fix: forward caller's bearer token from chat_stream to capability providers - #88
Merged
Merged
Conversation
…viders POST /a2a's authMiddleware stamps the caller's raw bearer token onto the request context (auth.ContextWithBearerToken) after authenticating it, which is what lets internal/agent thread it into capability.CallerIdentity for a provider like compute's MCP tool. chat_stream.go authenticates independently rather than going through that middleware, and never did the same stamp. Confirmed live in staging: a chat turn through POST /chat/.../sendmessage completed, but the compute tool call inside it reported no identity was forwarded, because the token never reached the context Run received.
scotwells
approved these changes
Sep 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Live in staging: a chat turn through
POST /chat/conversations/{contextId}/sendmessage(#85) completed, but the compute tool call inside it reported "no identity was forwarded."POST /a2a'sauthMiddlewarestamps the caller's raw bearer token onto the request context after authenticating it (auth.ContextWithBearerToken), which is what letsinternal/agentthread it intocapability.CallerIdentityfor a provider like compute's MCP tool.chat_stream.goauthenticates independently, since it doesn't run through that middleware, and never did the same stamp, soauth.BearerTokenFromContextread empty downstream. Same failure this endpoint exists to fix, one hop later.Adds the missing
ctx = auth.ContextWithBearerToken(...)call, and a regression test (TestChatStream_ForwardsBearerTokenForCapabilityProviders) asserting the token actually reaches the contextRunreceives — confirmed it fails without the fix and passes with it.Test plan
go build ./... && go vet ./... && go test ./...