fix(installer): add authentication to curl/Invoke-WebRequest calls by heditar · Pull Request #226 · OpenAEV-Platform/agent

Hedi (heditar) · 2026-09-15T16:09:08Z

Proposed changes

This PR adds the Authorization: Bearer ${OPENAEV_TOKEN} header to all curl and Invoke-WebRequest calls in the installation/update scripts. Another PR on the backend makes authentication mandatory: https://github.com/OpenAEV-Platform/ope_

How to test

see with Hedi (@heditar)

Files updated

installer/linux/agent-installer*.sh, installer/linux/agent-upgrade*.sh
installer/macos/agent-installer*.sh, installer/macos/agent-upgrade*.sh
installer/windows/agent-installer*.ps1, installer/windows/agent-upgrade*.ps1
I consider the submitted work as finished
[] I tested the code for its functionality -> STILL BEING TESTED
[NA] I wrote test cases for the relevant uses case
I added/update the relevant documentation (either on github or on notion)
Where necessary I refactored code to improve the overall quality
[NA] For bug fix -> I implemented a test that covers the bug

…ebRequest Les scripts d'installation et de mise à jour de l'agent (linux, macos, windows) téléchargeaient l'exécutable et le package d'installation sans authentification. Ajout du header Authorization: Bearer ${OPENAEV_TOKEN} sur tous les appels curl et Invoke-WebRequest. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Adds bearer-token authentication to agent installation and upgrade downloads across Linux, macOS, and Windows scripts.

Changes:

Adds Authorization: Bearer headers to curl and Invoke-WebRequest calls.
Covers installer and upgrade flows for service, service-user, and session-user modes.

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Reviewed changes
`installer/windows/agent-upgrade.ps1`	Authenticated upgrade; fallback URI retains an invalid token segment and malformed query separator.
`installer/windows/agent-upgrade-session-user.ps1`	Authenticated session-user upgrade; fallback URI retains an invalid token segment and malformed query separator.
`installer/windows/agent-upgrade-service-user.ps1`	Authenticated service-user upgrade.
`installer/windows/agent-installer.ps1`	Authenticated Windows installer download.
`installer/windows/agent-installer-session-user.ps1`	Authenticated session-user installer download.
`installer/windows/agent-installer-service-user.ps1`	Authenticated service-user installer download.
`installer/macos/agent-upgrade.sh`	Authenticated upgrade; fallback route retains a legacy token segment.
`installer/macos/agent-upgrade-session-user.sh`	Authenticated session-user upgrade; fallback route retains a legacy token segment.
`installer/macos/agent-upgrade-service-user.sh`	Authenticated service-user upgrade.
`installer/macos/agent-installer.sh`	Authenticated macOS installer download.
`installer/macos/agent-installer-session-user.sh`	Authenticated session-user installer download.
`installer/macos/agent-installer-service-user.sh`	Authenticated service-user installer download.
`installer/linux/agent-upgrade.sh`	Authenticated upgrade; failure logging can expose the bearer token and the fallback route retains a token segment.
`installer/linux/agent-upgrade-session-user.sh`	Authenticated session-user upgrade; failure logging can expose the bearer token and the fallback route retains a token segment.
`installer/linux/agent-upgrade-service-user.sh`	Authenticated service-user upgrade; failure logging can expose the bearer token.
`installer/linux/agent-installer.sh`	Authenticated installer download; failure logging can expose the bearer token.
`installer/linux/agent-installer-session-user.sh`	Authenticated session-user installer download; failure logging can expose the bearer token.
`installer/linux/agent-installer-service-user.sh`	Authenticated service-user installer download; failure logging can expose the bearer token.

