tagword-codeagent 1.2.6__tar.gz → 1.2.8__tar.gz

{tagword_codeagent-1.2.6/tagword_codeagent.egg-info → tagword_codeagent-1.2.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tagword-codeagent
-Version: 1.2.6
+Version: 1.2.8
 Summary: Autonomous AI coding agent driven by Markdown config — DeepSeek-ready, CLI + Web UI, 45+ tools, self-hosted
 License: MIT
 Project-URL: Homepage, https://github.com/tagword/codeagent
@@ -27,7 +27,7 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: seed-kernel
 Requires-Dist: seed-model-providers>=1.0.3
-Requires-Dist: seed-toolbox[code]>=1.0.8
+Requires-Dist: seed-toolbox[code]>=1.0.9
 Requires-Dist: uvicorn[standard]>=0.30.0
 Requires-Dist: starlette>=0.37.0
 Provides-Extra: dev

{tagword_codeagent-1.2.6 → tagword_codeagent-1.2.8}/codeagent/server/a2a/agent_card.py

@@ -10,6 +10,8 @@ from __future__ import annotations
 import os
 from typing import Any
 
+from .auth import auth_enabled
+
 PROTOCOL_VERSION = "0.2.5"
 
 
@@ -74,12 +76,20 @@ def build_agent_card() -> dict[str, Any]:
                 "outputModes": ["text"],
             }
         ],
-        "securitySchemes": {
-            "bearer": {
-                "type": "http",
-                "scheme": "bearer",
-                "description": "Bearer token（复用 WebUI token，见 config/webui.token）",
+        # 认证声明与真实行为一致：未配置 token 时不声明 security，
+        # 否则客户端会带 token 而服务端根本不校验（声明与实现脱节）。
+        **(
+            {
+                "securitySchemes": {
+                    "bearer": {
+                        "type": "http",
+                        "scheme": "bearer",
+                        "description": "Bearer token（复用 WebUI token，见 config/webui.token）",
+                    }
+                },
+                "security": [{"bearer": []}],
             }
-        },
-        "security": [{"bearer": []}],
+            if auth_enabled()
+            else {}
+        ),
     }

tagword_codeagent-1.2.8/codeagent/server/a2a/auth.py

@@ -0,0 +1,59 @@
+"""A2A Bearer 认证 — 复用 WebUI token。
+
+设计要点：
+- **单一 token 源**：复用 `codeagent.web.auth_impl.get_webui_token()`，
+  即 `CODEAGENT_WEBUI_TOKEN` 环境变量或 `config/webui.token` 文件。
+  不引入第二套密钥，避免运维分裂。
+- **未配置 token 时放行**：与 WebUI 行为一致（未设 token = 本机开发模式，
+  WebUI 本身也不鉴权）。此时 Agent Card 不声明 security，客户端不会带 token。
+- **常量时间比较**：`hmac.compare_digest` 防时序侧信道。
+- **认证在 JSON-RPC 入口统一做**：所有方法（含 `message/stream` SSE）
+  都经过 `a2a_jsonrpc`，故一处拦截即全覆盖。
+"""
+
+from __future__ import annotations
+
+import hmac
+import logging
+
+from starlette.requests import Request
+
+logger = logging.getLogger(__name__)
+
+# JSON-RPC 错误码：-32001 = 未授权（A2A/实现自定义区间 -32000..-32099）
+ERR_UNAUTHORIZED = -32001
+
+
+def get_a2a_token() -> str:
+    """返回期望的 Bearer token；空字符串表示未启用认证。"""
+    try:
+        from codeagent.web.auth_impl import get_webui_token
+
+        return get_webui_token()
+    except Exception:  # noqa: BLE001 - 认证不可用时不阻断服务
+        logger.warning("a2a: 无法读取 webui token，A2A 认证降级为关闭", exc_info=True)
+        return ""
+
+
+def auth_enabled() -> bool:
+    """是否启用 A2A 认证（配置了 token 才启用）。"""
+    return bool(get_a2a_token())
+
+
+def _extract_bearer(request: Request) -> str:
+    raw = request.headers.get("authorization") or ""
+    parts = raw.split(None, 1)
+    if len(parts) == 2 and parts[0].lower() == "bearer":
+        return parts[1].strip()
+    return ""
+
+
+def check_request(request: Request) -> bool:
+    """校验请求是否通过认证。未配置 token 时恒为 True。"""
+    expected = get_a2a_token()
+    if not expected:
+        return True
+    got = _extract_bearer(request)
+    if not got:
+        return False
+    return hmac.compare_digest(got.encode("utf-8"), expected.encode("utf-8"))

