fix: dual-send API key for CG Manager delegate 401s - #828
Draft
thisrohangupta wants to merge 4 commits into
Draft
Conversation
Document why delegate list returns 401 while other NG APIs work: paths route to CG Manager, which rejects inter-service JWTs and needs x-api-key/Bearer; applyDefaultAuth can skip x-api-key when Authorization is already set. Co-authored-by: Rohan Gupta <thisrohangupta@users.noreply.github.com>
Capture that delegate endpoints are CG-routed and need x-api-key/Bearer, so Authorization-only sessions fail with a misleading 401. Co-authored-by: Rohan Gupta <thisrohangupta@users.noreply.github.com>
|
|
Delegate-setup and delegate-token APIs are served by CG Manager, which rejects inter-service JWTs that NG Manager accepts. Stop skipping x-api-key when Authorization is already set, replace non-Bearer auth on CG paths with Bearer from the configured PAT/SAT, and clarify 401s. Co-authored-by: Rohan Gupta <thisrohangupta@users.noreply.github.com>
Co-authored-by: Rohan Gupta <thisrohangupta@users.noreply.github.com>
cursor
Bot
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Delegate list/token calls were returning 401 while other NG APIs worked on the same session. Those paths are ingress-routed to CG Manager, which rejects inter-service JWTs and needs
x-api-keyorAuthorization: Bearer.Root cause
HarnessClient.applyDefaultAuthskipped injectingx-api-keywhenever anyAuthorizationheader was already present. NG Manager could still authorize; CG Manager (/ng/api/delegate-setup,/ng/api/delegate-token-ng) returned 401. Error copy incorrectly blamed an expired API key.Fix
x-api-keyfor non-FME requests (dual-send with existingAuthorization).Authorization(e.g.genaiservice …) withBearer <configured PAT/SAT>when the key is not a placeholder.Tests
pnpm typecheckpnpm exec vitest run tests/client/harness-client.test.ts— 81 passedFollow-up
AskAI/
mcpServerInternalstill needs a CG-valid PAT/SAT if the session only has a genaiservice JWT — dual-auth cannot invent one. Live PAT smoke fordelegate/delegate_tokenstill pending.