Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix openresponses-http tests fail on origin/main for unauthenticated requests and owner detection [1 pull requests, 1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#58964•Fetched 2026-04-08 02:30:37
View on GitHub
Comments
0
Participants
1
Timeline
1
Reactions
0
Author
efwwefww
Participants
efwwefww
Timeline (top)
cross-referenced ×1

I reproduced two failing tests in src/gateway/openresponses-http.test.ts on origin/main.

Root Cause

I reproduced two failing tests in src/gateway/openresponses-http.test.ts on origin/main.

Fix Action

Fixed

PR fix notes

PR #58965: Avoid redundant cloning on fresh session store loads

Description (problem / solution / changelog)

Summary

loadSessionStore(..., { skipCache: true }) already forces a fresh disk read, but it still returns structuredClone(store) afterward.

On this path, the parsed store is not shared with the cache, so the extra clone is unnecessary. This change returns the parsed store directly when skipCache is true, while preserving the defensive clone behavior for normal cached reads.

Why

Session store update paths currently re-read the full store from disk with skipCache: true, mutate one entry, and then write the full JSON back out. The full rewrite is still the dominant cost, but the extra clone adds avoidable O(n) overhead on the read side of that hot path.

Benchmarks

Median local microbench results:

  • loadSessionStore(skipCache)

    • 1,000 entries: 2.735ms -> 1.502ms (-45%)
    • 5,000 entries: 17.209ms -> 6.561ms (-62%)
    • 10,000 entries: 35.020ms -> 13.652ms (-61%)

  • single-entry update path

    • 5,000 entries: 41.628ms -> 35.904ms (-14%)
    • 10,000 entries: 76.008ms -> 63.889ms (-16%)

Tests

  • pnpm test -- src/config/sessions.test.ts
  • pnpm test -- src/commands/agent/session-store.test.ts
  • pnpm test -- src/gateway/server-chat.agent-events.test.ts

Also added a regression test covering the skipCache path to ensure the returned mutable object does not taint cached reads.

Note

I also re-ran src/gateway/openresponses-http.test.ts and reproduced two existing failures on origin/main. I am tracking that separately in #58964.

Changed files

  • src/config/sessions.test.ts (modified, +27/-0)
  • src/config/sessions/store.ts (modified, +7/-0)

Code Example

pnpm test -- src/gateway/openresponses-http.test.ts src/gateway/server-chat.agent-events.test.ts
RAW_BUFFERClick to expand / collapse

Summary

I reproduced two failing tests in src/gateway/openresponses-http.test.ts on origin/main.

Reproduction

pnpm test -- src/gateway/openresponses-http.test.ts src/gateway/server-chat.agent-events.test.ts

Failures

  1. Unauthenticated POST to /v1/responses returns 200 instead of 403

    • src/gateway/openresponses-http.test.ts:241

  2. Requested HTTP scopes appear to imply owner identity

    • senderIsOwner is true when the test expects false
    • src/gateway/openresponses-http.test.ts:747

Expected behavior

  • HTTP requests without auth should be rejected with 403
  • Requested HTTP scopes should not, by themselves, prove owner identity for owner-only tool access

Notes

Reproduced on origin/main.

extent analysis

TL;DR

The issue can likely be resolved by updating the authentication and authorization logic in the /v1/responses endpoint to correctly handle unauthenticated requests and HTTP scopes.

Guidance

  • Review the authentication middleware used in the /v1/responses endpoint to ensure it correctly checks for authentication and returns a 403 status code for unauthenticated requests.
  • Investigate the logic used to determine the senderIsOwner flag and ensure it does not rely solely on HTTP scopes to imply owner identity.
  • Verify that the test cases in src/gateway/openresponses-http.test.ts are correctly testing the expected behavior for unauthenticated requests and owner-only tool access.
  • Check the API documentation and implementation to ensure that the expected behavior for unauthenticated requests and HTTP scopes is clearly defined and implemented.

Example

No code snippet is provided as the issue does not contain sufficient information about the implementation details.

Notes

The issue seems to be related to the authentication and authorization logic in the /v1/responses endpoint. Without more information about the implementation, it is difficult to provide a more specific solution.

Recommendation

Apply workaround: Update the authentication and authorization logic in the /v1/responses endpoint to correctly handle unauthenticated requests and HTTP scopes, as this is likely to resolve the issue.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

  • HTTP requests without auth should be rejected with 403
  • Requested HTTP scopes should not, by themselves, prove owner identity for owner-only tool access
#training loop#device allocation#model download#tokenizer error#prompt formatting

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING