19 lines
771 B
Diff
19 lines
771 B
Diff
diff --git a/backend/app/utils/security.py b/backend/app/utils/security.py
|
|
index a78c1cb..75e7349 100644
|
|
--- a/backend/app/utils/security.py
|
|
+++ b/backend/app/utils/security.py
|
|
@@ -7,7 +7,13 @@ def get_actor(request: Request) -> str | None:
|
|
|
|
This is the reserved placeholder from the contract — no authentication
|
|
or authorization is enforced yet.
|
|
+
|
|
+ Services acting on behalf of a user (the Bale bot) pass ``X-Actor-Id``
|
|
+ (users.id); it wins over the raw token so the audit trail shows the human.
|
|
"""
|
|
+ actor_id = request.headers.get("X-Actor-Id")
|
|
+ if actor_id:
|
|
+ return actor_id.strip()
|
|
auth = request.headers.get("Authorization")
|
|
if auth and auth.lower().startswith("bearer "):
|
|
return auth[7:].strip() or None
|