Repository navigation
当前 - #116
Open
thefloshibisci wants to merge 18 commits into
Open
当前#116thefloshibisci wants to merge 18 commits into
thefloshibisci wants to merge 18 commits into
Conversation
The star-map detail page in Xinchao calls /api/bucket/{id} with the
same Bearer token used for MCP protocol auth (OMBRE_MCP_TOKEN /
config['mcp_token']). The previous fix (73a318a) only accepted a
separate OMBRE_MCP_SERVICE_TOKEN env var, which is typically not
configured. This made every feel/plan/letter/i bucket appear in the
star map (via pulse) but show 'not in current memory library' when
clicked, because the HTTP read returned 401 and the MCP search
fallback could not find the bucket by query.
Now _is_service_token_authenticated accepts either the dedicated
service token or the live MCP static token, both in constant time.
Mutation routes remain Dashboard-session-only.
The production MCP token is 10 chars, but _MIN_SERVICE_TOKEN_LENGTH=32
was used for both service tokens and MCP tokens, causing the 10-char
token to be rejected with 401 on HTTP API routes like /api/bucket/{id}.
- Add _MIN_MCP_TOKEN_LENGTH=8 (MCP tokens are validated by the MCP
server itself, lower bar is acceptable)
- Service tokens still require _MIN_SERVICE_TOKEN_LENGTH=32 (unchanged)
- Add regression tests for short (10-char) MCP tokens
Collaborator
|
感谢提交。逐个看了 7 个提交，我这边的审查意见如下，最终由主负责人决定。 鉴权放宽的两处不建议合并。 只读桶详情端点接受 MCP 静态 token、调低 token 最小长度，这两处都在放宽鉴权。本地复现：用 MCP 静态 token 调 其他几点：
pulse 把 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
改了什么
为什么这么改
测过没有
Signed-off-by:（git commit -s），表示我有权提交这些代码 —— 见 DCO 与 CONTRIBUTING.md