Repository navigation
feat(auth): accept scoped acw_ keys on WebSocket (Factory#312) - #1496
Open
olafkfreund wants to merge 3 commits into
Open
olafkfreund wants to merge 3 commits into
olafkfreund wants to merge 3 commits into
Conversation
Plan step 4 of olafkfreund/Factory plan/2026-11-07-312-cockpit-scoped-keys.md (implemented by agy). authenticate_websocket validates acw_ keys the way the REST middleware does (authenticate + api:full) and returns the same principal, so /ws/events and the rmux console see the key as REST does. Ownerless and under-scoped keys are closed with 4001. Refs olafkfreund/Factory#312 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1
…ctory#312) Final-review fix (codex finding), plan steps 1/4 of olafkfreund/Factory plan/2026-11-07-312-cockpit-scoped-keys.md. Refs olafkfreund/Factory#312 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1
TFactory coverage54.95% on this PR vs 54.82% on its base ( PASS - Coverage 54.95% (up 0.13 pts from 54.82%)
|
…ry#312) CI ratchet fix for plan step 4 of olafkfreund/Factory plan/2026-11-07-312-cockpit-scoped-keys.md. _ws_acw_principal added a lazy import (PLC0415), a blind except (BLE001) and a bare dict return type. The lazy import mirrors the REST path and the catch-all is the approved WS policy (any validator failure denies), so both carry reasoned noqa; the return type gets its arguments. scripts/ratchet_lint.py now passes. Refs olafkfreund/Factory#312 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Plan step 4.
authenticate_websocketvalidatesacw_keys as REST does (authenticateplusapi:full) and returns the same principal. Ownerless and under-scoped keys are closed with 4001. TFactory's feed has no org routing for any principal (#3679).The callers are
/ws/eventsand the rmux agent-console WS. The rmux console runs the same per-project viewer check as REST, and typing still needsPOST /attach.verify_websocket_token(logs, progress, PTY terminal) is unchanged, soacw_keys get no PTY access. The legacy wildcard path is unchanged. Without this, CFactory can't stop sending the wildcard on its live feed.Artifacts (olafkfreund/Factory#3680): intent · spec · plan. User approved them unseen on 2026-11-07 (bulk run).
Part of a four-PR set. Each PR is safe to merge alone, and every new path stays off until it is configured. The cut-over needs all four deployed.
Who did what
try, so every failure closes with 4001.Tests
pytest tests/test_ws_acw_auth.py tests/rmux/test_bridge.py: 19 passed. ruff is clean.Refs olafkfreund/Factory#312 · follow-up olafkfreund/Factory#3679
🤖 Generated with Claude Code
https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1