fix(api-rs): authorize githubbot for all its session key families - #22
Closed
oponder wants to merge 2 commits into
Closed
fix(api-rs): authorize githubbot for all its session key families#22oponder wants to merge 2 commits into
oponder wants to merge 2 commits into
Conversation
The platform scoping added in paradigmxyz#1374 pins each ingress key to a single thread-key prefix, but githubbot mints three families: github: (chat), github-manage: (owned-PR management), github-review: (review runs). Only the first matched, so api-rs 403'd the bot's own review and management sessions ("ingress caller denied for another platform's session") and PR reviews stopped working. Callers now carry the full list of prefixes their ingress mints, and the session guard accepts any of them. Other bots keep their single prefix; unlisted github-* strings stay denied. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
oponder
marked this pull request as ready for review
August 18, 2026 18:49
0xdiid
previously approved these changes
Aug 19, 2026
Auditing every thread-key literal githubbot mints turned up a fourth family the first pass missed: github-issue: (issue assigned to the bot, issue-manager.ts). It 403s exactly like the management and review families did, so the hotfix was incomplete. Pin both ends of the contract so they cannot drift apart silently: the ingress table moves to a module-level const, letting the api-rs test assert the shipped spec rather than a hand-written list, and githubbot gains a test fixing the prefix each of its thread-key helpers produces. Code-identical to the upstream offering, paradigmxyz#1435. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Author
|
closing this one. it's merged upstream and I'll pull it down instead |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hotfix for PR reviews breaking after the upstream sync (#19): upstream's api-rs route authentication (paradigmxyz#1374, Aug 13) scopes each ingress key to one thread-key prefix —
github:for githubbot — but githubbot also mintsgithub-issue:(issue work),github-manage:(owned-PR management) andgithub-review:(review runs). Those now 403 ("ingress caller denied for another platform's session"), e.g. the review on splits#3592.Fix: callers carry every prefix their ingress mints; the session guard accepts any of them. Unlisted
github-*strings stay denied; other bots each mint a single family and keep a single prefix. Thread keys are NOT renamed — existing sessions keep working.Both ends of the contract are now pinned so they can't drift apart silently: the api-rs test asserts the shipped ingress spec rather than a hand-written list, and githubbot pins the prefix each of its thread-key helpers produces.
Upstream is broken the same way — offered there as paradigmxyz#1435. This branch is code-identical to it, so the sync that picks it up is a no-op here.
Validation
cargo fmt --check/clippy --workspace --all-targets -D warnings/test -p centaur-api-server --libin a rust:1 containerbun test test+bun tsgo --noEmitinservices/githubbot🤖 Generated with Claude Code