Skip to content

fix(core): skip interactive-auth registration when client auth is disabled - #540

Merged
antfu merged 1 commit into
mainfrom
fix/issue-539-client-auth-trust
Aug 20, 2026
Merged

fix(core): skip interactive-auth registration when client auth is disabled#540
antfu merged 1 commit into
mainfrom
fix/issue-539-client-auth-trust

Conversation

@antfubot

Copy link
Copy Markdown
Collaborator

Description

Disabling client auth (via devtools: { clientAuth: false } or VITE_DEVTOOLS_DISABLE_CLIENT_AUTH=true) no longer trusted the client's RPC session: createDevToolsContext unconditionally registered devframe's interactive-auth RPC functions (anonymous:devframe:auth and friends) on the context RPC host, regardless of whether auth would end up disabled. This preempted devframe's auth: false auto-trust shim in initHub, which only installs its noop auto-trust handler when anonymous:devframe:auth isn't already registered — so the real interactive handler always won that race, leaving isTrusted stuck at false and the client stuck on the authorization prompt.

This PR:

  • Extracts the auth-disabled check into a shared isClientAuthDisabled(context) helper in auth-handler.ts.
  • Uses it in createDevToolsContext to skip registering the interactive-auth RPC functions entirely when auth is disabled, so devframe's auto-trust shim can register anonymous:devframe:auth itself.
  • Uses the same helper in createDevToolsHub (previously computed inline) so both call sites agree on when the gate is off.
  • Adds regression tests covering build mode, devtools.clientAuth: false, and the VITE_DEVTOOLS_DISABLE_CLIENT_AUTH env var, asserting anonymous:devframe:auth is left unregistered so the auto-trust shim can take over.

Linked Issues

Fixes #539

Additional context

Verified with pnpm -w exec vitest run packages/core packages/kit and pnpm typecheck (both green), plus a targeted eslint run over the touched files.


This PR was created with the help of an agent.

…abled

createDevToolsContext registered devframe's interactive-auth RPC
functions (anonymous:devframe:auth and friends) unconditionally, even
when clientAuth is disabled (build mode, devtools.clientAuth: false,
or VITE_DEVTOOLS_DISABLE_CLIENT_AUTH=true). This preempted devframe's
auth: false auto-trust shim, which only installs its noop handler when
anonymous:devframe:auth isn't already registered — so disabling auth
never actually marked client sessions as trusted.

Extract the authDisabled check into isClientAuthDisabled() and share
it between createDevToolsContext (registration guard) and
createDevToolsHub (initHub's auth option), so both agree on when the
gate is off.

Fixes #539
@pkg-pr-new

pkg-pr-new Bot commented Aug 20, 2026

Copy link
Copy Markdown

Open in StackBlitz

@vitejs/devtools

npm i https://pkg.pr.new/@vitejs/devtools@540

@vitejs/devtools-kit

npm i https://pkg.pr.new/@vitejs/devtools-kit@540

@vitejs/devtools-oxc

npm i https://pkg.pr.new/@vitejs/devtools-oxc@540

@vitejs/devtools-rolldown

npm i https://pkg.pr.new/@vitejs/devtools-rolldown@540

@vitejs/devtools-vite

npm i https://pkg.pr.new/@vitejs/devtools-vite@540

@vitejs/devtools-vitest

npm i https://pkg.pr.new/@vitejs/devtools-vitest@540

commit: 0e0cfc5

@antfu
antfu merged commit 80da293 into main Aug 20, 2026
10 checks passed
@antfu
antfu deleted the fix/issue-539-client-auth-trust branch August 20, 2026 03:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Disabling client auth (clientAuth:false / VITE_DEVTOOLS_DISABLE_CLIENT_AUTH) no longer trusts the client in 0.5

2 participants