Разрешить Engine авторизацию в AI Workspace Hub

infra/synology/docker-compose.platform-http.yml

@@ -113,6 +113,7 @@ services:
       NODE_ENV: production
       PORT: 18081
       AI_WORKSPACE_HUB_TOKEN: ${AI_WORKSPACE_HUB_TOKEN:?ai workspace hub token required}
+      NODEDC_INTERNAL_ACCESS_TOKEN: ${NODEDC_INTERNAL_ACCESS_TOKEN:-}
       AI_WORKSPACE_HUB_WS_PATH: /api/ai-workspace/hub
     expose:
       - "18081"

services/ai-workspace-hub/src/server.mjs

@@ -23,7 +23,7 @@ app.get("/healthz", (_req, res) => {
     service: "nodedc-ai-workspace-hub",
     wsPath: config.wsPath,
     agentsOnline: Array.from(agentsByCode.values()).filter(isAgentOnline).length,
-    internalApiConfigured: Boolean(config.internalAccessToken),
+    internalApiConfigured: config.internalAccessTokens.length > 0,
   });
 });
 
@@ -352,13 +352,13 @@ function asyncRoute(handler) {
 }
 
 function requireInternalApi(req, res, next) {
-  if (!config.internalAccessToken) {
+  if (!config.internalAccessTokens.length) {
     res.status(503).json({ ok: false, error: "ai_workspace_hub_token_not_configured" });
     return;
   }
   const header = String(req.headers.authorization || "");
   const token = header.startsWith("Bearer ") ? header.slice(7) : "";
-  if (!token || !safeEqual(token, config.internalAccessToken)) {
+  if (!token || !config.internalAccessTokens.some((candidate) => safeEqual(token, candidate))) {
     res.status(401).json({ ok: false, error: "ai_workspace_hub_unauthorized" });
     return;
   }
@@ -372,10 +372,14 @@ function safeEqual(left, right) {
 }
 
 function readConfig() {
+  const internalAccessTokens = Array.from(new Set([
+    process.env.AI_WORKSPACE_HUB_TOKEN,
+    process.env.NODEDC_INTERNAL_ACCESS_TOKEN,
+  ].map((value) => cleanString(value, 1000)).filter(Boolean)));
   return {
     port: Number(process.env.PORT || 18081),
     wsPath: process.env.AI_WORKSPACE_HUB_WS_PATH || DEFAULT_WS_PATH,
-    internalAccessToken: process.env.AI_WORKSPACE_HUB_TOKEN || process.env.NODEDC_INTERNAL_ACCESS_TOKEN || "",
+    internalAccessTokens,
   };
 }