@agent-native/dispatch 0.27.3 → 0.27.5

package/src/server/lib/workspace-app-action-auth.ts

@@ -0,0 +1,105 @@
+import { verifyA2AToken } from "@agent-native/core/a2a";
+import {
+  isOrgMember,
+  resolveOrgByDomain,
+  resolveOrgIdForEmail,
+} from "@agent-native/core/org";
+import type {
+  ActionRouteAuthAdapter,
+  ActionRouteResolvedCaller,
+} from "@agent-native/core/server";
+
+export const WORKSPACE_APPS_ACTION_PATH =
+  "/_agent-native/actions/list-workspace-apps";
+
+function isWorkspaceAppsActionPath(event: any): boolean {
+  const rawUrl =
+    (typeof event?.context?._mountedPathname === "string" &&
+      event.context._mountedPathname) ||
+    (typeof event?.path === "string" && event.path) ||
+    (typeof event?.url?.pathname === "string" && event.url.pathname) ||
+    (typeof event?.node?.req?.url === "string" && event.node.req.url) ||
+    (typeof event?.req?.url === "string" && event.req.url) ||
+    "/";
+  const requestPath =
+    String(rawUrl).split("?", 1)[0].replace(/\/+$/, "") || "/";
+  const appBasePath = process.env.APP_BASE_PATH?.trim().replace(/\/+$/, "");
+  return (
+    requestPath === WORKSPACE_APPS_ACTION_PATH ||
+    Boolean(
+      appBasePath &&
+      `${appBasePath}${WORKSPACE_APPS_ACTION_PATH}` === requestPath,
+    )
+  );
+}
+
+function readAuthorizationHeader(event: any): string | undefined {
+  const headers = event?.node?.req?.headers ?? event?.req?.headers;
+  if (typeof headers?.get === "function") {
+    return headers.get("authorization") ?? undefined;
+  }
+  const value = headers?.authorization ?? headers?.Authorization;
+  return Array.isArray(value) ? value[0] : value;
+}
+
+/**
+ * The hosted workspace registry is a read-only action that accepts a caller
+ * JWT from Dispatch. Keep this resolver path-scoped so the shared secret never
+ * becomes a bearer credential for unrelated Dispatch actions.
+ */
+export const workspaceAppActionRouteAuth: ActionRouteAuthAdapter = {
+  resolveCaller: async (event): Promise<ActionRouteResolvedCaller | null> => {
+    if (!isWorkspaceAppsActionPath(event)) return null;
+
+    const authorization = readAuthorizationHeader(event);
+    if (!authorization) return null;
+    if (!authorization.startsWith("Bearer ")) {
+      throw new Error("Invalid workspace registry authorization");
+    }
+
+    const token = authorization.slice("Bearer ".length).trim();
+    if (!token) throw new Error("Invalid workspace registry authorization");
+
+    const identity = await verifyA2AToken(token, event);
+    if (!identity.email) {
+      throw new Error("Invalid workspace registry authorization");
+    }
+
+    const orgDomain = identity.orgDomain?.trim().toLowerCase();
+    const claimedOrgId = identity.orgId?.trim();
+    let orgId: string | null;
+    if (claimedOrgId) {
+      // A signed org_id is authoritative when the sender had an org-scoped
+      // request but could not resolve a domain. If both claims exist, reject
+      // a mismatch rather than allowing either claim to widen scope.
+      if (orgDomain) {
+        const org = await resolveOrgByDomain(orgDomain);
+        if (org && org.orgId !== claimedOrgId) {
+          throw new Error("Invalid workspace registry authorization");
+        }
+      }
+      if (!(await isOrgMember(claimedOrgId, identity.email))) {
+        throw new Error("Invalid workspace registry authorization");
+      }
+      orgId = claimedOrgId;
+    } else if (orgDomain) {
+      // A verified domain claim identifies the caller's intended org. Resolve
+      // it locally instead of falling back to the receiver's active-org or
+      // first-membership selection, which can be wrong for multi-org users.
+      const org = await resolveOrgByDomain(orgDomain);
+      if (!org || !(await isOrgMember(org.orgId, identity.email))) {
+        throw new Error("Invalid workspace registry authorization");
+      }
+      orgId = org.orgId;
+    } else {
+      // Preserve compatibility with legacy tokens that predate org_domain.
+      orgId = await resolveOrgIdForEmail(identity.email);
+    }
+
+    return {
+      owner: identity.email,
+      anonymous: false,
+      orgId,
+    };
+  },
+};

package/src/server/plugins/agent-chat.spec.ts

@@ -33,6 +33,10 @@ describe("Dispatch agent chat plugin", () => {
             "start-workspace-app-creation",
           ]),
         },
+        actionRoutePublicPaths: ["/_agent-native/actions/list-workspace-apps"],
+        actionRouteAuth: expect.objectContaining({
+          resolveCaller: expect.any(Function),
+        }),
       }),
     );
   });

package/src/server/plugins/agent-chat.ts

@@ -2,6 +2,10 @@ import { getOrgContext } from "@agent-native/core/org";
 import { createAgentChatPlugin } from "@agent-native/core/server";
 
 import { dispatchActions } from "../../actions/index.js";
+import {
+  workspaceAppActionRouteAuth,
+  WORKSPACE_APPS_ACTION_PATH,
+} from "../lib/workspace-app-action-auth.js";
 
 const INITIAL_TOOL_NAMES = [
   "view-screen",
@@ -53,6 +57,8 @@ export default createAgentChatPlugin({
   // a build-time-generated `.generated/actions-registry.ts` (the latter is a
   // template-only construct that the Vite plugin emits next to actions/).
   actions: dispatchActions,
+  actionRouteAuth: workspaceAppActionRouteAuth,
+  actionRoutePublicPaths: [WORKSPACE_APPS_ACTION_PATH],
   codeExecution: { production: "sandboxed" },
   systemPrompt: `You are the central dispatch for this workspace.