pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-08-19 13:42:09 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(mcp): preserve caller identity for internal REST hops (#9260)

Browse Source 
Validated in local merge-train (devbox-vm-06-dev002) @ combined-tip (FAST gates green: static + changed tests + vitest — only pre-existing audit.test.ts flake). Evidence: /home/diegosouzapw/dev/proxys/OmniRoute/.claude/worktrees/merge-train-20260805-213228-suite.log
This commit is contained in:
ffichman
2026-08-05 21:45:27 -03:00
committed by GitHub
parent bc876740f5
commit c10dace3b3
7 changed files with 165 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/server/authz/policies/management.ts
View File

@@ -9,6 +9,7 @@ import { getApiKeyMetadata } from "../../../lib/db/apiKeys";
import { hasManageScope } from "../../../lib/api/requireManagementAuth";
import { hasMcpConnectOrManageScope, MCP_CONNECT_SCOPE } from "../../../shared/constants/managementScopes";
import { evaluateAccessTokenAuth } from "../accessTokenAuth";
import { isInternalServiceRequest } from "../../../lib/api/internalServiceAuth";
import { CLI_TOKEN_HEADER, PEER_IP_HEADER, VIA_PROXY_HEADER } from "../headers";
import { resolveStampedPeer, resolveStampedViaProxy } from "../peerStamp";
import {
@@ -233,6 +234,14 @@ export const managementPolicy: RoutePolicy = {
return allow({ kind: "management_key", id: "model-sync", label: "internal-model-sync" });
}
if (isLoopbackRequest(ctx) && isInternalServiceRequest(ctx.request as unknown as Request)) {
return allow({
kind: "management_key",
id: "internal-service",
label: "internal-service-token",
});
}
if (hasValidCliToken(ctx)) {
return allow({ kind: "management_key", id: "cli", label: "local-cli-token" });
}