Problem
The PATCH handler validates Authorization: Bearer ${process.env.ARCHE_INTERNAL_TOKEN} — a single global token shared by every container. The slug is taken from the URL but the token is not bound to it. Related to issue #91 (closed, but the per-instance token design was never implemented).
Location
apps/web/src/app/api/instances/[slug]/activity/route.ts:33-49
Impact
Leakage of the one global token exposes every workspace's activity endpoint. There is no per-instance revocation.
Suggested fix
Implement issue #91: generate a per-instance token at start, store only its hash (Instance.internalTokenHash), inject the raw token into that container, and compare hashes in this route.
Source: code investigation.
Problem
The PATCH handler validates
Authorization: Bearer ${process.env.ARCHE_INTERNAL_TOKEN}— a single global token shared by every container. The slug is taken from the URL but the token is not bound to it. Related to issue #91 (closed, but the per-instance token design was never implemented).Location
apps/web/src/app/api/instances/[slug]/activity/route.ts:33-49Impact
Leakage of the one global token exposes every workspace's activity endpoint. There is no per-instance revocation.
Suggested fix
Implement issue #91: generate a per-instance token at start, store only its hash (
Instance.internalTokenHash), inject the raw token into that container, and compare hashes in this route.Source: code investigation.