Refactor HttpApi workspace routing and proxy boundaries (#25006)

packages/opencode/test/server/httpapi-workspace.test.ts

@@ -1,4 +1,4 @@
-import { afterEach, describe, expect, mock, spyOn, test } from "bun:test"
+import { afterEach, describe, expect, mock, test } from "bun:test"
 import { mkdir } from "node:fs/promises"
 import path from "node:path"
 import { Effect } from "effect"
@@ -14,6 +14,7 @@ import { resetDatabase } from "../fixture/db"
 import { tmpdir } from "../fixture/fixture"
 import { Instance } from "../../src/project/instance"
 import { InstancePaths } from "../../src/server/routes/instance/httpapi/groups/instance"
+import { WorkspaceRef } from "../../src/effect/instance-ref"
 
 void Log.init({ print: false })
 
@@ -27,8 +28,13 @@ function request(path: string, directory: string, init: RequestInit = {}) {
   return Server.Default().app.request(path, { ...init, headers })
 }
 
-function runSession<A, E>(fx: Effect.Effect<A, E, Session.Service>) {
-  return Effect.runPromise(fx.pipe(Effect.provide(Session.defaultLayer)))
+function runSession<A, E>(fx: Effect.Effect<A, E, Session.Service>, workspaceID?: Workspace.Info["id"]) {
+  return Effect.runPromise(
+    fx.pipe(
+      workspaceID ? Effect.provideService(WorkspaceRef, workspaceID) : (effect) => effect,
+      Effect.provide(Session.defaultLayer),
+    ),
+  )
 }
 
 function localAdaptor(directory: string): WorkspaceAdaptor {
@@ -55,7 +61,7 @@ function localAdaptor(directory: string): WorkspaceAdaptor {
   }
 }
 
-function remoteAdaptor(directory: string, url: string): WorkspaceAdaptor {
+function remoteAdaptor(directory: string, url: string, headers?: HeadersInit): WorkspaceAdaptor {
   return {
     name: "Remote Test",
     description: "Create a remote test workspace",
@@ -74,20 +80,51 @@ function remoteAdaptor(directory: string, url: string): WorkspaceAdaptor {
       return {
         type: "remote" as const,
         url,
+        headers,
       }
     },
   }
 }
 
-function eventStreamResponse() {
-  return new Response(new ReadableStream({ start() {} }), {
-    status: 200,
-    headers: {
-      "content-type": "text/event-stream",
+type ProxiedRequest = {
+  url: string
+  method: string
+  headers: Record<string, string>
+  body: string
+}
+
+function listenRemoteHttp(handler: (request: ProxiedRequest) => Response | Promise<Response>) {
+  return Bun.serve({
+    port: 0,
+    async fetch(request) {
+      return handler({
+        url: request.url,
+        method: request.method,
+        headers: Object.fromEntries(request.headers.entries()),
+        body: await request.text(),
+      })
     },
   })
 }
 
+function eventStreamResponse() {
+  return new Response(
+    new ReadableStream({
+      start(controller) {
+        controller.enqueue(
+          new TextEncoder().encode('data: {"payload":{"type":"server.connected","properties":{}}}\n\n'),
+        )
+      },
+    }),
+    {
+      status: 200,
+      headers: {
+        "content-type": "text/event-stream",
+      },
+    },
+  )
+}
+
 afterEach(async () => {
   mock.restore()
   Flag.OPENCODE_EXPERIMENTAL_WORKSPACES = originalWorkspaces
@@ -97,6 +134,8 @@ afterEach(async () => {
 })
 
 describe("workspace HttpApi", () => {
+  test.todo("proxies remote workspace websocket through real Effect listener", () => {})
+
   test("serves read endpoints", async () => {
     await using tmp = await tmpdir({ git: true })
 
@@ -191,25 +230,33 @@ describe("workspace HttpApi", () => {
     }
   })
 
