mirror of
https://github.com/tiennm99/goclaw.git
synced 2026-10-15 20:15:48 +00:00
Duy /zuey/
cf66bda618
Squash merge PR #101 after resolving dev conflicts and fixing cron GetJob snapshot race. PR CI run 26703877225 passed release-versioning, go, and web.
70 lines
3.0 KiB
Markdown
70 lines
3.0 KiB
Markdown
---
|
|
title: "RapidAPI cron SecureCLI credential fix"
|
|
description: "Diagnose and fix RapidAPI CLI credential injection from cron-triggered agent turns without changing cron credential architecture."
|
|
status: complete
|
|
priority: P1
|
|
effort: 6h
|
|
issue: 74
|
|
branch: "codex/issue-74-rapidapi-cron-plan"
|
|
tags: [bugfix, backend, security, cron, secure-cli, tdd]
|
|
blockedBy: []
|
|
blocks: []
|
|
created: "2026-05-28T11:01:28.893Z"
|
|
createdBy: "ck:plan"
|
|
source: skill
|
|
---
|
|
|
|
# RapidAPI cron SecureCLI credential fix
|
|
|
|
## Overview
|
|
|
|
Issue #74 reports `rapidapi` CLI failing from cron with `RAPIDAPI_KEY required`.
|
|
Broader cron credential context is already fixed by storing `payload.credentialUserId` on create and injecting it into cron runs. This plan keeps that architecture and focuses on RapidAPI-specific SecureCLI setup, diagnostics, and regression smoke.
|
|
|
|
## Phases
|
|
|
|
| Phase | Name | Status |
|
|
|-------|------|--------|
|
|
| 1 | [Diagnose Current RapidAPI Credential Path](./phase-01-diagnose-current-rapidapi-credential-path.md) | Complete |
|
|
| 2 | [Add RapidAPI Preset and Credential Diagnostics](./phase-02-add-rapidapi-preset-and-credential-diagnostics.md) | Complete |
|
|
| 3 | [Validate Cron Smoke and Issue Handoff](./phase-03-validate-cron-smoke-and-issue-handoff.md) | Complete |
|
|
|
|
## Dependencies
|
|
|
|
- GitHub issue: `digitopvn/goclaw#74`
|
|
- Related closed issue: `digitopvn/goclaw#54`
|
|
- Cron context path: `cmd/gateway_cron.go`, `internal/store/cron_store.go`, `internal/gateway/methods/cron.go`
|
|
- SecureCLI path: `internal/tools/credentialed_exec.go`, `internal/tools/credential_presets.go`, `internal/store/secure_cli_store.go`
|
|
- Docs to update if behavior changes: `docs/project-changelog.md`, `docs/03-tools-system.md`
|
|
|
|
## Recommended Scope
|
|
|
|
- First prove whether live config is missing `rapidapi`, missing agent grant, missing user env, or legacy cron payload.
|
|
- Add built-in RapidAPI preset only if config gap confirmed or reproducible from local tests.
|
|
- Add logs/tests that distinguish: no SecureCLI config, no grant, no `RAPIDAPI_KEY`, invalid env JSON, binary not found.
|
|
|
|
## Out of Scope
|
|
|
|
- New credential store.
|
|
- New cron auth model.
|
|
- Exposing credential values in API/logs.
|
|
- Load/stress tests.
|
|
- Direct live write smoke unless operator provides explicit credentialed environment.
|
|
|
|
## Validation Gates
|
|
|
|
- `go test ./internal/tools ./internal/store ./cmd`
|
|
- Targeted cron/SecureCLI regression tests before implementation changes.
|
|
- Manual or documented smoke: cron-created-after-fix invokes harmless `rapidapi` command and does not print secret.
|
|
|
|
## Completion Notes
|
|
|
|
- 2026-05-29: all code/test/build gates passed, including PG and SQLite builds, `go vet`, and integration race suite with local PG test DB.
|
|
- Real RapidAPI cron smoke remains operator-gated because this session did not include an approved RapidAPI key, target SecureCLI grant, or harmless endpoint.
|
|
|
|
## Unresolved Questions
|
|
|
|
- Is `rapidapi` registered in the live SecureCLI table now?
|
|
- Was the failing cron created before `v3.12.0-beta.25` / commit `f9440bac`?
|
|
- Which harmless RapidAPI endpoint should be the operator-approved smoke target?
|