Harden release console token bootstrap

2026-07-21 03:16:57 +02:00
parent fcc5885dcf
commit 17f8036bdc
4 changed files with 51 additions and 4 deletions
--- a/tools/release/server/app.py
+++ b/tools/release/server/app.py
@@ -85,7 +85,7 @@ def create_app(*, workspace_root: Path = DEFAULT_WORKSPACE_ROOT, token: str | No
    @app.middleware("http")
    async def require_token(request: Request, call_next):  # type: ignore[no-untyped-def]
        if token and request.url.path.startswith("/api/"):
-            provided = request.headers.get("x-release-console-token") or request.query_params.get("token")
+            provided = request.headers.get("x-release-console-token")
            if provided != token:
                return JSONResponse({"detail": "release console token required"}, status_code=401)
        return await call_next(request)