Repository navigation
scalar_http client: cookie-session only, not Bearer (i3 auth fidelity) - #33
Merged
Merged
Conversation
…lity) The real i3 authenticates via the sessionID session cookie; the client was hybrid — it relied on the cookie jar AND also sent Authorization: Bearer using the token the EMULATOR happens to return in the login body. A real appliance does not accept that header, so the Bearer path let the client "work" against the emulator while diverging from the real contract (external review #2). - _headers() no longer adds Authorization; auth rides purely on the cookie jar (login sets sessionID; httpx persists it; 401 still triggers a transparent re-login). The body token is retained for diagnostics only. - New contract test asserts the client sends no Authorization header, the sessionID cookie is present, and a cookie-authenticated read still works — guarding against regressing to the Bearer artifact. 18 scalar_http contract tests green against the in-process emulator. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012K5Zjc2bggcyJtFbz2D4Pw
These in-process (TestClient) real-i3 client tests were not run by any PR CI job — the selective-coverage gap again. Wire them into backend-tests so the client contract (incl. cookie-session auth) is verified at PR time, not only post-merge. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012K5Zjc2bggcyJtFbz2D4Pw
There was a problem hiding this comment.
Pull request overview
This PR improves Quantum Scalar i3 authentication fidelity in the scalar_http client by ensuring authentication is performed exclusively via the sessionID session cookie (as on real appliances), rather than also sending an emulator-only Authorization: Bearer header.
Changes:
- Remove
Authorization: Bearerinjection fromScalarHttpSession._headers()so requests rely solely on the cookie jar. - Update
ScalarHttpSession.login()documentation to clarify the response-body token is diagnostic-only. - Add a contract test to guard against reintroducing Bearer-based authentication.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
openblade/hardware/scalar_http/session.py |
Stops adding Authorization: Bearer and documents cookie-session as the sole auth mechanism. |
tests/i3/test_scalar_http_session.py |
Adds a contract test to ensure cookie-based auth is used and Bearer auth is not relied upon. |
Comment on lines
+68
to
+78
| def test_scalar_http_session_authenticates_via_cookie_not_bearer( | ||
| emulator_client: TestClient, | ||
| ) -> None: | ||
| # Real i3 fidelity: auth rides on the sessionID cookie, never an Authorization | ||
| # header. Guards against regressing to the emulator-only Bearer artifact. | ||
| session = _session(emulator_client) | ||
| session.login() | ||
|
|
||
| assert "Authorization" not in session._headers() | ||
| assert "sessionID" in emulator_client.cookies # cookie jar carries the session | ||
| assert session.get_json("/aml/system/status") # cookie-authenticated read works |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
External review #2 (client auth fidelity). The real i3 authenticates via the sessionID session cookie; the scalar_http client was hybrid — it relied on the cookie jar AND also sent
Authorization: Bearerusing the token the emulator happens to return in the login body. A real appliance doesn't accept that header, so the Bearer path let the client 'work' against the emulator while diverging from the real contract._headers()no longer adds Authorization; auth rides purely on the cookie jar (login sets sessionID, httpx persists it, 401 still triggers a transparent re-login). The body token is retained for diagnostics only.Note: I investigated the elements-coordinate wire change (the other i3-fidelity item) and deliberately did NOT do it — test_aml_diagnostics.py asserts the current
"1,bay,slot"string, and the real 5-field format can't be certified without an appliance capture. Guessing a parity wire contract would be wrong; the corpus already flags that gap for certification.https://claude.ai/code/session_012K5Zjc2bggcyJtFbz2D4Pw