Wire up Eco web auth so the FastAPI app doesn't have to read SQLite directly #25

New issue

Closed

opened 2026-06-17 07:29:38 +00:00 by coilysiren · 1 comment

coilysiren commented

2026-06-17 07:29:38 +00:00

Owner

Originally filed by @coilysiren on 2026-05-18T06:45:40Z

Problem

The mod registers GET /api/v1/events and GET /api/v1/events/stats ASP.NET controllers, but Eco's web server on :3001 returns 401 for every probe (X-API-Key, Authorization: Bearer, raw token, etc.) using /eco/server-api-token. That token is a StrangeCloud user JWT, not an admin web token.

The Python web app sidesteps this by reading the SQLite file directly via ECO_REPLAY_DB.

Next steps

Figure out what auth eco-jobs-tracker actually uses in prod (it has the same problem — its UPSTREAM_URL hits the same web port).
If it's a session cookie from /login, document the credential path.
If it's a header that eco-spec-tracker sets via secret env var, document the SSM key.
Direct SQLite read is fine for kai-server-local deploys but won't work when the web app is on a different host.

Migrated from coilyco-flight-deck/eco-replay#5 during the eco repo consolidation (coilysiren/inbox#100).

_Originally filed by @coilysiren on 2026-05-18T06:45:40Z_ **Problem** The mod registers `GET /api/v1/events` and `GET /api/v1/events/stats` ASP.NET controllers, but Eco's web server on :3001 returns 401 for every probe (`X-API-Key`, `Authorization: Bearer`, raw token, etc.) using `/eco/server-api-token`. That token is a StrangeCloud user JWT, not an admin web token. The Python web app sidesteps this by reading the SQLite file directly via `ECO_REPLAY_DB`. **Next steps** - Figure out what auth eco-jobs-tracker actually uses in prod (it has the same problem — its UPSTREAM_URL hits the same web port). - If it's a session cookie from `/login`, document the credential path. - If it's a header that eco-spec-tracker sets via secret env var, document the SSM key. - Direct SQLite read is fine for kai-server-local deploys but won't work when the web app is on a different host. --- _Migrated from coilyco-flight-deck/eco-replay#5 during the eco repo consolidation (coilysiren/inbox#100)._

coilysiren added the

label

2026-06-17 07:29:38 +00:00

coilysiren commented

2026-06-17 08:20:39 +00:00

Author

Owner

Backlog burndown 2026-06-17: closing low-priority (P3/P4) to bring the open count to a manageable level. Nothing lost — reopen if this resurfaces. Batch tag: burndown-2026-06.

Backlog burndown 2026-06-17: closing low-priority (P3/P4) to bring the open count to a manageable level. Nothing lost — reopen if this resurfaces. Batch tag: `burndown-2026-06`.

coilysiren

2026-06-17 08:20:39 +00:00