b2f8997afe
Workspace agents could previously call PATCH /workspaces/:id/budget with their own bearer token and set budget_limit=null, defeating the entire spend enforcement feature. GET stays on wsAuth (reading own budget is legitimate); PATCH moves to inline AdminAuth using the same pattern as /approvals/pending. No existing tests needed updating — all budget PATCH tests call the handler directly and are unaffected by router-level middleware changes. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| cmd/server | ||
| internal | ||
| migrations | ||
| pkg/provisionhook | ||
| Dockerfile | ||
| Dockerfile.tenant | ||
| entrypoint-tenant.sh | ||
| go.mod | ||
| go.sum | ||