ai-workspace-lab/xworkmate-bridge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

require explicit external provider auth header

Browse Source
This commit is contained in:
Haitao Pan 2026-04-10 16:50:56 +08:00
parent 67696beab8
commit 78fa471211
2 changed files with 19 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
internal/acp/execution.go
View File

@ -232,24 +232,16 @@ func externalProviderFromParams(params map[string]any) (syncedProvider, bool) {
return syncedProvider{}, false
}
return syncedProvider{
ProviderID: strings.TrimSpace(shared.StringArg(params, "provider", "")),
Label: strings.TrimSpace(shared.StringArg(params, externalProviderLabelKey, "")),
Endpoint: endpoint,
AuthorizationHeader: fallbackAuthorizationHeader(
strings.TrimSpace(shared.StringArg(params, externalProviderAuthorizationHeaderKey, "")),
strings.TrimSpace(shared.StringArg(params, inboundAuthorizationHeaderKey, "")),
ProviderID: strings.TrimSpace(shared.StringArg(params, "provider", "")),
Label: strings.TrimSpace(shared.StringArg(params, externalProviderLabelKey, "")),
Endpoint: endpoint,
AuthorizationHeader: strings.TrimSpace(
shared.StringArg(params, externalProviderAuthorizationHeaderKey, ""),
),
Enabled: true,
Enabled: true,
}, true
}
func fallbackAuthorizationHeader(explicit, inbound string) string {
if strings.TrimSpace(explicit) != "" {
return strings.TrimSpace(explicit)
}
return strings.TrimSpace(inbound)
}
func requestExternalACP(
ctx context.Context,
endpoint,

25
internal/acp/providers_sync_test.go
View File

@ -201,11 +201,11 @@ func TestExecuteSessionTaskEnrichesExternalProviderResultWithArtifactsAndRemoteM
"jsonrpc": "2.0",
"id": request["id"],
"result": map[string]any{
"success": true,
"output": "external-provider-ok",
"turnId": "turn-external-artifacts",
"provider": "claude",
"mode": "single-agent",
"success": true,
"output": "external-provider-ok",
"turnId": "turn-external-artifacts",
"provider": "claude",
"mode": "single-agent",
"resolvedWorkingDirectory": "/remote/threads/task-42",
"resolvedWorkspaceRefKind": "remotePath",
},
@ -358,10 +358,10 @@ func TestRunSingleAgentFallsBackWorkingDirectoryToHome(t *testing.T) {
}
}
func TestHandleRPCForwardsInboundBearerToExternalProvider(t *testing.T) {
func TestHandleRPCRequiresExplicitBearerForExternalProvider(t *testing.T) {
externalServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
if got := r.Header.Get("Authorization"); got != "Bearer bridge-token" {
t.Fatalf("expected forwarded bearer header, got %q", got)
if got := r.Header.Get("Authorization"); got != "Bearer synced-provider-token" {
t.Fatalf("expected explicit synced provider bearer header, got %q", got)
}
_ = json.NewEncoder(w).Encode(map[string]any{
"jsonrpc": "2.0",
@ -376,10 +376,11 @@ func TestHandleRPCForwardsInboundBearerToExternalProvider(t *testing.T) {
server := NewServer()
server.syncProviders([]syncedProvider{{
ProviderID: "codex",
Label: "Codex",
Endpoint: externalServer.URL,
Enabled: true,
ProviderID: "codex",
Label: "Codex",
Endpoint: externalServer.URL,
AuthorizationHeader: "Bearer synced-provider-token",
Enabled: true,
}})
recorder := httptest.NewRecorder()