@forestadmin/agent 1.79.5 → 1.81.0

package/dist/routes/workflow/workflow-executor-proxy.d.ts

@@ -6,9 +6,13 @@ import BaseRoute from '../base-route';
 export default class WorkflowExecutorProxyRoute extends BaseRoute {
     readonly type = RouteType.PrivateRoute;
     private readonly executorUrl;
+    protected readonly requestTimeoutMs: number;
     constructor(services: ForestAdminHttpDriverServices, options: AgentOptionsWithDefaults);
     setupRoutes(router: KoaRouter): void;
     private handleProxy;
+    private buildTargetUrl;
+    private executorPath;
+    private forwardedHeaders;
     private forwardRequest;
 }
 //# sourceMappingURL=workflow-executor-proxy.d.ts.map

package/dist/routes/workflow/workflow-executor-proxy.js

@@ -3,46 +3,96 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+const datasource_toolkit_1 = require("@forestadmin/datasource-toolkit");
 const http_1 = require("http");
 const https_1 = require("https");
 const types_1 = require("../../types");
 const base_route_1 = __importDefault(require("../base-route"));
+// Any sub-path under this prefix is forwarded verbatim to the executor root, so a new executor
+// route needs no agent change.
+const AGENT_PREFIX = '/_internal/executor';
+// Never forwarded: hop-by-hop headers, Host (Node derives the executor's from the target URL),
+// and length/encoding the HTTP client recomputes.
+const SKIPPED_HEADERS = new Set([
+    'connection',
+    'keep-alive',
+    'transfer-encoding',
+    'upgrade',
+    'te',
+    'trailer',
+    'proxy-authenticate',
+    'proxy-authorization',
+    'host',
+    'content-length',
+]);
+// Substrings that could let the wildcard escape the executor origin (traversal, encoded dots,
+// backslash, null byte). SSRF hygiene — not a namespace allowlist.
+const UNSAFE_PATH_FRAGMENTS = ['..', '%2e', '%2E', '\\', '\0'];
+const REQUEST_TIMEOUT_MS = 120000;
 class WorkflowExecutorProxyRoute extends base_route_1.default {
     constructor(services, options) {
         super(services, options);
         this.type = types_1.RouteType.PrivateRoute;
-        // Remove trailing slash for clean URL joining
+        // Overridable so tests can exercise the timeout branch without waiting the full default.
+        this.requestTimeoutMs = REQUEST_TIMEOUT_MS;
         this.executorUrl = new URL(options.workflowExecutorUrl.replace(/\/+$/, ''));
     }
     setupRoutes(router) {
-        router.get('/_internal/workflow-executions/:runId', this.handleProxy.bind(this));
-        router.post('/_internal/workflow-executions/:runId/trigger', this.handleProxy.bind(this));
+        router.all(`${AGENT_PREFIX}/:path(.*)`, this.handleProxy.bind(this));
     }
     async handleProxy(context) {
-        const { runId } = context.params;
-        const isTrigger = context.method === 'POST';
-        const qs = context.querystring ? `?${context.querystring}` : '';
-        const executorRelativeUrl = isTrigger ? `/runs/${runId}/trigger${qs}` : `/runs/${runId}${qs}`;
-        const targetUrl = new URL(executorRelativeUrl, this.executorUrl);
-        const forwardedHeaders = {
-            authorization: context.request.header.authorization,
-            cookie: context.request.header.cookie,
-        };
-        const response = await this.forwardRequest(context.method, targetUrl, context.request.body, forwardedHeaders);
+        const targetUrl = this.buildTargetUrl(context);
+        const response = await this.forwardRequest({
+            method: context.method,
+            url: targetUrl,
+            // Raw body forwarded verbatim (set by @koa/bodyparser); undefined for GET.
+            body: context.method === 'GET' ? undefined : context.request.rawBody,
+            headers: this.forwardedHeaders(context),
+        });
         context.response.status = response.status;
+        // Forward every executor response header (minus hop-by-hop) so new executor headers never
+        // require an agent change — the agent stays a transparent proxy.
+        for (const [name, value] of Object.entries(response.headers)) {
+            if (value !== undefined && !SKIPPED_HEADERS.has(name.toLowerCase())) {
+                context.response.set(name, value);
+            }
+        }
         context.response.body = response.body;
     }
-    forwardRequest(method, url, body, forwardedHeaders = {}) {
+    buildTargetUrl(context) {
+        const path = this.executorPath(String(context.params.path ?? ''));
+        const qs = context.querystring ? `?${context.querystring}` : '';
+        const targetUrl = new URL(`${path}${qs}`, this.executorUrl);
+        // Authoritative SSRF check: URL parsing strips control chars the string guard can't see
+        // (e.g. a decoded `\t//host` collapses to `//host`), so confirm we never left the executor.
