Enhance directUrlDocumentLoader support for End User Specific IDP - #3013
Enhance directUrlDocumentLoader support for End User Specific IDP#3013jimthompson5802 wants to merge 17 commits into
Conversation
…t and config path resolution
jimthompson5802
changed the title
…uthentication plugin
…d related components
|
@markscott-ms @rocketstack-matt @jpgough-ms @willosborne @byrash here is the PR that implements authenticated access for the To view how an end user organization integrates with the changes in this PR, see this repo: https://github.com/jimthompson5802/calm-web-repo. The README describes the three test scenarios used for testing the PR. There are sample code and configurations that show how the end user provided authentication module is used and integrates with |
rocketstack-matt
left a comment
rocketstack-matt
left a comment
There was a problem hiding this comment.
Two non-blocking findings on the verbose error-cause logging in validate.ts. Build/lint/full test suite all pass locally.
| const stack = err instanceof Error ? err.stack : undefined; | ||
| logger.error('An error occurred while validating: ' + message); | ||
| if (options.verbose) { | ||
| for (const causeMessage of formatErrorCauseChain(err)) { |
There was a problem hiding this comment.
This walks error.cause and logs each nested .message under --verbose. For the direct-URL auth failure path, cause is whatever the user's own auth-plugin code threw (direct-url-document-loader.ts AUTHENTICATION_FAILED branches) — unlike the redacted debug-request logging elsewhere in this PR, nothing sanitizes that message before it's printed. Worth redacting/suppressing the cause chain specifically for AUTHENTICATION_FAILED errors, consistent with the header-redaction already done for debug request logs.
| let currentCause = getErrorCause(error); | ||
| let isFirst = true; | ||
|
|
||
| while (currentCause instanceof Error) { |
There was a problem hiding this comment.
No cycle guard here: if error.cause ever forms a cycle (self-referential, or A→B→A) — plausible from a buggy or malicious user-supplied auth module, which is exactly the trust boundary this feature introduces — this loop never terminates and hangs the process under --verbose.
| while (currentCause instanceof Error) { | |
| const seen = new Set<Error>(); | |
| while (currentCause instanceof Error && !seen.has(currentCause)) { | |
| seen.add(currentCause); |
2 participants
Description
Closes #2975
This PR adds support for authenticated direct
http(s)document loading in the CLI and shared document loader stack. It introduces a separatedirectUrlAuthconfiguration path for protected remote schema and document fetches, wires that module into the CLI document loader configuration, and improves error handling and debug logging so authentication failures are clearer without exposing sensitive header values.The intent of this PR is to provide an interface specification that lets an end-user organization supply a custom authentication module for its own Identity Provider. That module remains outside the CALM project and is fully owned by the end-user organization.
For TLS and certificate validation, this PR relies on Node.js runtime behavior rather than adding CALM-specific certificate handling. In environments that use private or enterprise certificate chains, trust can be extended with
NODE_EXTRA_CA_CERTS. In environments where certificate verification must be bypassed for local or controlled use cases, Node also supportsNODE_TLS_REJECT_UNAUTHORIZED=0. This keeps certificate handling aligned with Node.js configuration and leaves trust and validation policy under deployment control.IMPORTANT NOTE: To view how an end user organization integrates with the changes in this PR, see this repo: https://github.com/jimthompson5802/calm-web-repo. The README describes the three test scenarios used for testing the PR. There are sample code and configurations that show how the end user provided authentication module is used and integrates with
calm cliDirectUrlDocumentLoader.Type of Change
Affected Components
cli/)calm/)calm-ai/)calm-hub/)calm-hub-ui/)calm-server/)calm-widgets/)docs/)shared/)calm-plugins/vscode/)Commit Message Format ✅
Testing
Checklist