Add hosted outbound HTTP policy

Route hosted plugin outbound requests through a shared Effect HttpClient layer that blocks local/private/metadata targets and re-checks redirects. Thread the executor-provided HTTP client through OpenAPI, GraphQL, MCP probing, and OAuth discovery, keep local harnesses on the normal fetch client, and split the restored security coverage into the relevant existing suites. Fix cloud migration scripts to invoke the local Drizzle binary under op run.

Rhys Sullivan committed 6 months ago

Commit 5fc67cd1 parent 745deac19 files · +559 −36Browse files

Showing the changes to packages/plugins (4 of 19 files). Show all

Unified · Split

4 files

packages/plugins/graphql/src/sdk/plugin.ts +6 −5
packages/plugins/mcp/src/sdk/plugin.ts +17 −2
packages/plugins/mcp/src/sdk/probe-shape.ts +3 −2
packages/plugins/openapi/src/sdk/plugin.ts +6 −4

packages/plugins/graphql/src/sdk/plugin.ts+6−5

 import { Effect, Option, Schema } from "effect";
 import type { Layer } from "effect";
-import { FetchHttpClient, HttpClient } from "effect/unstable/http";
+import { HttpClient } from "effect/unstable/http";
 import { GraphqlGroup } from "../api/group";
 import { GraphqlExtensionService, GraphqlHandlers } from "../api/handlers";
 export type GraphqlPluginExtension = ReturnType<typeof makeGraphqlExtension>;
 export const graphqlPlugin = definePlugin((options?: GraphqlPluginOptions) => {
-  const httpClientLayer = options?.httpClientLayer ?? FetchHttpClient.layer;
   return {
     id: "graphql" as const,
     packageName: "@executor-js/plugin-graphql",
     schema: graphqlSchema,
     storage: (deps): GraphqlStore => makeDefaultGraphqlStore(deps),
-    extension: (ctx) => makeGraphqlExtension(ctx, httpClientLayer, options?.configFile),
+    extension: (ctx) =>
+      makeGraphqlExtension(ctx, options?.httpClientLayer ?? ctx.httpClientLayer, options?.configFile),
     staticSources: (self) => [
       {
     invokeTool: ({ ctx, toolRow, args }) =>
       Effect.gen(function* () {
+        const httpClientLayer = options?.httpClientLayer ?? ctx.httpClientLayer;
         // toolRow.scope_id is the resolved owning scope of the tool
         // (innermost-wins from the executor's stack). The matching
         // graphql_operation + graphql_source rows live at the same
     usagesForConnection: () => Effect.succeed([]),
-    detect: ({ url }) =>
+    detect: ({ ctx, url }) =>
       Effect.gen(function* () {
+        const httpClientLayer = options?.httpClientLayer ?? ctx.httpClientLayer;
         const trimmed = url.trim();
         if (!trimmed) return null;
         const parsed = yield* Effect.try({

packages/plugins/mcp/src/sdk/plugin.ts+17−2

-import { Duration, Effect, Exit, Option, Predicate, Result, Scope, ScopedCache } from "effect";
+import {
+  Duration,
+  Effect,
+  Exit,
+  Layer,
+  Option,
+  Predicate,
+  Result,
+  Scope,
+  ScopedCache,
+} from "effect";
+import type { HttpClient } from "effect/unstable/http";
 import type { OAuthClientProvider } from "@modelcontextprotocol/sdk/client/auth.js";
    * `process.env`. Only enable for trusted single-user contexts.
    */
   readonly dangerouslyAllowStdioMCP?: boolean;
+  readonly httpClientLayer?: Layer.Layer<HttpClient.HttpClient>;
   /** If provided, source add/remove is mirrored to executor.jsonc
    *  (best-effort — file errors are logged, not raised). */
   readonly configFile?: ConfigFileSink;
     storage: (deps): McpBindingStore => makeMcpStore(deps),
     extension: (ctx) => {
+      const httpClientLayer = options?.httpClientLayer ?? ctx.httpClientLayer;
       const probeEndpoint = (input: string | McpProbeEndpointInput) =>
         Effect.gen(function* () {
           const endpoint = typeof input === "string" ? input : input.endpoint;
           // probe and be misclassified as MCP. The shape probe rejects
           // anything whose initialize response isn't 2xx or 401+Bearer.
           const shape = yield* probeMcpEndpointShape(trimmed, {
+            httpClientLayer,
             headers: probeHeaders,
             queryParams: probeQueryParams,
           });
     detect: ({ ctx, url }) =>
       Effect.gen(function* () {
+        const httpClientLayer = options?.httpClientLayer ?? ctx.httpClientLayer;
         const trimmed = url.trim();
         if (!trimmed) return null;
         // host publishes RFC 9728 + 8414 metadata) would be classified
         // as MCP whenever the cross-plugin detector fans out to us.
-        const shape = yield* probeMcpEndpointShape(trimmed);
+        const shape = yield* probeMcpEndpointShape(trimmed, { httpClientLayer });
         if (shape.kind !== "mcp") return null;
         // Confirm OAuth metadata is actually reachable. The shape

