Keep the agent routes out of the API switch (forum 18241) - #1755
Merged
fog-workflows[bot] merged 3 commits intoSep 10, 2026
Conversation
With FOG_API_ENABLED off, Route answered every request with a 308 to management/index.php before it looked at the path. That included /agent/v1/, so no fog-agent could enroll or poll on a server with the REST API off: POST https://192.168.1.100/fog/agent/v1/enroll HTTP/1.1 308 Permanent Redirect Location: https://192.168.1.100/fog/management/index.php The setting governs the REST API that people and API tokens use. The agent routes are FOG's client channel, like service/*.php, which the setting never governed. They keep their own gate: enroll issues nothing without an approval, and every other agent route needs a certificate bound to a host. Behavior change: with the API off, /agent/v1/ now answers as it does with the API on. Every other API route still gets the 308. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YBAeoaZ3a3chFAvQdfxrh7
route-read-path-guards.test.php finds the agent block by its `self::AGENT_ROUTE_SEGMENT)` condition. The previous commit rewrote that condition to reuse $isAgentRoute, so the test found no block and failed two checks about FOG_MACHINE_REQUEST. The original text goes back; only the API switch uses $isAgentRoute. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YBAeoaZ3a3chFAvQdfxrh7
CI's phpstan tests pass analyses tests/ as one program. route-read-path-guards.test.php already declares runChild() and child(), so phpstan read this test's calls against those declarations and reported six errors. The helpers are now apiSwitchRunChild() and apiSwitchChild(). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YBAeoaZ3a3chFAvQdfxrh7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
With
FOG_API_ENABLEDoff,Route::__construct()sends a 308 tomanagement/index.phpbefore it looks at the path. That includes/agent/v1/. No fog-agent can enroll or poll on a server with the REST API off.Reported in forum topic 18241:
That
Locationshape (absolute, no query) comes only from this gate. The schema redirect carries?node=schema, and it already skips agent routes.Workaround until this merges: turn
FOG_API_ENABLEDon.Change
The API switch now skips paths under
<webroot>/agent/v1/. The agent routes keep their own gate: enroll issues nothing without an approval, and every other agent route needs a certificate bound to a host.Behavior change: with the API off,
/agent/v1/answers as it does with the API on. Every other API route still gets the 308.Access change
This widens what is reachable when an admin has turned the API off. Enroll becomes reachable anonymously again (it still needs an approval to issue anything). A maintainer approved this.
Tests
tests/agent-routes-ignore-api-switch.test.phpconstructsRoutein child processes withFOG_API_ENABLED=0:POST /fog/agent/v1/enrollPOST /fog/agent/v1/pollno_client_certificatePOST /fog/hostworking-1.6: 3 of 4 checks fail, each with the reporter's 308. On this branch: 4 of 4 pass.route-read-path-guards.test.php(2 of 139 failed). It rewrote the agent block's condition, and that test finds the block by that text. The second commit restores the text. It now passes 139 of 139.route-read-path-guards.test.php. The third commit prefixes them. Both phpstan passes are clean locally.tests/run-all.sh: 355 passed, 0 failed.🤖 Generated with Claude Code
https://claude.ai/code/session_01YBAeoaZ3a3chFAvQdfxrh7