mirror of
https://github.com/penpot/penpot.git
synced 2026-08-29 08:08:46 +00:00
8613e66115
`/dbg` read only `::session/profile-id`, so scripted access meant logging in with a password to obtain a cookie. A middleware after `actoken/authz` fills `::session/profile-id` in from the token when there is no session, which keeps one key for every existing handler to read and makes a console session, keyed by profile, resolve the same way either way. The admin gate is unchanged: devenv, or an address in `:admins`. What changes is that a token now reaches those handlers where before only a browser session did. This stays off `graph-backend`. It is a change to what reaches an admin-gated surface, and a reviewer should get to weigh it on its own rather than find it inside a graph change. AI-assisted-by: mixed models