@vellumai/assistant 0.12.2-dev.202609212215.5512e77 → 0.12.2-dev.202609212314.ad5e307

package/README.md

@@ -183,7 +183,7 @@ Internal forwarding routes (`/v1/internal/twilio/*`) are unaffected — these ac
 The `/channels/inbound` endpoint requires a JWT with the `svc_gateway` principal type and `ingress.write` scope to prove the request originated from the gateway. This ensures channel messages can only arrive via the gateway (which performs webhook-level verification) and not via direct HTTP calls that bypass signature checks.
 
 - **JWT-based enforcement:** The route policy in `route-policy.ts` restricts `/channels/inbound` to the `svc_gateway` principal type with `ingress.write` scope. Actor and local principals are rejected with 403.
-- **Auth bypass:** When `DISABLE_HTTP_AUTH=true` is set (platform-managed deployments), JWT verification is skipped and a synthetic context is used.
+- **Auth bypass:** When `DISABLE_HTTP_AUTH=true` is set (platform-managed deployments), a request that supplies no `Authorization` header gets a synthetic context. A request that supplies one is verified normally, and a token that fails verification is rejected.
 
 ## Twilio Setup Primitive
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.12.2-dev.202609212215.5512e77",
+  "version": "0.12.2-dev.202609212314.ad5e307",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/approval-routes-http.test.ts

@@ -241,8 +241,10 @@ function makeConfirmationEmittingSession(opts?: {
 // Tests
 // ---------------------------------------------------------------------------
 
-const TEST_TOKEN = "test-bearer-token-approvals";
-const AUTH_HEADERS = { Authorization: `Bearer ${TEST_TOKEN}` };
+// This suite mocks isHttpAuthDisabled() to true, so a request carrying no
+// bearer authenticates through the dev bypass. A bearer that is present is
+// verified against the signing key, which these tests do not set up.
+const AUTH_HEADERS: Record<string, string> = {};
 
 describe("standalone approval endpoints — HTTP layer", () => {
   let server: RuntimeHttpServer;

package/src/__tests__/call-routes-http.test.ts

@@ -82,8 +82,10 @@ await initializeDb();
 // Helpers
 // ---------------------------------------------------------------------------
 
-const TEST_TOKEN = "test-bearer-token-calls";
-const AUTH_HEADERS = { Authorization: `Bearer ${TEST_TOKEN}` };
+// This suite mocks isHttpAuthDisabled() to true, so a request carrying no
+// bearer authenticates through the dev bypass. A bearer that is present is
+// verified against the signing key, which these tests do not set up.
+const AUTH_HEADERS: Record<string, string> = {};
 
 let ensuredConvIds = new Set<string>();
 

package/src/__tests__/runtime-attachment-metadata.test.ts

@@ -55,8 +55,10 @@ afterAll(() => {
   resetDbForTesting();
 });
 
-const TEST_TOKEN = "test-bearer-token-attach";
-const AUTH_HEADERS = { Authorization: `Bearer ${TEST_TOKEN}` };
+// This suite mocks isHttpAuthDisabled() to true, so a request carrying no
+// bearer authenticates through the dev bypass. A bearer that is present is
+// verified against the signing key, which these tests do not set up.
+const AUTH_HEADERS: Record<string, string> = {};
 
 describe("Runtime attachment metadata", () => {
   let server: RuntimeHttpServer;

package/src/__tests__/send-endpoint-busy.test.ts

@@ -302,8 +302,10 @@ function makePendingApprovalConversation(
 // Tests
 // ---------------------------------------------------------------------------
 
-const TEST_TOKEN = "test-bearer-token-send";
-const AUTH_HEADERS = { Authorization: `Bearer ${TEST_TOKEN}` };
+// This suite mocks isHttpAuthDisabled() to true, so a request carrying no
+// bearer authenticates through the dev bypass. A bearer that is present is
+// verified against the signing key, which these tests do not set up.
+const AUTH_HEADERS: Record<string, string> = {};
 
 describe("POST /v1/messages — queue-if-busy and hub publishing", () => {
   let server: RuntimeHttpServer;

package/src/persistence/embeddings/embedding-gemini.test.ts

@@ -439,6 +439,23 @@ describe("GeminiEmbeddingBackend: batched text inputs", () => {
     expect(vectors.map((v) => v[0])).toEqual(texts(250).map(textIndex));
   });
 
