feat(auth): query-string token for headerless webhook senders

src/beaver_gateway/frontends/_auth.py

@@ -25,20 +25,24 @@ async def require_token(
 ) -> str:
     """Verify the request's bearer + scope, return the token's audit name.
 
-    Accepts both ``X-Api-Key: <token>`` (Anthropic SDK / LibreChat) and
-    ``Authorization: Bearer <token>`` (curl, Cursor). 401 on missing /
+    Accepts ``X-Api-Key: <token>`` (Anthropic SDK / LibreChat),
+    ``Authorization: Bearer <token>`` (curl, Cursor) and, when neither
+    header is present, ``?token=<token>`` (Komodo alerters). 401 on missing /
     unknown token; 403 on a known token whose scope doesn't cover
     ``scope``. Bootstrap tokens implicitly carry ``"*"`` and pass every
     scope check.
     """
     api_key = request.headers.get("x-api-key")
-    identity = (
-        await runtime.token_store.verify(api_key)
-        if api_key
-        else await runtime.token_store.verify_bearer(
-            request.headers.get("authorization")
-        )
-    )
+    authorization = request.headers.get("authorization")
+    if api_key:
+        identity = await runtime.token_store.verify(api_key)
+    elif authorization:
+        identity = await runtime.token_store.verify_bearer(authorization)
+    else:
+        # Webhook senders that cannot set headers (Komodo alerters) put the
+        # token in the query string; the URL is not logged with it.
+        qs_token = request.query_params.get("token")
+        identity = await runtime.token_store.verify(qs_token) if qs_token else None
     if identity is None:
         raise HTTPException(
             status.HTTP_401_UNAUTHORIZED,