fix(gateway): multiplex primary gateways resolve bot tokens through profile secret scope (#64986 salvage) - #65525
Merged
Merged
Conversation
…nnect loops When gateway.multiplex_profiles is on, the default-profile GatewayRunner used to call load_gateway_config() unscoped. Platform tokens that lived only in a profile .env (often a secondary profile) never reached the primary Telegram adapter, producing "No bot token configured" and an infinite reconnect watcher loop (#64674). - Load primary config under the default profile secret scope when multiplex is enabled (same path secondary adapters already use). - Skip starting token platforms on the default profile when no credential is present under multiplex; secondary profiles still connect with their scoped tokens. - Drop empty-token configs from the reconnect queue so they cannot spin forever. Regression coverage in tests/gateway/test_64674_multiplex_primary_token_scope.py.
…m map + unserved-platform warning Follow-ups to @SAMBAS123's #64986 salvage: - Replace the hardcoded token-platform set in _platform_has_bot_credential with PLATFORM_TOKEN_ENV_NAMES, a shared canonical map in gateway/config.py also used by the empty-token validation warning — one source of truth, so future token platforms can't silently bypass the gate or drift between the two sites. - After secondary-profile startup, warn loudly for any platform skipped on the primary that no secondary profile ended up serving: an enabled platform with no credential anywhere is a config error, not a silent no-op. - AUTHOR_MAP entry for the salvaged commit's author email.
alt-glitch
added
type/security
This was referenced Jul 16, 2026
19 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Under
gateway.multiplex_profiles: true, the default-profile gateway now resolves platform bot tokens through its own profile secret scope instead of bareos.environ— so a token living only in a profile.envconnects at startup instead of failing into an infinite 60s reconnect loop. Closes #64674.Salvages PR #64986 by @SAMBAS123 (root cause traced line-by-line in the issue by @stupidsexyhermes), plus two hardening follow-ups.
Changes
Contributor commit (cherry-picked, authorship preserved):
load_gateway_config_for_runner()— when multiplex is on, reload config under the default profile's_profile_runtime_scope(the same seam secondary profiles already use since fix(gateway): read platform env overrides through the profile secret scope (#50094 salvage) #59315). Multiplex off = legacy unscoped path, unchanged.tests/gateway/test_64674_multiplex_primary_token_scope.py— 8 regression tests.Our follow-ups:
_platform_has_bot_credential()now readsPLATFORM_TOKEN_ENV_NAMES, a new canonical map ingateway/config.pyshared with the empty-token validation warning — replaces the PR's hardcoded 6-platform set so future token platforms can't drift between the two sites.Validation
test_64674_multiplex_primary_token_scope.pytests/gateway/ -k "multiplex or token".env, absent fromos.environ)Related: follow-on to #49415 / #59315 (secondary-profile scoped loads). Complementary to the open multiplex cluster (#64461 authz/Slack/webhook scoping, #63256, #51115) — no file-level or semantic conflicts: this PR only touches the primary startup/reconnect path.
Infographic