mirror of
https://github.com/multica-ai/multica.git
synced 2026-08-12 10:59:06 +02:00
50c89c7094
* feat(autopilots): hide webhook URL token by default (MUL-5374) The webhook URL is a bearer credential — anyone who reads it off a screen share or screenshot can fire the autopilot. GH #6004 reports exactly that leak during a live demo. The trigger row and the post-create panel now render the URL through a shared WebhookUrlField that masks the token segment by default. Clicking the value (or the eye toggle) reveals it; Copy keeps working while hidden, so the common case never needs a reveal. The plaintext token is not in the DOM until the user asks for it — this is a real display boundary, not a CSS blur. Co-authored-by: multica-agent <github@multica.ai> * fix(autopilots): scope webhook URL reveal to the URL it was granted for (MUL-5374) The reveal was a bare boolean, so a token rotation under a mounted trigger row swapped in the new URL while `revealed` was still true — exposing the new credential in the clear at the exact moment the user rotated to contain a leak. Track which URL the reveal was granted for and derive `revealed` during render. Deriving it (rather than resetting in an effect) means the new token never reaches the DOM, not even for the pre-effect frame. Co-authored-by: multica-agent <github@multica.ai> --------- Co-authored-by: Bohan-J <bohan@devv.ai> Co-authored-by: multica-agent <github@multica.ai>
62 lines
2.4 KiB
TypeScript
62 lines
2.4 KiB
TypeScript
import type { AutopilotTrigger } from "../types";
|
|
|
|
/**
|
|
* Compose a usable absolute webhook URL for a webhook trigger.
|
|
*
|
|
* Resolution order:
|
|
* 1. trigger.webhook_url — present only when MULTICA_PUBLIC_URL is set on the
|
|
* server. This is the authoritative form when available.
|
|
* 2. apiBaseUrl + webhook_path — desktop apps and self-host setups where the
|
|
* server didn't mint an absolute URL but the client knows its API origin.
|
|
* 3. currentOrigin + webhook_path — browser fallback when getBaseUrl() is
|
|
* empty (e.g. same-origin Next.js dev).
|
|
*
|
|
* Returns null when the trigger has no token / path yet (a new trigger that
|
|
* hasn't been written back to the cache, or a non-webhook trigger).
|
|
*/
|
|
export function buildAutopilotWebhookUrl(params: {
|
|
trigger: Pick<AutopilotTrigger, "kind" | "webhook_token" | "webhook_path" | "webhook_url">;
|
|
apiBaseUrl?: string;
|
|
currentOrigin?: string;
|
|
}): string | null {
|
|
const { trigger, apiBaseUrl, currentOrigin } = params;
|
|
|
|
if (trigger.kind !== "webhook") return null;
|
|
|
|
if (typeof trigger.webhook_url === "string" && trigger.webhook_url) {
|
|
return trigger.webhook_url;
|
|
}
|
|
|
|
const path =
|
|
(typeof trigger.webhook_path === "string" && trigger.webhook_path) ||
|
|
(trigger.webhook_token ? `/api/webhooks/autopilots/${trigger.webhook_token}` : null);
|
|
if (!path) return null;
|
|
|
|
const base = stripTrailingSlash(apiBaseUrl) || stripTrailingSlash(currentOrigin);
|
|
if (!base) return path; // last resort — relative path will still work in-browser
|
|
return base + path;
|
|
}
|
|
|
|
function stripTrailingSlash(s: string | undefined): string {
|
|
if (!s) return "";
|
|
return s.endsWith("/") ? s.slice(0, -1) : s;
|
|
}
|
|
|
|
/** Fixed-width run — never derived from the token, so the mask leaks no length. */
|
|
const WEBHOOK_URL_MASK = "••••••••••••";
|
|
|
|
/**
|
|
* Mask the secret part of a webhook URL for display.
|
|
*
|
|
* Only the trailing token segment is a credential: anyone holding it can fire
|
|
* the autopilot. The origin and the `/api/webhooks/autopilots/` prefix carry no
|
|
* secret, so they stay readable and the value is still recognizable as this
|
|
* trigger's URL while hidden. Falls back to the bare mask when the URL has no
|
|
* separable last segment.
|
|
*/
|
|
export function maskAutopilotWebhookUrl(url: string): string {
|
|
const cut = url.lastIndexOf("/");
|
|
if (cut < 0 || cut === url.length - 1) return WEBHOOK_URL_MASK;
|
|
return url.slice(0, cut + 1) + WEBHOOK_URL_MASK;
|
|
}
|