Backend Engineer 9122d6aeea fix(security): gate GET /approvals/pending behind AdminAuth (#180) ... GET /approvals/pending was registered on the open router with no middleware, allowing any unauthenticated caller to enumerate all pending approvals across every workspace on the platform. Fix: add inline middleware.AdminAuth(db.DB) to the route registration, matching the pattern used in PR #167 for bundles, events, and viewport. The three workspace-scoped approvals routes (POST/GET /approvals, POST /approvals/:id/decide) were already correctly behind WorkspaceAuth inside the wsAuth group — no change needed there. Tests: two new regression tests in wsauth_middleware_test.go — TestAdminAuth_Issue180_ApprovalsListing_NoBearer_Returns401 TestAdminAuth_Issue180_ApprovalsListing_FailOpen_NoTokens Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>		2026-04-15 17:25:09 +00:00
..
ratelimit_test.go	fix: #93 category_routing + #105 X-RateLimit headers	2026-04-15 00:23:46 -07:00
ratelimit.go	fix: #93 category_routing + #105 X-RateLimit headers	2026-04-15 00:23:46 -07:00
securityheaders_test.go	initial commit — Molecule AI platform	2026-04-13 11:55:37 -07:00
securityheaders.go	initial commit — Molecule AI platform	2026-04-13 11:55:37 -07:00
tenant_guard_test.go	fix(middleware): tenant guard reads bare UUID from state= (no prefix)	2026-04-14 18:09:44 -07:00
tenant_guard.go	fix(middleware): tenant guard reads bare UUID from state= (no prefix)	2026-04-14 18:09:44 -07:00
wsauth_middleware_test.go	fix(security): gate GET /approvals/pending behind AdminAuth (#180)	2026-04-15 17:25:09 +00:00
wsauth_middleware.go	fix(security): protect global secrets routes with AdminAuth middleware (Cycle 7)	2026-04-14 06:33:22 +00:00