-  test("proxies remote workspace HTTP requests", async () => {
+  test("proxies remote workspace HTTP requests with sanitized forwarding", async () => {
     Flag.OPENCODE_EXPERIMENTAL_WORKSPACES = true
     await using tmp = await tmpdir({ git: true })
-    const proxied: string[] = []
-    const rawFetch = globalThis.fetch
-    spyOn(globalThis, "fetch").mockImplementation(
-      Object.assign(
-        async (input: URL | RequestInfo, init?: BunFetchRequestInit | RequestInit) => {
-          const url = new URL(typeof input === "string" || input instanceof URL ? input : input.url)
-          if (url.pathname === "/base/global/event") return eventStreamResponse()
-          if (url.pathname === "/base/sync/history") return Response.json([])
-          proxied.push(url.toString())
-          return Response.json({ proxied: true, path: url.pathname, workspace: url.searchParams.get("workspace") })
-        },
+    const proxied: ProxiedRequest[] = []
+    const remote = listenRemoteHttp((request) => {
+      proxied.push(request)
+      const url = new URL(request.url)
+      if (url.pathname === "/base/global/event") return eventStreamResponse()
+      if (url.pathname === "/base/sync/history") return Response.json([])
+      return new Response(
+        JSON.stringify({
+          proxied: true,
+          path: url.pathname,
+          keep: url.searchParams.get("keep"),
+          workspace: url.searchParams.get("workspace"),
+        }),
         {
-          preconnect: rawFetch.preconnect?.bind(rawFetch),
+          status: 201,
+          statusText: "Created",
+          headers: {
+            "content-length": "999",
+            "content-type": "application/json",
+            "x-remote": "yes",
+          },
         },
-      ) as typeof globalThis.fetch,
-    )
+      )
+    })
 
     const workspace = await Instance.provide({
       directory: tmp.path,
@@ -217,7 +264,9 @@ describe("workspace HttpApi", () => {
         registerAdaptor(
           Instance.project.id,
           "remote-target",
-          remoteAdaptor(path.join(tmp.path, ".remote"), "https://remote.test/base"),
+          remoteAdaptor(path.join(tmp.path, ".remote"), `http://127.0.0.1:${remote.port}/base`, {
+            "x-target-auth": "secret",
+          }),
         )
         return Workspace.create({
           type: "remote-target",
@@ -228,16 +277,101 @@ describe("workspace HttpApi", () => {
       },
     })
 
-    const url = new URL(`http://localhost${InstancePaths.path}`)
+    const url = new URL("http://localhost/config")
     url.searchParams.set("workspace", workspace.id)
+    url.searchParams.set("keep", "yes")
 
     try {
-      const response = await request(url.toString(), tmp.path)
+      const response = await request(url.toString(), tmp.path, {
+        method: "PATCH",
+        headers: {
+          "accept-encoding": "br",
+          "content-type": "application/json",
+          "x-opencode-workspace": "internal",
+        },
+        body: JSON.stringify({ $schema: "https://opencode.ai/config.json" }),
+      })
 
-      expect(response.status).toBe(200)
-      expect(await response.json()).toEqual({ proxied: true, path: "/base/path", workspace: null })
-      expect(proxied).toEqual(["https://remote.test/base/path"])
+      const responseBody = await response.text()
+      expect({ status: response.status, body: responseBody }).toMatchObject({ status: 201 })
+      expect(response.headers.get("content-length")).toBeNull()
+      expect(response.headers.get("x-remote")).toBe("yes")
+      expect(JSON.parse(responseBody)).toEqual({ proxied: true, path: "/base/config", keep: "yes", workspace: null })
+      const forwarded = proxied.filter((item) => new URL(item.url).pathname === "/base/config")
+      expect(forwarded).toEqual([
+        {
+          url: `http://127.0.0.1:${remote.port}/base/config?keep=yes`,
+          method: "PATCH",
+          headers: expect.objectContaining({
+            "content-type": "application/json",
+            "x-target-auth": "secret",
+          }),
+          body: JSON.stringify({ $schema: "https://opencode.ai/config.json" }),
+        },
+      ])
+      expect(forwarded[0]?.headers).not.toHaveProperty("x-opencode-directory")
+      expect(forwarded[0]?.headers).not.toHaveProperty("x-opencode-workspace")
     } finally {
+      remote.stop(true)
+      await Workspace.remove(workspace.id)
+    }
+  })
+
+  test("proxies remote workspace requests selected from session ownership", async () => {
+    Flag.OPENCODE_EXPERIMENTAL_WORKSPACES = true
+    await using tmp = await tmpdir({ git: true })
+    const proxied: ProxiedRequest[] = []
+    const remote = listenRemoteHttp((request) => {
+      proxied.push(request)
+      const url = new URL(request.url)
+      if (url.pathname === "/base/global/event") return eventStreamResponse()
+      if (url.pathname === "/base/sync/history") return Response.json([])
+      return Response.json({ proxied: true, path: new URL(request.url).pathname })
+    })
+
+    const workspace = await Instance.provide({
+      directory: tmp.path,
+      fn: async () => {
+        registerAdaptor(
+          Instance.project.id,
+          "remote-session-target",
+          remoteAdaptor(path.join(tmp.path, ".remote-session"), `http://127.0.0.1:${remote.port}/base`),
+        )
+        return Workspace.create({
+          type: "remote-session-target",
+          branch: null,
+          extra: null,
+          projectID: Instance.project.id,
+        })
+      },
+    })
+    const session = await Instance.provide({
+      directory: tmp.path,
+      fn: async () =>
+        runSession(
+          Session.Service.use((svc) => svc.create()),
+          workspace.id,
+        ),
+    })
+
+    try {
+      const response = await request(`http://localhost/session/${session.id}/message`, tmp.path, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ parts: [{ type: "text", text: "hello" }] }),
+      })
+
+      const responseBody = await response.text()
+      expect({ status: response.status, body: responseBody }).toMatchObject({ status: 200 })
+      expect(JSON.parse(responseBody)).toEqual({ proxied: true, path: `/base/session/${session.id}/message` })
+      expect(proxied.filter((item) => new URL(item.url).pathname === `/base/session/${session.id}/message`)).toEqual([
+        expect.objectContaining({
+          url: `http://127.0.0.1:${remote.port}/base/session/${session.id}/message`,
+          method: "POST",
+        }),
+      ])
+    } finally {
+      remote.stop(true)
       await Workspace.remove(workspace.id)
     }
   })

