mirror of
https://github.com/rennf93/roboco.git
synced 2026-08-03 07:23:24 +02:00
463c952b16
The v1 flow role guards (_require_roles) are the sole gate for /api/v1/flow/* but checked only the X-Agent-Role string — unlike get_agent_context, which verifies the token. So a forged role header passed, and in strict mode (ROBOCO_AGENT_AUTH_REQUIRED) the token was never required on these routes. Call _check_agent_auth_token before the role membership test (deferred import to avoid the cycle): missing token stays a no-op in header-trust mode, any presented token is verified, and strict mode now requires it. Supersedes #222 (antfleet-ops flagged the bypass); re-done as our own change so it lands without the contributor CLA, and adds the positive valid-token test their PR was missing. Co-authored-by: Renn F <rennf93@users.noreply.github.com>