pastilhasandClaude Opus 5 ae275ee607 resolve api keys at the websocket doors too ...

there were four doors, not two. the ws upgrade in server.tsx and the
vault notifications socket each verified the jwt themselves, so a key
that worked against /api would have 401'd on cliamp — signed in and can
play audio would have been two different questions for the music app.

both now call resolveAuthToken. verified: owner key upgrades cliamp
(101), bogus key 401, member key 403 on terminal exactly as their jwt
is.

reset-password and verify-token deliberately keep verify() — they read
a purpose-scoped reset token and a key must not be spendable as one.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-08-08 10:40:04 +00:00

..

_middlewares

per-user api keys, resolved at both identity doors

2026-08-08 10:10:14 +00:00

api

resolve api keys at the websocket doors too

2026-08-08 10:40:04 +00:00

capabilities

per-user api keys, resolved at both identity doors

2026-08-08 10:10:14 +00:00

channels

carry attached images through to the model

2026-08-07 02:54:39 +00:00

queue

email: the sidecar schedules its own syncs

2026-07-31 13:33:46 +00:00

sidecar

make the notify identity rule testable, and fix what the test found

2026-08-08 10:00:02 +00:00

auth-token.ts

per-user api keys, resolved at both identity doors

2026-08-08 10:10:14 +00:00

bootstrap.ts

log every auth attempt that names an identity the platform does not know

2026-08-06 05:31:10 +00:00

build-env.ts

fail closed when PUBLIC_BUILD_ENV is unset

2026-07-25 23:30:20 +01:00

create-router.ts

first

2026-02-16 19:34:35 +00:00

custom-errors.ts

first

2026-02-16 19:34:35 +00:00

data-path.ts

clean out the per-container architecture's remnants

2026-08-04 13:41:16 +00:00

ensure-tool-loader.ts

add header rescan button to apply officer-items changes without restart

2026-07-21 01:31:51 +00:00

hono.ts

per-user api keys, resolved at both identity doors

2026-08-08 10:10:14 +00:00

jwt.ts

sidecar network host

2026-02-26 03:32:04 +00:00

mcp-tool-server.ts

clear the remaining type errors

2026-07-25 23:30:20 +01:00

sidecar-registry.test.ts

fail only the disconnected sidecar's in-flight requests

2026-08-04 01:33:29 +00:00

sidecar-registry.ts

reattach a refreshed browser to a running turn

2026-08-07 17:59:26 +00:00

super-admin.ts

auth: the role column decides who owns the server

2026-08-04 14:42:35 +00:00

tool-loader-source.ts

gmail proxy tool with token refresh, claude pro bearer auth, pi --list-models stderr fallback, tool object input type

2026-05-30 17:07:51 +00:00

tool-registry.ts

tool registry, claude tool awareness, and model selector fix

2026-03-07 11:55:38 +00:00