Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Advanced Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
✅ Deterministic PR hygiene checks passed. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d4b1f87a11
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if (ctx.req.method !== "GET" && ( | ||
| ctx.principal !== "gui-session" | ||
| || ctx.sessionControl?.isPaired(ctx.req, ctx.config) !== true | ||
| )) { |
There was a problem hiding this comment.
When the Hub dashboard is opened directly, the page is automatically given a loopback or tailscale-identity session, but gui/src/App.tsx renders ConnectPairingForm only for a connected-client topology and only while no shared session exists. This new check therefore makes every Remote Workspace mutation return 403 without exposing any UI path to obtain the required pairing-issued session; even a manually paired session is replaced by an automatic one after reloading the Hub page. Add an in-dashboard upgrade path for these read-only sessions before enforcing this gate.
Useful? React with 👍 / 👎.
| ctx.principal !== "gui-session" | ||
| || ctx.sessionControl?.isPaired(ctx.req, ctx.config) !== true | ||
| )) { | ||
| return Response.json({ error: "A paired dashboard session is required for Remote Workspace changes." }, { status: 403 }); |
There was a problem hiding this comment.
For an enabled workspace mutation authorized as admin-token, this branch now returns the new “paired dashboard session” error, while tests/clients/remote-workspace-activation.test.ts still asserts the previous exact JSON string. That test will deterministically fail in the normal test suite, so its expected response must be updated with this behavior change.
Useful? React with 👍 / 👎.
github-actions
Bot
changed the title
⏳ DRAFT
What to do
Its title has been prefixed with |
1 participant
Motivation
gui-sessionprincipal, which can be minted and replayed by local non-browser processes and thus did not guarantee interactive, operator-mediated dashboard consent.Description
isPairedtoManagementSessionControland implementcurrentSession(...)to re-evaluate session provenance using the full GUI session predicate (src/server/management-auth.ts).handleRemoteWorkspaceRoutesOnDemand(src/server/management-api.ts) and at route-level checks viasessionOnly(src/server/management/remote-workspace-routes.ts).tests/clients/remote-workspace-management.test.ts,tests/server/server-management-auth.test.ts).structure/remote-workspace.md,docs-site/src/content/docs/guides/remote-workspace.md,docs-site/src/content/docs/reference/management-api.md).Testing
npx --yes bun@latest test tests/server/server-management-auth.test.ts --test-name-pattern 'remote session admission shares'andnpx --yes bun@latest test tests/clients/remote-workspace-management.test.ts, both passed.bun run typecheckandbun run structure:checkand privacy scan withbun run privacy:scan(all succeeded).(cd docs-site && bun install --frozen-lockfile && bun run build), which succeeded.Codex Task