@agent-native/dispatch 0.15.22 → 0.15.24

package/src/server/lib/vault-store.spec.ts

@@ -1,10 +1,16 @@
 import { afterEach, describe, expect, it, vi } from "vitest";
 
 const mocks = vi.hoisted(() => ({
+  currentOrgId: vi.fn(),
+  currentOwnerEmail: vi.fn(),
   deleteAppSecret: vi.fn(),
+  discoverAgents: vi.fn(),
   getDb: vi.fn(),
+  getOrgSetting: vi.fn(),
+  getUserSetting: vi.fn(),
   listAppSecretsForScope: vi.fn(),
   readAppSecret: vi.fn(),
+  recordAudit: vi.fn(),
   writeAppSecret: vi.fn(),
 }));
 
@@ -15,6 +21,23 @@ vi.mock("@agent-native/core/secrets", () => ({
   writeAppSecret: mocks.writeAppSecret,
 }));
 
+vi.mock("@agent-native/core/server/agent-discovery", () => ({
+  discoverAgents: mocks.discoverAgents,
+}));
+
+vi.mock("@agent-native/core/settings", () => ({
+  getOrgSetting: mocks.getOrgSetting,
+  getUserSetting: mocks.getUserSetting,
+  putOrgSetting: vi.fn(),
+  putUserSetting: vi.fn(),
+}));
+
+vi.mock("./dispatch-store.js", () => ({
+  currentOrgId: mocks.currentOrgId,
+  currentOwnerEmail: mocks.currentOwnerEmail,
+  recordAudit: mocks.recordAudit,
+}));
+
 vi.mock("../../db/index.js", async (importOriginal) => {
   const actual = await importOriginal<typeof import("../../db/index.js")>();
   return {
@@ -30,6 +53,7 @@ import {
   credentialStoreScopeForVaultCtx,
   isTrustedEnvVarSyncAgentUrl,
   resyncAllVaultSecretsToCredentialStore,
+  syncGrantsToApp,
   syncSecretsToCredentialStore,
 } from "./vault-store.js";
 
