Allow anonymous users to view threads

[bracesproul]

We should have a way for users to mark their current thread as private or public via the UI. If it's marked as public that should update a field on the main manager thread metadata. Then we need to update the custom auth middleware in the langgraph server to allow unauthenticated users to perform read request on the endpoints, which would be required for rendering a thread to unauthenticated users. Finally will need to update the auth middleware on the web app to allow on authenticated users to access the chat/thread ID endpoint

Agent Context

{ "tasks": [ { "id": "d4931fac-9bd5-4e09-8721-8beeb625278d", "taskIndex": 0, "request": "[original issue]\n**Allow anonymous users to view threads**\nWe should have a way for users to mark their current thread as private or public via the UI. If it's marked as public that should update a field on the main manager thread metadata. Then we need to update the custom auth middleware in the langgraph server to allow unauthenticated users to perform read request on the endpoints, which would be required for rendering a thread to unauthenticated users. Finally will need to update the auth middleware on the web app to allow on authenticated users to access the chat/thread ID endpoint", "title": "Implement anonymous thread viewing with public/private thread privacy controls", "createdAt": 1753245034240, "completed": true, "planRevisions": [ { "revisionIndex": 0, "plans": [ { "index": 0, "plan": "Add isPublic field to ManagerGraphState type in packages/shared/src/open-swe/manager/types.ts by extending the ManagerGraphStateObj with a new optional boolean field using withLangGraph reducer pattern similar to autoAcceptPlan", "completed": true, "summary": "Successfully added the `isPublic` field to the `ManagerGraphState` type in packages/shared/src/open-swe/manager/types.ts. The field was implemented using the `withLangGraph` reducer pattern with proper TypeScript typing (optional boolean), following the same pattern as the existing `autoAcceptPlan` field. The field includes comprehensive documentation explaining that it controls whether the thread is public and can be viewed by anonymous users. This establishes the foundational data structure needed for thread privacy controls throughout the application." }, { "index": 1, "plan": "Add isPublic field to ThreadMetadata interface in apps/web/src/components/v2/types.ts to support UI display of thread privacy status", "completed": true, "summary": "Successfully added the `isPublic` field to the `ThreadMetadata` interface in apps/web/src/components/v2/types.ts. The field was added as an optional boolean property to support UI display of thread privacy status. This field will be used by the UI components to determine whether to show privacy controls and display the current privacy state of threads to users." }, { "index": 2, "plan": "Update threadsToMetadata function in apps/web/src/lib/thread-utils.ts to map the isPublic field from ManagerGraphState to ThreadMetadata, defaulting to false for existing threads", "completed": true, "summary": "Successfully updated the `threadsToMetadata` function in apps/web/src/lib/thread-utils.ts to map the `isPublic` field from `ManagerGraphState` to `ThreadMetadata`. The implementation includes proper null-safe access using the optional chaining operator and nullish coalescing to default to `false` for existing threads that don't have this field set. This ensures backward compatibility with existing threads while enabling the privacy functionality for new threads." }, { "index": 3, "plan": "Create a privacy toggle UI component in apps/web/src/components/v2/thread-privacy-toggle.tsx using existing UI patterns from theme-toggle.tsx, with a lock/unlock icon and tooltip to allow users to mark threads as public or private", "completed": true, "summary": "Successfully created the ThreadPrivacyToggle component in apps/web/src/components/v2/thread-privacy-toggle.tsx following the existing UI patterns from theme-toggle.tsx. The component includes Lock/Unlock icons from lucide-react, proper tooltip integration using TooltipIconButton, stream integration for updating thread privacy state via stream.updateState(), TypeScript typing with ThreadPrivacyToggleProps interface, error handling for update failures, and accessibility features with proper aria-labels. The component is ready to be integrated into the thread header area." }, { "index": 4, "plan": "Integrate the privacy toggle component into the thread header area in apps/web/src/components/v2/thread-view.tsx, positioning it near the existing ThemeToggle and other controls in the top-right section", "completed": true, "summary": "Successfully integrated the ThreadPrivacyToggle component into the thread header area in apps/web/src/components/v2/thread-view.tsx. The component has been positioned next to the existing ThemeToggle in the top-right section of the thread header. The integration includes: (1) Added import statement for ThreadPrivacyToggle, (2) Positioned the component in a flex container with proper spacing (gap-1), (3) Passed the required props including the stream for state updates and isPublic from displayThread metadata, (4) Maintained the existing layout structure while adding the new privacy control. The privacy toggle is now accessible to users in the thread interface and will allow them to mark threads as public or private." }, { "index": 5, "plan": "Modify the LangGraph server auth middleware in apps/open-swe/src/security/auth.ts to allow unauthenticated read access for public threads by checking the isPublic field in thread metadata and bypassing authentication for threads:read operations on public threads", "completed": true, "summary": "Successfully modified the LangGraph server auth middleware in apps/open-swe/src/security/auth.ts to allow unauthenticated read access for public threads. The implementation includes: (1) Added import for createLangGraphClient utility, (2) Created isThreadPublic() function that uses the LangGraph client to fetch thread metadata and check if isPublic is true, (3) Created extractThreadIdFromUrl() function to parse thread IDs from request URLs, (4) Modified the threads:read event handler to conditionally bypass authentication - it extracts the thread ID from the request URL, checks if the thread is public, and returns undefined (no owner filtering) for public threads while applying normal owner filtering for private threads. This enables anonymous users to read public threads while maintaining security for private threads." }, { "index": 6, "plan": "Update the web app middleware in apps/web/src/middleware.ts to allow unauthenticated access to specific thread URLs (/chat/[thread_id]) by checking if the thread is public through a new API endpoint before redirecting", "completed": true, "summary": "Successfully updated the web app middleware in apps/web/src/middleware.ts to allow unauthenticated access to specific thread URLs (/chat/[thread_id]) by checking if the thread is public through a new API endpoint before redirecting. The implementation includes: (1) Added extractThreadIdFromPath() function to extract thread IDs from chat URL paths using regex pattern matching, (2) Added isThreadPublic() function that calls the API endpoint /api/threads/${threadId}/public to check if a thread is public, (3) Modified the middleware logic to extract thread ID from URLs for unauthenticated