multica

mirror of https://github.com/multica-ai/multica.git synced 2026-07-06 14:00:09 +02:00

Files

Jiayuan Zhang 82bbce98fd fix(security): add workspace ownership checks to daemon API routes (#684 )

* fix(security): add workspace ownership checks to all daemon API routes

Switch daemon routes from middleware.Auth to middleware.DaemonAuth and
add per-handler workspace ownership verification. This prevents
cross-workspace access to runtimes, tasks, usage, and daemon lifecycle
endpoints (HIGH-1/2/3 + CHAIN-1/2/3).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(security): support mdt_ daemon tokens in DaemonRegister + add regression tests

DaemonRegister now handles both auth paths:
- mdt_ daemon tokens: verify workspace match, skip member check, zero OwnerID
  (SQL COALESCE preserves existing owner on upsert)
- PAT/JWT: existing member check + OwnerID from member

Also adds WithDaemonContext helper and regression tests covering:
- Successful register with daemon token
- Workspace mismatch rejection
- Cross-workspace heartbeat rejection
- Cross-workspace task status rejection

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-04-11 12:49:23 +08:00

auth_test.go

feat(auth): email verification login and personal access tokens

2026-03-26 14:32:30 +08:00

auth.go

feat(auth): email verification login and personal access tokens

2026-03-26 14:32:30 +08:00

cloudfront.go

fix(auth): extend JWT and CloudFront cookie expiration from 72h to 30 days

2026-04-06 21:48:31 +08:00

daemon_auth.go

fix(security): add workspace ownership checks to daemon API routes (#684 )