You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix(server): port upstream PTY connect route authorization (anomalyco/opencode#58258) - #1615
With server auth enabled, a ticketed PTY WebSocket connect skips Basic/token auth so the handler can validate the ticket. That bypass was decided by hasPtyConnectTicketURL(url), a regex over the raw request URL, not by the route Effect actually dispatched, so authorization and routing could disagree about the path. The connect handler also looked the PTY up before checking origin and ticket, so an unauthenticated caller with a junk ticket or foreign Origin got 404 vs 403 and could probe which PTY IDs exist.
Ported from upstream:
anomalyco/opencode#58258: both authorization layers (packages/opencode instance HttpApi and packages/server) read HttpRouter.RouteContext and only bypass when route.route.path === PTY_CONNECT_PATH and a ticket query is present. The regex helpers are replaced by a shared PTY_CONNECT_PATH route constant used by the endpoint definitions.
anomalyco/opencode@7b39a338a0: both connect handlers check origin and consume the ticket before the PTY existence check.
All changes wrapped in altimate_change markers tagged upstream_fix:.
How did you verify your code works?
New test in test/server/httpapi-pty.test.ts: a junk ticket and a cross-origin connect to a missing PTY both return 403. It fails on main (404) and passes here.
test/upstream/adversarial/upi-server.test.ts updated for the route constant; httpapi-pty, upi-server and httpapi-listen tests pass (22 pass, 8 existing todo).
bun run typecheck clean in packages/opencode and packages/server; bun run script/upstream/analyze.ts --markers --base origin/main --strict clean.
Cost side effects
None. No model calls, queries or resources added.
Screenshots / recordings
N/A, no UI change.
Checklist
I have tested my changes locally
I have not included unrelated changes in this PR
I checked for cost side effects (model calls, queries or cloud resources that grow with user data) and described them, or wrote "none"
Fixes PTY WebSocket connect authorization so the ticket bypass is keyed to the matched route rather than a raw-URL regex, and bad-origin or bad-ticket requests now return 403 before revealing whether a PTY exists.
Bug Fixes
Both authorization layers (packages/opencode and packages/server) now read HttpRouter.RouteContext and only bypass credential checks when the matched route is the PTY connect path with a ticket query, so authorization cannot disagree with dispatch.
The connect handlers now validate origin and consume the ticket before the PTY existence check, so junk tickets and cross-origin requests to missing PTYs get 403 instead of 404.
Replaced the regex path helpers with a shared PTY_CONNECT_PATH route constant used by both endpoint definitions.
Written for commit f269fbd. Summary will update on new commits.
CI note: the TypeScript job reports 1 test(s) failed, but I can't open the job log from this session (log storage host isn't reachable), and re-running the job via the API returns 403.
Locally on this branch the PTY/auth suites pass: httpapi-pty, httpapi-v2-pty, httpapi-instance-route-auth, httpapi-listen, httpapi-public-openapi, upi-server and test/upstream. The only local failures are test/cli/run time-budget subprocess tests and skill create scaffold, which fail the same way on main in this environment (no node, timing-sensitive). Could a maintainer re-run the job or say which test failed?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue for this PR
Closes #1614
Type of change
What does this PR do?
With server auth enabled, a ticketed PTY WebSocket connect skips Basic/token auth so the handler can validate the ticket. That bypass was decided by
hasPtyConnectTicketURL(url), a regex over the raw request URL, not by the route Effect actually dispatched, so authorization and routing could disagree about the path. The connect handler also looked the PTY up before checking origin and ticket, so an unauthenticated caller with a junk ticket or foreignOrigingot 404 vs 403 and could probe which PTY IDs exist.Ported from upstream:
packages/opencodeinstance HttpApi andpackages/server) readHttpRouter.RouteContextand only bypass whenroute.route.path === PTY_CONNECT_PATHand aticketquery is present. The regex helpers are replaced by a sharedPTY_CONNECT_PATHroute constant used by the endpoint definitions.All changes wrapped in
altimate_changemarkers taggedupstream_fix:.How did you verify your code works?
test/server/httpapi-pty.test.ts: a junk ticket and a cross-origin connect to a missing PTY both return 403. It fails onmain(404) and passes here.test/upstream/adversarial/upi-server.test.tsupdated for the route constant;httpapi-pty,upi-serverandhttpapi-listentests pass (22 pass, 8 existing todo).bun run typecheckclean inpackages/opencodeandpackages/server;bun run script/upstream/analyze.ts --markers --base origin/main --strictclean.Cost side effects
None. No model calls, queries or resources added.
Screenshots / recordings
N/A, no UI change.
Checklist
Written by Devin
Summary by cubic
Fixes PTY WebSocket connect authorization so the ticket bypass is keyed to the matched route rather than a raw-URL regex, and bad-origin or bad-ticket requests now return 403 before revealing whether a PTY exists.
Bug Fixes
packages/opencodeandpackages/server) now readHttpRouter.RouteContextand only bypass credential checks when the matched route is the PTY connect path with aticketquery, so authorization cannot disagree with dispatch.PTY_CONNECT_PATHroute constant used by both endpoint definitions.Written for commit f269fbd. Summary will update on new commits.