Registry auth for OpenAPI and preset add flows; product-key matching

GitHub's official OpenAPI description declares no securitySchemes, so the add flow offered OAuth (from the preset template) and nothing else, while a PAT bearer header is how most calls actually authenticate. The registry's declared placement now seeds an API key method alongside detected OAuth; a spec-declared key method still wins over the registry's version of the same fact. Preset-to-catalog matching moves from rendered titles to a product key (normalized name plus kind), so 'GitHub REST' and the registry's 'GitHub API' count as one product — titles and domains both proved unreliable joins. MCP surfaces carry their auth facts too.

Rhys Sullivan committed 2 months ago

Commit 97c4ef41 parent d3acfe32 files · +50 −16Browse files

Unified · Split

2 files

packages/plugins/openapi/src/react/AddOpenApiIntegration.tsx +21 −2
packages/react/src/pages/integration-browse.tsx +29 −14

packages/plugins/openapi/src/react/AddOpenApiIntegration.tsx+21−2

   type AuthMethodRow,
   type AuthMethodSeed,
 } from "@executor-js/react/components/auth-method-list-editor";
+import { placementFromHeaderPattern } from "@executor-js/react/lib/auth-placements";
 import { CardStack, CardStackContent } from "@executor-js/react/components/card-stack";
 import { FieldLabel } from "@executor-js/react/components/field";
 import { FloatActions } from "@executor-js/react/components/float-actions";
   initialUrl?: string;
   initialPreset?: string;
   initialNamespace?: string;
+  initialAuthHeader?: string;
+  initialAuthNote?: string;
 }) {
   const integrationPlugins = useIntegrationPlugins();
   const openApiPlugin = integrationPlugins.find((plugin) => plugin.key === "openapi");
       ...(preview?.headerPresets ?? []).map((preset) => preset.label),
       ...(preview?.oauth2Presets ?? []).map((preset) => preset.label),
     ];
-    return authenticationTemplate.map(
+    const detected = authenticationTemplate.map(
       (template: Authentication, index: number): AuthMethodSeed => ({
         value: editorValueFromAuthentication(template),
         slug: String(template.slug),
         ...(labels[index] !== undefined ? { label: labels[index] } : {}),
       }),
     );
-  }, [preview, authenticationTemplate]);
+    if (preview === null) return detected;
+    // The registry's declared credential placement fills what the document
+    // leaves out. GitHub's official description famously declares no
+    // securitySchemes at all, and even with the OAuth preset template a PAT
+    // bearer header is how most calls actually authenticate — so the key
+    // method is offered alongside OAuth. A spec-declared key method wins over
+    // the registry's version of the same fact.
+    const placement = props.initialAuthHeader
+      ? placementFromHeaderPattern(props.initialAuthHeader)
+      : null;
+    if (!placement || detected.some((seed) => seed.value.kind === "apikey")) return detected;
+    return [...detected, { value: { kind: "apikey", placements: [placement] } }];
+  }, [preview, authenticationTemplate, props.initialAuthHeader]);
   const authMethodList = useAuthMethodList(authMethodSeeds);
   // The methods to register, mapped back to stored `Authentication[]`. Drops
         />
       )}
+      {preview && props.initialAuthNote ? (
+        <p className="text-xs leading-relaxed text-muted-foreground">{props.initialAuthNote}</p>
+      ) : null}
       {preview ? (
         <AddOpenApiHealthCheckSection
           presetHealthCheck={activePreset?.healthCheck}

