aaronrene / knowtation public
fix patch feat/phase-2g-bundle
AI Agent git-import/068377df · 107 days ago · Apr 10, 2026 · Diff

fix: add X-Gateway-Auth to all bridge→canister calls (Phase 0 compatibility)

Phase 0 added gatewayAuthorized() to the canister, which rejects every request that lacks the X-Gateway-Auth header when gateway_auth_secret is set. The bridge never sent this header, so all canister operations (export for backup, vault list, notes batch write, proposals list, vault delete, keyword search) started returning 401 after the new canister code was deployed.

Adds GATEWAY_AUTH_SECRET constant and a canisterHeaders() helper that injects X-Gateway-Auth when the secret is configured. All 8 canister fetch call sites in bridge/server.mjs now go through this helper.

New tests in phase3-security.test.mjs verify the helper exists and is used at every canister fetch call site.

sha256:aea7b7f36e52c8f81ece4e8084ba0bff7159a5a32b51796080b33c015a5f1b67 sha
sha256:5954acb0c47507f7f46feb1f289475f19a2085e243953708c8ea7ccf31d32308 parent
sha256:d75c68c0fe67098c424792deff4ad83a994f046d0c90c8c65a1c515efc7b8269 snapshot
← Older Oldest on feat/phase-2g-bundle
All commits
Newer → Latest on feat/phase-2g-bundle

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:aea7b7f36e52c8f81ece4e8084ba0bff7159a5a32b51796080b33c015a5f1b67 --body "your comment"