mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-11-12 23:31:02 +00:00
Maurice
eae74c5605
Every visitor of a demo instance signs in as the same account, so one visitor's API key, MCP token, OAuth client, passkey or new email address became everybody's. These writes now answer 403 for the demo account through refuseForDemoAccount in demo-write.ts: creating API keys, creating and deleting MCP tokens, registering, rotating and deleting OAuth clients, approving an app and ending a connected app, changing the name, address or picture, and enrolling, renaming or deleting passkeys. Password, 2FA, account deletion, sessions and the own AI connection were refused already. The demo account's language is fixed to English: a single settings write of the language answers unchanged, a bulk save drops it and keeps the rest. The MCP settings tool is held back for the demo account by the tool gate, as every write tool is. The admin of a demo instance and every real instance are untouched.