fix: share integration transport and enforce access

packages/api/src/router/custom-widget/source-resolver.ts

@@ -1,42 +1,33 @@
-import { createHash } from "node:crypto";
 import { TRPCError } from "@trpc/server";
 
-import type { Session } from "@homarr/auth";
-import { decryptSecret } from "@homarr/common/server";
-import {
-  getAllTrustedCertificatesAsync,
-  getTrustedCertificateHostnamesAsync,
-} from "@homarr/core/infrastructure/certificates";
-import { createCustomCheckServerIdentity } from "@homarr/core/infrastructure/http";
-import type { Database } from "@homarr/db";
-import { eq } from "@homarr/db";
-import { integrations } from "@homarr/db/schema";
 import type { CustomJsxRequest, CustomWidgetSource } from "@homarr/custom-widgets/core";
-import { getCustomWidgetSourceAuthType } from "@homarr/custom-widgets/core";
+import { customWidgetIntegrationKinds, getCustomWidgetSourceAuthType } from "@homarr/custom-widgets/core";
 import type { CustomWidgetHttpRequest } from "@homarr/custom-widgets/server";
-import { getCustomWidgetIntegrationConnection } from "@homarr/integrations/custom-widget-source";
+import type { integrationHttpAuth } from "@homarr/integrations/http-auth";
 
-import { throwIfActionForbiddenAsync } from "../integration/integration-access";
+import type { IntegrationHttpContext } from "../integration/integration-http";
+import {
+  getIntegrationForHttpRequest,
+  getIntegrationHttpCacheVersion,
+  getIntegrationHttpConnection,
+} from "../integration/integration-http";
 
-interface SourceContext {
-  db: Database;
-  session: Session | null;
-}
+// Keep the portable schema's supported types within the server authentication adapters.
+customWidgetIntegrationKinds satisfies readonly (keyof typeof integrationHttpAuth)[];
 
 export async function assertCustomWidgetIntegrationBindings(
-  ctx: SourceContext,
+  ctx: IntegrationHttpContext,
   sources: Record<string, CustomWidgetSource>,
 ) {
   for (const source of Object.values(sources)) {
     if (source.type !== "integration" || !source.integrationId) continue;
-    await resolveIntegration(ctx, source, "full");
+    await resolveIntegration(ctx, source);
   }
 }
 
 async function resolveIntegration(
-  ctx: SourceContext,
+  ctx: IntegrationHttpContext,
   source: Extract<CustomWidgetSource, { type: "integration" }>,
-  permission: "use" | "interact" | "full",
 ) {
   if (!source.integrationId) {
     throw new TRPCError({
@@ -44,11 +35,7 @@ async function resolveIntegration(
       message: "Select an existing integration for this widget source",
     });
   }
-  await throwIfActionForbiddenAsync(ctx, eq(integrations.id, source.integrationId), permission);
-  const integration = await ctx.db.query.integrations.findFirst({
-    where: eq(integrations.id, source.integrationId),
-    with: { secrets: true },
-  });
+  const integration = await getIntegrationForHttpRequest(ctx, source.integrationId);
   if (!integration || integration.kind !== source.integrationKind) {
     throw new TRPCError({
       code: "PRECONDITION_FAILED",
@@ -59,12 +46,14 @@ async function resolveIntegration(
 }
 
 export async function resolveCustomWidgetSource(
-  ctx: SourceContext,
+  ctx: IntegrationHttpContext,
   source: CustomWidgetSource,
   request: Pick<CustomJsxRequest, "kind" | "method" | "auth">,
   getSecrets: () => Array<{ kind: string; value: string }>,
 ): Promise<
-  Pick<CustomWidgetHttpRequest, "baseUrl" | "networkScope" | "auth" | "tls" | "pathPrefix"> & { cacheVersion: string }
+  Pick<CustomWidgetHttpRequest, "baseUrl" | "networkScope" | "auth" | "tls" | "pathPrefix" | "redactSecrets"> & {
+    cacheVersion: string;
+  }
 > {
   if (source.type !== "integration") {
     const authType = getCustomWidgetSourceAuthType(source);
@@ -75,32 +64,26 @@ export async function resolveCustomWidgetSource(
     }
     return { baseUrl: source.baseUrl, networkScope: source.networkScope, auth, cacheVersion: "" };
   }
-  let permission = "use" as "use" | "interact" | "full";
-  if (request.kind === "action" || request.method !== "GET") permission = "interact";
-  if (request.method === "DELETE") permission = "full";
-  const integration = await resolveIntegration(ctx, source, permission);
-  const connection = getCustomWidgetIntegrationConnection({
-    ...integration,
-    externalUrl: null,
-    decryptedSecrets: integration.secrets.map(({ kind, value }) => ({ kind, value: decryptSecret(value) })),
-  });
-  let tls: CustomWidgetHttpRequest["tls"];
-  if (new URL(connection.baseUrl).protocol === "https:") {
-    const [ca, hostnames] = await Promise.all([
-      getAllTrustedCertificatesAsync(),
-      getTrustedCertificateHostnamesAsync(),
-    ]);
-    tls = { ca, checkServerIdentity: createCustomCheckServerIdentity(hostnames) };
-  }
+  const integration = await resolveIntegration(ctx, source);
+  const connection = await getIntegrationHttpConnection(integration);
   return {
     ...connection,
     auth: request.auth === "none" ? undefined : connection.auth,
-    networkScope: "loopback",
-    pathPrefix: new URL(connection.baseUrl).pathname,
-    tls,
-    cacheVersion: createHash("sha256")
-      .update(JSON.stringify([integration.id, integration.kind, integration.url, integration.secrets]))
-      .digest("hex")
-      .slice(0, 16),
   };
 }
+
+export async function getCustomWidgetIntegrationCacheVersions(
+  ctx: IntegrationHttpContext,
+  sources: Record<string, CustomWidgetSource>,
+) {
+  return Promise.all(
+    Object.entries(sources).flatMap(([sourceId, source]) => {
+      if (source.type !== "integration") return [];
+      return [
+        resolveIntegration(ctx, source)
+          .then((integration) => `${sourceId}:${getIntegrationHttpCacheVersion(integration)}`)
+          .catch(() => `${sourceId}:unavailable`),
+      ];
+    }),
+  );
+}