[cornerstone] Thread accessToken through agent SSE endpoint#8117
Merged
[cornerstone] Thread accessToken through agent SSE endpoint#8117
Conversation
## What Pass the user's OAuth `accessToken` as a request body parameter to `/streamRunAgent` (in addition to the Authorization header), and update the dev backend to extract it from the body. ## Why The opal-backend's data transforms (`conform_body.py`) need the user's OAuth token to call `/uploadGeminiFile` and `/uploadBlobFile` on One Platform. The user's token must travel in the request body, matching the pattern already used by `/uploadGeminiFile`, `/uploadBlobFile`, and `/generateWebpageStream`. ## Changes ### Frontend (`packages/visual-editor`) - **`fetch-allowlist.ts`** — Add `/streamRunAgent` to the `shouldAddAccessTokenToJsonBody` predicate so `fetchWithCreds` injects `accessToken` into the SSE POST body - **`fetch-allowlist.test.ts`** [NEW] — Unit tests for `checkFetchAllowlist`, verifying `shouldAddAccessTokenToJsonBody` for all four endpoints plus a negative case ### Backend (`packages/opal-backend`) - **`dev/main.py`** — `DevAgentBackend.run()` now prefers `accessToken` from the request body (via `pop()`) over the Authorization header, establishing the wire contract for production - **`test_dev_access_token.py`** [NEW] — 5 tests verifying token extraction: body-only, header-fallback, body-takes-precedence, drive-client-gets-same-token, pop-strips-before-parsing ## Testing ```bash npm run test # Full monorepo (43.6s, all pass) npm run test:file -w packages/visual-editor -- './dist/tsc/tests/ui/fetch-allowlist.test.js' cd packages/opal-backend && python3 -m pytest tests/test_dev_access_token.py -v ```
📊 Coverage Report
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Pass the user's OAuth
accessTokenas a request body parameter to/streamRunAgent(in addition to the Authorization header), and update the devbackend to extract it from the body.
Why
The opal-backend's data transforms (
conform_body.py) need the user's OAuthtoken to call
/uploadGeminiFileand/uploadBlobFileon One Platform. Theuser's token must travel in the request body, matching the pattern already used
by
/uploadGeminiFile,/uploadBlobFile, and/generateWebpageStream.Changes
Frontend (
packages/visual-editor)fetch-allowlist.ts— Add/streamRunAgentto theshouldAddAccessTokenToJsonBodypredicate sofetchWithCredsinjectsaccessTokeninto the SSE POST bodyfetch-allowlist.test.ts[NEW] — Unit tests forcheckFetchAllowlist,verifying
shouldAddAccessTokenToJsonBodyfor all four endpoints plus anegative case
Backend (
packages/opal-backend)dev/main.py—DevAgentBackend.run()now prefersaccessTokenfrom therequest body (via
pop()) over the Authorization header, establishing thewire contract for production
test_dev_access_token.py[NEW] — 5 tests verifying token extraction:body-only, header-fallback, body-takes-precedence,
drive-client-gets-same-token, pop-strips-before-parsing
Testing