Wanjohi 23fceb0cfb feat(api): an installer sign-in can only ask for an install token ...

A session the issuer minted for the installer exists to make one call:
POST /machine/install-token. The installer runs on a machine that may
not belong to the person who approved it, so anything else that session
could do with the account is exposure with no use.

The auth middleware now refuses a token whose audience is `installer`
on every other route with 403 `forbidden`, "This sign-in can only add a
host". It is checked once, in the middleware, so a route added later
cannot forget it. Tokens for every other audience behave as before.

2026-10-16 00:57:14 +03:00

..

auth.ts

feat(api): an installer sign-in can only ask for an install token

2026-10-16 00:57:14 +03:00