guru-connect

Go to file

Mike Swanson 4614df04fb Security: Require authentication for all WebSocket and API endpoints

- REST API: All session/code/machine endpoints now require AuthenticatedUser
- Viewer WebSocket: Requires JWT token in query params (token=...)
- Agent WebSocket: Requires either valid support code OR API key
- Dashboard: Passes JWT token when connecting to viewer WS
- Native viewer: Passes token in protocol URL and WebSocket connection
- Added AGENT_API_KEY env var support for persistent agents
- Added get_status() to SupportCodeManager for auth validation

This fixes the security vulnerability where unauthenticated agents
could connect and appear in the dashboard without any credentials.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

2025-12-30 06:30:28 -07:00

.cargo

Add portal UX and dashboard specifications

2025-12-28 10:37:34 -07:00

agent

Security: Require authentication for all WebSocket and API endpoints

2025-12-30 06:30:28 -07:00

dashboard

Initial GuruConnect implementation - Phase 1 MVP

2025-12-21 17:18:05 -07:00

proto

Add machine deletion API with uninstall command support