[GallaGit]

Adds an opt-in loginBasicAuth: true flag to the LOGIN_TOKEN login config, as agreed in #982. When set, the engine sends Authorization: Basic base64(username:password) on the login request only. The credentials never go through templates (${password} resolves empty), and no body is sent unless loginBody is defined.

Validation (engine, validate-adapters rule login-basic-auth, catalog.spec)

• An explicit Authorization in loginHeaders together with the flag is rejected before any request, so there's never doubt about which credentials the provider gets.
• Also rejected: a non-boolean flag value, combining it with signedJwt or bcrypt passwordHashing, a username containing :, a missing username/password param, and ${password} in loginBody.

Secrets handling: on login failure the error is sanitised (message, config and response headers, request._header) and keeps the status. Debug logs mask the credentials.

Docs: docs/tool-definition.md and docs/connectors/login-token-auth.md.

Tests

• login-token.service.spec: 71/71, 7 new tests.
• Engine, catalog and adapters specs: 44 suites, 15,609 tests passing.
• validate-adapters.test.mjs: 32/32.
• tsc and eslint: clean.

Known gap (out of scope): the connector edit page (connectors/[id]/page.tsx) rebuilds authConfig without advanced fields, so editing would drop loginBasicAuth, the same way it already drops loginHeaders. Happy to fix that in a follow-up.

The Wazuh adapter (#982) will follow on top of this.

[helpcodeai]

Thanks @GallaGit, this is what we agreed in #982, and the code reads well. The engine builds the header itself, the conflicting configurations are refused before any request, and outbound-http.ts already drops Authorization on a cross-origin redirect.

One CI failure, and it comes from the docs change: docs/tool-definition.md and docs/connectors/login-token-auth.md feed llms-full.txt, so the backend job stops at node scripts/generate-llms-txt.mjs --check with "llms-full.txt is stale". Lint, typecheck and Jest have not run in CI yet because of that.

The branch is also behind main. Please merge main, then run:

node scripts/generate-llms-txt.mjs

and commit the regenerated llms-full.txt. Once the checks are green I'll merge it.

A follow-up PR for the connector edit page, so it keeps loginBasicAuth and loginHeaders, is welcome. After that, the Wazuh adapter.

[GallaGit]

FYI: the Wazuh adapter that uses this flag is up as a draft in #1461, stacked on this branch. I'll rebase it onto main and mark it ready once this one merges.

[helpcodeai]

Thanks, this looks good. The Basic header is built only from the username and password, it never goes through templates, conflicting settings are refused, and the error is cleaned before it travels on.

One thing blocks the merge: the backend CI fails at "Verify generated AI documentation is up to date", because docs/tool-definition.md changed. Please run node scripts/generate-llms-txt.mjs from the repository root, commit the regenerated files, and merge the latest main into the branch. Then I'll merge it.

The edit page dropping loginBasicAuth is fine as a follow-up.

[helpcodeai]

I merged the latest main into your branch and committed the regenerated llms-full.txt myself, so you don't need to push anything for this. I'll merge once CI is green.

[helpcodeai]

Thanks @GallaGit. Checked again after the regenerated docs: the Basic header is built only from the username and password, conflicting settings are refused before any request, and the credentials are scrubbed from errors. CI is green, merging.

[helpcodeai]

Merged, thanks @GallaGit. You can rebase the Wazuh adapter in #1461 onto main now and mark it ready when CI is green.