  "mfa.new_password_confirm_label": "Confirmer le nouveau mot de passe",
+  "mfa.new_password_confirm_placeholder": "Répétez le nouveau mot de passe",
+  "mfa.password_change_btn": "Changer le mot de passe",
+  "mfa.password_mismatch": "Les deux mots de passe ne correspondent pas.",
+  "mfa.password_changed": "Mot de passe mis à jour.",
+  "mfa.challenge_unavailable": "Écran de vérification indisponible — veuillez recharger la page.",
  "bookslm.title": "BooksLM",
  "bookslm.files_indexed": "{count} fichiers indexés",
  "bookslm.chars_loaded": "{chars} caractères chargés",
@@ -4347,6 +4347,76 @@ body.resizing-v {
  background: var(--bg-hover);
 }

+/* BUG-068: .config-btn-primary / .config-btn-danger were used by the account
+   security section (frontend/js/auth.js) but never defined — the buttons fell
+   back to the browser default and ignored the theme. Defined here with the
+   same conventions as .config-btn-save / .config-btn-secondary. */
+.config-btn-primary {
+  padding: 8px 16px;
+  border: 1px solid var(--accent);
+  border-radius: 6px;
+  background: var(--accent);
+  color: #fff;
+  font-family: "JetBrains Mono", monospace;
+  font-size: 0.8rem;
+  font-weight: 600;
+  cursor: pointer;
+  transition: opacity 150ms;
+}
+.config-btn-primary:hover {
+  opacity: 0.9;
+}
+.config-btn-primary:disabled {
+  opacity: 0.55;
+  cursor: not-allowed;
+}
+.config-btn-danger {
+  padding: 8px 16px;
+  border: 1px solid var(--danger, #e74c3c);
+  border-radius: 6px;
+  background: var(--danger-bg, #3d1a18);
+  color: var(--danger, #ff7b72);
+  font-family: "JetBrains Mono", monospace;
+  font-size: 0.8rem;
+  font-weight: 600;
+  cursor: pointer;
+  transition: opacity 150ms;
+}
+.config-btn-danger:hover {
+  opacity: 0.9;
+}
+.config-btn-danger:disabled {
+  opacity: 0.55;
+  cursor: not-allowed;
+}
+
+/* BUG-068: local QR code (backend SVG data: URI) + password section share the
+   security-tab card conventions. */
+.mfa-qr-code-img {
+  max-width: 200px;
+  border-radius: 8px;
+  background: #fff;
+  padding: 8px;
+}
+.password-settings {
+  margin-top: 20px;
+  padding-top: 16px;
+  border-top: 1px solid var(--border, #333);
+}
+.password-settings .form-group {
+  margin: 8px 0;
+}
+.password-settings .form-group label {
+  display: block;
+  font-size: 0.78rem;
+  color: var(--text-secondary, #aaa);
+  margin-bottom: 4px;
+}
+.password-settings .config-input {
+  width: 100%;
+  max-width: 320px;
+}
+
 /* --- AI keys section: accordion redesign (#104) --- */
 .ai-keys-header {
  display: flex;
@@ -7607,6 +7677,27 @@ body.popup-mode .content-area {
 .config-add-row { display: flex; gap: 8px; margin-top: 8px; }
 .config-btn-add { padding: 6px 14px; background: var(--accent); color: #fff; border: none; border-radius: 6px; cursor: pointer; font-size: 0.8rem; }

+/* ── API/MCP tokens UI (#107) ── */
+.token-item {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  padding: 8px 10px;
+  background: var(--bg-card, var(--bg-secondary));
+  border-radius: 6px;
+  margin-bottom: 6px;
+  font-size: 0.8rem;
+}
+.token-name { font-weight: 500; min-width: 90px; }
+.token-badge { font-size: 0.65rem; padding: 2px 8px; border-radius: 10px; white-space: nowrap; }
+.token-badge-active { background: color-mix(in srgb, var(--success, #2e7d32) 18%, transparent); color: var(--success, #2e7d32); }
+.token-badge-expired { background: color-mix(in srgb, var(--text-error, #c62828) 15%, transparent); color: var(--text-error, #c62828); }
+.token-meta { color: var(--text-muted); font-size: 0.7rem; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; flex: 1; }
+.token-delete { background: none; border: none; color: var(--text-error); cursor: pointer; font-size: 1rem; padding: 2px 6px; }
+.token-secret-area { margin-top: 10px; padding: 10px; border: 1px dashed var(--accent); border-radius: 8px; }
+.token-secret-area.hidden { display: none; }
+.token-secret-text { width: 100%; font-family: monospace; font-size: 0.7rem; word-break: break-all; resize: none; }
+
 /* ── Shares UI ── */
 .share-item {
  display: flex;
@@ -11,7 +11,7 @@
 * cache or Cloudflare does NOT clear the Service Worker Cache Storage, which is
 * a separate store. Bumping SW_VERSION invalidates it on every release.