packages/react/src/pages/integration-browse.tsx+29−14

   return already ? name : `${name} ${surface}`;
 };
+/** The key on which a preset and a catalog row count as the same product:
+ *  the name with surface words and punctuation stripped, plus the kind.
+ *  "GitHub REST" and "GitHub API" are one product; "Stripe API" and
+ *  "Stripe MCP" are not. */
+const productKey = (name: string, kind: string): string =>
+  `${name
+    .toLowerCase()
+    .replace(/\b(api|rest|graphql|mcp)\b/g, "")
+    .replace(/[^a-z0-9]/g, "")}|${kind}`;
 const detectionRank: Record<IntegrationDetectionResult["confidence"], number> = {
   high: 3,
   medium: 2,
   readonly key: string;
   readonly testId: string;
   readonly title: string;
+  /** Surface kind for product matching (productKey); not rendered. */
+  readonly kindKey: string;
   /** The domain, shown beside a prettified title so near-namesakes stay
    *  distinguishable. Omitted when the title is already the domain. */
   readonly domain?: string;
   // catalog row for the same product must not read as two different kinds of
   // thing — the row shows the registry's identity (the domain) like every
   // other result, and the preset only supplies the better add flow. Keyed by
-  // the rendered title, the same match the dedupe below uses.
+  // productKey, the same match the dedupe below uses.
-  const catalogIdentityByTitle = useMemo(() => {
+  const catalogIdentityByKey = useMemo(() => {
     const map = new Map<
       string,
       { readonly domain: string; readonly auth?: CatalogSurface["auth"] }
           ? entry.surfaces
           : entry.kinds.map((kind) => ({ kind }));
       for (const surface of surfaces) {
-        const word = SURFACE_WORD[surface.kind] ?? CATALOG_KIND_LABEL[surface.kind];
+        const key = productKey(pretty, surface.kind);
-        const title = withSurface(pretty, word).toLowerCase();
+        if (!map.has(key)) {
-        if (!map.has(title)) {
+          map.set(key, {
-          map.set(title, {
             domain: entry.domain,
             ...("auth" in surface && surface.auth ? { auth: surface.auth } : {}),
           });
       }
       const surface = SURFACE_WORD[entry.pluginKey] ?? entry.pluginLabel;
       const title = withSurface(entry.preset.name, surface);
-      const identity = catalogIdentityByTitle.get(title.toLowerCase());
+      const kindKey = entry.pluginKey === "google" ? "openapi" : entry.pluginKey;
+      const identity = catalogIdentityByKey.get(productKey(entry.preset.name, kindKey));
       rows.push({
         key: `preset-${entry.pluginKey}-${entry.preset.id}`,
         testId: `preset-${entry.preset.id}`,
         title,
+        kindKey,
         ...(identity ? { domain: identity.domain } : {}),
         ...(entry.preset.summary ? { description: entry.preset.summary } : {}),
         ...(entry.preset.icon ? { iconUrl: entry.preset.icon } : {}),
       });
     }
     return rows;
-  }, [allPresets, kind, text, pickPreset, isAdded, catalogIdentityByTitle]);
+  }, [allPresets, kind, text, pickPreset, isAdded, catalogIdentityByKey]);
   // --- Catalog rows: one per (service, surface) -----------------------------
   const catalogRows = useMemo<readonly Row[]>(() => {
           key: `catalog-${entry.domain}-${surface.kind}-${known?.slug ?? pretty}`,
           testId: `catalog-${known?.slug ?? `${entry.domain}-${surface.kind}`}`,
           title: withSurface(pretty, word),
+          kindKey: surface.kind,
           domain: entry.domain,
           ...(description ? { description } : {}),
           iconUrl: catalogLogoUrl(entry.domain, 10),
       });
     });
     // A registry row for something a preset already offers is a worse copy of
-    // it: same service, no auth template, no health check. Matched on the
+    // it: same service, no auth template, no health check. Matched on
-    // rendered title because a preset's domain is inferred from its icon and
+    // productKey — normalized name plus kind — because neither titles nor
-    // often does not match the registry's (the Gmail preset's icon is Google's,
+    // domains line up reliably: the Gmail preset's icon is Google's (so a
-    // so a domain comparison let a second "Gmail API" through).
+    // domain comparison let a second "Gmail API" through), and the GitHub
-    const presetTitles = new Set(presetRows.map((row) => row.title.toLowerCase()));
+    // preset says "GitHub REST" where the registry row says "GitHub API".
-    rows = rows.filter((row) => !presetTitles.has(row.title.toLowerCase()));
+    const presetKeys = new Set(presetRows.map((row) => productKey(row.title, row.kindKey)));
+    rows = rows.filter((row) => !presetKeys.has(productKey(row.title, row.kindKey)));
     if (text.length === 0) return rows;
     // A name match beats a mention in the blurb: searching "gmail" should not
     // rank a CRM that merely describes itself as living inside Gmail above

Registry auth for OpenAPI and preset add flows; product-key matching

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code