Repository navigation
Conversation
…uest The _get_kb_info_via_http method was making HTTP POST requests to the backend's /internal/rag/kb-size endpoint without an Authorization header. After the backend added verify_internal_service_token dependency to all internal RAG endpoints, these requests started returning 401, causing the knowledge base info to be empty and triggering rag_not_configured. The auth_token was already available in the KnowledgeBaseTool instance but was never passed to the HTTP request. This fix adds the Authorization: Bearer header when auth_token is present, consistent with the fix already applied to _check_any_kb_has_rag_enabled.
Three endpoints were making requests to backend /internal/rag/* without Authorization headers, causing 401 errors after the backend enforced internal service token verification: 1. KnowledgeBaseTool._retrieve_with_strategy_via_http (POST /retrieve) 2. KbLsTool._list_docs_http_mode (POST /list-docs) 3. KbHeadTool._arun (POST /read-docs) For KnowledgeBaseTool, self.auth_token already existed and just needed to be passed as a header. For KbLsTool and KbHeadTool, the auth_token field was added and wired through in knowledge_factory.py. This completes the fix started in the previous commit for _get_kb_info_via_http, covering all remaining chat_shell → backend internal RAG HTTP calls.
cocowh
changed the title
The /internal/rag/* endpoints on the backend use verify_internal_service_token which checks against settings.INTERNAL_SERVICE_TOKEN, not the task token JWT (auth_token). Sending the task token JWT resulted in persistent 401 errors. This fix changes all 5 internal RAG HTTP call sites to prefer settings.INTERNAL_SERVICE_TOKEN from chat_shell config, with fallback to auth_token for backward compatibility in dev environments. Affected methods: - KnowledgeBaseTool._get_kb_info_via_http (POST /kb-size) - KnowledgeBaseTool._retrieve_with_strategy_via_http (POST /retrieve) - KbLsTool._list_docs_http_mode (POST /list-docs) - KbHeadTool._arun (POST /read-docs) - knowledge_factory._check_any_kb_has_rag_enabled (POST /kb-size)
cocowh
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Background
The
/internal/rag/*endpoints on the backend useverify_internal_service_tokenwhich checks againstsettings.INTERNAL_SERVICE_TOKEN, a shared secret for service-to-service authentication. The original code was sendingauth_token(a task token JWT fromExecutionRequest), which does NOT matchINTERNAL_SERVICE_TOKEN, resulting in persistent HTTP 401 errors.Bug Timeline
_get_kb_info_via_httpintroduced in6a2e18d9(feat(inbox): implement work queue and message forwarding system wecode-ai/Wegent#851) — no auth headers at allverify_internal_service_tokenin7fedc2a3(refactor(knowledge_runtime): switch RAG protocol from value mode to reference mode wecode-ai/Wegent#1030)self.auth_token(task token JWT) as auth headerINTERNAL_SERVICE_TOKEN, so 401 persistedFix
Changed all 5 internal RAG HTTP call sites to use a priority chain:
settings.INTERNAL_SERVICE_TOKEN(primary — shared secret for service-to-service)self.auth_token(task token JWT — for dev backward compat)Changes
chat_shell/chat_shell/tools/builtin/knowledge_base.py
_get_kb_info_via_http:settings.INTERNAL_SERVICE_TOKENorself.auth_token_retrieve_with_strategy_via_http:settings.INTERNAL_SERVICE_TOKENorself.auth_tokenchat_shell/chat_shell/tools/builtin/knowledge_listing.py
KbLsTool._list_docs_http_mode: added settings import,INTERNAL_SERVICE_TOKENorself.auth_tokenKbHeadTool._arun: added settings import,INTERNAL_SERVICE_TOKENorself.auth_tokenchat_shell/chat_shell/tools/knowledge_factory.py
_check_any_kb_has_rag_enabled:settings.INTERNAL_SERVICE_TOKENorauth_tokenparameter