Skip to content

πŸ› fix: slove the list connection always use require auth & should have trust client auth#13344

Merged
ONLY-yours merged 1 commit intocanaryfrom
fix/marketAuthAddTrustClient
Mar 27, 2026
Merged

πŸ› fix: slove the list connection always use require auth & should have trust client auth#13344
ONLY-yours merged 1 commit intocanaryfrom
fix/marketAuthAddTrustClient

Conversation

@ONLY-yours
Copy link
Copy Markdown
Member

@ONLY-yours ONLY-yours commented Mar 27, 2026

…trust client check

πŸ’» Change Type

  • ✨ feat
  • πŸ› fix
  • ♻️ refactor
  • πŸ’„ style
  • πŸ‘· build
  • ⚑️ perf
  • βœ… test
  • πŸ“ docs
  • πŸ”¨ chore

πŸ”— Related Issue

πŸ”€ Description of Change

πŸ§ͺ How to Test

  • Tested locally
  • Added/updated tests
  • No tests needed

πŸ“Έ Screenshots / Videos

Before After
... ...

πŸ“ Additional Information

@vercel
Copy link
Copy Markdown

vercel bot commented Mar 27, 2026 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
lobehub Ready Ready Preview, Comment Mar 27, 2026 0:19am

Request Review

@ONLY-yours ONLY-yours changed the title πŸ› fix: slove the list connection always use require auth & should have … πŸ› fix: slove the list connection always use require auth & should have trust client auth Mar 27, 2026
sourcery-ai[bot]
sourcery-ai bot reviewed Mar 27, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@sourcery-ai sourcery-ai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We've reviewed this pull request using the Sourcery rules engine

@lobehubbot
Copy link
Copy Markdown
Member

lobehubbot commented Mar 27, 2026

@nekomeowww @tjx666 - This PR fixes a marketplace SDK TRPC middleware auth issue (trust client check). It touches server-side middleware and router code. Please take a look.

chatgpt-codex-connector[bot]
chatgpt-codex-connector bot reviewed Mar 27, 2026
View reviewed changes
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ’‘ Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2415e5ae37

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with πŸ‘.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

src/libs/trpc/lambda/middleware/marketSDK.ts
Comment on lines +46 to +47
if (isTrustedClientEnabled()) {
return opts.next();
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector bot Mar 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Keep auth guard active when trusted client is enabled

requireMarketAuth now returns early whenever trusted-client env vars are set, before checking ctx.marketAccessToken/ctx.marketUserInfo. That bypasses the only local auth gate for credsProcedure (src/server/routers/lambda/market/creds.ts, which is built from publicProcedure), so unauthenticated requests can reach credential handlers in trusted-client deployments; previously they were rejected as UNAUTHORIZED at middleware level. At minimum this regresses auth semantics (missing-auth becomes downstream handler failures), and it weakens route protection for credential APIs.

Useful? React with πŸ‘Β / πŸ‘Ž.

@codecov
Copy link
Copy Markdown

codecov bot commented Mar 27, 2026 •
edited
Loading

Codecov Report

❌ Patch coverage is 25.00000% with 3 lines in your changes missing coverage. Please review.
βœ… Project coverage is 66.75%. Comparing base (6b4046e) to head (2415e5a).
⚠️ Report is 2 commits behind head on canary.

Additional details and impacted files 
@@            Coverage Diff             @@
##           canary   #13344      +/-   ##
==========================================
- Coverage   66.75%   66.75%   -0.01%     
==========================================
  Files        1894     1894              
  Lines      152312   152316       +4     
  Branches    17374    14610    -2764     
==========================================
+ Hits       101672   101673       +1     
- Misses      50520    50523       +3     
  Partials      120      120
Flag Coverage Ξ”
app 58.13% <25.00%> (-0.01%) ⬇️
database 96.66% <ΓΈ> (ΓΈ)
packages/agent-runtime 89.61% <ΓΈ> (ΓΈ)
packages/context-engine 86.47% <ΓΈ> (ΓΈ)
packages/conversation-flow 92.36% <ΓΈ> (ΓΈ)
packages/file-loaders 87.02% <ΓΈ> (ΓΈ)
packages/memory-user-memory 66.68% <ΓΈ> (ΓΈ)
packages/model-bank 99.85% <ΓΈ> (ΓΈ)
packages/model-runtime 84.44% <ΓΈ> (ΓΈ)
packages/prompts 67.76% <ΓΈ> (ΓΈ)
packages/python-interpreter 92.90% <ΓΈ> (ΓΈ)
packages/ssrf-safe-fetch 0.00% <ΓΈ> (ΓΈ)
packages/utils 90.41% <ΓΈ> (ΓΈ)
packages/web-crawler 88.82% <ΓΈ> (ΓΈ)

Flags with carried forward coverage won't be shown. Click here to find out more.

Components Coverage Ξ”
Store 66.11% <ΓΈ> (ΓΈ)
Services 49.58% <ΓΈ> (ΓΈ)
Server 67.20% <ΓΈ> (ΓΈ)
Libs 51.03% <25.00%> (-0.03%) ⬇️
Utils 91.01% <ΓΈ> (ΓΈ)
πŸš€ New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • πŸ“¦ JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@ONLY-yours ONLY-yours merged commit 83f8f03 into canary Mar 27, 2026
35 checks passed
@ONLY-yours ONLY-yours deleted the fix/marketAuthAddTrustClient branch March 27, 2026 13:14
@lobehubbot
Copy link
Copy Markdown
Member

lobehubbot commented Mar 27, 2026

❀️ Great PR @ONLY-yours ❀️

The growth of project is inseparable from user feedback and contribution, thanks for your contribution! If you are interesting with the lobehub developer community, please join our discord and then dm @arvinxx or @canisminor1990. They will invite you to our private developer channel. We are talking about the lobe-chat development or sharing ai newsletter around the world.

@nekomeowww nekomeowww mentioned this pull request Apr 7, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sourcery-ai sourcery-ai[bot] sourcery-ai[bot] left review comments

@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@ONLY-yours @lobehubbot