cb7cc9a43e
Code-review feedback: startsWith('/cluster') was a prefix match that exposed
destructive operator endpoints (POST /containers/:id/restart, DELETE /:id,
GET /devices/blackmagic/*) unauthenticated. Only POST /heartbeat is genuine
node-agent traffic; everything else in cluster.js is operator/UI surface
that should go through requireAuth. Long-term: issue node-agent a bound
api_token and drop the carve-out entirely.
|
||
|---|---|---|
| .. | ||
| src | ||
| test | ||
| .env.example | ||
| .gitignore | ||
| Dockerfile | ||
| package.json | ||