@agent-native/dispatch 0.38.1 → 0.38.2-nightly-20260916214808
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/actions/create-workspace-resource.d.ts +13 -13
- package/dist/actions/provider-api-register.d.ts +4 -4
- package/dist/actions/update-workspace-resource.d.ts +13 -13
- package/dist/server/lib/app-creation-store.d.ts.map +1 -1
- package/dist/server/lib/app-creation-store.js +60 -9
- package/dist/server/lib/app-creation-store.js.map +1 -1
- package/package.json +4 -4
- package/src/server/lib/app-creation-store.spec.ts +91 -2
- package/src/server/lib/app-creation-store.ts +78 -10
|
@@ -6,19 +6,6 @@ declare const _default: import("@agent-native/core/action").ActionDefinition<{
|
|
|
6
6
|
content: string;
|
|
7
7
|
scope: "all" | "selected";
|
|
8
8
|
}, {
|
|
9
|
-
id: string;
|
|
10
|
-
ownerEmail: string;
|
|
11
|
-
orgId: string | null;
|
|
12
|
-
kind: string;
|
|
13
|
-
name: string;
|
|
14
|
-
description: string | null;
|
|
15
|
-
path: string;
|
|
16
|
-
content: string;
|
|
17
|
-
scope: string;
|
|
18
|
-
createdBy: string;
|
|
19
|
-
createdAt: number;
|
|
20
|
-
updatedAt: number;
|
|
21
|
-
} | {
|
|
22
9
|
id: string;
|
|
23
10
|
ownerEmail: string;
|
|
24
11
|
orgId: string | null;
|
|
@@ -35,6 +22,19 @@ declare const _default: import("@agent-native/core/action").ActionDefinition<{
|
|
|
35
22
|
reviewedAt: number | null;
|
|
36
23
|
createdAt: number;
|
|
37
24
|
updatedAt: number;
|
|
25
|
+
} | {
|
|
26
|
+
id: string;
|
|
27
|
+
ownerEmail: string;
|
|
28
|
+
orgId: string | null;
|
|
29
|
+
kind: string;
|
|
30
|
+
name: string;
|
|
31
|
+
description: string | null;
|
|
32
|
+
path: string;
|
|
33
|
+
content: string;
|
|
34
|
+
scope: string;
|
|
35
|
+
createdBy: string;
|
|
36
|
+
createdAt: number;
|
|
37
|
+
updatedAt: number;
|
|
38
38
|
}>;
|
|
39
39
|
export default _default;
|
|
40
40
|
//# sourceMappingURL=create-workspace-resource.d.ts.map
|
|
@@ -47,6 +47,7 @@ declare const _default: import("node_modules/@agent-native/core/dist").ActionDef
|
|
|
47
47
|
notes?: string | undefined;
|
|
48
48
|
scope?: "org" | "user" | undefined;
|
|
49
49
|
}, {
|
|
50
|
+
message?: undefined;
|
|
50
51
|
id?: undefined;
|
|
51
52
|
provider?: undefined;
|
|
52
53
|
deleted?: undefined;
|
|
@@ -63,8 +64,8 @@ declare const _default: import("node_modules/@agent-native/core/dist").ActionDef
|
|
|
63
64
|
count: number;
|
|
64
65
|
registered?: undefined;
|
|
65
66
|
label?: undefined;
|
|
66
|
-
message?: undefined;
|
|
67
67
|
} | {
|
|
68
|
+
message?: undefined;
|
|
68
69
|
id?: undefined;
|
|
69
70
|
deleted?: undefined;
|
|
70
71
|
providers?: undefined;
|
|
@@ -73,8 +74,8 @@ declare const _default: import("node_modules/@agent-native/core/dist").ActionDef
|
|
|
73
74
|
provider: import("node_modules/@agent-native/core/dist/provider-api").CustomProviderConfig;
|
|
74
75
|
registered?: undefined;
|
|
75
76
|
label?: undefined;
|
|
76
|
-
message?: undefined;
|
|
77
77
|
} | {
|
|
78
|
+
message?: undefined;
|
|
78
79
|
provider?: undefined;
|
|
79
80
|
deleted?: undefined;
|
|
80
81
|
providers?: undefined;
|
|
@@ -83,8 +84,8 @@ declare const _default: import("node_modules/@agent-native/core/dist").ActionDef
|
|
|
83
