test(auth): failing integration test for OAuth-profile X-User-Id 403 - #136
Open
Ramon Nogueira (ramon-langchain) wants to merge 2 commits into
Open
test(auth): failing integration test for OAuth-profile X-User-Id 403#136Ramon Nogueira (ramon-langchain) wants to merge 2 commits into
Ramon Nogueira (ramon-langchain) wants to merge 2 commits into
Conversation
Reproduces a regression where OAuth-profile (langsmith auth login) requests are rejected with 403 by the backend. WithProfile auth sends an X-User-Id header derived from the access-token JWT sub; the backend rejects the request when that id does not match the user it resolves from the same token. Only the OAuth-bearer path is affected — API-key auth (covered by the existing profile tests) strips the header — and the unit tests use an httptest mock that does no identity resolution, so neither catches it. The test uses WithProfile and hits GET /v2/sandboxes/boxes, which runs under the auth middleware that enforces the X-User-Id check. It fails (403) against a real backend today and skips unless an OAuth-logged-in profile is present.
Use the 'default' (production) profile by default and confirm the 403 reproduces against prod, not just dev — the X-User-Id mismatch is systematic, not dev-only. Add a consistent loginHint to every credential-related skip.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
OAuth-profile requests (
langsmith auth login) are rejected with 403 by the backend.WithProfileauth sends anX-User-Idheader derived from the access-token JWTsub(added in #98). The backend's auth middleware returns 403 whenX-User-Iddoesn't equal the user it resolves from the same token — and the ASsubdoes not match the resolvedls_user_id, so the call fails.Reproduced live with a fresh OAuth login on both dev and prod (it is not environment-specific):
Why nothing caught it
WithAPIKey— the API-key path stripsAuthorization/X-User-Id, so it never exercises this.httptestmock that records the header but does no identity resolution, so they pass regardless.This PR adds the missing coverage: an integration test that uses
WithProfile(the OAuth-bearer path) and hitsGET /v2/sandboxes/boxes, which runs under the auth middleware that enforces theX-User-Idcheck. It fails (403) against a real backend today, and skips unless an OAuth-logged-in profile is present (so API-key-only CI is unaffected). Defaults to thedefault(production) profile; override withLANGSMITH_OAUTH_PROFILE.This PR intentionally contains only the failing test — no fix — to capture the regression.
Test Plan
go test -tags integration -run TestOAuthProfile_AuthenticatedRequest ./integration/fails with 403 against prod and dev using an OAuth profile