From 57e29cae5c53ed5477ac9034e4d156951b28560a Mon Sep 17 00:00:00 2001
From: Echo <echoassistant50@gmail.com>
Date: Sun, 15 Feb 2026 03:47:50 -0500
Subject: [PATCH] fix(gateway): allow Mattermost slash callback without bearer
 auth

---
 src/gateway/server-http.ts | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/gateway/server-http.ts b/src/gateway/server-http.ts
index ef0e56dd6d9..c6c0cabd1ff 100644
--- a/src/gateway/server-http.ts
+++ b/src/gateway/server-http.ts
@@ -84,6 +84,7 @@ const GATEWAY_PROBE_STATUS_BY_PATH = new Map<string, "live" | "ready">([
   ["/ready", "ready"],
   ["/readyz", "ready"],
 ]);
+const MATTERMOST_SLASH_CALLBACK_PATH = "/api/channels/mattermost/command";
 
 function shouldEnforceDefaultPluginGatewayAuth(pathContext: PluginRoutePathContext): boolean {
   return (
@@ -189,6 +190,9 @@ function buildPluginRequestStages(params: {
     {
       name: "plugin-auth",
       run: async () => {
+        if (params.requestPath === MATTERMOST_SLASH_CALLBACK_PATH) {
+          return false;
+        }
         const pathContext =
           params.pluginPathContext ?? resolvePluginRoutePathContext(params.requestPath);
         if (