+        if (targetUrl.origin !== this.executorUrl.origin) {
+            throw new datasource_toolkit_1.NotFoundError('Invalid workflow executor path');
+        }
+        return targetUrl;
+    }
+    // First-pass rejection of escape attempts; the authoritative origin check is in buildTargetUrl.
+    executorPath(wildcard) {
+        const unsafe = wildcard === '' ||
+            wildcard.startsWith('/') ||
+            UNSAFE_PATH_FRAGMENTS.some(fragment => wildcard.includes(fragment));
+        if (unsafe)
+            throw new datasource_toolkit_1.NotFoundError('Invalid workflow executor path');
+        return `/${wildcard}`;
+    }
+    forwardedHeaders(context) {
+        const headers = {};
+        for (const [name, value] of Object.entries(context.request.headers)) {
+            if (value !== undefined && !SKIPPED_HEADERS.has(name.toLowerCase())) {
+                headers[name] = value;
+            }
+        }
+        return headers;
+    }
+    forwardRequest(request) {
+        const { method, url, body, headers } = request;
         const requestFn = url.protocol === 'https:' ? https_1.request : http_1.request;
-        const headers = { 'Content-Type': 'application/json' };
-        // Forward the caller's auth so the executor's JWT middleware can validate it.
-        // Agent and executor share the same FOREST_AUTH_SECRET so the token is valid on both.
-        if (forwardedHeaders.authorization)
-            headers.Authorization = forwardedHeaders.authorization;
-        if (forwardedHeaders.cookie)
-            headers.Cookie = forwardedHeaders.cookie;
         return new Promise((resolve, reject) => {
-            const req = requestFn(url, { method, headers }, res => {
+            const req = requestFn(url, { method, headers, timeout: this.requestTimeoutMs }, res => {
                 const chunks = [];
                 res.on('data', chunk => chunks.push(chunk));
                 res.on('end', () => {
@@ -54,17 +104,21 @@ class WorkflowExecutorProxyRoute extends base_route_1.default {
                     catch {
                         parsed = raw;
                     }
-                    resolve({ status: res.statusCode ?? types_1.HttpCode.InternalServerError, body: parsed });
+                    resolve({
+                        status: res.statusCode ?? types_1.HttpCode.InternalServerError,
+                        body: parsed,
+                        headers: res.headers,
+                    });
                 });
                 res.on('error', reject);
             });
             req.on('error', reject);
-            if (body && method !== 'GET') {
-                req.write(JSON.stringify(body));
-            }
+            req.on('timeout', () => req.destroy(new Error('Workflow executor request timed out')));
+            if (body !== undefined && method !== 'GET')
+                req.write(body);
             req.end();
         });
     }
 }