84
|
id: string;
|
|
84
85
|
registered?: undefined;
|
|
85
86
|
label?: undefined;
|
|
86
|
-
message?: undefined;
|
|
87
87
|
} | {
|
|
88
|
+
message?: undefined;
|
|
88
89
|
provider?: undefined;
|
|
89
90
|
found?: undefined;
|
|
90
91
|
providers?: undefined;
|
|
@@ -93,7 +94,6 @@ declare const _default: import("node_modules/@agent-native/core/dist").ActionDef
|
|
|
93
94
|
id: string;
|
|
94
95
|
registered?: undefined;
|
|
95
96
|
label?: undefined;
|
|
96
|
-
message?: undefined;
|
|
97
97
|
} | {
|
|
98
98
|
provider?: undefined;
|
|
99
99
|
deleted?: undefined;
|
|
@@ -5,19 +5,6 @@ declare const _default: import("@agent-native/core/action").ActionDefinition<{
|
|
|
5
5
|
content?: string | undefined;
|
|
6
6
|
scope?: "all" | "selected" | undefined;
|
|
7
7
|
}, {
|
|
8
|
-
id: string;
|
|
9
|
-
ownerEmail: string;
|
|
10
|
-
orgId: string | null;
|
|
11
|
-
kind: string;
|
|
12
|
-
name: string;
|
|
13
|
-
description: string | null;
|
|
14
|
-
path: string;
|
|
15
|
-
content: string;
|
|
16
|
-
scope: string;
|
|
17
|
-
createdBy: string;
|
|
18
|
-
createdAt: number;
|
|
19
|
-
updatedAt: number;
|
|
20
|
-
} | {
|
|
21
8
|
id: string;
|
|
22
9
|
ownerEmail: string;
|
|
23
10
|
orgId: string | null;
|
|
@@ -34,6 +21,19 @@ declare const _default: import("@agent-native/core/action").ActionDefinition<{
|
|
|
34
21
|
reviewedAt: number | null;
|
|
35
22
|
createdAt: number;
|
|
36
23
|
updatedAt: number;
|
|
24
|
+
} | {
|
|
25
|
+
id: string;
|
|
26
|
+
ownerEmail: string;
|
|
27
|
+
orgId: string | null;
|
|
28
|
+
kind: string;
|
|
29
|
+
name: string;
|
|
30
|
+
description: string | null;
|
|
31
|
+
path: string;
|
|
32
|
+
content: string;
|
|
33
|
+
scope: string;
|
|
34
|
+
createdBy: string;
|
|
35
|
+
createdAt: number;
|
|
36
|
+
updatedAt: number;
|
|
37
37
|
}>;
|
|
38
38
|
export default _default;
|
|
39
39
|
//# sourceMappingURL=update-workspace-resource.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"app-creation-store.d.ts","sourceRoot":"","sources":["../../../src/server/lib/app-creation-store.ts"],"names":[],"mappings":"AAaA,OAAO,EAYL,KAAK,sBAAsB,EAC5B,MAAM,2BAA2B,CAAC;AAOnC,OAAO,EAML,KAAK,mBAAmB,EACzB,MAAM,2BAA2B,CAAC;AAInC,OAAO,mBAAmB,CAAC;
|
|
1
|
+
{"version":3,"file":"app-creation-store.d.ts","sourceRoot":"","sources":["../../../src/server/lib/app-creation-store.ts"],"names":[],"mappings":"AAaA,OAAO,EAYL,KAAK,sBAAsB,EAC5B,MAAM,2BAA2B,CAAC;AAOnC,OAAO,EAML,KAAK,mBAAmB,EACzB,MAAM,2BAA2B,CAAC;AAInC,OAAO,mBAAmB,CAAC;AAwF3B,KAAK,oBAAoB,GAAG,UAAU,GAAG,QAAQ,CAAC;AAClD,KAAK,sBAAsB,GAAG,SAAS,GAAG,KAAK,CAAC;AAEhD,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,sBAAsB,CAAC;IACpC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,4EAA4E;IAC5E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAcD,MAAM,WAAW,wBAAwB;IACvC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,oBAAoB,GAAG,KAAK,CAAC;CACzC;AAED,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,sBAAsB,EAAE,KAAK,GAAG,UAAU,GAAG,SAAS,GAAG,OAAO,CAAC;IACjE,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,uBAAuB,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,sFAAsF;IACtF,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,qEAAqE;IACrE