Harden remote API security boundaries

2026-06-12 18:24:07 +03:00
parent c281937406
commit 106b31a407
52 changed files with 1582 additions and 579 deletions
@@ -51,18 +51,6 @@ export const createBootstrapRuntime = (dependencies) => {
      setAutoAcceptSession,
    } = options;

-    registerServerStatusRoutes(app, {
-      express,
-      process,
-      openchamberVersion,
-      runtimeName,
-      serverStartedAt,
-      gracefulShutdown,
-      getHealthSnapshot,
-    });
-
-    registerCommonRequestMiddleware(app, { express, verboseRequestLogs });
-
    const uiAuthController = createUiAuth({
      password: uiPassword,
      readSettingsFromDiskMigrated,
@@ -72,6 +60,20 @@ export const createBootstrapRuntime = (dependencies) => {
      console.log('UI password protection enabled for browser sessions');
    }

+    registerServerStatusRoutes(app, {
+      express,
+      process,
+      openchamberVersion,
+      runtimeName,
+      serverStartedAt,
+      gracefulShutdown,
+      getHealthSnapshot,
+      tunnelAuthController,
+      uiAuthController,
+    });
+
+    registerCommonRequestMiddleware(app, { express, verboseRequestLogs });
+
    registerAuthAndAccessRoutes(app, {
      express,
      tunnelAuthController,