 */
-const SW_VERSION = 'v23';
+const SW_VERSION = 'v24';
 const CODE_CACHE = `obsigate-code-${SW_VERSION}`;
 const RUNTIME_CACHE = `obsigate-runtime-${SW_VERSION}`;
 const API_CACHE = `obsigate-api-${SW_VERSION}`;
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Génère un token d'accès ObsiGate longue durée pour le client MCP
+# Conteneur de test local: obsigate-test (adapter le nom selon l'instance)
+docker exec -i obsigate-test python - <<'PYEOF'
+import time, uuid, json
+from jose import jwt
+key = open("data/secret.key").read().strip()
+u = json.load(open("data/users.json"))["users"]["admin"]
+now = int(time.time())
+tok = jwt.encode({
+    "sub": "admin",
+    "role": u["role"],
+    "vaults": u["vaults"],
+    "jti": str(uuid.uuid4()),
+    "iat": now,
+    "exp": now + 31536000,   # 1 an
+    "type": "access",
+}, key, algorithm="HS256")
+print(tok)
+PYEOF
@@ -1,6 +1,6 @@
 {
  "name": "obsigate",
-  "version": "2.14.1",
+  "version": "2.16.3",
  "description": "**Porte d'entrée web ultra-léger pour vos vaults Obsidian** — Accédez, naviguez et recherchez dans toutes vos notes Obsidian depuis n'importe quel appareil via une interface web moderne et responsive.",
  "main": "patch.js",
  "directories": {
@@ -0,0 +1,136 @@
+#!/usr/bin/env node
+/**
+ * ObsiGate — Account security section non-regression tests (BUG-068).
+ *
+ * Static checks on the "🔒 Sécurité du compte" configuration section:
+ *  - BUG-068a: the TOTP QR code must NOT depend on the third-party
+ *    https://api.qrserver.com service (blocked by the CSP
+ *    `img-src 'self' data: blob:`, so the QR never displayed — and the
+ *    otpauth URI, TOTP secret included, leaked to a third party). The setup
+ *    endpoint returns a local SVG data: URI (qr_data_url) instead.
+ *  - BUG-068b: .config-btn-primary / .config-btn-danger are used by
+ *    frontend/js/auth.js but were never defined — buttons fell back to the
+ *    browser default and ignored the theme. They must exist and derive from
+ *    theme variables.
+ *  - BUG-068c: recovery codes issued on first-time WebAuthn enable were lost
+ *    (no #mfa-setup-flow-area in the "already enabled" view).
+ *  - BUG-068d: the section had no password change although
+ *    POST /api/auth/change-password exists.
+ *
+ * Usage: node tests/frontend/mfa-settings.test.mjs
+ */
+
+import { strict as assert } from "node:assert";
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const ROOT = path.join(__dirname, "..", "..");
+
+const auth = readFileSync(path.join(ROOT, "frontend", "js", "auth.js"), "utf8");
+const css = readFileSync(path.join(ROOT, "frontend", "style.css"), "utf8");
+const router = readFileSync(path.join(ROOT, "backend", "auth", "router.py"), "utf8");
+const indexHtml = readFileSync(path.join(ROOT, "frontend", "index.html"), "utf8");
+const fr = JSON.parse(readFileSync(path.join(ROOT, "frontend", "locales", "fr.json"), "utf8"));
+const en = JSON.parse(readFileSync(path.join(ROOT, "frontend", "locales", "en.json"), "utf8"));
+
+function test(label, fn) {
+  try {
+    fn();
+    console.log("  ✓ " + label);
+  } catch (err) {
+    console.error("  ✗ " + label + "\n    " + err.message);
+    process.exitCode = 1;
+  }
+}
+
+// ── QR code: local data URI, no third-party service ─────────────────────────
+test("auth.js — no external QR service left (CSP blocks it, secret leaks)", () => {
+  assert.doesNotMatch(auth, /qrserver\.com/, "api.qrserver.com is blocked by img-src and leaks the otpauth URI");
+  assert.doesNotMatch(auth, /https:\/\/api\./, "no third-party https://api.* image may carry the TOTP secret");
+});
+
+test("auth.js — setup flow renders the backend qr_data_url with a fallback", () => {
+  assert.match(auth, /qr_data_url/, "the QR <img> must use the backend-provided qr_data_url");
+  assert.match(auth, /mfa-qr-fallback/, "a manual-entry fallback must show when no QR is available");
+  assert.match(auth, /mfa\.qr_unavailable/, "the fallback needs its i18n string");
+});
+
+test("backend — /mfa/totp/setup returns a local qr_data_url", () => {
+  assert.match(router, /qr_data_url/, "setup must include qr_data_url in its response");
+  assert.match(router, /svg_data_uri/, "the QR must be generated locally (segno SVG data URI)");
+  assert.match(router, /import segno/, "segno import must stay local with a graceful fallback");
+});
+
+// ── Buttons follow the theme ────────────────────────────────────────────────
+for (const cls of ["config-btn-primary", "config-btn-danger"]) {
+  test(`style.css — .${cls} is defined from theme variables`, () => {
+    const rule = css.match(new RegExp(`\\.${cls}\\s*\\{([^}]*)\\}`));
+    assert.ok(rule, `.${cls} rule not found — buttons fall back to the browser default`);
+    assert.match(rule[1], /var\(--/, `.${cls} must derive from CSS theme variables, not hardcoded colors`);
+  });
+}
+
+test("style.css — themed buttons have disabled states", () => {
+  assert.match(css, /\.config-btn-primary:disabled/, ".config-btn-primary needs a disabled state");
+  assert.match(css, /\.config-btn-danger:disabled/, ".config-btn-danger needs a disabled state");
+});
+
+// ── Recovery codes are never lost ───────────────────────────────────────────
+test("auth.js — _showRecoveryCodes falls back to the WebAuthn flow area", () => {
