HIGH: _auth_label() reports anonymous guest sessions as "authed" #90

New issue

Closed

opened 2026-04-18 09:02:10 -07:00 by pyr0ball · 0 comments

pyr0ball commented

2026-04-18 09:02:10 -07:00

Owner

Summary

The /api/v1/session/bootstrap endpoint (and all structured log lines) report anonymous guest visitors as auth=authed. This breaks log-based analytics: there is no way to distinguish unauthenticated users from authenticated ones in logs.

Root Cause

app/cloud_session.py, _auth_label():

def _auth_label(user_id: str) -> str:
    if user_id in ("local", "local-dev"):
        return "local"
    if user_id == "anonymous":  # ← never matches
        return "anon"
    return "authed"

Guest sessions use user_id = f"anon-{uuid4()}" (e.g. "anon-3e8c..."), which never matches the literal string "anonymous". Every guest hits the fallthrough and returns "authed".

Fix

def _auth_label(user_id: str) -> str:
    if user_id in ("local", "local-dev"):
        return "local"
    if user_id.startswith("anon-") or user_id == "anonymous":
        return "anon"
    return "authed"

Verified

GET /api/v1/session/bootstrap with no session cookie or auth header returns:

{"auth": "authed", "tier": "free", "has_byok": true}

Expected:

{"auth": "anon", "tier": "free", "has_byok": true}

## Summary The `/api/v1/session/bootstrap` endpoint (and all structured log lines) report anonymous guest visitors as `auth=authed`. This breaks log-based analytics: there is no way to distinguish unauthenticated users from authenticated ones in logs. ## Root Cause `app/cloud_session.py`, `_auth_label()`: ```python def _auth_label(user_id: str) -> str: if user_id in ("local", "local-dev"): return "local" if user_id == "anonymous": # ← never matches return "anon" return "authed" ``` Guest sessions use `user_id = f"anon-{uuid4()}"` (e.g. `"anon-3e8c..."`), which never matches the literal string `"anonymous"`. Every guest hits the fallthrough and returns `"authed"`. ## Fix ```python def _auth_label(user_id: str) -> str: if user_id in ("local", "local-dev"): return "local" if user_id.startswith("anon-") or user_id == "anonymous": return "anon" return "authed" ``` ## Verified `GET /api/v1/session/bootstrap` with no session cookie or auth header returns: ```json {"auth": "authed", "tier": "free", "has_byok": true} ``` Expected: ```json {"auth": "anon", "tier": "free", "has_byok": true} ```