 exports.default = WorkflowExecutorProxyRoute;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoid29ya2Zsb3ctZXhlY3V0b3ItcHJveHkuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvcm91dGVzL3dvcmtmbG93L3dvcmtmbG93LWV4ZWN1dG9yLXByb3h5LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7O0FBS0EsK0JBQThDO0FBQzlDLGlDQUFnRDtBQUVoRCx1Q0FBa0Q7QUFDbEQsK0RBQXNDO0FBT3RDLE1BQXFCLDBCQUEyQixTQUFRLG9CQUFTO0lBSS9ELFlBQVksUUFBdUMsRUFBRSxPQUFpQztRQUNwRixLQUFLLENBQUMsUUFBUSxFQUFFLE9BQU8sQ0FBQyxDQUFDO1FBSmxCLFNBQUksR0FBRyxpQkFBUyxDQUFDLFlBQVksQ0FBQztRQUtyQyw4Q0FBOEM7UUFDOUMsSUFBSSxDQUFDLFdBQVcsR0FBRyxJQUFJLEdBQUcsQ0FBQyxPQUFPLENBQUMsbUJBQW1CLENBQUMsT0FBTyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDO0lBQzlFLENBQUM7SUFFRCxXQUFXLENBQUMsTUFBaUI7UUFDM0IsTUFBTSxDQUFDLEdBQUcsQ0FBQyx1Q0FBdUMsRUFBRSxJQUFJLENBQUMsV0FBVyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDO1FBQ2pGLE1BQU0sQ0FBQyxJQUFJLENBQUMsK0NBQStDLEVBQUUsSUFBSSxDQUFDLFdBQVcsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQztJQUM1RixDQUFDO0lBRU8sS0FBSyxDQUFDLFdBQVcsQ0FBQyxPQUFnQjtRQUN4QyxNQUFNLEVBQUUsS0FBSyxFQUFFLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQztRQUNqQyxNQUFNLFNBQVMsR0FBRyxPQUFPLENBQUMsTUFBTSxLQUFLLE1BQU0sQ0FBQztRQUM1QyxNQUFNLEVBQUUsR0FBRyxPQUFPLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQyxJQUFJLE9BQU8sQ0FBQyxXQUFXLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ2hFLE1BQU0sbUJBQW1CLEdBQUcsU0FBUyxDQUFDLENBQUMsQ0FBQyxTQUFTLEtBQUssV0FBVyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsU0FBUyxLQUFLLEdBQUcsRUFBRSxFQUFFLENBQUM7UUFDOUYsTUFBTSxTQUFTLEdBQUcsSUFBSSxHQUFHLENBQUMsbUJBQW1CLEVBQUUsSUFBSSxDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBRWpFLE1BQU0sZ0JBQWdCLEdBQXFCO1lBQ3pDLGFBQWEsRUFBRSxPQUFPLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxhQUFhO1lBQ25ELE1BQU0sRUFBRSxPQUFPLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxNQUFNO1NBQ3RDLENBQUM7UUFFRixNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxjQUFjLENBQ3hDLE9BQU8sQ0FBQyxNQUFNLEVBQ2QsU0FBUyxFQUNULE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUNwQixnQkFBZ0IsQ0FDakIsQ0FBQztRQUVGLE9BQU8sQ0FBQyxRQUFRLENBQUMsTUFBTSxHQUFHLFFBQVEsQ0FBQyxNQUFNLENBQUM7UUFDMUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxJQUFJLEdBQUcsUUFBUSxDQUFDLElBQUksQ0FBQztJQUN4QyxDQUFDO0lBRU8sY0FBYyxDQUNwQixNQUFjLEVBQ2QsR0FBUSxFQUNSLElBQWMsRUFDZCxtQkFBcUMsRUFBRTtRQUV2QyxNQUFNLFNBQVMsR0FBRyxHQUFHLENBQUMsUUFBUSxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsZUFBWSxDQUFDLENBQUMsQ0FBQyxjQUFXLENBQUM7UUFDekUsTUFBTSxPQUFPLEdBQTJCLEVBQUUsY0FBYyxFQUFFLGtCQUFrQixFQUFFLENBQUM7UUFFL0UsOEVBQThFO1FBQzlFLHNGQUFzRjtRQUN0RixJQUFJLGdCQUFnQixDQUFDLGFBQWE7WUFBRSxPQUFPLENBQUMsYUFBYSxHQUFHLGdCQUFnQixDQUFDLGFBQWEsQ0FBQztRQUMzRixJQUFJLGdCQUFnQixDQUFDLE1BQU07WUFBRSxPQUFPLENBQUMsTUFBTSxHQUFHLGdCQUFnQixDQUFDLE1BQU0sQ0FBQztRQUV0RSxPQUFPLElBQUksT0FBTyxDQUFDLENBQUMsT0FBTyxFQUFFLE1BQU0sRUFBRSxFQUFFO1lBQ3JDLE1BQU0sR0FBRyxHQUFHLFNBQVMsQ0FBQyxHQUFHLEVBQUUsRUFBRSxNQUFNLEVBQUUsT0FBTyxFQUFFLEVBQUUsR0FBRyxDQUFDLEVBQUU7Z0JBQ3BELE1BQU0sTUFBTSxHQUFpQixFQUFFLENBQUM7Z0JBQ2hDLEdBQUcsQ0FBQyxFQUFFLENBQUMsTUFBTSxFQUFFLEtBQUssQ0FBQyxFQUFFLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO2dCQUM1QyxHQUFHLENBQUMsRUFBRSxDQUFDLEtBQUssRUFBRSxHQUFHLEVBQUU7b0JBQ2pCLE1BQU0sR0FBRyxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxDQUFDO29CQUNwRCxJQUFJLE1BQWUsQ0FBQztvQkFFcEIsSUFBSSxDQUFDO3dCQUNILE1BQU0sR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDO29CQUMzQixDQUFDO29CQUFDLE1BQU0sQ0FBQzt3QkFDUCxNQUFNLEdBQUcsR0FBRyxDQUFDO29CQUNmLENBQUM7b0JBRUQsT0FBTyxDQUFDLEVBQUUsTUFBTSxFQUFFLEdBQUcsQ0FBQyxVQUFVLElBQUksZ0JBQVEsQ0FBQyxtQkFBbUIsRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLENBQUMsQ0FBQztnQkFDcEYsQ0FBQyxDQUFDLENBQUM7Z0JBQ0gsR0FBRyxDQUFDLEVBQUUsQ0FBQyxPQUFPLEVBQUUsTUFBTSxDQUFDLENBQUM7WUFDMUIsQ0FBQyxDQUFDLENBQUM7WUFFSCxHQUFHLENBQUMsRUFBRSxDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsQ0FBQztZQUV4QixJQUFJLElBQUksSUFBSSxNQUFNLEtBQUssS0FBSyxFQUFFLENBQUM7Z0JBQzdCLEdBQUcsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDO1lBQ2xDLENBQUM7WUFFRCxHQUFHLENBQUMsR0FBRyxFQUFFLENBQUM7UUFDWixDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7Q0FDRjtBQWhGRCw2Q0FnRkMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoid29ya2Zsb3ctZXhlY3V0b3ItcHJveHkuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvcm91dGVzL3dvcmtmbG93L3dvcmtmbG93LWV4ZWN1dG9yLXByb3h5LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7O0FBTUEsd0VBQWdFO0FBQ2hFLCtCQUE4QztBQUM5QyxpQ0FBZ0Q7QUFFaEQsdUNBQWtEO0FBQ2xELCtEQUFzQztBQUV0QywrRkFBK0Y7QUFDL0YsK0JBQStCO0FBQy9CLE1BQU0sWUFBWSxHQUFHLHFCQUFxQixDQUFDO0FBQzNDLCtGQUErRjtBQUMvRixrREFBa0Q7QUFDbEQsTUFBTSxlQUFlLEdBQUcsSUFBSSxHQUFHLENBQUM7SUFDOUIsWUFBWTtJQUNaLFlBQVk7SUFDWixtQkFBbUI7SUFDbkIsU0FBUztJQUNULElBQUk7SUFDSixTQUFTO0lBQ1Qsb0JBQW9CO0lBQ3BCLHFCQUFxQjtJQUNyQixNQUFNO0lBQ04sZ0JBQWdCO0NBQ2pCLENBQUMsQ0FBQztBQUNILDhGQUE4RjtBQUM5RixtRUFBbUU7QUFDbkUsTUFBTSxxQkFBcUIsR0FBRyxDQUFDLElBQUksRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxJQUFJLENBQUMsQ0FBQztBQUMvRCxNQUFNLGtCQUFrQixHQUFHLE1BQU8sQ0FBQztBQUVuQyxNQUFxQiwwQkFBMkIsU0FBUSxvQkFBUztJQU0vRCxZQUFZLFFBQXVDLEVBQUUsT0FBaUM7UUFDcEYsS0FBSyxDQUFDLFFBQVEsRUFBRSxPQUFPLENBQUMsQ0FBQztRQU5sQixTQUFJLEdBQUcsaUJBQVMsQ0FBQyxZQUFZLENBQUM7UUFFdkMseUZBQXlGO1FBQ3RFLHFCQUFnQixHQUFXLGtCQUFrQixDQUFDO1FBSS9ELElBQUksQ0FBQyxXQUFXLEdBQUcsSUFBSSxHQUFHLENBQUMsT0FBTyxDQUFDLG1CQUFtQixDQUFDLE9BQU8sQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQztJQUM5RSxDQUFDO0lBRUQsV0FBVyxDQUFDLE1BQWlCO1FBQzNCLE1BQU0sQ0FBQyxHQUFHLENBQUMsR0FBRyxZQUFZLFlBQVksRUFBRSxJQUFJLENBQUMsV0FBVyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDO0lBQ3ZFLENBQUM7SUFFTyxLQUFLLENBQUMsV0FBVyxDQUFDLE9BQWdCO1FBQ3hDLE1BQU0sU0FBUyxHQUFHLElBQUksQ0FBQyxjQUFjLENBQUMsT0FBTyxDQUFDLENBQUM7UUFFL0MsTUFBTSxRQUFRLEdBQUcsTUFBTSxJQUFJLENBQUMsY0FBYyxDQUFDO1lBQ3pDLE1BQU0sRUFBRSxPQUFPLENBQUMsTUFBTTtZQUN0QixHQUFHLEVBQUUsU0FBUztZQUNkLDJFQUEyRTtZQUMzRSxJQUFJLEVBQUUsT0FBTyxDQUFDLE1BQU0sS0FBSyxLQUFLLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxPQUFPO1lBQ3BFLE9BQU8sRUFBRSxJQUFJLENBQUMsZ0JBQWdCLENBQUMsT0FBTyxDQUFDO1NBQ3hDLENBQUMsQ0FBQztRQUVILE9BQU8sQ0FBQyxRQUFRLENBQUMsTUFBTSxHQUFHLFFBQVEsQ0FBQyxNQUFNLENBQUM7UUFFMUMsMEZBQTBGO1FBQzFGLGlFQUFpRTtRQUNqRSxLQUFLLE1BQU0sQ0FBQyxJQUFJLEVBQUUsS0FBSyxDQUFDLElBQUksTUFBTSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztZQUM3RCxJQUFJLEtBQUssS0FBSyxTQUFTLElBQUksQ0FBQyxlQUFlLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQyxFQUFFLENBQUM7Z0JBQ3BFLE9BQU8sQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLElBQUksRUFBRSxLQUFLLENBQUMsQ0FBQztZQUNwQyxDQUFDO1FBQ0gsQ0FBQztRQUVELE9BQU8sQ0FBQyxRQUFRLENBQUMsSUFBSSxHQUFHLFFBQVEsQ0FBQyxJQUFJLENBQUM7SUFDeEMsQ0FBQztJQUVPLGNBQWMsQ0FBQyxPQUFnQjtRQUNyQyxNQUFNLElBQUksR0FBRyxJQUFJLENBQUMsWUFBWSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLElBQUksSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBQ2xFLE1BQU0sRUFBRSxHQUFHLE9BQU8sQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDLElBQUksT0FBTyxDQUFDLFdBQVcsