@agent-native/dispatch 0.29.3 → 0.29.5

package/src/server/lib/app-creation-store.spec.ts

@@ -345,6 +345,49 @@ describe("listWorkspaceApps", () => {
     expect(apps.map((app) => app.id)).toEqual(["dispatch"]);
   });
 
+  it("projects exact custom SSO eligibility without exposing registry details", async () => {
+    stubNoPendingContext();
+    stubManifest([
+      { id: "dispatch", name: "Dispatch", path: "/dispatch" },
+      {
+        id: "workspace-reports",
+        name: "Workspace Reports",
+        path: "/workspace-reports",
+        url: "https://reports.example.com/workspace-reports",
+      },
+      {
+        id: "unregistered",
+        name: "Unregistered",
+        path: "/unregistered",
+        url: "https://unregistered.example.com",
+      },
+    ]);
+    vi.stubEnv(
+      "IDENTITY_SSO_APP_REGISTRY_JSON",
+      JSON.stringify([
+        {
+          appId: "workspace-reports",
+          clientId: "workspace-reports-client",
+          origin: "https://reports.example.com",
+          callbackPath: "/_agent-native/identity/callback",
+          capabilities: ["identity-sso"],
+        },
+      ]),
+    );
+
+    const apps = await runWithRequestContext(
+      { userEmail: "dev@example.test" },
+      () => listWorkspaceApps({ includeAgentCards: false }),
+    );
+
+    expect(apps.find((app) => app.id === "workspace-reports")).toMatchObject({
+      workspaceSso: true,
+    });
+    expect(apps.find((app) => app.id === "unregistered")).toMatchObject({
+      workspaceSso: false,
+    });
+  });
+
   it("filters workspace apps by audience", async () => {
     stubNoPendingContext();
     vi.stubEnv(

package/src/server/lib/app-creation-store.ts

@@ -17,6 +17,7 @@ import {
 import { getSetting, putSetting } from "@agent-native/core/settings";
 import { assertValidWorkspaceAppId } from "@agent-native/core/shared";
 
+import { isWorkspaceSsoAppUrl } from "../../shared/workspace-sso.js";
 import { identityKeyForIncoming } from "./dispatch-integrations.js";
 import {
   currentOrgId,
@@ -103,6 +104,8 @@ export interface WorkspaceAppSummary {
   agentName?: string | null;
   agentSkillsCount?: number | null;
   archived?: boolean;
+  /** Safe server-side eligibility projection for the workspace SSO action. */
+  workspaceSso?: boolean;
 }
 
 export interface ListWorkspaceAppsOptions {
@@ -1326,9 +1329,14 @@ async function applyArchivedAndPending(
       app,
       metadataSettings,
     );
-    return archivedSet.has(app.id)
-      ? { ...withMetadata, archived: true }
-      : withMetadata;
+    return {
+      ...withMetadata,
+      workspaceSso: isWorkspaceSsoAppUrl(withMetadata, {
+        nodeEnv: process.env.NODE_ENV,
+        registryRaw: process.env.IDENTITY_SSO_APP_REGISTRY_JSON,
+      }),
+      ...(archivedSet.has(app.id) ? { archived: true } : {}),
+    };
   });
   return options.includeArchived
     ? filterAppsByAudience(annotated, options.audience)

package/src/server/lib/mcp-gateway.ts

@@ -25,9 +25,8 @@ import {
 } from "@agent-native/core/server/agent-discovery";
 
 import {
-  CANONICAL_WORKSPACE_SSO_APP_ORIGINS,
   DISPATCH_WORKSPACE_SSO_FLAG,
-  parseWorkspaceSsoAppRegistrations,
+  isWorkspaceSsoAppUrl,
 } from "../../shared/workspace-sso.js";
 import {
   listWorkspaceApps,
@@ -465,17 +464,6 @@ function safeAppOrigin(app: DispatchMcpAccessibleApp): string | null {
   }
 }
 
-function isLoopbackOrigin(origin: string): boolean {
-  try {
-    const hostname = new URL(origin).hostname;
-    return ["localhost", "127.0.0.1", "::1"].includes(hostname);
-  } catch {
-    // coercion-ok: only a previously validated app origin reaches this helper;
-    // malformed values are ineligible for the loopback development exception.
-    return false;
-  }
-}
-
 function appBaseUrl(app: DispatchMcpAccessibleApp): string {
   return app.url.replace(/\/+$/, "");
 }
@@ -643,44 +631,13 @@ export async function resolveGrantedDispatchMcpApp(
   return match;
 }
 
