Keep OpenAPI credentials bound to destinations

Rhys Sullivan committed 6 months ago

Commit 84baa511 parent 416073e2 files · +101 −19Browse files

Unified · Split

2 files

packages/plugins/openapi/src/sdk/plugin.test.ts +67 −8
packages/plugins/openapi/src/sdk/plugin.ts +34 −11

packages/plugins/openapi/src/sdk/plugin.test.ts+67−8

@@ -944,7 +944,7 @@ layer(TestLayer)("OpenAPI Plugin", (it) => { · 943 unmodified lines
944	}),	944	}),
945	);	945	);
946		946
947	it.effect("updateSource on user shadow does not mutate the org row", () =>	947	it.effect("updateSource on user shadow cannot override the inherited base URL", () =>
948	Effect.gen(function* () {	948	Effect.gen(function* () {
949	const httpClient = yield* HttpClient.HttpClient;	949	const httpClient = yield* HttpClient.HttpClient;
950	const clientLayer = Layer.succeed(HttpClient.HttpClient, httpClient);	950	const clientLayer = Layer.succeed(HttpClient.HttpClient, httpClient);
@@ -970,25 +970,84 @@ layer(TestLayer)("OpenAPI Plugin", (it) => { · 19 unmodified lines
970	spec: specJson,	970	spec: specJson,
971	scope: String(USER_SCOPE),	971	scope: String(USER_SCOPE),
972	namespace: "shared",	972	namespace: "shared",
973	baseUrl: "https://user.example.com",
974	name: "User Source",	973	name: "User Source",
975	});	974	});
976		975
977	yield* executor.openapi.updateSource("shared", String(USER_SCOPE), {	976	const updateResult = yield* executor.openapi
978	name: "User Renamed",	977	.updateSource("shared", String(USER_SCOPE), {
979	baseUrl: "https://user-new.example.com",	978	name: "User Renamed",
980	});	979	baseUrl: "https://user-new.example.com",
		980	})
		981	.pipe(
		982	Effect.match({
		983	onFailure: (error) => error,
		984	onSuccess: () => null,
		985	}),
		986	);
981		987
982	const userView = yield* executor.openapi.getSource("shared", String(USER_SCOPE));	988	const userView = yield* executor.openapi.getSource("shared", String(USER_SCOPE));
983	const orgView = yield* executor.openapi.getSource("shared", String(ORG_SCOPE));	989	const orgView = yield* executor.openapi.getSource("shared", String(ORG_SCOPE));
984		990
985	expect(userView?.name).toBe("User Renamed");	991	expect(updateResult).toMatchObject({ _tag: "OpenApiOAuthError" });
986	expect(userView?.config.baseUrl).toBe("https://user-new.example.com");	992	expect(userView?.name).toBe("User Source");
		993	expect(userView?.config.baseUrl).toBe("https://org.example.com");
987	expect(orgView?.name).toBe("Org Source");	994	expect(orgView?.name).toBe("Org Source");
988	expect(orgView?.config.baseUrl).toBe("https://org.example.com");	995	expect(orgView?.config.baseUrl).toBe("https://org.example.com");
989	}),	996	}),
990	);	997	);
991		998
		999	it.effect("addSpec on user shadow cannot override the inherited base URL", () =>
		1000	Effect.gen(function* () {
		1001	const server = yield* makeOpenApiTestServer({ spec });
		1002	const executor = yield* createExecutor(
		1003	makeTestConfig({
		1004	scopes: stackedScopes,
		1005	plugins: [
		1006	openApiPlugin({ httpClientLayer: server.httpClientLayer }),
		1007	memorySecretsPlugin(),
		1008	] as const,
		1009	}),
		1010	);
		1011
		1012	yield* executor.secrets.set(
		1013	new SetSecretInput({
		1014	id: SecretId.make("org-api-token"),
		1015	scope: ORG_SCOPE,
		1016	name: "Org API token",
		1017	value: "org-secret",
		1018	}),
		1019	);
		1020
		1021	yield* executor.openapi.addSpec({
		1022	spec: server.specJson,
		1023	scope: String(ORG_SCOPE),
		1024	namespace: "shadow_auth",
		1025	baseUrl: "https://org.example.com",
		1026	credentialTargetScope: String(ORG_SCOPE),
		1027	headers: {
		1028	Authorization: { secretId: "org-api-token", prefix: "Bearer " },
		1029	},
		1030	});
		1031
		1032	const addResult = yield* executor.openapi
		1033	.addSpec({
		1034	spec: server.specJson,
		1035	scope: String(USER_SCOPE),
		1036	namespace: "shadow_auth",
		1037	baseUrl: server.baseUrl,
		1038	name: "User Shadow",
		1039	})
		1040	.pipe(
		1041	Effect.match({
		1042	onFailure: (error) => error,
		1043	onSuccess: () => null,
		1044	}),
		1045	);
		1046
		1047	expect(addResult).toMatchObject({ _tag: "OpenApiOAuthError" });
		1048	}),
		1049	);
		1050
992	it.effect(	1051	it.effect(
993	"refreshing a user shadow uses inherited spec-fetch credentials without copying them",	1052	"refreshing a user shadow uses inherited spec-fetch credentials without copying them",
994	() =>	1053	() =>