packages/opencode/test/server/proxy-util.test.ts

@@ -0,0 +1,113 @@
+import { describe, expect, test } from "bun:test"
+import { ProxyUtil } from "../../src/server/proxy-util"
+
+describe("ProxyUtil", () => {
+  describe("websocketTargetURL", () => {
+    test("converts http to ws", () => {
+      expect(ProxyUtil.websocketTargetURL("http://example.com/path")).toBe("ws://example.com/path")
+    })
+
+    test("converts https to wss", () => {
+      expect(ProxyUtil.websocketTargetURL("https://example.com/path")).toBe("wss://example.com/path")
+    })
+
+    test("preserves query params", () => {
+      expect(ProxyUtil.websocketTargetURL("http://example.com/path?foo=bar")).toBe("ws://example.com/path?foo=bar")
+    })
+
+    test("accepts URL objects", () => {
+      expect(ProxyUtil.websocketTargetURL(new URL("http://localhost:3000/ws"))).toBe("ws://localhost:3000/ws")
+    })
+  })
+
+  describe("websocketProtocols", () => {
+    test("returns empty array when no header", () => {
+      const req = new Request("http://localhost")
+      expect(ProxyUtil.websocketProtocols(req)).toEqual([])
+    })
+
+    test("parses single protocol", () => {
+      const req = new Request("http://localhost", {
+        headers: { "sec-websocket-protocol": "graphql-ws" },
+      })
+      expect(ProxyUtil.websocketProtocols(req)).toEqual(["graphql-ws"])
+    })
+
+    test("parses multiple protocols", () => {
+      const req = new Request("http://localhost", {
+        headers: { "sec-websocket-protocol": "graphql-ws, graphql-transport-ws" },
+      })
+      expect(ProxyUtil.websocketProtocols(req)).toEqual(["graphql-ws", "graphql-transport-ws"])
+    })
+
+    test("trims whitespace and filters empty", () => {
+      const req = new Request("http://localhost", {
+        headers: { "sec-websocket-protocol": " proto1 , , proto2 " },
+      })
+      expect(ProxyUtil.websocketProtocols(req)).toEqual(["proto1", "proto2"])
+    })
+  })
+
+  describe("headers", () => {
+    test("strips hop-by-hop headers", () => {
+      const req = new Request("http://localhost", {
+        headers: {
+          connection: "keep-alive",
+          "keep-alive": "timeout=5",
+          "transfer-encoding": "chunked",
+          "content-type": "application/json",
+        },
+      })
+      const result = ProxyUtil.headers(req)
+      expect(result.get("connection")).toBeNull()
+      expect(result.get("keep-alive")).toBeNull()
+      expect(result.get("transfer-encoding")).toBeNull()
+      expect(result.get("content-type")).toBe("application/json")
+    })
+
+    test("strips opencode-specific headers", () => {
+      const req = new Request("http://localhost", {
+        headers: {
+          "x-opencode-directory": "/home/user/project",
+          "x-opencode-workspace": "ws_123",
+          "accept-encoding": "gzip",
+          "x-custom": "keep",
+        },
+      })
+      const result = ProxyUtil.headers(req)
+      expect(result.get("x-opencode-directory")).toBeNull()
+      expect(result.get("x-opencode-workspace")).toBeNull()
+      expect(result.get("accept-encoding")).toBeNull()
+      expect(result.get("x-custom")).toBe("keep")
+    })
+
+    test("merges extra headers", () => {
+      const req = new Request("http://localhost", {
+        headers: { "content-type": "application/json" },
+      })
+      const result = ProxyUtil.headers(req, { "x-auth": "token", "content-type": "text/plain" })
+      expect(result.get("x-auth")).toBe("token")
+      expect(result.get("content-type")).toBe("text/plain")
+    })
+
+    test("returns original headers when no extra", () => {
+      const req = new Request("http://localhost", {
+        headers: { "content-type": "application/json", "x-foo": "bar" },
+      })
+      const result = ProxyUtil.headers(req)
+      expect(result.get("content-type")).toBe("application/json")
+      expect(result.get("x-foo")).toBe("bar")
+    })
+
+    test("accepts plain object (HeadersInit) as input", () => {
+      const result = ProxyUtil.headers(
+        { "content-type": "application/json", connection: "keep-alive", "x-custom": "val" },
+        { "x-extra": "added" },
+      )
+      expect(result.get("connection")).toBeNull()
+      expect(result.get("content-type")).toBe("application/json")
+      expect(result.get("x-custom")).toBe("val")
+      expect(result.get("x-extra")).toBe("added")
+    })
+  })
+})

