mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-25 08:32:11 +03:00
0fb4eb6878
The REST task routes (/api/a2a/tasks, /api/a2a/tasks/[id], /[id]/cancel) had NO authentication call at all — open regardless of configuration — and the task manager stored tasks in an owner-less Map, so any caller could read or cancel any task by id over either the JSON-RPC or the REST surface. - New shared src/lib/a2a/authenticate.ts (the v54m JSON-RPC posture, lifted so both surfaces cannot drift) + src/app/api/a2a/_auth.ts implementing the full posture matrix: REQUIRE_API_KEY=true demands a valid key (management session also passes via alwaysRequireAuth); requireLogin=true accepts management or a valid key; the keyless local-first default stays open by design. - Tasks bind to an owner (hashed API key) at creation; get/cancel/list are owner-scoped. Another principal's task answers with the same not-found a missing one would (no existence oracle). Ownerless tasks (keyless posture) stay visible to everyone; management/operator view sees all tasks. - Callers discriminate the auth failure with instanceof Response, never instanceof NextResponse — createErrorResponse() returns a plain Response, which silently fell through to the handler (caught by the 401-vs-404 test).