core-lead/molecule-core
1
0
Fork 0
forked from molecule-ai/molecule-core
Code Pull Requests Activity

fix(auth): accept admin token in CanvasOrBearer for viewport PUT

Browse Source
This commit is contained in:
rabbitblood 2026-04-20 12:45:09 -07:00
parent 1e30386aec
commit 992e6d3f38
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
workspace-server/internal/middleware/wsauth_middleware.go
View File

@ -188,6 +188,12 @@ func CanvasOrBearer(database *sql.DB) gin.HandlerFunc {
// expired token + a matching Origin would otherwise bypass auth.
// Empty bearer → skip to Origin path (canvas never sends one).
if tok := wsauth.BearerTokenFromHeader(c.GetHeader("Authorization")); tok != "" {
// Admin token accepted for canvas dashboard
adminSecret := os.Getenv("ADMIN_TOKEN")
if adminSecret != "" && subtle.ConstantTimeCompare([]byte(tok), []byte(adminSecret)) == 1 {
c.Next()
return
}
if err := wsauth.ValidateAnyToken(ctx, database, tok); err != nil {
c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "invalid admin auth token"})
return