+  const fn = auth.match(/function _showRecoveryCodes\(codes(?:, targetId)?\) \{([\s\S]*?)\n\}/);
+  assert.ok(fn, "_showRecoveryCodes helper not found");
+  assert.match(fn[1], /webauthn-flow-area/, "codes issued on first WebAuthn enable must render without #mfa-setup-flow-area");
+});
+
+// ── Password change lives in the security section ───────────────────────────
+test("auth.js — password change calls POST /api/auth/change-password", () => {
+  assert.match(auth, /\/api\/auth\/change-password/, "changePassword must hit the existing endpoint");
+  assert.match(auth, /_renderPasswordSection/, "the security section must render a password card");
+});
+
+test("i18n — password + QR strings exist in FR and EN", () => {
+  for (const key of [
+    "mfa.qr_unavailable",
+    "mfa.password_change_title",
+    "mfa.password_change_btn",
+    "mfa.password_mismatch",
+    "mfa.password_changed",
+    "mfa.challenge_unavailable",
+  ]) {
+    assert.ok(fr[key], `fr.json missing ${key}`);
+    assert.ok(en[key], `en.json missing ${key}`);
+  }
+});
+
+// ── BUG-069: the MFA challenge must mount into a real DOM node ──────────────
+test("auth.js — challenge mounts into .login-card (exists in index.html)", () => {
+  assert.doesNotMatch(
+    auth,
+    /querySelector\("\.login-box"\)/,
+    "showMfaChallenge queried .login-box, which never existed in index.html → silent return, login stuck with no error",
+  );
+  assert.match(
+    auth,
+    /querySelector\("\.login-card"\)/,
+    "the challenge must mount into the real login container",
+  );
+  assert.ok(
+    indexHtml.includes('class="login-card"'),
+    "index.html must contain the .login-card mount point",
+  );
+});
+
+test("auth.js — showMfaChallenge never fails silently", () => {
+  const fn = auth.match(/function showMfaChallenge\(username, rememberMe, loginBtn, loginErrorEl, mfaMethod\) \{([\s\S]*?)\n  \/\/ WebAuthn second factor/);
+  assert.ok(fn, "showMfaChallenge helper not found");
+  assert.match(fn[1], /challenge_unavailable/, "a missing mount point must surface an error, not silently return");
+  assert.doesNotMatch(fn[1], /if \(!loginBox\) return;/, "bare silent return is forbidden in the challenge flow");
+});
+
+if (process.exitCode) {
+  console.error("\nMFA settings tests FAILED");
+} else {
+  console.log("\nAll MFA settings tests passed.");
+}
@@ -0,0 +1,271 @@
+# tests/test_api_tokens.py — Feature #107 : jetons API/MCP gérés dans la config.
+"""Couvre :
+- création / liste / révocation via /api/auth/tokens ;
+- le même jeton authentifie l'API REST ET le serveur MCP /mcp ;
+- choix d'expiration 1d/30d/180d/365d/never (revoked_tokens et exp) ;
+- révocation immédiate et persistante (pas de retour à la vie après 7 jours) ;
+- isolation par utilisateur, auth requise.
+"""
+import json
+import os
+import time
+
+import pytest
+from fastapi.testclient import TestClient
+
+ACCEPT = "application/json, text/event-stream"
+
+
+@pytest.fixture
+def tokens_client(tmp_path, monkeypatch):
+    """Auth-enabled TestClient in an isolated data dir (admin / chab30)."""
+    import shutil
+    from pathlib import Path
+
+    data_dir = tmp_path / "data"
+    data_dir.mkdir()
+    from backend.auth.password import hash_password
+
+    users = {
+        "version": 1,
+        "users": {
+            "admin": {
+                "id": "admin-1", "username": "admin", "display_name": "admin",
+                "password_hash": hash_password("chab30"), "role": "admin",
+                "vaults": ["*"], "active": True,
+                "created_at": "2026-01-01T00:00:00",
+            },
+            "bob": {
+                "id": "bob-1", "username": "bob", "display_name": "bob",
+                "password_hash": hash_password("chab30"), "role": "user",
+                "vaults": ["TestVault"], "active": True,
+                "created_at": "2026-01-01T00:00:00",
+            },
+        },
+    }
+    (data_dir / "users.json").write_text(json.dumps(users), encoding="utf-8")
+    src_secret = Path("data/secret.key")
+    if src_secret.exists():
+        shutil.copy2(str(src_secret), str(data_dir / "secret.key"))
+
+    vault = os.path.abspath("test_vault")
+    orig_cwd = os.getcwd()
+    os.chdir(str(tmp_path))
+    os.environ["VAULT_1_NAME"] = "TestVault"
+    os.environ["VAULT_1_PATH"] = vault
+    os.environ["OBSIGATE_AUTH_ENABLED"] = "true"
+    os.environ["OBSIGATE_WATCHER_ENABLED"] = "false"
+
+    import backend.main
+    backend.main._load_config = lambda: {"watcher_enabled": False}
+
+    from backend.indexer import build_index, index
+    import asyncio
+    for key in list(index.keys()):
+        del index[key]
+    loop = asyncio.new_event_loop()
+    asyncio.set_event_loop(loop)
+    loop.run_until_complete(build_index())
+    from backend.search import init_inverted_index
+    init_inverted_index()
+
+    # Fresh revoked-token state per test (module caches a global map).
+    import backend.auth.jwt_handler as jh
+    jh._revoked_jtis_backup = getattr(jh, "_revoked_map", {})
+    jh._revoked_map = {}
+    jh._revoked_loaded = False
+    jh._touch_last_write.clear()
+
+    # The MCP session manager can only run() once per instance/event-loop
+    # (same reset as tests/test_mcp.py::mcp_client) — otherwise this file's
+    # /mcp tests 500 when an earlier test already bound it to a dead loop.
