@lensmcp/cluster 1.18.4 → 1.18.6

package/executors/gateway/runtime/handler.js

@@ -1,183 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createHandler = createHandler;
-const manifest_1 = require("../manifest");
-const gateway_errors_1 = require("../gateway-errors");
-const discovery_1 = require("./discovery");
-const edge_1 = require("./edge");
-const observability_1 = require("./observability");
-const chooser_1 = require("./chooser");
-function createHandler(deps) {
-    const { rt, obs, auth, proxy, hooks } = deps;
-    const match = (req) => (0, manifest_1.matchRoute)(rt.routes, (req.headers.host || '').split(':')[0], req.url ?? '/');
-    // Host-root infra: when a host only has PATH-mounted services (pure
-    // microservices under api.<domain>/{prefix}), the gateway itself owns the
-    // root — CORS, health aggregation + service discovery, like a real edge.
-    const handleNoRoute = (req, res) => {
-        // gateway-owned endpoints are cross-origin by design (the app calls
-        // api.<domain>/health from app.<domain>) — answer CORS here; routed
-        // paths inherit CORS from the services themselves.
-        (0, edge_1.cors)(req, res);
-        if (req.method === 'OPTIONS') {
-            res.writeHead(204, {
-                'access-control-allow-methods': edge_1.PREFLIGHT_METHODS_NOROUTE,
-                'access-control-allow-headers': String(req.headers['access-control-request-headers'] ?? '*'),
-            });
-            res.end();
-            return;
-        }
-        const host = (req.headers.host || '').split(':')[0];
-        const mounted = rt.routes.filter((r) => r.host && (0, manifest_1.hostMatches)(r.host, host) && r.prefix);
-        const url = (req.url ?? '/').split('?')[0];
-        // The lens dashboard HOST ROOT → the multi-workspace chooser. The dashboard itself mounts at `/<key>`,
-        // so the bare `/` is unrouted and lands here; serve the landing page listing every known workspace.
-        if ((url === '/' || url === '/index.html' || url === '') &&
-            rt.routes.some((r) => r.host && (0, manifest_1.hostMatches)(r.host, host) && r.project === observability_1.LENS_DASHBOARD_PROJECT)) {
-            (0, chooser_1.serveChooser)(res, rt.wsKey);
-            return;
-        }
-        if (mounted.length > 0 && (url === '/health' || url === '/healthz')) {
-            const services = mounted.map((r) => ({
-                project: r.project,
-                prefix: r.prefix,
-                pods: r.pool ? ((0, discovery_1.pickSock)(r.pool, 0), r.pool.socks.length) : undefined,
-                state: r.svc?.state ?? (r.target ? 'up' : 'unknown'),
-            }));
-            const ok = services.every((s) => s.state !== 'down' || true);
-            res.writeHead(ok ? 200 : 503, { 'content-type': 'application/json' });
-            res.end(JSON.stringify({ status: 'ok', host, services }, null, 2));
-            return;
-        }
-        if (mounted.length > 0 && url === '/.well-known/services') {
-            res.writeHead(200, { 'content-type': 'application/json' });
-            res.end(JSON.stringify({ host, services: mounted.map((r) => ({ prefix: r.prefix, project: r.project, internal: !!r.internal })) }, null, 2));
-            return;
-        }
-        (0, edge_1.sendError)(res, req, 404, 'not_found', mounted.length > 0
-            ? `No service mounted at ${url}. Mounted on ${host}: ${[...new Set(mounted.map((r) => r.prefix))].join(', ')} (+ /health, /.well-known/services)`
-            : 'No gateway route for this hostname.');
-    };
-    const runPipeline = async (req, res) => {
-        // 0. HTTP/2 carries the host in the `:authority` pseudo-header, NOT `host` — the
-        // http2 compat layer exposes it as `req.authority` and omits `host` from `req.headers`.
-        // Every downstream step (route match, trace, CORS) reads `req.headers.host`, so
-        // normalize it here before anything else. No-op for HTTP/1.1 (host is already set).
-        if (!req.headers.host) {
-            const authority = req.authority ?? req.headers[':authority'];
-            if (authority)
-                req.headers.host = authority;
-        }
-        // 1. STRIP client-supplied trust headers before anything else: the gateway is
-        // the ONLY party allowed to assert `x-internal-token` (came through me) and
-        // `x-api-key-id` (validated caller identity). Without this, a keyless/TCP route
-        // would leak a spoofed token and any public route would forward a spoofed caller
-        // id to downstream audit. The gateway re-stamps them below where earned.