{tagword_codeagent-1.2.6 → tagword_codeagent-1.2.8}/codeagent/server/a2a/handlers.py

@@ -18,6 +18,7 @@ from starlette.requests import Request
 from starlette.responses import JSONResponse
 
 from .agent_card import build_agent_card
+from .auth import ERR_UNAUTHORIZED, check_request
 from .context import ContextError, context_id_for_task, record_task
 from .context import resolve as resolve_context
 from .models import (
@@ -52,7 +53,13 @@ async def a2a_jsonrpc(request: Request):
     """POST /a2a — A2A JSON-RPC 2.0 入口。
 
     ``message/stream`` 返回 SSE 流（StreamingResponse），其余返回 JSON。
+
+    认证在此统一校验：所有方法（含 SSE）都经过本入口。
     """
+    # ── Bearer 认证（未配置 token 时放行，见 auth.py）──
+    if not check_request(request):
+        return _rpc_error(None, ERR_UNAUTHORIZED, "Unauthorized: invalid or missing Bearer token")
+
     try:
         body = await request.json()
     except Exception:

{tagword_codeagent-1.2.6 → tagword_codeagent-1.2.8}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "tagword-codeagent"
-version = "1.2.6"
+version = "1.2.8"
 description = "Autonomous AI coding agent driven by Markdown config — DeepSeek-ready, CLI + Web UI, 45+ tools, self-hosted"
 readme = "README.md"
 license = { text = "MIT" }
@@ -29,7 +29,7 @@ classifiers = [
 dependencies = [
     "seed-kernel",
     "seed-model-providers>=1.0.3",
-    "seed-toolbox[code]>=1.0.8",
+    "seed-toolbox[code]>=1.0.9",
     "uvicorn[standard]>=0.30.0",
     "starlette>=0.37.0"
 ]

{tagword_codeagent-1.2.6 → tagword_codeagent-1.2.8/tagword_codeagent.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tagword-codeagent
-Version: 1.2.6
+Version: 1.2.8
 Summary: Autonomous AI coding agent driven by Markdown config — DeepSeek-ready, CLI + Web UI, 45+ tools, self-hosted
 License: MIT
 Project-URL: Homepage, https://github.com/tagword/codeagent
@@ -27,7 +27,7 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: seed-kernel
 Requires-Dist: seed-model-providers>=1.0.3
-Requires-Dist: seed-toolbox[code]>=1.0.8
+Requires-Dist: seed-toolbox[code]>=1.0.9
 Requires-Dist: uvicorn[standard]>=0.30.0
 Requires-Dist: starlette>=0.37.0
 Provides-Extra: dev

{tagword_codeagent-1.2.6 → tagword_codeagent-1.2.8}/tagword_codeagent.egg-info/SOURCES.txt

@@ -78,6 +78,7 @@ codeagent/server/webui_handlers_skills.py
 codeagent/server/webui_handlers_teams.py
 codeagent/server/a2a/__init__.py
 codeagent/server/a2a/agent_card.py
+codeagent/server/a2a/auth.py
 codeagent/server/a2a/client.py
 codeagent/server/a2a/client_card.py
 codeagent/server/a2a/context.py
@@ -210,6 +211,7 @@ tagword_codeagent.egg-info/entry_points.txt
 tagword_codeagent.egg-info/requires.txt
 tagword_codeagent.egg-info/top_level.txt
 tests/test_a2a.py
+tests/test_a2a_auth.py
 tests/test_a2a_context.py
 tests/test_a2a_streaming.py
 tests/test_a2a_tool.py

