External/roboco
1
0
Fork 0
mirror of https://github.com/rennf93/roboco.git synced 2026-08-03 07:23:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat(api/v2): enforce X-Agent-Role on every flow router

Browse Source 
Route layer now rejects 403 if the role doesn't match the router's
allowed set. Choreographer still re-checks role per verb where needed,
but defense in depth means a future verb that forgets the role check
doesn't leak. Auditor router also gated.
This commit is contained in:
Renn F
2026-05-03 05:27:31 +02:00
parent 3d5f14815d
commit 92294f90fb
16 changed files with 167 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/unit/api/routes/v2/test_flow_auditor.py
+1 -1
View File
@@ -19,7 +19,7 @@ _HTTP_200 = 200
_AGENT_ID = str(uuid4())
_TASK_ID = str(uuid4())
_HEADERS = {"X-Agent-ID": _AGENT_ID}
_HEADERS = {"X-Agent-ID": _AGENT_ID, "X-Agent-Role": "auditor"}
def _make_envelope(