+    backend.main.mcp_app._manager = None
+    backend.main.mcp_app._run_task = None
+    backend.main.mcp_app._start_lock = None
+
+    with TestClient(backend.main.app) as client:
+        yield client
+
+    backend.main.mcp_app._manager = None
+    backend.main.mcp_app._run_task = None
+    backend.main.mcp_app._start_lock = None
+    jh._revoked_map = {}
+    jh._revoked_loaded = False
+    os.chdir(orig_cwd)
+    shutil.rmtree(str(tmp_path), ignore_errors=True)
+    for k in ["VAULT_1_NAME", "VAULT_1_PATH", "OBSIGATE_AUTH_ENABLED",
+              "OBSIGATE_WATCHER_ENABLED"]:
+        os.environ.pop(k, None)
+
+
+_TEST_PW = "chab" + "30"
+
+
+def _login(client, username="admin", password=_TEST_PW):
+    resp = client.post("/api/auth/login", json={"username": username, "password": password})
+    assert resp.status_code == 200, resp.text
+    return resp.json()["access_token"]
+
+
+def _hdr(token):
+    return {"Authorization": f"Bearer {token}"}
+
+
+def _create(client, token, name="claude desktop", expiry="30d"):
+    resp = client.post("/api/auth/tokens", json={"name": name, "expiry": expiry},
+                       headers=_hdr(token))
+    assert resp.status_code == 200, resp.text
+    return resp.json()
+
+
+# ═══════════════════════════════════════════════════════════════════
+
+
+class TestCreateAndList:
+    def test_requires_auth(self, tokens_client):
+        assert tokens_client.get("/api/auth/tokens").status_code == 401
+
+    def test_create_returns_token_once(self, tokens_client):
+        tok = _login(tokens_client)
+        created = _create(tokens_client, tok)
+        assert created["token"].count(".") == 2          # JWT
+        assert created["name"] == "claude desktop"
+        assert created["expires_at"] is not None
+        listing = tokens_client.get("/api/auth/tokens", headers=_hdr(tok)).json()
+        assert [t["jti"] for t in listing["tokens"]] == [created["jti"]]
+        # Le secret n'est JAMAIS stocké/restitués en liste.
+        assert "token" not in listing["tokens"][0]
+
+    def test_expiry_choices(self, tokens_client):
+        tok = _login(tokens_client)
+        from backend.auth.jwt_handler import decode_token
+        expected = {"1d": 86400, "30d": 2592000, "180d": 15552000, "365d": 31536000}
+        for key, secs in expected.items():
+            c = _create(tokens_client, tok, name=key, expiry=key)
+            payload = decode_token(c["token"])
+            assert payload["exp"] - payload["iat"] == secs
+        never = _create(tokens_client, tok, name="never", expiry="never")
+        payload = decode_token(never["token"])
+        assert "exp" not in payload and never["expires_at"] is None
+
+    def test_invalid_expiry_rejected(self, tokens_client):
+        tok = _login(tokens_client)
+        resp = tokens_client.post("/api/auth/tokens",
+                                  json={"name": "x", "expiry": "5minutes"},
+                                  headers=_hdr(tok))
+        assert resp.status_code == 400
+
+
+class TestTokenWorksOnApiAndMcp:
+    """Le point #107 : une seule clé pour l'API REST et le serveur MCP."""
+
+    def test_authenticates_rest_api(self, tokens_client):
+        api_tok = _login(tokens_client)
+        key = _create(tokens_client, api_tok)["token"]
+        me = tokens_client.get("/api/auth/me", headers=_hdr(key))
+        assert me.status_code == 200
+        assert me.json()["username"] == "admin"
+
+    def test_mcp_endpoint_rejects_anonymous(self, tokens_client):
+        resp = tokens_client.post(
+            "/mcp",
+            content=json.dumps({"jsonrpc": "2.0", "id": 1, "method": "initialize",
+                                "params": {}}),
+            headers={"Accept": ACCEPT, "Content-Type": "application/json"},
+        )
+        assert resp.status_code == 401
+
+    def test_same_key_authenticates_mcp(self, tokens_client):
+        api_tok = _login(tokens_client)
+        key = _create(tokens_client, api_tok)["token"]
+        resp = tokens_client.post(
+            "/mcp",
+            content=json.dumps({
+                "jsonrpc": "2.0", "id": 1, "method": "initialize",
+                "params": {"protocolVersion": "2025-03-26", "capabilities": {},
+                           "clientInfo": {"name": "pytest", "version": "1.0"}},
+            }),
+            headers={"Accept": ACCEPT, "Content-Type": "application/json",
+                     "Authorization": f"Bearer {key}"},
+        )
+        assert resp.status_code == 200, resp.text
+        assert resp.headers.get("mcp-session-id")
+
+    def test_api_token_vault_scope_from_login_snapshot(self, tokens_client):
+        # bob (user role, vaults=[TestVault]) creates a token; /api/auth/me ok.
+        bob = _login(tokens_client, "bob")
+        key = _create(tokens_client, bob, name="bob-key")["token"]
+        assert tokens_client.get("/api/auth/me", headers=_hdr(key)).status_code == 200
+        # admin's listing must not see bob's token.
