From 35cb91c3a9aa9c328f43b920d31a03684ef54807 Mon Sep 17 00:00:00 2001 From: Markus Hartung Date: Sat, 16 May 2026 03:55:28 +0200 Subject: [PATCH] More permissive cookie auth so /dashboard/batch works with REQUIRE_API_KEY=true --- src/server/authz/policies/clientApi.ts | 16 ++-------------- 1 file changed, 2 insertions(+), 14 deletions(-) diff --git a/src/server/authz/policies/clientApi.ts b/src/server/authz/policies/clientApi.ts index 47022b1919..f56afe0b4b 100644 --- a/src/server/authz/policies/clientApi.ts +++ b/src/server/authz/policies/clientApi.ts @@ -1,4 +1,4 @@ -import { isDashboardSessionAuthenticated } from "../../../shared/utils/apiAuth"; +import { isDashboardSessionAuthenticated } from "@/shared/utils/apiAuth.ts"; import type { AuthOutcome, PolicyContext, RoutePolicy } from "../context"; import { allow, reject } from "../context"; @@ -15,24 +15,12 @@ function maskKeyId(apiKey: string): string { return `key_${tail}`; } -function isDashboardModelCatalogRead(ctx: PolicyContext): boolean { - const method = ctx.request.method.toUpperCase(); - if (method !== "GET" && method !== "HEAD") return false; - return ( - ctx.classification.normalizedPath === "/api/v1/models" || - ctx.classification.normalizedPath === "/api/v1" - ); -} - export const clientApiPolicy: RoutePolicy = { routeClass: "CLIENT_API", async evaluate(ctx: PolicyContext): Promise { const bearer = extractBearer(ctx.request.headers); if (!bearer) { - if ( - isDashboardModelCatalogRead(ctx) && - (await isDashboardSessionAuthenticated(ctx.request)) - ) { + if (await isDashboardSessionAuthenticated(ctx.request)) { return allow({ kind: "dashboard_session", id: "dashboard" }); }