ginnoir
a96ff619a8
Deploy to valhalla / deploy (push) Has been cancelled
RomM 4.8.x crashes with HTTP 500 on a malformed Authorization header: hybrid_auth.py unpacks `scheme, token = header.split()` with no guard, so any value without exactly two space-separated parts raises ValueError. decky-romm-sync >=0.20.0 (Client API Token auth, added 2026-06-05) sends `Authorization: Bearer ` with an empty token on its first-run heartbeat/ platforms/devices probes, before it has minted a token, which trips that crash and deadlocks setup. The Basic-auth mint (POST /api/client-tokens) is never reached. Strip the empty-token header for the roms host so the probe gets a clean 200 and the mint can run; thereafter the plugin sends a real Bearer rmm_ token. Well-formed Bearer tokens and browser session-cookie auth are unaffected. Remove once the plugin omits the empty header or RomM guards the split.