refactor(core): canonicalize pty service (#32182)

packages/server/src/middleware/authorization.ts

@@ -1,5 +1,6 @@
 import { ServerAuth } from "../auth"
 import { UnauthorizedError } from "../errors"
+import { hasPtyConnectTicketURL } from "../groups/pty"
 import { Effect, Encoding, Layer, Redacted } from "effect"
 import { HttpEffect, HttpServerRequest, HttpServerResponse } from "effect/unstable/http"
 import { HttpApiMiddleware } from "effect/unstable/httpapi"
@@ -45,6 +46,9 @@ export const authorizationLayer = Layer.effect(
     return Authorization.of((effect) =>
       Effect.gen(function* () {
         const request = yield* HttpServerRequest.HttpServerRequest
+        // Browsers cannot set headers on WebSocket upgrades, so a ticketed PTY connect skips
+        // credential checks here; the connect handler consumes and validates the ticket.
+        if (hasPtyConnectTicketURL(new URL(request.url, "http://localhost"))) return yield* effect
         const credential = yield* credentialFromRequest(request)
         if (ServerAuth.authorized(credential, config)) return yield* effect
         yield* HttpEffect.appendPreResponseHandler((_request, response) =>