sync: 167 file da Baida98/AI@10cc1cf7 (2026-08-22 08:20 UTC) (#53)

- sync: 167 file da Baida98/AI@10cc1cf7 (2026-08-22 08:20 UTC) (e169361ac7aea85fe2f6b7e0a2891ee384c66f6c)

api/auth_guard.py

@@ -201,6 +201,7 @@ def _get_token(env_var: str) -> str:
 
 async def _resolve_role(
     x_internal_token: Optional[str] = Header(None, alias="X-Internal-Token"),
+    x_machine_token:   Optional[str] = Header(None, alias="X-Machine-Token"),
     x_operator_token:  Optional[str] = Header(None, alias="X-Operator-Token"),
     x_admin_token:     Optional[str] = Header(None, alias="X-Admin-Token"),
 ) -> AuthRole:
@@ -218,9 +219,11 @@ async def _resolve_role(
         logger.debug("auth: OPERATOR role granted")
         return AuthRole.OPERATOR
 
-    # MACHINE (INTERNAL_TOKEN, già generato al boot da main.py)
-    int_tok = _get_token("INTERNAL_TOKEN")
-    if int_tok and x_internal_token and _sec_comp.compare_digest(x_internal_token, int_tok):
+    # MACHINE: supporta entrambi gli header per compatibilità tra runner e backend.
+    # Il valore resta confrontato esclusivamente con il secret server-side.
+    int_tok = _get_token("INTERNAL_TOKEN") or _get_token("MACHINE_TOKEN")
+    machine_header = x_internal_token or x_machine_token
+    if int_tok and machine_header and _sec_comp.compare_digest(machine_header, int_tok):
         logger.debug("auth: MACHINE role granted")
         return AuthRole.MACHINE
 
@@ -280,7 +283,8 @@ def require_role(min_role: AuthRole):
         _token_hdr = (
             request.headers.get('X-Admin-Token') or
             request.headers.get('X-Operator-Token') or
-            request.headers.get('X-Internal-Token')
+            request.headers.get('X-Internal-Token') or
+            request.headers.get('X-Machine-Token')
         )
         # GAP-AUTH-FIX: estrai IP reale (Railway/HF dietro proxy → X-Forwarded-For)
         _client_ip: str | None = (