From aa8a41ddb3b9abcdf117ef8f3cda31e6d3506939 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E7=94=A8=E6=88=B7CI=20Test?= <ci-test@xiaoxia.com>
Date: Sun, 12 Jul 2026 00:37:11 +0800
Subject: [PATCH] debug: read auth logic and test various auth methods

---
 .gitea/workflows/read-auth.yml | 38 ++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)
 create mode 100644 .gitea/workflows/read-auth.yml

diff --git a/.gitea/workflows/read-auth.yml b/.gitea/workflows/read-auth.yml
new file mode 100644
index 000000000..418e5b0e1
--- /dev/null
+++ b/.gitea/workflows/read-auth.yml
@@ -0,0 +1,38 @@
+name: Read Auth Logic
+
+on:
+  push:
+    branches:
+      - 'debug/cmd-agent'
+
+jobs:
+  read:
+    name: Read check_auth logic
+    runs-on: host
+    timeout-minutes: 3
+    steps:
+      - name: Read
+        shell: bash
+        run: |
+          echo "=== Full server.py (lines 1-50) ==="
+          sed -n '1,50p' /opt/xiaoxia-cmd-agent/server.py
+          echo ""
+          echo "=== Lines 120-160 (startup logic) ==="
+          sed -n '120,160p' /opt/xiaoxia-cmd-agent/server.py
+          echo ""
+          echo "=== Test with X-Token header ==="
+          curl -s -X POST http://127.0.0.1:18888/cmd-agent/exec \
+            -H "X-Token: $(cat /etc/xiaoxia-cmd-agent.token)" \
+            -H "Content-Type: application/json" \
+            -d '{"command":"hostname"}'
+          echo ""
+          echo "=== Test with token in query string ==="
+          curl -s -X POST "http://127.0.0.1:18888/cmd-agent/exec?token=$(cat /etc/xiaoxia-cmd-agent.token)" \
+            -H "Content-Type: application/json" \
+            -d '{"command":"hostname"}'
+          echo ""
+          echo "=== Check if path is /exec not /cmd-agent/exec ==="
+          curl -s -X POST http://127.0.0.1:18888/exec \
+            -H "Authorization: Bearer $(cat /etc/xiaoxia-cmd-agent.token)" \
+            -H "Content-Type: application/json" \
+            -d '{"command":"hostname"}'