packages/opencode/test/server/workspace-proxy.test.ts

@@ -0,0 +1,93 @@
+import { NodeHttpServer } from "@effect/platform-node"
+import Http from "node:http"
+import { describe, expect } from "bun:test"
+import { Effect } from "effect"
+import { HttpServer, HttpServerRequest, HttpServerResponse } from "effect/unstable/http"
+import { HttpApiProxy } from "../../src/server/routes/instance/httpapi/middleware/proxy"
+import { testEffect } from "../lib/effect"
+
+function serverUrl() {
+  return Effect.gen(function* () {
+    return HttpServer.formatAddress((yield* HttpServer.HttpServer).address)
+  })
+}
+
+const testServerLayer = NodeHttpServer.layer(Http.createServer, { host: "127.0.0.1", port: 0 })
+const it = testEffect(testServerLayer)
+
+describe("HttpApi workspace proxy", () => {
+  it.live("proxies HTTP request and returns streamed response with status and headers", () =>
+    Effect.gen(function* () {
+      yield* HttpServer.serveEffect()(
+        Effect.gen(function* () {
+          const req = yield* HttpServerRequest.HttpServerRequest
+          const body = yield* req.text
+          return yield* HttpServerResponse.json({ path: req.url, method: req.method, body }, {
+            status: 201,
+            headers: {
+              "content-encoding": "identity",
+              "content-length": "999",
+              "x-remote": "yes",
+            },
+          })
+        }),
+      )
+      const url = yield* serverUrl()
+
+      const request = HttpServerRequest.fromWeb(
+        new Request("http://localhost/session/abc", { method: "POST", body: "request-body" }),
+      )
+      const response = yield* HttpApiProxy.http(`${url}/session/abc?keep=yes`, { "x-extra": "injected" }, request)
+
+      expect(response.status).toBe(201)
+      const client = HttpServerResponse.toClientResponse(response)
+      expect(yield* client.json).toEqual({
+        path: "/session/abc?keep=yes",
+        method: "POST",
+        body: "request-body",
+      })
+      expect(response.headers["x-remote"]).toBe("yes")
+      expect(response.headers["content-encoding"]).toBeUndefined()
+      expect(response.headers["content-length"]).toBeUndefined()
+    }),
+  )
+
+  it.live("returns 500 when remote is unreachable", () =>
+    Effect.gen(function* () {
+      const request = HttpServerRequest.fromWeb(new Request("http://localhost/anything"))
+      const response = yield* HttpApiProxy.http("http://127.0.0.1:1/unreachable", undefined, request)
+
+      expect(response.status).toBe(500)
+    }),
+  )
+
+  it.live("strips opencode-internal headers and merges extra headers", () =>
+    Effect.gen(function* () {
+      let forwarded: Record<string, string> = {}
+      yield* HttpServer.serveEffect()(
+        Effect.gen(function* () {
+          const req = yield* HttpServerRequest.HttpServerRequest
+          forwarded = req.headers
+          return HttpServerResponse.empty()
+        }),
+      )
+      const url = yield* serverUrl()
+
+      const request = HttpServerRequest.fromWeb(
+        new Request("http://localhost/test", {
+          headers: {
+            "x-opencode-directory": "/secret/path",
+            "x-opencode-workspace": "ws_123",
+            "x-custom": "preserved",
+          },
+        }),
+      )
+      yield* HttpApiProxy.http(`${url}/test`, { "x-injected": "extra" }, request)
+
+      expect(forwarded["x-opencode-directory"]).toBeUndefined()
+      expect(forwarded["x-opencode-workspace"]).toBeUndefined()
+      expect(forwarded["x-custom"]).toBe("preserved")
+      expect(forwarded["x-injected"]).toBe("extra")
+    }),
+  )
+})

