Files
sencho/backend
Anso ce4b91e90f fix(auth): gate scoped JWTs on container-exec WebSocket (#1741)
Partial-auth (mfa_pending) and enroll-only (pilot_enroll) tokens skipped
the admin check on /ws because any set scope was treated as already gated.
Reject those scopes in the shared upgrade pipeline, and deny unknown scopes
on the generic path while allowing api_token, console_session, and pilot_tunnel.
2026-07-30 18:21:59 -04:00
..