molecule-core/workspace-server/internal/middleware
molecule-ai[bot] 833fbeaa5c
fix(canvas/a11y): aria-hidden SVGs, MissingKeysModal semantics, session cookie auth (#1744)
1. f675500: aria-hidden="true" on decorative SVG icons in
   DeleteCascadeConfirmDialog warning icon and Toolbar stop/restart
   /search/help icons. All have adjacent aria-label text or parent
   button aria-label — correct.

2. eb87737: session cookie auth fallback for /registry/:id/peers
   SaaS canvas path. verifiedCPSession() checked after bearer token
   in validateDiscoveryCaller, allowing canvas to hit the Peers tab
   via session cookie rather than bearer token. Self-hosted bypass
   logic preserved.

3. 80fedd6: MissingKeysModal dialog semantics — role="dialog",
   aria-modal="true", aria-labelledby="missing-keys-title",
   requestAnimationFrame focus management. Also removes stale
   aria-describedby={undefined} from CreateWorkspaceDialog.

Co-authored-by: Molecule AI App & Docs Lead <app-docs-lead@agents.moleculesai.app>
Co-authored-by: molecule-ai[bot] <molecule-ai[bot]@users.noreply.github.com>
2026-04-23 17:39:38 +00:00
..
mcp_ratelimit_test.go chore: open-source restructure — rename dirs, remove internal files, scrub secrets 2026-04-18 00:24:44 -07:00
mcp_ratelimit.go chore: open-source restructure — rename dirs, remove internal files, scrub secrets 2026-04-18 00:24:44 -07:00
ratelimit_test.go chore: open-source restructure — rename dirs, remove internal files, scrub secrets 2026-04-18 00:24:44 -07:00
ratelimit.go chore: open-source restructure — rename dirs, remove internal files, scrub secrets 2026-04-18 00:24:44 -07:00
securityheaders_test.go chore: open-source restructure — rename dirs, remove internal files, scrub secrets 2026-04-18 00:24:44 -07:00
securityheaders.go chore: open-source restructure — rename dirs, remove internal files, scrub secrets 2026-04-18 00:24:44 -07:00
session_auth_test.go fix: close cross-tenant authz + cp_proxy admin-traversal gaps 2026-04-20 13:45:57 -07:00
session_auth.go fix(canvas/a11y): aria-hidden SVGs, MissingKeysModal semantics, session cookie auth (#1744) 2026-04-23 17:39:38 +00:00
tenant_guard_test.go fix(tenant-guard): allowlist /registry/register + /registry/heartbeat (#1236) 2026-04-21 02:47:27 +00:00
tenant_guard.go fix(tenant-guard): allowlist /registry/register + /registry/heartbeat (#1236) 2026-04-21 02:47:27 +00:00
wsauth_middleware_org_id_test.go fix(platform-go-ci): align test mocks with schema drift + org_id context contract (#1755) 2026-04-23 07:14:33 +00:00
wsauth_middleware_test.go fix(platform-go-ci): align test mocks with schema drift + org_id context contract (#1755) 2026-04-23 07:14:33 +00:00
wsauth_middleware.go fix(platform-go-ci): align test mocks with schema drift + org_id context contract (#1755) 2026-04-23 07:14:33 +00:00