mirror of
https://github.com/HeyPuter/puter.git
synced 2026-09-11 15:55:44 +00:00
Daniel Salazar
5065bcbf0a
The JSDoc claimed non-app actors are rejected; they are passed through, and the check reads `actor.app` rather than `effectiveApp`, so an app in the token chain is invisible to it. Callers depend on the pass-through — routes combining `adminOnly` + `allowedAppIds` are reached with an admin's browser session, and the dev-account surface is called from the desktop's own session — so the docs are corrected instead of the behavior, on the gate and on the `allowedAppIds` route option. Tests cover the gate per actor shape (user session, worker, full-access token, app-issued access token, app-under-user allowed/disallowed) and the admin composition.