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,wDAAwD;IACxD,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAsFD,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,MAAM,CAcR;AAusBD,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAcxC;AAED,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAexC;AAED,wBAAsB,yBAAyB,CAAC,KAAK,EAAE;IACrD,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAkBhC;AAq0BD,wBAAgB,sBAAsB,IAAI,MAAM,GAAG,IAAI,CAOtD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAAI,aAAa,CAiChD;AAyCD,wBAAsB,0BAA0B,CAAC,KAAK,EAAE;IACtD,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA8C/B;AAED,wBAAsB,iBAAiB,CACrC,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAkFhC;AA+GD,wBAAsB,+BAA+B,IAAI,OAAO,CAC9D,0BAA0B,EAAE,CAC7B,CAOA;AAID,wBAAsB,gCAAgC,CAAC,KAAK,EAAE;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAoF/D;AA6CD,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,mBAAmB,CAAC,CA+B3E;AAqDD,wBAAsB,sBAAsB,CAAC,KAAK,EAAE;IAClD,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAgB/B;AAWD,wBAAgB,yBAAyB,IAAI,OAAO,CAcnD;AA+UD;;;GAGG;AACH,MAAM,MAAM,4BAA4B,GACpC,qBAAqB,GACrB,8BAA8B,GAC9B,uBAAuB,GACvB,8BAA8B,GAC9B,eAAe,CAAC;AAEpB,MAAM,WAAW,oCAAoC;IACnD,IAAI,EAAE,qBAAqB,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,qBAAqB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mCAAmC;IAClD,IAAI,EAAE,qBAAqB,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC,4BAA4B,EAAE,qBAAqB,CAAC,CAAC;IACrE,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB;qEACiE;IACjE,eAAe,CAAC,EAAE,mBAAmB,CAAC;CACvC;AAED,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,aAAa,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,aAAa,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,+BAA+B,GACvC,oCAAoC,GACpC,mCAAmC,GACnC,2BAA2B,GAC3B,2BAA2B,GAC3B,wBAAwB,CAAC;AAE7B,wBAAsB,yBAAyB,CAAC,KAAK,EAAE;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE,sBAAsB,EAAE,CAAC;CACxC,GAAG,OAAO,CAAC,+BAA+B,CAAC,CA4K3C"}
|
|
@@ -64,6 +64,12 @@ class WorkspaceAppsGatewayAuthorizationError extends Error {
|
|
|
64
64
|
}
|
|
65
65
|
statusCode;
|
|
66
66
|
}
|
|
67
|
+
/** A denied gateway read is visible in logs even when a fallback can answer. */
|
|
68
|
+
function warnWorkspaceAppsGatewayDenial(denial, source) {
|
|
69
|
+
if (!denial)
|
|
70
|
+
return;
|
|
71
|
+
console.warn(`[dispatch] workspace apps gateway denied the registry read with HTTP ${denial.statusCode}; served the ${source} instead`);
|
|
72
|
+
}
|
|
67
73
|
function readJson(file) {
|
|
68
74
|
try {
|
|
69
75
|
return JSON.parse(fs.readFileSync(file, "utf8"));
|
|
@@ -900,13 +906,20 @@ function appRecordTimestamp(value) {
|
|
|
900
906
|
*/
|
|
901
907
|
async function ensureWorkspaceAppRecords(apps, options = {}) {
|
|
902
908
|
const readyApps = apps.filter((app) => app.status !== "pending" && !app.isDispatch);
|
|
903
|
-
|
|
904
|
-
|
|
909
|
+
// A source the caller could not authenticate annotates from existing rows
|
|
910
|
+
// only. Minting a row here would create the very authorization the access
|
|
911
|
+
// filter then checks, and reconciling would delete rows and shares on the
|
|
912
|
+
// word of a manifest no authoritative registry confirmed.
