From d6ae5cd216c57fc32d56955d3eef03036f0d7100 Mon Sep 17 00:00:00 2001 From: Trezy Date: Mon, 11 May 2026 15:42:57 -0500 Subject: [PATCH] fix: restrict Bearer space credentials to space XRPC routes Signed-off-by: Trezy --- src/auth/middleware.rs | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/auth/middleware.rs b/src/auth/middleware.rs index 4d9814f..f4cc387 100644 --- a/src/auth/middleware.rs +++ b/src/auth/middleware.rs @@ -252,13 +252,18 @@ impl FromRequestParts for XrpcClaims { } Some(h) if h.starts_with("Bearer ") => { let token = &h[7..]; + let path = parts.uri.path(); + let is_space_route = path.contains("/dev.happyview.space."); match crate::spaces::credential::peek_jwt_typ(token) { - Some(typ) if typ == "space_credential" => { + Some(typ) if typ == "space_credential" && is_space_route => { Ok(XrpcClaims { identity: None, space_credential: Some(token.to_string()), }) } + Some(typ) if typ == "space_credential" => Err(AppError::Auth( + "space credentials are only accepted on space routes".into(), + )), _ => Err(AppError::Auth( "XRPC routes do not accept Bearer auth. Use DPoP auth, a space credential, or omit the Authorization header for anonymous access.".into(), )), -- 2.51.2