fix(auth): restore permission boundary safeguards

2026-08-16 18:03:36 +02:00
parent 2e0489ce22
commit f99bddcdf0
8 changed files with 126 additions and 14 deletions
@@ -102,7 +102,8 @@ export function sessionRoutes(
    admissionLeases.set(req, release);
  });
  app.addHook("preHandler", async (req, reply) => {
-    if (req.url === "/runtime/prewarm" || req.url === "/sessions" || req.url.startsWith("/sessions/")) {
+    const pathname = req.url.split("?", 1)[0];
+    if (pathname === "/runtime/prewarm" || pathname === "/sessions" || pathname.startsWith("/sessions/")) {
      const principal = requirePermission(req, reply, "session.use");
      if (!isPrincipalContext(principal)) return principal;
    }