Fix scoped JWTs#679

Open

Rajat-Ahuja1997 wants to merge 1 commit into

mainfrom

Commits on May 13, 2026

Peer- and session-scoped JWTs were effectively workspace-scoped: auth() walked the route's declared scope and fell through to a workspace match, so a {w: ws-a, p: alice} token could act on any peer…
Rajat-Ahuja1997
committed