openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-22 03:35:29 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

[PR #296] [MERGED] fix(cors): complete CORS + tokenized CLI reads #315

New Issue
Closed
opened 2026-02-15 17:16:51 -05:00 by yindo · 0 comments
yindo commented 2026-02-15 17:16:51 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/openclaw/clawhub/pull/296
Author: @steipete
Created: 2/14/2026
Status: ✅ Merged
Merged: 2/14/2026
Merged by: @steipete

Base: main ← Head: temp/landpr-146-cors

📝 Commits (5)

  • 39612fc fix(cors): add Access-Control-Allow-Origin headers to API and downloads
  • 8118127 fix: add CORS to error/raw paths & add CLI install auth
  • a07ddf9 fix: add OPTIONS handler for CORS preflight
  • 5c2ef1b fix(cors): complete CORS + tokenized CLI reads
  • beebccd test(cli): fix config mock typing

📊 Changes

14 files changed (+164 additions, -28 deletions)

View changed files

📝 CHANGELOG.md (+1 -0)
📝 convex/downloads.ts (+33 -8)
📝 convex/http.ts (+7 -0)
📝 convex/httpApi.ts (+2 -0)
📝 convex/httpApiV1.ts (+33 -0)
📝 convex/lib/httpRateLimit.ts (+1 -0)
📝 packages/clawdhub/src/cli/commands/inspect.test.ts (+5 -0)
📝 packages/clawdhub/src/cli/commands/inspect.ts (+8 -3)
📝 packages/clawdhub/src/cli/commands/skills.test.ts (+32 -1)
📝 packages/clawdhub/src/cli/commands/skills.ts (+14 -7)
📝 packages/clawdhub/src/cli/commands/sync.ts (+1 -1)
📝 packages/clawdhub/src/cli/commands/syncHelpers.ts (+4 -2)
📝 packages/clawdhub/src/http.test.ts (+7 -2)
📝 packages/clawdhub/src/http.ts (+16 -4)

📄 Description

Fixes #143.

Port/supersede #146 (fork branch was conflicting).

Changes:

  • Convex: CORS headers on API + download success and error paths (incl. 429 rate limit), legacy API helpers updated.
  • Convex: OPTIONS preflight handler now reflects requested headers.
  • CLI: pass optional API token for install/update/inspect/sync read paths + download.
  • Tests + changelog.

Verified: bun run lint, bun run test, bun run build.

Greptile Overview

Greptile Summary

Added comprehensive CORS support with proper preflight handling and Access-Control-Allow-Origin headers on all API endpoints, error paths, and download routes. CLI commands now pass optional API tokens for authenticated read operations (install/update/inspect/sync), enabling owners to access their private or hidden skills. Changes are well-tested with new test cases covering token authentication flow.

Confidence Score: 5/5

  • This PR is safe to merge with minimal risk
  • The implementation is thorough and well-tested. CORS headers are consistently applied across all response paths (success and error), the preflight handler correctly reflects requested headers, and token authentication is properly integrated into CLI commands with appropriate test coverage. No security vulnerabilities or logical errors were identified.
  • No files require special attention

Last reviewed commit: 5c2ef1b

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/openclaw/clawhub/pull/296 **Author:** [@steipete](https://github.com/steipete) **Created:** 2/14/2026 **Status:** ✅ Merged **Merged:** 2/14/2026 **Merged by:** [@steipete](https://github.com/steipete) **Base:** `main` ← **Head:** `temp/landpr-146-cors` --- ### 📝 Commits (5) - [`39612fc`](https://github.com/openclaw/clawhub/commit/39612fc6b1d0bbcd6a472c27d20968c760611c10) fix(cors): add Access-Control-Allow-Origin headers to API and downloads - [`8118127`](https://github.com/openclaw/clawhub/commit/8118127f0923d01b71ac64c176d3a48adf7cecb2) fix: add CORS to error/raw paths & add CLI install auth - [`a07ddf9`](https://github.com/openclaw/clawhub/commit/a07ddf98971a1c8684b72512c9e9a03a8f939bf5) fix: add OPTIONS handler for CORS preflight - [`5c2ef1b`](https://github.com/openclaw/clawhub/commit/5c2ef1be3f44071b56e6073e508538b1908d8dba) fix(cors): complete CORS + tokenized CLI reads - [`beebccd`](https://github.com/openclaw/clawhub/commit/beebccd2b28f7dab0ce166d4b74fb65ebf66060e) test(cli): fix config mock typing ### 📊 Changes **14 files changed** (+164 additions, -28 deletions) <details> <summary>View changed files</summary> 📝 `CHANGELOG.md` (+1 -0) 📝 `convex/downloads.ts` (+33 -8) 📝 `convex/http.ts` (+7 -0) 📝 `convex/httpApi.ts` (+2 -0) 📝 `convex/httpApiV1.ts` (+33 -0) 📝 `convex/lib/httpRateLimit.ts` (+1 -0) 📝 `packages/clawdhub/src/cli/commands/inspect.test.ts` (+5 -0) 📝 `packages/clawdhub/src/cli/commands/inspect.ts` (+8 -3) 📝 `packages/clawdhub/src/cli/commands/skills.test.ts` (+32 -1) 📝 `packages/clawdhub/src/cli/commands/skills.ts` (+14 -7) 📝 `packages/clawdhub/src/cli/commands/sync.ts` (+1 -1) 📝 `packages/clawdhub/src/cli/commands/syncHelpers.ts` (+4 -2) 📝 `packages/clawdhub/src/http.test.ts` (+7 -2) 📝 `packages/clawdhub/src/http.ts` (+16 -4) </details> ### 📄 Description Fixes #143. Port/supersede #146 (fork branch was conflicting). Changes: - Convex: CORS headers on API + download success and error paths (incl. 429 rate limit), legacy API helpers updated. - Convex: OPTIONS preflight handler now reflects requested headers. - CLI: pass optional API token for install/update/inspect/sync read paths + download. - Tests + changelog. Verified: `bun run lint`, `bun run test`, `bun run build`. <!-- greptile_comment --> <h2>Greptile Overview</h2> <h3>Greptile Summary</h3> Added comprehensive CORS support with proper preflight handling and Access-Control-Allow-Origin headers on all API endpoints, error paths, and download routes. CLI commands now pass optional API tokens for authenticated read operations (install/update/inspect/sync), enabling owners to access their private or hidden skills. Changes are well-tested with new test cases covering token authentication flow. <h3>Confidence Score: 5/5</h3> - This PR is safe to merge with minimal risk - The implementation is thorough and well-tested. CORS headers are consistently applied across all response paths (success and error), the preflight handler correctly reflects requested headers, and token authentication is properly integrated into CLI commands with appropriate test coverage. No security vulnerabilities or logical errors were identified. - No files require special attention <sub>Last reviewed commit: 5c2ef1b</sub> <!-- greptile_other_comments_section --> <!-- /greptile_comment --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-02-15 17:16:51 -05:00
yindo closed this issue 2026-02-15 17:16:51 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#315
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?