Hongming Wang 807b4c1b45 fix(auth): allow same-origin canvas requests through WorkspaceAuth on tenant ... WorkspaceAuth only accepted bearer tokens, blocking the canvas from calling per-workspace routes (restart, config, secrets, chat) on the tenant image where canvas + API share the same origin. Added isSameOriginCanvas() fallback (same check used by AdminAuth): checks Referer matches request Host, gated behind CANVAS_PROXY_URL so only tenant deployments are affected. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>		2026-04-16 10:06:33 -07:00
..
ratelimit_test.go	fix(router): call SetTrustedProxies(nil) to close IP-spoofing bypass (#179)	2026-04-15 17:32:54 +00:00
ratelimit.go	fix: #93 category_routing + #105 X-RateLimit headers	2026-04-15 00:23:46 -07:00
securityheaders_test.go	fix: address all code review findings + remove exposed secrets	2026-04-16 05:05:49 -07:00
securityheaders.go	fix: address all code review findings + remove exposed secrets	2026-04-16 05:05:49 -07:00
tenant_guard_test.go	fix(middleware): tenant guard reads bare UUID from state= (no prefix)	2026-04-14 18:09:44 -07:00
tenant_guard.go	fix(middleware): tenant guard reads bare UUID from state= (no prefix)	2026-04-14 18:09:44 -07:00
wsauth_middleware_test.go	chore(test): remove dead constants from wsauth_middleware_test.go (#358)	2026-04-16 05:02:11 +00:00
wsauth_middleware.go	fix(auth): allow same-origin canvas requests through WorkspaceAuth on tenant	2026-04-16 10:06:33 -07:00