@opengeni/api-router 0.5.0 → 0.5.2

package/dist/index.js

@@ -1,6 +1,6 @@
 import {
   createApp
-} from "./chunk-DQ5TIRDZ.js";
+} from "./chunk-YY6OAEL6.js";
 
 // src/index.ts
 import { dbSearchPath, getSettings, resolveNatsCalloutConfig, resolveNatsControlPlaneAuth, retryStartupDependency, startupRetryOptions } from "@opengeni/config";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/api-router",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "OpenGeni HTTP surface: the Hono adapter/router (createApp), routes, MCP HTTP transport, and HTTP access adapters over @opengeni/core. An engine-distribution surface — its runtime closure includes engine-internal packages.",
   "license": "Apache-2.0",
   "repository": {
@@ -47,16 +47,16 @@
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@opengeni/agent-proto": "^0.2.1",
     "@opengeni/codex": "^0.2.1",
-    "@opengeni/config": "^0.3.0",
+    "@opengeni/config": "^0.4.0",
     "@opengeni/contracts": "^0.9.0",
-    "@opengeni/core": "^0.4.3",
-    "@opengeni/db": "^0.6.0",
-    "@opengeni/documents": "^0.2.7",
-    "@opengeni/events": "^0.2.7",
-    "@opengeni/github": "^0.2.7",
+    "@opengeni/core": "^0.4.5",
+    "@opengeni/db": "^0.6.1",
+    "@opengeni/documents": "^0.2.8",
+    "@opengeni/events": "^0.2.8",
+    "@opengeni/github": "^0.2.8",
     "@opengeni/observability": "^0.2.1",
-    "@opengeni/runtime": "^0.4.0",
-    "@opengeni/storage": "^0.2.7",
+    "@opengeni/runtime": "^0.6.0",
+    "@opengeni/storage": "^0.2.8",
     "@temporalio/client": "^1.17.0",
     "better-auth": "^1.6.14",
     "hono": "^4.12.18",

package/src/app.ts

@@ -21,6 +21,7 @@ import { buildOpenGeniMcpServer } from "./mcp/server";
 import { isToolspaceGrant, prepareToolspaceMcpSurface } from "./mcp/toolspace";
 import { requireAccessKey } from "./http/auth";
 import { registerCapabilityRoutes } from "./routes/capabilities";
+import { registerCatalogAssetRoutes } from "./routes/catalog-assets";
 import { registerCodexRoutes } from "./routes/codex";
 import { registerConnectionRoutes } from "./routes/connections";
 import { registerDocumentRoutes } from "./routes/documents";
@@ -246,6 +247,7 @@ export function createApp(deps: AppDependencies): Hono {
   registerSocialRoutes(app, routeDeps);
   registerConnectionRoutes(app, routeDeps);
   registerCapabilityRoutes(app, routeDeps);
+  registerCatalogAssetRoutes(app, routeDeps);
   registerEnrollmentRoutes(app, routeDeps);
   registerMachineRoutes(app, routeDeps);
   registerEnvironmentRoutes(app, routeDeps);
@@ -426,6 +428,7 @@ const routeLabelPatterns: Array<{ pattern: RegExp; label: string }> = [
   { pattern: /^\/v1\/workspaces\/[^/]+\/connections$/, label: "/v1/workspaces/:workspaceId/connections" },
   { pattern: /^\/v1\/workspaces\/[^/]+\/connections\/oauth\/start$/, label: "/v1/workspaces/:workspaceId/connections/oauth/start" },
   { pattern: /^\/v1\/workspaces\/[^/]+\/connections\/[^/]+$/, label: "/v1/workspaces/:workspaceId/connections/:connectionId" },
+  { pattern: /^\/v1\/catalog-assets\/.+$/, label: "/v1/catalog-assets/*" },
   { pattern: /^\/v1\/integrations\/oauth\/callback$/, label: "/v1/integrations/oauth/callback" },
   { pattern: /^\/v1\/integrations\/oauth\/client-metadata\.json$/, label: "/v1/integrations/oauth/client-metadata.json" },
   { pattern: /^\/v1\/enrollments\/device\/start$/, label: "/v1/enrollments/device/start" },

package/src/http/auth.ts

@@ -52,6 +52,12 @@ function isAuthExempt(c: Context, settings: Settings): boolean {
   ) {
     return true;
   }
+  // Catalog logos are rendered via bare <img> tags, which carry no credentials;
+  // the images are public vendor logos, digest-keyed by content, and the route
+  // itself enforces the catalog-assets/ prefix lock and extension whitelist.
+  if (path.startsWith("/v1/catalog-assets/")) {
+    return true;
+  }
   // Browser entry for MCP-issued GitHub install links: opened in a browser
   // that holds no API credentials, like the callbacks above. The route itself
   // verifies the signed workspace-bound state before doing anything.

