Jannik/PaperClipAI
1
0 Fork 0
mirror of https://github.com/paperclipai/paperclip.git synced 2026-10-23 09:07:46 +02:00
Code Issues Packages Projects Releases Wiki Activity

Allow cloud tenant import mutations without browser origin

Browse Source
This commit is contained in:
Dotta committed 2026-05-19 14:25:05 -05:00
1 parent 98b15503e8
commit 569da5dc9d
2 files changed
+14 -3
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

server/src/__tests__/board-mutation-guard.test.ts
+7 -1
View File
@@ -5,7 +5,7 @@ import { boardMutationGuard } from "../middleware/board-mutation-guard.js";
function createApp(
actorType: "board" | "agent",
boardSource: "session" | "local_implicit" | "board_key" = "session",
boardSource: "session" | "local_implicit" | "board_key" | "cloud_tenant" = "session",
) {
const app = express();
app.use(express.json());
@@ -66,6 +66,12 @@ describe("boardMutationGuard", () => {
expect([200, 204]).toContain(res.status);
});
it("allows trusted Cloud tenant mutations without origin", async () => {
const app = createApp("board", "cloud_tenant");
const res = await request(app).post("/mutate").send({ ok: true });
expect([200, 204]).toContain(res.status);
});
it("allows board mutations from trusted origin", async () => {
const app = createApp("board");
const res = await request(app)
server/src/middleware/board-mutation-guard.ts
+7 -2
View File
@@ -56,9 +56,14 @@ export function boardMutationGuard(): RequestHandler {
return;
}
// Local-trusted mode and board bearer keys are not browser-session requests.
// Local-trusted mode, board bearer keys, and trusted Cloud tenant calls are
// not browser-session requests.
// In these modes, origin/referer headers can be absent; do not block those mutations.
if (req.actor.source === "local_implicit" || req.actor.source === "board_key") {
if (
req.actor.source === "local_implicit"
|| req.actor.source === "board_key"
|| req.actor.source === "cloud_tenant"
) {
next();
return;
}