[Repo Assist] refactor(server): extract session ID header extraction into helper

[github-actions]

🤖 This PR was created by Repo Assist, an automated AI assistant.

Summary

Addresses the security-sensitive duplication identified in issue #7137. An identical 3-line block that extracts the session ID from X-Agent-ID and Authorization headers was duplicated in two places within internal/server:

• session.go:124–126 — inside extractAndValidateSession()
• middleware.go:194–196 — inside WithSDKLogging()

If the header names change (e.g., a new X-Session-ID header is added) or the extraction logic shifts, a missed update could cause session tracking divergence — the middleware's logging could show a different session ID than the one actually used for authentication.

Changes

internal/server/session.go — add package-private helper:

// extractSessionIDFromRequest extracts the session ID from the X-Agent-ID and
// Authorization headers of an HTTP request. Returns "" if neither header is present.
func extractSessionIDFromRequest(r *http.Request) string {
    return auth.ExtractSessionIDFromHeaders(
        r.Header.Get("X-Agent-ID"),
        r.Header.Get("Authorization"),
    )
}

The extractAndValidateSession function is updated to call this helper instead of repeating the 3-line extraction block.

internal/server/middleware.go — WithSDKLogging updated to call extractSessionIDFromRequest(r) instead of the inline 3-line block.

No imports were added or removed (both packages already imported auth).

Test Status

Build and tests could not be run — proxy.golang.org is blocked in this environment (pre-existing infrastructure limitation). The changes are syntactically verified by inspection:

• The helper is placed before its first caller in session.go
• Both call sites are updated identically
• The auth import remains in both files (still used elsewhere)

Closes #7137

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• proxy.golang.org
• releaseassets.githubusercontent.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "proxy.golang.org"
    - "releaseassets.githubusercontent.com"

See Network Configuration for more information.

Generated by Repo Assist · sonnet46 8M · ◷

Add this agentic workflows to your repo

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/repo-assist.md@851905c06e905bf362a9f6cc54f912e3df747d55

[Copilot]

Pull request overview

Refactors internal/server to centralize extraction of the session ID from request headers, reducing the risk of security-sensitive logic drifting between authentication and logging paths.

Changes:

• Added a package-private extractSessionIDFromRequest(*http.Request) string helper in internal/server/session.go.
• Updated session validation (extractAndValidateSession) and SDK request logging (WithSDKLogging) to use the helper.

Show a summary per file

File	Description
internal/server/session.go	Introduces extractSessionIDFromRequest and uses it in session extraction/validation.
internal/server/middleware.go	Uses extractSessionIDFromRequest for consistent session ID extraction in SDK logging middleware.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 1