Katia Bulatova cb0bcc92b9 fix(webapp): refuse an environment-scoped token on a route that names nothing ...

assertUserActorScope returned early whenever the passed scope carried no
org, project or environment, and the route builder passes {} for any route
that declares no context — so the guard was a no-op there. api.v1.orgs's
action is such a route and has no authorization block either, letting a
read-only agent token create an organization.

Fail closed instead, with an explicit identityOnly opt-in for the two
contextless loaders that answer with the caller's own identity, and give
org creation the gate its siblings have.

2026-08-07 23:50:02 +00:00

..

supervisor

feat(supervisor): cancel a resumed run's in-flight checkpoint (#4502)

2026-08-05 12:01:14 +01:00

webapp

fix(webapp): refuse an environment-scoped token on a route that names nothing

2026-08-07 23:50:02 +00:00