Add dynamic AI Workspace run profiles
This commit is contained in:
Codex
@@ -326,6 +326,8 @@ app.post("/api/ai-workspace/assistant/v1/threads/:threadId/dispatch", requireInt
|
||||
accessMode: "ops-write",
|
||||
};
|
||||
}
|
||||
const runProfile = await buildRunProfile({ owner, thread, executor, ownerSettings, bridgePayload });
|
||||
bridgePayload.runProfile = runProfile;
|
||||
let bridge = null;
|
||||
try {
|
||||
bridge = await dispatchExecutorMessage(executor, bridgePayload);
|
||||
@@ -379,6 +381,7 @@ app.post("/api/ai-workspace/assistant/v1/threads/:threadId/dispatch", requireInt
|
||||
executor,
|
||||
message,
|
||||
assistantMessage: null,
|
||||
runProfile: redactRunProfile(runProfile),
|
||||
bridge,
|
||||
});
|
||||
}));
|
||||
@@ -1018,6 +1021,7 @@ async function createBridgeRun({ owner, thread, executor, bridge, payload }) {
|
||||
const requestId = optionalString(bridge?.requestId);
|
||||
if (!requestId || bridge?.accepted !== true || bridge?.mode !== "hub") return null;
|
||||
const context = isPlainObject(payload?.context) ? payload.context : {};
|
||||
const runProfile = isPlainObject(payload?.runProfile) ? payload.runProfile : null;
|
||||
const metadata = {
|
||||
modeId: optionalString(context.modeId),
|
||||
modeTitle: optionalString(context.modeTitle),
|
||||
@@ -1025,6 +1029,7 @@ async function createBridgeRun({ owner, thread, executor, bridge, payload }) {
|
||||
threadTitle: optionalString(payload?.threadTitle) || thread.title,
|
||||
executorName: executor.name,
|
||||
executorType: executor.type,
|
||||
runProfile: runProfile ? redactRunProfile(runProfile) : null,
|
||||
};
|
||||
const result = await pool.query(
|
||||
`insert into ai_workspace_runs (
|
||||
@@ -1426,6 +1431,367 @@ function buildBridgeMessagePayload({ thread, message, history, executor, command
|
||||
};
|
||||
}
|
||||
|
||||
async function buildRunProfile({ owner, thread, executor, ownerSettings, bridgePayload }) {
|
||||
const context = isPlainObject(bridgePayload?.context) ? bridgePayload.context : {};
|
||||
const sourceSurface = optionalString(context.sourceSurface)
|
||||
|| optionalString(context.surface)
|
||||
|| thread.originSurface
|
||||
|| "global";
|
||||
const targetContexts = isPlainObject(context.contexts) ? context.contexts : {};
|
||||
const enabledToolPacks = mergeToolPacks(
|
||||
ownerSettings?.enabledToolPacks,
|
||||
thread.enabledToolPacks,
|
||||
bridgePayload?.enabledToolPacks
|
||||
);
|
||||
const grantResolution = await resolveRunAppGrants({ owner, context, ownerSettings });
|
||||
const appGrants = summarizeRunAppGrants({ appGrants: grantResolution.appGrants });
|
||||
const mcpServers = runProfileMcpServersFromAppGrants(ownerSettings, grantResolution.appGrants);
|
||||
const mcpServerNames = mcpServers.map((server) => server.serverName).filter(Boolean);
|
||||
const requiredMcpServerNames = mcpServers
|
||||
.filter((server) => server.required === true)
|
||||
.map((server) => server.serverName)
|
||||
.filter(Boolean);
|
||||
const diagnostics = {
|
||||
schemaVersion: "ai-workspace.run-profile.diagnostics.v1",
|
||||
dynamicProfile: true,
|
||||
contextReady: context.contextReady !== false,
|
||||
accessMode: optionalString(context.accessMode) || "chat",
|
||||
sourceSurface,
|
||||
