Token CRUD endpoints had no authentication guard. Without it, unauthenticated requests could reach the handler — GET would return empty results silently, and POST could attempt to insert a token with user_id = NULL. All other route files in this codebase apply requireAuth explicitly; tokens.js was simply missing it. |
||
|---|---|---|
| .. | ||
| capture | ||
| editor | ||
| mam-api | ||
| premiere-plugin | ||
| web-ui | ||
| worker | ||