+  test("managed text inputs use single calls from the first request and preserve vector order", async () => {
+    const fetchMock = routedFetch();
+    globalThis.fetch = fetchMock as unknown as typeof fetch;
+    const backend = new GeminiEmbeddingBackend("test-key", "test-model", {
+      managedBaseUrl: "https://proxy.example.com/v1/runtime-proxy/gemini",
+      interCallDelayMs: 0,
+    });
+
+    expect(await backend.embed(texts(3))).toEqual([[0], [1], [2]]);
+    expect(await backend.embed(["t4", "t5"])).toEqual([[4], [5]]);
+    expect(calledUrls(fetchMock)).toEqual(
+      Array(5).fill(
+        "https://proxy.example.com/v1/runtime-proxy/gemini/v1beta/models/test-model:embedContent",
+      ),
+    );
+  });
+
   test("each batched request names the model with the models/ prefix and carries taskType and outputDimensionality", async () => {
     const fetchMock = routedFetch();
     globalThis.fetch = fetchMock as unknown as typeof fetch;

package/src/persistence/embeddings/embedding-gemini.ts

@@ -71,7 +71,8 @@ export class GeminiEmbeddingBackend implements EmbeddingBackend {
   }
 
   /**
-   * Embed `inputs` in order. Runs of text inputs go through
+   * Embed `inputs` in order. Managed requests use single `embedContent`
+   * calls because Vertex does not expose the batch route. Direct text runs use
    * `batchEmbedContents`, {@link GEMINI_EMBED_BATCH_SIZE} texts per round
    * trip, so a corpus re-embed costs one request per hundred sections rather
    * than one per section; a lone text and every multimodal input take the
@@ -99,6 +100,7 @@ export class GeminiEmbeddingBackend implements EmbeddingBackend {
       // Gather the run of text inputs starting here, up to one batch.
       let end = i;
       while (
+        !this.managed &&
         !this.batchRouteUnavailable &&
         end < normalized.length &&
         end - i < GEMINI_EMBED_BATCH_SIZE &&

package/src/runtime/auth/__tests__/middleware.test.ts

@@ -325,6 +325,144 @@ describe("authenticateRequest for /v1/host-browser-result", () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// Dev bypass covers only a request that supplied no Authorization header. A
+// bearer sent to a platform pod (the gateway's exchange token, or a trusted
+// contact's) is verified on its own terms.
+// ---------------------------------------------------------------------------
+
+describe("authenticateRequest with auth disabled and a bearer present", () => {
+  beforeEach(() => {
+    authDisabled = true;
+  });
+
+  test("uses the token's claims rather than the dev-bypass context", () => {
+    const token = mintValidToken({ sub: "actor:self:contact-principal" });
+
+    const req = new Request("http://localhost/v1/messages", {
+      method: "POST",
+      headers: { Authorization: `Bearer ${token}` },
+    });
+
+    const result = authenticateRequest(req);
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.context.actorPrincipalId).toBe("contact-principal");
+      expect(result.context.policyEpoch).toBe(CURRENT_POLICY_EPOCH);
+    }
+  });
+
+  test("accepts the gateway's exchange token", () => {
+    const token = mintValidToken({
+      sub: "svc:gateway:self",
+      scope_profile: "gateway_service_v1",
+    });
+
+    const req = new Request("http://localhost/v1/messages", {
+      method: "POST",
+      headers: { Authorization: `Bearer ${token}` },
+    });
+
+    const result = authenticateRequest(req);
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.context.principalType).toBe("svc_gateway");
+    }
+  });
+
+  test("accepts a gateway-audience token through the fallback", () => {
+    const token = mintValidToken({
+      aud: "vellum-gateway",
+      sub: "actor:self:local-client",
+    });
+
+    const req = new Request("http://localhost/v1/messages", {
+      method: "POST",
+      headers: { Authorization: `Bearer ${token}` },
+    });
+
+    const result = authenticateRequest(req);
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.context.actorPrincipalId).toBe("local-client");
+      expect(result.context.assistantId).toBe(DAEMON_INTERNAL_ASSISTANT_ID);
+    }
+  });
+
+  test.each([
+    ["malformed", () => "not-a-token.xxxxxxxxxxxxx"],
+    [
+      "expired",
+      () => mintValidToken({ exp: Math.floor(Date.now() / 1000) - 100 }),
+    ],
+    [
+      "wrong-audience",
+      () => mintValidToken({ aud: "vellum-other" as TokenAudience }),
+    ],
+    ["unparseable-sub", () => mintValidToken({ sub: "garbage" })],
+  ])("refuses a %s token rather than falling back", (_label, build) => {
+    const req = new Request("http://localhost/v1/messages", {
+      method: "POST",
+      headers: { Authorization: `Bearer ${build()}` },
+    });
+
+    const result = authenticateRequest(req);
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.response.status).toBe(401);
+    }
+  });
+
+  test("still returns the dev-bypass context when no bearer is sent", () => {
+    const req = new Request("http://localhost/v1/messages", {
+      method: "POST",
+    });
+
+    const result = authenticateRequest(req);
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.context.actorPrincipalId).toBe("dev-bypass");
+    }
+  });
+
+  test("verifies a lowercase bearer scheme rather than bypassing it", () => {
+    const token = mintValidToken({ sub: "actor:self:contact-principal" });
+
+    const req = new Request("http://localhost/v1/messages", {
+      method: "POST",
+      headers: { Authorization: `bearer ${token}` },
+    });
+
+    const result = authenticateRequest(req);
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.context.actorPrincipalId).toBe("contact-principal");
+    }
+  });
+
+  test.each([
+    ["lowercase scheme with a bad token", "bearer not-a-jwt.xxxxxxxx"],
+    ["empty credential", "Bearer "],
+    ["non-bearer scheme", "Basic dXNlcjpwYXNz"],
+    ["an empty header value", ""],
+    ["a whitespace-only header value", "   "],
+  ])(
+    "refuses %s instead of granting the dev-bypass context",
+    (_label, header) => {
+      const req = new Request("http://localhost/v1/messages", {
+        method: "POST",
+        headers: { Authorization: header },
+      });
+
+      const result = authenticateRequest(req);
+      expect(result.ok).toBe(false);
+      if (!result.ok) {
+        expect(result.response.status).toBe(401);
+      }
+    },
+  );
+});
+
 // ---------------------------------------------------------------------------
 // oauth_proxy_v1 grants: the narrow bearer a third-party CLI presents to the
 // OAuth passthrough route. Accepted on either audience, and carrying nothing