modeId: optionalString(context.modeId) || "ops",
|
||||
targetSurfaces: Object.keys(targetContexts).map(normalizeKey).filter(Boolean).sort(),
|
||||
enabledToolPacks,
|
||||
appGrantIds: Object.keys(appGrants).sort(),
|
||||
entitlementAdapters: grantResolution.diagnostics,
|
||||
mcpServerNames,
|
||||
requiredMcpServerNames,
|
||||
missingContext: Array.isArray(context.missingContext)
|
||||
? context.missingContext.map(optionalString).filter(Boolean)
|
||||
: [],
|
||||
};
|
||||
const runProfile = {
|
||||
schemaVersion: "ai-workspace.run-profile.v1",
|
||||
runId: randomUUID(),
|
||||
createdAt: new Date().toISOString(),
|
||||
owner: publicOwner(owner),
|
||||
executor: {
|
||||
id: executor.id,
|
||||
type: executor.type,
|
||||
connectionMode: executor.connectionMode,
|
||||
},
|
||||
sourceSurface,
|
||||
modeId: optionalString(context.modeId) || "ops",
|
||||
modeTitle: optionalString(context.modeTitle) || "",
|
||||
targetContexts: redactForPublicDiagnostics(targetContexts),
|
||||
enabledToolPacks,
|
||||
appGrants,
|
||||
toolProfile: {
|
||||
schemaVersion: "ai-workspace.tool-profile.v1",
|
||||
enabledToolPacks,
|
||||
mcpServers,
|
||||
mcpServerNames,
|
||||
requiredMcpServerNames,
|
||||
},
|
||||
policyPrompt: buildRunProfilePolicyPrompt({ context, diagnostics }),
|
||||
diagnostics,
|
||||
};
|
||||
runProfile.diagnostics.profileHash = runProfileHash(runProfile);
|
||||
return runProfile;
|
||||
}
|
||||
|
||||
async function resolveRunAppGrants({ owner, context, ownerSettings }) {
|
||||
const metadata = isPlainObject(ownerSettings?.metadata) ? ownerSettings.metadata : {};
|
||||
const staticAppGrants = isPlainObject(metadata.appGrants) ? metadata.appGrants : {};
|
||||
const appGrants = { ...staticAppGrants };
|
||||
const adapterDiagnostics = [];
|
||||
const adapters = Array.isArray(config.entitlementAdapters) ? config.entitlementAdapters : [];
|
||||
if (!adapters.length) {
|
||||
return {
|
||||
appGrants,
|
||||
diagnostics: {
|
||||
source: "settings",
|
||||
adapters: [],
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
for (const adapter of adapters) {
|
||||
const result = await fetchRunEntitlementAdapter({ adapter, owner, context, ownerSettings }).catch((error) => ({
|
||||
ok: false,
|
||||
error: errorMessage(error),
|
||||
}));
|
||||
if (!result.ok) {
|
||||
adapterDiagnostics.push({
|
||||
appId: adapter.appId,
|
||||
status: "error",
|
||||
required: adapter.required === true,
|
||||
error: sanitizeBridgeErrorText(result.error || "entitlement_adapter_failed"),
|
||||
});
|
||||
if (adapter.required === true) {
|
||||
const error = new Error(`entitlement_adapter_failed:${adapter.appId}`);
|
||||
error.status = 502;
|
||||
throw error;
|
||||
}
|
||||
continue;
|
||||
}
|
||||
const adapterAppGrants = normalizeEntitlementAdapterAppGrants(result.payload, adapter);
|
||||
for (const [appId, grant] of Object.entries(adapterAppGrants)) {
|
||||
if (!isPlainObject(grant)) continue;
|
||||
const existing = isPlainObject(appGrants[appId]) ? appGrants[appId] : {};
|
||||
appGrants[appId] = {
|
||||
...existing,
|
||||
...grant,
|
||||
appId,
|
||||
mcpServers: Object.hasOwn(grant, "mcpServers") ? grant.mcpServers : existing.mcpServers,
|
||||
};
|
||||
}
|
||||
adapterDiagnostics.push({
|
||||
