sync app filled in

apps/server/internal/httpserver/middleware.go

@@ -104,8 +104,19 @@ func isSetupAllowedPath(path string) bool {
 }
 
 func (s *Server) authenticateRequest(r *http.Request) (auth.Principal, bool) {
+	var token string
 	if header := r.Header.Get("Authorization"); strings.HasPrefix(header, "Bearer ") {
-		principal, err := s.auth.ValidateBearerToken(r.Context(), strings.TrimSpace(strings.TrimPrefix(header, "Bearer ")))
+		token = strings.TrimSpace(strings.TrimPrefix(header, "Bearer "))
+	} else if r.URL.Path == "/ws" {
+		token = r.URL.Query().Get("token")
+	}
+
+	if token != "" {
+		if s.config.DevMode && token == "dev" {
+			principal, err := s.auth.PrincipalForUser(r.Context(), s.devUserID)
+			return principal, err == nil
+		}
+		principal, err := s.auth.ValidateBearerToken(r.Context(), token)
 		if err == nil {
 			return principal, true
 		}