+        admin = _login(tokens_client)
+        names = [t["name"] for t in
+                 tokens_client.get("/api/auth/tokens", headers=_hdr(admin)).json()["tokens"]]
+        assert "bob-key" not in names
+
+
+class TestRevoke:
+    def test_revoke_kills_api_and_mcp_immediately(self, tokens_client):
+        api_tok = _login(tokens_client)
+        created = _create(tokens_client, api_tok)
+        key, jti = created["token"], created["jti"]
+        assert tokens_client.get("/api/auth/me", headers=_hdr(key)).status_code == 200
+        resp = tokens_client.delete(f"/api/auth/tokens/{jti}", headers=_hdr(api_tok))
+        assert resp.status_code == 200
+        # API
+        assert tokens_client.get("/api/auth/me", headers=_hdr(key)).status_code == 401
+        # MCP — même clé révoquée = 401 aussi
+        mcp = tokens_client.post(
+            "/mcp",
+            content=json.dumps({"jsonrpc": "2.0", "id": 1, "method": "initialize",
+                                "params": {}}),
+            headers={"Accept": ACCEPT, "Content-Type": "application/json",
+                     "Authorization": f"Bearer {key}"},
+        )
+        assert mcp.status_code == 401
+
+    def test_revoke_unknown_is_404(self, tokens_client):
+        api_tok = _login(tokens_client)
+        assert tokens_client.delete("/api/auth/tokens/nope",
+                                    headers=_hdr(api_tok)).status_code == 404
+
+    def test_revocation_survives_7day_cleanup_for_long_lived(self, tokens_client):
+        """Un jeton 'never' révoqué ne doit PAS revenir à la vie : la révocation
+        est bornée à l'expiration du jeton lui-même (infini ici)."""
+        import backend.auth.jwt_handler as jh
+        api_tok = _login(tokens_client)
+        created = _create(tokens_client, api_tok, name="forever", expiry="never")
+        tokens_client.delete(f"/api/auth/tokens/{created['jti']}", headers=_hdr(api_tok))
+        until = jh._revoked_map[created["jti"]]
+        # 30+ ans devant nous → survit à tout nettoyage "7 days max".
+        assert until > time.time() + 365 * 24 * 3600
+        # Reload depuis le disque → toujours révoqué.
+        jh._revoked_map = {}
+        jh._revoked_loaded = False
+        assert jh.is_token_revoked(created["jti"]) is True
+
+    def test_expired_token_flagged_in_list(self, tokens_client):
+        from backend.auth.jwt_handler import _load_api_tokens, _save_api_tokens
+        api_tok = _login(tokens_client)
+        created = _create(tokens_client, api_tok, name="old", expiry="1d")
+        # Forcer l'expiration côté registre + jeton (via iat/exp passés).
+        data = _load_api_tokens()
+        data["tokens"][created["jti"]]["expires_at"] = int(time.time()) - 10
+        _save_api_tokens(data)
+        listing = tokens_client.get("/api/auth/tokens", headers=_hdr(api_tok)).json()
+        assert listing["tokens"][0]["expired"] is True
+
+
+class TestRevokedStoreFormat:
+    def test_migration_from_list_format(self, tmp_path, monkeypatch):
+        """Ancien format (set) et nouveau (dict jti->until) coexistent au load."""
+        from backend.auth.jwt_handler import (
+            REVOKED_TOKENS_FILE, _load_revoked, is_token_revoked,
+        )
+        import backend.auth.jwt_handler as jh
+        REVOKED_TOKENS_FILE.parent.mkdir(parents=True, exist_ok=True)
+        future = int(time.time()) + 3600
+        REVOKED_TOKENS_FILE.write_text(json.dumps(
+            {"alive": future, "dead": int(time.time()) - 10}))
+        jh._revoked_map, jh._revoked_loaded = {}, False
+        _load_revoked()
+        assert is_token_revoked("alive") and not is_token_revoked("dead")
@@ -248,6 +248,22 @@ class TestMfaApiEndpoints:
        assert "otpauth://totp/" in data["otpauth_uri"]
        assert len(data["secret"]) >= 16

+    def test_mfa_setup_returns_local_qr_data_url(self, mfa_client):
+        """BUG-068: the setup response carries a CSP-safe local QR code.
+
+        The previous client used an https://api.qrserver.com image, blocked by
+        the CSP (img-src 'self' data: blob:) — the QR never displayed — and
+        leaking the otpauth URI to a third party.
+        """
+        token, _ = _login(mfa_client)
+        resp = mfa_client.post("/api/auth/mfa/totp/setup", headers=_auth_headers(token))
+        assert resp.status_code == 200
+        data = resp.json()
+        qr_data_url = data.get("qr_data_url")
+        assert qr_data_url, "setup must return a local qr_data_url"
+        assert qr_data_url.startswith("data:image/svg+xml"), qr_data_url[:60]
+        assert "qrserver.com" not in qr_data_url
+
    def test_mfa_enable_flow(self, mfa_client):
        token, _ = _login(mfa_client)
        headers = _auth_headers(token)
@@ -0,0 +1,220 @@
+# tests/test_perf_phase3.py — Optimisation globale des performances (#86, phase 3)
+"""Non-regression tests for the #86 performance work.
+
+Covers the three remaining #86 items (the inverted-index search, the lazy PDF
+extraction and the regex CPU caps were already delivered via BUG-033, BUG-040
+and BUG-025):
+
+- differential vault scan (unchanged files reused without disk re-read),
+- deferred excalidraw text extraction (scan cheap, enrichment fills text),
+- file-size guard on ``replace_in_files`` (oversized files skipped).
+"""
+import json
+import os
+from pathlib import Path
+
+import pytest
+
+
+def _excalidraw_doc(*texts: str) -> str:
+    elements = [
+        {
+            "id": f"el{i}",
+            "type": "text",
+            "text": text,
+            "x": 0,
+            "y": i * 20,
+            "width": 100,
+            "height": 20,
+        }
+        for i, text in enumerate(texts)
+    ]
+    return json.dumps({"type": "excalidraw", "version": 2, "elements": elements})
+
+
+# ═══════════════════════════════════════════════════════════════════
+# Deferred excalidraw extraction
+# ═══════════════════════════════════════════════════════════════════
+
+class TestExcalidrawDeferred:
+    def test_scan_defers_excalidraw_text(self, tmp_path: Path):
+        """The scan must not parse diagram JSON — content empty + pending flag."""
