pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-07-26 09:52:11 +03:00
Code Issues Packages Projects Releases Wiki Activity

More permissive cookie auth so /dashboard/batch works with REQUIRE_API_KEY=true

Browse Source
This commit is contained in:
Markus Hartung
2026-05-16 03:55:28 +02:00
parent 7b73ac47da
commit 35cb91c3a9
1 changed files with 2 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
src/server/authz/policies/clientApi.ts
View File

@@ -1,4 +1,4 @@
import { isDashboardSessionAuthenticated } from "../../../shared/utils/apiAuth";
import { isDashboardSessionAuthenticated } from "@/shared/utils/apiAuth.ts";
import type { AuthOutcome, PolicyContext, RoutePolicy } from "../context";
import { allow, reject } from "../context";
@@ -15,24 +15,12 @@ function maskKeyId(apiKey: string): string {
return `key_${tail}`;
}
function isDashboardModelCatalogRead(ctx: PolicyContext): boolean {
const method = ctx.request.method.toUpperCase();
if (method !== "GET" && method !== "HEAD") return false;
return (
ctx.classification.normalizedPath === "/api/v1/models" ||
ctx.classification.normalizedPath === "/api/v1"
);
}
export const clientApiPolicy: RoutePolicy = {
routeClass: "CLIENT_API",
async evaluate(ctx: PolicyContext): Promise<AuthOutcome> {
const bearer = extractBearer(ctx.request.headers);
if (!bearer) {
if (
isDashboardModelCatalogRead(ctx) &&
(await isDashboardSessionAuthenticated(ctx.request))
) {
if (await isDashboardSessionAuthenticated(ctx.request)) {
return allow({ kind: "dashboard_session", id: "dashboard" });
}