bjoernpoettker/paperlessmanager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Freigabe → main: Mobile UI, Webhook, IMAP, Zahlung-Workflow und weitere Features #5

Merged
bjoernpoettker merged 16 commits from Freigabe into main 2026-07-14 07:44:32 +00:00
Conversation 0 Commits 16 Files Changed 59
+10 -3
1 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 156b0401b3 - Show all commits
paperless-backend/src/auth/api-key.guard.ts
+9 -2
View File
@@ -28,14 +28,21 @@ export class ApiKeyGuard implements CanActivate {
if (apiKey) source = 'apiKey query param'; if (apiKey) source = 'apiKey query param';
} }
// Fallback to Authorization: Bearer (used by SSE clients that can't set X-API-Key) // Fallback to Authorization: Bearer (used by SSE clients that can't set
// X-API-Key). Nur akzeptieren, wenn das Token wie ein API-Key aussieht
// (Präfix "pm_"). Ein (abgelaufenes) JWT als Bearer-Token wird hier ignoriert,
// statt es fälschlich als API-Key zu prüfen – das vermeidet die irreführende
// "Invalid API Key"-Warnung beim normalen JWT-Ablauf.
if (!apiKey) { if (!apiKey) {
const auth: string | undefined = request.headers['authorization']; const auth: string | undefined = request.headers['authorization'];
if (auth?.startsWith('Bearer ')) { if (auth?.startsWith('Bearer ')) {
apiKey = auth.slice(7); const token = auth.slice(7);
if (token.startsWith('pm_')) {
apiKey = token;
source = 'Authorization: Bearer'; source = 'Authorization: Bearer';
} }
} }
}
this.logger.log( this.logger.log(
`[${method} ${url}] key source: ${apiKey ? source : 'NONE'} | ` + `[${method} ${url}] key source: ${apiKey ? source : 'NONE'} | ` +