Backend Engineer 9122d6aeea fix(security): gate GET /approvals/pending behind AdminAuth (#180) ... GET /approvals/pending was registered on the open router with no middleware, allowing any unauthenticated caller to enumerate all pending approvals across every workspace on the platform. Fix: add inline middleware.AdminAuth(db.DB) to the route registration, matching the pattern used in PR #167 for bundles, events, and viewport. The three workspace-scoped approvals routes (POST/GET /approvals, POST /approvals/:id/decide) were already correctly behind WorkspaceAuth inside the wsAuth group — no change needed there. Tests: two new regression tests in wsauth_middleware_test.go — TestAdminAuth_Issue180_ApprovalsListing_NoBearer_Returns401 TestAdminAuth_Issue180_ApprovalsListing_FailOpen_NoTokens Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>		2026-04-15 17:25:09 +00:00
..
cmd	fix(platform): panic-recovering supervisor for every background goroutine (#92)	2026-04-14 20:34:18 -07:00
internal	fix(security): gate GET /approvals/pending behind AdminAuth (#180)	2026-04-15 17:25:09 +00:00
migrations	fix(schedules): backfill legacy rows to 'template' + extract import SQL const	2026-04-14 14:30:22 -07:00
Dockerfile	initial commit — Molecule AI platform	2026-04-13 11:55:37 -07:00
go.mod	initial commit — Molecule AI platform	2026-04-13 11:55:37 -07:00
go.sum	initial commit — Molecule AI platform	2026-04-13 11:55:37 -07:00