UAT: Server-mode authentication entirely unimplemented — AuthClient, A2aHttpTransport, and auth event emission are all stubs #3636

Open
opened 2026-04-05 21:01:19 +00:00 by freemo · 1 comment
Owner

Metadata

  • Branch: fix/server-mode-auth-implementation
  • Commit Message: fix(a2a): implement server-mode authentication — AuthClient, HTTP transport bearer token validation, and AUTH_SUCCESS/AUTH_FAILURE event emission
  • Milestone: (none — backlog)
  • Parent Epic: #400

Backlog note: This issue was discovered during autonomous operation
on milestone v3.6.0. It does not block milestone completion and has been
placed in the backlog for human review and future milestone assignment.

Summary

The spec defines server mode as a multi-user collaborative hub where authentication is required. The codebase has the scaffolding (protocols, event types, audit log entries) but zero actual authentication implementation.

Affected Code Locations

  1. AuthClient protocol (src/cleveragents/a2a/clients.py, lines 79–115): Defines authenticate(token) and validate_token(token) methods. The only implementation is StubAuthClient which raises NotImplementedError for all methods.

  2. A2aHttpTransport (src/cleveragents/a2a/transport.py): The HTTP transport that would carry auth headers raises A2aNotAvailableError for all operations — it is a complete stub.

  3. AUTH_SUCCESS / AUTH_FAILURE event types (src/cleveragents/infrastructure/events/types.py, lines 72–73): Defined but the AuditEventSubscriber comment explicitly notes: "NOTE: AUTH_SUCCESS and AUTH_FAILURE have no producing service yet — server-mode authentication is not implemented."

  4. ServerConnectionConfig.auth_token_ref (src/cleveragents/a2a/server_config.py): The field exists but is never read or validated by any authentication middleware.

  5. Spec line 23573: "Local mode (stdio) bypasses authentication entirely — the agent subprocess runs with the user's local permissions." This is correct. But server mode must enforce authentication, and it does not.

Expected Behaviour (from spec)

Server mode requires authentication. The spec defines auth_token_ref on ServerConnectionConfig and the A2A protocol supports bearer token authentication. AUTH_SUCCESS and AUTH_FAILURE events should be emitted and recorded in the audit log with user_identity.

Actual Behaviour

No authentication middleware exists. StubAuthClient raises NotImplementedError. No JWT validation, no bearer token verification, no session token management. Unauthenticated requests to server-mode endpoints are not rejected.

Note: This is also related to Epic #933 (A2A Protocol Compliance), which lists "Authentication support (OAuth2/API key) for server mode" as an acceptance criterion.

Subtasks

  • Implement a concrete AuthClient class with bearer token validation (replacing StubAuthClient)
  • Wire ServerConnectionConfig.auth_token_ref into the AuthClient instantiation path
  • Implement authentication middleware in A2aHttpTransport that validates bearer tokens on every request
  • Emit AUTH_SUCCESS domain event on successful authentication, including user_identity
  • Emit AUTH_FAILURE domain event on failed authentication, including reason and attempted identity
  • Ensure AuditEventSubscriber handles AUTH_SUCCESS and AUTH_FAILURE and writes audit log entries
  • Write Behave unit test scenarios for AuthClient (valid token, expired token, malformed token, missing token)
  • Write Robot Framework integration tests verifying unauthenticated requests to server-mode endpoints return HTTP 401
  • Run nox (all default sessions) and fix any errors
  • Verify coverage >= 97% via nox -s coverage_report

Definition of Done

  • All subtasks above are checked
  • Concrete AuthClient implementation exists with bearer token validation — no NotImplementedError stubs remain in production code
  • Authentication middleware is wired into A2aHttpTransport; all server-mode requests without a valid token are rejected with HTTP 401
  • AUTH_SUCCESS and AUTH_FAILURE events are emitted on auth attempts and recorded in the audit log with user_identity
  • ServerConnectionConfig.auth_token_ref is read and used by the authentication layer
  • Integration tests verify that unauthenticated requests to server-mode endpoints are rejected with 401
  • All nox stages pass
  • Coverage >= 97%
  • PR is merged and this issue is closed

Automated by CleverAgents Bot
Supervisor: UAT Testing | Agent: ca-new-issue-creator

