[GH-ISSUE #450] Admin authentication header differs between OpenAPI and server implementation #112

New issue

Open

opened 2026-10-29 14:19:43 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-29 14:19:43 +00:00

Owner

Originally created by @guozy18 on GitHub (Oct 29, 2026).
Original GitHub issue: https://github.com/kvcache-ai/AgentENV/issues/450

Documentation problem

Incorrect

Location

src/api/openapi.yml (AdminApiKeyAuth); src/api/impls/auth.rs

Current content or problem

GET /nodes is documented with X-Admin-Token, but the server checks x-api-key. The authentication adapter ignores the supplied header-name argument, so clients following the schema receive 401 even with the correct key.

With the same valid key:

X-Admin-Token: <key> → HTTP 401
x-api-key: <key> → HTTP 200

This mismatch already exists on main; it was exposed by #341's snapshot-pull client.

Suggested correction

Choose one supported header and align the OpenAPI schema, server authentication, and clients. Add a regression test through the actual /nodes authentication path.

Additional context

Verified at aed3eca2 using unchanged Rust authentication code and the generated /nodes handler in an isolated HTTP harness (node-list payload stubbed). The original Go snapshot fetcher also received 401. This was not a full node deployment.

The authentication implementation is unchanged from the PR base:

Contribution

I am only reporting the problem

Pre-submission checklist

I searched existing issues and did not find a duplicate.

Originally created by @guozy18 on GitHub (Oct 29, 2026). Original GitHub issue: https://github.com/kvcache-ai/AgentENV/issues/450 ### Documentation problem Incorrect ### Location src/api/openapi.yml (AdminApiKeyAuth); src/api/impls/auth.rs ### Current content or problem GET /nodes is documented with `X-Admin-Token`, but the server checks `x-api-key`. The authentication adapter ignores the supplied header-name argument, so clients following the schema receive 401 even with the correct key. With the same valid key: - `X-Admin-Token: <key>` → HTTP 401 - `x-api-key: <key>` → HTTP 200 This mismatch already exists on main; it was exposed by #341's snapshot-pull client. ### Suggested correction Choose one supported header and align the OpenAPI schema, server authentication, and clients. Add a regression test through the actual /nodes authentication path. ### Additional context Verified at aed3eca2 using unchanged Rust authentication code and the generated /nodes handler in an isolated HTTP harness (node-list payload stubbed). The original Go snapshot fetcher also received 401. This was not a full node deployment. The authentication implementation is unchanged from the PR base: - [OpenAPI declaration](https://github.com/kvcache-ai/AgentENV/blob/8e05a676b1fcd4b4851152eac73ccc82e16b91a9/src/api/openapi.yml#L24-L27) - [Authentication adapter](https://github.com/kvcache-ai/AgentENV/blob/8e05a676b1fcd4b4851152eac73ccc82e16b91a9/src/api/impls/auth.rs#L139-L146) ### Contribution I am only reporting the problem ### Pre-submission checklist - [x] I searched existing issues and did not find a duplicate.

bsakaguchi added the

documentation

label

2026-10-29 14:19:43 +00:00

bsakaguchi referenced this issue

2026-10-29 14:20:49 +00:00

[PR #112] [CLOSED] chore(scripts): add API benchmark and smoke scripts #189