fix(auth): surface distinct scope-mismatch reason for device token failures#79295
Closed
hclsys wants to merge 1 commit into
Closed
fix(auth): surface distinct scope-mismatch reason for device token failures#79295hclsys wants to merge 1 commit into
hclsys wants to merge 1 commit into
Conversation
…ilures
When verifyDeviceToken returns reason="scope-mismatch" (the device token's
approved scopes do not cover the requested connection scopes), the auth
pipeline previously collapsed this into the generic device_token_mismatch
error, causing clients to rotate/reissue a perfectly valid token.
Surface a distinct device_token_scope_mismatch reason and error message
("re-pair this device to request the current scope set") so clients can
take the right corrective action. Adds AUTH_DEVICE_TOKEN_SCOPE_MISMATCH
error detail code for protocol-level classification.
Fixes openclaw#79292.
openclaw-barnacle
Bot
added
app: web-ui
|
Closing this PR because the author has more than 20 active PRs in this repo. Please reduce the active PR queue and reopen or resubmit once it is back under the limit. You can close your own PRs to get back under the limit. |
|
Closing this PR because the author has more than 20 active PRs in this repo. Please reduce the active PR queue and reopen or resubmit once it is back under the limit. You can close your own PRs to get back under the limit. |
github-actions Bot
pushed a commit
to Desicool/openclaw
that referenced
this pull request
May 24, 2026
Preserve full shared-token operator sessions while reusing bootstrap/cached device-token scopes for handoff reconnects. Surface device-token scope mismatches as AUTH_SCOPE_MISMATCH and stop reconnect retry loops without clearing valid stored tokens. Fixes openclaw#79292. Supersedes openclaw#79314, openclaw#79296, openclaw#79295.
jameslcowan
pushed a commit
to jameslcowan/openclaw
that referenced
this pull request
Jun 2, 2026
Preserve full shared-token operator sessions while reusing bootstrap/cached device-token scopes for handoff reconnects. Surface device-token scope mismatches as AUTH_SCOPE_MISMATCH and stop reconnect retry loops without clearing valid stored tokens. Fixes openclaw#79292. Supersedes openclaw#79314, openclaw#79296, openclaw#79295.
sablehead
pushed a commit
to sablehead/openclaw
that referenced
this pull request
Jun 10, 2026
Preserve full shared-token operator sessions while reusing bootstrap/cached device-token scopes for handoff reconnects. Surface device-token scope mismatches as AUTH_SCOPE_MISMATCH and stop reconnect retry loops without clearing valid stored tokens. Fixes openclaw#79292. Supersedes openclaw#79314, openclaw#79296, openclaw#79295.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
When
verifyDeviceTokenreturnsreason: "scope-mismatch"(the token's approved scopes do not cover the requested connection scopes), the auth pipeline collapsed this into the genericdevice_token_mismatcherror and message — misleading clients into rotating/reissuing a perfectly valid token.VerifyDeviceTokenResulttype to includereason?: stringscope-mismatchas a distinctdevice_token_scope_mismatchreason instead of collapsing itAUTH_DEVICE_TOKEN_SCOPE_MISMATCHerror detail code toConnectErrorDetailCodes"device_token_scope_mismatch"message case: "unauthorized: device token scope mismatch (re-pair this device to request the current scope set)"verifyDeviceTokenreturningscope-mismatch→authResult.reason === "device_token_scope_mismatch"Fixes #79292.
Root cause (from issue)
macOS/iOS/Control UI clients request 5 scopes including
operator.adminandoperator.pairing. Bootstrap token issuance strips those two (the allowlist only has 4), so the stored device token has 4 scopes. On reconnect with 5 scopes,verifyDeviceTokenat line 896/900 ofdevice-pairing.tsreturns{ ok: false, reason: "scope-mismatch" }.resolveConnectAuthDecisiondropped thereasonfield (the localVerifyDeviceTokenResulttype was{ ok: boolean }) and emitteddevice_token_mismatch— the wrong diagnosis.Test plan
src/gateway/server/ws-connection/auth-context.test.ts— new test: scope-mismatch reason propagates asdevice_token_scope_mismatch; all 30 tests passsrc/gateway/protocol/connect-error-details.test.ts— all 26 tests passformatGatewayAuthFailureMessageorreadConnectAuthDecisionErrorDetailCodeneed changes — additive switch case🤖 Generated with Claude Code