mirror of
https://github.com/HeyPuter/puter.git
synced 2026-10-03 02:18:06 +00:00
Daniel Salazar
4c3c684cb4
* fix: new cache costs for claude * fix: refuse app-issued scoped tokens on events handler and worker routes An access token an app mints (e.g. a getReadURL() token) resolves effectiveApp to the issuing app, so #handlerApp and listEventsWorkers treated it as the app: it could publish, remove and list handlers, and list or destroy the app's worker, regardless of its permission manifest. Refuse any scoped token there, as the kv-handle routes already do. * test: freeze the clock before the first backoff read in workerInvoker The first hold was read on real time, so a slow run measured the 2s backoff as 1s.