fix(a2a): accept dashboard session auth on /a2a route (#12888) (#13271)

Merged as part of the owner batch of 2026-09-11.

This PR had a live worktree in another session, so it sat outside the main 39. Merged on your explicit call, validated first rather than taken on trust: boarded with the other 10 worktree-held PRs into a consolidated worktree off `release/v3.8.51`.

- ESLint over every changed file: no errors
- `typecheck:core` clean; `check:dashboard-typecheck` OK; `check:changelog-integrity` OK
- complexity 2821 / baseline 3218 and cognitive-complexity 1272 / baseline 1437
- 203 of 208 assertions green. The 5 remaining (`guide-settings-route` ×4, `hard-session-lease-bypass-inventory` ×1) reproduce on the pure tip with nothing from this batch applied.
- `imageGeneration.ts` rebaselined 3259 → 3293 for #12945's image-only-model guard, landed separately in #13392 so nothing was pushed onto a live branch.

⚠️ base-red inherited: #12732 — provider count 356 vs 358 and `open-sse/utils/stream.ts` 3115 > frozen 3098, both reproducing on the pure tip.

src/app/(dashboard)/dashboard/endpoint/components/A2ADashboard.tsx

@@ -201,6 +201,7 @@ export default function A2ADashboardPage() {
       const response = await fetch("/a2a", {
         method: "POST",
         headers: { "Content-Type": "application/json" },
+        credentials: "same-origin",
         body: JSON.stringify({
           jsonrpc: "2.0",
           id: "dashboard-send",
@@ -234,6 +235,7 @@ export default function A2ADashboardPage() {
       const response = await fetch("/a2a", {
         method: "POST",
         headers: { "Content-Type": "application/json" },
+        credentials: "same-origin",
         body: JSON.stringify({
           jsonrpc: "2.0",
           id: "dashboard-stream",

src/app/a2a/route.ts

@@ -187,7 +187,7 @@ export async function POST(req: NextRequest) {
   const tm = getTaskManager();
   // GHSA-jcm5-6wpp-wjj8: scope every task read/mutation below to the caller's
   // owner id (hashed API key; undefined under the keyless local-first posture).
-  const callerOwner = resolveA2AOwner(req);
+  const callerOwner = await resolveA2AOwner(req);
 
   // A2A 1.0 method-name compatibility (SendMessage → message/send, etc.)
   const isV1Method = method in V1_METHOD_ALIASES;

src/app/api/a2a/_auth.ts

@@ -35,7 +35,7 @@ export async function authorizeA2ATaskRoute(request: Request): Promise<A2ARestAu
   const apiKey = extractApiKey(request);
 
   if (isRequireApiKeyEnabled()) {
-    if (apiKey && (await isValidApiKey(apiKey))) return { owner: resolveA2AOwner(request) };
+    if (apiKey && (await isValidApiKey(apiKey))) return { owner: await resolveA2AOwner(request) };
     const managementError = await requireManagementAuth(request, {
       invalidApiKeyStatus: 401,
       alwaysRequireAuth: true,
@@ -46,6 +46,6 @@ export async function authorizeA2ATaskRoute(request: Request): Promise<A2ARestAu
 
   const managementError = await requireManagementAuth(request, { invalidApiKeyStatus: 401 });
   if (managementError === null) return { owner: undefined };
-  if (apiKey && (await isValidApiKey(apiKey))) return { owner: resolveA2AOwner(request) };
+  if (apiKey && (await isValidApiKey(apiKey))) return { owner: await resolveA2AOwner(request) };
   return managementError;
 }

src/lib/a2a/authenticate.ts

@@ -11,6 +11,7 @@
 import { createHash, timingSafeEqual } from "crypto";
 import type { NextRequest } from "next/server";
 import { extractApiKey, isValidApiKey } from "@/sse/services/auth";
+import { isDashboardSessionAuthenticated } from "@/shared/utils/apiAuth";
 import { isRequireApiKeyEnabled } from "@/shared/utils/featureFlags";
 
 function tokensMatch(provided: string, expected: string): boolean {
@@ -29,12 +30,17 @@ function tokensMatch(provided: string, expected: string): boolean {
 export async function authenticateA2ARequest(req: NextRequest | Request): Promise<boolean> {
   const apiKey = extractApiKey(req as NextRequest);
   if (isRequireApiKeyEnabled()) {
-    return apiKey ? await isValidApiKey(apiKey) : false;
+    if (apiKey) return isValidApiKey(apiKey);
+    // #12888: mirror clientApiPolicy's dashboard-session fallback so the
+    // dashboard's own A2A playground (no Authorization header, session
+    // cookie only) is accepted the same way /api/v1/* already accepts it.
+    return isDashboardSessionAuthenticated(req);
   }
 
   const configuredKey = process.env.OMNIROUTE_API_KEY;
   if (configuredKey) {
-    return apiKey ? tokensMatch(apiKey, configuredKey) : false;
+    if (apiKey) return tokensMatch(apiKey, configuredKey);
+    return isDashboardSessionAuthenticated(req);
   }
 
   // No API key required and none configured — allow (keyless local-first).
@@ -43,11 +49,15 @@ export async function authenticateA2ARequest(req: NextRequest | Request): Promis
 
 /**
  * Owner id for task scoping (GHSA-jcm5-6wpp-wjj8): a stable hash of the
- * caller's API key, or `undefined` when the call carries no key (keyless
- * posture — ownerless tasks stay visible to everyone, by design).
+ * caller's API key, `"dashboard"` for a session-authenticated caller with no
+ * API key (#12888 — keeps dashboard-originated tasks scoped consistently
+ * instead of falling into the ownerless keyless bucket), or `undefined` when
+ * the call carries neither (keyless posture — ownerless tasks stay visible to
+ * everyone, by design).
  */
-export function resolveA2AOwner(req: NextRequest | Request): string | undefined {
+export async function resolveA2AOwner(req: NextRequest | Request): Promise<string | undefined> {
   const apiKey = extractApiKey(req as NextRequest);
-  if (!apiKey) return undefined;
-  return createHash("sha256").update(apiKey).digest("hex").slice(0, 32);
+  if (apiKey) return createHash("sha256").update(apiKey).digest("hex").slice(0, 32);
+  if (await isDashboardSessionAuthenticated(req)) return "dashboard";
+  return undefined;
 }