@agent-native/core 0.32.2 → 0.32.17

package/dist/server/auth.js

@@ -44,13 +44,13 @@ import { getAllowedCorsOrigin, readCorsAllowedOrigins, } from "./cors-origins.js
 import { getOnboardingHtml, getResetPasswordHtml, } from "./onboarding-html.js";
 import { readBody } from "../server/h3-helpers.js";
 import { readDesktopSso, writeDesktopSso, clearDesktopSso, } from "./desktop-sso.js";
-import { isElectron as isElectronRequest, getAppBasePath, getAppUrl, encodeOAuthState, decodeOAuthState, createOAuthSession, oauthCallbackResponse, oauthErrorPage, resolveOAuthRedirectUri, isAllowedOAuthRedirectUri, } from "./google-oauth.js";
+import { isElectron as isElectronRequest, getAppBasePath, getAppUrl, getOrigin, encodeOAuthState, decodeOAuthState, createOAuthSession, oauthCallbackResponse, oauthErrorPage, resolveOAuthRedirectUri, isAllowedOAuthRedirectUri, } from "./google-oauth.js";
 import { safeOAuthReturnUrl } from "./oauth-return-url.js";
 import { captureAuthError } from "./sentry.js";
 import { extractOAuthStateAppId } from "../shared/oauth-state.js";
 import { isValidWorkspaceAppIdFormat } from "../shared/workspace-app-id.js";
+import { AGENT_NATIVE_SOCIAL_IMAGE_ALT, AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT, AGENT_NATIVE_SOCIAL_IMAGE_PATH, AGENT_NATIVE_SOCIAL_IMAGE_TYPE, AGENT_NATIVE_SOCIAL_IMAGE_WIDTH, } from "../shared/social-meta.js";
 import { normalizeWorkspaceAppAudience, workspaceAppAudienceFromEnv, workspaceAppRouteAccessFromEnv, } from "../shared/workspace-app-audience.js";
-import { DEFAULT_SSR_CACHE_CONTROL } from "../shared/cache-control.js";
 import { resolveAuthCookieNamespace } from "./cookie-namespace.js";
 import { BUILDER_CONNECT_OWNER_COOKIE, BUILDER_CONNECT_PARAM, BUILDER_STATE_PARAM, verifyBuilderCallbackStateAndGetOwner, verifyBuilderConnectTokenAndGetOwner, } from "./builder-browser.js";
 // Pure env-read feature switch from a leaf module (no dependency back on
@@ -72,7 +72,7 @@ export function getSessionMaxAge() {
  *
  * Browsers scope cookies by host (NOT host+port — RFC 6265), so two apps
  * running on different localhost ports share one cookie jar. When multiple
- * templates run side-by-side (`dev:all`, the desktop app, multi-template
+ * templates run side-by-side (eager repo dev, the desktop app, multi-template
  * deploys on a shared domain), they would otherwise stomp on each other's
  * `an_session` cookie and ping-pong each other into a logged-out state.
  *
@@ -315,7 +315,8 @@ export function getConfiguredLoginHtml(event) {
     const url = event.node?.req?.url ?? event.path ?? "/";
     const queryStart = url.indexOf("?");
     const rawPath = queryStart >= 0 ? url.slice(0, queryStart) : url;
-    return config.getLoginHtml?.(event, rawPath) ?? config.loginHtml ?? null;
+    const loginHtml = config.getLoginHtml?.(event, rawPath) ?? config.loginHtml ?? null;
+    return loginHtml ? injectLoginSocialImageMeta(loginHtml, event) : null;
 }
 /**
  * True only when the request originates from the local machine — the raw
@@ -598,6 +599,7 @@ function getOnboardingHtmlOptions(options, event, rawPath) {
         googleAuthMode: options.googleAuthMode,
         requestHost: event ? getRequestHost(event) : undefined,
         requestPath: rawPath,
+        requestOrigin: event ? getOrigin(event) : undefined,
     };
 }
 function getAuthOnboardingHtml(options, event, rawPath) {
@@ -904,12 +906,56 @@ function shouldBypassAuthForBuilderConnect(event, p) {
     }
     return false;
 }
-function loginHtmlResponse(loginHtml) {
-    return new Response(loginHtml, {
+const LOGIN_OG_IMAGE_META_RE = /<meta\b(?=[^>]*\bproperty=(["'])og:image\1)[^>]*>/i;
+const LOGIN_TWITTER_CARD_META_RE = /<meta\b(?=[^>]*\bname=(["'])twitter:card\1)[^>]*>/i;
+const LOGIN_TWITTER_IMAGE_META_RE = /<meta\b(?=[^>]*\bname=(["'])twitter:image\1)[^>]*>/i;
+function escapeHtmlAttr(value) {
+    return value
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;");
+}
+function injectLoginSocialImageMeta(loginHtml, event) {
+    const headCloseIdx = loginHtml.indexOf("</head>");
+    if (headCloseIdx === -1)
+        return loginHtml;
+    const hasAnySocialImage = LOGIN_OG_IMAGE_META_RE.test(loginHtml) ||
+        LOGIN_TWITTER_IMAGE_META_RE.test(loginHtml);
+    const imageUrl = escapeHtmlAttr(getAppUrl(event, AGENT_NATIVE_SOCIAL_IMAGE_PATH));
+    const tags = [];
+    if (!hasAnySocialImage) {
+        tags.push(`<meta property="og:image" content="${imageUrl}">`);
+        tags.push(`<meta property="og:image:secure_url" content="${imageUrl}">`);
