Fix auth on EU workspaces: preserve Authorization across regional redirect - #12
Closed
kevduc wants to merge 4 commits into
Closed
Fix auth on EU workspaces: preserve Authorization across regional redirect#12kevduc wants to merge 4 commits into
kevduc wants to merge 4 commits into
Conversation
Segment Public API redirects api.segmentapis.com -> eu1.api.segmentapis.com for EU workspaces. URLSession strips Authorization headers on redirect by default, causing the auth probe to receive a 401 "Authorization header is required". A URLSessionTaskDelegate now re-attaches the original Authorization (and Accept) headers on redirect. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
PAPISources and PAPIEdgeFunctions used URLSession.shared, which strips Authorization on redirect — causing 401s on EU workspaces (US host 30x's to eu1.api.segmentapis.com). Switch them to PAPI.shared.session so the existing redirect delegate re-attaches the auth header. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Squashes the long endpoint comment and redirect-delegate explanation into single lines, collapses the duplicated header re-attach blocks into a loop, and removes the SEGMENTCLI_DEBUG print block that was only used during diagnosis. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Documents the CLI's commands, auth/profile model, EU-workspace behavior (redirect-aware), read-only vs side-effecting commands, and common workflows. Loaded automatically by Claude Code when working in this repo. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Author
|
Closing to recreate from a clean fork — the previous force-pushed history is still referenced by the timeline event of this PR. Reopening shortly from a fresh branch with no pre-sanitization commits. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
EU-region Segment workspaces could not authenticate via
segmentcli:authand every subsequent command returnedSupplied token is not authorized.(orAuthorization header is required). Root cause is thatapi.segmentapis.com30x's to a regional host (e.g.eu1.api.segmentapis.com) for EU workspaces, and Apple'sURLSessionstrips theAuthorizationheader on redirect by default — the followed request arrives unauthenticated.This PR adds a
URLSessionTaskDelegatethat re-attachesAuthorization(andAccept) on redirect, and routes every PAPI endpoint (/,/sources,/sources/<id>/edge-functions/...) through the new redirect-aware session.Also adds a Claude Code skill (
.claude/skills/segmentcli/SKILL.md) that documents the CLI's commands, auth/profile model, and read-only vs side-effecting operations.Commits
Fix auth on EU workspaces: re-attach Authorization on redirect— introducesPAPIRedirectDelegateand routesauthenticate()through it; addsAccept: application/vnd.segment.v1+json.Route remaining endpoints through redirect-aware session— switchesPAPISourcesandPAPIEdgeFunctionsfromURLSession.sharedtoPAPI.shared.session.Add Claude Code skill for segmentcli— repo-shipped skill, auto-loaded in Claude Code.Tidy PAPI.swift— compact comments, drop diagnostic debug prints.Test plan
Tested against an EU workspace:
segmentcli auth <Profile> <Token>— succeeds (previously failed withSupplied token is not authorized.)segmentcli profile list— shows the saved workspacesegmentcli sources list— returns the full source list (previously failed with 401)segmentcli liveplugins latest <sourceId>— authenticates, server reports per-source statesudo make install, release config)No public-facing API or flag changes —
--stagingstill works, no new--euflag (Public API is single-host; the redirect is server-driven).