LLM/moltbot
1
0
Fork 0
mirror of https://github.com/moltbot/moltbot.git synced 2026-03-07 22:44:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: include trusted-proxy in sharedAuthOk check

Browse Source 
In trusted-proxy mode, sharedAuthResult is null because hasSharedAuth
only triggers for token/password in connectParams.auth. But the primary
auth (authResult) already validated the trusted-proxy — the connection
came from a CIDR in trustedProxies with a valid userHeader. This IS
shared auth semantically (the proxy vouches for identity), so operator
connections should be able to skip device identity.

Without this fix, trusted-proxy operator connections are rejected with
"device identity required" because roleCanSkipDeviceIdentity() sees
sharedAuthOk=false.

(cherry picked from commit e87048a6a6)
This commit is contained in:
Marco Di Dionisio
2026-02-23 19:20:26 +01:00
committed by Peter Steinberger
parent bc52d4a459
commit 83689fc838
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/gateway/server/ws-connection/auth-context.ts
View File

@@ -133,9 +133,13 @@ export async function resolveConnectAuthState(params: {
// primary auth flow (or deferred for device-token candidates).
rateLimitScope: AUTH_RATE_LIMIT_SCOPE_SHARED_SECRET,
}));
// Trusted-proxy auth is semantically shared: the proxy vouches for identity,
// no per-device credential needed. Include it so operator connections
// can skip device identity via roleCanSkipDeviceIdentity().
const sharedAuthOk =
sharedAuthResult?.ok === true &&
(sharedAuthResult.method === "token" || sharedAuthResult.method === "password");
(sharedAuthResult?.ok === true &&
(sharedAuthResult.method === "token" || sharedAuthResult.method === "password")) ||
(authResult.ok && authResult.method === "trusted-proxy");
return {
authResult,