-        for (const h of edge_1.GATEWAY_OWNED_HEADERS)
-            delete req.headers[h];
-        // 2. Mint a trace id for EVERY request (not just lens-traced ones): forwarded to the
-        // pod (adopted as its traceId) and returned on the response — any request is traceable.
-        (0, gateway_errors_1.ensureRequestId)(req);
-        const trace = obs.beginTrace(req);
-        if (trace) {
-            obs.traceStep(trace, 'received', { host: trace.host, method: trace.method, url: trace.url });
-            req.__lensmcpTrace = trace;
-        }
-        const ctx = hooks.httpContext(req, res, trace);
-        try {
-            // 3. onRequest (sees already-stripped headers; may short-circuit)
-            if (hooks.has('onRequest')) {
-                await hooks.run('onRequest', ctx);
-                if (ctx.responded())
-                    return;
-            }
-            // 4. route match
-            const route = match(req);
-            if (!route) {
-                handleNoRoute(req, res);
-                return;
-            }
-            ctx.route = route;
-            obs.traceStep(trace, 'route-match', {
-                project: route.project,
-                ...(route.prefix ? { prefix: route.prefix } : {}),
-                ...(route.host ? { routeHost: route.host } : {}),
-                ...(route.internal ? { internal: true } : {}),
-            });
-            // 7. CORS preflight on a ROUTED path: answer it HERE, BEFORE edge auth — an OPTIONS preflight
-            // carries no token by spec, so the JWT (or x-api-key) enforcement below would 401 it and the
-            // browser's CORS check fails. The matching real request still goes through auth normally.
-            if (req.method === 'OPTIONS') {
-                (0, edge_1.cors)(req, res);
-                res.writeHead(204, {
-                    'access-control-allow-methods': edge_1.PREFLIGHT_METHODS_ROUTED,
-                    'access-control-allow-headers': String(req.headers['access-control-request-headers'] ?? '*'),
-                });
-                res.end();
-                return;
-            }
-            // 8. CORS on EVERY routed response — including the 401/403/5xx the gateway generates ITSELF
-            // below. Without this a gateway-generated error short-circuits before the upstream (which
-            // carries CORS on success), so the browser sees the error WITHOUT an Access-Control-Allow-Origin
-            // and reports a CORS failure that MASKS the real status. On success the upstream's CORS header
-            // overwrites this one (http-proxy setHeader), so there's no duplicate.
-            (0, edge_1.cors)(req, res);
-            // 9. beforeAuth
-            if (hooks.has('beforeAuth')) {
-                await hooks.run('beforeAuth', ctx);
-                if (ctx.responded())
-                    return;
-            }
-            // 10/11. auth + authz. internal.* validates the caller's api-key; public verifies the end-user
-            // JWT + enforces per-route rules. Custom middleware (afterAuth) runs AFTER core auth, public ONLY.
-            if (route.internal) {
-                const v = auth.internal(req, route, trace);
-                if (!v.ok) {
-                    obs.finishTrace(trace, route.project, v.status);
-                    (0, edge_1.sendError)(res, req, v.status, v.reason, v.detail);
-                    return;
-                }
-                ctx.caller = v.caller;
-            }
-            else {
-                const v = auth.public(req, route, trace);
-                if (!v.ok) {
-                    obs.finishTrace(trace, route.project, v.status);
-                    (0, edge_1.sendError)(res, req, v.status, v.reason, v.detail);
-                    return;
-                }
-                ctx.claims = v.claims;
-                if (hooks.has('afterAuth')) {
-                    await hooks.run('afterAuth', ctx);
-                    if (ctx.responded())
-                        return;
-                }
-            }
-            // 12. inject the target service's key so pods trust the gateway (pool routes, both branches)
-            if (route.pool && rt.serviceKeys[route.project]) {
-                req.headers['x-internal-token'] = rt.serviceKeys[route.project];
-            }
-            // 13. beforeForward (last chance to mutate headers/url)
-            if (hooks.has('beforeForward')) {
-                await hooks.run('beforeForward', ctx);
-                if (ctx.responded())
-                    return;
-            }
-            // 15. onResponse — fire user handlers once the response closes (the built-in
-            // recordEdge/finishTrace live in proxy.forward's own close handler).