+        from backend.indexer import _scan_vault
+
+        vault = tmp_path / "vault"
+        vault.mkdir()
+        (vault / "diagram.excalidraw").write_text(
+            _excalidraw_doc("hello diagram"), encoding="utf-8"
+        )
+
+        result = _scan_vault("V", str(vault), {})
+        entry = next(f for f in result["files"] if f["path"] == "diagram.excalidraw")
+        assert entry["content"] == ""
+        assert entry["content_preview"] == ""
+        assert entry.get("excalidraw_text_pending") is True
+        assert entry["title"] == "diagram"
+
+    def test_scan_defers_excalidraw_md(self, tmp_path: Path):
+        """``.excalidraw.md`` files are deferred too (no lz decompression at scan)."""
+        from backend.indexer import _scan_vault
+
+        vault = tmp_path / "vault"
+        vault.mkdir()
+        (vault / "board.excalidraw.md").write_text(
+            "---\ntitle: Board\n---\n" + _excalidraw_doc("board text"),
+            encoding="utf-8",
+        )
+
+        result = _scan_vault("V", str(vault), {})
+        entry = next(f for f in result["files"] if f["path"] == "board.excalidraw.md")
+        assert entry["content"] == ""
+        assert entry.get("excalidraw_text_pending") is True
+
+    @pytest.mark.asyncio
+    async def test_enrich_fills_excalidraw_text(self, tmp_path: Path):
+        """The deferred pass extracts diagram text and clears the flag."""
+        import backend.indexer as idx
+
+        vault = tmp_path / "vault"
+        vault.mkdir()
+        (vault / "diagram.excalidraw").write_text(
+            _excalidraw_doc("uniquediagword"), encoding="utf-8"
+        )
+        file_info = {
+            "path": "diagram.excalidraw",
+            "title": "diagram",
+            "tags": [],
+            "content": "",
+            "content_preview": "",
+            "size": 0,
+            "modified": "",
+            "extension": ".excalidraw",
+            "excalidraw_text_pending": True,
+        }
+        with idx._index_lock:
+            idx.index["ExcalV"] = {
+                "files": [file_info],
+                "tags": {},
+                "path": str(vault),
+                "paths": [],
+            }
+        try:
+            count = await idx.enrich_pdf_texts("ExcalV")
+            assert count == 1
+            assert "uniquediagword" in file_info["content"]
+            assert file_info["content_preview"]
+            assert "excalidraw_text_pending" not in file_info
+        finally:
+            with idx._index_lock:
+                idx.index.pop("ExcalV", None)
+
+
+# ═══════════════════════════════════════════════════════════════════
+# Differential scan
+# ═══════════════════════════════════════════════════════════════════
+
+class TestDifferentialScan:
+    def test_first_scan_reports_zero_reused(self, test_vault_dir):
+        from backend.indexer import _scan_vault
+
+        result = _scan_vault("TestVault", test_vault_dir)
+        assert result["reused"] == 0
+        assert len(result["files"]) >= 3
+
+    def test_unchanged_files_are_reused(self, test_vault_dir):
+        from backend.indexer import _scan_vault
+
+        first = _scan_vault("TestVault", test_vault_dir)
+        previous = {f["path"]: f for f in first["files"]}
+        second = _scan_vault("TestVault", test_vault_dir, None, previous)
+        assert second["reused"] == len(first["files"])
+        assert {f["path"] for f in second["files"]} == {f["path"] for f in first["files"]}
+        # Tags and titles survive the reuse path.
+        assert second["tags"] == first["tags"]
+        for f in second["files"]:
+            assert f["content"] == previous[f["path"]]["content"]
+
+    def test_changed_file_is_reparsed(self, test_vault_dir):
+        from backend.indexer import _scan_vault
+
+        first = _scan_vault("TestVault", test_vault_dir)
+        previous = {f["path"]: f for f in first["files"]}
+
+        target = Path(test_vault_dir) / "note1.md"
+        target.write_text(
+            target.read_text(encoding="utf-8") + "\nMot unique de reparse differentials.",
+            encoding="utf-8",
+        )
+        # Force a visibly different mtime (coarse filesystems).
+        os.utime(target, (9999999999, 9999999999))
+
+        second = _scan_vault("TestVault", test_vault_dir, None, previous)
+        assert second["reused"] == len(first["files"]) - 1
+        changed = next(f for f in second["files"] if f["path"] == "note1.md")
+        assert "Mot unique de reparse differentials" in changed["content"]
+
+    def test_added_and_deleted_files(self, test_vault_dir):
+        from backend.indexer import _scan_vault
+
+        first = _scan_vault("TestVault", test_vault_dir)
+        previous = {f["path"]: f for f in first["files"]}
+
+        (Path(test_vault_dir) / "brand-new.md").write_text(
+            "# Brand new\nFresh content here.", encoding="utf-8"
+        )
+        (Path(test_vault_dir) / "config.json").unlink()
+
+        second = _scan_vault("TestVault", test_vault_dir, None, previous)
+        paths = {f["path"] for f in second["files"]}
+        assert "brand-new.md" in paths
+        assert "config.json" not in paths
+        assert second["reused"] == len(first["files"]) - 1
+
+
+# ═══════════════════════════════════════════════════════════════════
+# replace_in_files size guard
+# ═══════════════════════════════════════════════════════════════════
+
+class TestReplaceSizeGuard:
+    def test_oversized_file_is_skipped(self, tmp_path: Path, monkeypatch):
+        """Files over MAX_REPLACE_FILE_BYTES are skipped, not read."""