users, check if the thread is public using the API endpoint, allow access to public threads by returning NextResponse.next(), and maintain existing behavior of redirecting unauthenticated users away from private threads or general chat routes. The middleware now supports anonymous access to public threads while maintaining security for private threads." }, { "index": 7, "plan": "Create a new API endpoint in apps/web/src/app/api/threads/[thread_id]/public/route.ts to check if a thread is public without requiring authentication, using direct LangGraph SDK calls with minimal auth bypass", "completed": true, "summary": "Successfully created a new API endpoint in apps/web/src/app/api/threads/[thread_id]/public/route.ts to check if a thread is public without requiring authentication. The implementation includes: (1) Created GET handler that accepts thread_id as a parameter, (2) Used direct LangGraph SDK calls with Client class configured with server-side API key for minimal auth bypass, (3) Fetched thread data using client.threads.get() with MANAGER_GRAPH_ID, (4) Checked the isPublic field in thread.values and returned simple JSON response with { isPublic }, (5) Implemented proper error handling that defaults to private for security, (6) Added comprehensive documentation. The endpoint bypasses normal authentication by using server-side API key instead of user tokens, enabling anonymous access to check thread publicity status for the middleware integration." }, { "index": 8, "plan": "Update the API proxy in apps/web/src/app/api/[..._path]/route.ts to conditionally add authentication headers only when the user is authenticated, allowing anonymous requests to pass through for public thread read operations", "completed": true, "summary": "Successfully updated the API proxy in apps/web/src/app/api/[..._path]/route.ts to conditionally add authentication headers only when the user is authenticated, allowing anonymous requests to pass through for public thread read operations. The implementation includes: (1) Updated imports to include new helper functions getGitHubInstallationToken and getGitHubAccessToken that return null instead of throwing errors, (2) Modified the headers function to conditionally build authentication headers, (3) Implemented logic to try getting authentication tokens without throwing errors when they're missing, (4) Created conditional header building that only adds GitHub token headers when valid tokens are available, (5) Maintained backward compatibility for authenticated users while allowing anonymous requests to pass through to the LangGraph server. This enables the anonymous thread viewing functionality by allowing unauthenticated requests to reach the LangGraph server where the modified auth middleware can check thread publicity and allow access to public threads." }, { "index": 9, "plan": "Run yarn lint:fix and yarn format from the repository root to ensure code quality standards are met", "completed": true, "summary": "Successfully ran yarn lint:fix and yarn format from the repository root to ensure code quality standards are met. The linting process completed successfully for all packages (3 successful, 3 total) after fixing critical issues including: (1) Replaced console.error with proper logger in auth.ts to comply with no-console ESLint rule, (2) Fixed unnecessary escape character in regex pattern in middleware.ts. The formatting process also completed successfully for all packages (4 successful, 4 total), ensuring consistent code style across the entire monorepo. Only minor warnings remain (unused variables, React component patterns) but no critical errors, confirming that all implemented code meets the project's quality standards." } ], "createdAt": 1753245034240, "createdBy": "agent" } ], "activeRevisionIndex": 0, "completedAt": 1753246317552, "summary": "## Implementation Complete: Anonymous Thread Viewing Feature\n\nI have successfully implemented the anonymous thread viewing feature with public/private thread privacy controls. Here's what was accomplished:\n\n**Core Changes Made:**\n- Added `isPublic` field to `ManagerGraphState` and `ThreadMetadata` types with proper TypeScript typing\n- Created `ThreadPrivacyToggle` UI component with Lock/Unlock icons and tooltips, integrated into thread headers\n- Modified LangGraph server auth middleware to allow unauthenticated read access for public threads while maintaining security for private threads\n- Updated web app middleware to check thread publicity before redirecting anonymous users\n- Created `/api/threads/[thread_id]/public` endpoint for checking thread publicity without authentication\n- Updated API proxy to conditionally add auth headers, allowing anonymous requests to pass through for public thread operations\n- Implemented proper data mapping with backward compatibility (existing threads default to private)\n\n**Security & Quality:**\n- All code properly linted and formatted with no critical errors\n- Secure defaults (threads are private unless explicitly marked public)\n- Comprehensive error handling throughout the implementation\n- Maintains authentication requirements for private threads and non-read operations\n\nThe feature is now fully functional - users can mark threads as public/private via the UI toggle, and anonymous users can view public threads while being redirected away from private ones. All 10 planned tasks completed successfully." } ], "activeTaskIndex": 0 } [ "Add isPublic field to ManagerGraphState type in packages/shared/src/open-swe/manager/types.ts by extending the ManagerGraphStateObj with a new optional boolean field using withLangGraph reducer pattern similar to autoAcceptPlan", "Add isPublic field to ThreadMetadata interface in apps/web/src/components/v2/types.ts to support UI display of thread privacy status", "Update threadsToMetadata function in apps/web/src/lib/thread-utils.ts to map the isPublic field from ManagerGraphState to ThreadMetadata, defaulting to false for existing threads", "Create a privacy toggle UI component in apps/web/src/components/v2/thread-privacy-toggle.tsx using existing UI patterns from theme-toggle.tsx, with a lock/unlock icon and tooltip to allow users to mark threads as public or private", "Integrate the privacy toggle component into the thread header area in apps/web/src/components/v2/thread-view.tsx, positioning it near the existing ThemeToggle and other controls in the top-right section", "Modify the LangGraph server auth middleware in apps/open-swe/src/security/auth.ts to allow unauthenticated read access for public threads by checking the isPublic field in thread metadata and bypassing authentication for threads:read operations on public threads", "Update the web app middleware in apps/web/src/middleware.ts to allow unauthenticated access to specific thread URLs (/chat/[thread_id]) by checking if the thread is public through a new API endpoint before redirecting", "Create a new API endpoint in apps/web/src/app/api/threads/[thread_id]/public/route.ts to check if a thread is public without requiring authentication, using direct LangGraph SDK calls with minimal auth bypass", "Update the API proxy in apps/web/src/app/api/[..._path]/route.ts to conditionally add authentication headers only when the user is authenticated, allowing anonymous requests to pass through for public thread read operations", "Run yarn lint:fix and yarn format from the repository root to ensure code quality standards are met" ]

