feat: validate user agent for admin access token by alexplash · Pull Request #118 · nearai/cloud-api

alexplash · 2025-10-28T22:21:25Z

Made it so admin access tokens can only be used with the same User-Agent as when the token was initialized.

Note

Enforces User-Agent matching for admin access tokens by storing UA on creation and validating on use; updates middleware, routes, DB schema/repo, and adds e2e tests.

Auth/Middleware:
- Admin tokens (adm_ prefix) validated only as admin tokens (no session fallback) and now require matching User-Agent.
- Extracts User-Agent from requests and passes to authenticate_admin_access_token.
Routes:
- POST /v1/admin/access-tokens captures request User-Agent and persists it with the token.
Database:
- Adds user_agent column to admin_access_token (migration V0024__...).
- Extends models::AdminAccessToken with optional user_agent.
Repositories (AdminAccessTokenRepository):
- create(...) now stores user_agent.
- validate(token, user_agent) checks token is active, not expired, and UA matches (or token has no UA); updates last_used_at.
Tests:
- New e2e tests for UA match (200) and mismatch (401); existing tests updated to use new behavior.

^{Written by Cursor Bugbot for commit 8687270. This will update automatically on new commits. Configure here.}

crates/api/src/routes/admin.rs

crates/api/src/middleware/auth.rs

think-in-universe · 2025-10-29T15:48:39Z

I think we can also add user agent validation for refreshing access tokens as mentioned in #106

crates/api/src/middleware/auth.rs

crates/api/src/routes/admin.rs

crates/database/src/repositories/admin_access_token.rs

crates/api/src/middleware/auth.rs

crates/database/src/repositories/admin_access_token.rs

crates/.DS_Store

crates/database/src/repositories/admin_access_token.rs

cursor

This is the final PR Bugbot will review for you during this billing cycle

Your free Bugbot reviews will reset on December 9

Details

Your team is on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle for each member of your team.

To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

crates/database/src/repositories/admin_access_token.rs

Copilot

Pull Request Overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 5 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

crates/database/src/repositories/admin_access_token.rs

crates/api/src/middleware/auth.rs

crates/api/src/routes/admin.rs

crates/api/src/middleware/auth.rs

Copilot

Pull Request Overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

PierreLeGuen · 2025-11-20T00:30:14Z

crates/database/src/repositories/admin_access_token.rs

        name: String,
        creation_reason: String,
        expires_at: chrono::DateTime<Utc>,
+        user_agent: Option<String>,


Why keeping user_agent optional if we enforce it in #131?

It's preferred to enforce user agent for security reason, so we did that in #130.

The reason to keep the user agent optional for #118 is to avoid payment service abortion before we can create a new admin access token with user-agent.

* feat: implement batch conversation retrieval endpoint Add GET /v1/conversations/batch endpoint to fetch multiple conversations in a single request using SQL ANY() queries instead of N individual calls. Changes: - Add batch_get_by_ids() to ConversationRepository trait and implement with efficient WHERE id = ANY($1) SQL query - Add batch_get_conversations() to service trait and implement - Create BatchConversationsRequest and ConversationBatchResponse models - Implement route handler with: * JSON body input (no URL length limits) * Validation: 1-1000 IDs per request * Returns found conversations + missing_ids list (AWS DynamoDB pattern) - Register GET /v1/conversations/batch route (before /{id} to avoid conflicts) - Add comprehensive integration test verifying: * Batch retrieval of 5 IDs (3 found, 2 missing) * Correct response structure * Missing IDs properly tracked Performance: Reduces N individual API calls to 1 batch call (100x faster) * fix: only include model providers with valid attestation report (#187) * feat: validate user agent for admin access token (#118) * feat: rotate refresh token and access token with user agent check (#131) Co-authored-by: Robert Yan <46699230+think-in-universe@users.noreply.github.com> * Updated GET to POST and updated response structure * remove the order by and simplified the logic --------- Co-authored-by: Robert Yan <46699230+think-in-universe@users.noreply.github.com> Co-authored-by: alexplash <131205674+alexplash@users.noreply.github.com>

user agent

845765f

This comment was marked as outdated.

Sign in to view

debug user agent

51c8493

This comment was marked as outdated.

Sign in to view

PierreLeGuen requested changes Oct 28, 2025

View reviewed changes

crates/api/src/routes/admin.rs Outdated Show resolved Hide resolved

PierreLeGuen reviewed Oct 28, 2025

View reviewed changes

crates/api/src/middleware/auth.rs Outdated Show resolved Hide resolved

optional user agent

f7d306d

This comment was marked as outdated.

