Supersede #2792 (tsk-iqk2bn): registry-JWT unknown-route + off-allowlist hardening must extend dev's shipped check_agent_identity/_any_route_matches mechanism, not ship a second one

[jaylfc]

CARD TITLE (intent, not commit subject): Supersede #2792 (tsk-iqk2bn): registry-JWT unknown-route + off-allowlist hardening must extend dev's shipped check_agent_identity/_any_route_matches mechanism, not ship a second one

Autonomous build of board card tsk-etzofb.

Port TestRegistryJwtUnknownRouteDispatch (8 tests) onto dev's check_agent_identity + _any_route_matches mechanism, extending _any_route_matches with a match_method parameter so the 404/401 split keys off path existence (whatever the method) rather than method+path match. A wrong verb on an existing URL now falls through to the session gate's 401 instead of being misreported as a wrong URL. One pre-existing dev test (test_checklist_delete_requires_session) updated to match the corrected behavior.

Step-1 red line: 1 failed, 9 passed (before fix)
Step-2 green line: 139 passed (after fix, across test_auth_middleware.py + test_agent_scope_requests.py + test_token_rotation.py)

Files:
.../tsk-etzofb-registry-jwt-unknown-route.md | 2 +
docs/agent-coordination.md | 27 ++-
tests/test_auth_middleware.py | 244 ++++++++++++++++++++-
tinyagentos/auth_middleware.py | 6 +-
4 files changed, 265 insertions(+), 14 deletions(-)

Summary by CodeRabbit

• Bug Fixes

  • Corrected authentication responses for registry JWT requests.
  • Requests to genuinely unknown URLs now return 404, while requests using an unsupported method on an existing URL correctly return 401.
  • Invalid, revoked, or absent credentials continue to receive 401 responses.

• Documentation

  • Clarified agent API refusal responses, including status codes and representative scenarios.

[qodo-code-review]

ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 58a719ac-19ed-49db-bce5-f23e35e0826f

📥 Commits

Reviewing files that changed from the base of the PR and between c2c60f9 and 0d769a7.

📒 Files selected for processing (4)

• changelog.d/tsk-etzofb-registry-jwt-unknown-route.md
• docs/agent-coordination.md
• tests/test_auth_middleware.py
• tinyagentos/auth_middleware.py

Included review availability: Your plan provides up to 4 included reviews per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Registry JWT dispatch now returns 404 for unknown paths and 401 for known paths with unsupported methods or invalid credentials. Middleware route matching, regression tests, agent API documentation, and the changelog were updated.

Changes

Registry JWT dispatch

Layer / File(s)	Summary
Route existence and authentication flow tinyagentos/auth_middleware.py	_any_route_matches can ignore HTTP methods. Registry JWT checks use this mode to distinguish unknown paths from known paths with unsupported methods.
Dispatch regression coverage and documentation tests/test_auth_middleware.py, docs/agent-coordination.md, changelog.d/tsk-etzofb-registry-jwt-unknown-route.md	Tests cover valid, absent, malformed, revoked, rotated, unauthorized, and method-mismatched credentials. Documentation and the changelog describe the resulting 404 and 401 responses.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 0d769

Registry JWT requests now receive 404 only for genuinely unknown paths, while requests using unsupported methods on known paths proceed to the session gate and return 401. The behavior is covered by targeted regression tests and is ready to merge.

Sequence Diagram(s)

sequenceDiagram
  participant Request
  participant AuthMiddleware
  participant RouteMatcher
  participant SessionGate
  Request->>AuthMiddleware: present registry JWT
  AuthMiddleware->>RouteMatcher: check path existence without method
  RouteMatcher-->>AuthMiddleware: unknown path or registered path
  alt unknown path
    AuthMiddleware-->>Request: 404 Not Found
  else registered path
    AuthMiddleware->>SessionGate: apply session authentication
    SessionGate-->>Request: 401 Authentication required
  end

Loading

Suggested reviewers: hognek

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 78.57% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 14 functions across 2 files. (2 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: hardening registry-JWT unknown-route handling by extending the existing mechanism instead of adding a duplicate. It is longer than preferred but remains s…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 78.57% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 14 functions across 2 files. (2 skipped: 2 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 2

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch exec/tsk-etzofb

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gitar-bot]

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

_Gitar

[kilo-code-bot]

Kilo Code Review could not run — your account is out of credits.

Add credits or switch to a free model to enable reviews on this change.