pangolin_mirror/pangolin
1
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-10-22 12:39:05 +02:00
Code Issues Packages Projects Releases Wiki Activity

Optionally forward identity headers

Browse Source
This commit is contained in:
Owen
2026-10-20 09:50:02 -04:00
parent f363c07afa
commit 6aaaae3819
2 changed files with 67 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/routers/badger/verifySession.ts
+37 -6
View File
@@ -857,7 +857,10 @@ export async function verifyResourceSession(
return allowed(
res,
whitelistEmail ? { email: whitelistEmail } : undefined,
forwardedUserData(
resource,
whitelistEmail ? { email: whitelistEmail } : undefined
),
dontStripSession
);
}
@@ -899,7 +902,11 @@ export async function verifyResourceSession(
parsedBody.data
);
return allowed(res, userData, dontStripSession);
return allowed(
res,
forwardedUserData(resource, userData),
dontStripSession
);
}
logger.debug(
@@ -951,7 +958,10 @@ export async function verifyResourceSession(
return allowed(
res,
{ ...allowedUserData, dontStripSession },
forwardedUserData(resource, {
...allowedUserData,
dontStripSession
}),
dontStripSession
);
}
@@ -1158,6 +1168,19 @@ async function notAllowed(
return response<VerifyUserResponse>(res, data);
}
// Badger only sets the Remote-* identity headers for fields present in the
// response, so omitting the user data is enough to keep them off the upstream
// request. Some backends (e.g. embedded device web servers) reject requests
// carrying headers they don't recognize. Inference resources skip this since
// the AI gateway relies on those headers for attribution.
function forwardedUserData<T>(
resource: Resource,
userData: T | undefined
): T | undefined {
// Treat a missing value (older hybrid payloads) as enabled
return resource.forwardIdentityHeaders === false ? undefined : userData;
}
function allowed(
res: Response,
userData?: BasicUserData | EmailOnlyUserData,
@@ -1209,7 +1232,11 @@ async function allowAccessToken(
if (!tokenItem.persistSession) {
logAccessTokenAccessAudit(tokenItem, resource, userData, auditBody);
return allowed(res, userData, dontStripSession);
return allowed(
res,
forwardedUserData(resource, userData),
dontStripSession
);
}
const resourceSessionToken = extractResourceSessionToken(
@@ -1241,7 +1268,11 @@ async function allowAccessToken(
logger.debug(
"Resource allowed because existing access token session is valid"
);
return allowed(res, userData, dontStripSession);
return allowed(
res,
forwardedUserData(resource, userData),
dontStripSession
);
}
}
@@ -1274,7 +1305,7 @@ async function createAccessTokenSession(
);
res.appendHeader("Set-Cookie", cookie);
logger.debug("Access token is valid, creating new session");
return allowed(res, userData);
return allowed(res, forwardedUserData(resource, userData));
}
async function getAccessTokenUserData(