From 58d43af3e62d809fcf68e807ec12c46342d6872e Mon Sep 17 00:00:00 2001 From: Hare Date: Thu, 24 Sep 2026 18:37:11 +0900 Subject: [PATCH] fix: align runtime attachment authorization --- crates/worker-runtime/src/http_server.rs | 4 ++++ crates/workspace-server/src/hosts.rs | 13 ++++++++++++- 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/crates/worker-runtime/src/http_server.rs b/crates/worker-runtime/src/http_server.rs index 1ffdae919..27a41fef0 100644 --- a/crates/worker-runtime/src/http_server.rs +++ b/crates/worker-runtime/src/http_server.rs @@ -3013,6 +3013,10 @@ mod tests { ), Some("workers:input") ); + assert_eq!( + required_runtime_permission(&Method::POST, "/v1/workers/7/workdir-attachments"), + Some("workers:input") + ); } fn test_bundle(profile: ProfileSelector) -> ConfigBundle { diff --git a/crates/workspace-server/src/hosts.rs b/crates/workspace-server/src/hosts.rs index 1629f73c7..31950aba9 100644 --- a/crates/workspace-server/src/hosts.rs +++ b/crates/workspace-server/src/hosts.rs @@ -3569,7 +3569,11 @@ fn workspace_runtime_operation(method: &str, path_and_query: &str) -> &'static s if path.ends_with("/workspace-api") { return "workers:create"; } - if path.ends_with("/input") || path.ends_with("/restore") || path.contains("/attachments") { + if path.ends_with("/input") + || path.ends_with("/restore") + || path.contains("/attachments") + || path.contains("/workdir-attachments") + { return "workers:input"; } if path.ends_with("/stop") || path.ends_with("/cancel") { @@ -7300,6 +7304,13 @@ mod tests { workspace_runtime_operation("GET", &format!("/v1/workers/{worker_id}/protocol/ws")), "workers:protocol" ); + assert_eq!( + workspace_runtime_operation( + "POST", + &format!("/v1/workers/{worker_id}/workdir-attachments") + ), + "workers:input" + ); assert_eq!( workspace_runtime_operation("POST", SSH_HOST_KEY_PROBE_PATH), SSH_HOST_KEY_PROBE_OPERATION