Repository navigation
fix: uniform 401 for every rejected bearer on run routes - #24
Merged
TheGreatAxios merged 1 commit intoOct 21, 2026
Merged
TheGreatAxios merged 1 commit into
TheGreatAxios merged 1 commit into
Conversation
|
Triage: Fail @TheGreatAxios, please address the following:
Waiting on a maintainer to approve: request changes. Changed since the last verdict (Pass at |
corbits-triage
Bot
added
Triage: Not Ready
Triage: Ready
and removed
Triage: Waiting for CI
Triage: Not Ready
labels
TheGreatAxios
force-pushed
the
cl-10968-bind-each-agent-token-to-the-run-it-was-issued-for
branch
from
October 21, 2026 03:10
0c28bed to
600d87d
Compare
TheGreatAxios
force-pushed
the
cl-10972-return-one-401-for-every-rejected-bearer-on-artifacts-run
branch
from
October 21, 2026 03:11
c295a19 to
115d88e
Compare
Every rejection path — missing bearer, invalid token, unbound token,
wrong run, wrong tenant, and missing tenant middleware — now returns the
same 401 { error: unauthorized }. Previously, a missing tenant
middleware caused a 500, which revealed that the route existed.
Changes:
- requireAgentToken catches host-side errors and returns 401
- requireRunBoundToken catches host-side errors and returns 401
- Updated existing test expectation from 500 to 401 for missing tenant
- Added test for requireRunBoundToken without tenant middleware
Closes CL-10972
TheGreatAxios
changed the base branch from
cl-10968-bind-each-agent-token-to-the-run-it-was-issued-for
to
main
October 21, 2026 03:12
TheGreatAxios
force-pushed
the
cl-10972-return-one-401-for-every-rejected-bearer-on-artifacts-run
branch
from
October 21, 2026 03:12
115d88e to
cdde7ce
Compare
TheGreatAxios
deleted the
cl-10972-return-one-401-for-every-rejected-bearer-on-artifacts-run
branch
October 21, 2026 03:14
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Every rejection path — missing bearer, invalid token, unbound token, unknown run, wrong tenant, and missing tenant middleware — now returns the same 401
{ error: "unauthorized" }. Previously, a missing tenant middleware caused a 500, which revealed that the route existed.Changes:
requireAgentTokencatches host-side errors and returns 401requireRunBoundTokencatches host-side errors and returns 401requireRunBoundTokenwithout tenant middlewareVerification
bun run check: passes (tsc, oxlint, oxfmt, tests)bun run build: passesCloses CL-10972