From 708675803f20be84e49b7417c5089bca5d3b3e17 Mon Sep 17 00:00:00 2001 From: rcourtman Date: Wed, 19 Nov 2025 14:35:22 +0000 Subject: [PATCH] fix(setup): use runtime AUTH_TOKEN variable for Authorization headers MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Changed Authorization headers in ssh-config and verify-temperature-ssh API calls to use the runtime $AUTH_TOKEN variable instead of compile-time hardcoded authToken. This fixes a bug where users who override the auth token via: - PULSE_SETUP_TOKEN environment variable - Interactive prompt (when auth_token URL param omitted) ...would still send an empty Bearer token in the Authorization headers, causing API calls to fail with 401 Unauthorized. Changes: - Line 4748: -H "Authorization: Bearer %s" → -H "Authorization: Bearer $AUTH_TOKEN" - Line 4937: -H "Authorization: Bearer %s" → -H "Authorization: Bearer $AUTH_TOKEN" - Removed 2 authToken arguments from fmt.Sprintf (lines 5059) Now the script respects runtime token overrides in all code paths. Identified by Codex during fmt.Sprintf argument alignment review. --- internal/api/config_handlers.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/internal/api/config_handlers.go b/internal/api/config_handlers.go index 4716bf4..9faa80b 100644 --- a/internal/api/config_handlers.go +++ b/internal/api/config_handlers.go @@ -4745,7 +4745,7 @@ Host ${NODE} # This will be written to /home/pulse/.ssh/config inside the container echo "$SSH_CONFIG" | curl -s -X POST "%s/api/system/ssh-config" \ -H "Content-Type: text/plain" \ - -H "Authorization: Bearer %s" \ + -H "Authorization: Bearer $AUTH_TOKEN" \ --data-binary @- > /dev/null 2>&1 if [ $? -eq 0 ]; then @@ -4934,7 +4934,7 @@ EOF VERIFY_RESPONSE=$(curl -s -X POST "%s/api/system/verify-temperature-ssh" \ -H "Content-Type: application/json" \ - -H "Authorization: Bearer %s" \ + -H "Authorization: Bearer $AUTH_TOKEN" \ -d "{\"nodes\": \"$CONFIGURED_NODES\"}" 2>/dev/null || echo "") if [ -n "$VERIFY_RESPONSE" ]; then @@ -5056,7 +5056,7 @@ fi tokenName, tokenName, tokenName, tokenName, tokenName, tokenName, authToken, pulseURL, serverHost, tokenName, tokenName, storagePerms, sshKeys.ProxyPublicKey, sshKeys.SensorsPublicKey, minProxyReadyVersion, - pulseURL, pulseURL, pulseURL, pulseURL, pulseURL, pulseURL, pulseURL, pulseURL, pulseURL, pulseURL, pulseURL, pulseURL, pulseURL, pulseURL, authToken, pulseURL, authToken, pulseURL, tokenName) + pulseURL, pulseURL, pulseURL, pulseURL, pulseURL, pulseURL, pulseURL, pulseURL, pulseURL, pulseURL, pulseURL, pulseURL, pulseURL, pulseURL, pulseURL, pulseURL, tokenName) } else { // PBS script = fmt.Sprintf(`#!/bin/bash