config preflight exits 0 on allow_unauthenticated_users = true
维护者通常 1 天内回复
评估
调研方向
在 Rust 代码（可能是一个 CLI crate）中找到 openshell-gateway config preflight 子命令。检查当前以 exit 0 退出的配置验证，并在 [openshell.gateway.auth] 下当 allow_unauthenticated_users = true 时添加警告。使用该设置运行 preflight，确认警告打印的同时 exit code 保持为 0。
由索引模型根据 Issue 内容生成。
描述
Summary
openshell-gateway config preflight validates the shape of a configuration but not whether its choices are ones an operator should permit. In particular it exits 0, silently, on allow_unauthenticated_users = true — the one switch that turns v0.1.6's refusal-to-start-unauthenticated back into v0.1.5's warn-and-continue.
Measured on v0.1.6
Four arms, same binary, same host:
| config | result |
|---|---|
| valid config | exit 0, silent |
compute_driver = "not-a-driver" |
exit 1, category=malformed |
| malformed TOML | exit 1 |
allow_unauthenticated_users = true under [openshell.gateway.auth] |
exit 0, silent |
Why this seems worth a signal
v0.1.6 added the refusal to start without OIDC, mTLS user, operator auth, or gateway JWTs (#4814 — thank you, it is a real hardening over 0.1.5's warn-only behaviour). allow_unauthenticated_users is documented as the escape hatch for "trusted local development only", and that is a reasonable thing to provide.
The gap is that preflight is the tool an operator reaches for before starting the service, and it gives the same silent exit 0 for a correctly-authenticated configuration and for one that has opted out of authentication entirely. With the Docker compute driver the gateway holds a socket that is root-equivalent on its host, so the difference between those two configurations is not a small one.
Suggestion
A warning rather than a failure would fit the stated purpose: the switch is deliberate and documented, so failing preflight on it would break the development workflow it exists for. Something like
warning: allow_unauthenticated_users = true — inbound authentication is disabled
(documented for trusted local development only)
would mean an operator who ran preflight cannot have missed it, and exit 0 would still hold for anyone who meant it. A --strict mode that failed on it would also work, if that fits the CLI's conventions better.
Related
- #4814 introduced the refusal this switch opts out of.
- #3959 reports adjacent preflight gaps on 0.1.2 — preflight not naming the offending key, and exit 0 on a configuration whose
CreateSandboxcalls then fail. That issue is about configurations that are invalid but unreported; this one is about a configuration that is valid but unsafe, which is why it is filed separately rather than as a comment there.
Happy to re-measure on a newer release if that is useful.
- 主要语言
- Rust
- 星标
- 20.6k
- 派生
- 2k
- 平均合并
- 2 天 13 小时
- 30 天内合并 PR
- 262
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
NVIDIA/OpenShell 的其他 Issue
-
state:triage-needed
难度 2/5 1-3 小时 新手友好度 62/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 84/100
维护者通常 1 天内回复
-
bug(python): OIDC refresh drops the gateway's oidc_scopes可能重新可做 @jyotir07 于 7 天前认领，目前没有进行中的 PR。 未关闭state:triage-needed
难度 2/5 1-3 小时 新手友好度 84/100
NVIDIA/OpenShell#4919 · 3 条评论 ·
维护者通常 1 天内回复
-
bug: workspace access hint suggests a --subject command that fails for hyphen-leading OIDC subjects可能重新可做 关联的 PR 已关闭且未合并。 未关闭
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 76/100
维护者通常 1 天内回复
相似的 Issue
-
priority: low ☕️ type: bug 🐛
难度 2/5 1-3 小时 新手友好度 62/100
维护者通常 1 天内回复
-
area:docs documentation good first issue priority:medium
难度 1/5 1 小时以内 新手友好度 78/100
维护者通常 1 天内回复
-
feature
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复
-
agent-self
难度 2/5 1-3 小时 新手友好度 62/100
yologdev/yoyo-evolve#1117 · 1 条评论 ·
-
[Bug]: streamed Responses API flex_unavailable error maps to 500 InternalServerError instead of 429未关闭llm translation
难度 2/5 1 小时以内 新手友好度 85/100
BerriAI/litellm#49736 · 1 条评论 ·
维护者通常 1 天内回复