Sign in to view

alexplash added 2 commits October 28, 2025 16:23

format code

6e4ae37

user agent is nullable

2cd3f2f

alexplash had a problem deploying to Cloud API test env October 28, 2025 23:54 — with GitHub Actions Failure

PierreLeGuen self-requested a review October 30, 2025 23:46

PierreLeGuen requested changes Oct 30, 2025

View reviewed changes

PierreLeGuen self-requested a review October 30, 2025 23:48

PierreLeGuen approved these changes Oct 30, 2025

View reviewed changes

crates/api/src/middleware/auth.rs Outdated Show resolved Hide resolved

crates/api/src/middleware/auth.rs Outdated Show resolved Hide resolved

crates/database/src/repositories/admin_access_token.rs Outdated Show resolved Hide resolved

alexplash had a problem deploying to Cloud API test env October 31, 2025 00:41 — with GitHub Actions Failure

PierreLeGuen requested changes Oct 31, 2025

View reviewed changes

crates/.DS_Store Outdated Show resolved Hide resolved

dereferenced user_agent_header

18b5424

alexplash force-pushed the user-agent-authentication branch from 383be56 to 18b5424 Compare October 31, 2025 20:18

alexplash had a problem deploying to Cloud API test env October 31, 2025 20:18 — with GitHub Actions Failure

removed ds store

e79d558

alexplash linked an issue Oct 31, 2025 that may be closed by this pull request

Issue: admin session_token does not validate User-Agent #66

Closed

PierreLeGuen self-requested a review November 1, 2025 00:00

Merge branch 'main' into user-agent-authentication

855f33e

alexplash had a problem deploying to Cloud API test env November 1, 2025 00:05 — with GitHub Actions Failure

migration name change

00fc6db

alexplash had a problem deploying to Cloud API test env November 1, 2025 00:06 — with GitHub Actions Failure

This comment was marked as outdated.

Sign in to view

PierreLeGuen requested changes Nov 1, 2025

View reviewed changes

crates/database/src/repositories/admin_access_token.rs Outdated Show resolved Hide resolved

hanakannzashi had a problem deploying to Cloud API test env November 13, 2025 08:28 — with GitHub Actions Failure

fix: migration version

ca66a16

hanakannzashi had a problem deploying to Cloud API test env November 14, 2025 03:14 — with GitHub Actions Failure

cursor bot reviewed Nov 14, 2025

View reviewed changes

crates/database/src/repositories/admin_access_token.rs Outdated Show resolved Hide resolved

Merge branch 'main' into user-agent-authentication

fb4c570

think-in-universe had a problem deploying to Cloud API test env November 19, 2025 20:27 — with GitHub Actions Failure

fix: validate user agent for admin access token

6853b82

think-in-universe had a problem deploying to Cloud API test env November 19, 2025 20:56 — with GitHub Actions Failure

think-in-universe requested a review from Copilot November 19, 2025 20:56

Copilot started reviewing on behalf of think-in-universe November 19, 2025 20:57 View session

Copilot finished reviewing on behalf of think-in-universe November 19, 2025 20:58

Copilot AI reviewed Nov 19, 2025

View reviewed changes

think-in-universe added 2 commits November 20, 2025 05:09

fix: resolve comments

35c88bf

fix: test failure

0dad9dd

think-in-universe had a problem deploying to Cloud API test env November 19, 2025 21:27 — with GitHub Actions Failure

think-in-universe requested a review from Copilot November 19, 2025 21:27

Copilot started reviewing on behalf of think-in-universe November 19, 2025 21:28 View session

Copilot finished reviewing on behalf of think-in-universe November 19, 2025 21:29

Copilot AI reviewed Nov 19, 2025

View reviewed changes

think-in-universe had a problem deploying to Cloud API test env November 19, 2025 21:31 — with GitHub Actions Failure

fix: tests

8687270

think-in-universe temporarily deployed to Cloud API test env November 19, 2025 21:38 — with GitHub Actions Inactive

PierreLeGuen self-requested a review November 20, 2025 00:28

PierreLeGuen reviewed Nov 20, 2025

View reviewed changes

PierreLeGuen self-requested a review November 20, 2025 00:32

PierreLeGuen approved these changes Nov 20, 2025

View reviewed changes

think-in-universe merged commit 974ee01 into main Nov 20, 2025
2 checks passed

think-in-universe deleted the user-agent-authentication branch November 20, 2025 02:08

henrypark133 pushed a commit that referenced this pull request Nov 20, 2025

feat: validate user agent for admin access token (#118)

20a19ce

Conversation

alexplash commented Oct 28, 2025 • edited by cursor bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

think-in-universe commented Oct 29, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

This is the final PR Bugbot will review for you during this billing cycle

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

PierreLeGuen Nov 20, 2025

Choose a reason for hiding this comment

Uh oh!

think-in-universe Nov 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

alexplash commented Oct 28, 2025 •

edited by cursor bot

Loading

think-in-universe Nov 20, 2025 •

edited

Loading