appId: adapter.appId,
|
||||
status: "ok",
|
||||
required: adapter.required === true,
|
||||
grantIds: Object.keys(adapterAppGrants).sort(),
|
||||
mcpServerNames: Object.values(adapterAppGrants)
|
||||
.flatMap((grant) => {
|
||||
const servers = Array.isArray(grant?.mcpServers)
|
||||
? grant.mcpServers
|
||||
: isPlainObject(grant?.mcpServers)
|
||||
? Object.values(grant.mcpServers)
|
||||
: [];
|
||||
return servers.map((server) => safeMcpServerName(server?.serverName || server?.server_name || server?.name));
|
||||
})
|
||||
.filter(Boolean),
|
||||
});
|
||||
}
|
||||
|
||||
return {
|
||||
appGrants,
|
||||
diagnostics: {
|
||||
source: adapterDiagnostics.some((item) => item.status === "ok") ? "adapters+settings" : "settings",
|
||||
adapters: adapterDiagnostics,
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
async function fetchRunEntitlementAdapter({ adapter, owner, context, ownerSettings }) {
|
||||
const controller = new AbortController();
|
||||
const timeout = setTimeout(() => controller.abort(), adapter.timeoutMs);
|
||||
const body = JSON.stringify({
|
||||
schemaVersion: "ai-workspace.entitlement-request.v1",
|
||||
appId: adapter.appId,
|
||||
owner: publicOwner(owner),
|
||||
activeContext: redactForPublicDiagnostics(isPlainObject(ownerSettings?.activeContext) ? ownerSettings.activeContext : {}),
|
||||
runContext: redactForPublicDiagnostics(context),
|
||||
requestedAt: new Date().toISOString(),
|
||||
});
|
||||
try {
|
||||
const response = await fetch(adapter.url, {
|
||||
method: "POST",
|
||||
headers: {
|
||||
Accept: "application/json",
|
||||
"Content-Type": "application/json",
|
||||
...(adapter.authorization ? { Authorization: adapter.authorization } : {}),
|
||||
...adapter.headers,
|
||||
},
|
||||
body,
|
||||
signal: controller.signal,
|
||||
});
|
||||
const text = await response.text();
|
||||
let payload = {};
|
||||
try {
|
||||
payload = text ? JSON.parse(text) : {};
|
||||
} catch {
|
||||
payload = { ok: false, error: "invalid_json_response" };
|
||||
}
|
||||
if (!response.ok || payload?.ok === false) {
|
||||
throw new Error(optionalString(payload?.error || payload?.message) || `http_${response.status}`);
|
||||
}
|
||||
return { ok: true, payload };
|
||||
} catch (error) {
|
||||
if (error?.name === "AbortError") throw new Error("entitlement_adapter_timeout");
|
||||
throw error;
|
||||
} finally {
|
||||
clearTimeout(timeout);
|
||||
}
|
||||
}
|
||||
|
||||
function normalizeEntitlementAdapterAppGrants(payload, adapter) {
|
||||
const source = isPlainObject(payload?.appGrants)
|
||||
? payload.appGrants
|
||||
: Array.isArray(payload?.appGrants)
|
||||
? payload.appGrants
|
||||
: payload?.grant || payload?.appGrant || payload?.entitlement || payload?.entitlements || payload?.grants || payload;
|
||||
const out = {};
|
||||
if (Array.isArray(source)) {
|
||||
for (const item of source) {
|
||||
const grant = normalizeEntitlementAdapterGrant(item, adapter);
|
||||
if (grant?.appId) out[grant.appId] = grant;
|
||||
}
|
||||
return out;
|
||||
}
|
||||
if (!isPlainObject(source)) return out;
|
||||
if (source.mcpServers || source.scopes || source.appId || source.app_id || source.surface) {
|
||||
const grant = normalizeEntitlementAdapterGrant(source, adapter);
|
||||