packages/plugins/mcp/src/sdk/probe-shape.ts+3−2

 // round-trip, no DCR — every non-MCP endpoint exits here.
 // ---------------------------------------------------------------------------
-import { Data, Duration, Effect, Option, Schema } from "effect";
+import { Data, Duration, Effect, Layer, Option, Schema } from "effect";
 import { FetchHttpClient, HttpClient, HttpClientRequest } from "effect/unstable/http";
 /** MCP initialize request body used as the shape probe. Any real MCP
 export interface ProbeOptions {
   /** Abort the request after this many ms. Default 8000. */
   readonly timeoutMs?: number;
+  readonly httpClientLayer?: Layer.Layer<HttpClient.HttpClient>;
   readonly headers?: Record<string, string>;
   readonly queryParams?: Record<string, string>;
 }
         reason: `unexpected status ${postResponse.status} for initialize`,
       } as const;
     }).pipe(
-      Effect.provide(FetchHttpClient.layer),
+      Effect.provide(options.httpClientLayer ?? FetchHttpClient.layer),
       Effect.mapError(
         (cause) =>
           new ProbeTransportError({

packages/plugins/openapi/src/sdk/plugin.ts+6−4

 import { Effect, Option, Predicate, Schema } from "effect";
 import type { Layer } from "effect";
-import { FetchHttpClient, HttpClient } from "effect/unstable/http";
+import { HttpClient } from "effect/unstable/http";
 import { OpenApiGroup } from "../api/group";
 import { OpenApiExtensionService, OpenApiHandlers } from "../api/handlers";
 const isHttpUrl = (s: string): boolean => s.startsWith("http://") || s.startsWith("https://");
 export const openApiPlugin = definePlugin((options?: OpenApiPluginOptions) => {
-  const httpClientLayer = options?.httpClientLayer ?? FetchHttpClient.layer;
   type RebuildInput = {
     readonly specText: string;
     readonly scope: string;
   // than surface a 500 through the unwhitelisted error channel.
   const refreshSourceInternal = (ctx: PluginCtx<OpenapiStore>, sourceId: string, scope: string) =>
     Effect.gen(function* () {
+      const httpClientLayer = options?.httpClientLayer ?? ctx.httpClientLayer;
       const existing = yield* ctx.storage.getSource(sourceId, scope);
       if (!existing) return;
       const effective = yield* resolveEffectiveSourceConfig(ctx, existing);
     storage: (deps): OpenapiStore => makeDefaultOpenapiStore(deps),
     extension: (ctx) => {
+      const httpClientLayer = options?.httpClientLayer ?? ctx.httpClientLayer;
       const addSpecInternal = (config: OpenApiSpecConfig) =>
         Effect.gen(function* () {
           // Resolve URL → text and parse BEFORE opening a transaction.
     invokeTool: ({ ctx, toolRow, args }) =>
       Effect.gen(function* () {
+        const httpClientLayer = options?.httpClientLayer ?? ctx.httpClientLayer;
         // toolRow.scope_id is the resolved owning scope of the tool
         // (innermost-wins from the executor's stack). The matching
         // openapi_operation + openapi_source rows live at the same
     // means stale UI state, which is worth surfacing to the caller.
     refreshSource: ({ ctx, sourceId, scope }) => refreshSourceInternal(ctx, sourceId, scope),
-    detect: ({ url }) =>
+    detect: ({ ctx, url }) =>
       Effect.gen(function* () {
+        const httpClientLayer = options?.httpClientLayer ?? ctx.httpClientLayer;
         const trimmed = url.trim();
         if (!trimmed) return null;
         const parsed = yield* Effect.try({