packages/plugins/openapi/src/sdk/plugin.ts+34−11

   );
 };
-const resolveEffectiveSourceConfig = (
+const findOuterSource = (
   ctx: PluginCtx<OpenapiStore>,
-  base: StoredSource,
+  namespace: string,
-): Effect.Effect<EffectiveSourceConfig, StorageFailure> =>
+  scope: string,
+): Effect.Effect<StoredSource | null, StorageFailure> =>
   Effect.gen(function* () {
     const ranks = scopeRanks(ctx);
-    const baseRank = scopeRank(ranks, base.scope);
+    const baseRank = scopeRank(ranks, scope);
-    let fallback: StoredSource | null = null;
     for (let index = baseRank + 1; index < ctx.scopes.length; index++) {
-      const scope = ctx.scopes[index];
+      const candidateScope = ctx.scopes[index];
-      if (!scope) continue;
+      if (!candidateScope) continue;
-      fallback = yield* ctx.storage.getSource(base.namespace, scope.id);
+      const source = yield* ctx.storage.getSource(namespace, candidateScope.id);
-      if (fallback) break;
+      if (source) return source;
     }
+    return null;
+  });
+const resolveEffectiveSourceConfig = (
+  ctx: PluginCtx<OpenapiStore>,
+  base: StoredSource,
+): Effect.Effect<EffectiveSourceConfig, StorageFailure> =>
+  Effect.gen(function* () {
+    const fallback = yield* findOuterSource(ctx, base.namespace, base.scope);
     if (!fallback) {
       return {
       config: {
         ...base.config,
         sourceUrl: base.config.sourceUrl ?? fallback.config.sourceUrl,
-        baseUrl: base.config.baseUrl || fallback.config.baseUrl,
+        baseUrl: fallback.config.baseUrl,
         namespace: base.config.namespace ?? fallback.config.namespace,
         headers: hasBaseHeaders ? base.config.headers : fallback.config.headers,
         queryParams: hasBaseQueryParams ? base.config.queryParams : fallback.config.queryParams,
         Option.getOrElse(result.title, () => "api")
           .toLowerCase()
           .replace(/[^a-z0-9]+/g, "_");
+      const outerSource = yield* findOuterSource(ctx, namespace, input.scope);
+      if (outerSource && input.baseUrl !== undefined && input.baseUrl.trim() !== "") {
+        return yield* new OpenApiOAuthError({
+          message: "OpenAPI source shadows inherit the outer source base URL",
+        });
+      }
       const hoistedDefs: Record<string, unknown> = {};
       if (doc.components?.schemas) {
         }
       }
-      const baseUrl = input.baseUrl ?? resolveBaseUrl(result.servers);
+      const baseUrl = outerSource ? undefined : (input.baseUrl ?? resolveBaseUrl(result.servers));
       const canonicalHeaders = canonicalizeHeaders(input.headers);
       const canonicalQueryParams = canonicalizeCredentialMap(
         input.queryParams,
               ...(input.oauth2 !== undefined ? ["oauth2:"] : []),
             ];
             const targetScope = input.credentialTargetScope ?? scope;
+            if (input.baseUrl !== undefined && input.baseUrl.trim() !== "") {
+              const outerSource = yield* findOuterSource(ctx, namespace, scope);
+              if (outerSource) {
+                return yield* new OpenApiOAuthError({
+                  message: "OpenAPI source shadows inherit the outer source base URL",
+                });
+              }
+            }
             if (affectedPrefixes.length > 0 || directBindings.length > 0) {
               yield* validateOpenApiBindingTarget(ctx, {
                 sourceId: namespace,