Repository navigation
rescued stash: mva-180-validate-run-jwt-aud-claim: b4dda9553 fix(security): enforce aud claim in validate #14096
Description
Child of #14078. The work is safe — it is now a branch on origin, not only a stash entry.
| Branch | rescued/stash-2026-05-12-f6fd80143 |
| Stash commit | f6fd80143ca533818110289a4e5e6775aca7e809 |
| Stashed | 2026-05-12 |
| Change | 7 files changed, 305 insertions(+), 350 deletions(-) |
| Applies to current base | CONFLICTED |
| Original context | mva-180-validate-run-jwt-aud-claim: b4dda95 fix(security): enforce aud claim in validate |
Files touched:
autobot-frontend/src/composables/useAuditApi.tsautobot-frontend/src/composables/useBatchProcessing.tsautobot-frontend/src/composables/useOperationsApi.tsautobot-frontend/src/composables/useProbeBackedHealth.tsautobot-frontend/src/composables/useSecretsAuditApi.tsautobot-frontend/src/composables/useServiceMessages.tsautobot-frontend/src/views/LLMApiKeysView.vue
Why this exists: the repo-wide stash stack held 113 entries spanning three months, unowned and
unlinked. This one's content is absent from Dev_new_gui — verified by git apply --check --3way
— so it is genuinely unfinished work, not a leftover of something that already landed.
Ask — a decision, not a deletion:
- Is this work still wanted? The original context above names where it came from (MVA-180 discovery(security): validate_run_jwt does not verify aud claim — heartbeat token accepted by any validator #7643 ).
- Wanted → rebase
rescued/stash-2026-05-12-f6fd80143ontoDev_new_gui, open a PR, land it. - Not wanted → say so here with the reason, then delete the branch. A recorded decision, never a
silent drop.
Note: this one does not apply cleanly to today's base — expect a real rebase, not a fast-forward.
Activity
mrveiss commentedon Aug 25, 2026
Disposition: LANDED
The stash migrates six composables off the deprecated
useApiWithState()from@/composables/useApionto
useApiClient()from@/plugins/api, withshowSubtleErrorNotificationfor error surfacing.Evidence
useApiClientpresentuseAuditApi.tsuseBatchProcessing.tsuseOperationsApi.tsuseProbeBackedHealth.tsuseSecretsAuditApi.tsshowSubtleErrorNotificationincludeduseServiceMessages.tsLanding commit:
89dc98b105— refactor(frontend): complete useApiWithState Group 3 composablesmigration (#7600), 2026-05-15, three days after this stash was taken. No file under
autobot-frontend/srcimportsuseApi/useApiWithStateany more.The seventh file,
src/views/LLMApiKeysView.vue, no longer exists at that path: it moved inf10ba88eb9feat(secrets): move LLM API Keys into the Secrets menu (#10488) (#10568) and is nowsrc/views/secrets/LlmApiKeysView.vue.Parent issues MVA-180 / #7643 are CLOSED.
Decision: landed.
rescued/stash-2026-05-12-f6fd80143is disposable; left in place — branchdeletion is a separate deliberate act.
Discovered while checking this — filed separately:
autobot-frontend/src/composables/useApi.tsstill exists and still exports
useApiWithState, with zero importers left insrc/. The #7600migration retired every call site but not the shim.
mrveiss commentedon Aug 25, 2026
Filed the leftover
useApi.tsshim noted above as #15025.