Admin/annonet
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove temporary OAuth probe from production image

Browse Source
This commit is contained in:
Admin 2026-09-21 22:09:11 +00:00
parent 852fb40ca6
commit 9dcc2099a0
3 changed files with 2 additions and 91 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Dockerfile
View File

@ -4,7 +4,6 @@ WORKDIR /src
COPY annonet-arrowstack-ready.zip /tmp/annonet.zip COPY annonet-arrowstack-ready.zip /tmp/annonet.zip
RUN unzip -q /tmp/annonet.zip -d /src RUN unzip -q /tmp/annonet.zip -d /src
COPY mcpAuthMiddleware.js /src/src/auth/mcpAuthMiddleware.js COPY mcpAuthMiddleware.js /src/src/auth/mcpAuthMiddleware.js
COPY oauthProbe.js /src/oauthProbe.js
# Arrowstack's database-per-tenant runtime role intentionally cannot install # Arrowstack's database-per-tenant runtime role intentionally cannot install
# extensions. PostgreSQL 13+ provides gen_random_uuid() in core, and annoNet # extensions. PostgreSQL 13+ provides gen_random_uuid() in core, and annoNet
# does not use any other pgcrypto functions. # does not use any other pgcrypto functions.
@ -33,7 +32,6 @@ COPY --from=source /src/src ./src
COPY --from=source /src/sql ./sql COPY --from=source /src/sql ./sql
COPY --from=source /src/scripts ./scripts COPY --from=source /src/scripts ./scripts
COPY --from=source /src/frontend ./frontend COPY --from=source /src/frontend ./frontend
COPY --from=source /src/oauthProbe.js ./oauthProbe.js
COPY --from=frontend-build /build/frontend-astro/dist ./public COPY --from=frontend-build /build/frontend-astro/dist ./public
RUN npm run check \ RUN npm run check \

69
oauthProbe.js
View File

@ -1,68 +1 @@
const decodePayload = (token) => { // Historical deployment diagnostic placeholder. Not copied into the production image.\n
try {
const part = String(token || "").split(".")[1] || "";
return JSON.parse(Buffer.from(part, "base64url").toString("utf8"));
} catch {
return {};
}
};
const call = async (label, token) => {
const headers = token === undefined ? {} : { Authorization: `Bearer ${token}` };
const response = await fetch("http://127.0.0.1:8787/api/mcp/annotations?limit=1", { headers });
const body = await response.text();
console.log("[oauth-probe]", JSON.stringify({
test: label,
status: response.status,
body: body.slice(0, 240)
}));
return response.status;
};
(async () => {
const issuer = String(process.env.MCP_TEST_ISSUER || "").replace(/\/$/, "");
const clientId = String(process.env.MCP_TEST_CLIENT_ID || "");
const clientSecret = String(process.env.MCP_TEST_CLIENT_SECRET || "");
if (!issuer || !clientId || !clientSecret) {
throw new Error("temporary MCP test credentials are not configured");
}
const tokenResponse = await fetch(`${issuer}/protocol/openid-connect/token`, {
method: "POST",
headers: { "content-type": "application/x-www-form-urlencoded" },
body: new URLSearchParams({
grant_type: "client_credentials",
client_id: clientId,
client_secret: clientSecret
})
});
const tokenBody = await tokenResponse.json().catch(() => ({}));
console.log("[oauth-probe]", JSON.stringify({
test: "client_credentials",
status: tokenResponse.status,
tokenType: tokenBody.token_type || null,
expiresIn: tokenBody.expires_in || null
}));
if (!tokenResponse.ok || !tokenBody.access_token) {
process.exitCode = 2;
return;
}
const claims = decodePayload(tokenBody.access_token);
console.log("[oauth-probe]", JSON.stringify({
test: "safe_claims",
iss: claims.iss || null,
azp: claims.azp || claims.client_id || null,
aud: claims.aud || null,
preferredUsername: claims.preferred_username || null,
realmRoles: claims.realm_access && claims.realm_access.roles || [],
resourceAccess: claims.resource_access || {}
}));
await call("missing_token", undefined);
await call("invalid_token", "not-a-jwt");
await call("service_account", tokenBody.access_token);
})().catch((error) => {
console.error("[oauth-probe-error]", error && error.message ? error.message : error);
process.exitCode = 3;
});

22
scopeProbe.js
View File

@ -1,21 +1 @@
const { pool } = require("./src/db/pool"); // Historical deployment diagnostic placeholder. Not copied into the production image.\n
(async () => {
try {
const { rows } = await pool.query(
`SELECT o.id AS org_id, t.id AS team_id
FROM orgs o
JOIN teams t ON t.org_id = o.id
WHERE o.name = 'Default Organization'
AND t.name = 'Default Team'
LIMIT 1`
);
console.error("[bootstrap-scope]", JSON.stringify(rows[0] || null));
process.exitCode = 42;
} finally {
await pool.end();
}
})().catch((error) => {
console.error("[bootstrap-scope-error]", error);
process.exit(43);
});