1

server-rs/crates/api-server/src/auth.rs

@@ -191,6 +191,7 @@ fn allows_internal_forwarded_auth(path: &str) -> bool {
     // Node 代理已经完成平台账号 JWT 校验，Rust 运行时只信任这些明确的内部转发路径。
     path.starts_with("/api/runtime/big-fish/")
         || path.starts_with("/api/runtime/chat/")
+        || path.starts_with("/api/runtime/creative-agent/")
         || path.starts_with("/api/runtime/puzzle/")
 }
 
@@ -287,6 +288,9 @@ mod tests {
         assert!(allows_internal_forwarded_auth(
             "/api/runtime/chat/npc/turn/stream"
         ));
+        assert!(allows_internal_forwarded_auth(
+            "/api/runtime/creative-agent/sessions"
+        ));
         assert!(allows_internal_forwarded_auth("/api/runtime/puzzle/works"));
         assert!(!allows_internal_forwarded_auth("/api/auth/me"));
     }