mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-25 05:00:07 +00:00
Oliver Kieselbach
5cd268e88c
The ticket-gated diagnostics/download route (PublicAnonymous, MCP session_debug) 401'd on the deployed backend: AuthenticationMiddleware kept its OWN hardcoded _anonymousRoutes allowlist, parallel to EndpointAccessPolicyCatalog, and the new route was added only to the catalog. Since AuthenticationMiddleware runs before PolicyEnforcementMiddleware, the missing entry rejected the request with a JWT 401 before the PublicAnonymous policy was ever honored. Classic hand-synced parallel-catalog drift. Delete _anonymousRoutes / _anonymousPrefixes and derive the JWT-exempt decision from the catalog: a route skips JWT iff its policy is PublicAnonymous or DeviceOrBootstrapAuth (authenticated in-function via cert/bootstrap token, not JWT). Now method-aware and fail-closed on unregistered routes. Behavior- preserving: the old 14 routes + 1 prefix equal exactly the catalog's PublicAnonymous u DeviceOrBootstrapAuth set. Add drift guard in EndpointPolicyCatalogCompletenessTests: AnonymousAndDeviceRoutes_AreJwtExemptInAuthMiddleware loops every such catalog entry and asserts the middleware exempts it (would have caught this bug); SkipsJwtValidation_MatchesPolicyTier locks the positive/negative tiers incl. the diagnostics/download vs diagnostics/download-url contrast. Full suite 2393 green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>