@segmentstream-cloud/app 0.16.1 → 0.16.3

package/dist/decision-pages.d.ts

@@ -7,6 +7,7 @@ import { type SegmentStreamProxy } from "./proxy.js";
 export declare function withUnframeablePages(proxy: SegmentStreamProxy): SegmentStreamProxy;
 /**
  * Whether a form post came from the app's own pages. A decision must never be made from another
- * site, which could otherwise approve an agent in the member's name.
+ * site, which could otherwise approve an agent in the member's name. Fetch Metadata describes
+ * the browser's public request even when a trusted proxy rewrites the server's request URL.
  */
 export declare function isSameOrigin(request: Request): boolean;

package/dist/decision-pages.js

@@ -1,3 +1,4 @@
+import { isLoopbackHostname } from "./cookies.js";
 import { AGENT_CONNECT_PAGE, CONSENT_PAGE } from "./pages.js";
 import { matchesPathPrefix } from "./proxy.js";
 /** Pages where a signed-in member lets an agent act for them. */
@@ -26,12 +27,48 @@ export function withUnframeablePages(proxy) {
 }
 /**
  * Whether a form post came from the app's own pages. A decision must never be made from another
- * site, which could otherwise approve an agent in the member's name.
+ * site, which could otherwise approve an agent in the member's name. Fetch Metadata describes
+ * the browser's public request even when a trusted proxy rewrites the server's request URL.
  */
 export function isSameOrigin(request) {
-    const origin = request.headers.get("origin");
-    if (origin !== null) {
-        return origin === new URL(request.url).origin;
+    const site = request.headers.get("sec-fetch-site");
+    if (site !== null) {
+        return site === "same-origin";
     }
-    return request.headers.get("sec-fetch-site") === "same-origin";
+    const supplied = request.headers.get("origin");
+    const origin = supplied === null ? undefined : httpOrigin(supplied);
+    if (origin === undefined) {
+        return false;
+    }
+    if (origin === new URL(request.url).origin) {
+        return true;
+    }
+    const host = (request.headers.get("x-forwarded-host") ?? request.headers.get("host"))
+        ?.split(",")[0]
+        ?.trim();
+    if (!host) {
+        return false;
+    }
+    const forwardedProto = request.headers.get("x-forwarded-proto")?.split(",")[0]?.trim();
+    const protocol = forwardedProto === "http" || forwardedProto === "https"
+        ? forwardedProto
+        : isLoopbackHostname(host.replace(/:\d+$/, ""))
+            ? "http"
+            : "https";
+    return origin === httpOrigin(`${protocol}://${host}`);
+}
+/** An Origin names only an HTTP(S) authority, never credentials, a path or query. */
+function httpOrigin(value) {
+    if (!URL.canParse(value)) {
+        return undefined;
+    }
+    const url = new URL(value);
+    return (url.protocol === "http:" || url.protocol === "https:") &&
+        url.username === "" &&
+        url.password === "" &&
+        url.pathname === "/" &&
+        url.search === "" &&
+        url.hash === ""
+        ? url.origin
+        : undefined;
 }

package/dist/handlers.js

@@ -1,5 +1,6 @@
 import { NextResponse } from "next/server";
 import { authFlowCookieName, clearCookie, clearSessionCookies, cookiePolicyFor, decodeAuthFlowState, pendingAuthFlowCookies, safeReturnTo, setSessionCookies, } from "./cookies.js";
+import { isSameOrigin } from "./decision-pages.js";
 import { constantTimeEqual } from "./pkce.js";
 import { CALLBACK_PATH, SIGNED_OUT_PATH, SIGN_IN_PATH, SDK_ROUTE_PREFIX, signInRedirect, } from "./sign-in.js";
 export function createHandlers(context) {
@@ -92,8 +93,7 @@ function returnToApp(request, policy, flowCookie, returnTo) {
     return response;
 }
 async function handleSignOut(context, request) {
-    const origin = request.headers.get("origin");
-    if (origin !== null && origin !== request.nextUrl.origin) {
+    if (!isSameOrigin(request)) {
         return htmlResponse(403, "Sign-out refused", "Sign out from this app's own pages.", "Return to the app");
     }
     const policy = cookiePolicyFor(request.nextUrl, context.config.workspaceId);

