Jiayuan Zhang 82bbce98fd fix(security): add workspace ownership checks to daemon API routes (#684) ...

* fix(security): add workspace ownership checks to all daemon API routes

Switch daemon routes from middleware.Auth to middleware.DaemonAuth and
add per-handler workspace ownership verification. This prevents
cross-workspace access to runtimes, tasks, usage, and daemon lifecycle
endpoints (HIGH-1/2/3 + CHAIN-1/2/3).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(security): support mdt_ daemon tokens in DaemonRegister + add regression tests

DaemonRegister now handles both auth paths:
- mdt_ daemon tokens: verify workspace match, skip member check, zero OwnerID
  (SQL COALESCE preserves existing owner on upsert)
- PAT/JWT: existing member check + OwnerID from member

Also adds WithDaemonContext helper and regression tests covering:
- Successful register with daemon token
- Workspace mismatch rejection
- Cross-workspace heartbeat rejection
- Cross-workspace task status rejection

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-04-11 12:49:23 +08:00

..

cmd

fix(security): add workspace ownership checks to daemon API routes (#684)

2026-04-11 12:49:23 +08:00

internal

fix(security): add workspace ownership checks to daemon API routes (#684)

2026-04-11 12:49:23 +08:00

migrations

feat(search): add project search support to Cmd+K search (#663)

2026-04-10 20:59:32 +08:00

pkg

fix(server): validate workspace ownership for attachment uploads and queries (#683)

2026-04-11 04:33:24 +08:00

go.mod

fix: sanitize markdown rendering in comments and shared renderers (#679)

2026-04-11 03:44:30 +08:00

go.sum

fix: sanitize markdown rendering in comments and shared renderers (#679)

2026-04-11 03:44:30 +08:00

sqlc.yaml

…