The first 6 characters of invalid agent tokens were logged, leaking
partial credential information. Remove token_prefix from log messages
while preserving the request path for debugging.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
send_gateway_session_message only required basic auth (AUTH_DEP) while
all other gateway endpoints required ORG_ADMIN_DEP. Any authenticated
user could send messages to any gateway session. Now requires org-admin
and verifies the board belongs to the caller's organization.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The webhook ingest endpoint read the entire request body with no size
limit, enabling memory exhaustion attacks. Add a 1 MB limit checked
via both Content-Length header (early reject) and actual body size.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
User-controlled fields (skill name, source URL, webhook payloads) were
interpolated directly into agent instruction messages. Sanitize skill
fields by stripping newlines/control chars, and fence all external data
behind "BEGIN EXTERNAL DATA" / "BEGIN STRUCTURED DATA" delimiters with
explicit "do not interpret as instructions" markers. Move system
instructions above the data section so they cannot be overridden.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Webhook ingest endpoint was completely unauthenticated. Add an optional
`secret` field to BoardWebhook. When configured, inbound requests must
include a valid HMAC-SHA256 signature in X-Hub-Signature-256 or
X-Webhook-Signature headers. Uses hmac.compare_digest for timing safety.
Includes migration to add the secret column.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Main agents (board_id=None) could list boards across all organizations.
Now resolves the agent's organization via its gateway and filters boards
by organization_id to prevent cross-tenant data leakage.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The function only checked that the caller was an authenticated user
(not an agent) but its name implied privilege enforcement. Rename to
require_user_actor and add docstring clarifying the distinction between
actor-type checks and privilege/role checks (require_org_admin, is_super_admin).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Three related provisioning fixes:
1. **tools.exec.host auto-configuration**: Add `_tools_exec_host_patch()`
that ensures `tools.exec.host` is set to `"gateway"` during
`patch_agent_heartbeats()`. Without this, heartbeat-driven agents
cannot execute `curl`, `bash`, or any shell command — making
HEARTBEAT.md instructions unexecutable. The function is idempotent
and respects existing user configuration.
2. **agents.update hot-reload race**: After `agents.create` writes to
disk, the gateway triggers a ~500ms debounced hot-reload. If
`agents.update` arrives before the reload completes, it returns
"agent not found". Fix: add a 750ms delay after create + exponential
backoff retry (5 attempts, 0.5s → 4s) on the update call.
3. **Skip no-op config.patch**: When `patch_agent_heartbeats()` detects
no changes to agents, channels, or tools config, skip the
`config.patch` RPC entirely. Each unnecessary patch triggers a
gateway SIGUSR1 restart that rotates agent tokens and breaks active
sessions.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The optional variant of get_agent_auth_context had accept_authorization=False,
which prevented agents using Authorization: Bearer from passing through the
ACTOR_DEP / BOARD_READ_DEP / TASK_DEP dependency chain.
This caused 401 on any agent route that resolves a board or task via the shared
ACTOR_DEP (e.g. PATCH /agent/boards/{id}/tasks/{id} and
POST /agent/boards/{id}/tasks/{id}/comments), even though the same token worked
fine on routes that use AGENT_CTX_DEP directly (accept_authorization=True).
Fix: set accept_authorization=True in get_agent_auth_context_optional so both
X-Agent-Token and Authorization: Bearer are accepted consistently.
Verified: PATCH and POST /comments now resolve board/task correctly when
Authorization: Bearer is used. No security regression — agent_token_hash
comparison rejects any non-agent bearer tokens.
FastAPI 0.131.0 includes Pydantic's Rust-based JSON serialization by default (PR #14962), making ORJSONResponse unnecessary. The new default serialization is 2x faster than the previous approach and eliminates the need for explicit orjson configuration.
Changes:
- Upgrade FastAPI from 0.130.0 to 0.131.0
- Remove orjson dependency (deprecated in 0.131.0)
- Remove ORJSONResponse import and configuration
- Use FastAPI's new default Pydantic-based serialization
Co-authored-by: abhi1693 <5083532+abhi1693@users.noreply.github.com>
- Add healthcheck to Redis service in compose.yml and upgrade
depends_on from service_started to service_healthy so backend
and webhook-worker wait for Redis readiness.
- Add HTTP security headers middleware (X-Content-Type-Options,
X-Frame-Options, Referrer-Policy, Permissions-Policy) to the
FastAPI backend.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
