inkeep
diff --git a/‎.changeset/abundant-bronze-dragon.md‎
Lines changed: 5 additions & 0 deletions b/‎.changeset/abundant-bronze-dragon.md‎
Lines changed: 5 additions & 0 deletions
diff --git a/‎.changeset/tasteless-rose-ostrich.md‎
Lines changed: 5 additions & 0 deletions b/‎.changeset/tasteless-rose-ostrich.md‎
Lines changed: 5 additions & 0 deletions
diff --git a/‎.github/workflows/ci.yml‎
Lines changed: 2 additions & 2 deletions b/‎.github/workflows/ci.yml‎
Lines changed: 2 additions & 2 deletions
diff --git a/‎agents-api/__snapshots__/openapi.json‎
Lines changed: 26 additions & 25 deletions b/‎agents-api/__snapshots__/openapi.json‎
Lines changed: 26 additions & 25 deletions
diff --git a/‎agents-api/src/__tests__/manage/routes/crud/appAuthKeys.test.ts‎
Lines changed: 189 additions & 1 deletion b/‎agents-api/src/__tests__/manage/routes/crud/appAuthKeys.test.ts‎
Lines changed: 189 additions & 1 deletion
@@ -0,0 +1,5 @@
+---
+"@inkeep/agents-api": minor
+---
+
+Add server-side config merge for web client app updates, enforce allowAnonymous across all auth paths, flatten auth config into webClient, and add migration to backfill allowAnonymous for existing apps
@@ -0,0 +1,5 @@
+---
+"@inkeep/agents-manage-ui": minor
+---
+
+Add Require Authentication toggle for web client apps
@@ -162,7 +162,7 @@ jobs:
           APP_TOKEN: ${{ steps.app-token.outputs.token }}
 
       - name: Install Playwright
-        run: pnpx playwright install chromium --with-deps # install browsers + dependencies for Chromium only
+        run: pnpm --filter @inkeep/agents-manage-ui exec playwright install chromium --with-deps # install browsers + dependencies for Chromium only
 
       # Clean database files before running tests
       - name: Clean database files
@@ -337,7 +337,7 @@ jobs:
           restore-keys: playwright-${{ runner.os }}-
 
       - name: Install Playwright
-        run: pnpx playwright install chromium --with-deps
+        run: pnpm --filter @inkeep/agents-manage-ui exec playwright install chromium --with-deps
 
       - name: Build create-agents and dependencies
         run: |
 
@@ -10574,27 +10574,6 @@
         "example": "user_123",
         "type": "string"
       },
-      "WebClientAuthConfig": {
-        "properties": {
-          "allowAnonymous": {
-            "type": "boolean"
-          },
-          "audience": {
-            "type": "string"
-          },
-          "publicKeys": {
-            "default": [],
-            "items": {
-              "$ref": "#/components/schemas/PublicKeyConfig"
-            },
-            "type": "array"
-          },
-          "validateScopeClaims": {
-            "type": "boolean"
-          }
-        },
-        "type": "object"
-      },
       "WebClientConfig": {
         "properties": {
           "type": {
@@ -10605,6 +10584,10 @@
           },
           "webClient": {
             "properties": {
+              "allowAnonymous": {
+                "default": false,
+                "type": "boolean"
+              },
               "allowedDomains": {
                 "items": {
                   "minLength": 1,
@@ -10614,8 +10597,15 @@
                 "minItems": 1,
                 "type": "array"
               },
-              "auth": {
-                "$ref": "#/components/schemas/WebClientAuthConfig"
+              "audience": {
+                "type": "string"
+              },
+              "publicKeys": {
+                "default": [],
+                "items": {
+                  "$ref": "#/components/schemas/PublicKeyConfig"
+                },
+                "type": "array"
               }
             },
             "required": [
@@ -10640,6 +10630,10 @@
           },
           "webClient": {
             "properties": {
+              "allowAnonymous": {
+                "default": false,
+                "type": "boolean"
+              },
               "allowedDomains": {
                 "items": {
                   "minLength": 1,
@@ -10649,8 +10643,15 @@
                 "minItems": 1,
                 "type": "array"
               },
-              "auth": {
-                "$ref": "#/components/schemas/WebClientAuthConfig"
+              "audience": {
+                "type": "string"
+              },
+              "publicKeys": {
+                "default": [],
+                "items": {
+                  "$ref": "#/components/schemas/PublicKeyConfig"
+                },
+                "type": "array"
               }
             },
             "required": [
 
