Katia Bulatova a4ba0271b0 fix(webapp): refuse a delegated token at the entrance of the PAT-only auth helper ...

The helper checks no scopes and no capability context, so a read-only user-actor token
reached an alert-channel write and every admin route behind requireAdminApiRequest.
Actor-aware routes are unaffected: they authenticate the token through the route
builders, which enforce its claims.

2026-08-08 16:19:12 +00:00

..

supervisor

feat(supervisor): cancel a resumed run's in-flight checkpoint (#4502)

2026-08-05 12:01:14 +01:00

webapp

fix(webapp): refuse a delegated token at the entrance of the PAT-only auth helper

2026-08-08 16:19:12 +00:00