@opengeni/api-router 0.5.7 → 0.7.3

package/src/http/auth.ts

@@ -3,6 +3,7 @@ import type { Context, MiddlewareHandler } from "hono";
 import { installExactPaths, isInstallRedirectPath } from "../routes/install";
 
 const githubConnectPathPattern = /^\/v1\/workspaces\/[^/]+\/github\/connect$/;
+const githubInstallationLinkPathPattern = /^\/v1\/workspaces\/[^/]+\/github\/installations$/;
 
 export function requireAccessKey(settings: Settings): MiddlewareHandler {
   return async (c, next) => {
@@ -58,15 +59,22 @@ function isAuthExempt(c: Context, settings: Settings): boolean {
   if (path.startsWith("/v1/catalog-assets/")) {
     return true;
   }
-  // Browser entry for MCP-issued GitHub install links: opened in a browser
-  // that holds no API credentials, like the callbacks above. The route itself
-  // verifies the signed workspace-bound state before doing anything.
+  // Compatibility entry for already-issued GitHub install/link URLs. It stays
+  // public like the callbacks above, verifies signed workspace-bound state,
+  // and then terminates with 410 while new installation binding is disabled.
   if (githubConnectPathPattern.test(path)) {
     return true;
   }
+  // Compatibility endpoint for stale chooser submissions. It remains public
+  // only so already-rendered forms can authenticate their signed account and
+  // workspace state locally before terminating with 410; it does not parse a
+  // ticket, resolve browser authority, or write an installation binding.
+  if (c.req.method === "POST" && githubInstallationLinkPathPattern.test(path)) {
+    return true;
+  }
   // The get.<domain> install-serving routes (install.sh/.ps1/uninstall.sh/
   // minisign pub + the release-binary redirects). Reached by a fresh machine
-  // with no credentials; the bodies carry no secrets (dossier §23.1).
+  // with no credentials; the bodies carry no secrets.
   if (installExactPaths.has(path) || isInstallRedirectPath(path)) {
     return true;
   }