@norskvideo/ctl-sdk 0.1.35 → 0.1.36

package/http-proxy.d.ts

@@ -25,6 +25,10 @@ export type ProxyHttpOptions = ForwardResponseOptions & {
     timeoutMs?: number;
 };
 /** Proxy one HTTP request to `targetUrl`, streaming the response body back.
+ *  Forwards the request's headers as they arrive: this runs INSIDE an instance
+ *  (a product backend fronting its own studio), where the ingress has already
+ *  blanked the client-supplied identity headers. The runner's product proxy,
+ *  which sits at the trust boundary, strips them itself in proxy-middleware.ts.
  *  Never throws into express: an unreachable/booting upstream surfaces as a
  *  502 the caller retries. */
 export declare function proxyHttp(req: Request, res: Response, targetUrl: string, opts?: ProxyHttpOptions): Promise<void>;

package/http-proxy.js

@@ -93,6 +93,10 @@ export async function forwardUpstreamResponse(res, upstream, opts = {}) {
 }
 const DEFAULT_PROXY_TIMEOUT_MS = 30_000;
 /** Proxy one HTTP request to `targetUrl`, streaming the response body back.
+ *  Forwards the request's headers as they arrive: this runs INSIDE an instance
+ *  (a product backend fronting its own studio), where the ingress has already
+ *  blanked the client-supplied identity headers. The runner's product proxy,
+ *  which sits at the trust boundary, strips them itself in proxy-middleware.ts.
  *  Never throws into express: an unreachable/booting upstream surfaces as a
  *  502 the caller retries. */
 export async function proxyHttp(req, res, targetUrl, opts = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-sdk",
-  "version": "0.1.35",
+  "version": "0.1.36",
   "type": "module",
   "exports": {
     ".": {

package/proxy-middleware.d.ts

@@ -3,5 +3,6 @@ import type { ProductRegistration } from "./product-types.js";
 interface ProductRegistry {
     list(): ProductRegistration[];
 }
+export declare function isOauth2SessionCookieName(name: string): boolean;
 export declare function createProductProxyMiddleware(svc: ProductRegistry): (req: Request, res: ExpressResponse, next: NextFunction) => Promise<void>;
 export {};

package/proxy-middleware.js

@@ -7,6 +7,41 @@ function targetBaseUrl(reg) {
     }
     return reg.spec.url.replace(/\/$/, "");
 }
+// The session cookie oauth2-proxy sets at the ctl/mgr ingress (see
+// packages/proxy/src/oauth2-config.ts), including the _0, _1... chunks it
+// splits an oversized session into.
+const OAUTH2_SESSION_COOKIE = /^__(Host|Secure)-[A-Za-z0-9_-]+_oauth2(_\d+)?$/;
+export function isOauth2SessionCookieName(name) {
+    return OAUTH2_SESSION_COOKIE.test(name);
+}
+// No product control plane calls back into ctl/mgr, so the ingress secret
+// (full admin), the caller's bearer token and the ingress session cookie
+// have no business reaching one. The whole `x-norsk-*` space goes, per RFC
+// 0003 Phase 0 item 4 — a header the ingress starts asserting later must not
+// reach a product merely because this code was not updated with its name.
+function buildProductForwardHeaders(req) {
+    const headers = buildForwardHeaders(req);
+    const norskHeaders = [];
+    headers.forEach((_value, name) => {
+        if (name.toLowerCase().startsWith("x-norsk-"))
+            norskHeaders.push(name);
+    });
+    for (const name of norskHeaders)
+        headers.delete(name);
+    headers.delete("authorization");
+    const cookie = headers.get("cookie");
+    if (cookie !== null) {
+        const kept = cookie
+            .split(";")
+            .map((c) => c.trim())
+            .filter((c) => c !== "" && !isOauth2SessionCookieName(c.split("=", 1)[0] ?? ""));
+        if (kept.length > 0)
+            headers.set("cookie", kept.join("; "));
+        else
+            headers.delete("cookie");
+    }
+    return headers;
+}
 export function createProductProxyMiddleware(svc) {
     return async (req, res, next) => {
         const name = req.params.name;
@@ -24,7 +59,7 @@ export function createProductProxyMiddleware(svc) {
             return;
         }
         const targetUrl = `${base}${req.url}`;
-        const headers = buildForwardHeaders(req);
+        const headers = buildProductForwardHeaders(req);
         const body = await readRequestBody(req);
         let upstream;
         try {