@@ -319,3 +343,138 @@ describe("resyncAllVaultSecretsToCredentialStore", () => {
     warnSpy.mockRestore();
   });
 });
+
+describe("syncGrantsToApp", () => {
+  /** In-memory stand-in for app_secrets, keyed scope + scopeId + key. */
+  function fakeCredentialStore() {
+    const store = new Map<string, string>();
+    mocks.writeAppSecret.mockImplementation(async (args: any) => {
+      store.set(`${args.scope}:${args.scopeId}:${args.key}`, args.value);
+      return "app-secret-id";
+    });
+    return store;
+  }
+
+  /**
+   * `all-apps` vault access, one discovered app, and a caller whose active org
+   * is deliberately NOT the org that owns the secrets. The app URL is remote so
+   * the best-effort env-var push is skipped and no network call is attempted.
+   */
+  function mockWorkspace(
+    caller: { ownerEmail: string; orgId: string | null },
+    secretRows: Array<Record<string, unknown>>,
+  ) {
+    mocks.currentOwnerEmail.mockReturnValue(caller.ownerEmail);
+    mocks.currentOrgId.mockReturnValue(caller.orgId);
+    mocks.getOrgSetting.mockResolvedValue(null);
+    mocks.getUserSetting.mockResolvedValue(null);
+    mocks.discoverAgents.mockResolvedValue([
+      { id: "coach", url: "https://coach.example.test" },
+    ]);
+    mocks.getDb.mockReturnValue({
+      select: () => ({
+        from: () => ({
+          where: () => ({ orderBy: async () => secretRows }),
+        }),
+      }),
+      insert: () => ({ values: async () => undefined }),
+    });
+  }
+
+  afterEach(() => {
+    mocks.writeAppSecret.mockReset();
+  });
+
+  // The regression: `all-apps` mode lists secrets across orgs, and syncing them
+  // under the caller's ctx upserts copies of another org's credentials into
+  // whichever org the person clicking Sync happened to be in. Because
+  // writeAppSecret upserts, that copies rather than moves, so credential
+  // material accumulates permanently in the wrong org.
+  it("writes each secret under its own org, not the caller's active org", async () => {
+    const store = fakeCredentialStore();
+    mockWorkspace({ ownerEmail: "clicker@example.test", orgId: "org_caller" }, [
+      {
+        id: "secret_builder",
+        ownerEmail: "admin@example.test",
+        orgId: "org_owner",
+        name: "Academy Site URL",
+        credentialKey: "ACADEMY_CONVEX_SITE_URL",
+        value: "https://academy.example.test",
+      },
+      {
+        id: "secret_solo",
+        ownerEmail: "owner@example.test",
+        orgId: null,
+        name: "Personal API Key",
+        credentialKey: "PERSONAL_API_KEY",
+        value: "sk-test-personal",
+      },
+    ]);
+
+    const result = await syncGrantsToApp("coach");
+
+    expect(store.get("org:org_owner:ACADEMY_CONVEX_SITE_URL")).toBe(
+      "https://academy.example.test",
+    );
+    expect(
+      store.get("workspace:solo:owner@example.test:PERSONAL_API_KEY"),
+    ).toBe("sk-test-personal");
+
+    // Nothing may be written under the caller's org.
+    const callerScoped = [...store.keys()].filter((key) =>
+      key.startsWith("org:org_caller:"),
+    );
+    expect(callerScoped).toEqual([]);
+
