[Bug]: Trust boundary bypass in `internal/auth/repair` causes API key disclosure

Summary

Skyvern's internal/auth/repair route contains a trust-boundary bypass that can lead to credential disclosure. internal_auth is intended for local-only use in ENV=local, but _is_local_request() treats any private RFC1918 address as local (skyvern/forge/sdk/routes/internal_auth.py):

def _is_local_request(request: Request) -> bool:
    ...
    is_local = addr.is_loopback or addr.is_private
    return is_local

At the same time, repair_api_key() returns the full regenerated API key in its JSON response. As a result, a caller from a Docker bridge or other private-network address can bypass the intended localhost-only restriction and receive a freshly generated API key in the response.

To reproduce

Run Skyvern in a local-style configuration where the internal auth routes are enabled, then send a request from a private-network address such as 172.17.0.2.

The relevant route is:

POST /api/v1/internal/auth/repair

Expected

Only loopback callers (for example 127.0.0.1 / ::1) should be considered local for this endpoint, and the repair response should not return the full raw API key body to non-interactive callers.

Actual

For a request object with request.client.host = 172.17.0.2, the current route logic returned the following JSON body:

{
  "result": {
    "status": "ok",
    "organization_id": "org-demo",
    "fingerprint": "fp-BYPASS",
    "api_key": "skyvern-demo-token-PRIVATE-IP-BYPASS",
    "backend_env_path": "/tmp/backend.env",
    "frontend_env_path": "/tmp/frontend.env"
  }
}

Impact

In common development and Docker-based deployments, any host that can reach this endpoint from a private-network address may be able to obtain a newly generated valid API key. This weakens the intended localhost-only trust boundary and can enable unauthorized access to the wider application under the affected organization context. Because the endpoint returns the raw token directly in the response, successful exploitation results in immediate credential disclosure.

Version

1.0.39