feat(integration): add host-owned plugin delivery-origin authority - #205
feat(integration): add host-owned plugin delivery-origin authority#205seonghobae wants to merge 13 commits into
Conversation
📝 WalkthroughWalkthrough새로운 Changes플러그인 delivery-origin 권한
Estimated code review effort: 4 (Complex) | ~45 minutes Mergeability Score: ⚪ Minimal · up to The change adds host-controlled delivery-origin validation and persistence boundaries without introducing outbound network behavior. No actionable merge-blocking risk remains beyond normal review and checks. Sequence Diagram(s)sequenceDiagram
participant PluginDeliveryOriginAuthority
participant PluginInstallationAuthorityReader
participant PluginDeliveryOriginGrantStore
PluginDeliveryOriginAuthority->>PluginInstallationAuthorityReader: 활성 설치 권한 조회
PluginDeliveryOriginAuthority->>PluginDeliveryOriginGrantStore: 정규화된 HTTPS origin grant 저장
PluginDeliveryOriginGrantStore-->>PluginDeliveryOriginAuthority: durable grant 반환
PluginDeliveryOriginAuthority-->>PluginDeliveryOriginAuthority: 반환 결과 검증
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head24e363bf4432de4f7ee8d486285f56064d6c4581. -
Head SHA:
24e363bf4432de4f7ee8d486285f56064d6c4581 -
Workflow run: 31799111497
-
Workflow attempt: 1
Coverage evidence
Coverage evidence job did not run or did not publish coverage evidence.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (4 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (4 files)"]
R1 --> V1["required checks"]
OpenCode Review Overview
Pull request overviewOpenCode cannot approve yet because required coverage evidence did not pass. Review outcome1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
Coverage evidenceCoverage evidence job did not run or did not publish coverage evidence. Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (4 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (4 files)"]
R1 --> V1["required checks"]
|
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head24e363bf4432de4f7ee8d486285f56064d6c4581. -
Head SHA:
24e363bf4432de4f7ee8d486285f56064d6c4581 -
Workflow run: 31799111497
-
Workflow attempt: 2
Coverage evidence
Coverage evidence job did not run or did not publish coverage evidence.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (4 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (4 files)"]
R1 --> V1["required checks"]
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| * perform network delivery and therefore does not replace the later DNS/IP, | ||
| * redirect, proxy, timeout, byte-limit or connect-time egress enforcement. | ||
| */ | ||
| export class PluginDeliveryOriginAuthority { |
There was a problem hiding this comment.
🟡 New authority boundary missing changelog and architecture entry
This PR adds a new host-owned delivery-origin authority boundary but records no Unreleased entry in CHANGELOG.md and nothing in ARCHITECTURE.md, which AGENTS.md requires when a boundary changes. The comparable plugin-installation authority has both.
Prompt for agents
AGENTS.md and CLAUDE.md require CHANGELOG.md and ARCHITECTURE.md to be updated when a service boundary changes. This PR adds a new host-owned plugin delivery-origin authority boundary (apps/integration-service/src/plugin-delivery-origin-authority.ts) but neither file mentions it. Add an entry under CHANGELOG.md's Unreleased > Added describing the delivery-origin grant authority (versioned life-os.plugin-delivery-origin.v1 grants, exact HTTPS-origin validation, active-installation evidence requirement, scoped lookup/revocation), mirroring the existing plugin-installation authority entry, and record the new boundary in ARCHITECTURE.md.
Was this helpful? React with 👍 or 👎 to provide feedback.
| parsed.pathname !== '/' || | ||
| parsed.search !== '' || | ||
| parsed.hash !== '' || | ||
| parsed.origin === 'null' || |
There was a problem hiding this comment.
📝 Info: Unreachable origin==='null' guard
In normalizeOrigin, the parsed.origin === 'null' guard cannot be true once parsed.protocol === 'https:' is required; HTTPS origins are never the string null. Harmless dead code, but it would break the 100% branch-coverage gate AGENTS.md mandates if this package ever runs --coverage (its test script currently does not).
Was this helpful? React with 👍 or 👎 to provide feedback.
| function sameActiveGrant( | ||
| durable: PluginDeliveryOriginGrantRecord, | ||
| candidate: PluginDeliveryOriginGrantRecord, | ||
| ): boolean { | ||
| return ( | ||
| durable.authorityVersion === candidate.authorityVersion && | ||
| durable.grantId === candidate.grantId && | ||
| durable.installationId === candidate.installationId && | ||
| durable.workspaceId === candidate.workspaceId && | ||
| durable.grantedByUserId === candidate.grantedByUserId && | ||
| durable.origin === candidate.origin && | ||
| durable.status === 'active' && | ||
| durable.revokedAt === null | ||
| ); | ||
| } |
There was a problem hiding this comment.
📝 Info: Replay equality intentionally omits grantedAt
sameActiveGrant compares identity plus origin and requires the durable winner to be active, deliberately ignoring grantedAt even though grant computes a fresh one per call. This lets an exact replay succeed and still fails closed on a revoked or origin-conflicting winner. Noted so a future change does not add a grantedAt comparison and break idempotent replay.
Was this helpful? React with 👍 or 👎 to provide feedback.
1 participant
Buyer/security outcome
Advance #130 with an explicit host-owned authority boundary for plugin outbound destinations before any network client is introduced. A plugin manifest remains intent only: it cannot self-authorize an origin.
Scope
life-os.plugin-delivery-origin.v1grant records scoped to opaque UUIDv4 grant, installation, workspace, and granting user identities;This slice deliberately does not perform outbound HTTP. DNS/IP rebinding resistance, connect-time address enforcement, redirect/proxy policy, bounded timeouts/bytes, retry/dead-letter, durable PostgreSQL grant storage, and operator HTTP composition remain later #130 slices and must not be inferred as implemented here.
Test-first evidence
The branch preserves RED commit
70ae35d46841da1f33768ff44920605a9c4bffaa, which defines the host delivery-origin authority before the production module exists. Implementation follows in73958742aa8f6a861bcb34a7e7fbe5922b982ac7.Exact-head CI/security/review and live-base compatibility remain authoritative; no predecessor evidence transfers.
Summary by CodeRabbit
새로운 기능
테스트