From 9c142993b89dd3f75360552c3bdf9fa2e1e76546 Mon Sep 17 00:00:00 2001 From: Kevin Shenghui Date: Thu, 26 Feb 2026 04:11:19 -0800 Subject: [PATCH] fix: preserve operator scopes for shared auth connections When connecting via shared gateway token (no device identity), the operator scopes were being cleared, causing API operations to fail with 'missing scope' errors. This fix preserves scopes when sharedAuthOk is true, allowing headless/API operator clients to retain their requested scopes. Fixes #27494 (cherry picked from commit c71c8948bd693de0391f861c31d4d6c2cce96061) --- src/gateway/server/ws-connection/message-handler.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/gateway/server/ws-connection/message-handler.ts b/src/gateway/server/ws-connection/message-handler.ts index d78066e85..28323a2ad 100644 --- a/src/gateway/server/ws-connection/message-handler.ts +++ b/src/gateway/server/ws-connection/message-handler.ts @@ -486,7 +486,7 @@ export function attachGatewayWsMessageHandler(params: { close(1008, truncateCloseReason(authMessage)); }; const clearUnboundScopes = () => { - if (scopes.length > 0 && !controlUiAuthPolicy.allowBypass) { + if (scopes.length > 0 && !controlUiAuthPolicy.allowBypass && !sharedAuthOk) { scopes = []; connectParams.scopes = scopes; }