[RobinMennens-UiPath]

The solution-tests write actions copied the user's bearer token into the HTTP trigger's request body. Orchestrator stores that body as the job's input arguments, which anyone with Jobs.View in the folder can read. create-actions.ts now sends the token in the Authorization header only.

The FINS backend gets the caller from the job's Orchestrator creator instead: UiPath/fins-vertical-solution#1502. FINS is the only consumer of solution-tests, so the old body fields go without a compatibility path. The file matches the FINS webapps' copies byte for byte.

Checked with tsc --noEmit, oxlint --type-aware registry/solution-tests and biome format in packages/apollo-vertex.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VQA1xEsDwn4t2UBBRpTroi

[Copilot]

🔵 Needs a closer look

Compatibility and authorization depend on the linked FINS backend change, which requires human verification.

No open issues 🎉

What changed in this PR

Prevents solution-test actions from exposing bearer tokens through Orchestrator job input arguments.

Changes:

• Keeps bearer tokens exclusively in the Authorization header.
• Removes body authentication fields, relying on the coordinated FINS backend change to identify callers.

File	Description
packages/​apollo-vertex/​registry/​solution-tests/​create-actions.ts	Removes token-bearing request fields and documents header-only authentication.

_{Review effort: Balanced}

[github-actions]

Dependency License Review

• ✅ 1957 package(s) scanned
• ✅ No license issues found
• ⚠️ 2 package(s) excluded (see details below)

License distribution

License	Packages
MIT	1721
ISC	91
Apache-2.0	57
BSD-3-Clause	28
BSD-2-Clause	23
BlueOak-1.0.0	8
MPL-2.0	4
CC0-1.0	4
MIT-0	3
MIT OR Apache-2.0	2
(MIT OR Apache-2.0)	2
Unlicense	2
LGPL-3.0-or-later	1
Python-2.0	1
CC-BY-4.0	1
(MPL-2.0 OR Apache-2.0)	1
Unknown	1
Artistic-2.0	1
(WTFPL OR MIT)	1
(BSD-2-Clause OR MIT OR Apache-2.0)	1
CC-BY-3.0	1
0BSD	1
(MIT OR CC0-1.0)	1
MIT AND ISC	1

Excluded packages

Package	Version	License	Reason
@img/sharp-libvips-linux-x64	1.3.4	LGPL-3.0-or-later	LGPL pre-built binary, not linked
khroma	2.1.0	Unknown	MIT per GitHub repo, missing license field in package.json

[github-actions]

📊 Coverage + size by package

Per-package coverage and bundle size on this PR. New-line coverage = of the source lines this PR adds or changes, the % hit by tests.

Package	Coverage	New-line coverage	Packed (gzip)	Unpacked	vs main
@uipath/apollo-core	—	—	—	—	—
@uipath/apollo-react	—	—	—	—	—
@uipath/apollo-ui-icons	—	—	—	—	—
@uipath/apollo-vertex	85.5%	— (11 untracked)	336.8 KB	1.88 MB	−4 B
@uipath/apollo-wind	—	—	—	—	—
@uipath/ap-chat	—	—	—	—	—

_{"Coverage" is each package's own coverage.include scope (e.g. apollo-core instruments only scripts/). "Packed"/"Unpacked" come from npm pack --dry-run and only cover built packages — "—" means not measured this run (package not affected / not built). "vs main" is the packed (gzipped) delta against the last successful main build (the package-sizes artifact from the Release workflow); "—" there means no main baseline was available this run. The baseline is main's latest build, not this PR's exact merge-base, so it includes any drift since the branch diverged. Packages with no vitest config are omitted.}

[github-actions]

Storybook visual diff

✅ No stories are affected by this PR's changes; nothing to compare. Logs

Updated (PT): Oct 21, 2026, 07:45:25 AM