mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-28 12:49:03 +00:00
SaelixCode
30fe77cd5d
When the gateway proxied a WebSocket upgrade for a remote node's interactive terminal (host console or container exec), it injected the long-lived api_token (scope: 'node_proxy') as the Bearer token. The remote's WS upgrade handler correctly blocked this token via its isProxyToken guard (added in a prior security hardening commit), causing a 403 → socket destroy → "connection error, session ended" on the client. Fix: introduce a POST /api/system/console-token endpoint that issues a short-lived JWT (scope: 'console_session', 60 s TTL). Before forwarding an interactive WS upgrade to a remote node, the gateway calls this endpoint using the api_token, then substitutes the returned console_session token as the Bearer header for the WS upgrade. The remote's isProxyToken guard (scope === 'node_proxy') continues to block the long-lived api_token from spawning shells directly while allowing gateway-delegated console sessions through. Non-interactive WS paths (stack logs) continue to use the api_token unchanged.