Skip to content

Migrate settings auth from encrypted tokens to Redis sessions #152

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
buremba wants to merge 6 commits into from
Closed

Migrate settings auth from encrypted tokens to Redis sessions #152

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
641fe25
fix(security): prevent settings token from leaking to agent
claude Mar 4, 2026
ea3e33b
fix(security): prevent token/URL leaks to agent across all link-gener…
claude Mar 4, 2026
4157c0f
feat(auth): replace encrypted tokens with Redis sessions + provider-a…
claude Mar 4, 2026
ef124b5
fix(auth): update bootstrap page to use session ID instead of token
claude Mar 4, 2026
b653659
refactor(auth): simplify to ?s= query params, remove all hash fragmen…
claude Mar 4, 2026
5132fce
cleanup(auth): remove legacy token functions and update tests
claude Mar 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
522 changes: 281 additions & 241 deletions packages/gateway/src/__tests__/base-provider-module-auth.test.ts
View file
Open in desktop

Large diffs are not rendered by default.

180 changes: 85 additions & 95 deletions packages/gateway/src/__tests__/link-buttons.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,99 +2,89 @@ import { describe, expect, test } from "bun:test";
import { extractSettingsLinkButtons } from "../platform/link-buttons";

describe("extractSettingsLinkButtons", () => {
test("extracts settings link and replaces with label", () => {
const content =
"Click [Open Settings](https://example.com/settings#st=abc123) to continue";
const { processedContent, linkButtons } =
extractSettingsLinkButtons(content);

expect(linkButtons).toHaveLength(1);
expect(linkButtons[0]!.text).toBe("Open Settings");
expect(linkButtons[0]!.url).toBe("https://example.com/settings#st=abc123");
expect(processedContent).toBe("Click Open Settings to continue");
expect(processedContent).not.toContain("https://");
});

test("extracts settings link with query param (?st=)", () => {
const content = "[Settings](https://example.com/settings?st=token123)";
const { linkButtons } = extractSettingsLinkButtons(content);

expect(linkButtons).toHaveLength(1);
expect(linkButtons[0]!.url).toBe(
"https://example.com/settings?st=token123"
);
});

test("extracts multiple settings links", () => {
const content =
"[First](https://a.com/settings#st=1) and [Second](https://b.com/settings#st=2)";
const { processedContent, linkButtons } =
extractSettingsLinkButtons(content);

expect(linkButtons).toHaveLength(2);
expect(processedContent).toBe("First and Second");
});

test("filters out localhost URLs", () => {
const content = "[Settings](http://localhost:3000/settings#st=token)";
const { processedContent, linkButtons } =
extractSettingsLinkButtons(content);

expect(linkButtons).toHaveLength(0);
// Label still replaces the link
expect(processedContent).toBe("Settings");
});

test("filters out 127.0.0.1 URLs", () => {
const content = "[Settings](http://127.0.0.1/settings#st=token)";
const { linkButtons } = extractSettingsLinkButtons(content);
expect(linkButtons).toHaveLength(0);
});

test("does not match non-settings links", () => {
const content = "[Home](https://example.com/home)";
const { processedContent, linkButtons } =
extractSettingsLinkButtons(content);

expect(linkButtons).toHaveLength(0);
expect(processedContent).toBe(content); // unchanged
});

test("does not match links without st= parameter", () => {
const content = "[Settings](https://example.com/settings)";
const { processedContent, linkButtons } =
extractSettingsLinkButtons(content);

expect(linkButtons).toHaveLength(0);
expect(processedContent).toBe(content);
});

test("returns empty buttons for content without links", () => {
const content = "No links here, just plain text";
const { processedContent, linkButtons } =
extractSettingsLinkButtons(content);

expect(linkButtons).toHaveLength(0);
expect(processedContent).toBe(content);
});

test("handles HTTP and HTTPS", () => {
const httpContent = "[A](http://example.com/settings#st=x)";
const httpsContent = "[B](https://example.com/settings#st=y)";

const httpResult = extractSettingsLinkButtons(httpContent);
const httpsResult = extractSettingsLinkButtons(httpsContent);

expect(httpResult.linkButtons).toHaveLength(1);
expect(httpsResult.linkButtons).toHaveLength(1);
});

test("mixed localhost and remote links only keeps remote", () => {
const content =
"[Local](http://localhost/settings#st=a) and [Remote](https://app.com/settings#st=b)";
const { linkButtons } = extractSettingsLinkButtons(content);

expect(linkButtons).toHaveLength(1);
expect(linkButtons[0]!.url).toContain("app.com");
});
test("extracts settings link and replaces with label", () => {
const content =
"Click [Open Settings](https://example.com/settings?s=abc123) to continue";
const { processedContent, linkButtons } =
extractSettingsLinkButtons(content);

expect(linkButtons).toHaveLength(1);
expect(linkButtons[0]!.text).toBe("Open Settings");
expect(linkButtons[0]!.url).toBe("https://example.com/settings?s=abc123");
expect(processedContent).toBe("Click Open Settings to continue");
expect(processedContent).not.toContain("https://");
});

test("extracts multiple settings links", () => {
const content =
"[First](https://a.com/settings?s=1) and [Second](https://b.com/settings?s=2)";
const { processedContent, linkButtons } =
extractSettingsLinkButtons(content);

expect(linkButtons).toHaveLength(2);
expect(processedContent).toBe("First and Second");
});

test("filters out localhost URLs", () => {
const content = "[Settings](http://localhost:3000/settings?s=token)";
const { processedContent, linkButtons } =
extractSettingsLinkButtons(content);

expect(linkButtons).toHaveLength(0);
// Label still replaces the link
expect(processedContent).toBe("Settings");
});

test("filters out 127.0.0.1 URLs", () => {
const content = "[Settings](http://127.0.0.1/settings?s=token)";
const { linkButtons } = extractSettingsLinkButtons(content);
expect(linkButtons).toHaveLength(0);
});

test("does not match non-settings links", () => {
const content = "[Home](https://example.com/home)";
const { processedContent, linkButtons } =
extractSettingsLinkButtons(content);

expect(linkButtons).toHaveLength(0);
expect(processedContent).toBe(content); // unchanged
});

test("does not match links without s= parameter", () => {
const content = "[Settings](https://example.com/settings)";
const { processedContent, linkButtons } =
extractSettingsLinkButtons(content);

expect(linkButtons).toHaveLength(0);
expect(processedContent).toBe(content);
});

test("returns empty buttons for content without links", () => {
const content = "No links here, just plain text";
const { processedContent, linkButtons } =
extractSettingsLinkButtons(content);

expect(linkButtons).toHaveLength(0);
expect(processedContent).toBe(content);
});

test("handles HTTP and HTTPS", () => {
const httpContent = "[A](http://example.com/settings?s=x)";
const httpsContent = "[B](https://example.com/settings?s=y)";

const httpResult = extractSettingsLinkButtons(httpContent);
const httpsResult = extractSettingsLinkButtons(httpsContent);

expect(httpResult.linkButtons).toHaveLength(1);
expect(httpsResult.linkButtons).toHaveLength(1);
});

test("mixed localhost and remote links only keeps remote", () => {
const content =
"[Local](http://localhost/settings?s=a) and [Remote](https://app.com/settings?s=b)";
const { linkButtons } = extractSettingsLinkButtons(content);

expect(linkButtons).toHaveLength(1);
expect(linkButtons[0]!.url).toContain("app.com");
});
});
Loading
Loading