+    expect(result.credentialStores).toEqual([
+      { scope: "org", scopeId: "org_owner", synced: 1 },
+      {
+        scope: "workspace",
+        scopeId: "solo:owner@example.test",
+        synced: 1,
+      },
+    ]);
+    expect(result.synced).toBe(2);
+  });
+
+  it("still syncs the caller's own org secrets into that org", async () => {
+    const store = fakeCredentialStore();
+    mockWorkspace({ ownerEmail: "clicker@example.test", orgId: "org_caller" }, [
+      {
+        id: "secret_own",
+        ownerEmail: "clicker@example.test",
+        orgId: "org_caller",
+        name: "Shared API Key",
+        credentialKey: "SHARED_API_KEY",
+        value: "sk-test-shared",
+      },
+    ]);
+
+    const result = await syncGrantsToApp("coach");
+
+    expect(store.get("org:org_caller:SHARED_API_KEY")).toBe("sk-test-shared");
+    expect(result.credentialStores).toEqual([
+      { scope: "org", scopeId: "org_caller", synced: 1 },
+    ]);
+  });
+
+  // A row with no ownerEmail cannot name its own tenant, so the caller's ctx is
+  // the only scope available — the pre-existing ctxForSecretRow fallback.
+  it("falls back to the caller ctx for a secret row with no owner", async () => {
+    const store = fakeCredentialStore();
+    mockWorkspace({ ownerEmail: "clicker@example.test", orgId: "org_caller" }, [
+      {
+        id: "secret_ownerless",
+        ownerEmail: "",
+        orgId: null,
+        name: "Legacy Key",
+        credentialKey: "LEGACY_KEY",
+        value: "sk-test-legacy",
+      },
+    ]);
+
+    await syncGrantsToApp("coach");
+
+    expect(store.get("org:org_caller:LEGACY_KEY")).toBe("sk-test-legacy");
+  });
+});

package/src/server/lib/vault-store.ts

@@ -763,6 +763,33 @@ export async function syncSecretsToCredentialStore(
   return { ...target, keys: syncedKeys };
 }
 
+/**
+ * Group secrets by the tenant their credential-store rows must land in.
+ *
+ * Every sync path must write a secret under the org that *owns the row*, not
+ * under whoever happens to be syncing: `writeAppSecret` upserts, so syncing
+ * with the caller's ctx copies credential material into the caller's org
+ * instead of moving it, and it accumulates there permanently.
+ */
+function groupSecretsByTenant(
+  rows: VaultSecretRow[],
+  resolveCtx: (row: VaultSecretRow) => VaultCtx,
+): { ctx: VaultCtx; rows: VaultSecretRow[] }[] {
+  const groups = new Map<string, { ctx: VaultCtx; rows: VaultSecretRow[] }>();
+  for (const row of rows) {
+    if (!row.credentialKey || !row.value) continue;
+    const ctx = resolveCtx(row);
+    const groupKey = `${ctx.orgId ?? ""}\u0000${ctx.ownerEmail}`;
+    const group = groups.get(groupKey);
+    if (group) {
+      group.rows.push(row);
+    } else {
+      groups.set(groupKey, { ctx, rows: [row] });
+    }
+  }
+  return [...groups.values()];
+}
+
 /**
  * Re-sync every vault secret across every tenant into the shared credential
  * store, regardless of which request/ctx is currently active.
@@ -788,23 +815,12 @@ export async function resyncAllVaultSecretsToCredentialStore(): Promise<{
   const db = getDb();
   const rows = await db.select().from(schema.vaultSecrets);
 
