1949846001
PATCH /workspaces/:id field-level auth for parent_id/tier/runtime required a bearer token, blocking canvas nesting (drag-to-nest). Added IsSameOriginCanvas check so the tenant canvas can update sensitive fields without a bearer. Exported IsSameOriginCanvas from middleware package so workspace.go can call it for the field-level auth path. DELETE /workspaces/:id is behind AdminAuth which already has the same-origin check — if delete still fails, it's a different issue. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| cmd/server | ||
| internal | ||
| migrations | ||
| pkg/provisionhook | ||
| Dockerfile | ||
| Dockerfile.tenant | ||
| entrypoint-tenant.sh | ||
| go.mod | ||
| go.sum | ||