Skip to content

feat(ai): accept key-bearing v1 Agent tokens #327

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nimish-ks merged 2 commits into from
Oct 29, 2026
Merged

feat(ai): accept key-bearing v1 Agent tokens #327

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c242c38
feat(ai): accept key-bearing v2 Agent tokens
nimish-ks Oct 28, 2026
775ee68
feat(ai): version key-bearing Agent tokens as v1
nimish-ks Oct 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 2 additions & 4 deletions src/internal/agentapi/client_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,6 @@ func testToken(prefix string, version int, lookup string) string {
if lookup == "" {
lookup = strings.Repeat("a", 64)
}
if prefix == "pss_agent" {
return fmt.Sprintf("%s:v%d:%s", prefix, version, lookup)
}
return fmt.Sprintf("%s:v%d:%s:%s:%s:%s", prefix, version, lookup,
strings.Repeat("b", 64), strings.Repeat("c", 64), strings.Repeat("d", 64))
}
Expand Down Expand Up @@ -54,7 +51,8 @@ func TestParseDurableTokenCompatibility(t *testing.T) {
for _, invalid := range []string{
"",
"pss_agent:v1:" + strings.Repeat("a:", 4) + "a",
"pss_agent:v2:" + strings.Repeat("a", 64) + ":" + strings.Repeat("b", 64) + ":" + strings.Repeat("c", 64) + ":" + strings.Repeat("d", 64),
"pss_agent:v1:" + strings.Repeat("a", 64),
testToken("pss_agent", 2, ""),
"pss_user:v1:not-hex",
} {
if _, _, err := ParseDurableToken(invalid); err == nil {
Expand Down
8 changes: 4 additions & 4 deletions src/internal/agentsdk/client_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ func TestClientRoutesStatusesAndDualAuthentication(t *testing.T) {

const durableToken = "durable-token"
const mintedSecret = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
const mintedFullToken = "pss_agent:v1:" + mintedSecret
const mintedFullToken = "pss_agent:v1:" + mintedSecret + ":" + mintedSecret + ":" + mintedSecret + ":" + mintedSecret
const sessionCredential = "session-credential"
session := SessionAuth{SessionUID: "session-123", Credential: SensitiveString(sessionCredential)}

Expand Down Expand Up @@ -595,7 +595,7 @@ func TestAuthenticationFromPhaseToken(t *testing.T) {
kind AuthenticationType
token string
}{
{kind: AuthenticationAgent, token: "pss_agent:v1:" + lookup},
{kind: AuthenticationAgent, token: "pss_agent:v1:" + strings.Join(fullParts, ":")},
{kind: AuthenticationUser, token: "pss_user:v1:" + strings.Join(fullParts, ":")},
{kind: AuthenticationServiceAccount, token: "pss_service:v2:" + strings.Join(fullParts, ":")},
}
Expand All @@ -616,8 +616,8 @@ func TestAuthenticationFromPhaseToken(t *testing.T) {
if _, err := AuthenticationFromPhaseToken("pss_agent:v2:" + strings.Join(fullParts, ":")); err == nil {
t.Fatal("expected unsupported Agent token version error")
}
if _, err := AuthenticationFromPhaseToken("pss_agent:v1:" + lookup + ":" + lookup); err == nil {
t.Fatal("expected Agent key-share token to be rejected")
if _, err := AuthenticationFromPhaseToken("pss_agent:v1:" + lookup); err == nil {
t.Fatal("expected Agent token without key shares to be rejected")
}
if _, err := AuthenticationFromPhaseToken("pss_user:v2:" + strings.Join(fullParts, ":")); err == nil {
t.Fatal("expected unsupported PAT version error")
Expand Down
6 changes: 3 additions & 3 deletions src/internal/agentsdk/types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -387,8 +387,8 @@ func ServiceAccountAuthentication(token string) Authentication {

