updated allowlist for anonymous requests

2026-10-24 12:42:38 +00:00 · 2026-06-22 23:27:05 +02:00
parent 12d67380e9
commit 781cf0fb9b
2 changed files with 7 additions and 1 deletions
@@ -1 +1 @@
-1169
+1175
@@ -42,6 +42,12 @@ public class AuthenticationMiddleware : IFunctionsWorkerMiddleware
    {
        "/api/health",
        "/api/stats/platform",
+        // Ticket-gated diagnostics download (MCP/AI clients hold no JWT). Authority is the
+        // HMAC-signed ?t= ticket, validated inside DiagnosticsTicketDownloadFunction; authz
+        // already happened at mint time (diagnostics/download-ticket, MemberRead). Must mirror
+        // the PublicAnonymous entry in EndpointAccessPolicyCatalog — this middleware runs BEFORE
+        // PolicyEnforcementMiddleware, so a missing entry here 401s before the policy is honored.
+        "/api/diagnostics/download",
        "/api/agent/register-session",
        "/api/agent/ingest",
        "/api/agent/telemetry",