Repository navigation
fix(web): send the API key on direct fetches; fix Playground replay and View run - #1169
Closed
santoshkumarradha wants to merge 2 commits into
Closed
santoshkumarradha wants to merge 2 commits into
santoshkumarradha wants to merge 2 commits into
Conversation
…und input
Several UI calls use fetch directly instead of the shared client and never send X-API-Key, so with API key auth on they fail with 401: the Integrations and Triggers pages, the trigger sheet, new-trigger dialog and event replay, step approval actions, the workflow graph's step details, execution retry, and the DID resolution bundle download. Two of them read the key from storage slots the app never writes (localStorage agentfield_api_key, sessionStorage apiKey). They now use one authHeaders() helper backed by the key the app signed in with.
Replaying a run in the Playground pre-filled the stored request body, which is the whole {"input": {...}} envelope; Execute wrapped it again, so the reasoner received input.input and rejected the call with missing required fields. The envelope is now removed when the box is filled from a replay or a recent run, and before execute.
The execute response carries both execution_id and run_id; the Playground preferred execution_id, so View run went to /runs/<execution id>, which is a 404. It now prefers run_id.
Contributor
📊 Coverage gateThresholds from
✅ Gate passedNo surface regressed past the allowed threshold and the aggregate stayed above the floor. |
Contributor
📐 Patch coverage gateThreshold: 80% on lines this PR touches vs
❌ Patch gate failed
How to fix
|
19 of 22 tasks
Member
Author
|
Folded into #1171 so all fixes get one review; commits unchanged. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
With API key auth on, several UI screens fail with a 401 because they call
fetchdirectly and never sendX-API-Key. Separately, the Playground's replay and "View run" are broken.Playground:
Type of change
Evidence
HTTP 401: {"error":"unauthorized", … "invalid or missing API key"}. Replaying atriage_ticketrun in the Playground and pressing Execute returnsagent error (422): Missing required field: ticket_id. View run after a Playground execution showsHTTP error! status: 404.After: Integrations lists all providers; Replay → Execute on the same run returns
succeeded(driven end to end in a headless browser against a control plane with API key auth on); View run opens the run.StepDetail.test.tsx"submits approval actions" previously passed only because it stubbedlocalStorage.getItemto return the key from the never-written slot; it now sets the key the way the app does (setGlobalApiKey) and asserts the same header.Test plan
cd control-plane/web/client && npx tsc --noEmit -p tsconfig.app.jsonnpx vitest run(141 files, 837 tests pass)npm run buildAGENTFIELD_API_KEYset → Integrations, Triggers, Playground replay + Execute + View runMerge Danger
Door: two-way
Frontend only; no API or storage change. Revert restores the previous behaviour.
Blast Radius: small
Requests that already worked are unchanged (the header is only added where it was missing, and
authHeaders()is empty when no key is set). The Playground only unwraps an object whose single key isinputholding an object; a reasoner whose own schema is exactly one field namedinput(an object) would now have that field unwrapped when replayed or pasted.