zhi/HarborForge.Backend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: monitor API key flow and versioned telemetry #10

Merged
hzhang merged 5 commits from feat/monitor-api-key-v2 into main 2026-03-20 09:18:09 +00:00
Conversation 0 Commits 5 Files Changed 6 +220 -670
zhi commented 2026-03-20 09:16:01 +00:00
Owner
Copy Link

Summary

  • switch monitor server auth to API key-only flow
  • remove deprecated challenge/WebSocket monitor path
  • store plugin_version separately from openclaw_version
  • harden server deletion against FK failures

Validation

  • backend syntax checked
  • validated against t1 real plugin telemetry
  • delete endpoint verified on t1 (204)
## Summary - switch monitor server auth to API key-only flow - remove deprecated challenge/WebSocket monitor path - store `plugin_version` separately from `openclaw_version` - harden server deletion against FK failures ## Validation - backend syntax checked - validated against t1 real plugin telemetry - delete endpoint verified on t1 (204)
zhi added 5 commits 2026-03-20 09:16:01 +00:00
feat(monitor): add API Key authentication for server heartbeat c70f90cb52 
- Add api_key field to MonitoredServer model with unique index
- Add migration to create api_key column
- Add POST /admin/servers/{id}/api-key for key generation
- Add DELETE /admin/servers/{id}/api-key for key revocation
- Add POST /server/heartbeat-v2 with X-API-Key header auth
- TelemetryPayload includes load_avg and uptime_seconds
fix(monitoring): handle timezone-naive datetimes in get_server_states_view a0d0c7b3a1 
Fixes datetime comparison error when last_seen_at from database is
offset-naive (no timezone info) while 'now' is offset-aware (UTC).

This resolves the TypeError: can't subtract offset-naive and
offset-aware datetimes issue in integration tests.
feat(monitor): store plugin version separately from openclaw version 97f12cac7a 
- Add server_states.plugin_version column
- Keep openclaw_version for remote OpenClaw runtime version
- Expose plugin_version in monitor server view
- Accept and persist plugin_version in heartbeat payloads
refactor(monitor): remove deprecated challenge flow 8e0f158266 
- Remove challenge issuance endpoint
- Remove monitor websocket challenge handshake flow
- Remove challenge/nonce runtime models
- Keep API key as the only server auth path
fix(monitor): harden server delete and remove challenge docs 9b5e2dc15c 
- Delete server state before monitored server to avoid FK 500s
- Keep legacy cleanup for obsolete challenge tables
- Rewrite monitor docs to API key-only flow
hzhang merged commit d67f676006 into main 2026-03-20 09:18:09 +00:00
hzhang deleted branch feat/monitor-api-key-v2 2026-03-20 09:18:09 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
nav orion river zhi
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: zhi/HarborForge.Backend#10
Delete Branch "feat/monitor-api-key-v2"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?