diff options
| author | Christophe Besson <cbesson@gmail.com> | 2026-09-30 21:04:39 +0200 |
|---|---|---|
| committer | Christophe Besson <cbesson@gmail.com> | 2026-09-30 21:04:39 +0200 |
| commit | 0ed56d3a1b4f71cf622d3e27edc87a15ef33c185 (patch) | |
| tree | d53579b0791112483560517399736388733df305 /docs/playlists.md | |
| parent | d692db441680eef8969573047cf5da00cfb61362 (diff) | |
| download | meshbay-0ed56d3a1b4f71cf622d3e27edc87a15ef33c185.tar.gz | |
fix(hub): the pepper and a device key take the passphrase, not a token
POST /me/bundle-pepper (was GET) and POST /users/devices require auth_key.
A refreshed or lifted token could otherwise fetch the pepper, or register a
device whose every sign-in carries it. Both callers have just been given the
passphrase.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Diffstat (limited to 'docs/playlists.md')
0 files changed, 0 insertions, 0 deletions