-  const groups = new Map<string, { ctx: VaultCtx; rows: VaultSecretRow[] }>();
-  for (const row of rows) {
-    if (!row.credentialKey || !row.value) continue;
-    const ctx: VaultCtx = { ownerEmail: row.ownerEmail, orgId: row.orgId };
-    const groupKey = `${ctx.orgId ?? ""}${ctx.ownerEmail}`;
-    const group = groups.get(groupKey);
-    if (group) {
-      group.rows.push(row);
-    } else {
-      groups.set(groupKey, { ctx, rows: [row] });
-    }
-  }
+  const groups = groupSecretsByTenant(rows, ctxForRow);
 
   let failedGroups = 0;
   let syncedKeys = 0;
 
-  for (const { ctx, rows: groupRows } of groups.values()) {
+  for (const { ctx, rows: groupRows } of groups) {
     try {
       const result = await syncSecretsToCredentialStore(groupRows, ctx);
       syncedKeys += result.keys.length;
@@ -818,7 +834,7 @@ export async function resyncAllVaultSecretsToCredentialStore(): Promise<{
     }
   }
 
-  return { groups: groups.size, failedGroups, syncedKeys };
+  return { groups: groups.length, failedGroups, syncedKeys };
 }
 
 export async function cleanupSyncedCredentialKeysIfUnused(
@@ -889,13 +905,37 @@ export async function syncGrantsToApp(
   }
 
   if (secretsToSync.length === 0) {
-    return { appId, accessMode: access.mode, synced: 0, keys: [] };
+    return {
+      appId,
+      accessMode: access.mode,
+      synced: 0,
+      keys: [],
+      credentialStores: [],
+    };
   }
 
-  const credentialStoreSync = await syncSecretsToCredentialStore(
-    secretsToSync,
-    ctx,
+  // `all-apps` mode lists secrets across every org the caller can see, so each
+  // row must be written back under its own org. Syncing them all under `ctx`
+  // upserts copies of other orgs' credentials into the caller's org.
+  const credentialStoreGroups = groupSecretsByTenant(secretsToSync, (row) =>
+    ctxForSecretRow(row, ctx),
   );
+  const credentialStores: {
+    scope: ReturnType<typeof credentialStoreScopeForVaultCtx>["scope"];
+    scopeId: string;
+    synced: number;
+  }[] = [];
+  const credentialStoreKeys: string[] = [];
+  for (const group of credentialStoreGroups) {
+    const result = await syncSecretsToCredentialStore(group.rows, group.ctx);
+    credentialStores.push({
+      scope: result.scope,
+      scopeId: result.scopeId,
+      synced: result.keys.length,
+    });
+    credentialStoreKeys.push(...result.keys);
+  }
+
   const vars = secretsToSync.map((secret) => ({
     key: secret.credentialKey,
     value: secret.value,
@@ -942,7 +982,7 @@ export async function syncGrantsToApp(
     }
   }
 
-  const syncedKeys = credentialStoreSync.keys;
+  const syncedKeys = credentialStoreKeys;
   const timestamp = now();
 