|
|
913
|
+
const shouldPersist = options.persist !== false;
|
|
914
|
+
const shouldReconcile = options.reconcile === true && shouldPersist;
|
|
915
|
+
if (!shouldReconcile && readyApps.length === 0) {
|
|
905
916
|
return apps;
|
|
917
|
+
}
|
|
906
918
|
const orgId = currentOrgId();
|
|
907
919
|
const metadata = await readWorkspaceAppMetadataSettings();
|
|
908
920
|
const db = getDbExec();
|
|
909
921
|
const records = new Map();
|
|
922
|
+
const unresolvedIds = [];
|
|
910
923
|
try {
|
|
911
924
|
const existingRecords = new Map();
|
|
912
925
|
for (let start = 0; start < readyApps.length; start += 500) {
|
|
@@ -927,6 +940,10 @@ async function ensureWorkspaceAppRecords(apps, options = {}) {
|
|
|
927
940
|
for (const app of readyApps) {
|
|
928
941
|
const existing = existingRecords.get(app.id);
|
|
929
942
|
if (!existing) {
|
|
943
|
+
if (!shouldPersist) {
|
|
944
|
+
unresolvedIds.push(app.id);
|
|
945
|
+
continue;
|
|
946
|
+
}
|
|
930
947
|
const override = metadata.apps[app.id];
|
|
931
948
|
// Never infer ownership from the person who happened to list apps.
|
|
932
949
|
// Legacy manifests without trusted creation metadata remain
|
|
@@ -968,7 +985,7 @@ async function ensureWorkspaceAppRecords(apps, options = {}) {
|
|
|
968
985
|
const existingOrgId = cleanOptionalText(existing.org_id) ?? null;
|
|
969
986
|
// A registry row belongs to the org that created it. Never reassign a
|
|
970
987
|
// row from another org just because a caller listed the same manifest.
|
|
971
|
-
if (existingOrgId && existingOrgId !== orgId) {
|
|
988
|
+
if (!shouldPersist || (existingOrgId && existingOrgId !== orgId)) {
|
|
972
989
|
records.set(app.id, {
|
|
973
990
|
ownerEmail: existingOwnerEmail,
|
|
974
991
|
orgId: existingOrgId,
|
|
@@ -1026,6 +1043,9 @@ async function ensureWorkspaceAppRecords(apps, options = {}) {
|
|
|
1026
1043
|
});
|
|
1027
1044
|
}
|
|
1028
1045
|
}
|
|
1046
|
+
if (unresolvedIds.length > 0) {
|
|
1047
|
+
console.warn(`[dispatch] unverified workspace app read has no access record for ${unresolvedIds.length} app(s); hidden from this response: ${unresolvedIds.join(", ")}`);
|
|
1048
|
+
}
|
|
1029
1049
|
if (shouldReconcile && orgId) {
|
|
1030
1050
|
const currentAppIds = new Set(readyApps.map((app) => app.id));
|
|
1031
1051
|
const result = await db.execute({
|
|
@@ -1117,6 +1137,8 @@ async function filterWorkspaceAppsByAccess(apps) {
|
|
|
1117
1137
|
const decisions = await Promise.all(batch.map(async (app) => {
|
|
1118
1138
|
try {
|
|
1119
1139
|
const access = await resolveAccess("workspace-app", app.id, { userEmail, orgId }, { skipResourceBody: true });
|
|
1140
|
+
// A missing row is not an authorization result. This remains
|
|
1141
|
+
// fail-closed when a denied registry read falls back to a manifest.
|
|
1120
1142
|
return { app, allowed: Boolean(access) };
|
|
1121
1143
|
}
|
|
1122
1144
|
catch (error) {
|
|
@@ -1289,6 +1311,9 @@ async function readWorkspaceAppsFromGateway() {
|
|
|
1289
1311
|
...protectedRedirect,
|
|
1290
1312
|
signal: controller.signal,
|
|
1291
1313
|
});
|
|
1314
|
+
if (localResponse.status === 401 || localResponse.status === 403) {
|
|
1315
|
+
throw new WorkspaceAppsGatewayAuthorizationError(localResponse.status);
|
|
1316
|
+
}
|
|
1292
1317
|
if (localResponse.ok) {
|
|
1293
1318
|
const apps = parseWorkspaceAppsManifest(
|
|
1294
1319
|
// coercion-ok: malformed gateway JSON is an unavailable registry and
|
|
@@ -1529,32 +1554,58 @@ export async function updateWorkspaceAppMetadata(input) {
|
|
|
1529
1554
|
return updated ?? { ...app, name, description };
|
|
1530
1555
|
}
|
|
1531
1556
|
export async function listWorkspaceApps(options = {}) {
|
|
1532
|
-
const finalize = async (apps, reconcile = false) => {
|
|
1557
|
+
const finalize = async (apps, { reconcile = false, persist = true } = {}) => {
|
|
1533
1558
|
// Reconcile from the complete manifest. Archive and audience filters only
|
|
1534
1559
|
// control the response; treating hidden apps as absent deletes their rows.
