feat(auth): add advanced authentication system

[m199369309]

Summary

• Adds an optional advanced authentication mode (XINFERENCE_AUTH_ADVANCED=1) as an alternative to the existing file-based auth config
• JWT-based auth with refresh tokens (rotation on use), encrypted API key management with per-model access control, user management with admin/user roles, and password change enforcement
• Backend: new xinference/api/oauth2/advanced/ module with SQLite storage, crypto utilities, and xinference-migrate-auth CLI
• Frontend: user management, API key management, and change password pages with refresh token rotation support

Configuration

Set these environment variables to enable:

XINFERENCE_AUTH_ADVANCED=1
XINFERENCE_AUTH_JWT_SECRET_KEY=<your-secret>
XINFERENCE_AUTH_ENCRYPTION_KEY=<your-encryption-key>
XINFERENCE_AUTH_DB_PATH=<optional, defaults to ~/.xinference/auth/auth.db>

Changes

Backend

• xinference/api/oauth2/advanced/ — Full auth module (auth_service, database, cache, crypto, migrate, routes)
• xinference/constants.py — New env var constants for advanced auth
• xinference/api/restful_api.py — Advanced auth initialization, model access control (_check_model_access)
• xinference/api/routers/admin.py — Conditional /token route, auth_advanced in UI config
• setup.cfg — xinference-migrate-auth entry point

Frontend

• fetchWrapper.js — Refresh token mechanism with token rotation support
• MenuSide.js — User management, API key management, logout menu items
• router/index.js — Routes for new pages
• New pages: change_password/, apikey_management/, user_management/
• login.js — Refresh token + must-change-password handling
• locales/ — i18n strings for new features

Security Improvements (code review feedback)

• Initial admin password output to console only (no plain-text file)
• API keys for non-existent users default to disabled
• Refresh token rotation: old token invalidated on use, new token issued
• AES-GCM decryption failures handled gracefully
• list_users N+1 query optimized to batch fetch
• update_user allows setting nullable fields to NULL

Test plan

• Verify existing file-based auth still works when XINFERENCE_AUTH_ADVANCED is not set
• Enable advanced auth and test login/logout/refresh token rotation flow
• Test API key creation, listing, deletion, and per-model access restrictions
• Test user management (create, update roles, password reset)
• Test xinference-migrate-auth CLI tool
• Verify mutual exclusion error when both --auth-config and XINFERENCE_AUTH_ADVANCED are set
• Verify refresh token rotation: after refresh, old token rejected, new token works

[gemini-code-assist]

Code Review

This pull request introduces a comprehensive advanced authentication system for Xinference, moving from a static JSON configuration to a dynamic SQLite-backed architecture. The new system supports JWT-based authentication, refresh tokens, and granular management of users and API keys with model-level access controls. Significant updates were made to both the backend services and the web UI to accommodate these features, including a new migration utility for existing setups. Review feedback highlights several critical security and performance improvements, such as avoiding plain-text storage of initial admin credentials, implementing refresh token rotation, handling cryptographic exceptions more robustly, and optimizing database queries to prevent N+1 performance issues.

[qinxuye]

Reviewed current head b31bf04. I skipped the existing Gemini findings and only added non-duplicate issues. One additional blocker: the current lint check fails at the Prettier step for src/components/MenuSide.js, src/scenes/apikey_management/index.js, and src/scenes/user_management/index.js.

[qinxuye]

LGTM