Tempo session close/top-up/voucher retry ignore the challenge's credential header (requiresAuth)

Cerrado
  • ¿Algo no está bien?
#930 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

@nniiovoo ya está trabajando en esto.

Desde el 29/9/2026.

  • #931 de @nniiovoo — abierto

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
25/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Estancado
Stack tecnológico
node.js, typescript
Área
api, authentication, payments

Línea de trabajo

Start in src/tempo/session/client/Transports.ts at postManagementCredential, requestInitWithAuthorization, and closeHttpSession, then inspect the HEAD bootstrap in SessionManager.ts. Run the four tests added in PR #931 against main and trace the requiresAuth flow. Done means top-up, voucher retry, close, and bootstrap use the challenge credential header without overwriting the app's Authorization header.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Check existing issues
Describe the bug

With Mppx.create({ requiresAuth: true }) (added in #821), every challenge carries header="Payment-Authorization" and the server reads the credential only from that header. The core client follows it (Challenge.credentialHeader), so opening a Tempo session and ordinary vouchers work. But sessionManager's own requests hard-code Authorization:

Those requests send the credential in Authorization, which the requiresAuth transport doesn't read, so the server answers 402. In the flow below, both close POSTs get 402 and close() rejects, so the channel isn't closed cooperatively. Top-up and the voucher retry hit the same 402. The voucher retry and the bootstrap also overwrite the app's own Authorization header, which requiresAuth is meant to keep free.

I'd like to submit a PR for this.

Link to Minimal Reproducible Example

https://github.com/wevm/mppx/pull/931 (its four new tests fail on main)

Steps To Reproduce

Server: Mppx.create({ requiresAuth: true, methods: [tempo.session({ unitType: 'request', ... })] }) from mppx/server. Client: sessionManager({ ... }) from mppx/client. Then call manager.fetch(url) twice and manager.close(). Requests as the server sees them:

GET  cred-in=none                  -> 402
GET  cred-in=Payment-Authorization action=open    -> 200
GET  cred-in=none                  -> 402
GET  cred-in=Payment-Authorization action=voucher -> 200
POST cred-in=Authorization         action=close   -> 402
POST cred-in=Authorization         action=close   -> 402
close() throws: Close request failed with status 402: Payment is required. [WWW-Authenticate: Payment ... header="Payment-Authorization"]

The same flow with requiresAuth: false closes normally. I ran this with the mocked chain clients from src/tempo/session/server/Session.test.ts.

Package Version

0.11.0 (reproduced on main @ 42e9b8f)

Anything else?

Node.js v26.8.2, macOS. Challenge.credentialHeader(challenge) already exists, and so does the core client's setCredentialHeader. Using them at those four places fixes it for sessionManager. The CLI's own session close (src/cli/plugins/tempo.ts, closeChannel) and the legacy v1 session manager have the same hard-coded header; I left those for a follow-up.

Lenguaje dominante
TypeScript
Estrellas
189
Forks
75
Merge medio
20 h 3 min
PR fusionados (30 d)
108

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de wevm/mppx

Todos los issues de wevm/mppx

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.