{tagword_codeagent-1.2.6 → tagword_codeagent-1.2.8}/tagword_codeagent.egg-info/requires.txt

@@ -1,6 +1,6 @@
 seed-kernel
 seed-model-providers>=1.0.3
-seed-toolbox[code]>=1.0.8
+seed-toolbox[code]>=1.0.9
 uvicorn[standard]>=0.30.0
 starlette>=0.37.0
 

{tagword_codeagent-1.2.6 → tagword_codeagent-1.2.8}/tests/test_a2a.py

@@ -40,7 +40,11 @@ def test_agent_card_structure():
     skill = card["skills"][0]
     for key in ("id", "name", "description", "inputModes", "outputModes"):
         assert key in skill
-    assert "securitySchemes" in card
+    # security 声明与 auth_enabled() 一致（未配置 token 时不声明），
+    # 两种状态各自的行为由 test_a2a_auth.py 覆盖。
+    from codeagent.server.a2a.auth import auth_enabled
+
+    assert ("securitySchemes" in card) is auth_enabled()
 
 
 def test_agent_card_endpoint(client):
@@ -79,6 +83,16 @@ def test_empty_text(client):
 
 
 # ---------- 项目校验默认放行 ----------
+@pytest.fixture(autouse=True)
+def _no_a2a_auth(monkeypatch):
+    """禁用 A2A 认证，隔离本机 config/webui.token 的影响。
+
+    认证行为由 tests/test_a2a_auth.py 专门覆盖；本文件测的是协议逻辑，
+    若读取真实 token 文件，所有用例都会因缺 Bearer 头而 401。
+    """
+    monkeypatch.setattr(ai, "get_webui_token", lambda *a, **k: "")
+
+
 @pytest.fixture(autouse=True)
 def _allow_any_project(monkeypatch):
     """默认认为任意 projectId 都存在，避免每个测试都要 mock。

