mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-09-13 18:32:12 +03:00
7448780cbd
check:pack-boot booted the packed tarball fine but failed its version assertion: `version "undefined" (expected "3.8.50")`. The artifact was not broken — the health payload was. #11040 (GHSA-mvf8-qc78-5mxm) reduced GET /api/monitoring/health to a liveness-only view for non-management callers. But that route is classified PUBLIC (src/shared/constants/publicApiRoutes.ts:67) and runAuthzPipeline deletes CLI_TOKEN_HEADER from the forwarded headers for EVERY route class (src/server/authz/pipeline.ts), so a handler can only learn that a local CLI authenticated from the subject the policy stamped. publicPolicy stamped `anonymous` unconditionally, so requireManagementAuth in the route 401'd even for a valid loopback machine token and every caller got `{status, setupComplete}` — no `version`. Verified on the installed tarball before the fix: the same token that returns 200 on /api/cli/whoami (MANAGEMENT, where the pipeline does stamp the subject) got the anonymous body on /api/monitoring/health. publicPolicy now stamps the same loopback-gated `local-cli-token` subject the MANAGEMENT policy already produced. The shared verdict (peer-locality resolution + constant-time token compare) moves to src/server/authz/peerContext.ts so both policies use one implementation — no behavior change on the MANAGEMENT side. Anonymous callers keep the liveness-only view. Tests: publicPolicy stamps the CLI subject only for a loopback peer with a valid token (both negative controls asserted; the positive case fails on the pre-fix policy), plus a health-route pin that a stamped local-CLI caller receives `version`. check:pack-boot green end to end (boot #1, machine-token contrast, sql.js round trip, boot #2 persistence).