@platformatic/watt-extra 1.13.0-alpha.1 → 1.13.0-alpha.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@platformatic/watt-extra",
-  "version": "1.13.0-alpha.1",
+  "version": "1.13.0-alpha.2",
   "description": "The Platformatic runtime manager",
   "type": "module",
   "scripts": {

package/plugins/auth.js

@@ -48,7 +48,12 @@ async function resolveEcsIdentity (log) {
     if (!res.ok) throw new Error(`status ${res.status}`)
     const meta = await res.json()
     const id = meta.TaskARN?.split('/').pop()
-    const namespace = meta.Cluster
+    // meta.Cluster may be either the short name or the full cluster ARN
+    // (e.g. 'arn:aws:ecs:us-east-1:123456789012:cluster/my-cluster'). We
+    // strip down to the short name so callers can interpolate it into
+    // URL paths without producing extra path segments.
+    const cluster = meta.Cluster
+    const namespace = cluster?.includes('/') ? cluster.split('/').pop() : cluster
     if (!id || !namespace) throw new Error('TaskARN or Cluster missing in metadata')
     log.info({ id, namespace }, 'Resolved ECS task identity')
     return { id, namespace }

package/test/auth.test.js

@@ -214,3 +214,42 @@ test('auth plugin sends ECS identity headers when running on ECS', async (t) =>
   equal(responseBody.headers['x-ecs-cluster'], 'my-cluster')
   equal(responseBody.headers.authorization, undefined, 'No Authorization header on ECS')
 })
+
+test('auth plugin strips cluster ARN to short name in x-ecs-cluster header', async (t) => {
+  const originalEnv = { ...process.env }
+
+  t.after(() => {
+    process.env = originalEnv
+  })
+
+  // ECS task metadata sometimes returns the full cluster ARN in the Cluster
+  // field. ICC interpolates this value into URL paths, so the short name
+  // (which contains no slashes) is the only safe form to send.
+  const metadata = fastify()
+  metadata.get('/task', async () => ({
+    TaskARN: 'arn:aws:ecs:us-east-1:123456789012:task/my-cluster/abcdef0123',
+    Cluster: 'arn:aws:ecs:us-east-1:123456789012:cluster/my-cluster'
+  }))
+  await metadata.listen({ port: 0 })
+  const metadataUrl = `http://localhost:${metadata.server.address().port}`
+  t.after(() => metadata.close())
+
+  process.env.ECS_CONTAINER_METADATA_URI_V4 = metadataUrl
+
+  const server = fastify()
+  server.get('/', async (request) => {
+    return { headers: request.headers }
+  })
+  await server.listen({ port: 0 })
+  const url = `http://localhost:${server.server.address().port}`
+  t.after(() => server.close())
+
+  const app = createMockApp('ecs')
+  await authPlugin(app)
+
+  equal(app.machineIdentity?.namespace, 'my-cluster', 'Namespace should be stripped to cluster short name')
+
+  const response = await request(url, { dispatcher: app.dispatcher })
+  const responseBody = await response.body.json()
+  equal(responseBody.headers['x-ecs-cluster'], 'my-cluster')
+})