   // Update syncedAt on grants that were successfully pushed to the shared
@@ -964,10 +1004,7 @@ export async function syncGrantsToApp(
     metadata: {
       syncedKeys,
       accessMode: access.mode,
-      credentialStore: {
-        scope: credentialStoreSync.scope,
-        scopeId: credentialStoreSync.scopeId,
-      },
+      credentialStores,
       envVars: envVarSync,
     },
   });
@@ -977,11 +1014,7 @@ export async function syncGrantsToApp(
     accessMode: access.mode,
     synced: syncedKeys.length,
     keys: syncedKeys,
-    credentialStore: {
-      scope: credentialStoreSync.scope,
-      scopeId: credentialStoreSync.scopeId,
-      synced: credentialStoreSync.keys.length,
-    },
+    credentialStores,
     envVars: envVarSync,
   };
 }

package/dist/server/lib/pre-auth-routing.d.ts

@@ -1,2 +0,0 @@
-export declare function rootDispatchRedirect(pathname: string, search: string): Response | null;
-//# sourceMappingURL=pre-auth-routing.d.ts.map

package/dist/server/lib/pre-auth-routing.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"pre-auth-routing.d.ts","sourceRoot":"","sources":["../../../src/server/lib/pre-auth-routing.ts"],"names":[],"mappings":"AAoFA,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,QAAQ,GAAG,IAAI,CAuEjB"}

package/dist/server/lib/pre-auth-routing.js

@@ -1,136 +0,0 @@
-function normalizeBasePath(value) {
-    if (!value || value === "/")
-        return "";
-    const trimmed = value.trim();
-    if (!trimmed || trimmed === "/")
-        return "";
-    return `/${trimmed.replace(/^\/+/, "").replace(/\/+$/, "")}`;
-}
-function normalizePathname(value) {
-    if (value === "/")
-        return "/";
-    return value.replace(/\/+$/, "") || "/";
-}
-const DISPATCH_PAGE_PATHS = new Set([
-    "/overview",
-    "/metrics",
-    "/login",
-    "/signup",
-    "/apps",
-    "/new-app",
-    "/vault",
-    "/integrations",
-    "/agents",
-    "/workspace",
-    "/tools",
-    "/messaging",
-    "/destinations",
-    "/identities",
-    "/approvals",
-    "/automations",
-    "/audit",
-    "/team",
-]);
-const DISPATCH_ROOT_ALIASES = new Map([
-    ...Array.from(DISPATCH_PAGE_PATHS, (path) => [path, path]),
-    ["/approval", "/approval"],
-    ["/extensions", "/extensions"],
-    ["/tools", "/tools"],
-    ["/apps/new-app", "/new-app"],
-]);
-const MOUNTED_DISPATCH_ALIASES = new Map([
-    ["/apps/new-app", "/new-app"],
-]);
-function isDispatchPagePath(pathname) {
-    if (DISPATCH_PAGE_PATHS.has(pathname))
-        return true;
-    if (pathname === "/approval" || pathname === "/extensions")
-        return true;
-    if (pathname === "/tools")
-        return true;
-    return (/^\/extensions\/[^/]+$/.test(pathname) ||
-        /^\/tools\/[^/]+$/.test(pathname) ||
-        /^\/apps\/[^/]+$/.test(pathname));
-}
-function isDispatchAssetOrFrameworkPath(pathname) {
-    return (pathname === "/__manifest" ||
-        pathname.startsWith("/__manifest/") ||
-        pathname === "/_agent-native" ||
-        pathname.startsWith("/_agent-native/") ||
-        pathname === "/.well-known" ||
-        pathname.startsWith("/.well-known/") ||
-        pathname.startsWith("/assets/") ||
-        pathname.startsWith("/_build/") ||
-        pathname.endsWith(".js") ||
-        pathname.endsWith(".css") ||
-        pathname.endsWith(".map") ||
-        pathname.endsWith(".ico") ||
-        pathname.endsWith(".png") ||
-        pathname.endsWith(".svg") ||
-        pathname.endsWith(".woff2") ||
-        pathname.endsWith(".woff"));
-}
-function dispatchNotFoundResponse() {
-    return new Response("Dispatch route not found", {
-        status: 404,
-        headers: { "content-type": "text/plain; charset=utf-8" },
-    });
-}
-export function rootDispatchRedirect(pathname, search) {
-    const normalizedPathname = normalizePathname(pathname);
-    const basePath = normalizeBasePath(process.env.VITE_APP_BASE_PATH || process.env.APP_BASE_PATH);
-    if (!basePath)
-        return null;
-    if (normalizedPathname === "/__manifest" ||
-        normalizedPathname.startsWith("/__manifest/") ||
-        normalizedPathname === "/_agent-native" ||
-        normalizedPathname.startsWith("/_agent-native/")) {
-        return null;
-    }
-    if (normalizedPathname === "/.well-known" ||
-        normalizedPathname.startsWith("/.well-known/")) {
-        return null;
-    }
-    if (normalizedPathname === "/") {
-        return new Response(null, {
-            status: 302,
-            headers: { Location: `${basePath}/overview${search}` },
-        });
-    }
-    if (normalizedPathname === basePath) {
-        return new Response(null, {
-            status: 302,
-            headers: { Location: `${basePath}/overview${search}` },
-        });
-    }
-    if (normalizedPathname.startsWith(`${basePath}/`)) {
-        const dispatchPath = normalizedPathname.slice(basePath.length);
-        const mountedAlias = MOUNTED_DISPATCH_ALIASES.get(dispatchPath);
-        if (mountedAlias) {
-            return new Response(null, {
-                status: 302,
-                headers: { Location: `${basePath}${mountedAlias}${search}` },
-            });
-        }
-        if (isDispatchPagePath(dispatchPath) ||
-            isDispatchAssetOrFrameworkPath(dispatchPath)) {
-            return null;
-        }
-        return dispatchNotFoundResponse();
-    }
-    const rootAlias = DISPATCH_ROOT_ALIASES.get(normalizedPathname);
-    if (rootAlias) {
-        return new Response(null, {
-            status: 302,
-            headers: { Location: `${basePath}${rootAlias}${search}` },
-        });
-    }
-    if (/^\/apps\/[^/]+$/.test(normalizedPathname)) {
-        return new Response(null, {
-            status: 302,
-            headers: { Location: `${basePath}${normalizedPathname}${search}` },
-        });
-    }
-    return dispatchNotFoundResponse();
-}
-//# sourceMappingURL=pre-auth-routing.js.map

