Files
hermes-agent/hermes_cli
unsupportedpastels 9242ce464b fix(dashboard-auth): /api/status on the Webapp reads the session-token header as signed in
The gate now accepts the deployment session token in X-Hermes-Session-Token on
the gateway's Webapp, but peek_session (used only by /api/status to decide what
a signed-out Webapp caller sees) still read just the bearer and the cookies. So
a Desktop "Session token" connection was signed in on gated routes and got the
signed-out /api/status body, without install_id or gateway_shared_with.

peek_session now tries the header in the same place the gate does: no bearer
and neither session cookie present. It goes through the same helper, so only
the session-token provider verifies the value and the Webapp bearer rule
applies; peek stays side-effect free (no refresh, cookie writes, audit or 401).
Bearer, cookie and no-credential requests read as before.

Docs: the Desktop guide lists the header among the ways the deployment token
works on the Webapp.

Patch from @BearHuddleston's review.
2026-11-05 19:56:12 -05:00
..
2026-10-09 17:34:38 +02:00
2026-10-21 23:05:11 -04:00
2026-10-09 17:34:38 +02:00
…
2026-10-20 22:18:49 -04:00
2026-10-09 17:34:38 +02:00
2026-10-09 17:34:38 +02:00
2026-10-09 17:34:38 +02:00
2026-10-08 19:28:23 +02:00
2026-10-09 17:34:38 +02:00
…
2026-10-09 17:34:38 +02:00
2026-10-09 17:34:38 +02:00
2026-10-09 17:34:38 +02:00
2026-10-09 17:34:38 +02:00
2026-10-09 17:34:38 +02:00
2026-10-09 17:34:36 +02:00
2026-10-09 17:34:36 +02:00
2026-10-09 17:34:36 +02:00
2026-10-09 17:34:36 +02:00
2026-10-09 17:34:36 +02:00
…
2026-10-09 17:34:38 +02:00
…
2026-10-09 17:34:38 +02:00