mirror/nanobot
1
0
Fork 0
mirror of https://github.com/HKUDS/nanobot.git synced 2026-05-20 00:22:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(websocket): do not trigger pairing on authenticated WS connections

Browse Source 
WebSocket already authenticates clients at handshake time via token
or issued-token validation. Setting is_dm=True caused unrecognised
clients to receive a pairing code after they had already passed
token auth, which is nonsensical for a browser-tab client.

Treat WebSocket as non-DM so pairing is never offered; access control
remains at the WS handshake level (allow_from + token gate).
This commit is contained in:
chengyongru 2026-05-14 11:32:29 +08:00 committed by Xubin Ren
parent 9bc86ee825
commit f47b8f0819
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
nanobot/channels/websocket.py
View File

@ -1249,14 +1249,15 @@ class WebSocketChannel(BaseChannel):
content = _parse_inbound_payload(raw) content = _parse_inbound_payload(raw)
if content is None: if content is None:
continue continue
# WebSocket connections are always treated as 1:1 (DM) because # WebSocket already authenticates at handshake time (token),
# each connection represents a single client browser/tab. # so pairing is not applicable. Treat as non-DM to avoid
# sending pairing codes to an already-authenticated client.
await self._handle_message( await self._handle_message(
sender_id=client_id, sender_id=client_id,
chat_id=default_chat_id, chat_id=default_chat_id,
content=content, content=content,
metadata={"remote": getattr(connection, "remote_address", None)}, metadata={"remote": getattr(connection, "remote_address", None)},
is_dm=True, is_dm=False,
) )
except Exception as e: except Exception as e:
self.logger.debug("connection ended: {}", e) self.logger.debug("connection ended: {}", e)
@ -1402,7 +1403,7 @@ class WebSocketChannel(BaseChannel):
content=content, content=content,
media=media_paths or None, media=media_paths or None,
metadata=metadata, metadata=metadata,
is_dm=True, is_dm=False,
) )
return return
await self._send_event(connection, "error", detail=f"unknown type: {t!r}") await self._send_event(connection, "error", detail=f"unknown type: {t!r}")