+        tags.push(`<meta property="og:image:type" content="${AGENT_NATIVE_SOCIAL_IMAGE_TYPE}">`);
+        tags.push(`<meta property="og:image:width" content="${AGENT_NATIVE_SOCIAL_IMAGE_WIDTH}">`);
+        tags.push(`<meta property="og:image:height" content="${AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT}">`);
+        tags.push(`<meta property="og:image:alt" content="${AGENT_NATIVE_SOCIAL_IMAGE_ALT}">`);
+    }
+    if (!LOGIN_TWITTER_CARD_META_RE.test(loginHtml)) {
+        tags.push(`<meta name="twitter:card" content="summary_large_image">`);
+    }
+    if (!hasAnySocialImage) {
+        tags.push(`<meta name="twitter:image" content="${imageUrl}">`);
+        tags.push(`<meta name="twitter:image:alt" content="${AGENT_NATIVE_SOCIAL_IMAGE_ALT}">`);
+    }
+    if (tags.length === 0)
+        return loginHtml;
+    return (loginHtml.slice(0, headCloseIdx) +
+        tags.join("") +
+        loginHtml.slice(headCloseIdx));
+}
+function loginHtmlResponse(loginHtml, event) {
+    return new Response(injectLoginSocialImageMeta(loginHtml, event), {
         status: 200,
         headers: {
             "Content-Type": "text/html; charset=utf-8",
-            "Cache-Control": DEFAULT_SSR_CACHE_CONTROL,
+            // Login HTML is selected by the absence of a session cookie. Never put it
+            // in a shared CDN cache: the same route may redirect authenticated users
+            // or render the app after sign-in.
+            "Cache-Control": "private, no-store, max-age=0, must-revalidate",
+            "CDN-Cache-Control": "no-store",
+            "Netlify-CDN-Cache-Control": "no-store",
             "X-Robots-Tag": "noindex, nofollow",
         },
     });
@@ -989,6 +1035,13 @@ function createAuthGuardFn() {
         if (p === "/_agent-native/integrations/process-a2a-continuation") {
             return;
         }
+        // Agent Teams durable sub-agent processor. Self-fired by `spawnTask` to run
+        // a queued sub-agent in a fresh function invocation; authenticity is
+        // verified by the same HMAC internal-token scheme plus an atomic SQL claim,
+        // so it bypasses cookie/session auth (mirrors the integration processor).
+        if (p === "/_agent-native/agent-teams/_process-run") {
+            return;
+        }
         // A2A endpoint verifies authenticity via JWT signed with the org's A2A
         // secret (or the global A2A_SECRET fallback), not via session cookies.
         if (p === "/_agent-native/a2a") {
@@ -999,10 +1052,10 @@ function createAuthGuardFn() {
         // authoritative gate — exactly like A2A above. Without this bypass the
         // guard's blanket 401-for-/_agent-native/* below shadows that check, so
         // an external coding agent (Claude Code / Codex / Cowork) connecting via
-        // the stdio proxy or HTTP can never reach it. Exact path only: the MCP
-        // handler returns early for `/_agent-native/mcp/*` management subroutes,
-        // which keep their normal session auth.
-        if (p === "/_agent-native/mcp") {
+        // the stdio proxy or HTTP can never reach it. Exact protocol endpoint only:
+        // tolerate the common trailing slash, but keep
+        // `/_agent-native/mcp/*` management subroutes on normal session auth.
+        if (p === "/_agent-native/mcp" || p === "/_agent-native/mcp/") {
             return;
         }
         // MCP connect — frictionless external-agent connection. Like /open
@@ -1089,7 +1142,7 @@ function createAuthGuardFn() {
                     headers: { Location: safeReturn },
                 });
             }
-            return loginHtmlResponse(loginHtml);
+            return loginHtmlResponse(loginHtml, event);
         }
         // Auth entry pages are framework-owned pages, not app routes. When a user
         // already has a session, redirect them back to the mounted app instead of
@@ -1102,7 +1155,7 @@ function createAuthGuardFn() {
                     headers: { Location: getAppBasePath() || "/" },
                 });
             }
-            return loginHtmlResponse(loginHtml);
+            return loginHtmlResponse(loginHtml, event);
         }
         // Skip static assets (Vite chunks, fonts, images, etc.)
         if (p.startsWith("/assets/") ||
@@ -1154,7 +1207,7 @@ function createAuthGuardFn() {
             if (autoSession)
                 return autoSession;
         }
-        return loginHtmlResponse(loginHtml);
+        return loginHtmlResponse(loginHtml, event);
     };
 }
 // `.test` is an RFC 6761 reserved TLD that never resolves, so this stays a