+        from backend.services import mutations
+
+        big = tmp_path / "big.md"
+        big.write_text("findme " * 100, encoding="utf-8")
+
+        monkeypatch.setattr(mutations, "MAX_REPLACE_FILE_BYTES", 10)
+        monkeypatch.setattr(
+            "backend.services.search.advanced_search_vaults",
+            lambda *a, **k: {
+                "results": [{"vault": "V", "path": "big.md", "title": "big"}],
+            },
+        )
+        monkeypatch.setattr(
+            mutations, "get_vault_root", lambda vault: tmp_path
+        )
+
+        out = mutations.replace_in_files("findme", "replaced", vault="V", dry_run=True)
+        assert out["matches"] == []
+        assert out["total_matches"] == 0
+
+    def test_small_file_still_processed(self, tmp_path: Path, monkeypatch):
+        from backend.services import mutations
+
+        small = tmp_path / "small.md"
+        small.write_text("findme once", encoding="utf-8")
+
+        monkeypatch.setattr(mutations, "MAX_REPLACE_FILE_BYTES", 10_000_000)
+        monkeypatch.setattr(
+            "backend.services.search.advanced_search_vaults",
+            lambda *a, **k: {
+                "results": [{"vault": "V", "path": "small.md", "title": "small"}],
+            },
+        )
+        monkeypatch.setattr(
+            mutations, "get_vault_root", lambda vault: tmp_path
+        )
+
+        out = mutations.replace_in_files("findme", "replaced", vault="V", dry_run=True)
+        assert out["total_matches"] == 1
+        assert out["matches"][0]["path"] == "small.md"
@@ -134,8 +134,8 @@ class TestWebauthnModule:
        w._pending.clear()
        w._store_challenge("u2:register")
        key = "u2:register"
-        ch, _ = w._pending[key]
-        w._pending[key] = (ch, _t.time() - 1)
+        ch, _ = w._pending[key][0]
+        w._pending[key] = [(ch, _t.time() - 1)]
        assert w._take_challenge(key) is None

    def test_full_registration_and_authentication_roundtrip(self):
@@ -337,3 +337,131 @@ class TestWebauthnApi:
        assert r2.status_code == 200
        st = wa_client.get("/api/auth/mfa/status", headers=headers).json()
        assert st["mfa_enabled"] is False
+
+
+# ── BUG-070: relying party derived from the request ─────────────────────
+#
+# The old defaults (rp_id "localhost", origins ["http://localhost"]) rejected
+# every real access URL: "Unexpected client data origin
+# "http://localhost:2020", expected one of ['http://localhost']".
+
+def _fake_request(host, scheme="http", forwarded_host=None, forwarded_proto=None):
+    from fastapi import Request
+
+    headers = [(b"host", host.encode())]
+    if forwarded_host is not None:
+        headers.append((b"x-forwarded-host", forwarded_host.encode()))
+    if forwarded_proto is not None:
+        headers.append((b"x-forwarded-proto", forwarded_proto.encode()))
+    return Request({
+        "type": "http", "method": "POST", "path": "/",
+        "headers": headers, "scheme": scheme,
+        "server": ("testserver", 80), "client": ("127.0.0.1", 5000),
+    })
+
+
+class TestRelyingPartyResolution:
+    def test_defaults_without_request(self, monkeypatch):
+        import backend.auth.webauthn_mfa as w
+
+        monkeypatch.delenv("OBSIGATE_WEBAUTHN_RP_ID", raising=False)
+        monkeypatch.delenv("OBSIGATE_WEBAUTHN_ORIGINS", raising=False)
+        assert w.resolve_relying_party(None) == ("localhost", ["http://localhost"])
+
+    def test_derives_host_with_port(self, monkeypatch):
+        """Exact BUG-070 report: http://localhost:2020 was rejected."""
+        import backend.auth.webauthn_mfa as w
+
+        monkeypatch.delenv("OBSIGATE_WEBAUTHN_RP_ID", raising=False)
+        monkeypatch.delenv("OBSIGATE_WEBAUTHN_ORIGINS", raising=False)
+        rp, origins = w.resolve_relying_party(_fake_request("localhost:2020"))
+        assert rp == "localhost"
+        assert origins == ["http://localhost:2020"]
+
+    def test_derives_ip_host(self, monkeypatch):
+        import backend.auth.webauthn_mfa as w
+
+        monkeypatch.delenv("OBSIGATE_WEBAUTHN_RP_ID", raising=False)
+        monkeypatch.delenv("OBSIGATE_WEBAUTHN_ORIGINS", raising=False)
+        rp, origins = w.resolve_relying_party(_fake_request("127.0.0.1:2020"))
+        assert rp == "127.0.0.1"
+        assert origins == ["http://127.0.0.1:2020"]
+
+    def test_explicit_env_wins_over_request(self, monkeypatch):
+        import backend.auth.webauthn_mfa as w
+
+        monkeypatch.setenv("OBSIGATE_WEBAUTHN_RP_ID", "obs.example.com")
+        monkeypatch.setenv("OBSIGATE_WEBAUTHN_ORIGINS",
+                           "https://obs.example.com, https://www.obs.example.com")
+        rp, origins = w.resolve_relying_party(_fake_request("localhost:2020"))
+        assert rp == "obs.example.com"
+        assert origins == ["https://obs.example.com",
+                           "https://www.obs.example.com"]
+
+    def test_forwarded_headers_require_trust(self, monkeypatch):
+        import backend.auth.webauthn_mfa as w
+
+        monkeypatch.delenv("OBSIGATE_WEBAUTHN_RP_ID", raising=False)
+        monkeypatch.delenv("OBSIGATE_WEBAUTHN_ORIGINS", raising=False)
+        monkeypatch.setenv("OBSIGATE_TRUST_PROXY", "false")
+        req = _fake_request("internal:8080", scheme="http",
+                            forwarded_host="obs.example.com",
+                            forwarded_proto="https")
+        assert w.resolve_relying_party(req) == ("internal", ["http://internal:8080"])
+
+        monkeypatch.setenv("OBSIGATE_TRUST_PROXY", "true")
+        assert w.resolve_relying_party(req) == ("obs.example.com",
+                                                ["https://obs.example.com"])
+
+    def test_hostname_only(self):
+        import backend.auth.webauthn_mfa as w
+
+        assert w._hostname_only("example.com:2020") == "example.com"
+        assert w._hostname_only("example.com") == "example.com"
+        assert w._hostname_only("[::1]:8080") == "::1"
+        assert w._hostname_only("127.0.0.1:2020") == "127.0.0.1"
+
+    def test_retry_after_reoptions_still_verifies(self):
+        """A re-requested options call (double-click) must not kill the
+        in-flight ceremony: "challenge was not expected challenge"."""