|
|
1535
1560
|
const annotated = await applyArchivedAndPending(apps);
|
|
1536
|
-
const recorded = await ensureWorkspaceAppRecords(annotated, {
|
|
1561
|
+
const recorded = await ensureWorkspaceAppRecords(annotated, {
|
|
1562
|
+
reconcile,
|
|
1563
|
+
persist,
|
|
1564
|
+
});
|
|
1537
1565
|
const listed = options.includeArchived
|
|
1538
1566
|
? recorded
|
|
1539
1567
|
: recorded.filter((app) => !app.archived);
|
|
1540
1568
|
const visible = await filterWorkspaceAppsByAccess(filterAppsByAudience(listed, options.audience));
|
|
1541
1569
|
return maybeIncludeAgentCards(visible, options);
|
|
1542
1570
|
};
|
|
1543
|
-
|
|
1571
|
+
let gatewayDenial = null;
|
|
1572
|
+
let gatewayApps = null;
|
|
1573
|
+
try {
|
|
1574
|
+
gatewayApps = await readWorkspaceAppsFromGateway();
|
|
1575
|
+
}
|
|
1576
|
+
catch (error) {
|
|
1577
|
+
if (!(error instanceof WorkspaceAppsGatewayAuthorizationError))
|
|
1578
|
+
throw error;
|
|
1579
|
+
// A denial answers for the gateway hop, not for what this caller may see.
|
|
1580
|
+
// Serve deployment manifests below, but keep the degraded read read-only
|
|
1581
|
+
// because an unauthenticated manifest must not mint access rows.
|
|
1582
|
+
gatewayDenial = error;
|
|
1583
|
+
}
|
|
1544
1584
|
if (gatewayApps) {
|
|
1545
|
-
return finalize(gatewayApps.apps, gatewayApps.authoritative);
|
|
1585
|
+
return finalize(gatewayApps.apps, { reconcile: gatewayApps.authoritative });
|
|
1546
1586
|
}
|
|
1587
|
+
const unverified = gatewayDenial !== null;
|
|
1547
1588
|
const workspaceRoot = findWorkspaceRoot();
|
|
1548
1589
|
const localFilesystemApps = workspaceRoot && isLocalAppCreationRuntime()
|
|
1549
1590
|
? await readWorkspaceAppsFromFilesystem(workspaceRoot)
|
|
1550
1591
|
: null;
|
|
1551
1592
|
if (localFilesystemApps) {
|
|
1552
|
-
|
|
1593
|
+
warnWorkspaceAppsGatewayDenial(gatewayDenial, "local filesystem");
|
|
1594
|
+
return finalize(localFilesystemApps, {
|
|
1595
|
+
reconcile: !unverified,
|
|
1596
|
+
persist: !unverified,
|
|
1597
|
+
});
|
|
1553
1598
|
}
|
|
1554
1599
|
const manifestApps = readWorkspaceAppsFromEnv() ?? readWorkspaceAppsFromManifestFile();
|
|
1555
1600
|
if (manifestApps) {
|
|
1556
|
-
|
|
1601
|
+
warnWorkspaceAppsGatewayDenial(gatewayDenial, "deployment manifest");
|
|
1602
|
+
return finalize(manifestApps, {
|
|
1603
|
+
reconcile: !unverified,
|
|
1604
|
+
persist: !unverified,
|
|
1605
|
+
});
|
|
1557
1606
|
}
|
|
1607
|
+
if (gatewayDenial)
|
|
1608
|
+
throw gatewayDenial;
|
|
1558
1609
|
if (!workspaceRoot) {
|
|
1559
1610
|
return finalize([
|
|
1560
1611
|
{
|