test(runtime): verify live same-origin canary

2026-07-18 15:45:57 +08:00
parent f89f393485
commit 3718c91706
7 changed files with 185 additions and 6 deletions
@@ -37,6 +37,10 @@ export function buildProductionControlPlane(
      db,
      store,
      upstream: options.upstream ?? createProductionUpstream(),
+      // This route-local decision is safe only in this composition: when a token is
+      // configured, buildApp's global onRequest hook rejects the request first.
+      // Keep all other control-plane compositions fail-closed by default.
+      ...(options.gatewayToken ? { authenticateEventStream: () => true } : {}),
      app: {
        logger: {},
        ...(options.gatewayToken ? { gatewayToken: options.gatewayToken } : {}),