From 2e3d5a404a272fd48c74854016cb2c93f21bccbb Mon Sep 17 00:00:00 2001
From: ragnarok-clanker <ragnarok-clanker>
Date: Wed, 28 Oct 2026 16:27:53 +0100
Subject: [PATCH] Accept admin API tokens for accept-regressions

POST /api/admin/batches/:id/accept-regressions is admin-only; like batch review and task updates, an admin API token can now call it without a browser session.
---
 src/server/app.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/server/app.js b/src/server/app.js
index b51bf63..9049359 100644
--- a/src/server/app.js
+++ b/src/server/app.js
@@ -1118,7 +1118,7 @@ export function createApp(ctx) {
 
   // An admin merges a batch that came back only for lowering matching scores (merge.js).
   router.on('POST', '/api/admin/batches/:id/accept-regressions', async ({ req, params }) => {
-    const user = auth(req, { role: 'admin', session: true });
+    const user = auth(req, { role: 'admin' });
     const body = await readJson(req, 16 * 1024);
     const r = merger.acceptRegressions(user, intParam(params.id), body.comment ? String(body.comment) : null);
     if (runsWorker) setImmediate(() => merger.pump().catch(() => {}));