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDaEUsTUFBTSxTQUFTLEdBQUcsSUFBSSxHQUFHLENBQUMsR0FBRyxJQUFJLEdBQUcsRUFBRSxFQUFFLEVBQUUsSUFBSSxDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBRTVELHdGQUF3RjtRQUN4Riw0RkFBNEY7UUFDNUYsSUFBSSxTQUFTLENBQUMsTUFBTSxLQUFLLElBQUksQ0FBQyxXQUFXLENBQUMsTUFBTSxFQUFFLENBQUM7WUFDakQsTUFBTSxJQUFJLGtDQUFhLENBQUMsZ0NBQWdDLENBQUMsQ0FBQztRQUM1RCxDQUFDO1FBRUQsT0FBTyxTQUFTLENBQUM7SUFDbkIsQ0FBQztJQUVELGdHQUFnRztJQUN4RixZQUFZLENBQUMsUUFBZ0I7UUFDbkMsTUFBTSxNQUFNLEdBQ1YsUUFBUSxLQUFLLEVBQUU7WUFDZixRQUFRLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQztZQUN4QixxQkFBcUIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7UUFFdEUsSUFBSSxNQUFNO1lBQUUsTUFBTSxJQUFJLGtDQUFhLENBQUMsZ0NBQWdDLENBQUMsQ0FBQztRQUV0RSxPQUFPLElBQUksUUFBUSxFQUFFLENBQUM7SUFDeEIsQ0FBQztJQUVPLGdCQUFnQixDQUFDLE9BQWdCO1FBQ3ZDLE1BQU0sT0FBTyxHQUF3QixFQUFFLENBQUM7UUFFeEMsS0FBSyxNQUFNLENBQUMsSUFBSSxFQUFFLEtBQUssQ0FBQyxJQUFJLE1BQU0sQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1lBQ3BFLElBQUksS0FBSyxLQUFLLFNBQVMsSUFBSSxDQUFDLGVBQWUsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDLEVBQUUsQ0FBQztnQkFDcEUsT0FBTyxDQUFDLElBQUksQ0FBQyxHQUFHLEtBQUssQ0FBQztZQUN4QixDQUFDO1FBQ0gsQ0FBQztRQUVELE9BQU8sT0FBTyxDQUFDO0lBQ2pCLENBQUM7SUFFTyxjQUFjLENBQUMsT0FLdEI7UUFDQyxNQUFNLEVBQUUsTUFBTSxFQUFFLEdBQUcsRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFLEdBQUcsT0FBTyxDQUFDO1FBQy9DLE1BQU0sU0FBUyxHQUFHLEdBQUcsQ0FBQyxRQUFRLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxlQUFZLENBQUMsQ0FBQyxDQUFDLGNBQVcsQ0FBQztRQUV6RSxPQUFPLElBQUksT0FBTyxDQUFDLENBQUMsT0FBTyxFQUFFLE1BQU0sRUFBRSxFQUFFO1lBQ3JDLE1BQU0sR0FBRyxHQUFHLFNBQVMsQ0FBQyxHQUFHLEVBQUUsRUFBRSxNQUFNLEVBQUUsT0FBTyxFQUFFLE9BQU8sRUFBRSxJQUFJLENBQUMsZ0JBQWdCLEVBQUUsRUFBRSxHQUFHLENBQUMsRUFBRTtnQkFDcEYsTUFBTSxNQUFNLEdBQWlCLEVBQUUsQ0FBQztnQkFDaEMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxNQUFNLEVBQUUsS0FBSyxDQUFDLEVBQUUsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7Z0JBQzVDLEdBQUcsQ0FBQyxFQUFFLENBQUMsS0FBSyxFQUFFLEdBQUcsRUFBRTtvQkFDakIsTUFBTSxHQUFHLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUM7b0JBQ3BELElBQUksTUFBZSxDQUFDO29CQUVwQixJQUFJLENBQUM7d0JBQ0gsTUFBTSxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUM7b0JBQzNCLENBQUM7b0JBQUMsTUFBTSxDQUFDO3dCQUNQLE1BQU0sR0FBRyxHQUFHLENBQUM7b0JBQ2YsQ0FBQztvQkFFRCxPQUFPLENBQUM7d0JBQ04sTUFBTSxFQUFFLEdBQUcsQ0FBQyxVQUFVLElBQUksZ0JBQVEsQ0FBQyxtQkFBbUI7d0JBQ3RELElBQUksRUFBRSxNQUFNO3dCQUNaLE9BQU8sRUFBRSxHQUFHLENBQUMsT0FBTztxQkFDckIsQ0FBQyxDQUFDO2dCQUNMLENBQUMsQ0FBQyxDQUFDO2dCQUNILEdBQUcsQ0FBQyxFQUFFLENBQUMsT0FBTyxFQUFFLE1BQU0sQ0FBQyxDQUFDO1lBQzFCLENBQUMsQ0FBQyxDQUFDO1lBRUgsR0FBRyxDQUFDLEVBQUUsQ0FBQyxPQUFPLEVBQUUsTUFBTSxDQUFDLENBQUM7WUFDeEIsR0FBRyxDQUFDLEVBQUUsQ0FBQyxTQUFTLEVBQUUsR0FBRyxFQUFFLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEtBQUssQ0FBQyxxQ0FBcUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztZQUV2RixJQUFJLElBQUksS0FBSyxTQUFTLElBQUksTUFBTSxLQUFLLEtBQUs7Z0JBQUUsR0FBRyxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQztZQUU1RCxHQUFHLENBQUMsR0FBRyxFQUFFLENBQUM7UUFDWixDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7Q0FDRjtBQXJIRCw2Q0FxSEMifQ==

package/dist/types.d.ts

@@ -46,8 +46,8 @@ export type AgentOptions = {
     useUnsafeActionEndpoint?: boolean;
     /**
      * Base URL of the workflow executor to proxy requests to.
