@axiom-lattice/gateway 10.2.2 → 10.2.3

package/dist/index.mjs

@@ -15222,6 +15222,10 @@ function isStaleConsoleSessionCredential(authHeader) {
     return false;
   }
 }
+function isConsoleAuthPublicRoute(request) {
+  const routeOptions = request.routeOptions;
+  return routeOptions?.config?.consoleAuth === "public";
+}
 function bypassesConsoleAuth(request) {
   const path5 = request.url.split("?")[0];
   const method = request.method;
@@ -15239,7 +15243,7 @@ function registerConsoleAuthHook(app2, options) {
       const user = { id: session.id, tenantId: session.tenantId, tokenExpiresAt: session.expiresAt };
       request.user = user;
     }
-    if (bypassesConsoleAuth(request)) return;
+    if (isConsoleAuthPublicRoute(request) || bypassesConsoleAuth(request)) return;
     if (session) return;
     if (!options.authRequired || request.method === "OPTIONS") {
       if (!isPublicRoute(request) && !request.url.startsWith("/s/") && isStaleConsoleSessionCredential(request.headers.authorization)) {
@@ -26287,6 +26291,11 @@ function registerAgentWebAppRuntimeRoutes(app2, deps) {
   const identities = deps.identityResolver ?? createWebAppIdentityResolver({ getIdentityConfig: (webAppId) => deps.service.getIdentityConfig(webAppId) });
   const runLifecycle = deps.runLifecycle ?? createRunLifecycleHandlers({ threadOwnedBy: async () => true });
   app2.register(async (routes) => {
+    routes.addHook("onRoute", (routeOptions) => {
+      if (/^\/api\/web-apps\/[^/]+\/runtime(?:\/|$)/.test(routeOptions.url)) {
+        routeOptions.config = { ...routeOptions.config, consoleAuth: "public" };
+      }
+    });
     routes.setErrorHandler((error, _request, reply) => normalizeError2(reply, error));
     routes.get("/api/web-apps/:webAppId/runtime/bootstrap", async (request, reply) => handle2(reply, async () => {
       const { webAppId } = paramsSchema.parse(request.params);