External/SnapOtter
1
0
Fork 0
mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: add SSE progress endpoint to public paths

Browse Source 
The /api/v1/jobs/ endpoint was blocked by auth middleware.
EventSource doesn't support custom headers so auth tokens can't be
sent. The jobId is a random UUID (unguessable capability token), same
security model as the download endpoint.
This commit is contained in:
Siddharth Kumar Sah
2026-03-23 09:16:44 +08:00
parent dbd3bf737e
commit b3f590c8b3
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/src/plugins/auth.ts
+1 -1
View File
@@ -388,7 +388,7 @@ function extractToken(request: FastifyRequest): string | null {
// ── Auth middleware ────────────────────────────────────────────────
const PUBLIC_PATHS = ["/api/v1/health", "/api/v1/config/", "/api/auth/", "/api/docs", "/api/v1/download/"];
const PUBLIC_PATHS = ["/api/v1/health", "/api/v1/config/", "/api/auth/", "/api/docs", "/api/v1/download/", "/api/v1/jobs/"];
function isPublicRoute(url: string): boolean {
// Non-API routes are public (SPA static files — auth is handled client-side)