package/dist/server/lib/pre-auth-routing.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pre-auth-routing.js","sourceRoot":"","sources":["../../../src/server/lib/pre-auth-routing.ts"],"names":[],"mappings":"AAAA,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IAC3C,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,GAAG,CAAC;IAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;AAC1C,CAAC;AAED,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,WAAW;IACX,UAAU;IACV,QAAQ;IACR,SAAS;IACT,OAAO;IACP,UAAU;IACV,QAAQ;IACR,eAAe;IACf,SAAS;IACT,YAAY;IACZ,QAAQ;IACR,YAAY;IACZ,eAAe;IACf,aAAa;IACb,YAAY;IACZ,cAAc;IACd,QAAQ;IACR,OAAO;CACR,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAiB;IACpD,GAAG,KAAK,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAU,CAAC;IACnE,CAAC,WAAW,EAAE,WAAW,CAAC;IAC1B,CAAC,aAAa,EAAE,aAAa,CAAC;IAC9B,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACpB,CAAC,eAAe,EAAE,UAAU,CAAC;CAC9B,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAiB;IACvD,CAAC,eAAe,EAAE,UAAU,CAAC;CAC9B,CAAC,CAAC;AAEH,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,IAAI,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IACxE,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,CACL,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC;QACtC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC;QACjC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CACjC,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CAAC,QAAgB;IACtD,OAAO,CACL,QAAQ,KAAK,aAAa;QAC1B,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC;QACnC,QAAQ,KAAK,gBAAgB;QAC7B,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC;QACtC,QAAQ,KAAK,cAAc;QAC3B,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC;QACpC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC;QAC/B,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC;QAC/B,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;QACxB,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC3B,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAC3B,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB;IAC/B,OAAO,IAAI,QAAQ,CAAC,0BAA0B,EAAE;QAC9C,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE;KACzD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,MAAc;IAEd,MAAM,kBAAkB,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,iBAAiB,CAChC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAC5D,CAAC;IACF,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,IACE,kBAAkB,KAAK,aAAa;QACpC,kBAAkB,CAAC,UAAU,CAAC,cAAc,CAAC;QAC7C,kBAAkB,KAAK,gBAAgB;QACvC,kBAAkB,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAChD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IACE,kBAAkB,KAAK,cAAc;QACrC,kBAAkB,CAAC,UAAU,CAAC,eAAe,CAAC,EAC9C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,kBAAkB,KAAK,GAAG,EAAE,CAAC;QAC/B,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;YACxB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,QAAQ,YAAY,MAAM,EAAE,EAAE;SACvD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,kBAAkB,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;YACxB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,QAAQ,YAAY,MAAM,EAAE,EAAE;SACvD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,kBAAkB,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,YAAY,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/D,MAAM,YAAY,GAAG,wBAAwB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAChE,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACxB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,QAAQ,GAAG,YAAY,GAAG,MAAM,EAAE,EAAE;aAC7D,CAAC,CAAC;QACL,CAAC;QACD,IACE,kBAAkB,CAAC,YAAY,CAAC;YAChC,8BAA8B,CAAC,YAAY,CAAC,EAC5C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,wBAAwB,EAAE,CAAC;IACpC,CAAC;IAED,MAAM,SAAS,GAAG,qBAAqB,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAChE,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;YACxB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,EAAE,EAAE;SAC1D,CAAC,CAAC;IACL,CAAC;IAED,IAAI,iBAAiB,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;YACxB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,QAAQ,GAAG,kBAAkB,GAAG,MAAM,EAAE,EAAE;SACnE,CAAC,CAAC;IACL,CAAC;IAED,OAAO,wBAAwB,EAAE,CAAC;AACpC,CAAC","sourcesContent":["function normalizeBasePath(value?: string): string {\n  if (!value || value === \"/\") return \"\";\n  const trimmed = value.trim();\n  if (!trimmed || trimmed === \"/\") return \"\";\n  return `/${trimmed.