6f108237d4
* test preview bypass 2 Co-authored-by: Cursor <cursoragent@cursor.com> * add apiFetch wrapper with Vercel bypass via query param + header the template workflow was missing VERCEL_AUTOMATION_BYPASS_SECRET, so all action API calls to preview deployments hit Vercel's deployment protection without bypass. this also consolidates the bypass logic into a single fetch wrapper that applies the secret as both a query parameter (matching server-side forwarding) and a header for belt-and-suspenders reliability. Co-authored-by: Cursor <cursoragent@cursor.com> * security hardening for Vercel bypass - redact bypass token from webhook forwarder logs and response body - remove dead x-preview-api-forward header - refactor getAllSecrets() to use SENSITIVE_PATTERNS instead of hardcoded list - enforce https:// on API_URL (localhost exempt for local dev) Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>
100 lines
2.4 KiB
TypeScript
100 lines
2.4 KiB
TypeScript
import type { AgentName, BashPermission, PushPermission, ToolPermission } from "../external.ts";
|
|
import { apiFetch } from "./apiFetch.ts";
|
|
import type { RepoContext } from "./github.ts";
|
|
|
|
export interface Mode {
|
|
id: string;
|
|
name: string;
|
|
description: string;
|
|
prompt: string;
|
|
}
|
|
|
|
export interface RepoSettings {
|
|
defaultAgent: AgentName | null;
|
|
modes: Mode[];
|
|
setupScript: string | null;
|
|
postCheckoutScript: string | null;
|
|
repoInstructions: string;
|
|
web: ToolPermission;
|
|
search: ToolPermission;
|
|
push: PushPermission;
|
|
bash: BashPermission;
|
|
}
|
|
|
|
export interface RunContext {
|
|
settings: RepoSettings;
|
|
apiToken: string;
|
|
}
|
|
|
|
const defaultSettings: RepoSettings = {
|
|
defaultAgent: null,
|
|
modes: [],
|
|
setupScript: null,
|
|
postCheckoutScript: null,
|
|
repoInstructions: "",
|
|
web: "enabled",
|
|
search: "enabled",
|
|
push: "restricted",
|
|
bash: "restricted",
|
|
};
|
|
|
|
const defaultRunContext: RunContext = {
|
|
settings: defaultSettings,
|
|
apiToken: "",
|
|
};
|
|
|
|
/**
|
|
* fetch run context from Pullfrog API
|
|
* returns settings + API token for subsequent calls
|
|
* returns defaults if fetch fails
|
|
*/
|
|
export async function fetchRunContext(params: {
|
|
token: string;
|
|
repoContext: RepoContext;
|
|
}): Promise<RunContext> {
|
|
const timeoutMs = 30000;
|
|
const controller = new AbortController();
|
|
const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
|
|
|
|
try {
|
|
const response = await apiFetch({
|
|
path: `/api/repo/${params.repoContext.owner}/${params.repoContext.name}/run-context`,
|
|
headers: {
|
|
Authorization: `Bearer ${params.token}`,
|
|
"Content-Type": "application/json",
|
|
},
|
|
signal: controller.signal,
|
|
});
|
|
|
|
clearTimeout(timeoutId);
|
|
|
|
if (!response.ok) {
|
|
return defaultRunContext;
|
|
}
|
|
|
|
const data = (await response.json()) as {
|
|
settings: RepoSettings | null;
|
|
apiToken: string;
|
|
} | null;
|
|
|
|
if (data === null) {
|
|
return defaultRunContext;
|
|
}
|
|
|
|
return {
|
|
settings: {
|
|
...defaultSettings,
|
|
...data.settings,
|
|
// ensure arrays are never undefined (API may omit new fields for existing repos)
|
|
modes: data.settings?.modes ?? [],
|
|
setupScript: data.settings?.setupScript ?? null,
|
|
postCheckoutScript: data.settings?.postCheckoutScript ?? null,
|
|
},
|
|
apiToken: data.apiToken,
|
|
};
|
|
} catch {
|
|
clearTimeout(timeoutId);
|
|
return defaultRunContext;
|
|
}
|
|
}
|