aaronrene / knowtation public
fix patch feat/phase-2g-bundle
AI Agent git-import/068377df · 107 days ago · Apr 10, 2026 · Diff

fix: restore backward-compat JWT fallback in image proxy for pre-token-migration hub.js

The Phase 3.2 change replaced full-JWT ?token= auth with short-lived HMAC-signed tokens. However, the currently deployed hub.js still sends the full session JWT as ?token=, causing image proxy requests to 401.

Add a JWT fallback in both gateway and self-hosted image proxy: after the HMAC verifyImageProxyToken check fails, attempt to verify the query token as a standard JWT. This restores images for the already- deployed frontend until the updated hub.js (PR #136) is live.

New tests added to test/phase3-security.test.mjs verifying the backward-compat path is present in both servers.

sha256:b9908eeb4b88c902193d61c61c9fe25094d59ddd0d191bc10082b4ac94a55e75 sha
sha256:def43276900c79ad66a1f6811873d8b774e07f9e125e199b0f0c83b3bbf27480 parent
sha256:6032887bf658eae665cc0f98b9e6901ca7ae1d084d95e8c616b22877acf73543 snapshot
← Older Oldest on feat/phase-2g-bundle
All commits
Newer → Latest on feat/phase-2g-bundle

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:b9908eeb4b88c902193d61c61c9fe25094d59ddd0d191bc10082b4ac94a55e75 --body "your comment"