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\")}`;\n}\n\nfunction normalizePathname(value: string): string {\n  if (value === \"/\") return \"/\";\n  return value.replace(/\\/+$/, \"\") || \"/\";\n}\n\nconst DISPATCH_PAGE_PATHS = new Set([\n  \"/overview\",\n  \"/metrics\",\n  \"/login\",\n  \"/signup\",\n  \"/apps\",\n  \"/new-app\",\n  \"/vault\",\n  \"/integrations\",\n  \"/agents\",\n  \"/workspace\",\n  \"/tools\",\n  \"/messaging\",\n  \"/destinations\",\n  \"/identities\",\n  \"/approvals\",\n  \"/automations\",\n  \"/audit\",\n  \"/team\",\n]);\n\nconst DISPATCH_ROOT_ALIASES = new Map<string, string>([\n  ...Array.from(DISPATCH_PAGE_PATHS, (path) => [path, path] as const),\n  [\"/approval\", \"/approval\"],\n  [\"/extensions\", \"/extensions\"],\n  [\"/tools\", \"/tools\"],\n  [\"/apps/new-app\", \"/new-app\"],\n]);\n\nconst MOUNTED_DISPATCH_ALIASES = new Map<string, string>([\n  [\"/apps/new-app\", \"/new-app\"],\n]);\n\nfunction isDispatchPagePath(pathname: string): boolean {\n  if (DISPATCH_PAGE_PATHS.has(pathname)) return true;\n  if (pathname === \"/approval\" || pathname === \"/extensions\") return true;\n  if (pathname === \"/tools\") return true;\n  return (\n    /^\\/extensions\\/[^/]+$/.test(pathname) ||\n    /^\\/tools\\/[^/]+$/.test(pathname) ||\n    /^\\/apps\\/[^/]+$/.test(pathname)\n  );\n}\n\nfunction isDispatchAssetOrFrameworkPath(pathname: string): boolean {\n  return (\n    pathname === \"/__manifest\" ||\n    pathname.startsWith(\"/__manifest/\") ||\n    pathname === \"/_agent-native\" ||\n    pathname.startsWith(\"/_agent-native/\") ||\n    pathname === \"/.well-known\" ||\n    pathname.startsWith(\"/.well-known/\") ||\n    pathname.startsWith(\"/assets/\") ||\n    pathname.startsWith(\"/_build/\") ||\n    pathname.endsWith(\".js\") ||\n    pathname.endsWith(\".css\") ||\n    pathname.endsWith(\".map\") ||\n    pathname.endsWith(\".ico\") ||\n    pathname.endsWith(\".png\") ||\n    pathname.endsWith(\".svg\") ||\n    pathname.endsWith(\".woff2\") ||\n    pathname.endsWith(\".woff\")\n  );\n}\n\nfunction dispatchNotFoundResponse(): Response {\n  return new Response(\"Dispatch route not found\", {\n    status: 404,\n    headers: { \"content-type\": \"text/plain; charset=utf-8\" },\n  });\n}\n\nexport function rootDispatchRedirect(\n  pathname: string,\n  search: string,\n): Response | null {\n  const normalizedPathname = normalizePathname(pathname);\n  const basePath = normalizeBasePath(\n    process.env.VITE_APP_BASE_PATH || process.env.APP_BASE_PATH,\n  );\n  if (!basePath) return null;\n\n  if (\n    normalizedPathname === \"/__manifest\" ||\n    normalizedPathname.startsWith(\"/__manifest/\") ||\n    normalizedPathname === \"/_agent-native\" ||\n    normalizedPathname.startsWith(\"/_agent-native/\")\n  ) {\n    return null;\n  }\n\n  if (\n    normalizedPathname === \"/.well-known\" ||\n    normalizedPathname.startsWith(\"/.well-known/\")\n  ) {\n    return null;\n  }\n\n  if (normalizedPathname === \"/\") {\n    return new Response(null, {\n      status: 302,\n      headers: { Location: `${basePath}/overview${search}` },\n    });\n  }\n\n  if (normalizedPathname === basePath) {\n    return new Response(null, {\n      status: 302,\n      headers: { Location: `${basePath}/overview${search}` },\n    });\n  }\n\n  if (normalizedPathname.startsWith(`${basePath}/`)) {\n    const dispatchPath = normalizedPathname.slice(basePath.length);\n    const mountedAlias = MOUNTED_DISPATCH_ALIASES.get(dispatchPath);\n    if (mountedAlias) {\n      return new Response(null, {\n        status: 302,\n        headers: { Location: `${basePath}${mountedAlias}${search}` },\n      });\n    }\n    if (\n      isDispatchPagePath(dispatchPath) ||\n      isDispatchAssetOrFrameworkPath(dispatchPath)\n    ) {\n      return null;\n    }\n    return dispatchNotFoundResponse();\n  }\n\n  const rootAlias = DISPATCH_ROOT_ALIASES.get(normalizedPathname);\n  if (rootAlias) {\n    return new Response(null, {\n      status: 302,\n      headers: { Location: `${basePath}${rootAlias}${search}` },\n    });\n  }\n\n  if (/^\\/apps\\/[^/]+$/.test(normalizedPathname)) {\n    return new Response(null, {\n      status: 302,\n      headers: { Location: `${basePath}${normalizedPathname}${search}` },\n    });\n  }\n\n  return dispatchNotFoundResponse();\n}\n"]}

