Implemented Bypass Auth for Agent Chat in the SaaS

packages/app/src/backend/routes/api/page/chat.ts

@@ -66,11 +66,7 @@ router.post('/stream', async (req, res) => {
   const agentId = req.headers['x-agent-id'] as string;
   const conversationId = req.headers['x-conversation-id'];
   const modelId = req.headers['x-model-id']; // Extract model ID for backend override
-
-  // Get auth token: priority header > session
-  // const headerAuthToken = req.headers['x-auth-token'] as string | undefined;
-  // const sessionAuthToken = req.session?.agentTokens?.[agentId];
-  // const authToken = headerAuthToken || sessionAuthToken;
+  const authToken = req.headers['x-agent-chat-token'] as string | undefined;
 
   try {
     const result = await axios.post(
@@ -85,7 +81,7 @@ router.post('/stream', async (req, res) => {
           'x-conversation-id': conversationId,
           'x-smyth-team-id': teamId,
           ...(modelId ? { 'x-model-id': modelId } : {}), // Forward model ID if provided
-          // ...(authToken ? { 'X-Auth-Token': authToken } : {}), // Forward auth token if provided
+          ...(authToken ? { 'x-agent-chat-token': authToken } : {}), // Forward auth token if provided
         },
         responseType: 'stream',
       },
@@ -146,12 +142,6 @@ router.get('/params', async (req, res) => {
 
     const responseData = result.data;
 
-    // Check if session already has a valid token for this agent (persist auth across page reloads)
-    // const sessionToken = req.session?.agentTokens?.[agentId];
-    // if (sessionToken && responseData.authRequired) {
-    //   responseData.authRequired = false;
-    // }
-
     return res.status(200).json(responseData);
   } catch (error) {
     return res
@@ -160,59 +150,6 @@ router.get('/params', async (req, res) => {
   }
 });
 
-router.post('/verify-token', async (req, res) => {
-  const agentId = req.headers['x-agent-id'];
-  const { token: bearerToken } = req.body;
-  const userId = req._user?.id;
-  const teamId = req._team?.id;
-  const accessToken = req.user.accessToken;
-
-  if (!agentId) {
-    return res.status(400).json({ success: false, message: 'Agent ID required' });
-  }
-
-  if (!bearerToken) {
-    return res.status(400).json({ success: false, message: 'Token required' });
-  }
-
-  try {
-    const result = await axios.post(
-      getAgentServerURL(agentId as string, isUsingLocalServer) + '/emb/auth/verify',
-      { token: bearerToken },
-      {
-        headers: {
-          ...includeAxiosAuth(accessToken).headers,
-          'x-user-id': userId,
-          'x-team-id': teamId,
-          'X-AGENT-ID': agentId,
-        },
-        withCredentials: true,
-      },
-    );
-
-    // Forward any cookies from SRE response
-    // const setCookie = result.headers['set-cookie'];
-    // if (setCookie) {
-    //   res.setHeader('set-cookie', setCookie);
-    // }
-
-    // Store token in session for subsequent requests (Option B: server-side storage)
-    // if (result.data.success) {
-    //   if (!req.session.agentTokens) {
-    //     req.session.agentTokens = {};
-    //   }
-    //   req.session.agentTokens[agentId as string] = bearerToken;
-    // }
-
-    return res.json(result.data);
-  } catch (error) {
-    return res.status(401).json({
-      success: false,
-      message: error.response?.data?.message || 'Token verification failed',
-    });
-  }
-});
-
 router.post('/new', async (req, res) => {
   try {
     const agentId = req.body.conversation?.aiAgentId;

packages/app/src/react/features/ai-chat/clients/chat-api.client.ts

@@ -98,9 +98,6 @@ export class ChatAPIClient {
       // Notify stream start
       if (onStart) onStart();
 
-      // Get auth token from localStorage
-      // const authToken = localStorage.getItem('authToken');
-
       // Prepare request headers with optional model override
       const requestHeaders: Record<string, string> = {
         ...this.config.defaultHeaders,
@@ -110,10 +107,6 @@ export class ChatAPIClient {
         ...headers,
       };
 
-      // Add auth token to headers if it exists
-      // if (authToken) {
-      //   requestHeaders['X-Auth-Token'] = authToken;
-      // }
 
       const requestBody = { message, attachments, enableMetaMessages: true };
 

packages/app/src/react/features/ai-chat/components/chat-content.tsx

@@ -1,10 +1,9 @@
 import {
   ArrowLeftIcon,
-  AuthOverlay,
   Chats,
   Footer,
   Header,
-  LoadingSkeleton,
+  LoadingSkeleton
 } from '@react/features/ai-chat/components';
 import { DEFAULT_AVATAR_URL } from '@react/features/ai-chat/constants';
 import { useChatStores } from '@react/features/ai-chat/hooks';
@@ -21,9 +20,6 @@ export const ChatContent = () => {
   // Loading state
   if (pageState === 'loading') return <LoadingSkeleton />;
 
-  // Auth required
-  if (pageState === 'auth-required') return <AuthOverlay />;
-
   // Chatbot disabled
   if (pageState === 'disabled') {
     const agentName = agent?.data?.name || 'Agent';