feat(auth): replace baked API key with scoped key model#2
Open
matthewubundi wants to merge 3 commits intomainfrom
Open
feat(auth): replace baked API key with scoped key model#2matthewubundi wants to merge 3 commits intomainfrom
matthewubundi wants to merge 3 commits intomainfrom
Conversation
Remove the build-time key injection pipeline (api-key.ts, inject-api-key.mjs, BUILD_API_KEY in CI/publish workflows) in favor of user-provisioned scoped keys. - Simplify key resolution to config.apiKey → CORTEX_API_KEY env var - Add first-run guidance pointing to https://cortex.ubundi.com for key generation - Add whoami() client method and call it during bootstrap to log authenticated user identity and permissions - Surface scoped-key 403 errors (wrong user_id, missing permission) as clear, actionable messages instead of generic "failed: 403" - Update tests: whoami, scoped-key 403 variants, no-key early return - Remove stale baked-key references from README and CLAUDE.md
bootstrapClient logged the whoami user_id but never adopted it, so a scoped key's enforced user_id was ignored — causing 403s on every subsequent knowledge/recall/capture call with the install-generated ID. - Return scopedUserId from bootstrapClient so register() can adopt it - Use the adopted ID for knowledge() and stats() during bootstrap - Stop swallowing whoami 403s — surface scoped-key and permission errors as warnings and abort bootstrap early instead of proceeding to a misleading "Cortex connected" message - Let non-auth whoami failures (network, old backend) fall through at debug level so startup isn't blocked
…fires The whoami identity check was gated behind !isCliInvocation, so CLI commands (status, search, pair, reset) never adopted the scoped user_id and sent the local install UUID instead — causing 403s with scoped keys. Additionally, bootstrapClient ran as fire-and-forget after userIdReady, meaning recall/capture/tool hooks could fire before whoami finished, producing avoidable auth failures on the first agent turn. Split bootstrapClient into resolveScopedIdentity (whoami) and bootstrapKnowledge (health + knowledge + warmup). Identity resolution now runs for all paths via identityReady, which all consumers await before making API calls.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
api-key.ts,inject-api-key.mjs,BUILD_API_KEYin CI/publish workflows) in favor of user-provisioned scoped keys resolved at runtime viaconfig.apiKeyorCORTEX_API_KEYenv varwhoami()endpoint is called during bootstrap to resolve the server-owneduser_idfrom scoped keys, replacing the locally generated install UUID — fixes 403s when the backend enforces key-bound identity!isCliInvocationand now completes before any hook or handler fires, preventing auth failures on CLI commands and the first agent turnTest plan
npx tsc --noEmitpassesnpm testpasses — new tests cover whoami, scoped-key 403 variants, identity adoption, CLI identity resolutionopenclaw cortex statusworks with a scoped key🤖 Generated with Claude Code