arc53-machine 174130607a feat(pat): authenticate personal access tokens ...

handle_auth resolves a dgpt_pat_ bearer against the database instead of
decoding it as a JWT, for both the Flask and the ASGI routes. Scopes and the
resource filter always come from the token row, and the claims that mark a
PAT are stripped from decoded JWTs so a session token cannot pose as one.
ASGI routes reject tokens unless they name the scope that admits them, and
/api/user/me reports what the calling token may do.

2026-09-19 23:39:58 +01:00

0 lines

0 B

Python

Raw Blame History

The file is empty.