From d57e8639c5bea8eadee9e69a9065665ab89a7662 Mon Sep 17 00:00:00 2001 From: Anton Evseev <78427278+slayoffer@users.noreply.github.com> Date: Fri, 30 Jan 2026 18:07:23 +1000 Subject: [PATCH] fix(auth): skip tenant auth for all internal background tasks (#240) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Previously, _authenticate_tenant only skipped extension auth for internal requests when _current_schema was set to a non-public schema. This caused async HTTP retain (document upload with async_processing=True) to fail with AuthenticationError because the worker had no API key and the schema was "public". Remove the public-schema guard since internal tasks were already authenticated at submission time. The worker sets _current_schema from the task's _schema field for tenant schemas, and it defaults to "public" for public schema tasks — both are valid. --- hindsight-api/hindsight_api/engine/memory_engine.py | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/hindsight-api/hindsight_api/engine/memory_engine.py b/hindsight-api/hindsight_api/engine/memory_engine.py index a19bfbb6..56e54f31 100644 --- a/hindsight-api/hindsight_api/engine/memory_engine.py +++ b/hindsight-api/hindsight_api/engine/memory_engine.py @@ -504,12 +504,11 @@ class MemoryEngine(MemoryEngineInterface): if request_context is None: raise AuthenticationError("RequestContext is required when tenant extension is configured") - # For internal/background operations (e.g., worker tasks), skip extension authentication - # if the schema has already been set by execute_task via the _schema field. + # For internal/background operations (e.g., worker tasks), skip extension authentication. + # The task was already authenticated at submission time, and execute_task sets _current_schema + # from the task's _schema field. For public schema tasks, _current_schema keeps its default "public". if request_context.internal: - current = _current_schema.get() - if current and current != "public": - return current + return _current_schema.get() # Let AuthenticationError propagate - HTTP layer will convert to 401 tenant_context = await self._tenant_extension.authenticate(request_context)