vrr/eigent
2
0
Fork 0
mirror of https://github.com/eigent-ai/eigent.git synced 2026-04-28 11:40:25 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

fix: enforce authentication on unauthenticated endpoints and harden auth_must (#1294)

Browse source 
Co-authored-by: bytecii <994513625@qq.com>
This commit is contained in:
Muhammet Eren Karakuş 2026-02-22 03:23:26 +03:00 • committed by GitHub
parent 1831d2a686
commit 8d26e1a122
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 172 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

14
server/app/controller/chat/snapshot_controller.py
View file

@ -33,9 +33,11 @@ async def list_chat_snapshots(
camel_task_id: str | None = None,
browser_url: str | None = None,
session: Session = Depends(session),
auth: Auth = Depends(auth_must),
):
"""List chat snapshots with optional filtering."""
query = select(ChatSnapshot)
user_id = auth.user.id
query = select(ChatSnapshot).where(ChatSnapshot.user_id == user_id)
if api_task_id is not None:
query = query.where(ChatSnapshot.api_task_id == api_task_id)
if camel_task_id is not None:
@ -45,7 +47,8 @@ async def list_chat_snapshots(
snapshots = session.exec(query).all()
logger.debug(
"Snapshots listed", extra={"api_task_id": api_task_id, "camel_task_id": camel_task_id, "count": len(snapshots)}
"Snapshots listed",
extra={"user_id": user_id, "api_task_id": api_task_id, "camel_task_id": camel_task_id, "count": len(snapshots)},
)
return snapshots
@ -60,6 +63,13 @@ async def get_chat_snapshot(snapshot_id: int, session: Session = Depends(session
logger.warning("Snapshot not found", extra={"user_id": user_id, "snapshot_id": snapshot_id})
raise HTTPException(status_code=404, detail=_("Chat snapshot not found"))
if snapshot.user_id != user_id:
logger.warning(
"Unauthorized snapshot access",
extra={"user_id": user_id, "snapshot_id": snapshot_id, "owner_id": snapshot.user_id},
)
raise HTTPException(status_code=403, detail=_("You are not allowed to view this snapshot"))
logger.debug(
"Snapshot retrieved",
extra={"user_id": user_id, "snapshot_id": snapshot_id, "api_task_id": snapshot.api_task_id},