ceos/opencode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(server): include auth challenge on typed 401 (#26455)

Browse source
This commit is contained in:
Kit Langton 2026-05-09 00:15:20 -04:00 • committed by GitHub
commit 8cbc43fbb0
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 9 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

9
packages/opencode/src/server/routes/instance/httpapi/middleware/authorization.ts
View file

@ -1,6 +1,6 @@
import { ServerAuth } from "@/server/auth" import { ServerAuth } from "@/server/auth"
import { Effect, Encoding, Layer, Redacted } from "effect" import { Effect, Encoding, Layer, Redacted } from "effect"
import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/unstable/http" import { HttpEffect, HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/unstable/http"
import { HttpApiError, HttpApiMiddleware } from "effect/unstable/httpapi" import { HttpApiError, HttpApiMiddleware } from "effect/unstable/httpapi"
import { hasPtyConnectTicketURL } from "@/server/shared/pty-ticket" import { hasPtyConnectTicketURL } from "@/server/shared/pty-ticket"
import { isPublicUIPath } from "@/server/shared/public-ui" import { isPublicUIPath } from "@/server/shared/public-ui"
@ -33,7 +33,12 @@ function validateCredential<A, E, R>(
) { ) {
return Effect.gen(function* () { return Effect.gen(function* () {
if (!ServerAuth.required(config)) return yield* effect if (!ServerAuth.required(config)) return yield* effect
if (!ServerAuth.authorized(credential, config)) return yield* new HttpApiError.Unauthorized({}) if (!ServerAuth.authorized(credential, config)) {
yield* HttpEffect.appendPreResponseHandler((_request, response) =>
Effect.succeed(HttpServerResponse.setHeader(response, "www-authenticate", WWW_AUTHENTICATE)),
)
return yield* new HttpApiError.Unauthorized({})
}
return yield* effect return yield* effect
}) })
} }

2
packages/opencode/test/server/httpapi-authorization.test.ts
View file

@ -72,7 +72,9 @@ describe("HttpApi authorization middleware", () => {
) )
expect(missing.status).toBe(401) expect(missing.status).toBe(401)
expect(missing.headers["www-authenticate"] ?? "").toContain("Basic")
expect(badPassword.status).toBe(401) expect(badPassword.status).toBe(401)
expect(badPassword.headers["www-authenticate"] ?? "").toContain("Basic")
expect(good.status).toBe(200) expect(good.status).toBe(200)
}), }),
) )