## Metadata - **Branch**: `fix/server-mode-auth-implementation` - **Commit Message**: `fix(a2a): implement server-mode authentication — AuthClient, HTTP transport bearer token validation, and AUTH_SUCCESS/AUTH_FAILURE event emission` - **Milestone**: _(none — backlog)_ - **Parent Epic**: #400 > **Backlog note:** This issue was discovered during autonomous operation > on milestone v3.6.0. It does not block milestone completion and has been > placed in the backlog for human review and future milestone assignment. ## Summary The spec defines server mode as a multi-user collaborative hub where authentication is required. The codebase has the scaffolding (protocols, event types, audit log entries) but zero actual authentication implementation. ### Affected Code Locations 1. **`AuthClient` protocol** (`src/cleveragents/a2a/clients.py`, lines 79–115): Defines `authenticate(token)` and `validate_token(token)` methods. The only implementation is `StubAuthClient` which raises `NotImplementedError` for all methods. 2. **`A2aHttpTransport`** (`src/cleveragents/a2a/transport.py`): The HTTP transport that would carry auth headers raises `A2aNotAvailableError` for all operations — it is a complete stub. 3. **`AUTH_SUCCESS` / `AUTH_FAILURE` event types** (`src/cleveragents/infrastructure/events/types.py`, lines 72–73): Defined but the `AuditEventSubscriber` comment explicitly notes: _"NOTE: AUTH_SUCCESS and AUTH_FAILURE have no producing service yet — server-mode authentication is not implemented."_ 4. **`ServerConnectionConfig.auth_token_ref`** (`src/cleveragents/a2a/server_config.py`): The field exists but is never read or validated by any authentication middleware. 5. **Spec line 23573**: _"Local mode (stdio) bypasses authentication entirely — the agent subprocess runs with the user's local permissions."_ This is correct. But server mode must enforce authentication, and it does not. ### Expected Behaviour (from spec) Server mode requires authentication. The spec defines `auth_token_ref` on `ServerConnectionConfig` and the A2A protocol supports bearer token authentication. `AUTH_SUCCESS` and `AUTH_FAILURE` events should be emitted and recorded in the audit log with `user_identity`. ### Actual Behaviour No authentication middleware exists. `StubAuthClient` raises `NotImplementedError`. No JWT validation, no bearer token verification, no session token management. Unauthenticated requests to server-mode endpoints are not rejected. **Note:** This is also related to Epic #933 (`A2A Protocol Compliance`), which lists "Authentication support (OAuth2/API key) for server mode" as an acceptance criterion. ## Subtasks - [ ] Implement a concrete `AuthClient` class with bearer token validation (replacing `StubAuthClient`) - [ ] Wire `ServerConnectionConfig.auth_token_ref` into the `AuthClient` instantiation path - [ ] Implement authentication middleware in `A2aHttpTransport` that validates bearer tokens on every request - [ ] Emit `AUTH_SUCCESS` domain event on successful authentication, including `user_identity` - [ ] Emit `AUTH_FAILURE` domain event on failed authentication, including reason and attempted identity - [ ] Ensure `AuditEventSubscriber` handles `AUTH_SUCCESS` and `AUTH_FAILURE` and writes audit log entries - [ ] Write Behave unit test scenarios for `AuthClient` (valid token, expired token, malformed token, missing token) - [ ] Write Robot Framework integration tests verifying unauthenticated requests to server-mode endpoints return HTTP 401 - [ ] Run `nox` (all default sessions) and fix any errors - [ ] Verify coverage >= 97% via `nox -s coverage_report` ## Definition of Done - [ ] All subtasks above are checked - [ ] Concrete `AuthClient` implementation exists with bearer token validation — no `NotImplementedError` stubs remain in production code - [ ] Authentication middleware is wired into `A2aHttpTransport`; all server-mode requests without a valid token are rejected with HTTP 401 - [ ] `AUTH_SUCCESS` and `AUTH_FAILURE` events are emitted on auth attempts and recorded in the audit log with `user_identity` - [ ] `ServerConnectionConfig.auth_token_ref` is read and used by the authentication layer - [ ] Integration tests verify that unauthenticated requests to server-mode endpoints are rejected with 401 - [ ] All nox stages pass - [ ] Coverage >= 97% - [ ] PR is merged and this issue is closed --- **Automated by CleverAgents Bot** Supervisor: UAT Testing | Agent: ca-new-issue-creator
Author
Owner

Issue triaged by project owner:

  • State: Verified
  • Priority: Backlog — Server-mode authentication is entirely unimplemented. All auth components are stubs.
  • Story Points: 13 — XXL — Requires implementing a concrete AuthClient, authentication middleware, bearer token validation, event emission, audit log integration, and comprehensive unit + integration tests. This is a major feature implementation.
  • MoSCoW: Should Have — The spec requires server mode to enforce authentication. Currently, unauthenticated requests are not rejected. This is a significant security gap for server mode, but server mode itself is not yet fully operational (it's in the v3.7.0+ scope). When server mode is prioritized, this becomes Must Have.
  • Parent Epic: #400

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: ca-project-owner

Issue triaged by project owner: - **State**: Verified - **Priority**: Backlog — Server-mode authentication is entirely unimplemented. All auth components are stubs. - **Story Points**: 13 — XXL — Requires implementing a concrete AuthClient, authentication middleware, bearer token validation, event emission, audit log integration, and comprehensive unit + integration tests. This is a major feature implementation. - **MoSCoW**: Should Have — The spec requires server mode to enforce authentication. Currently, unauthenticated requests are not rejected. This is a significant security gap for server mode, but server mode itself is not yet fully operational (it's in the v3.7.0+ scope). When server mode is prioritized, this becomes Must Have. - **Parent Epic**: #400 --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: ca-project-owner
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Blocks
#400 Epic: Post-MVP Security
cleveragents/cleveragents-core
Reference
cleveragents/cleveragents-core#3636
No description provided.