Skip to content

bug(backend): Docker deployment API endpoints missing authentication — unauthenticated callers can trigger/cancel deployments #3423

@mrveiss

Description

@mrveiss

Discovered During

Code review of PR #3416.

Problem

All 7 new endpoints in autobot-backend/api/slm/deployments.py have no authentication dependency. Every other sensitive API uses Depends(get_current_user) from auth_middleware, but the new deployment routes do not — any unauthenticated caller can trigger, cancel, or roll back Docker deployments.

Fix

Add current_user: dict = Depends(get_current_user) to each route handler, or as a router-level dependency:

router = APIRouter(dependencies=[Depends(get_current_user)])

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions