aaronrene / knowtation public
fix patch feat/phase-2g-bundle
AI Agent git-import/068377df · 108 days ago · Apr 10, 2026 · Diff

fix: mint bridge JWT in image proxy when HMAC token used (private repo images)

When the signed HMAC image-proxy token authenticates the user, uid is known but jwtTokenForBridge is empty. The gateway then calls the bridge's /api/v1/vault/github-token with no auth, gets 401, ghToken is null, and redirects to the raw GitHub URL — which fails for private repos.

Fix: after all auth paths, if uid is set but jwtTokenForBridge is still empty, mint a short-lived (5 min) gateway JWT for the bridge call. This ensures the bridge can always identify the user and return the stored GitHub token regardless of which auth token the client sent.

sha256:88ffc61e271b74364a1b2f2220d1c032aa2e961083c255b949824ea1d9370700 sha
sha256:6d357cc6433df0f630e51ef77eeb3f48853bf2f3c32f8238f07cbdd59db71b3f parent
sha256:b4b5af6fb5395eed2a89852260a18ef5825dd1613a06890610add770f6a7811b snapshot
← Older Oldest on feat/phase-2g-bundle
All commits
Newer → Latest on feat/phase-2g-bundle

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:88ffc61e271b74364a1b2f2220d1c032aa2e961083c255b949824ea1d9370700 --body "your comment"