-            if (hooks.has('onResponse')) {
-                res.on('close', () => { ctx.status = res.statusCode ?? 0; void hooks.run('onResponse', ctx); });
-            }
-            // 14. forward
-            void proxy.forward(route, req, res);
-        }
-        catch (e) {
-            // A hook (or the pipeline) threw — narrate via onError, then 500 if nobody responded.
-            ctx.error = e;
-            if (hooks.has('onError'))
-                await hooks.run('onError', ctx);
-            if (!ctx.responded())
-                (0, edge_1.sendError)(res, req, 500, 'internal', e.message);
-        }
-    };
-    return (req, res) => { void runPipeline(req, res); };
-}
+"use strict";var E=Object.defineProperty;var d=(l,i)=>E(l,"name",{value:i,configurable:!0});var v=Object.defineProperty,h=d((l,i)=>v(l,"name",{value:i,configurable:!0}),"h");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createHandler=createHandler;const manifest_1=require("../manifest"),gateway_errors_1=require("../gateway-errors"),discovery_1=require("./discovery"),edge_1=require("./edge"),observability_1=require("./observability"),chooser_1=require("./chooser");function createHandler(l){const{rt:i,obs:u,auth:p,proxy:f,hooks:a}=l,w=h(e=>(0,manifest_1.matchRoute)(i.routes,(e.headers.host||"").split(":")[0],e.url??"/"),"match"),m=h((e,o)=>{if((0,edge_1.cors)(e,o),e.method==="OPTIONS"){o.writeHead(204,{"access-control-allow-methods":edge_1.PREFLIGHT_METHODS_NOROUTE,"access-control-allow-headers":String(e.headers["access-control-request-headers"]??"*")}),o.end();return}const n=(e.headers.host||"").split(":")[0],s=i.routes.filter(r=>r.host&&(0,manifest_1.hostMatches)(r.host,n)&&r.prefix),t=(e.url??"/").split("?")[0];if((t==="/"||t==="/index.html"||t==="")&&i.routes.some(r=>r.host&&(0,manifest_1.hostMatches)(r.host,n)&&r.project===observability_1.LENS_DASHBOARD_PROJECT)){(0,chooser_1.serveChooser)(o,i.wsKey);return}if(s.length>0&&(t==="/health"||t==="/healthz")){const r=s.map(c=>({project:c.project,prefix:c.prefix,pods:c.pool?((0,discovery_1.pickSock)(c.pool,0),c.pool.socks.length):void 0,state:c.svc?.state??(c.target?"up":"unknown")})),_=r.every(c=>c.state!=="down"||!0);o.writeHead(_?200:503,{"content-type":"application/json"}),o.end(JSON.stringify({status:"ok",host:n,services:r},null,2));return}if(s.length>0&&t==="/.well-known/services"){o.writeHead(200,{"content-type":"application/json"}),o.end(JSON.stringify({host:n,services:s.map(r=>({prefix:r.prefix,project:r.project,internal:!!r.internal}))},null,2));return}(0,edge_1.sendError)(o,e,404,"not_found",s.length>0?`No service mounted at ${t}. Mounted on ${n}: ${[...new Set(s.map(r=>r.prefix))].join(", ")} (+ /health, /.well-known/services)`:"No gateway route for this hostname.")},"handleNoRoute"),y=h(async(e,o)=>{if(!e.headers.host){const t=e.authority??e.headers[":authority"];t&&(e.headers.host=t)}for(const t of edge_1.GATEWAY_OWNED_HEADERS)delete e.headers[t];(0,gateway_errors_1.ensureRequestId)(e);const n=u.beginTrace(e);n&&(u.traceStep(n,"received",{host:n.host,method:n.method,url:n.url}),e.__lensmcpTrace=n);const s=a.httpContext(e,o,n);try{if(a.has("onRequest")&&(await a.run("onRequest",s),s.responded()))return;const t=w(e);if(!t){m(e,o);return}if(s.route=t,u.traceStep(n,"route-match",{project:t.project,...t.prefix?{prefix:t.prefix}:{},...t.host?{routeHost:t.host}:{},...t.internal?{internal:!0}:{}}),e.method==="OPTIONS"){(0,edge_1.cors)(e,o),o.writeHead(204,{"access-control-allow-methods":edge_1.PREFLIGHT_METHODS_ROUTED,"access-control-allow-headers":String(e.headers["access-control-request-headers"]??"