-     * When set, the agent exposes routes at `/_internal/workflow-executions/`
-     * that forward to the executor, benefiting from the agent's authentication layer.
+     * When set, the agent forwards `/_internal/executor/*` to the executor verbatim,
+     * benefiting from the agent's authentication layer.
      * @example 'http://localhost:4001'
      */
     workflowExecutorUrl?: string | null;

package/dist/utils/forest-schema/generator-collection.d.ts

@@ -3,10 +3,12 @@ import type { Collection } from '@forestadmin/datasource-toolkit';
 import type { ForestServerCollection } from '@forestadmin/forestadmin-client';
 export default class SchemaGeneratorCollection {
     private readonly schemaGeneratorActions;
+    private readonly useUnsafeActionEndpoint;
     constructor(options: AgentOptionsWithDefaults);
     /** Build forest-server schema for a collection */
     buildSchema(collection: Collection): Promise<ForestServerCollection>;
     private buildActions;
+    private static assertNoActionSlugCollision;
     private static buildFields;
     private static buildSegments;
 }

package/dist/utils/forest-schema/generator-collection.js

@@ -10,6 +10,7 @@ const generator_segments_1 = __importDefault(require("./generator-segments"));
 class SchemaGeneratorCollection {
     constructor(options) {
         this.schemaGeneratorActions = new generator_actions_1.default(options);
+        this.useUnsafeActionEndpoint = options.useUnsafeActionEndpoint;
     }
     /** Build forest-server schema for a collection */
     async buildSchema(collection) {
@@ -28,9 +29,23 @@ class SchemaGeneratorCollection {
         };
     }
     buildActions(collection) {
-        return Promise.all(Object.keys(collection.schema.actions)
-            .sort()
-            .map(name => this.schemaGeneratorActions.buildSchema(collection, name)));
+        const names = Object.keys(collection.schema.actions).sort();
+        if (this.useUnsafeActionEndpoint) {
+            SchemaGeneratorCollection.assertNoActionSlugCollision(collection.name, names);
+        }
+        return Promise.all(names.map(name => this.schemaGeneratorActions.buildSchema(collection, name)));
+    }
+    static assertNoActionSlugCollision(collectionName, names) {
+        const nameBySlug = new Map();
+        names.forEach(name => {
+            const slug = generator_actions_1.default.getActionSlug(name);
+            const existing = nameBySlug.get(slug);
+            if (existing) {
+                throw new Error(`Actions "${existing}" and "${name}" on collection "${collectionName}" resolve to the ` +
+                    `same endpoint slug "${slug}". Rename one of them or disable useUnsafeActionEndpoint.`);
+            }
+            nameBySlug.set(slug, name);
+        });
     }
     static buildFields(collection) {
         // Do not export foreign keys as those will be edited using the many to one relationship.
