From 80cab8454e1b2127f3f9bcc42cbb4684f6151862 Mon Sep 17 00:00:00 2001
From: Tyler Gillispie <mrteye@gmail.com>
Date: Mon, 24 Aug 2026 23:29:39 -0700
Subject: [PATCH] feat(api): support Authorization: Bearer <session_id> in
 addition to Cookie headers for agent queries

---
 server/auth-session.ts | 24 ++++++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

diff --git a/server/auth-session.ts b/server/auth-session.ts
index cd8682e..c626ed5 100644
--- a/server/auth-session.ts
+++ b/server/auth-session.ts
@@ -49,11 +49,27 @@ export function getCookieDomain(customRpId?: string): string | undefined {
  * Necessary because Chromium Android can send both a host-only and a wildcard cookie simultaneously.
  */
 export function extractAllSessionIds(c: Context): string[] {
+  const candidates: string[] = [];
+
+  // 1. Check Authorization: Bearer <token>
+  const authHeader = c.req.header("authorization") || "";
+  if (authHeader.startsWith("Bearer ")) {
+    const bearerToken = authHeader.substring(7).trim();
+    if (bearerToken) candidates.push(bearerToken);
+  }
+
+  // 2. Check Cookie header
   const cookieHeader = c.req.header("cookie") || "";
-  if (!cookieHeader) return [];
-  return [...cookieHeader.matchAll(/(?:^|;\s*)session_id=([^;]+)/g)]
-    .map((m) => decodeURIComponent(m[1].trim()))
-    .filter(Boolean);
+  if (cookieHeader) {
+    const cookieMatches = [
+      ...cookieHeader.matchAll(/(?:^|;\s*)session_id=([^;]+)/g),
+    ]
+      .map((m) => decodeURIComponent(m[1].trim()))
+      .filter(Boolean);
+    candidates.push(...cookieMatches);
+  }
+
+  return candidates;
 }
 
 export async function getAuthenticatedUser(