fix(gateway): separate auth check from device identity omission for auth-none

chenyangjun-xy · chenyangjun-xy · commit 893abf627a20 · 2026-07-02T07:27:51.000+08:00
Separate two concerns that were conflated in callGatewayWithScopes:

1. **Shared-auth check** (hasLocalBackendSharedAuth): auth mode none satisfies
   the local-backend shared-auth requirement → no error thrown
2. **Device identity omission** (omitDeviceIdentity): keep allowAuthNone in
   shouldOmitDeviceIdentityForGatewayCall so auth-none triggers the existing
   device-less self-pairing bypass (shouldSkipLocalBackendSelfPairing) on the
   server side → device identity intentionally omitted, scopes preserved

The server-side shouldSkipLocalBackendSelfPairing returns true for auth
method none, which skips clearUnboundScopes and allows requested operator
scopes (including operator.write) to survive the handshake without requiring
paired-device checks. Keeping auth-none device-less preserves this contract.
diff --git a/src/gateway/call.test.ts b/src/gateway/call.test.ts
@@ -923,7 +923,7 @@ describe("callGateway url resolution", () => {
     expect(lastClientOptions?.deviceIdentity).toBeNull();
   });
 
-  it("uses local backend auth-none without a device identity when required", async () => {
+  it("satisfies local backend shared auth with auth-none without a device identity", async () => {
     getRuntimeConfig.mockReturnValue({
       gateway: { mode: "local", bind: "loopback", auth: { mode: "none" } },
     });
@@ -940,6 +940,9 @@ describe("callGateway url resolution", () => {
     expect(lastClientOptions?.scopes).toEqual(["operator.read", "operator.pairing"]);
     expect(lastClientOptions?.token).toBeUndefined();
     expect(lastClientOptions?.password).toBeUndefined();
+    // auth mode "none" keeps the device-less self-pairing bypass; device identity
+    // is intentionally omitted so the server-side shouldSkipLocalBackendSelfPairing
+    // can preserve requested scopes without requiring paired-device checks.
     expect(lastClientOptions?.deviceIdentity).toBeNull();
   });
 
diff --git a/src/gateway/call.ts b/src/gateway/call.ts
@@ -1153,17 +1153,23 @@ async function callGatewayWithScopes<T = Record<string, unknown>>(
   const tlsFingerprint = await resolveGatewayTlsFingerprint({ opts, context, url });
   const token = useStoredDeviceAuth ? undefined : resolvedCredentials.token;
   const password = useStoredDeviceAuth ? undefined : resolvedCredentials.password;
+  // auth mode "none" satisfies the local-backend shared-auth requirement without
+  // token / password credentials.  It also triggers device-identity omission so
+  // the server-side device-less self-pairing bypass (shouldSkipLocalBackendSelfPairing)
+  // preserves requested scopes — pairing the two concerns keeps the auth-none
+  // path safe.
   const allowAuthNone =
     opts.requireLocalBackendSharedAuth === true &&
     resolveGatewayCallAuth(context.config).mode === "none";
+  const hasLocalBackendSharedAuth = Boolean(token || password) || allowAuthNone;
   const omitDeviceIdentity = shouldOmitDeviceIdentityForGatewayCall({
     opts,
     url,
     token,
     password,
     allowAuthNone,
   });
-  if (opts.requireLocalBackendSharedAuth && !omitDeviceIdentity) {
+  if (opts.requireLocalBackendSharedAuth && !hasLocalBackendSharedAuth) {
     throw new GatewayLocalBackendSharedAuthUnavailableError(
       "local backend shared auth requires a loopback gateway with token/password credentials or auth mode none",
     );
