openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-22 03:35:29 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

[PR #146] [CLOSED] fix(cors): add Access-Control-Allow-Origin headers to API and downloads #274

New Issue
Closed
opened 2026-02-15 17:16:37 -05:00 by yindo · 0 comments
yindo commented 2026-02-15 17:16:37 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/openclaw/clawhub/pull/146
Author: @Grenghis-Khan
Created: 2/5/2026
Status: ❌ Closed

Base: main ← Head: fix/cors-headers

📝 Commits (3)

  • 3c79392 fix(cors): add Access-Control-Allow-Origin headers to API and downloads
  • 5fc3d0c fix: add CORS to error/raw paths & add CLI install auth
  • 8f20a72 fix: add OPTIONS handler for CORS preflight

📊 Changes

5 files changed (+66 additions, -10 deletions)

View changed files

📝 convex/downloads.ts (+17 -4)
📝 convex/http.ts (+7 -0)
📝 convex/httpApiV1.ts (+16 -0)
📝 packages/clawdhub/src/cli/commands/skills.ts (+6 -2)
📝 packages/clawdhub/src/http.ts (+20 -4)

📄 Description

Description

This PR resolves "Server Error" / CORS failures in the Web UI and "Skill not found" errors in the CLI for newly published skills.
Fixes https://github.com/openclaw/clawhub/issues/143

Context

  1. Web UI (CORS): The frontend was blocked from accessing backend API endpoints (downloads, raw files) due to missing Access-Control-Allow-Origin headers. This caused failures in "GitHub Import" verification and skill downloading.
  2. CLI (Auth): The clawhub install command was making anonymous requests. This caused "Skill not found" errors for skills that were "pending scan" or otherwise not yet fully public, even for the owner.

Changes

  • Convex (Backend):
    • Added Access-Control-Allow-Origin: * to json() and text() helpers in convex/httpApiV1.ts.
    • Added Access-Control-Allow-Origin: * to downloadZip success AND error responses (400/404/410) in convex/downloads.ts.
    • Added Access-Control-Allow-Origin: * to raw file endpoints (skill/soul files) in convex/httpApiV1.ts.
  • CLI (clawhub ):
    • Updated cmdInstall to retrieve the authenticated user's token.
    • Updated downloadZip and fetchBinaryViaCurl to pass the Authorization: Bearer <token> header if present.

Verification Results

  • Verified CORS headers are present on success, error, and raw file responses.
  • Verified clawhub install uses authentication, allowing owners to install pending skills.
  • Ensured minimal diff and adherence to code style.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/openclaw/clawhub/pull/146 **Author:** [@Grenghis-Khan](https://github.com/Grenghis-Khan) **Created:** 2/5/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/cors-headers` --- ### 📝 Commits (3) - [`3c79392`](https://github.com/openclaw/clawhub/commit/3c79392eed3016180964402d42cbb6e49161998b) fix(cors): add Access-Control-Allow-Origin headers to API and downloads - [`5fc3d0c`](https://github.com/openclaw/clawhub/commit/5fc3d0ca655b933624a5c764e018c9a09135c65b) fix: add CORS to error/raw paths & add CLI install auth - [`8f20a72`](https://github.com/openclaw/clawhub/commit/8f20a7230793e35d9dcd7bc5ac8238210e952d9c) fix: add OPTIONS handler for CORS preflight ### 📊 Changes **5 files changed** (+66 additions, -10 deletions) <details> <summary>View changed files</summary> 📝 `convex/downloads.ts` (+17 -4) 📝 `convex/http.ts` (+7 -0) 📝 `convex/httpApiV1.ts` (+16 -0) 📝 `packages/clawdhub/src/cli/commands/skills.ts` (+6 -2) 📝 `packages/clawdhub/src/http.ts` (+20 -4) </details> ### 📄 Description ### Description This PR resolves "Server Error" / CORS failures in the Web UI and "Skill not found" errors in the CLI for newly published skills. **Fixes [https://github.com/openclaw/clawhub/issues/143](https://github.com/openclaw/clawhub/issues/143)** ### Context 1. **Web UI (CORS)**: The frontend was blocked from accessing backend API endpoints (downloads, raw files) due to missing `Access-Control-Allow-Origin` headers. This caused failures in "GitHub Import" verification and skill downloading. 2. **CLI (Auth)**: The `clawhub install` command was making anonymous requests. This caused "Skill not found" errors for skills that were "pending scan" or otherwise not yet fully public, even for the owner. ### Changes - **Convex (Backend)**: - Added `Access-Control-Allow-Origin: *` to `json()` and `text()` helpers in `convex/httpApiV1.ts`. - Added `Access-Control-Allow-Origin: *` to `downloadZip` success AND error responses (400/404/410) in `convex/downloads.ts`. - Added `Access-Control-Allow-Origin: *` to raw file endpoints (skill/soul files) in `convex/httpApiV1.ts`. - **CLI (`clawhub` )**: - Updated `cmdInstall` to retrieve the authenticated user's token. - Updated `downloadZip` and `fetchBinaryViaCurl` to pass the `Authorization: Bearer <token>` header if present. ### Verification Results - Verified CORS headers are present on success, error, and raw file responses. - Verified `clawhub install` uses authentication, allowing owners to install pending skills. - Ensured minimal diff and adherence to code style. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-02-15 17:16:37 -05:00
yindo closed this issue 2026-02-15 17:16:37 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#274
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?