@@ -48,4 +63,4 @@ class SchemaGeneratorCollection {
     }
 }
 exports.default = SchemaGeneratorCollection;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZ2VuZXJhdG9yLWNvbGxlY3Rpb24uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvdXRpbHMvZm9yZXN0LXNjaGVtYS9nZW5lcmF0b3ItY29sbGVjdGlvbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7OztBQVNBLHdFQUE4RDtBQUU5RCw0RUFBeUQ7QUFDekQsMEVBQXVEO0FBQ3ZELDhFQUEyRDtBQUUzRCxNQUFxQix5QkFBeUI7SUFHNUMsWUFBWSxPQUFpQztRQUMzQyxJQUFJLENBQUMsc0JBQXNCLEdBQUcsSUFBSSwyQkFBc0IsQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUNwRSxDQUFDO0lBRUQsa0RBQWtEO0lBQ2xELEtBQUssQ0FBQyxXQUFXLENBQUMsVUFBc0I7UUFDdEMsT0FBTztZQUNMLE9BQU8sRUFBRSxNQUFNLElBQUksQ0FBQyxZQUFZLENBQUMsVUFBVSxDQUFDO1lBQzVDLE1BQU0sRUFBRSx5QkFBeUIsQ0FBQyxXQUFXLENBQUMsVUFBVSxDQUFDO1lBQ3pELElBQUksRUFBRSxJQUFJO1lBQ1YsV0FBVyxFQUFFLElBQUk7WUFDakIsVUFBVSxFQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxLQUFLLENBQ3ZELEtBQUssQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLFVBQVUsQ0FDckQ7WUFDRCxZQUFZLEVBQUUsVUFBVSxDQUFDLE1BQU0sQ0FBQyxVQUFVO1lBQzFDLFNBQVMsRUFBRSxLQUFLO1lBQ2hCLElBQUksRUFBRSxVQUFVLENBQUMsSUFBSTtZQUNyQixvQkFBb0IsRUFBRSxLQUFLO1lBQzNCLGNBQWMsRUFBRSxNQUFNO1lBQ3RCLFFBQVEsRUFBRSx5QkFBeUIsQ0FBQyxhQUFhLENBQUMsVUFBVSxDQUFDO1NBQzlELENBQUM7SUFDSixDQUFDO0lBRU8sWUFBWSxDQUFDLFVBQXNCO1FBQ3pDLE9BQU8sT0FBTyxDQUFDLEdBQUcsQ0FDaEIsTUFBTSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQzthQUNuQyxJQUFJLEVBQUU7YUFDTixHQUFHLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsc0JBQXNCLENBQUMsV0FBVyxDQUFDLFVBQVUsRUFBRSxJQUFJLENBQUMsQ0FBQyxDQUMxRSxDQUFDO0lBQ0osQ0FBQztJQUVPLE1BQU0sQ0FBQyxXQUFXLENBQUMsVUFBc0I7UUFDL0MseUZBQXlGO1FBQ3pGLDhGQUE4RjtRQUM5RixPQUFPLE1BQU0sQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUM7YUFDekMsTUFBTSxDQUNMLElBQUksQ0FBQyxFQUFFLENBQ0wsZ0NBQVcsQ0FBQyxZQUFZLENBQUMsVUFBVSxDQUFDLE1BQU0sRUFBRSxJQUFJLENBQUM7WUFDakQsQ0FBQyxnQ0FBVyxDQUFDLFlBQVksQ0FBQyxVQUFVLENBQUMsTUFBTSxFQUFFLElBQUksQ0FBQyxDQUNyRDthQUNBLElBQUksRUFBRTthQUNOLEdBQUcsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLDBCQUFxQixDQUFDLFdBQVcsQ0FBQyxVQUFVLEVBQUUsSUFBSSxDQUFDLENBQUMsQ0FBQztJQUN0RSxDQUFDO0lBRU8sTUFBTSxDQUFDLGFBQWEsQ0FBQyxVQUFzQjtRQUNqRCxPQUFPLFVBQVUsQ0FBQyxNQUFNLENBQUMsUUFBUTthQUM5QixJQUFJLEVBQUU7YUFDTixHQUFHLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyw0QkFBdUIsQ0FBQyxXQUFXLENBQUMsVUFBVSxFQUFFLElBQUksQ0FBQyxDQUFDLENBQUM7SUFDeEUsQ0FBQztDQUNGO0FBcERELDRDQW9EQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZ2VuZXJhdG9yLWNvbGxlY3Rpb24uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvdXRpbHMvZm9yZXN0LXNjaGVtYS9nZW5lcmF0b3ItY29sbGVjdGlvbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7OztBQVNBLHdFQUE4RDtBQUU5RCw0RUFBeUQ7QUFDekQsMEVBQXVEO0FBQ3ZELDhFQUEyRDtBQUUzRCxNQUFxQix5QkFBeUI7SUFJNUMsWUFBWSxPQUFpQztRQUMzQyxJQUFJLENBQUMsc0JBQXNCLEdBQUcsSUFBSSwyQkFBc0IsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUNsRSxJQUFJLENBQUMsdUJBQXVCLEdBQUcsT0FBTyxDQUFDLHVCQUF1QixDQUFDO0lBQ2pFLENBQUM7SUFFRCxrREFBa0Q7SUFDbEQsS0FBSyxDQUFDLFdBQVcsQ0FBQyxVQUFzQjtRQUN0QyxPQUFPO1lBQ0wsT0FBTyxFQUFFLE1BQU0sSUFBSSxDQUFDLFlBQVksQ0FBQyxVQUFVLENBQUM7WUFDNUMsTUFBTSxFQUFFLHlCQUF5QixDQUFDLFdBQVcsQ0FBQyxVQUFVLENBQUM7WUFDekQsSUFBSSxFQUFFLElBQUk7WUFDVixXQUFXLEVBQUUsSUFBSTtZQUNqQixVQUFVLEVBQUUsTUFBTSxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLEtBQUssQ0FDdkQsS0FBSyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsVUFBVSxDQUNyRDtZQUNELFlBQVksRUFBRSxVQUFVLENBQUMsTUFBTSxDQUFDLFVBQVU7WUFDMUMsU0FBUyxFQUFFLEtBQUs7WUFDaEIsSUFBSSxFQUFFLFVBQVUsQ0FBQyxJQUFJO1lBQ3JCLG9CQUFvQixFQUFFLEtBQUs7WUFDM0IsY0FBYyxFQUFFLE1BQU07WUFDdEIsUUFBUSxFQUFFLHlCQUF5QixDQUFDLGFBQWEsQ0FBQyxVQUFVLENBQUM7U0FDOUQsQ0FBQztJQUNKLENBQUM7SUFFTyxZQUFZLENBQUMsVUFBc0I7UUFDekMsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO1FBRTVELElBQUksSUFBSSxDQUFDLHVCQUF1QixFQUFFLENBQUM7WUFDakMseUJBQXlCLENBQUMsMkJBQTJCLENBQUMsVUFBVSxDQUFDLElBQUksRUFBRSxLQUFLLENBQUMsQ0FBQztRQUNoRixDQUFDO1FBRUQsT0FBTyxPQUFPLENBQUMsR0FBRyxDQUNoQixLQUFLLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLHNCQUFzQixDQUFDLFdBQVcsQ0FBQyxVQUFVLEVBQUUsSUFBSSxDQUFDLENBQUMsQ0FDN0UsQ0FBQztJQUNKLENBQUM7SUFFTyxNQUFNLENBQUMsMkJBQTJCLENBQUMsY0FBc0IsRUFBRSxLQUFlO1FBQ2hGLE1BQU0sVUFBVSxHQUFHLElBQUksR0FBRyxFQUFrQixDQUFDO1FBRTdDLEtBQUssQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLEVBQUU7WUFDbkIsTUFBTSxJQUFJLEdBQUcsMkJBQXNCLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxDQUFDO1lBQ3hELE1BQU0sUUFBUSxHQUFHLFVBQVUsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLENBQUM7WUFFdEMsSUFBSSxRQUFRLEVBQUUsQ0FBQztnQkFDYixNQUFNLElBQUksS0FBSyxDQUNiLFlBQVksUUFBUSxVQUFVLElBQUksb0JBQW9CLGNBQWMsbUJBQW1CO29CQUNyRix1QkFBdUIsSUFBSSwyREFBMkQsQ0FDekYsQ0FBQztZQUNKLENBQUM7WUFFRCxVQUFVLENBQUMsR0FBRyxDQUFDLElBQUksRUFBRSxJQUFJLENBQUMsQ0FBQztRQUM3QixDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFTyxNQUFNLENBQUMsV0FBVyxDQUFDLFVBQXNCO1FBQy9DLHlGQUF5RjtRQUN6Riw4RkFBOEY7UUFDOUYsT0FBTyxNQUFNLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDO2FBQ3pDLE1BQU0sQ0FDTCxJQUFJLENBQUMsRUFBRSxDQUNMLGdDQUFXLENBQUMsWUFBWSxDQUFDLFVBQVUsQ0FBQyxNQUFNLEVBQUUsSUFBSSxDQUFDO1lBQ2pELENBQUMsZ0NBQVcsQ0FBQyxZQUFZLENBQUMsVUFBVSxDQUFDLE1BQU0sRUFBRSxJQUFJLENBQUMsQ0FDckQ7YUFDQSxJQUFJLEVBQUU7YUFDTixHQUFHLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQywwQkFBcUIsQ0FBQyxXQUFXLENBQUMsVUFBVSxFQUFFLElBQUksQ0FBQyxDQUFDLENBQUM7SUFDdEUsQ0FBQztJQUVPLE1BQU0sQ0FBQyxhQUFhLENBQUMsVUFBc0I7UUFDakQsT0FBTyxVQUFVLENBQUMsTUFBTSxDQUFDLFFBQVE7YUFDOUIsSUFBSSxFQUFFO2FBQ04sR0FBRyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsNEJBQXVCLENBQUMsV0FBVyxDQUFDLFVBQVUsRUFBRSxJQUFJLENBQUMsQ0FBQyxDQUFDO0lBQ3hFLENBQUM7Q0FDRjtBQTVFRCw0Q0E0RUMifQ==

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forestadmin/agent",
-  "version": "1.79.5",
+  "version": "1.81.0",
   "main": "dist/index.js",
   "license": "GPL-3.0",
   "publishConfig": {