tagword_codeagent-1.2.8/tests/test_a2a_auth.py

@@ -0,0 +1,147 @@
+"""A2A Bearer 认证测试。
+
+覆盖 4 种情形 + 声明一致性：
+1. 未配置 token → 放行（本机开发模式），且 Agent Card 不声明 security
+2. 配置 token + 无 Authorization → 401 语义（JSON-RPC -32001）
+3. 配置 token + 错误 token → 拒绝
+4. 配置 token + 正确 token → 通过
+5. Agent Card 的 security 声明与 auth_enabled() 一致（声明不脱节）
+
+认证在 JSON-RPC 入口统一做，故 message/send 与 message/stream 均覆盖。
+"""
+
+import pytest
+from starlette.applications import Starlette
+from starlette.routing import Route
+from starlette.testclient import TestClient
+
+from codeagent.server.a2a import a2a_agent_card, a2a_jsonrpc
+from codeagent.server.a2a.agent_card import build_agent_card
+from codeagent.server.a2a.auth import ERR_UNAUTHORIZED, auth_enabled, check_request
+from codeagent.web import auth_impl as ai
+
+TOKEN = "test-a2a-secret-token"
+
+
+@pytest.fixture()
+def client():
+    app = Starlette(routes=[
+        Route("/.well-known/agent-card.json", a2a_agent_card, methods=["GET"]),
+        Route("/a2a", a2a_jsonrpc, methods=["POST"]),
+    ])
+    return TestClient(app)
+
+
+@pytest.fixture()
+def no_token(monkeypatch):
+    monkeypatch.setattr(ai, "get_webui_token", lambda *a, **k: "")
+    return None
+
+
+@pytest.fixture()
+def with_token(monkeypatch):
+    monkeypatch.setattr(ai, "get_webui_token", lambda *a, **k: TOKEN)
+    return TOKEN
+
+
+def _rpc_body():
+    return {
+        "jsonrpc": "2.0",
+        "id": 1,
+        "method": "message/send",
+        "params": {
+            "message": {
+                "role": "user",
+                "parts": [{"kind": "text", "text": "hi"}],
+                "messageId": "m-1",
+                "contextId": "ctx-auth",
+            }
+        },
+    }
+
+
+# ---------- 1. 未配置 token：放行 ----------
+def test_no_token_configured_allows_request(client, no_token):
+    r = client.post("/a2a", json=_rpc_body())
+    assert r.status_code == 200
+    assert r.json().get("error", {}).get("code") != ERR_UNAUTHORIZED
+
+
+def test_auth_disabled_when_no_token(no_token):
+    assert auth_enabled() is False
+
+
+# ---------- 2. 配置 token + 无 header：拒绝 ----------
+def test_missing_header_rejected(client, with_token, monkeypatch):
+    # 避免真的跑 chat turn：认证失败应在进入业务逻辑前返回
+    r = client.post("/a2a", json=_rpc_body())
+    assert r.status_code == 200  # JSON-RPC 错误走 200 + error 字段
+    err = r.json().get("error") or {}
+    assert err.get("code") == ERR_UNAUTHORIZED
+
+
+# ---------- 3. 配置 token + 错误 token：拒绝 ----------
+def test_wrong_token_rejected(client, with_token):
+    r = client.post("/a2a", json=_rpc_body(), headers={"Authorization": "Bearer wrong"})
+    err = r.json().get("error") or {}
+    assert err.get("code") == ERR_UNAUTHORIZED
+
+
+def test_non_bearer_scheme_rejected(client, with_token):
+    r = client.post("/a2a", json=_rpc_body(), headers={"Authorization": f"Basic {TOKEN}"})
+    err = r.json().get("error") or {}
+    assert err.get("code") == ERR_UNAUTHORIZED
+
+
+# ---------- 4. 配置 token + 正确 token：通过 ----------
+def test_correct_token_accepted(client, with_token, monkeypatch):
+    """认证通过后应进入业务逻辑（此处用假 run_chat_turn 隔离）。"""
+    import codeagent.server.a2a.handlers as h
+
+    async def fake_turn(**kwargs):
+        return {"text": "pong", "tools_used": [], "token_usage": {}}
+
+    monkeypatch.setattr(h, "run_chat_turn", fake_turn, raising=False)
+    r = client.post("/a2a", json=_rpc_body(), headers={"Authorization": f"Bearer {TOKEN}"})
+    assert r.status_code == 200
+    assert "error" not in r.json()
+
+
+def test_token_case_insensitive_scheme(client, with_token, monkeypatch):
+    """`bearer` 小写也应被接受（HTTP 认证方案大小写不敏感）。"""
+    import codeagent.server.a2a.handlers as h
+
+    async def fake_turn(**kwargs):
+        return {"text": "pong", "tools_used": [], "token_usage": {}}
+
+    monkeypatch.setattr(h, "run_chat_turn", fake_turn, raising=False)
+    r = client.post("/a2a", json=_rpc_body(), headers={"Authorization": f"bearer {TOKEN}"})
+    assert "error" not in r.json()
+
+
+# ---------- 5. Agent Card 声明与实现一致 ----------
+def test_card_declares_security_when_token_configured(with_token):
+    card = build_agent_card()
+    assert "security" in card
+    assert "bearer" in card.get("securitySchemes", {})
+
+
+def test_card_omits_security_when_no_token(no_token):
+    card = build_agent_card()
+    assert "security" not in card
+    assert "securitySchemes" not in card
+
+
+# ---------- check_request 单元级 ----------
+def test_check_request_uses_constant_time_compare(with_token):
+    class _Req:
+        headers = {"authorization": f"Bearer {TOKEN}"}
+
+    assert check_request(_Req()) is True
+
+
+def test_check_request_empty_header(with_token):
+    class _Req:
+        headers = {}
+
+    assert check_request(_Req()) is False