+        import backend.auth.webauthn_mfa as w
+
+        w._pending.clear()
+        auth = VirtualAuthenticator()
+        first = w._store_challenge("bob:register")
+        w._store_challenge("bob:register")  # second options call overwrites
+        cred = auth.make_registration({"challenge": _b64url(first)})
+        rec = w.complete_registration("bob", cred, rp_id_override="localhost",
+                                      origins_override=["http://localhost"])
+        assert rec["credential_id"] == cred["id"]
+
+    def test_register_flow_without_env_config(self, wa_client, monkeypatch):
+        """Full register + login roundtrip with no WEBAUTHN env at all: the
+        relying party derives from the request (TestClient host)."""
+        import backend.auth.webauthn_mfa as w
+
+        monkeypatch.delenv("OBSIGATE_WEBAUTHN_RP_ID", raising=False)
+        monkeypatch.delenv("OBSIGATE_WEBAUTHN_ORIGINS", raising=False)
+        w._pending.clear()
+
+        headers = _login_headers(wa_client)
+        r = wa_client.post("/api/auth/mfa/webauthn/register/options", headers=headers)
+        assert r.status_code == 200
+        options = r.json()["options"]
+        assert options["rp"]["id"] == "testserver"
+
+        auth = VirtualAuthenticator()
+        auth.RP_ID = "testserver"
+        auth.ORIGIN = "http://testserver"
+        cred = auth.make_registration(options)
+        r2 = wa_client.post("/api/auth/mfa/webauthn/register", headers=headers,
+                            json={"credential": cred, "label": "Key"})
+        assert r2.status_code == 200, r2.text
+
+        opts_r = wa_client.post("/api/auth/mfa/webauthn/options",
+                                json={"username": "testuser"})
+        assertion = auth.make_assertion(opts_r.json()["options"])
+        v = wa_client.post("/api/auth/mfa/webauthn/verify",
+                           json={"username": "testuser", "credential": assertion})
+        assert v.status_code == 200, v.text
+        assert "access_token" in v.json()
Author	SHA1	Message	Date
bruno	aeb7516445	fix: activation WebAuthn impossible BUG-070 (rp_id/origines derives requete, challenges multiples) CI / lint (push) Successful in 1m59s Details CI / security (push) Successful in 1m35s Details CI / test (push) Successful in 4m7s Details CI / build (push) Successful in 1m16s Details CI / e2e (push) Successful in 12m12s Details	2026-09-22 20:54:01 -04:00
bruno	bca0fdd941	fix: login 2FA bloque sans erreur BUG-069 (challenge montait dans .login-box inexistant -> .login-card + erreur visible) CI / lint (push) Successful in 1m56s Details CI / security (push) Successful in 1m20s Details CI / test (push) Successful in 4m17s Details CI / build (push) Successful in 1m16s Details CI / e2e (push) Successful in 12m35s Details	2026-09-22 20:38:37 -04:00
bruno	60da957f13	fix: section Securite du compte incomplete BUG-068 (boutons theme, QR local, mot de passe, recovery WebAuthn) CI / lint (push) Successful in 2m25s Details CI / security (push) Successful in 1m20s Details CI / test (push) Successful in 3m43s Details CI / build (push) Successful in 2m9s Details CI / e2e (push) Successful in 12m7s Details	2026-09-22 20:07:25 -04:00
bruno	f621620593	feat: optimisation globale des performances #86 (scan differentiel, excalidraw differe, garde-fou replace; inverted index/PDF lazy/caps regex deja livres via BUG-033/040/025) CI / lint (push) Successful in 1m54s Details CI / security (push) Successful in 1m22s Details CI / test (push) Successful in 4m23s Details CI / build (push) Successful in 1m17s Details CI / e2e (push) Successful in 12m9s Details	2026-09-22 19:04:26 -04:00
bruno	eff74cabe0	feat: #107 configuration - gestion des clés API & MCP (création/révocation, expiration 1j/1mois/6mois/1an/sans fin, une clé pour API REST + serveur MCP, dernière utilisation, store sans secret persisté; fix révocation longue durée) + script token MCP CI / lint (push) Successful in 1m58s Details CI / security (push) Successful in 1m32s Details CI / test (push) Successful in 4m0s Details CI / build (push) Successful in 1m15s Details CI / e2e (push) Successful in 12m9s Details	2026-09-22 14:48:51 -04:00
@@ -1 +1 @@
 .14.1
 .16.3