vxaboveground/overlord
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

tiny update

Browse Source
This commit is contained in:
KingKDot
2026-08-24 09:35:03 -05:00
parent fcc6cc53be
commit 0921e39333
131 changed files with 9948 additions and 1076 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Overlord-Server/src/server/agent-auth.ts
+13 -5
View File
@@ -4,6 +4,7 @@ import { timingSafeEqual } from "crypto";
let warnedDisableAuthIgnored = false;
let loggedAuthDisabledByEnv = false;
let loggedAuthDisabledNoToken = false;
let warnedLegacyQueryAuth = false;
function safeCompare(a: string, b: string): boolean {
const bufA = Buffer.from(a);
@@ -40,16 +41,23 @@ export function isAuthorizedAgentRequest(
if (!token) {
if (!loggedAuthDisabledNoToken) {
loggedAuthDisabledNoToken = true;
logger.info("[auth] Agent auth disabled");
logger.error("[auth] Agent auth token is missing; agent requests will be rejected");
}
return true;
return false;
}
const headerToken = req.headers.get("x-agent-token");
if (headerToken !== null && safeCompare(headerToken, token)) return true;
const legacyQuerySetting = String(process.env.OVERLORD_ALLOW_AGENT_TOKEN_QUERY || "").trim().toLowerCase();
const allowLegacyQuery = legacyQuerySetting !== "false" && legacyQuerySetting !== "0";
if (!allowLegacyQuery) return false;
if (!warnedLegacyQueryAuth) {
warnedLegacyQueryAuth = true;
logger.warn("[auth] Legacy agent query-token authentication is enabled; URLs may leak credentials");
}
const queryToken = url.searchParams.get("token");
const isAuthed =
(headerToken !== null && safeCompare(headerToken, token)) ||
(queryToken !== null && safeCompare(queryToken, token));
const isAuthed = queryToken !== null && safeCompare(queryToken, token);
return isAuthed;
}