package/src/runtime/auth/middleware.ts

@@ -17,9 +17,10 @@
  * Replaces both the legacy bearer shared-secret check and the
  * actor-token HMAC middleware with a single JWT verification path.
  *
- * When DISABLE_HTTP_AUTH is set (platform-managed deployments), JWT
- * verification is skipped and a synthetic AuthContext is constructed
- * so downstream code always has a typed context to consume.
+ * When DISABLE_HTTP_AUTH is set (platform-managed deployments), a request
+ * carrying no bearer gets a synthetic AuthContext so downstream code always
+ * has a typed context to consume. A request that carries one is verified
+ * normally, and a bad token is refused rather than falling back.
  */
 
 import { isHttpAuthDisabled } from "../../config/env.js";
@@ -73,17 +74,18 @@ function buildDevBypassContext(): AuthContext {
  * The caller should return the error Response directly to the client.
  */
 export function authenticateRequest(req: Request): AuthenticateResult {
-  // Dev bypass: skip JWT verification entirely
-  if (isHttpAuthDisabled()) {
-    return { ok: true, context: buildDevBypassContext() };
-  }
-
-  const path = new URL(req.url).pathname;
-
   const rawToken = extractBearerToken(req);
   if (!rawToken) {
+    // Dev bypass covers only a request that supplied no Authorization header
+    // at all. A header that is present but unusable (empty or whitespace-only
+    // value, a non-bearer scheme, a malformed credential) is refused rather
+    // than handed the guardian context. `has` rather than `get`: an empty
+    // value reads back as "" and would otherwise pass as absent.
+    if (isHttpAuthDisabled() && !req.headers.has("authorization")) {
+      return { ok: true, context: buildDevBypassContext() };
+    }
     log.warn(
-      { reason: "missing_token", path },
+      { reason: "missing_token", path: new URL(req.url).pathname },
       "Auth denied: missing Authorization header",
     );
     return {
@@ -100,6 +102,8 @@ export function authenticateRequest(req: Request): AuthenticateResult {
     };
   }
 
+  const path = new URL(req.url).pathname;
+
   // Verify the JWT — prefer vellum-daemon audience (gateway-proxied requests
   // and daemon-minted tokens), but also accept vellum-gateway audience for
   // direct local clients (macOS SettingsStore) that hold a guardian-issued JWT

package/src/runtime/middleware/auth.ts

@@ -156,8 +156,14 @@ export function isPrivateNetworkOrigin(req: Request): boolean {
 /**
  * Extract and validate a bearer token from the Authorization header.
  * Returns the token string if present, or null.
+ *
+ * The scheme is matched case-insensitively, per RFC 7235 and to match the
+ * gateway's own parsing. An empty credential returns null.
  */
 export function extractBearerToken(req: Request): string | null {
   const authHeader = req.headers.get("authorization");
-  return authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : null;
+  if (!authHeader?.toLowerCase().startsWith("bearer ")) {
+    return null;
+  }
+  return authHeader.slice(7) || null;
 }