if (grant?.appId) out[grant.appId] = grant;
|
||||
return out;
|
||||
}
|
||||
for (const [key, value] of Object.entries(source)) {
|
||||
const grant = normalizeEntitlementAdapterGrant(value, { ...adapter, appId: normalizeKey(key) || adapter.appId });
|
||||
if (grant?.appId) out[grant.appId] = grant;
|
||||
}
|
||||
return out;
|
||||
}
|
||||
|
||||
function normalizeEntitlementAdapterGrant(value, adapter) {
|
||||
if (!isPlainObject(value)) return null;
|
||||
const appId = normalizeKey(value.appId || value.app_id || adapter.appId);
|
||||
if (!appId) return null;
|
||||
return {
|
||||
...value,
|
||||
appId,
|
||||
appTitle: optionalString(value.appTitle || value.app_title || value.title || adapter.title),
|
||||
surface: optionalString(value.surface) || appId,
|
||||
source: "entitlement-adapter",
|
||||
adapterId: adapter.id,
|
||||
};
|
||||
}
|
||||
|
||||
function runProfileMcpServersFromSettings(settings) {
|
||||
const metadata = isPlainObject(settings?.metadata) ? settings.metadata : {};
|
||||
const appGrants = isPlainObject(metadata.appGrants) ? metadata.appGrants : {};
|
||||
return runProfileMcpServersFromAppGrants(settings, appGrants);
|
||||
}
|
||||
|
||||
function runProfileMcpServersFromAppGrants(settings, appGrantsInput = {}) {
|
||||
const servers = [];
|
||||
const metadata = isPlainObject(settings?.metadata) ? settings.metadata : {};
|
||||
collectInstallerMcpServers(servers, metadata.mcpServers, {});
|
||||
const appGrants = isPlainObject(appGrantsInput) ? appGrantsInput : {};
|
||||
for (const [appId, grant] of Object.entries(appGrants)) {
|
||||
if (!isPlainObject(grant)) continue;
|
||||
collectInstallerMcpServers(servers, grant.mcpServers, {
|
||||
appId: optionalString(grant.appId) || normalizeKey(appId),
|
||||
appTitle: optionalString(grant.appTitle || grant.title),
|
||||
});
|
||||
}
|
||||
|
||||
const byServerName = new Map();
|
||||
for (const server of servers.map(sanitizeInstallerMcpServer).filter(Boolean)) {
|
||||
if (server.enabled === false) continue;
|
||||
byServerName.set(server.serverName, server);
|
||||
}
|
||||
return Array.from(byServerName.values());
|
||||
}
|
||||
|
||||
function summarizeRunAppGrants(metadata) {
|
||||
const appGrants = isPlainObject(metadata?.appGrants) ? metadata.appGrants : {};
|
||||
const out = {};
|
||||
for (const [key, value] of Object.entries(appGrants)) {
|
||||
if (!isPlainObject(value)) continue;
|
||||
const appId = optionalString(value.appId) || normalizeKey(key);
|
||||
if (!appId) continue;
|
||||
const mcpServers = Array.isArray(value.mcpServers)
|
||||
? value.mcpServers
|
||||
: isPlainObject(value.mcpServers)
|
||||
? Object.values(value.mcpServers)
|
||||
: [];
|
||||
out[appId] = {
|
||||
appId,
|
||||
appTitle: optionalString(value.appTitle || value.title),
|
||||
surface: optionalString(value.surface) || appId,
|
||||
updatedAt: optionalString(value.updatedAt || value.updated_at),
|
||||
context: redactForPublicDiagnostics(isPlainObject(value.context) ? value.context : {}),
|
||||
scopes: uniqueStrings(Array.isArray(value.scopes) ? value.scopes : []),
|
||||
hasMcpServers: mcpServers.length > 0,
|
||||
mcpServerNames: mcpServers
|
||||
.map((server) => safeMcpServerName(server?.serverName || server?.server_name || server?.name))
