coilyco-gaming/eco-app
Watch
2
0
Code Issues 22 Pull requests Projects Releases Packages 1 Wiki Activity Actions

Wire up Eco web auth so the FastAPI app doesn't have to read SQLite directly #25

New issue
Closed
opened 2026-06-17 07:29:38 +00:00 by coilysiren · 1 comment
coilysiren commented 2026-06-17 07:29:38 +00:00
Owner
Copy link

Originally filed by @coilysiren on 2026-05-18T06:45:40Z

Problem

The mod registers GET /api/v1/events and GET /api/v1/events/stats ASP.NET controllers, but Eco's web server on :3001 returns 401 for every probe (X-API-Key, Authorization: Bearer, raw token, etc.) using /eco/server-api-token. That token is a StrangeCloud user JWT, not an admin web token.

The Python web app sidesteps this by reading the SQLite file directly via ECO_REPLAY_DB.

Next steps

  • Figure out what auth eco-jobs-tracker actually uses in prod (it has the same problem — its UPSTREAM_URL hits the same web port).
  • If it's a session cookie from /login, document the credential path.
  • If it's a header that eco-spec-tracker sets via secret env var, document the SSM key.
  • Direct SQLite read is fine for kai-server-local deploys but won't work when the web app is on a different host.

Migrated from coilyco-flight-deck/eco-replay#5 during the eco repo consolidation (coilysiren/inbox#100).

_Originally filed by @coilysiren on 2026-05-18T06:45:40Z_ **Problem** The mod registers `GET /api/v1/events` and `GET /api/v1/events/stats` ASP.NET controllers, but Eco's web server on :3001 returns 401 for every probe (`X-API-Key`, `Authorization: Bearer`, raw token, etc.) using `/eco/server-api-token`. That token is a StrangeCloud user JWT, not an admin web token. The Python web app sidesteps this by reading the SQLite file directly via `ECO_REPLAY_DB`. **Next steps** - Figure out what auth eco-jobs-tracker actually uses in prod (it has the same problem — its UPSTREAM_URL hits the same web port). - If it's a session cookie from `/login`, document the credential path. - If it's a header that eco-spec-tracker sets via secret env var, document the SSM key. - Direct SQLite read is fine for kai-server-local deploys but won't work when the web app is on a different host. --- _Migrated from coilyco-flight-deck/eco-replay#5 during the eco repo consolidation (coilysiren/inbox#100)._
coilysiren commented 2026-06-17 08:20:39 +00:00
Author
Owner
Copy link

Backlog burndown 2026-06-17: closing low-priority (P3/P4) to bring the open count to a manageable level. Nothing lost — reopen if this resurfaces. Batch tag: burndown-2026-06.

Backlog burndown 2026-06-17: closing low-priority (P3/P4) to bring the open count to a manageable level. Nothing lost — reopen if this resurfaces. Batch tag: `burndown-2026-06`.
coilysiren 2026-06-17 08:20:39 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
aos/claude/bk79-eco-pr-ci
aos/claude/bk79-eco-instructions
aos/claude/mg96-fm
aos/claude/mg96
feat/autogen-recipe-index
recovery/2026-07-27-local-work
ward-salvage/eco-app-84ad1890
ward-salvage/eco-app-b3384b9b
ward-salvage/eco-app-0c6e4df2
ward-salvage/eco-app-b8207ef3
ward-salvage/eco-app-a58b14ad
No results found.
Labels
Clear labels   
burndown-2026-06
Backlog burndown June 2026

  
burndown-2026-08
Closed in the 2026-08-26 backlog burn-down. Reopen freely: state:closed label:burndown-2026-08 recovers the whole set.

  
headless
Safe for autonomous warded engineer carry

  
autonomy
async-consult
 A human needs to consult on the issue to upgrade it to headless

  
autonomy
epic
 This issue has many units of sub work - its size makes it meaningfully exclusive with other autonomy types

  
autonomy
headless
 The agent can perform the work on its own

  
autonomy
live-collab
 The agent and the human need to work together in realtime

  
c#
Requires C# work, flagged b/c it requires a Eco server restart

  
priority
P0
 priority tier

  
priority
P1
 priority tier

  
priority
P2
 priority tier

  
priority
P3
 priority tier

  
priority
P4
 priority tier

  
role/advocate
requires work from the Developer Advocate seat

  
role/director
requires work from the Portfolio Director seat

  
role/exec
requires work from the exec role

  
role/frontend
requires work from the Frontend Engineer seat

  
role/gamedev
requires work from the Game Developer seat

  
role/human
requires a person, and specifically not an agent seat

  
role/platform
requires work from the Platform Engineer seat

  
role/qa
requires work from the QA role

  
role/science
requires work from the Applied Scientist seat

  
role/sysadmin
requires work from the Systems Administrator seat

  
state
ambient
 ambient and ephemeral work, held as a maintained document rather than a queue

No labels
burndown-2026-06
burndown-2026-08
headless
autonomy
async-consult
autonomy
epic
autonomy
headless
autonomy
live-collab
c#
priority
P0
priority
P1
priority
P2
priority
P3
priority
P4
role/advocate
role/director
role/exec
role/frontend
role/gamedev
role/human
role/platform
role/qa
role/science
role/sysadmin
state
ambient
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
coilyco-gaming/eco-app#25
No description provided.