@@ -33,8 +33,11 @@ describe('App Auth Keys Routes', () => {
     return body.data.app;
   };
 
+  const appUrl = (tenantId: string, projectId: string, appId: string) =>
+    `/manage/tenants/${tenantId}/projects/${projectId}/apps/${appId}`;
+
   const keysUrl = (tenantId: string, projectId: string, appId: string) =>
-    `/manage/tenants/${tenantId}/projects/${projectId}/apps/${appId}/auth/keys`;
+    `${appUrl(tenantId, projectId, appId)}/auth/keys`;
 
   describe('POST /auth/keys', () => {
     it('should add a public key to an app', async () => {
@@ -191,6 +194,191 @@ describe('App Auth Keys Routes', () => {
     });
   });
 
+  describe('PATCH /apps/:id (allowAnonymous via app update)', () => {
+    it('should set allowAnonymous via app PATCH config merge', async () => {
+      const tenantId = await createTestTenantWithOrg('auth-settings-merge');
+      const projectId = 'default-project';
+      await createTestProject(manageDbClient, tenantId, projectId);
+      const app = await createTestApp(tenantId, projectId);
+
+      const res = await makeRequest(appUrl(tenantId, projectId, app.id), {
+        method: 'PATCH',
+        body: JSON.stringify({
+          config: {
+            type: 'web_client',
+            webClient: { allowedDomains: ['*'], allowAnonymous: true },
+          },
+        }),
+      });
+
+      expect(res.status).toBe(200);
+      const getRes = await makeRequest(appUrl(tenantId, projectId, app.id));
+      const appBody = await getRes.json();
+      expect(appBody.data.config.webClient.allowAnonymous).toBe(true);
+    });
+
+    it('should preserve existing keys when updating allowAnonymous via app PATCH', async () => {
+      const tenantId = await createTestTenantWithOrg('auth-settings-preserve');
+      const projectId = 'default-project';
+      await createTestProject(manageDbClient, tenantId, projectId);
+      const app = await createTestApp(tenantId, projectId);
+
+      const pem = await rsaPem();
+      await makeRequest(keysUrl(tenantId, projectId, app.id), {
+        method: 'POST',
+        body: JSON.stringify({ kid: 'preserved-key', publicKey: pem, algorithm: 'RS256' }),
+      });
+
+      await makeRequest(appUrl(tenantId, projectId, app.id), {
+        method: 'PATCH',
+        body: JSON.stringify({
+          config: {
+            type: 'web_client',
+            webClient: { allowedDomains: ['*'], allowAnonymous: true },
+          },
+        }),
+      });
+
+      const listRes = await makeRequest(keysUrl(tenantId, projectId, app.id));
+      const body = await listRes.json();
+      expect(body.data).toHaveLength(1);
+      expect(body.data[0].kid).toBe('preserved-key');
+    });
+
+    it('should preserve audience when updating allowAnonymous via app PATCH', async () => {
+      const tenantId = await createTestTenantWithOrg('auth-settings-audience');
+      const projectId = 'default-project';
+      await createTestProject(manageDbClient, tenantId, projectId);
+      const app = await createTestApp(tenantId, projectId);
+
+      await makeRequest(appUrl(tenantId, projectId, app.id), {
+        method: 'PATCH',
+        body: JSON.stringify({
+          config: {
+            type: 'web_client',
+            webClient: {
+              allowedDomains: ['example.com'],
+              audience: 'https://my-app.example.com',
+            },
+          },
+        }),
+      });
+
+      await makeRequest(appUrl(tenantId, projectId, app.id), {
+        method: 'PATCH',
+        body: JSON.stringify({
+          config: {
+            type: 'web_client',
+            webClient: {
+              allowedDomains: ['example.com'],
+              allowAnonymous: true,
+            },
+          },
+        }),
+      });
+
+      const getRes = await makeRequest(appUrl(tenantId, projectId, app.id));
+      const appBody = await getRes.json();
+      expect(appBody.data.config.webClient.audience).toBe('https://my-app.example.com');
+      expect(appBody.data.config.webClient.allowAnonymous).toBe(true);
+    });
+  });
+
+  describe('PATCH /apps/:id strips publicKeys from payload', () => {
