didericis/bot-bottle
1
0
Fork 0
Code Issues 37 Pull Requests 4 Actions Packages Releases Wiki Activity

egress: preserve_auth flag for per-route Authorization passthrough #453

Merged
didericis merged 1 commits from egress-preserve-auth-for-registry-routes into main 2026-07-21 15:02:02 -04:00
Conversation 0 Commits 1 Files Changed 6
+73 -5
didericis-claude commented 2026-07-21 14:10:04 -04:00
Collaborator
Copy Link
Copy Source

Closes #392.

Summary

  • Adds a preserve_auth: true boolean field to egress route entries. When set, the gateway skips its normal Authorization header strip for that host, allowing the agent's own bearer token to reach the upstream.
  • Intended for registry endpoints like Docker Hub (registry-1.docker.io) and GHCR (ghcr.io), where the agent must supply a client-fetched per-scope token the gateway cannot inject itself.
  • Threaded through ManifestEgressRoute → EgressRoute → Route, serialized in route_to_yaml_dict, and parsed in parse_routes in the addon core.
  • The auth strip in egress_addon.py now checks route.preserve_auth before popping the header.
  • Default is false; no existing behavior changes.

Usage

In a bottle manifest:

egress:
  routes:
    - host: registry-1.docker.io
      preserve_auth: true
    - host: ghcr.io
      preserve_auth: true
Closes #392. ## Summary - Adds a `preserve_auth: true` boolean field to egress route entries. When set, the gateway skips its normal Authorization header strip for that host, allowing the agent's own bearer token to reach the upstream. - Intended for registry endpoints like Docker Hub (`registry-1.docker.io`) and GHCR (`ghcr.io`), where the agent must supply a client-fetched per-scope token the gateway cannot inject itself. - Threaded through `ManifestEgressRoute` → `EgressRoute` → `Route`, serialized in `route_to_yaml_dict`, and parsed in `parse_routes` in the addon core. - The auth strip in `egress_addon.py` now checks `route.preserve_auth` before popping the header. - Default is `false`; no existing behavior changes. ## Usage In a bottle manifest: ```yaml egress: routes: - host: registry-1.docker.io preserve_auth: true - host: ghcr.io preserve_auth: true ```
didericis-claude added 1 commit 2026-07-21 14:10:06 -04:00
feat(egress): add preserve_auth flag to pass agent Authorization through
tracker-policy-pr / check-pr (pull_request) Successful in 6s
Details
test / integration-docker (pull_request) Successful in 13s
Details
test / unit (pull_request) Successful in 35s
Details
lint / lint (push) Successful in 2m28s
Details
test / integration-firecracker (pull_request) Successful in 3m34s
Details
test / coverage (pull_request) Successful in 16s
Details
test / publish-infra (pull_request) Has been skipped
Details
b1ef83ac84 
Adds a per-route boolean field preserve_auth (default false) that skips
the gateway's Authorization header stripping for that host. Intended for
registry endpoints like Docker Hub (registry-1.docker.io) and GHCR
(ghcr.io) where the agent must supply its own per-scope bearer token.

Threaded through ManifestEgressRoute → EgressRoute → Route, serialized
in route_to_yaml_dict, and parsed in parse_routes. The strip at
egress_addon.py now checks route.preserve_auth before popping the header.

Closes #392
didericis merged commit ccd987a501 into main 2026-07-21 15:02:02 -04:00
didericis deleted branch egress-preserve-auth-for-registry-routes 2026-07-21 15:02:03 -04:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
Compat/Breaking
Breaking change that won't be backward compatible
 Kind/Bug
Something is not working
 Kind/Documentation
Documentation changes
 Kind/Enhancement
Improve existing functionality
 Kind/Feature
New functionality
 Kind/Security
This is security issue
 Kind/Testing
Issue or pull request related to testing
Priority
Critical
1
The priority is critical
Priority
High
2
The priority is high
Priority
Low
4
The priority is low
Priority
Medium
3
The priority is medium
Reviewed
Confirmed
1
Issue has been confirmed
Reviewed
Duplicate
2
This issue or pull request already exists
Reviewed
Invalid
3
Invalid issue
Reviewed
Won't Fix
3
This issue won't be fixed
Status
Abandoned
3
Somebody has started to work on this but abandoned work
Status
Blocked
1
Something is blocking this issue or pull request
Status
Need More Info
2
Feedback is required to reproduce issue or to continue work
Status/Needs Triage
Awaiting initial classification
No Label
Milestone
No items
No Milestone
Assignees
Clear assignees
didericis-claude (didericis (claude)) didericis-codex (didericis (codex)) didericis-gemma (gemma) didericis
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: didericis/bot-bottle#453
Delete Branch "egress-preserve-auth-for-registry-routes"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?