mirror of
https://github.com/penpot/penpot.git
synced 2026-09-23 20:36:15 +00:00
Shared-key callers (exporter, admin-console) arrive as keywords on auth-key-id, so transit persisted them as ~:exporter while regular traffic stored app. Coerce with d/name at the single origin so every audit and telemetry copy carries a plain string. Adds regression tests for the origin and the push-audit-events path, including caller spoofing precedence. Closes #11628 AI-assisted-by: muse-spark-1.3-contributor