fix(web2): stop stamping an empty Authorization on every proxied request

[Shitikyan]

Fixes #959.

Root cause

Not a stale token, as the report guessed — the proxy sends an Authorization header nobody asked for.

The outbound Authorization header was keyed on requireAuthForAll. That flag actually governs inbound access to the DAHR proxy — the x-dahr-session-id check in isAuthorizedRequest — and says nothing about what the target site should receive. It defaults to SharedState.PROD, so on the public testnet every proxied request went out carrying Bearer undefined, whether or not the caller supplied a token (exceptions is empty by default, so nothing was exempt).

That explains both reported symptoms and why DAHR looked healthy:

• https://httpbin.org/get → 200, because permissive targets ignore a bogus Authorization header
• api.github.com → 401 "Bad credentials", because GitHub validates it
• raw.githubusercontent.com → 404, GitHub's answer to invalid auth on raw content

It also meant a token passed off production was silently dropped, since the flag is false there.

Fix

Forward the header only when the caller actually supplied a token. The inbound session-id control is untouched — isAuthorizedRequest still gates access to the proxy exactly as before. The outbound gate requiresAuthorization had no other caller and is removed, along with the now-unused targetUrl parameter.

Tests

New Proxy.test.ts (there was no proxy coverage at all). Verified non-vacuous: restoring the unconditional injection makes the first case fail.

• no token + production flag → no Authorization header, and nothing containing undefined
• token supplied → Bearer <token>
• token supplied off production → still forwarded, not dropped
• the inbound x-dahr-session-id header is still stamped

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes

  • Authorization headers are now forwarded only when explicitly provided by the caller.
  • Requests without a supplied token no longer receive an unintended authorization header.
  • Session identification headers continue to be included correctly.

• Tests

  • Added coverage for authorization behavior across production and non-production proxy configurations.

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.

_{Tip: disable this comment in your organization's Code Review settings.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: a90da789-f637-4a3a-8eb2-6dcce6434d72

📥 Commits

Reviewing files that changed from the base of the PR and between 1a15d73 and 1736aa9.

📒 Files selected for processing (2)

• src/features/web2/proxy/Proxy.test.ts
• src/features/web2/proxy/Proxy.ts

---

Walkthrough

The proxy now forwards Authorization only when supplied by the caller, removing URL/method-based authorization injection. New Jest tests validate token forwarding, omission of empty tokens, and session ID headers.

Changes

Proxy authorization forwarding

Layer / File(s)	Summary
Authorization forwarding behavior src/features/web2/proxy/Proxy.ts	sendHTTPRequest and createHeaders no longer use target URL or method rules to attach authorization; supplied tokens are forwarded and the obsolete helper is removed.
Authorization header validation src/features/web2/proxy/Proxy.test.ts	Isolated Jest tests verify omitted and forwarded bearer tokens across configurations and confirm the session ID header remains present.

Estimated code review effort: 2 (Simple) | ~10 minutes

Poem

A rabbit hops through headers bright,
No stale token takes its flight.
Caller words now pass along,
Session IDs still march strong.
Tests thump softly: all is right.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main fix: stopping empty Authorization headers on proxied requests.
Linked Issues check	✅ Passed	The PR addresses the main issue by only forwarding Authorization when the caller supplies a token and preserving session-ID auth.
Out of Scope Changes check	✅ Passed	The changes stay focused on proxy Authorization behavior and matching tests, with no clear unrelated additions.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/dahr-proxy-outbound-auth

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install timed out. The project may have too many dependencies for the sandbox.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

This PR changes how the web2 proxy builds outbound authorization headers. The main changes are:

• Sends Authorization only when the caller supplies a token.
• Removes the outbound URL and method authorization gate.
• Adds tests for missing tokens, supplied tokens, and the DAHR session header.

Confidence Score: 5/5

The proxy change looks safe to merge, with a non-blocking test-discovery issue.

• Outbound authorization now follows the supplied target token.
• Inbound session authorization remains unchanged.
• The new tests are skipped by the repository's configured test pattern.

src/features/web2/proxy/Proxy.test.ts

Important Files Changed

Filename	Overview
src/features/web2/proxy/Proxy.ts	Ties the outbound bearer header to the caller-supplied token and removes the unrelated inbound-auth configuration gate.
src/features/web2/proxy/Proxy.test.ts	Adds focused authorization-header tests, but the configured test command does not discover this file.

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
src/features/web2/proxy/Proxy.test.ts:1
**Regression Tests Are Not Discovered**

The repository's test script uses `--testMatch '**/tests/**/*.ts'`, which does not match this file under `src/features/web2/proxy/`. The normal test workflow therefore skips these cases, so an authorization-header regression can pass without failing the configured suite.

_{Reviews (1): Last reviewed commit: "fix(web2): stop stamping an empty Author..." | Re-trigger Greptile}

[greptile-apps]

Regression Tests Are Not Discovered

The repository's test script uses --testMatch '**/tests/**/*.ts', which does not match this file under src/features/web2/proxy/. The normal test workflow therefore skips these cases, so an authorization-header regression can pass without failing the configured suite.

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/features/web2/proxy/Proxy.test.ts
Line: 1

Comment:
**Regression Tests Are Not Discovered**

The repository's test script uses `--testMatch '**/tests/**/*.ts'`, which does not match this file under `src/features/web2/proxy/`. The normal test workflow therefore skips these cases, so an authorization-header regression can pass without failing the configured suite.

How can I resolve this? If you propose a fix, please make it concise.