BUG-0767project-08高已修复backend-auth

security audit - add @require_token to /api/status, /api/tasks, /api/tasks/<id> - These 3 read-only APIs leaked domain inventory + task history without auth - Updated test_dogfood S7: status/tasks now require token, health/ready still anon (k8s probe) - A

发现：2026-10-09验证：2026-10-27置信度：70%

症状

commit a171cb7803da (2026-09-12) fix: security audit - add @require_token to /api/status, /api/tasks, /api/tasks/<id> - These 3 read-only APIs leaked domain inventory + task history without auth - Updated test_dogfood S7: status/task

根因

commit message 描述: fix: security audit - add @require_token to /api/status, /api/tasks, /api/tasks/<id> - These 3 read-only APIs leaked domain inventory + task history without auth - Updated test_dogfood S7: status/task

修复方案

修复 286 行，删除 2 行。改动文件: omnicert/app.py, scripts/test_e2e_acceptance.py, tests/test_dogfood.py

错误签名

fix: security audit - add @require_token to /api/status, /api/tasks, /api/tasks/<id> - These 3 read-only APIs leaked domain inventory + task history without auth - Updated test_dogfood S7: status/tasks now require token, health/ready still anon (k8s probe) - Add scripts/test_e2e_acceptance.py: 73 tests, 7 categories - Dashboard render (15), System APIs (10), Auth (6), Core API (12), Token CRUD (7), Token Rotate (5), Webhook sign (5) - E2E test fixes: JS function match 'func(' not 'func()', token

技术信息

来源项目

project-08

涉及文件

omnicert/app.py, scripts/test_e2e_acceptance.py, tests/test_dogfood.py

标签

git-sweep, auto-ingested, project-08, mcp-reported, source-agent