|
||||
.filter(Boolean),
|
||||
};
|
||||
}
|
||||
return out;
|
||||
}
|
||||
|
||||
function buildRunProfilePolicyPrompt({ context, diagnostics }) {
|
||||
const lines = [
|
||||
"AI Workspace dynamic run profile:",
|
||||
`- source surface: ${diagnostics.sourceSurface}`,
|
||||
`- mode: ${diagnostics.modeId}`,
|
||||
`- access mode: ${diagnostics.accessMode}`,
|
||||
`- context ready: ${diagnostics.contextReady ? "yes" : "no"}`,
|
||||
`- entitlement source: ${diagnostics.entitlementAdapters?.source || "settings"}`,
|
||||
`- enabled tool packs: ${diagnostics.enabledToolPacks.length ? diagnostics.enabledToolPacks.join(", ") : "none"}`,
|
||||
`- MCP servers available in this run: ${diagnostics.mcpServerNames.length ? diagnostics.mcpServerNames.join(", ") : "none"}`,
|
||||
"- MCP tokens and headers are runtime secrets and must never be printed in public answers.",
|
||||
];
|
||||
const opsContext = isPlainObject(context?.contexts?.ops) ? context.contexts.ops : {};
|
||||
if (opsContext.opsWorkspaceSlug || opsContext.opsProjectId) {
|
||||
lines.push(
|
||||
`- Ops target workspace: ${opsContext.opsWorkspaceSlug || opsContext.opsWorkspaceId || "unknown"}`,
|
||||
`- Ops target project: ${opsContext.opsProjectId || "unknown"}`
|
||||
);
|
||||
}
|
||||
const engineContext = isPlainObject(context?.contexts?.engine) ? context.contexts.engine : {};
|
||||
if (engineContext.workflowId || engineContext.agentNodeId) {
|
||||
lines.push(
|
||||
`- Engine target workflow: ${engineContext.workflowId || "unknown"}`,
|
||||
`- Engine target agent node: ${engineContext.agentNodeId || "unknown"}`
|
||||
);
|
||||
}
|
||||
return lines.join("\n");
|
||||
}
|
||||
|
||||
function runProfileHash(runProfile) {
|
||||
const publicProfile = redactRunProfile(runProfile);
|
||||
const stableProfile = {
|
||||
...publicProfile,
|
||||
runId: undefined,
|
||||
createdAt: undefined,
|
||||
diagnostics: {
|
||||
...(isPlainObject(publicProfile?.diagnostics) ? publicProfile.diagnostics : {}),
|
||||
profileHash: undefined,
|
||||
},
|
||||
};
|
||||
return createHash("sha256").update(JSON.stringify(stableProfile)).digest("hex").slice(0, 16);
|
||||
}
|
||||
|
||||
function redactRunProfile(runProfile) {
|
||||
if (!isPlainObject(runProfile)) return null;
|
||||
return {
|
||||
...runProfile,
|
||||
targetContexts: redactForPublicDiagnostics(runProfile.targetContexts),
|
||||
appGrants: redactForPublicDiagnostics(runProfile.appGrants),
|
||||
toolProfile: {
|
||||
...(isPlainObject(runProfile.toolProfile) ? runProfile.toolProfile : {}),
|
||||
mcpServers: Array.isArray(runProfile.toolProfile?.mcpServers)
|
||||
? runProfile.toolProfile.mcpServers.map(redactMcpServer)
|
||||
: [],
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
function redactMcpServer(server) {
|
||||
if (!isPlainObject(server)) return {};
|
||||
const headers = isPlainObject(server.httpHeaders) ? server.httpHeaders : {};
|
||||
return {
|
||||
...server,
|
||||
httpHeaders: Object.fromEntries(Object.keys(headers).map((key) => [key, "<redacted>"])),
|
||||
headers: undefined,
|
||||
};
|
||||
}
|
||||
|
||||
function redactForPublicDiagnostics(value, depth = 0) {
|
||||
if (depth > 6) return "[max-depth]";
|
||||
if (Array.isArray(value)) return value.map((item) => redactForPublicDiagnostics(item, depth + 1));
