@camstack/server 1.2.683 → 1.2.684

package/CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.2.684] - 2026-10-29
+
+### Changed
+
+- A form posted through an addon's data plane (a vendor sign-in page) reaches the addon unchanged instead of re-encoded as JSON
+
 ## [1.2.683] - 2026-10-28
 
 ### Changed

package/dist/api/data-plane/form-body.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseFormBody = parseFormBody;
+exports.registerFormBodyParser = registerFormBodyParser;
+exports.dataPlaneReplayBody = dataPlaneReplayBody;
+const FORM_CONTENT_TYPE = 'application/x-www-form-urlencoded';
+const rawFormBodies = new WeakMap();
+/** Parse a urlencoded body string into a plain object (duplicate keys collapse). */
+function parseFormBody(raw) {
+    const result = {};
+    for (const [key, value] of new URLSearchParams(raw).entries()) {
+        result[key] = value;
+    }
+    return result;
+}
+/** Register the urlencoded parser: the parsed object for hub routes, the raw bytes on the side. */
+function registerFormBodyParser(fastify) {
+    fastify.addContentTypeParser(FORM_CONTENT_TYPE, { parseAs: 'buffer' }, (req, body, done) => {
+        try {
+            const bytes = Buffer.isBuffer(body) ? body : Buffer.from(body);
+            rawFormBodies.set(req.raw, bytes);
+            done(null, parseFormBody(bytes.toString('utf8')));
+        }
+        catch (err) {
+            done(err instanceof Error ? err : new Error(String(err)), undefined);
+        }
+    });
+}
+/**
+ * The bytes a data-plane upstream receives. Never a re-serialised object: a
+ * parsed body with no recorded raw bytes is a bug path, logged (no values) and
+ * refused with `null`.
+ */
+function dataPlaneReplayBody(raw, body, logger) {
+    if (body === undefined)
+        return undefined;
+    if (Buffer.isBuffer(body))
+        return body;
+    if (typeof body === 'string')
+        return Buffer.from(body);
+    const recorded = rawFormBodies.get(raw);
+    if (recorded !== undefined)
+        return recorded;
+    // A JSON body is re-serialised from its parsed object (Fastify's JSON parser
+    // keeps no bytes); every other parsed object has lost its original encoding.
+    const contentType = String(raw.headers['content-type'] ?? '');
+    if (/^application\/(?:[\w.+-]+\+)?json\b/i.test(contentType)) {
+        return Buffer.from(JSON.stringify(body));
+    }
+    logger.error('data-plane request body was parsed but its raw bytes were not recorded', {
+        tags: { contentType: String(raw.headers['content-type'] ?? ''), url: raw.url ?? '' },
+    });
+    return null;
+}

package/dist/api/oauth2/oauth2-routes.js

@@ -9,6 +9,7 @@ exports.registerOauth2Routes = registerOauth2Routes;
 const types_1 = require("@camstack/types");
 const session_cookie_js_1 = require("../../auth/session-cookie.js");
 const app_page_strings_js_1 = require("../../auth/app-page-strings.js");
+const form_body_js_1 = require("../data-plane/form-body.js");
 const consent_page_js_1 = require("./consent-page.js");
 const private_host_js_1 = require("./private-host.js");
 /**
@@ -328,27 +329,10 @@ async function readIntegrationRegistry(registry) {
         .filter((addonId) => !registry.hasProvider('oauth-integration', addonId));
     return { descriptors, pendingAddons };
 }
-/** Parse an application/x-www-form-urlencoded body string into a plain object. */
-function parseFormBody(raw) {
-    const params = new URLSearchParams(raw);
-    const result = {};
-    for (const [key, value] of params.entries()) {
-        result[key] = value;
-    }
-    return result;
-}
 function registerOauth2Routes(fastify, deps) {
-    // Register a content-type parser for application/x-www-form-urlencoded so that
-    // consent POST and token POST can read form bodies. @fastify/formbody is not in
-    // the project's dependencies; we use URLSearchParams (Node built-in) instead.
-    fastify.addContentTypeParser('application/x-www-form-urlencoded', { parseAs: 'string' }, (_req, body, done) => {
-        try {
-            done(null, parseFormBody(body));
-        }
-        catch (err) {
-            done(err, undefined);
-        }
-    });
+    // Form bodies (consent POST, token POST): parsed object for these routes, raw
+    // bytes recorded for the data plane (api/data-plane/form-body.ts).
+    (0, form_body_js_1.registerFormBodyParser)(fastify);
     // ─── GET /api/oauth2/authorize ────────────────────────────────────────────
     // Mounted under /api/* so it is naturally excluded from the SPA catch-all,
     // the PWA service-worker navigate fallback, and the Vite dev proxy — no

package/dist/main.js

@@ -71,6 +71,7 @@ const release_identity_1 = require("./core/release-identity");
 const runner_boot_check_1 = require("./core/runner-health/runner-boot-check");
 const hub_cluster_url_1 = require("./api/hub-cluster-url");
 const model_distributor_js_1 = require("./api/model-distributor.js");
+const form_body_js_1 = require("./api/data-plane/form-body.js");
 const oauth2_routes_js_1 = require("./api/oauth2/oauth2-routes.js");
 const embed_auth_route_js_1 = require("./auth/embed-auth-route.js");
 const live_user_js_1 = require("./auth/live-user.js");
@@ -1128,13 +1129,12 @@ async function bootstrap() {
                 }
                 if (shareHeaders !== null)
                     Object.assign(request.raw.headers, shareHeaders);
+                const replayBody = (0, form_body_js_1.dataPlaneReplayBody)(request.raw, request.body, addonGateLogger);
+                if (replayBody === null) {
+                    return reply.status(500).send({ error: 'Request body could not be forwarded' });
+                }
                 // Take over the socket — `proxyToUpstream` drives the raw response.
                 reply.hijack();
-                const replayBody = request.body === undefined
-                    ? undefined
-                    : Buffer.isBuffer(request.body)
-                        ? request.body
-                        : Buffer.from(typeof request.body === 'string' ? request.body : JSON.stringify(request.body));
                 (0, system_1.proxyToUpstream)({
                     baseUrl: dpMatch.endpoint.baseUrl,
                     secret: dpMatch.endpoint.secret,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.683",
+  "version": "1.2.684",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -49,7 +49,7 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.511",
+    "@camstack/addon-admin-ui": "1.2.512",
     "@camstack/addon-agent-ui": "1.2.289",
     "@camstack/addon-auth": "1.2.170",
     "@camstack/addon-benchmark": "1.2.288",
@@ -62,7 +62,7 @@
     "@camstack/sdk": "1.2.154",
     "@camstack/system": "1.2.514",
     "@camstack/types": "1.2.440",
-    "@camstack/ui-library": "1.2.346",
+    "@camstack/ui-library": "1.2.347",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",