Follow-up from PR #158 review (#158 (comment)).
require_session is called manually inside each protected handler, so authentication is opt-in per handler and easy to forget. The jobs routes (POST /jobs/:name/run, POST /jobs/runs/:run_id/cancel) trigger execution but never call it — they predate #158 (added in #98), so this was not introduced by the query endpoint, but it is a live gap when auth is enabled.
Proposed fix: apply auth as a route_layer on a protected sub-router in configure_routes, making authentication the default and public routes (/health, /api/auth/*) the explicit exception. verify_session returning a structured error instead of a serialized HTTP response (PR #158 review thread r3611055050) would fold naturally into the same middleware refactor.
🤖 Generated with Claude Code
Follow-up from PR #158 review (#158 (comment)).
require_sessionis called manually inside each protected handler, so authentication is opt-in per handler and easy to forget. The jobs routes (POST /jobs/:name/run,POST /jobs/runs/:run_id/cancel) trigger execution but never call it — they predate #158 (added in #98), so this was not introduced by the query endpoint, but it is a live gap when auth is enabled.Proposed fix: apply auth as a
route_layeron a protected sub-router inconfigure_routes, making authentication the default and public routes (/health,/api/auth/*) the explicit exception.verify_sessionreturning a structured error instead of a serialized HTTP response (PR #158 review thread r3611055050) would fold naturally into the same middleware refactor.🤖 Generated with Claude Code