|
||||
if (!isPlainObject(value)) return value;
|
||||
const out = {};
|
||||
for (const [key, item] of Object.entries(value)) {
|
||||
if (/token|secret|password|authorization|cookie|api[_-]?key/i.test(key)) {
|
||||
out[key] = "<redacted>";
|
||||
continue;
|
||||
}
|
||||
out[key] = redactForPublicDiagnostics(item, depth + 1);
|
||||
}
|
||||
return out;
|
||||
}
|
||||
|
||||
function mergeSurfaceContexts(...contexts) {
|
||||
const out = {};
|
||||
for (const context of contexts) {
|
||||
@@ -2188,6 +2554,13 @@ function sanitizeDispatchCommand(payload) {
|
||||
function getRequestOwner(req) {
|
||||
const userId = optionalString(req.headers["x-nodedc-user-id"] || req.query.userId);
|
||||
const email = normalizeEmail(req.headers["x-nodedc-user-email"] || req.query.email);
|
||||
const role = normalizeKey(req.headers["x-nodedc-user-role"] || req.query.role);
|
||||
const groups = uniqueStrings(
|
||||
String(req.headers["x-nodedc-user-groups"] || req.query.groups || "")
|
||||
.split(/[\n,;]+/)
|
||||
.map((item) => item.trim())
|
||||
.filter(Boolean)
|
||||
);
|
||||
if (!userId && !email) {
|
||||
throw badRequest("ai_workspace_owner_required");
|
||||
}
|
||||
@@ -2195,6 +2568,8 @@ function getRequestOwner(req) {
|
||||
key: email ? `email:${email}` : `user:${userId}`,
|
||||
userId,
|
||||
email,
|
||||
role: role || "",
|
||||
groups,
|
||||
};
|
||||
}
|
||||
|
||||
@@ -2203,6 +2578,8 @@ function publicOwner(owner) {
|
||||
ownerKey: owner.key,
|
||||
userId: owner.userId,
|
||||
email: owner.email,
|
||||
role: owner.role || "",
|
||||
groups: Array.isArray(owner.groups) ? owner.groups : [],
|
||||
};
|
||||
}
|
||||
|
||||
@@ -2568,6 +2945,111 @@ function isDeployedPublicHubUrl(value) {
|
||||
}
|
||||
}
|
||||
|
||||
function parseEntitlementAdapters() {
|
||||
const adapters = [];
|
||||
collectEntitlementAdapters(adapters, parseJsonEnv(
|
||||
process.env.AI_WORKSPACE_ENTITLEMENT_ADAPTERS_JSON ||
|
||||
process.env.NDC_AI_WORKSPACE_ENTITLEMENT_ADAPTERS_JSON ||
|
||||
""
|
||||
));
|
||||
collectEntitlementAdapter(adapters, "ops", {
|
||||
url: process.env.AI_WORKSPACE_OPS_ENTITLEMENT_URL || process.env.NDC_AI_WORKSPACE_OPS_ENTITLEMENT_URL,
|
||||
token: process.env.AI_WORKSPACE_OPS_ENTITLEMENT_TOKEN || process.env.NDC_AI_WORKSPACE_OPS_ENTITLEMENT_TOKEN,
|
||||
required: process.env.AI_WORKSPACE_OPS_ENTITLEMENT_REQUIRED || process.env.NDC_AI_WORKSPACE_OPS_ENTITLEMENT_REQUIRED,
|
||||
});
|
||||
collectEntitlementAdapter(adapters, "engine", {
|
||||
url: process.env.AI_WORKSPACE_ENGINE_ENTITLEMENT_URL || process.env.NDC_AI_WORKSPACE_ENGINE_ENTITLEMENT_URL,
|
||||
token: process.env.AI_WORKSPACE_ENGINE_ENTITLEMENT_TOKEN || process.env.NDC_AI_WORKSPACE_ENGINE_ENTITLEMENT_TOKEN,
|
||||
required: process.env.AI_WORKSPACE_ENGINE_ENTITLEMENT_REQUIRED || process.env.NDC_AI_WORKSPACE_ENGINE_ENTITLEMENT_REQUIRED,
|
||||
});
|
||||
|
||||
const byAppId = new Map();
|
||||
for (const adapter of adapters) {
|
||||
byAppId.set(adapter.appId, adapter);
|
||||
}
|
||||
return Array.from(byAppId.values());
|
||||
}
|
||||
|
||||
function parseJsonEnv(value) {
|
||||
const text = optionalString(value);
|
||||
if (!text) return null;
|
||||
try {
|
||||
return JSON.parse(text);
|
||||