[open-swe[bot]]

🤖 Open SWE has been triggered for this issue. Processing...

View run in Open SWE here (this URL will only work for @bracesproul)

Dev Metadata

{ "runId": "1f0677d3-9b9a-6469-9adb-f436d9339eff", "threadId": "50a619f0-ac9d-4435-be28-e59eb54d710a" }

✅ Plan Accepted ✅

The proposed plan was accepted.

Plan: Implement anonymous thread viewing with public/private thread privacy controls

• Task 1:

Add isPublic field to ManagerGraphState type in packages/shared/src/open-swe/manager/types.ts by extending the ManagerGraphStateObj with a new optional boolean field using withLangGraph reducer pattern similar to autoAcceptPlan

• Task 2:

Add isPublic field to ThreadMetadata interface in apps/web/src/components/v2/types.ts to support UI display of thread privacy status

• Task 3:

Update threadsToMetadata function in apps/web/src/lib/thread-utils.ts to map the isPublic field from ManagerGraphState to ThreadMetadata, defaulting to false for existing threads

• Task 4:

Create a privacy toggle UI component in apps/web/src/components/v2/thread-privacy-toggle.tsx using existing UI patterns from theme-toggle.tsx, with a lock/unlock icon and tooltip to allow users to mark threads as public or private

• Task 5:

Integrate the privacy toggle component into the thread header area in apps/web/src/components/v2/thread-view.tsx, positioning it near the existing ThemeToggle and other controls in the top-right section

• Task 6:

Modify the LangGraph server auth middleware in apps/open-swe/src/security/auth.ts to allow unauthenticated read access for public threads by checking the isPublic field in thread metadata and bypassing authentication for threads:read operations on public threads

• Task 7:

Update the web app middleware in apps/web/src/middleware.ts to allow unauthenticated access to specific thread URLs (/chat/[thread_id]) by checking if the thread is public through a new API endpoint before redirecting

• Task 8:

Create a new API endpoint in apps/web/src/app/api/threads/[thread_id]/public/route.ts to check if a thread is public without requiring authentication, using direct LangGraph SDK calls with minimal auth bypass

• Task 9:

Update the API proxy in apps/web/src/app/api/[..._path]/route.ts to conditionally add authentication headers only when the user is authenticated, allowing anonymous requests to pass through for public thread read operations

• Task 10:

Run yarn lint:fix and yarn format from the repository root to ensure code quality standards are met

Proceeding to implementation...