fix(core): skip interactive-auth registration when client auth is disabled - #540
Merged
Conversation
…abled createDevToolsContext registered devframe's interactive-auth RPC functions (anonymous:devframe:auth and friends) unconditionally, even when clientAuth is disabled (build mode, devtools.clientAuth: false, or VITE_DEVTOOLS_DISABLE_CLIENT_AUTH=true). This preempted devframe's auth: false auto-trust shim, which only installs its noop handler when anonymous:devframe:auth isn't already registered — so disabling auth never actually marked client sessions as trusted. Extract the authDisabled check into isClientAuthDisabled() and share it between createDevToolsContext (registration guard) and createDevToolsHub (initHub's auth option), so both agree on when the gate is off. Fixes #539
@vitejs/devtools
@vitejs/devtools-kit
@vitejs/devtools-oxc
@vitejs/devtools-rolldown
@vitejs/devtools-vite
@vitejs/devtools-vitest
commit: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Disabling client auth (via
devtools: { clientAuth: false }orVITE_DEVTOOLS_DISABLE_CLIENT_AUTH=true) no longer trusted the client's RPC session:createDevToolsContextunconditionally registered devframe's interactive-auth RPC functions (anonymous:devframe:authand friends) on the context RPC host, regardless of whether auth would end up disabled. This preempted devframe'sauth: falseauto-trust shim ininitHub, which only installs its noop auto-trust handler whenanonymous:devframe:authisn't already registered — so the real interactive handler always won that race, leavingisTrustedstuck atfalseand the client stuck on the authorization prompt.This PR:
isClientAuthDisabled(context)helper inauth-handler.ts.createDevToolsContextto skip registering the interactive-auth RPC functions entirely when auth is disabled, so devframe's auto-trust shim can registeranonymous:devframe:authitself.createDevToolsHub(previously computed inline) so both call sites agree on when the gate is off.devtools.clientAuth: false, and theVITE_DEVTOOLS_DISABLE_CLIENT_AUTHenv var, assertinganonymous:devframe:authis left unregistered so the auto-trust shim can take over.Linked Issues
Fixes #539
Additional context
Verified with
pnpm -w exec vitest run packages/core packages/kitandpnpm typecheck(both green), plus a targetedeslintrun over the touched files.This PR was created with the help of an agent.