package/src/integrations/oauth-client.ts

@@ -22,6 +22,7 @@ import { createHash, randomBytes } from "node:crypto";
 import { lookup } from "node:dns/promises";
 import { isIP } from "node:net";
 import { HTTPException } from "hono/http-exception";
+import { canonicalProviderDomain } from "./provider-domain";
 
 export const oauthStateTtlMs = 10 * 60 * 1000;
 
@@ -244,7 +245,11 @@ export async function completeMcpOAuthCallback(
     if (!connection) {
       throw new HTTPException(409, { message: "connection changed during OAuth reconnect; start again" });
     }
-    return { redirectTo: callbackReturnPath(state.returnPath, "success", { connectionId: connection.id }) };
+    // Carry the canonical providerDomain (not just the id) so the SPA can build
+    // the enable connectionRef straight from the redirect, without a listConnections
+    // round-trip that could fail (transient, or a grant lacking connections:read)
+    // and leave the connection created but the capability un-enabled.
+    return { redirectTo: callbackReturnPath(state.returnPath, "success", { connectionId: connection.id, providerDomain: connection.providerDomain }) };
   } catch (error) {
     if (error instanceof HTTPException && error.status >= 400 && error.status < 500) {
       throw error;
@@ -718,10 +723,6 @@ function canonicalMcpResource(value: string | undefined): string {
   return url.toString();
 }
 
-function canonicalProviderDomain(value: string): string {
-  return value.trim().toLowerCase().replace(/^www\./, "");
-}
-
 function safeReturnPath(value: string): string {
   if (!value.startsWith("/") || value.startsWith("//")) {
     throw new HTTPException(400, { message: "OAuth returnPath must be a relative path" });

package/src/integrations/provider-domain.ts

@@ -0,0 +1,15 @@
+import { HTTPException } from "hono/http-exception";
+
+/**
+ * Canonical form of a connection's providerDomain: trimmed, lowercased, no
+ * leading "www.". Rejects a value that canonicalizes to empty (whitespace-only,
+ * or a bare "www.") — `min(1)` validation passes such input, but an empty stored
+ * domain silently breaks the enable-time connectionRef domain match.
+ */
+export function canonicalProviderDomain(value: string): string {
+  const canonical = value.trim().toLowerCase().replace(/^www\./, "");
+  if (!canonical) {
+    throw new HTTPException(400, { message: "providerDomain must not be empty" });
+  }
+  return canonical;
+}