Suppressed comments (6)

installer/linux/agent-upgrade-session-user.sh:74

With the new Authorization header, this request should use the installer route without a token path segment. The backend route ends at .../agent/installer/openaev/{platform}/{installationMode}; appending /${OPENAEV_TOKEN} adds an extra segment and returns 404, so the fallback branch still cannot upgrade installations that do not have the new directory. Remove the token segment and rely on the header.

run curl -sSfLG -H "Authorization: Bearer ${OPENAEV_TOKEN}" ${base_url}/api/tenants/${tenant_id}/agent/installer/openaev/${os}/session-user/${OPENAEV_TOKEN} --data-urlencode "installationDir=${openaev_dir}" --data-urlencode "serviceName=${openaev_session}" -o "$tmp_installer"

installer/linux/agent-upgrade.sh:64

With the new Authorization header, this request should use the installer route without a token path segment. The backend route ends at .../agent/installer/openaev/{platform}/{installationMode}; appending /${OPENAEV_TOKEN} adds an extra segment and returns 404, so the fallback branch still cannot upgrade installations that do not have the new directory. Remove the token segment and rely on the header.

run curl -sSfLG -H "Authorization: Bearer ${OPENAEV_TOKEN}" ${base_url}/api/tenants/${tenant_id}/agent/installer/openaev/${os}/service/${OPENAEV_TOKEN} --data-urlencode "installationDir=${openaev_dir}" --data-urlencode "serviceName=${openaev_service}" -o "$tmp_installer"

installer/macos/agent-upgrade-session-user.sh:55

With the new Authorization header, this request should use the installer route without a token path segment. The backend route ends at .../agent/installer/openaev/{platform}/{installationMode}; appending /${OPENAEV_TOKEN} adds an extra segment and returns 404, so the fallback branch still cannot upgrade installations that do not have the new directory. Remove the token segment and rely on the header.

curl -sSfLG -H "Authorization: Bearer ${OPENAEV_TOKEN}" ${base_url}/api/tenants/${tenant_id}/agent/installer/openaev/${os}/session-user/${OPENAEV_TOKEN} --data-urlencode "installationDir=${openaev_dir}" --data-urlencode "serviceName=${openaev_session}" | sh

installer/macos/agent-upgrade.sh:56

With the new Authorization header, this request should use the installer route without a token path segment. The backend route ends at .../agent/installer/openaev/{platform}/{installationMode}; appending /${OPENAEV_TOKEN} adds an extra segment and returns 404, so the fallback branch still cannot upgrade installations that do not have the new directory. Remove the token segment and rely on the header.

curl -sSfLG -H "Authorization: Bearer ${OPENAEV_TOKEN}" ${base_url}/api/tenants/${tenant_id}/agent/installer/openaev/${os}/service/${OPENAEV_TOKEN} --data-urlencode "installationDir=${openaev_dir}" --data-urlencode "serviceName=${openaev_service}" | sh

installer/windows/agent-upgrade-session-user.ps1:63

With the new Authorization header, this URI still appends a legacy token path segment, but the installer route ends at .../agent/installer/openaev/windows/{installationMode}; the extra segment makes the request return 404. The literal & also does not delimit serviceName in PowerShell. Remove the token segment and use & for the query separator.

Invoke-WebRequest -Uri "${OPENAEV_URL}/api/tenants/${OPENAEV_TENANT_ID}/agent/installer/openaev/windows/session-user/${OPENAEV_TOKEN}?installationDir=$installationDir&amp;serviceName=$serviceName" -Headers @{ "Authorization" = "Bearer ${OPENAEV_TOKEN}" } -OutFile "openaev-installer.ps1";

installer/windows/agent-upgrade.ps1:31

With the new Authorization header, this URI still appends a legacy token path segment, but the installer route ends at .../agent/installer/openaev/windows/{installationMode}; the extra segment makes the request return 404. The literal & also does not delimit serviceName in PowerShell. Remove the token segment and use & for the query separator.

