From a8c45bf57cee5d364fbe6ca8de6a0c40604beaea Mon Sep 17 00:00:00 2001 From: hzhang Date: Wed, 10 Jun 2026 10:14:48 +0100 Subject: [PATCH] fix(api): /auth/me accepts apikey + expose task id in TaskResponse MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two contract gaps that broke the agent `hf` CLI's comment/worklog flow (apikey/padded-cell auth): - GET /auth/me used Depends(get_current_user) (JWT-only) → 401 for apikey callers. The CLI resolves the current user via /auth/me to fill comment/worklog author_id, so every `hf comment add` / `hf worklog add` failed with "Could not validate credentials". Switch to get_current_user_or_apikey (already imported), matching the rest of the apikey-accepting routes. - TaskResponse omitted the numeric `id`. CommentCreate/WorkLogCreate require a numeric task_id, which the CLI resolves from `GET /tasks/`.id — but the field was never serialized, so resolveTaskID got 0 → POST /comments|/worklogs → 404 "Task not found". Expose `id: int`. Verified on sim: hf comment add + hf worklog add now succeed end-to-end. Co-Authored-By: Claude Opus 4.8 (1M context) --- app/api/routers/auth.py | 2 +- app/schemas/schemas.py | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/app/api/routers/auth.py b/app/api/routers/auth.py index 372d88b..e303dbd 100644 --- a/app/api/routers/auth.py +++ b/app/api/routers/auth.py @@ -37,7 +37,7 @@ async def login(form_data: OAuth2PasswordRequestForm = Depends(), db: Session = @router.get("/me", response_model=schemas.UserResponse) -async def get_me(current_user: models.User = Depends(get_current_user)): +async def get_me(current_user: models.User = Depends(get_current_user_or_apikey)): return current_user diff --git a/app/schemas/schemas.py b/app/schemas/schemas.py index 5116855..79cf582 100644 --- a/app/schemas/schemas.py +++ b/app/schemas/schemas.py @@ -73,6 +73,7 @@ class TaskUpdate(BaseModel): class TaskResponse(TaskBase): + id: int status: TaskStatusEnum task_code: Optional[str] = None code: Optional[str] = None