@gen3/workspaces 0.12.73 → 0.12.75

package/dist/server/esm/server.js

@@ -342,18 +342,48 @@ async function proxyServerExtension(req, res, targetUrl, getToken) {
     // Only point serverExtensionProxyBaseUrl at a network path a user's own request cannot
     // otherwise forge, or add real signature verification (e.g. against Fence's JWKS)
     // here before trusting these claims.
+    // --- auth header injection with diagnostic logging ---
+    const tokenSource = getToken ? 'getToken(injected)' : 'extractTokenFallback';
     const jwt = getToken ? getToken(req) : extractTokenFallback(req);
+    // Log incoming auth signals so we can diagnose missing REMOTE_USER / 502s.
+    const hasBearerHeader = typeof req.headers['authorization'] === 'string' && req.headers['authorization'].startsWith('Bearer ');
+    const cookieHeader = req.headers['cookie'] ?? '';
+    const hasAccessTokenCookie = /(?:^|;\s*)access_token=/.test(cookieHeader);
+    const cookieNames = cookieHeader.split(';').map((p)=>p.trim().split('=')[0]).filter(Boolean);
+    console.warn(`[workspace-assets] proxy auth-diag: tokenSource=${tokenSource} jwtFound=${!!jwt}` + ` hasBearerHeader=${hasBearerHeader} hasAccessTokenCookie=${hasAccessTokenCookie}` + ` cookieNames=[${cookieNames.join(',')}]`);
     if (jwt) {
         const claims = decodeJwtClaims(jwt);
-        const rawUsername = claims?.sub ?? claims?.preferred_username ?? claims?.username;
-        if (typeof rawUsername === 'string') {
-            const safeUsername = rawUsername.replace(/[\r\n]/g, '');
+        // Gen3 nginx extracts the username from context.user.name (not sub, which is
+        // a numeric ID). Check context.user.name first so REMOTE_USER matches what
+        // workspace-proxy expects for per-user container routing.
+        const contextUserName = claims?.context?.user?.name;
+        // String username (what Ambassador stores in k8s service names via Hatchery).
+        const rawUsername = (typeof contextUserName === 'string' ? contextUserName : undefined) ?? claims?.preferred_username ?? claims?.username;
+        // Numeric sub — used as UID in workspace-proxy's uid:<UID>,<username> format.
+        const rawSub = claims?.sub;
+        const safeSub = typeof rawSub === 'string' ? rawSub.replace(/[\r\n]/g, '') : undefined;
+        // workspace-proxy identity.go parses the composite "uid:<UID>,<username>" format:
+        //   normalizeUsername → extracts the username part (used for k8s service lookup)
+        //   parseUID          → extracts the UID part (used for UID-based fallback lookup)
+        // Ambassador normally injects this format; we must replicate it here since we
+        // bypass nginx when calling workspace-proxy server-side.
+        const safeUsername = typeof rawUsername === 'string' ? rawUsername.replace(/[\r\n]/g, '') : safeSub;
+        if (safeUsername !== undefined) {
             const safeJwt = jwt.replace(/[\r\n]/g, '');
+            const remoteUserValue = safeSub && safeUsername !== safeSub ? `uid:${safeSub},${safeUsername}` : safeUsername;
             forwardHeaders['Authorization'] = `Bearer ${safeJwt}`;
-            forwardHeaders['REMOTE_USER'] = safeUsername;
-            forwardHeaders['X-Gen3-User-ID'] = safeUsername;
+            forwardHeaders['REMOTE_USER'] = remoteUserValue;
+            forwardHeaders['remote_user'] = remoteUserValue;
+            forwardHeaders['X-Gen3-User-ID'] = remoteUserValue;
+            console.warn(`[workspace-assets] proxy auth-diag: injected REMOTE_USER="${remoteUserValue}"` + ` (contextUserName=${String(contextUserName)} sub=${String(rawSub)})` + ` claimsKeys=[${Object.keys(claims ?? {}).join(',')}]`);
+        } else {
+            console.warn(`[workspace-assets] proxy auth-diag: JWT decoded but no sub/preferred_username/username claim found` + ` claimsKeys=[${Object.keys(claims ?? {}).join(',')}]` + ` (REMOTE_USER NOT injected — workspace-proxy will likely reject)`);
         }
+    } else {
+        console.warn(`[workspace-assets] proxy auth-diag: no JWT found via ${tokenSource}` + ` — REMOTE_USER/X-Gen3-User-ID NOT injected — workspace-proxy will likely 502`);
     }
+    // Log the set of header keys being forwarded (no values — headers can contain tokens).
+    console.warn(`[workspace-assets] proxy forwarding headers: [${Object.keys(forwardHeaders).join(',')}]`);
     const method = (req.method || 'GET').toUpperCase();
     let body;
     if (![
@@ -382,7 +412,10 @@ async function proxyServerExtension(req, res, targetUrl, getToken) {
             hostname: parsed.hostname,
             port: parsed.port || (parsed.protocol === 'https:' ? 443 : 80),
             path: parsed.pathname + parsed.search,
-            headers: forwardHeaders
+            headers: forwardHeaders,
+            // 30-second socket timeout — without this, a stalled upstream holds the
+            // connection open indefinitely and the client sees no response.
+            timeout: 30_000
         };
         const proxyReq = transport.request(reqOptions, (proxyRes)=>{
             const statusCode = proxyRes.statusCode ?? 502;
@@ -398,6 +431,11 @@ async function proxyServerExtension(req, res, targetUrl, getToken) {
             }
             const log = statusCode >= 400 ? console.error : console.warn;
             log(`[workspace-assets] ${method} ${targetUrl} -> ${statusCode} (${Date.now() - startedAt}ms)`);
+            if (statusCode >= 400) {
+                // Log upstream response headers for non-2xx to surface auth/routing rejections.
+                const upstreamHeaders = Object.entries(proxyRes.headers).filter(([k])=>!k.toLowerCase().includes('cookie')).map(([k, v])=>`${k}:${Array.isArray(v) ? v.join(',') : v}`).join(' | ');
+                console.error(`[workspace-assets] upstream response headers: ${upstreamHeaders}`);
+            }
             proxyRes.pipe(res, {
                 end: true
             });