packages/opencode/test/server/workspace-routing.test.ts

@@ -0,0 +1,85 @@
+import { describe, expect, test } from "bun:test"
+import { isLocalWorkspaceRoute, getWorkspaceRouteSessionID, workspaceProxyURL } from "../../src/server/workspace"
+import { SessionID } from "../../src/session/schema"
+
+describe("isLocalWorkspaceRoute", () => {
+  test("GET /session is local", () => {
+    expect(isLocalWorkspaceRoute("GET", "/session")).toBe(true)
+  })
+
+  test("GET /session/ses_abc is local (prefix match)", () => {
+    expect(isLocalWorkspaceRoute("GET", "/session/ses_abc")).toBe(true)
+  })
+
+  test("POST /session is not local (method mismatch)", () => {
+    expect(isLocalWorkspaceRoute("POST", "/session")).toBe(false)
+  })
+
+  test("/session/status is forwarded regardless of method", () => {
+    expect(isLocalWorkspaceRoute("GET", "/session/status")).toBe(false)
+    expect(isLocalWorkspaceRoute("POST", "/session/status")).toBe(false)
+  })
+
+  test("unrecognized paths are not local", () => {
+    expect(isLocalWorkspaceRoute("GET", "/config")).toBe(false)
+    expect(isLocalWorkspaceRoute("POST", "/session/ses_abc/message")).toBe(false)
+  })
+})
+
+describe("getWorkspaceRouteSessionID", () => {
+  test("extracts session ID from path", () => {
+    const url = new URL("http://localhost/session/ses_abc123/message")
+    expect(getWorkspaceRouteSessionID(url)).toBe(SessionID.make("ses_abc123"))
+  })
+
+  test("extracts session ID without trailing path", () => {
+    const url = new URL("http://localhost/session/ses_xyz")
+    expect(getWorkspaceRouteSessionID(url)).toBe(SessionID.make("ses_xyz"))
+  })
+
+  test("returns null for /session/status", () => {
+    const url = new URL("http://localhost/session/status")
+    expect(getWorkspaceRouteSessionID(url)).toBeNull()
+  })
+
+  test("returns null for non-session paths", () => {
+    const url = new URL("http://localhost/config")
+    expect(getWorkspaceRouteSessionID(url)).toBeNull()
+  })
+
+  test("returns null for bare /session path", () => {
+    const url = new URL("http://localhost/session")
+    expect(getWorkspaceRouteSessionID(url)).toBeNull()
+  })
+})
+
+describe("workspaceProxyURL", () => {
+  test("appends request path to target", () => {
+    const result = workspaceProxyURL("http://remote:8080/base", new URL("http://localhost/config"))
+    expect(result.toString()).toBe("http://remote:8080/base/config")
+  })
+
+  test("strips trailing slash on target before appending", () => {
+    const result = workspaceProxyURL("http://remote:8080/base/", new URL("http://localhost/session/abc"))
+    expect(result.pathname).toBe("/base/session/abc")
+  })
+
+  test("preserves query params from request but removes workspace", () => {
+    const url = new URL("http://localhost/config?workspace=ws_123&keep=yes")
+    const result = workspaceProxyURL("http://remote:8080/base", url)
+    expect(result.searchParams.get("workspace")).toBeNull()
+    expect(result.searchParams.get("keep")).toBe("yes")
+  })
+
+  test("preserves hash from request", () => {
+    const url = new URL("http://localhost/page#section")
+    const result = workspaceProxyURL("http://remote:8080", url)
+    expect(result.hash).toBe("#section")
+  })
+
+  test("works with URL object as target", () => {
+    const target = new URL("http://remote:3000/api")
+    const result = workspaceProxyURL(target, new URL("http://localhost/users"))
+    expect(result.toString()).toBe("http://remote:3000/api/users")
+  })
+})