package/src/routes/catalog-assets.ts

@@ -0,0 +1,105 @@
+import type { Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
+import type { ApiRouteDeps } from "@opengeni/core";
+
+const CATALOG_ASSET_PREFIX = "catalog-assets/";
+const MAX_KEY_LENGTH = 512;
+const PRINTABLE_ASCII = /^[\x20-\x7e]+$/;
+
+const CONTENT_TYPE_BY_EXTENSION: Record<string, string> = {
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  svg: "image/svg+xml",
+  webp: "image/webp",
+  gif: "image/gif",
+  ico: "image/x-icon",
+};
+
+export function registerCatalogAssetRoutes(app: Hono, deps: ApiRouteDeps): void {
+  const { settings, objectStorage } = deps;
+
+  app.get("/v1/catalog-assets/*", async (c) => {
+    if (!settings.integrationsEnabled) {
+      throw new HTTPException(404, { message: "integrations are not enabled for this deployment" });
+    }
+    if (!objectStorage) {
+      throw new HTTPException(404, { message: "asset not found" });
+    }
+    const key = catalogAssetKeyFromPath(new URL(c.req.url).pathname);
+    if (!key) {
+      throw new HTTPException(404, { message: "asset not found" });
+    }
+    const contentType = contentTypeForKey(key);
+    if (!contentType) {
+      throw new HTTPException(404, { message: "asset not found" });
+    }
+    const object = await objectStorage.getObjectBytes(key);
+    if (!object) {
+      throw new HTTPException(404, { message: "asset not found" });
+    }
+    const etag = etagForKey(key);
+    const headers = {
+      "Cache-Control": "public, max-age=31536000, immutable",
+      ETag: etag,
+      "X-Content-Type-Options": "nosniff",
+      "Content-Security-Policy": "default-src 'none'; style-src 'unsafe-inline'; sandbox",
+    };
+    if (ifNoneMatchSatisfied(c.req.header("if-none-match"), etag)) {
+      return c.body(null, 304, headers);
+    }
+    // Copy narrows the AWS/GCS/Azure SDKs' ArrayBufferLike-backed Uint8Array to the
+    // ArrayBuffer-backed one Hono's body() type expects.
+    return c.body(new Uint8Array(object.bytes), 200, { ...headers, "Content-Type": contentType });
+  });
+}
+
+/** Decoded, validated storage key from a `/v1/catalog-assets/...` request path, or null if malformed/unsafe. */
+export function catalogAssetKeyFromPath(pathname: string): string | null {
+  const prefix = "/v1/";
+  if (!pathname.startsWith(prefix)) {
+    return null;
+  }
+  let key: string;
+  try {
+    key = decodeURIComponent(pathname.slice(prefix.length));
+  } catch {
+    return null;
+  }
+  if (
+    key.length === 0 ||
+    key.length > MAX_KEY_LENGTH ||
+    !key.startsWith(CATALOG_ASSET_PREFIX) ||
+    key.includes("..") ||
+    key.includes("\\") ||
+    key.includes("//") ||
+    !PRINTABLE_ASCII.test(key)
+  ) {
+    return null;
+  }
+  return key;
+}
+
+function contentTypeForKey(key: string): string | null {
+  const match = /\.([a-zA-Z0-9]+)$/.exec(key);
+  const ext = match?.[1]?.toLowerCase();
+  return ext ? CONTENT_TYPE_BY_EXTENSION[ext] ?? null : null;
+}
+
+/** Digest-keyed filenames (`{domain}/{digest24}.{ext}`) make the basename itself a stable ETag. */
+function etagForKey(key: string): string {
+  const filename = key.slice(key.lastIndexOf("/") + 1);
+  const dot = filename.lastIndexOf(".");
+  const digest = dot === -1 ? filename : filename.slice(0, dot);
+  return `"${digest}"`;
+}
+
+function ifNoneMatchSatisfied(header: string | undefined, etag: string): boolean {
+  if (!header) {
+    return false;
+  }
+  if (header.trim() === "*") {
+    return true;
+  }
+  return header.split(",").map((value) => value.trim()).includes(etag);
+}

package/src/routes/connections.ts

@@ -24,6 +24,7 @@ import {
   integrationBaseUrl,
   startMcpOAuth,
 } from "../integrations/oauth-client";
+import { canonicalProviderDomain } from "../integrations/provider-domain";
 
 export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
   const { db, settings } = deps;
@@ -52,7 +53,7 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
       accountId: grant.accountId,
       workspaceId,
       subjectId,
-      providerDomain: payload.providerDomain,
+      providerDomain: canonicalProviderDomain(payload.providerDomain),
       kind: payload.kind,
       credentialEncrypted: encryptCredentialBundle(key, payload.credential),
       grantedScopes: payload.grantedScopes,
@@ -96,7 +97,7 @@ export function registerConnectionRoutes(app: Hono, deps: ApiRouteDeps): void {
       connectionId: c.req.param("connectionId"),
       visibleToSubjectId: grant.subjectId,
       updatedBySubjectId: grant.subjectId,
-      ...(payload.providerDomain !== undefined ? { providerDomain: payload.providerDomain } : {}),
+      ...(payload.providerDomain !== undefined ? { providerDomain: canonicalProviderDomain(payload.providerDomain) } : {}),
       ...(subjectId !== undefined ? { subjectId } : {}),
       ...(payload.kind !== undefined ? { kind: payload.kind } : {}),
       ...(payload.status !== undefined ? { status: payload.status } : {}),