@kb-labs/gateway-app 2.98.0 → 2.100.0

package/dist/index.js

@@ -4,7 +4,7 @@ import { createServiceBootstrap, platform, getPlatformRoot, getProjectRoot, getA
 import { makeAssemblyHook } from '@kb-labs/plugin-runtime';
 import { createCorrelatedLogger, registerOpenAPI, createServiceReadyResponse, OperationMetricsTracker, createServiceObservabilityDescribe, createServiceObservabilityHealth } from '@kb-labs/shared-http';
 import { HostStore, globalDispatcher, AdaptiveBuffer } from '@kb-labs/gateway-core';
-import { UsersStore, CredentialsStore, MembershipsStore, SessionsStore, InvitesStore, loadIdentityProviders, createPasswordPolicy, createStubPDP, createTenantResolver, createUserAuthService, ensureBootstrapAdmin, createRateLimiter, OAuthStateStore, AuthService, verifyUserAccessToken, AuthError, getClientByHandle, issueCsrfToken, verifyCsrfToken, getClientByHostId } from '@kb-labs/gateway-auth';
+import { UsersStore, CredentialsStore, MembershipsStore, SessionsStore, InvitesStore, loadIdentityProviders, createPasswordPolicy, createStubPDP, createTenantResolver, createUserAuthService, ensureBootstrapAdmin, createRateLimiter, OAuthStateStore, AuthService, ensureBootstrapCliCredentials, verifyUserAccessToken, AuthError, getClientByHandle, issueCsrfToken, verifyCsrfToken, getClientByHostId } from '@kb-labs/gateway-auth';
 import { createRegistry, mergeOpenAPISpecs } from '@kb-labs/core-registry';
 import { loadEffectiveConfig } from '@kb-labs/core-config';
 import { GatewayConfigSchema, HostRegistrationSchema, RegisterRequestSchema, TokenRequestSchema, RefreshRequestSchema, ExecuteRequestSchema, ChatCompletionRequestSchema, TelemetryIngestRequestSchema, PlatformCallRequestSchema, HelloMessageSchema, SUPPORTED_PROTOCOL_VERSIONS, HostCapabilitySchema, AdapterCallMessageSchema, AdapterNameSchema, ClientHelloSchema, ClientCancelSchema, ClientUnsubscribeSchema, ClientSubscribeSchema, CLIENT_PROTOCOL_VERSION } from '@kb-labs/gateway-contracts';
@@ -68,6 +68,14 @@ var PUBLIC_ROUTES = /* @__PURE__ */ new Set([
   "/health",
   "/health/adapters",
   "/ready",
+  // Studio SPA shell (index.html) — the login page itself. There is no
+  // session yet when a browser first hits this, so it can't be gated.
+  // Exact match only (not a prefix) so it doesn't swallow unrelated routes.
+  "/",
+  // Module Federation manifest — static, non-sensitive metadata describing
+  // available Studio remotes. The Studio SPA shell must be able to fetch
+  // this before a user has logged in (there is no session yet to gate on).
+  "/mf-manifest.json",
   "/hosts/register",
   // /hosts/connect and /clients/connect are handled at the HTTP upgrade level
   // by gateway-ws.ts (raw ws) — they never reach Fastify routing.
@@ -99,6 +107,15 @@ function createAuthMiddleware(cache, jwtConfig, options = {}) {
     if (routePath.startsWith("/auth/oauth/")) {
       return;
     }
+    if (routePath.startsWith("/webhooks/")) {
+      return;
+    }
+    if (routePath.startsWith("/plugins/")) {
+      return;
+    }
+    if (routePath.startsWith("/studio/")) {
+      return;
+    }
     const queryToken = request.query["access_token"];
     const token = extractBearerToken(request.headers.authorization) ?? queryToken ?? null;
     if (!token && request.userAuthContext) {
@@ -3787,6 +3804,20 @@ async function createServer(config, cache, logger, jwtConfig, registry, serviceT
       statusCode: reply.statusCode
     });
   });
+  if (userAuth) {
+    app.addHook(
+      "onRequest",
+      createUserAuthMiddleware({
+        users: userAuth.users,
+        tenantResolver: userAuth.tenantResolver,
+        jwtConfig
+      })
+    );
+  }
+  app.addHook(
+    "onRequest",
+    createAuthMiddleware(cache, jwtConfig, { authEnabled: config.auth?.enabled !== false })
+  );
   const socketWsUpstreams = [];
   for (const [name, upstream] of Object.entries(config.upstreams)) {
     const conn = serviceTransport.connectionInfo(upstream.serviceId);
@@ -3822,20 +3853,6 @@ async function createServer(config, cache, logger, jwtConfig, registry, serviceT
     gatewayLogger.info(`Upstream registered: ${name} \u2192 ${connDesc} (${upstream.prefix}${wsDesc})`);
   }
   await app.register(async function gatewayRoutes(scope) {
-    if (userAuth) {
-      scope.addHook(
-        "onRequest",
-        createUserAuthMiddleware({
-          users: userAuth.users,
-          tenantResolver: userAuth.tenantResolver,
-          jwtConfig
-        })
-      );
-    }
-    scope.addHook(
-      "onRequest",
-      createAuthMiddleware(cache, jwtConfig, { authEnabled: config.auth?.enabled !== false })
-    );
     if (config.pressure?.perTenant?.enabled === true && platform.hasResourceBroker) {
       scope.addHook(
         "preHandler",
@@ -4300,6 +4317,19 @@ async function bootstrap(repoRoot = process.cwd()) {
     logger.warn("GATEWAY_JWT_SECRET not set \u2014 using insecure default (dev only, never use in production!)");
   }
   const jwtConfig = { secret: jwtSecret ?? DEV_JWT_SECRET };
+  if (config.auth?.bootstrap?.provisionCliCredentials === true) {
+    const bootstrapAuthService = new AuthService(cache, jwtConfig);
+    await ensureBootstrapCliCredentials({
+      enabled: true,
+      authService: bootstrapAuthService,
+      gatewayUrl: `http://127.0.0.1:${config.port}`,
+      logger
+    }).catch((err) => {
+      logger.warn("Bootstrap CLI credentials provisioning failed (non-fatal)", {
+        error: err instanceof Error ? err.message : String(err)
+      });
+    });
+  }
   if (platform.hasResourceBroker) {
     registerPressureLimits(platform.resourceBroker, config.pressure, platform.logger);
   } else {