From c10aa7c3013fafd550d3b1a7bafd6e1418057f7e Mon Sep 17 00:00:00 2001
From: Codex <codex@nodedc.local>
Date: Sat, 30 May 2026 13:44:31 +0300
Subject: [PATCH] =?UTF-8?q?=D0=A0=D0=B0=D0=B7=D1=80=D0=B5=D1=88=D0=B8?=
 =?UTF-8?q?=D1=82=D1=8C=20Engine=20=D0=B0=D0=B2=D1=82=D0=BE=D1=80=D0=B8?=
 =?UTF-8?q?=D0=B7=D0=B0=D1=86=D0=B8=D1=8E=20=D0=B2=20AI=20Workspace=20Hub?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 infra/synology/docker-compose.platform-http.yml |  1 +
 services/ai-workspace-hub/src/server.mjs        | 12 ++++++++----
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/infra/synology/docker-compose.platform-http.yml b/infra/synology/docker-compose.platform-http.yml
index 56ccc05..dc78da6 100644
--- a/infra/synology/docker-compose.platform-http.yml
+++ b/infra/synology/docker-compose.platform-http.yml
@@ -113,6 +113,7 @@ services:
       NODE_ENV: production
       PORT: 18081
       AI_WORKSPACE_HUB_TOKEN: ${AI_WORKSPACE_HUB_TOKEN:?ai workspace hub token required}
+      NODEDC_INTERNAL_ACCESS_TOKEN: ${NODEDC_INTERNAL_ACCESS_TOKEN:-}
       AI_WORKSPACE_HUB_WS_PATH: /api/ai-workspace/hub
     expose:
       - "18081"
diff --git a/services/ai-workspace-hub/src/server.mjs b/services/ai-workspace-hub/src/server.mjs
index b0c0cd6..aecd910 100644
--- a/services/ai-workspace-hub/src/server.mjs
+++ b/services/ai-workspace-hub/src/server.mjs
@@ -23,7 +23,7 @@ app.get("/healthz", (_req, res) => {
     service: "nodedc-ai-workspace-hub",
     wsPath: config.wsPath,
     agentsOnline: Array.from(agentsByCode.values()).filter(isAgentOnline).length,
-    internalApiConfigured: Boolean(config.internalAccessToken),
+    internalApiConfigured: config.internalAccessTokens.length > 0,
   });
 });
 
@@ -352,13 +352,13 @@ function asyncRoute(handler) {
 }
 
 function requireInternalApi(req, res, next) {
-  if (!config.internalAccessToken) {
+  if (!config.internalAccessTokens.length) {
     res.status(503).json({ ok: false, error: "ai_workspace_hub_token_not_configured" });
     return;
   }
   const header = String(req.headers.authorization || "");
   const token = header.startsWith("Bearer ") ? header.slice(7) : "";
-  if (!token || !safeEqual(token, config.internalAccessToken)) {
+  if (!token || !config.internalAccessTokens.some((candidate) => safeEqual(token, candidate))) {
     res.status(401).json({ ok: false, error: "ai_workspace_hub_unauthorized" });
     return;
   }
@@ -372,10 +372,14 @@ function safeEqual(left, right) {
 }
 
 function readConfig() {
+  const internalAccessTokens = Array.from(new Set([
+    process.env.AI_WORKSPACE_HUB_TOKEN,
+    process.env.NODEDC_INTERNAL_ACCESS_TOKEN,
+  ].map((value) => cleanString(value, 1000)).filter(Boolean)));
   return {
     port: Number(process.env.PORT || 18081),
     wsPath: process.env.AI_WORKSPACE_HUB_WS_PATH || DEFAULT_WS_PATH,
-    internalAccessToken: process.env.AI_WORKSPACE_HUB_TOKEN || process.env.NODEDC_INTERNAL_ACCESS_TOKEN || "",
+    internalAccessTokens,
   };
 }