jpmschweitzer/odysseus
1
0
Fork 0
mirror of https://github.com/pewdiepie-archdaemon/odysseus.git synced 2026-10-24 15:52:20 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): close API token agent authorization gaps

Browse Source
This commit is contained in:
RaresKeY
2026-08-28 18:07:40 +00:00
parent aeff329c05
commit 9150a453b4
20 changed files with 907 additions and 114 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/test_null_owner_gates.py
+5 -4
View File
@@ -318,12 +318,13 @@ def test_sync_chat_fallback_skips_disabled_owned_endpoint():
assert ep is not None and ep.name == "shared"
def test_sync_chat_fallback_null_owner_uses_shared_rows_only():
# When no token owner is known, only null-owner (shared) endpoints are
# visible — private endpoints of any user must not be returned.
def test_sync_chat_fallback_rejects_missing_token_owner():
# The sync-chat route requires a resolved token owner before endpoint
# selection, so even a legacy/shared endpoint is not executable for an
# ownerless bearer.
rows = [_ep("bob-private", "bob"), _ep("shared", None)]
ep = _select(rows, None)
assert ep is not None and ep.name == "shared"
assert ep is None
def test_sync_chat_fallback_null_owner_returns_none_with_no_shared():