+    it('should not overwrite existing keys when publicKeys is sent in PATCH body', async () => {
+      const tenantId = await createTestTenantWithOrg('auth-settings-strip-keys');
+      const projectId = 'default-project';
+      await createTestProject(manageDbClient, tenantId, projectId);
+      const app = await createTestApp(tenantId, projectId);
+
+      const pem = await rsaPem();
+      await makeRequest(keysUrl(tenantId, projectId, app.id), {
+        method: 'POST',
+        body: JSON.stringify({ kid: 'real-key', publicKey: pem, algorithm: 'RS256' }),
+      });
+
+      const res = await makeRequest(appUrl(tenantId, projectId, app.id), {
+        method: 'PATCH',
+        body: JSON.stringify({
+          config: {
+            type: 'web_client',
+            webClient: {
+              allowedDomains: ['example.com'],
+              publicKeys: [],
+              allowAnonymous: true,
+            },
+          },
+        }),
+      });
+      expect(res.status).toBe(200);
+
+      const listRes = await makeRequest(keysUrl(tenantId, projectId, app.id));
+      const body = await listRes.json();
+      expect(body.data).toHaveLength(1);
+      expect(body.data[0].kid).toBe('real-key');
+    });
+  });
+
+  describe('Key operations preserve allowAnonymous', () => {
+    it('should preserve allowAnonymous when adding a key', async () => {
+      const tenantId = await createTestTenantWithOrg('auth-keys-preserve-anon-add');
+      const projectId = 'default-project';
+      await createTestProject(manageDbClient, tenantId, projectId);
+      const app = await createTestApp(tenantId, projectId);
+
+      await makeRequest(appUrl(tenantId, projectId, app.id), {
+        method: 'PATCH',
+        body: JSON.stringify({
+          config: {
+            type: 'web_client',
+            webClient: { allowedDomains: ['example.com'], allowAnonymous: true },
+          },
+        }),
+      });
+
+      const pem = await rsaPem();
+      await makeRequest(keysUrl(tenantId, projectId, app.id), {
+        method: 'POST',
+        body: JSON.stringify({ kid: 'new-key', publicKey: pem, algorithm: 'RS256' }),
+      });
+
+      const getRes = await makeRequest(appUrl(tenantId, projectId, app.id));
+      const appBody = await getRes.json();
+      expect(appBody.data.config.webClient.allowAnonymous).toBe(true);
+    });
+
+    it('should preserve allowAnonymous when deleting a key', async () => {
+      const tenantId = await createTestTenantWithOrg('auth-keys-preserve-anon-del');
+      const projectId = 'default-project';
+      await createTestProject(manageDbClient, tenantId, projectId);
+      const app = await createTestApp(tenantId, projectId);
+
+      const pem = await rsaPem();
+      await makeRequest(keysUrl(tenantId, projectId, app.id), {
+        method: 'POST',
+        body: JSON.stringify({ kid: 'del-key', publicKey: pem, algorithm: 'RS256' }),
+      });
+
+      await makeRequest(appUrl(tenantId, projectId, app.id), {
+        method: 'PATCH',
+        body: JSON.stringify({
+          config: {
+            type: 'web_client',
+            webClient: { allowedDomains: ['example.com'], allowAnonymous: true },
+          },
+        }),
+      });
+
+      await makeRequest(`${keysUrl(tenantId, projectId, app.id)}/del-key`, {
+        method: 'DELETE',
+      });
+
+      const getRes = await makeRequest(appUrl(tenantId, projectId, app.id));
+      const appBody = await getRes.json();
+      expect(appBody.data.config.webClient.allowAnonymous).toBe(true);
+    });
+  });
+
   describe('DELETE /auth/keys/:kid', () => {
     it('should delete a key by kid', async () => {
       const tenantId = await createTestTenantWithOrg('auth-keys-delete');
-Original file line number
+Diff line change
@@ @@ -0,0 +1,5 @@ @@
 +---
 +"@inkeep/agents-api": minor
 +---
++
 +Add server-side config merge for web client app updates, enforce allowAnonymous across all auth paths, flatten auth config into webClient, and add migration to backfill allowAnonymous for existing apps