*")}),o.end();return}if((0,edge_1.cors)(e,o),a.has("beforeAuth")&&(await a.run("beforeAuth",s),s.responded()))return;if(t.internal){const r=p.internal(e,t,n);if(!r.ok){u.finishTrace(n,t.project,r.status),(0,edge_1.sendError)(o,e,r.status,r.reason,r.detail);return}s.caller=r.caller}else{const r=p.public(e,t,n);if(!r.ok){u.finishTrace(n,t.project,r.status),(0,edge_1.sendError)(o,e,r.status,r.reason,r.detail);return}if(s.claims=r.claims,a.has("afterAuth")&&(await a.run("afterAuth",s),s.responded()))return}if(t.pool&&i.serviceKeys[t.project]&&(e.headers["x-internal-token"]=i.serviceKeys[t.project]),a.has("beforeForward")&&(await a.run("beforeForward",s),s.responded()))return;a.has("onResponse")&&o.on("close",()=>{s.status=o.statusCode??0,a.run("onResponse",s)}),f.forward(t,e,o)}catch(t){s.error=t,a.has("onError")&&await a.run("onError",s),s.responded()||(0,edge_1.sendError)(o,e,500,"internal",t.message)}},"runPipeline");return(e,o)=>{y(e,o)}}d(createHandler,"createHandler"),h(createHandler,"createHandler");

package/executors/gateway/runtime/hooks.js

@@ -1,55 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createHooks = createHooks;
-const edge_1 = require("./edge");
-// Terminal phases observe a request whose response is ALREADY complete, so
-// `responded()` is true by definition — they must run every handler regardless.
-// The request-flow phases short-circuit the moment a handler responds.
-const TERMINAL_PHASES = new Set(['onResponse', 'onError']);
-function createHooks(hooks) {
-    const run = async (phase, ctx) => {
-        const list = hooks[phase];
-        if (!list || list.length === 0)
-            return;
-        const terminal = TERMINAL_PHASES.has(phase);
-        for (const h of list) {
-            if (!terminal && ctx.responded())
-                return; // a request-flow hook already responded → stop
-            await h(ctx);
-        }
-    };
-    const has = (phase) => (hooks[phase]?.length ?? 0) > 0;
-    const httpContext = (req, res, trace) => ({
-        req,
-        res,
-        socket: undefined,
-        trace,
-        route: undefined,
-        claims: undefined,
-        caller: undefined,
-        pod: undefined,
-        error: undefined,
-        status: undefined,
-        sendError: (status, reason, detail) => (0, edge_1.sendError)(res, req, status, reason, detail),
-        responded: () => res.writableEnded || res.headersSent,
-    });
-    const upgradeContext = (req, socket, trace) => ({
-        req,
-        res: undefined,
-        socket,
-        trace,
-        route: undefined,
-        claims: undefined,
-        caller: undefined,
-        pod: undefined,
-        error: undefined,
-        status: undefined,
-        // No HTTP response on an upgrade — short-circuiting means destroying the socket.
-        sendError: () => { try {
-            socket.destroy();
-        }
-        catch { /* already gone */ } },
-        responded: () => socket.destroyed,
-    });
-    return { run, has, httpContext, upgradeContext };
-}
+"use strict";var u=Object.defineProperty;var i=(t,e)=>u(t,"name",{value:e,configurable:!0});var a=Object.defineProperty,n=i((t,e)=>a(t,"name",{value:e,configurable:!0}),"n");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createHooks=createHooks;const edge_1=require("./edge"),TERMINAL_PHASES=new Set(["onResponse","onError"]);function createHooks(t){return{run:n(async(e,r)=>{const o=t[e];if(!o||o.length===0)return;const d=TERMINAL_PHASES.has(e);for(const s of o){if(!d&&r.responded())return;await s(r)}},"run"),has:n(e=>(t[e]?.length??0)>0,"has"),httpContext:n((e,r,o)=>({req:e,res:r,socket:void 0,trace:o,route:void 0,claims:void 0,caller:void 0,pod:void 0,error:void 0,status:void 0,sendError:n((d,s,c)=>(0,edge_1.sendError)(r,e,d,s,c),"sendError"),responded:n(()=>r.writableEnded||r.headersSent,"responded")}),"httpContext"),upgradeContext:n((e,r,o)=>({req:e,res:void 0,socket:r,trace:o,route:void 0,claims:void 0,caller:void 0,pod:void 0,error:void 0,status:void 0,sendError:n(()=>{try{r.destroy()}catch{}},"sendError"),responded:n(()=>r.destroyed,"responded")}),"upgradeContext")}}i(createHooks,"createHooks"),n(createHooks,"createHooks");