Ma77Ball commented on code in PR #5558:
URL: https://github.com/apache/texera/pull/5558#discussion_r3607786414
##########
agent-service/src/server.ts:
##########
@@ -160,11 +162,44 @@ const agentsRouter = new Elysia({ prefix: "/agents" })
set.status = 500;
return { error: errorMessage || "Internal server error" };
})
+ // Authenticate every agent request by verifying the Bearer JWT ourselves
+ // (defense in depth — the gateway ext_authz also checks it, but this also
+ // covers direct access, e.g. bare-metal dev). The WebSocket route is guarded
+ // separately in its open() handler via the access-token query param.
+ .onBeforeHandle(({ request, set }) => {
+ const token = (request.headers.get("authorization") ??
"").replace(/^Bearer\s+/i, "").trim();
+ if (!verifyToken(token)) {
Review Comment:
This self-guard and the WebSocket `open()` guard only check token validity
via `verifyToken`, not role (REGULAR/ADMIN). With this guard, an INACTIVE user
with a valid token would be admitted, whereas the gateway should return 403.
`verifyToken` already returns the role, so consider rejecting non-REGULAR/ADMIN
here as well for parity with the gateway.
##########
frontend/src/app/workspace/service/agent/agent.service.ts:
##########
@@ -240,6 +240,12 @@ export class AgentService {
*/
private agentHeaders(agentId?: string): { headers: HttpHeaders } {
let headers = new HttpHeaders();
+ // The access-control-service authorizes every agent request by JWT, so
+ // attach the Bearer token to all agent-service calls.
Review Comment:
Every `/api/agents` call now needs this Bearer token, but
`syncAgentsWithBackend()` a few lines below (around line 265) still does
`this.http.get(`${this.AGENT_API_BASE}/agents`)` without `agentHeaders()`.
Under the new gate that request 401s, and its `.pipe(catchError(() => of({
agents: [] })))` swallows the failure and returns an empty list, which then
deletes every locally-cached agent as "stale". I recommend routing it through
the same helper as `getAllAgents()`:
`this.http.get<ApiAgentListResponse>(`${this.AGENT_API_BASE}/agents`,
this.agentHeaders())`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