-function workspaceSsoOriginForApp(appId: string): string | null {
-  const canonical =
-    CANONICAL_WORKSPACE_SSO_APP_ORIGINS[
-      appId as keyof typeof CANONICAL_WORKSPACE_SSO_APP_ORIGINS
-    ];
-  if (canonical) return canonical;
-  const custom = parseWorkspaceSsoAppRegistrations(
-    process.env.IDENTITY_SSO_APP_REGISTRY_JSON,
-  ).find((registration) => registration.appId === appId);
-  return custom?.origin ?? null;
-}
-
-function isWorkspaceSsoCanonicalApp(app: DispatchMcpAccessibleApp): boolean {
-  const origin = safeAppOrigin(app);
-  if (!origin) return false;
-  const registeredOrigin = workspaceSsoOriginForApp(app.id);
-  if (origin === registeredOrigin) return true;
-  // The built-in discovery table intentionally points at local dev ports when
-  // running outside production. Keep local development usable without ever
-  // weakening the production exact-origin check.
-  return process.env.NODE_ENV !== "production" && isLoopbackOrigin(origin)
-    ? Object.prototype.hasOwnProperty.call(
-        CANONICAL_WORKSPACE_SSO_APP_ORIGINS,
-        app.id,
-      )
-    : false;
-}
-
 async function isEligibleWorkspaceSsoApp(
   candidate: DispatchMcpAccessibleApp,
 ): Promise<boolean> {
-  const origin = safeAppOrigin(candidate);
-  if (!origin) return false;
-  if (isWorkspaceSsoCanonicalApp(candidate)) return true;
-
-  const customOrigin = workspaceSsoOriginForApp(candidate.id);
-  if (customOrigin === origin) return true;
-  return false;
+  return isWorkspaceSsoAppUrl(candidate, {
+    nodeEnv: process.env.NODE_ENV,
+    registryRaw: process.env.IDENTITY_SSO_APP_REGISTRY_JSON,
+  });
 }
 
 async function listWorkspaceSsoApps(): Promise<DispatchMcpAccessibleApp[]> {

package/src/shared/workspace-sso.ts

@@ -116,3 +116,58 @@ export function parseWorkspaceSsoAppRegistrations(
   }
   return registrations;
 }
+
+function appOrigin(rawUrl: unknown): string | null {
+  if (typeof rawUrl !== "string" || !rawUrl.trim()) return null;
+  try {
+    const url = new URL(rawUrl.trim());
+    return url.protocol === "http:" || url.protocol === "https:"
+      ? url.origin
+      : null;
+  } catch {
+    // coercion-ok: malformed app metadata is not eligible for workspace SSO.
+    return null;
+  }
+}
+
+function isLoopbackOrigin(origin: string): boolean {
+  try {
+    return LOCALHOST_HOSTS.has(new URL(origin).hostname);
+  } catch {
+    // coercion-ok: only a previously parsed origin reaches this helper.
+    return false;
+  }
+}
+
+/**
+ * Keep the server-side app catalog and the browser's action choice on the
+ * same exact-origin rules. `registryRaw` is deliberately supplied by the
+ * caller so this shared module never reads process or browser environment.
+ */
+export function isWorkspaceSsoAppUrl(
+  app: { id: string; url?: unknown },
+  options: { nodeEnv?: string; registryRaw?: unknown } = {},
+): boolean {
+  const origin = appOrigin(app.url);
+  if (!origin) return false;
+
+  const appId = app.id.trim().toLowerCase();
+  const canonicalOrigin =
+    CANONICAL_WORKSPACE_SSO_APP_ORIGINS[
+      appId as keyof typeof CANONICAL_WORKSPACE_SSO_APP_ORIGINS
+    ];
+  if (canonicalOrigin === origin) return true;
+
+  if (
+    options.nodeEnv !== "production" &&
+    canonicalOrigin &&
+    isLoopbackOrigin(origin)
+  ) {
+    return true;
+  }
+
+  return parseWorkspaceSsoAppRegistrations(options.registryRaw).some(
+    (registration) =>
+      registration.appId === appId && registration.origin === origin,
+  );
+}