holetron-lab/fleet-memory
1
0
Fork 0
Code Releases Packages Activity Actions

fix(auth): skip tenant auth for all internal background tasks (#240)

Browse source 
Previously, _authenticate_tenant only skipped extension auth for
internal requests when _current_schema was set to a non-public schema.
This caused async HTTP retain (document upload with async_processing=True)
to fail with AuthenticationError because the worker had no API key and
the schema was "public".

Remove the public-schema guard since internal tasks were already
authenticated at submission time. The worker sets _current_schema from
the task's _schema field for tenant schemas, and it defaults to "public"
for public schema tasks — both are valid.
This commit is contained in:
Anton Evseev 2026-01-30 18:07:23 +10:00 committed by GitHub
parent 03bf13e9e3
commit d57e8639c5
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 4 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
hindsight-api/hindsight_api/engine/memory_engine.py
View file

@ -504,12 +504,11 @@ class MemoryEngine(MemoryEngineInterface):
if request_context is None:
raise AuthenticationError("RequestContext is required when tenant extension is configured")
# For internal/background operations (e.g., worker tasks), skip extension authentication
# if the schema has already been set by execute_task via the _schema field.
# For internal/background operations (e.g., worker tasks), skip extension authentication.
# The task was already authenticated at submission time, and execute_task sets _current_schema
# from the task's _schema field. For public schema tasks, _current_schema keeps its default "public".
if request_context.internal:
current = _current_schema.get()
if current and current != "public":
return current
return _current_schema.get()
# Let AuthenticationError propagate - HTTP layer will convert to 401
tenant_context = await self._tenant_extension.authenticate(request_context)