b5674869ed
* fix(auth): enforce auth middleware and workspace membership on daemon API routes Daemon routes were registered without the Auth middleware, meaning the server accepted unauthenticated requests to register runtimes, claim tasks, etc. The daemon client already sends a Bearer token — the server just wasn't validating it. - Split /api/daemon routes: pairing-session endpoints stay public (used before the daemon has a token), all others now require Auth middleware - Add workspace membership check in DaemonRegister so only workspace members can register runtimes - Update test to include X-User-ID header matching the new auth requirement Closes MUL-90 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * refactor(daemon): remove dead pairing-session feature The daemon pairing flow was never completed — the daemon authenticates via CLI config token, not pairing sessions. Remove all related code: - Delete daemon_pairing.go handler (4 unused handlers) - Remove pairing routes from router.go (3 public + 1 protected) - Delete /pair/local page + test from frontend - Remove DaemonPairingSession types and API client methods - Add migration 029 to drop daemon_pairing_session table - Update LOCAL_DEVELOPMENT.md to reflect actual auth flow Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
21 lines
1.1 KiB
SQL
21 lines
1.1 KiB
SQL
-- Re-create the daemon_pairing_session table (from migration 005).
|
|
CREATE TABLE IF NOT EXISTS daemon_pairing_session (
|
|
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
token TEXT NOT NULL UNIQUE,
|
|
daemon_id TEXT NOT NULL,
|
|
device_name TEXT NOT NULL DEFAULT '',
|
|
runtime_name TEXT NOT NULL DEFAULT '',
|
|
runtime_type TEXT NOT NULL DEFAULT '',
|
|
runtime_version TEXT NOT NULL DEFAULT '',
|
|
workspace_id UUID REFERENCES workspace(id),
|
|
approved_by UUID REFERENCES "user"(id),
|
|
status TEXT NOT NULL DEFAULT 'pending',
|
|
approved_at TIMESTAMPTZ,
|
|
claimed_at TIMESTAMPTZ,
|
|
expires_at TIMESTAMPTZ NOT NULL,
|
|
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
|
updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
|
);
|
|
|
|
CREATE INDEX IF NOT EXISTS idx_daemon_pairing_session_token ON daemon_pairing_session(token);
|
|
CREATE INDEX IF NOT EXISTS idx_daemon_pairing_session_status ON daemon_pairing_session(status, expires_at);
|