mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-07-27 17:58:07 +00:00
cf4fb8993f
Two pure seams in native-auth-decisions.ts, following that module's existing pattern — the value is the test that pins the contract so the god-file call sites can't drift back to the buggy shape. resolveReadinessProbeAuth decides how the boot readiness probe authenticates, delegating to resolveOauthRestAuth for the oauth case rather than duplicating the bearer-vs-cookie rule. oauthGuardMayHardFail fixes a second way a gated gateway is misread. authModeFromStatus maps the gateway's `auth_required: true` onto 'oauth', but that flag only means the dashboard is GATED — it says nothing about how you authenticate. A gateway whose providers are all username/password can satisfy neither of the pre-flight guard's checks by construction: start_login raises NotImplementedError, /auth/native/authorize rejects password providers, and its cookies come from a plain password-login POST rather than the /auth/callback redirect the OAuth partition is primed for. The guard therefore threw "uses OAuth, but you are not signed in" one line before a mintGatewayWsTicket that would have succeeded against that very partition. The helper returns false only when EVERY advertised provider is password-based; an unknown or empty list keeps the strict guard, so backends predating /api/auth/providers are unaffected. |
||
|---|---|---|
| .. | ||
| bootstrap-installer | ||
| desktop | ||
| shared | ||