Skip to content

Add /api/dev/session for curl-based testing #885

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
nicoalbanese wants to merge 9 commits into
base: main
Choose a base branch
from
Draft

Add /api/dev/session for curl-based testing #885

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
621b330
Add /api/dev/session for curl-based testing
nicoalbanese May 21, 2026
805b534
Give bot user a @vercel.com email to bypass trial-user gate
nicoalbanese May 21, 2026
1af0bde
Add scripts/test-agent.sh smoke test for the curl-driven flow
nicoalbanese May 21, 2026
7dc6ff7
Support --session follow-ups in scripts/test-agent.sh
nicoalbanese May 21, 2026
6ac0f4e
Use configured auth lifetime for dev sessions
nicoalbanese May 21, 2026
870e743
Rename dev auth secret for production safety
nicoalbanese May 21, 2026
dfd3d4d
Update apps/web/.env.example
nicoalbanese May 21, 2026
77255f9
Delete old bot sessions before minting a new one
nicoalbanese May 22, 2026
c717d42
Require explicit opt-in for dev session auth
nicoalbanese May 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions AGENTS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ This file provides guidance for AI coding agents working in this repository.

- [Architecture & Workspace Structure](docs/agents/architecture.md)
- [Code Style & Patterns](docs/agents/code-style.md)
- [Testing the App via curl](docs/agents/endpoints.md)
- [Lessons Learned](docs/agents/lessons-learned.md)

## Authentication
Expand All @@ -16,6 +17,8 @@ Authentication uses [Better Auth](https://www.better-auth.com/) with Vercel OAut

Key env vars: `BETTER_AUTH_SECRET` (session signing), `NEXT_PUBLIC_VERCEL_APP_CLIENT_ID` + `VERCEL_APP_CLIENT_SECRET` (Vercel OAuth), plus GitHub App credentials for repo access. See `apps/web/.env.example` for the full list.

For testing without a browser, `POST /api/dev/session` mints a real session cookie for the dedicated test bot user. See [Testing the App via curl](docs/agents/endpoints.md) for the full flow.

## Database & Migrations

Schema lives in `apps/web/lib/db/schema.ts`. Migrations are managed by Drizzle Kit.
Expand Down
14 changes: 14 additions & 0 deletions apps/web/.env.example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,3 +37,17 @@ NEXT_PUBLIC_VERCEL_PROJECT_PRODUCTION_URL=
# Optional base snapshot for fresh sandboxes. If unset, sandboxes use Vercel's standard Sandbox runtime.
# Use a snapshot created in/accessible to your own Vercel scope.
VERCEL_SANDBOX_BASE_SNAPSHOT_ID=

# Dev-only test auth (enables POST /api/dev/session)
# When both values are set, the dev session endpoint mints a real Better Auth
# session for a dedicated test-bot user so the app is testable via curl.
# Disabled on production deployments (VERCEL_ENV=production) regardless of
# these values.
#
# Do not set these in production on any host.
# Set to "true" to explicitly enable the endpoint for local or preview testing.
OPEN_AGENTS_ALLOW_TEST_AUTH_DO_NOT_SET_IN_PRODUCTION=
#
# Generate a 32-byte secret: `openssl rand -hex 32`
# Must be at least 64 hex characters or the endpoint returns 404.
OPEN_AGENTS_TEST_AUTH_SECRET_DO_NOT_SET_IN_PRODUCTION=
Loading