From 3f8ae4414912aca901c71a99bb325681c7e70e26 Mon Sep 17 00:00:00 2001 From: "2569718930@qq.com" <2569718930@qq.com> Date: Mon, 15 Jun 2026 18:17:38 +0800 Subject: [PATCH] Accept entitlement token as service bearer --- tests/test_web_observability.py | 25 +++++++++++++++++++++++++ web/core.py | 3 ++- 2 files changed, 27 insertions(+), 1 deletion(-) diff --git a/tests/test_web_observability.py b/tests/test_web_observability.py index 2d0ca13a..936bea6d 100644 --- a/tests/test_web_observability.py +++ b/tests/test_web_observability.py @@ -3050,6 +3050,31 @@ def test_backend_entitlement_token_without_forwarded_identity_validates_bearer(m assert request.state.auth_email == "user@example.com" +def test_backend_entitlement_token_accepts_service_bearer(monkeypatch): + monkeypatch.setattr(web_core.SUPABASE_ENTITLEMENT, "enabled", True) + monkeypatch.setattr(web_core.SUPABASE_ENTITLEMENT, "supabase_url", "https://example.supabase.co") + monkeypatch.setattr(web_core.SUPABASE_ENTITLEMENT, "anon_key", "anon-key") + monkeypatch.setattr(web_core, "_SUPABASE_AUTH_REQUIRED", True) + monkeypatch.setattr(web_core, "_ENTITLEMENT_TOKEN", "backend-token") + + def _get_identity(_token): + raise AssertionError("service bearer token must not be treated as a Supabase access token") + + monkeypatch.setattr(web_core.SUPABASE_ENTITLEMENT, "get_identity", _get_identity) + + request = Request( + { + "type": "http", + "headers": [ + (b"x-polyweather-entitlement", b"backend-token"), + (b"authorization", b"Bearer backend-token"), + ], + } + ) + + web_core._assert_entitlement(request) + + def test_ops_memberships_prefers_supabase_auth_email(monkeypatch): monkeypatch.setattr(routes, "_assert_entitlement", lambda request: None) monkeypatch.setattr(routes, "_require_ops_admin", lambda request: None) diff --git a/web/core.py b/web/core.py index cfdb6396..a02cb47f 100644 --- a/web/core.py +++ b/web/core.py @@ -305,7 +305,8 @@ def _assert_entitlement(request: Request) -> None: if _legacy_service_token_valid(request): if _bind_forwarded_supabase_identity(request): return - if not extract_bearer_token(request.headers.get("authorization")): + bearer_token = extract_bearer_token(request.headers.get("authorization")) + if not bearer_token or bearer_token == _ENTITLEMENT_TOKEN: return if not _SUPABASE_AUTH_REQUIRED: _bind_optional_supabase_identity(request)