// AuthenticationFromPhaseToken extracts the bearer lookup value from a full
// Agent, Personal Access, or Service Account token without involving phase.New
// or the secrets client. Agent tokens are opaque v1 bearer secrets. Personal
// Access Tokens use v1 and Service Account tokens use v2.
// or the secrets client. All three carry key shares; Agent and Personal Access
// Tokens use v1, and Service Account tokens use v2.
func AuthenticationFromPhaseToken(token string) (Authentication, error) {
parts := strings.Split(token, ":")
if len(parts) < 2 {
Expand All @@ -399,7 +399,7 @@ func AuthenticationFromPhaseToken(token string) (Authentication, error) {
if parts[1] != "v1" {
return Authentication{}, fmt.Errorf("agents: invalid Agent token version")
}
if len(parts) != 3 || !isHex64(parts[2]) {
if !validKeyShareToken(parts) {
return Authentication{}, fmt.Errorf("agents: invalid Phase token")
}
return AgentAuthentication(parts[2]), nil
Expand Down
2 changes: 1 addition & 1 deletion src/internal/aiproxy/remote_integration_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -488,7 +488,7 @@ func writeRemoteTLSIdentity(t *testing.T, host string) (string, string, *x509.Ce
}

func remoteAgentToken() string {
return "pss_agent:v1:" + strings.Repeat("a", 64)
return "pss_agent:v1:" + strings.Repeat("a", 64) + ":" + strings.Repeat("b", 64) + ":" + strings.Repeat("c", 64) + ":" + strings.Repeat("d", 64)
}

func remoteProxyHTTPClient(t *testing.T, rawProxyURL string, roots *x509.CertPool) *http.Client {
Expand Down
4 changes: 2 additions & 2 deletions src/internal/airuntime/runtime_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,15 +43,15 @@ func TestRuntimeRejectsLegacyServiceToken(t *testing.T) {
}

func TestSavedLoginRejectsObsoleteAgentTokenAsAuthenticationRequired(t *testing.T) {
token := "pss_agent:v2:" + strings.Repeat("a", 64) + ":" + strings.Repeat("b", 64) + ":" + strings.Repeat("c", 64) + ":" + strings.Repeat("d", 64)
token := "pss_agent:v1:" + strings.Repeat("a", 64)
_, err := clientForSavedLogin("https://console.phase.dev", token)
if !errors.Is(err, ErrAuthenticationRequired) {
t.Fatalf("obsolete Agent token error = %v, want ErrAuthenticationRequired", err)
}
}

func TestSavedLoginRejectsInvalidHostAsAuthenticationRequired(t *testing.T) {
token := "pss_agent:v1:" + strings.Repeat("a", 64)
token := "pss_agent:v1:" + strings.Repeat("a", 64) + ":" + strings.Repeat("b", 64) + ":" + strings.Repeat("c", 64) + ":" + strings.Repeat("d", 64)
_, err := clientForSavedLogin("not-a-url", token)
if !errors.Is(err, ErrAuthenticationRequired) {
t.Fatalf("invalid saved host error = %v, want ErrAuthenticationRequired", err)
Expand Down
4 changes: 2 additions & 2 deletions src/pkg/phase/agent_scope_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,15 +6,15 @@ import (
)

func TestNewPhaseRejectsAgentTokenForLegacyAPIs(t *testing.T) {
token := "pss_agent:v1:" + strings.Repeat("a", 64)
token := "pss_agent:v1:" + strings.Repeat("a", 64) + ":" + strings.Repeat("b", 64) + ":" + strings.Repeat("c", 64) + ":" + strings.Repeat("d", 64)
_, err := NewPhase(false, token, "https://console.phase.dev")
if err == nil || !strings.Contains(err.Error(), "phase ai") {
t.Fatalf("expected clear Agent scope error, got %v", err)
}
}

func TestNewPhaseRejectsAgentTokenFromEnvironment(t *testing.T) {
t.Setenv("PHASE_SERVICE_TOKEN", "pss_agent:v1:"+strings.Repeat("a", 64))
t.Setenv("PHASE_SERVICE_TOKEN", "pss_agent:v1:"+strings.Repeat("a", 64)+":"+strings.Repeat("b", 64)+":"+strings.Repeat("c", 64)+":"+strings.Repeat("d", 64))
_, err := NewPhase(true, "", "")
if err == nil || !strings.Contains(err.Error(), "phase ai") {
t.Fatalf("expected clear Agent scope error, got %v", err)
Expand Down
Loading