Invoke-WebRequest -Uri "${OPENAEV_URL}/api/tenants/${OPENAEV_TENANT_ID}/agent/installer/openaev/windows/service/${OPENAEV_TOKEN}?installationDir=$installationDir&amp;serviceName=$serviceName" -Headers @{ "Authorization" = "Bearer ${OPENAEV_TOKEN}" } -OutFile "openaev-installer.ps1";

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Laurent Giovannoni (laugiov) · 2026-09-16T15:23:13Z

 openaev_session=$(printf %s "${session_name}" | sed 's/openbas/openaev/g')
 tmp_installer="$(mktemp)" || die "mktemp failed"
-run curl -sSfLG ${base_url}/api/tenants/${tenant_id}/agent/installer/openaev/${os}/session-user/${OPENAEV_TOKEN} --data-urlencode "installationDir=${openaev_dir}" --data-urlencode "serviceName=${openaev_session}" -o "$tmp_installer"
+run curl -sSfLG -H "Authorization: Bearer ${OPENAEV_TOKEN}" ${base_url}/api/tenants/${tenant_id}/agent/installer/openaev/${os}/session-user/${OPENAEV_TOKEN} --data-urlencode "installationDir=${openaev_dir}" --data-urlencode "serviceName=${openaev_session}" -o "$tmp_installer"


My AI agent find this : This URL has three segments after openaev/ ({os}/session-user/{token}), but the route was reduced to two ({platform}/{installationMode}) in commit 92db3d12c on 28 May. So this call already returns 404 today, and adding the header will not change that.

Same pattern in agent-upgrade.sh with /service/{token}, and in the macOS equivalents.

Worth fixing separately, ideally in the same delivery since we ship platform and agent together. Note also that the token in the path is now redundant with the header, and paths end up in access and proxy logs.

I think we can fix that separatly, it doesn't impact regular upgrade, just openbas to openaev upgrade. I am not sure we still support that.

…as l'exposer dans ps Suite au commentaire de revue de Laurent : sur Linux/macOS, curl -H expose le token dans la liste des arguments visible par 'ps'. On écrit désormais le header dans un fichier temporaire restreint (umask 077) passé via --config, puis on le supprime immédiatement après l'appel. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Filigran Automation (Filigran-Automation) changed the title ~~installer: ajouter l'authentification Bearer aux appels curl/Invoke-WebRequest~~ fix(installer): ajouter l'authentification Bearer aux appels curl/Invoke-WebRequest Sep 15, 2026

Filigran Automation (Filigran-Automation) added the filigran team Item from the Filigran team. label Sep 15, 2026

Hedi (heditar) mentioned this pull request Sep 15, 2026

fix(installer): gate agent installer command behind INSTALL_AGENT capability OpenAEV-Platform/openaev#7985

Merged

5 tasks

Hedi (heditar) changed the title ~~fix(installer): ajouter l'authentification Bearer aux appels curl/Invoke-WebRequest~~ fix(installer): add authentication to curl/Invoke-WebRequest calls Sep 16, 2026

Hedi (heditar) marked this pull request as ready for review September 16, 2026 13:43

Copilot AI lite review requested due to automatic review settings September 16, 2026 13:43

Copilot started reviewing on behalf of Hedi (heditar) September 16, 2026 13:44 View session

Copilot AI reviewed Sep 16, 2026

View reviewed changes

Laurent Giovannoni (laugiov) reviewed Sep 16, 2026

View reviewed changes

Hedi (heditar) and others added 2 commits September 16, 2026 17:56

Merge branch 'main' into heditar-add-curl-auth-install-scripts

11d1d0f

Laurent Giovannoni (laugiov) approved these changes Sep 18, 2026

View reviewed changes

Hedi (heditar) merged commit a5290a0 into main Sep 18, 2026
25 of 26 checks passed

Hedi (heditar) deleted the heditar-add-curl-auth-install-scripts branch September 18, 2026 15:35

Navigation Menu

fix(installer): add authentication to curl/Invoke-WebRequest calls - #226

fix(installer): add authentication to curl/Invoke-WebRequest calls#226
Hedi (heditar) merged 3 commits into
mainfrom
heditar-add-curl-auth-install-scripts

Hedi (heditar) commented Sep 15, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Laurent Giovannoni (laugiov) Sep 16, 2026

Uh oh!

Hedi (heditar) Sep 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

Hedi (heditar) commented Sep 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed changes

How to test

Files updated

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Laurent Giovannoni (laugiov) Sep 16, 2026

Choose a reason for hiding this comment

Uh oh!

Hedi (heditar) Sep 16, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Hedi (heditar) commented Sep 15, 2026 •

edited

Loading