} catch {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
function collectEntitlementAdapters(target, value) {
|
||||
if (Array.isArray(value)) {
|
||||
for (const item of value) collectEntitlementAdapter(target, "", item);
|
||||
return;
|
||||
}
|
||||
if (!isPlainObject(value)) return;
|
||||
for (const [appId, adapter] of Object.entries(value)) {
|
||||
collectEntitlementAdapter(target, appId, adapter);
|
||||
}
|
||||
}
|
||||
|
||||
function collectEntitlementAdapter(target, defaultAppId, value) {
|
||||
const adapter = sanitizeEntitlementAdapter(value, defaultAppId);
|
||||
if (adapter) target.push(adapter);
|
||||
}
|
||||
|
||||
function sanitizeEntitlementAdapter(value, defaultAppId = "") {
|
||||
if (!isPlainObject(value)) return null;
|
||||
const appId = normalizeKey(value.appId || value.app_id || defaultAppId);
|
||||
const url = cleanHttpEndpoint(value.url || value.endpoint);
|
||||
if (!appId || !url) return null;
|
||||
const tokenEnv = optionalString(value.tokenEnv || value.token_env);
|
||||
const rawToken = optionalString(value.token || value.bearerToken || value.bearer_token)
|
||||
|| (tokenEnv ? optionalString(process.env[tokenEnv]) : null)
|
||||
|| optionalString(process.env.NODEDC_INTERNAL_ACCESS_TOKEN)
|
||||
|| optionalString(process.env.NODEDC_PLATFORM_SERVICE_TOKEN)
|
||||
|| "";
|
||||
const authorization = optionalString(value.authorization || value.Authorization)
|
||||
|| (rawToken
|
||||
? rawToken.match(/^Bearer\s+/i) ? rawToken : `Bearer ${rawToken}`
|
||||
: "");
|
||||
return {
|
||||
id: optionalString(value.id) || appId,
|
||||
appId,
|
||||
title: optionalString(value.title || value.appTitle || value.app_title),
|
||||
url,
|
||||
authorization,
|
||||
headers: sanitizeAdapterHeaders(value.headers),
|
||||
required: value.required === true || isTruthy(value.required),
|
||||
timeoutMs: sanitizeInteger(value.timeoutMs || value.timeout_ms, 5000, 500, 30000),
|
||||
};
|
||||
}
|
||||
|
||||
function sanitizeAdapterHeaders(value) {
|
||||
if (!isPlainObject(value)) return {};
|
||||
const headers = {};
|
||||
for (const [key, rawValue] of Object.entries(value)) {
|
||||
const headerName = optionalString(key);
|
||||
const headerValue = optionalString(rawValue);
|
||||
if (!headerName || !headerValue || /[\r\n\0]/.test(headerName) || /[\r\n\0]/.test(headerValue)) continue;
|
||||
if (/^authorization$/i.test(headerName)) continue;
|
||||
headers[headerName] = headerValue;
|
||||
}
|
||||
return headers;
|
||||
}
|
||||
|
||||
function cleanHttpEndpoint(value) {
|
||||
const text = optionalString(value);
|
||||
if (!text) return "";
|
||||
try {
|
||||
const url = new URL(text);
|
||||
if (url.protocol !== "http:" && url.protocol !== "https:") return "";
|
||||
url.username = "";
|
||||
url.password = "";
|
||||
return url.toString().replace(/\/+$/, "");
|
||||
} catch {
|
||||
return "";
|
||||
}
|
||||
}
|
||||
|
||||
function readConfig() {
|
||||
const databaseUrl =
|
||||
process.env.DATABASE_URL ||
|
||||
@@ -2610,6 +3092,7 @@ function readConfig() {
|
||||
process.env.NODEDC_INTERNAL_ACCESS_TOKEN,
|
||||
process.env.NODEDC_PLATFORM_SERVICE_TOKEN,
|
||||
]),
|
||||
entitlementAdapters: parseEntitlementAdapters(),
|
||||
};
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user