David/kanban-dev-webapp
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs(agent-api): unset AGENT_API_TOKEN is 500 not 401; note Coolify deploy step

Browse source 
The design spec said an unset token gets a 401 like a missing/wrong one;
the implementation (and the plan's own Definition of Done) has always
treated unset/misconfigured as 500, matching CRON_SECRET's own behavior.
Also extends the .env.example comment to spell out that this same value
must be set in Coolify's environment too, not just .env.local — this app
has no local PocketBase, so the token is checked against process.env on
whichever environment actually receives the request.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Dave 2026-09-26 10:23:37 +02:00
parent 0f2ce3fed8
commit 1b06549c91
2 changed files with 11 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
.env.example
View file

@ -21,4 +21,10 @@ PB_SUPERUSER_PASSWORD=replace-me
# openssl rand -hex 32
# Anyone holding this can read every project and write comments/subtasks/
# moves as the owner — treat it like the superuser credentials above.
# This app has no local PocketBase — it always runs against the hosted
# Coolify instance — so this same value must ALSO be set in the deployed
# app's own environment variables in Coolify, not just in .env.local. The
# token is checked against process.env at request time on whichever
# environment is actually handling the request, so setting it in only one
# place leaves the other refusing every request with 500.
AGENT_API_TOKEN=replace-me

7
docs/superpowers/specs/2026-09-25-phase-8-agent-api-design.md
View file

@ -52,8 +52,11 @@ Authorization: Bearer <AGENT_API_TOKEN>
This is the exact pattern already used by `/api/cron/reconcile` (`CRON_SECRET`)
— nothing new is being introduced to this codebase's security model, just a
second secret of the same kind for a second machine caller. A request with
no token, a wrong token, or the token unset in the environment gets a 401
without touching PocketBase.
no token or a wrong token gets a 401. If `AGENT_API_TOKEN` itself is unset,
too weak (shorter than 32 characters), or still the literal placeholder
`replace-me`, every request gets a 500 without touching PocketBase — the
route is treated as not configured at all, matching `CRON_SECRET`'s own
behavior for the same case.
This is a full owner-equivalent credential. Anyone holding it can read every
client's board and post/move/comment as the owner. It must be treated with