Showing the changes to packages/plugins/openapi/src (2 of 19 files). Show all
Unified · Split
| @@ -0,0 +1,87 @@ | |||
| 1 | // --------------------------------------------------------------------------- | ||
| 2 | // The invoke span must not carry the connection's base URL verbatim. | ||
| 3 | // | ||
| 4 | // A connection `baseUrl` is a user-supplied URL from the same class as the mcp | ||
| 5 | // and graphql endpoints already covered: `?token=…` in the query string and | ||
| 6 | // `user:pass@host` userinfo are both supported input shapes. Stamping it raw on | ||
| 7 | // `plugin.openapi.invoke` shipped the credential to the trace backend on every | ||
| 8 | // tool call. Synthetic placeholders only. | ||
| 9 | // --------------------------------------------------------------------------- | ||
| 10 | |||
| 11 | import { describe, expect, it } from "@effect/vitest"; | ||
| 12 | import { Effect, Option, Tracer } from "effect"; | ||
| 13 | import { FetchHttpClient } from "effect/unstable/http"; | ||
| 14 | |||
| 15 | import { invokeWithLayer } from "./invoke"; | ||
| 16 | import { OperationBinding } from "./types"; | ||
| 17 | |||
| 18 | const QUERY_TOKEN = "synthetic-endpoint-token"; | ||
| 19 | const USERINFO_PASSWORD = "synthetic-endpoint-password"; | ||
| 20 | |||
| 21 | /** Records every span the program opens so the stamped attributes can be read | ||
| 22 | * back. Port 1 connection-refuses immediately, so the invocation resolves | ||
| 23 | * without any network dependency. */ | ||
| 24 | const recordingTracer = (spans: Array<Tracer.NativeSpan>) => | ||
| 25 | Tracer.make({ | ||
| 26 | span: (options) => { | ||
| 27 | const span = new Tracer.NativeSpan(options); | ||
| 28 | spans.push(span); | ||
| 29 | return span; | ||
| 30 | }, | ||
| 31 | context: (primitive, fiber) => primitive["~effect/Effect/evaluate"](fiber), | ||
| 32 | }); | ||
| 33 | |||
| 34 | const operation = OperationBinding.make({ | ||
| 35 | method: "get", | ||
| 36 | servers: [], | ||
| 37 | pathTemplate: "/things", | ||
| 38 | requestBody: Option.none(), | ||
| 39 | responseBody: Option.none(), | ||
| 40 | parameters: [], | ||
| 41 | }); | ||
| 42 | |||
| 43 | const invokeAgainst = (baseUrl: string) => | ||
| 44 | Effect.gen(function* () { | ||
| 45 | const spans: Array<Tracer.NativeSpan> = []; | ||
| 46 | yield* invokeWithLayer(operation, {}, baseUrl, {}, {}, FetchHttpClient.layer).pipe( | ||
| 47 | Effect.exit, | ||
| 48 | Effect.provideService(Tracer.Tracer, recordingTracer(spans)), | ||
| 49 | ); | ||
| 50 | return spans; | ||
| 51 | }); | ||
| 52 | |||
| 53 | describe("openapi invoke telemetry", () => { | ||
| 54 | it.effect("stamps a sanitized base_url on the invoke span", () => | ||
| 55 | Effect.gen(function* () { | ||
| 56 | const spans = yield* invokeAgainst( | ||
| 57 | `http://svc-user:${USERINFO_PASSWORD}@127.0.0.1:1/v1?token=${QUERY_TOKEN}`, | ||
| 58 | ); | ||
| 59 | |||
| 60 | const invoke = spans.find((span) => span.name === "plugin.openapi.invoke"); | ||
| 61 | expect(invoke).toBeDefined(); | ||
| 62 | expect(invoke?.attributes.get("plugin.openapi.base_url")).toBe("http://127.0.0.1:1/v1"); | ||
| 63 | |||
| 64 | // Scoped to the plugin's own spans. Effect's HttpClient separately stamps | ||
| 65 | // `url.full`/`url.query` on its outgoing client spans; those are scrubbed | ||
| 66 | // downstream by the export pipeline's redaction, which is not installed | ||
| 67 | // at this level. | ||
| 68 | const serialized = JSON.stringify( | ||
| 69 | spans | ||
| 70 | .filter((span) => span.name.startsWith("plugin.openapi.")) | ||
| 71 | .map((span) => Object.fromEntries(span.attributes.entries())), | ||
| 72 | ); | ||
| 73 | expect(serialized).not.toContain(QUERY_TOKEN); | ||
| 74 | expect(serialized).not.toContain(USERINFO_PASSWORD); | ||
| 75 | }), | ||
| 76 | ); | ||
| 77 | |||
| 78 | it.effect("leaves a credential-free base URL intact", () => | ||
| 79 | Effect.gen(function* () { | ||
| 80 | const spans = yield* invokeAgainst("http://127.0.0.1:1/v1"); | ||
| 81 | |||
| 82 | const invoke = spans.find((span) => span.name === "plugin.openapi.invoke"); | ||
| 83 | expect(invoke?.attributes.get("plugin.openapi.base_url")).toBe("http://127.0.0.1:1/v1"); | ||
| 84 | expect(invoke?.attributes.get("plugin.openapi.path_template")).toBe("/things"); | ||
| 85 | }), | ||
| 86 | ); | ||
| 87 | }); | ||
| @@ -1,6 +1,6 @@ | |||
| 1 | import { Effect, Exit, Fiber, Layer, Option, Schema, Stream } from "effect"; | 1 | import { Effect, Exit, Fiber, Layer, Option, Schema, Stream } from "effect"; |
| 2 | import { HttpClient, HttpClientRequest, HttpClientResponse } from "effect/unstable/http"; | 2 | import { HttpClient, HttpClientRequest, HttpClientResponse } from "effect/unstable/http"; |
| 3 | import type { ToolFileValue } from "@executor-js/sdk/core"; | 3 | import { endpointForTelemetry, type ToolFileValue } from "@executor-js/sdk/core"; |
| 4 | 4 | ||
| 5 | import { OpenApiInvocationError } from "./errors"; | 5 | import { OpenApiInvocationError } from "./errors"; |
| 6 | import { isNdjsonMediaType, NDJSON_MEDIA_TYPES, resolveServerUrl } from "./openapi-utils"; | 6 | import { isNdjsonMediaType, NDJSON_MEDIA_TYPES, resolveServerUrl } from "./openapi-utils"; |
| @@ -1293,7 +1293,10 @@ export const invokeWithLayer = ( · 1286 unmodified lines | |||
| 1293 | attributes: { | 1293 | attributes: { |
| 1294 | "plugin.openapi.method": operation.method.toUpperCase(), | 1294 | "plugin.openapi.method": operation.method.toUpperCase(), |
| 1295 | "plugin.openapi.path_template": operation.pathTemplate, | 1295 | "plugin.openapi.path_template": operation.pathTemplate, |
| 1296 | "plugin.openapi.base_url": effectiveBaseUrl, | 1296 | // The connection's `baseUrl` is a user-supplied URL from the same class |
| 1297 | // as the mcp/graphql endpoints: it may carry `?token=…` or `user:pass@` | ||
| 1298 | // userinfo. Sanitize before stamping. | ||
| 1299 | "plugin.openapi.base_url": endpointForTelemetry(effectiveBaseUrl), | ||
| 1297 | }, | 1300 | }, |
| 1298 | }), | 1301 | }), |
| 1299 | ); | 1302 | ); |