fix: replace worker password with per-task JWT tokens#904

Merged

PythonFZ merged 17 commits intomainfrom

fix/worker-auth-jwt

Apr 2, 2026

Commits on Apr 1, 2026

docs: add design spec for worker auth JWT redesign

PythonFZ
and
claude
committed
docs: drop unnecessary register guard from worker auth spec

PythonFZ
and
claude
committed
docs: add implementation plan for worker auth JWT redesign

PythonFZ
and
claude
committed
refactor: replace worker_password with internal_worker_email in Settings
PythonFZ
committed
refactor: auto-gen worker password, add lookup_worker_user helper

PythonFZ
and
claude
committed
refactor: executor accepts per-task JWT token instead of static credentials

PythonFZ
and
claude
committed
feat: mint per-task JWT for internal worker via WorkerTokenDep

PythonFZ
and
claude
committed
refactor: simplify broker — executor only needs base_url
PythonFZ
committed
feat: block internal worker email from public login endpoint

PythonFZ
and
claude
committed
chore: remove all worker_password references from Docker and docs

PythonFZ
and
claude
committed
test: add integration test for WorkerTokenDep JWT minting

PythonFZ
and
claude
committed
[pre-commit.ci] auto fixes from pre-commit.com hooks
pre-commit-ci[bot]
committed
fix: resolve SQLite deadlock in WorkerTokenDep and harden test wiring

PythonFZ
and
claude
committed
fix: wire WorkerTokenDep stub in joblib test conftest

PythonFZ
and
claude
committed
refactor: simplify WorkerTokenDep — real dependency, drop login guard

PythonFZ
and
claude
committed
refactor: remove unused lookup_worker_user helper

PythonFZ
and
claude
committed
fix: ensure_internal_worker update path mirrors create flags

PythonFZ
and
claude
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: replace worker password with per-task JWT tokens#904

fix: replace worker password with per-task JWT tokens#904
PythonFZ merged 17 commits intomainfrom
fix/worker-auth-jwt

Commits on Apr 1, 2026

docs: add design spec for worker auth JWT redesign

docs: drop unnecessary register guard from worker auth spec

docs: add implementation plan for worker auth JWT redesign

refactor: replace worker_password with internal_worker_email in Settings

refactor: auto-gen worker password, add lookup_worker_user helper

refactor: executor accepts per-task JWT token instead of static credentials

feat: mint per-task JWT for internal worker via WorkerTokenDep

refactor: simplify broker — executor only needs base_url

feat: block internal worker email from public login endpoint

chore: remove all worker_password references from Docker and docs

test: add integration test for WorkerTokenDep JWT minting

[pre-commit.ci] auto fixes from pre-commit.com hooks

fix: resolve SQLite deadlock in WorkerTokenDep and harden test wiring

fix: wire WorkerTokenDep stub in joblib test conftest

refactor: simplify WorkerTokenDep — real dependency, drop login guard

refactor: remove unused lookup_worker_user helper

fix: ensure_internal_worker update path mirrors create flags