Problem
The SDK's internal-service mode currently sends only X-Internal-Service: true and X-Internal-User-Id. MantisAPI issue #2065 identified that contract as spoofable, and MantisAPI PR #2388 replaces it with an authenticated X-Internal-Service-Token credential.
Once the backend fix lands, production SDK clients using MANTIS_INTERNAL_USER_ID without the new credential will no longer authenticate.
Scope
- Add an optional
MANTIS_INTERNAL_SERVICE_TOKEN / configuration value.
- Require the token whenever internal-user impersonation mode is enabled.
- Send
X-Internal-Service-Token with the existing internal marker and user ID.
- Never derive or log the credential in the SDK; deployments must provision the token generated for the MantisAPI environment.
- Add tests for the valid internal header set and fail-closed behavior when the token is missing.
- Keep cookie-based user authentication unchanged.
Conflict check
Open PR #5 does not modify mantis_sdk/_http.py, mantis_sdk/config.py, or tests/test_http_client.py, so the implementation can avoid its README/client changes.
Problem
The SDK's internal-service mode currently sends only
X-Internal-Service: trueandX-Internal-User-Id. MantisAPI issue #2065 identified that contract as spoofable, and MantisAPI PR #2388 replaces it with an authenticatedX-Internal-Service-Tokencredential.Once the backend fix lands, production SDK clients using
MANTIS_INTERNAL_USER_IDwithout the new credential will no longer authenticate.Scope
MANTIS_INTERNAL_SERVICE_TOKEN/ configuration value.X-Internal-Service-Tokenwith the existing internal marker and user ID.Conflict check
Open PR #5 does not modify
mantis_sdk/_http.py,mantis_sdk/config.py, ortests/test_http_client.py, so the implementation can avoid its README/client changes.