Authenticate the board event stream #82

Merged

Breadway merged 1 commit from fix/bb-93-authenticated-events into main

2026-10-02 12:00:40 +08:00

Breadway commented

2026-10-01 17:53:35 +08:00

Owner

Require a valid session cookie or bearer token for /events, preventing unauthenticated subscribers from receiving board keys and sync drift values. Browser EventSource clients continue to use their session cookie, and CLI/TUI clients can use bearer tokens.

Verified with cargo build --workspace, cargo test --workspace, cargo clippy --workspace --all-targets -- -D warnings, cargo run -p xtask -- check-docs, npm run check -w breadboard-web, and npm run build. Repository-wide cargo fmt --check reports existing formatting drift in untouched files; changed files were formatted.

Closes #80

Require a valid session cookie or bearer token for `/events`, preventing unauthenticated subscribers from receiving board keys and sync drift values. Browser EventSource clients continue to use their session cookie, and CLI/TUI clients can use bearer tokens. Verified with `cargo build --workspace`, `cargo test --workspace`, `cargo clippy --workspace --all-targets -- -D warnings`, `cargo run -p xtask -- check-docs`, `npm run check -w breadboard-web`, and `npm run build`. Repository-wide `cargo fmt --check` reports existing formatting drift in untouched files; changed files were formatted. Closes #80

Breadway added 1 commit

2026-10-01 17:53:35 +08:00

fix: authenticate board event stream

check / check (push) Successful in 4m7s

Details

5b659de0f7

Breadway referenced this pull request

2026-10-01 17:53:58 +08:00

Public /events stream exposes issue keys and sync.drift field values to anyone #80

Breadway commented

2026-10-01 17:55:39 +08:00

Author

Owner

Implementation is available in PR #82 at 5b659de0f7dac7c88fb3fefcda2c81086311b1c1. Local verification passed: workspace build, tests, Clippy, check-docs, web check, and npm build. Exact-head CI is pending and waiting to run; if it fails, move this card back to TODO.

Implementation is available in PR #82 at `5b659de0f7dac7c88fb3fefcda2c81086311b1c1`. Local verification passed: workspace build, tests, Clippy, check-docs, web check, and npm build. Exact-head CI is pending and waiting to run; if it fails, move this card back to TODO.

Breadway merged commit b826b48d75 into main

2026-10-02 12:00:40 +08:00

Breadway referenced this pull request from a commit

2026-10-02 12:00:41 +08:00

Merge pull request 'Authenticate the board event stream' (#82) from fix/bb-93-authenticated-events into main

Breadway referenced this pull request

2026-10-02 12:01:07 +08:00

Server ignores SIGTERM, so every container stop waits 10s and ends in SIGKILL #81