package/dist/neon.js

@@ -8,19 +8,14 @@ import { NOT_INVITED, SIGN_IN_LINK_INVALID, SegmentStreamApiError, apiErrorFrom,
 import { parseMe } from "./me.js";
 import { createOntologyTransport } from "./ontology-transport.js";
 import { isAllowed } from "./permissions.js";
-import { matchesPathPrefix, normalizePublicPath } from "./proxy.js";
+import { matchesPathPrefix, normalizePublicPath, wellKnownResponse } from "./proxy.js";
 import { isApiRequest, unauthenticatedResponse } from "./sign-in.js";
 /** The app's sign-in page, which renders `<SignIn />` from `@segmentstream-cloud/app/ui`. */
 export const SIGN_IN_PAGE = "/sign-in";
 /** Where `app/src/app/api/auth/[...path]/route.ts` serves the Neon Auth API. */
 export const AUTH_API_PATH = "/api/auth";
-/** The paths the ontology service answers: its HTTP API, its MCP server and its OAuth metadata. */
-const ONTOLOGY_PATHS = [
-    "/api/ontology",
-    "/mcp",
-    "/.well-known/oauth-protected-resource",
-    "/.well-known/oauth-authorization-server",
-];
+/** The ontology's HTTP API and MCP transport; metadata probes are handled separately. */
+const ONTOLOGY_PATHS = ["/api/ontology", "/mcp"];
 /**
  * Paths every visitor may open: the Neon Auth API, the sign-in page, the health check, and the
  * Next.js assets and metadata files the sign-in page needs.
@@ -310,6 +305,10 @@ export function createNeonSession(dependencies) {
         const publicPaths = [...OPEN_PATHS, ...(options.publicPaths ?? [])].map(normalizePublicPath);
         return async function neonProxy(request) {
             const { pathname, search } = request.nextUrl;
+            const discovery = wellKnownResponse(request, settings.ontologyUrl);
+            if (discovery !== undefined) {
+                return discovery;
+            }
             if (settings.ontologyUrl !== undefined &&
                 ONTOLOGY_PATHS.some((path) => matchesPathPrefix(pathname, path))) {
                 // Local development: the service runs elsewhere; deployed, its paths never reach the app.

package/dist/proxy.d.ts

@@ -11,5 +11,7 @@ export interface ProxyOptions {
 }
 export type SegmentStreamProxy = (request: NextRequest) => Promise<NextResponse>;
 export declare function createProxy(context: AppContext, options?: ProxyOptions): SegmentStreamProxy;
+/** Discovery probes never start browser authentication, including probes for unsupported metadata. */
+export declare function wellKnownResponse(request: NextRequest, ontologyUrl?: string): NextResponse | undefined;
 export declare function normalizePublicPath(path: string): string;
 export declare function matchesPathPrefix(pathname: string, prefix: string): boolean;

package/dist/proxy.js

@@ -22,6 +22,10 @@ export function createProxy(context, options = {}) {
     }
     return async function proxy(request) {
         const pathname = request.nextUrl.pathname;
+        const discovery = wellKnownResponse(request);
+        if (discovery !== undefined) {
+            return discovery;
+        }
         if (matchesPathPrefix(pathname, SDK_ROUTE_PREFIX) ||
             publicPaths.some((path) => matchesPathPrefix(pathname, path))) {
             return NextResponse.next();
@@ -58,6 +62,26 @@ export function createProxy(context, options = {}) {
         return startSignIn(context, request, policy, true);
     };
 }
+const ONTOLOGY_METADATA_PATHS = new Set([
+    "/.well-known/oauth-protected-resource",
+    "/.well-known/oauth-protected-resource/mcp",
+    "/.well-known/oauth-authorization-server",
+]);
+/** Discovery probes never start browser authentication, including probes for unsupported metadata. */
+export function wellKnownResponse(request, ontologyUrl) {
+    const { pathname, search } = request.nextUrl;
+    if (!matchesPathPrefix(pathname, "/.well-known")) {
+        return undefined;
+    }
+    if (ONTOLOGY_METADATA_PATHS.has(pathname)) {
+        return ontologyUrl === undefined
+            ? NextResponse.next()
+            : NextResponse.rewrite(new URL(`${pathname}${search}`, ontologyUrl));
+    }
+    // The issuer is the root origin, so RFC 8414 does not define an AS document suffixed by /mcp.
+    // This service also does not publish OpenID Connect discovery metadata.
+    return NextResponse.json({ error: "not_found" }, { status: 404 });
+}
 /**
  * SegmentStream is unreachable. API requests get a retryable 503; pages restart sign-in,
  * which ends on the callback's error page rather than looping. Session cookies are kept.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@segmentstream-cloud/app",
-  "version": "0.16.1",
+  "version": "0.16.3",
   "description": "Sign-in, users, permissions, the ontology client and warehouse data access for SegmentStream workspace apps built with Next.js.",
   "license": "Apache-2.0",
   "author": "SegmentStream",