From 3b5b148525ca82c24240758794b78b166dc28abc Mon Sep 17 00:00:00 2001
From: CG-5228 <g15222152017@gmail.com>
Date: Wed, 4 Nov 2026 13:11:18 +0000
Subject: [PATCH] fix(opamp): omit fluentforward receiver when collector auth
 is enforced

---
 ...isable-fluentforward-when-auth-enforced.md |  5 +++
 .../__tests__/opampController.test.ts         | 39 +++++++++++++++++++
 .../src/opamp/controllers/opampController.ts  | 17 +++++---
 3 files changed, 56 insertions(+), 5 deletions(-)
 create mode 100644 .changeset/disable-fluentforward-when-auth-enforced.md

diff --git a/.changeset/disable-fluentforward-when-auth-enforced.md b/.changeset/disable-fluentforward-when-auth-enforced.md
new file mode 100644
index 0000000000..5b52880acd
--- /dev/null
+++ b/.changeset/disable-fluentforward-when-auth-enforced.md
@@ -0,0 +1,5 @@
+---
+"@hyperdx/api": patch
+---
+
+fix(opamp): omit unauthenticated fluentforward receiver when collector authentication is enforced
diff --git a/packages/api/src/opamp/controllers/__tests__/opampController.test.ts b/packages/api/src/opamp/controllers/__tests__/opampController.test.ts
index b6d274e970..cdf6791c7c 100644
--- a/packages/api/src/opamp/controllers/__tests__/opampController.test.ts
+++ b/packages/api/src/opamp/controllers/__tests__/opampController.test.ts
@@ -169,6 +169,45 @@ describe('opampController', () => {
     });
   });
 
+  describe('buildOtelCollectorConfig fluentforward receiver', () => {
+    it('enables the fluentforward receiver when no teams exist', () => {
+      const cfg = buildOtelCollectorConfig([]);
+
+      expect(cfg.receivers.fluentforward).toEqual({
+        endpoint: '0.0.0.0:24225',
+      });
+      expect(cfg.service.pipelines['logs/in'].receivers).toEqual([
+        'fluentforward',
+      ]);
+    });
+
+    it('enables the fluentforward receiver when collector authentication is not enforced', () => {
+      const cfg = buildOtelCollectorConfig([
+        { apiKey: 'k1', collectorAuthenticationEnforced: false },
+      ]);
+
+      expect(cfg.receivers.fluentforward).toEqual({
+        endpoint: '0.0.0.0:24225',
+      });
+      expect(cfg.service.pipelines['logs/in'].receivers).toEqual([
+        'fluentforward',
+        'otlp/hyperdx',
+      ]);
+    });
+
+    it('omits the fluentforward receiver when collector authentication is enforced', () => {
+      const cfg = buildOtelCollectorConfig([
+        { apiKey: 'k1', collectorAuthenticationEnforced: true },
+      ]);
+
+      expect(cfg.receivers.fluentforward).toBeUndefined();
+      expect(cfg.service.pipelines['logs/in'].receivers).toEqual([
+        'nop',
+        'otlp/hyperdx',
+      ]);
+    });
+  });
+
   describe('buildOtelCollectorConfig datadog receiver', () => {
     it('omits the datadog receiver when the flag is off (default)', () => {
       configState.ENABLE_DATADOG_RECEIVER = false;
diff --git a/packages/api/src/opamp/controllers/opampController.ts b/packages/api/src/opamp/controllers/opampController.ts
index 22325ad2bc..813a0eadb0 100644
--- a/packages/api/src/opamp/controllers/opampController.ts
+++ b/packages/api/src/opamp/controllers/opampController.ts
@@ -236,9 +236,13 @@ export const buildOtelCollectorConfig = (
           ],
         },
       },
-      fluentforward: {
-        endpoint: '0.0.0.0:24225',
-      },
+      ...(collectorAuthenticationEnforced
+        ? {}
+        : {
+            fluentforward: {
+              endpoint: '0.0.0.0:24225',
+            },
+          }),
     },
     connectors: {
       'routing/logs': {
@@ -318,8 +322,11 @@ export const buildOtelCollectorConfig = (
           exporters: ['clickhouse'],
         },
         'logs/in': {
-          // TODO: fluentforward needs to be authenticated
-          receivers: ['fluentforward'],
+          // The upstream fluentforwardreceiver has no auth setting, so omit it
+          // when collector authentication is enforced.
+          receivers: [
+            collectorAuthenticationEnforced ? 'nop' : 'fluentforward',
+          ],
           exporters: ['routing/logs'],
         },
         'logs/out-default': {