mirror of
https://github.com/open-jarvis/OpenJarvis.git
synced 2026-07-29 09:21:58 +00:00
4b4fd587b2
When `jarvis serve` runs with an API key configured, AuthMiddleware 401s every /v1 and /api request that lacks a Bearer token. The frontend never sent one, so telemetry, managed-agents, savings, etc. all failed (#266). - Add getApiKey() (reads settings.apiKey, with optional VITE_OPENJARVIS_API_KEY build-time override) and authHeaders() to api.ts, plus an apiFetch() wrapper that prepends getBase() and injects the Bearer header on every local-server call. Route all /v1 + /api fetches through it so none can omit auth. - Add `apiKey` to the Settings model (store.ts) and a password field in Settings → Connection so users can enter it. Keyless local servers are unaffected: with no key, no Authorization header is sent (byte-for-byte unchanged). The Supabase savings path keeps its own anon key — not conflated with the local key. Bootstraps vitest (no prior frontend test runner) + a `test` script, and adds api.auth.test.ts covering getApiKey/authHeaders. Verified: tsc --noEmit clean, vitest 6/6, vite build succeeds. Deferred (not in scope): WebSocket auth (browsers can't set WS headers) and Tauri auto-injecting a generated key. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>