fix(gateway): separate auth check from device identity omission for auth-none

chenyangjun-xy · ClawSweeper · chenyangjun-xy · commit b8ee16a07969 · 2026-07-02T00:13:42.000+08:00
Separate two concerns that were conflated in callGatewayWithScopes:

1. **Shared-auth check** (hasLocalBackendSharedAuth): auth mode none satisfies
   the local-backend shared-auth requirement → no error thrown
2. **Device identity omission** (omitDeviceIdentity): auth-none keeps the existing
   device-less self-pairing bypass (shouldSkipLocalBackendSelfPairing) on the
   server side → device identity intentionally omitted

Previously the PR removed allowAuthNone entirely, making auth-none
identity-bearing. Per codex review, auth-none must remain device-less
because the server-side bypass already preserves scopes correctly for
device-less local backend connections.

Co-authored-by: ClawSweeper &lt;codex@anthropic.com&gt;
diff --git a/src/gateway/call.test.ts b/src/gateway/call.test.ts
@@ -923,7 +923,7 @@ describe("callGateway url resolution", () => {
     expect(lastClientOptions?.deviceIdentity).toBeNull();
   });
 
-  it("preserves device identity with local backend auth-none (operator scopes survive)", async () => {
+  it("satisfies local backend shared auth with auth-none without a device identity", async () => {
     getRuntimeConfig.mockReturnValue({
       gateway: { mode: "local", bind: "loopback", auth: { mode: "none" } },
     });
@@ -940,8 +940,10 @@ describe("callGateway url resolution", () => {
     expect(lastClientOptions?.scopes).toEqual(["operator.read", "operator.pairing"]);
     expect(lastClientOptions?.token).toBeUndefined();
     expect(lastClientOptions?.password).toBeUndefined();
-    // auth mode "none" no longer strips device identity; operator scopes like operator.write must survive
-    expect(lastClientOptions?.deviceIdentity).not.toBeNull();
+    // auth mode "none" keeps the device-less self-pairing bypass; device identity
+    // is intentionally omitted so the server-side shouldSkipLocalBackendSelfPairing
+    // can preserve requested scopes without requiring paired-device checks.
+    expect(lastClientOptions?.deviceIdentity).toBeNull();
   });
 
   it("rejects required local backend shared auth for remote targets", async () => {
diff --git a/src/gateway/call.ts b/src/gateway/call.ts
@@ -485,10 +485,12 @@ function shouldOmitDeviceIdentityForGatewayCall(params: {
   url: string;
   token?: string;
   password?: string;
+  allowAuthNone?: boolean;
 }): boolean {
   const mode = params.opts.mode ?? GATEWAY_CLIENT_MODES.CLI;
   const clientName = params.opts.clientName ?? GATEWAY_CLIENT_NAMES.CLI;
-  const hasDirectLocalBackendAuth = Boolean(params.token || params.password);
+  const hasDirectLocalBackendAuth =
+    Boolean(params.token || params.password) || params.allowAuthNone === true;
   return (
     mode === GATEWAY_CLIENT_MODES.BACKEND &&
     clientName === GATEWAY_CLIENT_NAMES.GATEWAY_CLIENT &&
@@ -1151,17 +1153,22 @@ async function callGatewayWithScopes<T = Record<string, unknown>>(
   const tlsFingerprint = await resolveGatewayTlsFingerprint({ opts, context, url });
   const token = useStoredDeviceAuth ? undefined : resolvedCredentials.token;
   const password = useStoredDeviceAuth ? undefined : resolvedCredentials.password;
-  // auth mode "none" satisfies the local-backend shared-auth check but must not
-  // strip device identity, which would drop operator scopes like operator.write.
+  // auth mode "none" satisfies the local-backend shared-auth requirement without
+  // token / password credentials.  It also triggers device-identity omission so
+  // the server-side device-less self-pairing bypass (shouldSkipLocalBackendSelfPairing)
+  // preserves requested scopes — pairing the two concerns keeps the auth-none
+  // path safe.
+  const allowAuthNone =
+    opts.requireLocalBackendSharedAuth === true &&
+    resolveGatewayCallAuth(context.config).mode === "none";
   const hasLocalBackendSharedAuth =
-    Boolean(token || password) ||
-    (opts.requireLocalBackendSharedAuth === true &&
-      resolveGatewayCallAuth(context.config).mode === "none");
+    Boolean(token || password) || allowAuthNone;
   const omitDeviceIdentity = shouldOmitDeviceIdentityForGatewayCall({
     opts,
     url,
     token,
     password,
+    allowAuthNone,
   });
   if (opts.requireLocalBackendSharedAuth && !hasLocalBackendSharedAuth) {
     throw new GatewayLocalBackendSharedAuthUnavailableError(
