fix(#249): schedule health endpoint accessible to CanCommunicate peers - #400
Merged
Merged
Conversation
…e peers Rebased cleanly onto current main (resolves the add/add conflicts that blocked CI on PR #374 — the original branch diverged from a pre-repo-bootstrap commit that predated most files). Changes: - schedules.go: add scheduleHealthResponse struct + Health handler (mirrors A2A proxy auth pattern: X-Workspace-ID + CanCommunicate gate) - router.go: register GET /workspaces/:id/schedules/health on r (not wsAuth) so peer agents can query without holding the target workspace's bearer token - schedules_test.go: 7 new tests (missing caller 401, self-call OK, legacy peer grandfathered, non-peer 403, system caller bypass, no prompt exposure, DB error 500) isSystemCaller/validateCallerToken reused from a2a_proxy.go (same package). registry.CanCommunicate import added to schedules.go. Closes #249 Supersedes PR #374 (which could not get CI due to merge conflict) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
9 tasks
molecule-ai Bot
pushed a commit
that referenced
this pull request
Apr 21, 2026
…e peers (#400) Rebased cleanly onto current main (resolves the add/add conflicts that blocked CI on PR #374 — the original branch diverged from a pre-repo-bootstrap commit that predated most files). Changes: - schedules.go: add scheduleHealthResponse struct + Health handler (mirrors A2A proxy auth pattern: X-Workspace-ID + CanCommunicate gate) - router.go: register GET /workspaces/:id/schedules/health on r (not wsAuth) so peer agents can query without holding the target workspace's bearer token - schedules_test.go: 7 new tests (missing caller 401, self-call OK, legacy peer grandfathered, non-peer 403, system caller bypass, no prompt exposure, DB error 500) isSystemCaller/validateCallerToken reused from a2a_proxy.go (same package). registry.CanCommunicate import added to schedules.go. Closes #249 Supersedes PR #374 (which could not get CI due to merge conflict) Co-authored-by: PM (Molecule AI) <pm@molecule-ai.internal> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
GET /workspaces/:id/schedules/health— accessible to peer agents without holding the target workspace's bearer tokenregistry.CanCommunicategate, system callers bypass both checksscheduleHealthResponseintentionally omitspromptandcron_expr(prevents sensitive cron content leaking to peers)r(notwsAuth) outside the workspace-auth middleware groupWhy this is a re-submission
PR #374 opened the same change but its branch diverged from a pre-bootstrap commit that predated most of the current codebase (60+ "add/add" conflicts with main). GitHub Actions never triggered CI on it because
mergeable: CONFLICTINGpreventspull_requestwebhook events from spawning workflow runs. This clean branch resolves that.PR #374 is being closed in favour of this PR.
Test plan
schedules_test.go: missing caller 401, self-call OK, legacy peer grandfathered, non-peer 403, system caller bypass, no prompt/cron_expr in response, DB error → 500go build ./...+go test -race ./...curl -H "X-Workspace-ID: <peer-id>" /workspaces/<id>/schedules/healthreturns schedule health without workspace bearer tokenCloses #249
Supersedes #374
🤖 Generated with Claude Code