AdministratorandClaude Opus 4.8 d35d121261 feat(auth): 登录白名单也拦「接口问答」(已登录的 run 接口按用户放行)
开关开启时,未放行用户(非 admin)即便持旧 token,直接调发起问答的 run 接口
(/api/threads/{id}/runs[/stream|/wait]、/api/runs/{stream|wait})也返回 403,
不止拦登录。在 AuthMiddleware 解析出 user 后仅对问答 run 请求复用
enforce_user_approved;GET 列表/join/cancel/feedback 及普通浏览不受影响;
内部/渠道调用与无鉴权 /api/open/chat 不在此范围。

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-25 17:37:47 +08:00
2026-06-12 18:09:07 +08:00
2026-06-08 22:52:18 +08:00
2026-06-01 14:16:13 +08:00
2026-05-31 16:48:43 +08:00
2026-05-22 20:40:36 +08:00
2026-05-28 17:14:01 +08:00
2026-06-11 17:11:28 +08:00
2026-06-05 20:06:55 +08:00
2026-06-12 18:09:07 +08:00
2026-06-03 09:54:11 +08:00
2026-05-28 17:14:01 +08:00
2026-05-28 17:14:01 +08:00
2026-05-22 20:40:36 +08:00
S
Description
deerflow-code
238 MiB
0 Stars 1 Watchers 0 Forks
Languages
Python 39.2%
TypeScript 35.9%
HTML 22.2%
CSS 1.5%
JavaScript 0.9%
Other 0.2%