package/src/server/lib/pre-auth-routing.ts

@@ -1,159 +0,0 @@
-function normalizeBasePath(value?: string): string {
-  if (!value || value === "/") return "";
-  const trimmed = value.trim();
-  if (!trimmed || trimmed === "/") return "";
-  return `/${trimmed.replace(/^\/+/, "").replace(/\/+$/, "")}`;
-}
-
-function normalizePathname(value: string): string {
-  if (value === "/") return "/";
-  return value.replace(/\/+$/, "") || "/";
-}
-
-const DISPATCH_PAGE_PATHS = new Set([
-  "/overview",
-  "/metrics",
-  "/login",
-  "/signup",
-  "/apps",
-  "/new-app",
-  "/vault",
-  "/integrations",
-  "/agents",
-  "/workspace",
-  "/tools",
-  "/messaging",
-  "/destinations",
-  "/identities",
-  "/approvals",
-  "/automations",
-  "/audit",
-  "/team",
-]);
-
-const DISPATCH_ROOT_ALIASES = new Map<string, string>([
-  ...Array.from(DISPATCH_PAGE_PATHS, (path) => [path, path] as const),
-  ["/approval", "/approval"],
-  ["/extensions", "/extensions"],
-  ["/tools", "/tools"],
-  ["/apps/new-app", "/new-app"],
-]);
-
-const MOUNTED_DISPATCH_ALIASES = new Map<string, string>([
-  ["/apps/new-app", "/new-app"],
-]);
-
-function isDispatchPagePath(pathname: string): boolean {
-  if (DISPATCH_PAGE_PATHS.has(pathname)) return true;
-  if (pathname === "/approval" || pathname === "/extensions") return true;
-  if (pathname === "/tools") return true;
-  return (
-    /^\/extensions\/[^/]+$/.test(pathname) ||
-    /^\/tools\/[^/]+$/.test(pathname) ||
-    /^\/apps\/[^/]+$/.test(pathname)
-  );
-}
-
-function isDispatchAssetOrFrameworkPath(pathname: string): boolean {
-  return (
-    pathname === "/__manifest" ||
-    pathname.startsWith("/__manifest/") ||
-    pathname === "/_agent-native" ||
-    pathname.startsWith("/_agent-native/") ||
-    pathname === "/.well-known" ||
-    pathname.startsWith("/.well-known/") ||
-    pathname.startsWith("/assets/") ||
-    pathname.startsWith("/_build/") ||
-    pathname.endsWith(".js") ||
-    pathname.endsWith(".css") ||
-    pathname.endsWith(".map") ||
-    pathname.endsWith(".ico") ||
-    pathname.endsWith(".png") ||
-    pathname.endsWith(".svg") ||
-    pathname.endsWith(".woff2") ||
-    pathname.endsWith(".woff")
-  );
-}
-
-function dispatchNotFoundResponse(): Response {
-  return new Response("Dispatch route not found", {
-    status: 404,
-    headers: { "content-type": "text/plain; charset=utf-8" },
-  });
-}
-
-export function rootDispatchRedirect(
-  pathname: string,
-  search: string,
-): Response | null {
-  const normalizedPathname = normalizePathname(pathname);
-  const basePath = normalizeBasePath(
-    process.env.VITE_APP_BASE_PATH || process.env.APP_BASE_PATH,
-  );
-  if (!basePath) return null;
-
-  if (
-    normalizedPathname === "/__manifest" ||
-    normalizedPathname.startsWith("/__manifest/") ||
-    normalizedPathname === "/_agent-native" ||
-    normalizedPathname.startsWith("/_agent-native/")
-  ) {
-    return null;
-  }
-
-  if (
-    normalizedPathname === "/.well-known" ||
-    normalizedPathname.startsWith("/.well-known/")
-  ) {
-    return null;
-  }
-
-  if (normalizedPathname === "/") {
-    return new Response(null, {
-      status: 302,
-      headers: { Location: `${basePath}/overview${search}` },
-    });
-  }
-
-  if (normalizedPathname === basePath) {
-    return new Response(null, {
-      status: 302,
-      headers: { Location: `${basePath}/overview${search}` },
-    });
-  }
-
-  if (normalizedPathname.startsWith(`${basePath}/`)) {
-    const dispatchPath = normalizedPathname.slice(basePath.length);
-    const mountedAlias = MOUNTED_DISPATCH_ALIASES.get(dispatchPath);
-    if (mountedAlias) {
-      return new Response(null, {
-        status: 302,
-        headers: { Location: `${basePath}${mountedAlias}${search}` },
-      });
-    }
-    if (
-      isDispatchPagePath(dispatchPath) ||
-      isDispatchAssetOrFrameworkPath(dispatchPath)
-    ) {
-      return null;
-    }
-    return dispatchNotFoundResponse();
-  }
-
-  const rootAlias = DISPATCH_ROOT_ALIASES.get(normalizedPathname);
-  if (rootAlias) {
-    return new Response(null, {
-      status: 302,
-      headers: { Location: `${basePath}${rootAlias}${search}` },
-    });
-  }
-
-  if (/^\/apps\/[^/]+$/.test(normalizedPathname)) {
-    return new Response(null, {
-      status: 302,
-      headers: { Location: `${basePath}${normalizedPathname}${search}` },
-    });
-  }
-
-  return dispatchNotFoundResponse();
-}