@@ -8,7 +8,12 @@ import {
88import { createServer as createHttpsServer } from "node:https";
99import type { TlsOptions } from "node:tls";
1010import type { WebSocketServer } from "ws";
11-import { A2UI_PATH, CANVAS_WS_PATH, handleA2uiHttpRequest } from "../canvas-host/a2ui.js";
11+import {
12+A2UI_PATH,
13+CANVAS_HOST_PATH,
14+CANVAS_WS_PATH,
15+handleA2uiHttpRequest,
16+} from "../canvas-host/a2ui.js";
1217import type { CanvasHostHandler } from "../canvas-host/server.js";
1318import { resolveBundledChannelGatewayAuthBypassPaths } from "../channels/plugins/gateway-auth-bypass.js";
1419import { loadConfig } from "../config/config.js";
@@ -56,17 +61,10 @@ import {
5661resolveHookChannel,
5762resolveHookDeliver,
5863} from "./hooks.js";
59-import {
60-type AuthorizedGatewayHttpRequest,
61-authorizeGatewayHttpRequestOrReply,
62-getBearerToken,
63-resolveHttpBrowserOriginPolicy,
64-} from "./http-auth-utils.js";
64+import type { AuthorizedGatewayHttpRequest } from "./http-auth-utils.js";
6565import { sendGatewayAuthFailure, setDefaultSecurityHeaders } from "./http-common.js";
6666import { resolveRequestClientIp } from "./net.js";
6767import { DEDUPE_MAX, DEDUPE_TTL_MS } from "./server-constants.js";
68-import { authorizeCanvasRequest, isCanvasPath } from "./server/http-auth.js";
69-import { resolvePluginRouteRuntimeOperatorScopes } from "./server/plugin-route-runtime-scopes.js";
7068import {
7169isProtectedPluginRoutePathFromContext,
7270resolvePluginRoutePathContext,
@@ -109,6 +107,11 @@ let toolsInvokeHttpModulePromise: Promise<typeof import("./tools-invoke-http.js"
109107let voiceClawRealtimeUpgradeModulePromise:
110108| Promise<typeof import("./voiceclaw-realtime/upgrade.js")>
111109| undefined;
110+let canvasAuthModulePromise: Promise<typeof import("./server/http-auth.js")> | undefined;
111+let httpAuthUtilsModulePromise: Promise<typeof import("./http-auth-utils.js")> | undefined;
112+let pluginRouteRuntimeScopesModulePromise:
113+| Promise<typeof import("./server/plugin-route-runtime-scopes.js")>
114+| undefined;
112115113116function getIdentityAvatarModule() {
114117identityAvatarModulePromise ??= import("../agents/identity-avatar.js");
@@ -165,6 +168,21 @@ function getVoiceClawRealtimeUpgradeModule() {
165168return voiceClawRealtimeUpgradeModulePromise;
166169}
167170171+function getCanvasAuthModule() {
172+canvasAuthModulePromise ??= import("./server/http-auth.js");
173+return canvasAuthModulePromise;
174+}
175+176+function getHttpAuthUtilsModule() {
177+httpAuthUtilsModulePromise ??= import("./http-auth-utils.js");
178+return httpAuthUtilsModulePromise;
179+}
180+181+function getPluginRouteRuntimeScopesModule() {
182+pluginRouteRuntimeScopesModulePromise ??= import("./server/plugin-route-runtime-scopes.js");
183+return pluginRouteRuntimeScopesModulePromise;
184+}
185+168186type HookDispatchers = {
169187dispatchWakeHook: (value: { text: string; mode: "now" | "next-heartbeat" }) => void;
170188dispatchAgentHook: (value: HookAgentDispatchPayload) => string;
@@ -283,6 +301,16 @@ function isA2uiPath(pathname: string): boolean {
283301return pathname === A2UI_PATH || pathname.startsWith(`${A2UI_PATH}/`);
284302}
285303304+function isCanvasPath(pathname: string): boolean {
305+return (
306+pathname === A2UI_PATH ||
307+pathname.startsWith(`${A2UI_PATH}/`) ||
308+pathname === CANVAS_HOST_PATH ||
309+pathname.startsWith(`${CANVAS_HOST_PATH}/`) ||
310+pathname === CANVAS_WS_PATH
311+);
312+}
313+286314function shouldEnforceDefaultPluginGatewayAuth(pathContext: PluginRoutePathContext): boolean {
287315return (
288316pathContext.malformedEncoding ||
@@ -304,6 +332,7 @@ async function canRevealReadinessDetails(params: {
304332return false;
305333}
306334335+const { getBearerToken, resolveHttpBrowserOriginPolicy } = await getHttpAuthUtilsModule();
307336const bearerToken = getBearerToken(params.req);
308337const authResult = await authorizeHttpGatewayConnect({
309338auth: params.resolvedAuth,
@@ -474,6 +503,7 @@ function buildPluginRequestStages(params: {
474503if ((await params.getGatewayAuthBypassPaths()).has(params.requestPath)) {
475504return false;
476505}
506+const { authorizeGatewayHttpRequestOrReply } = await getHttpAuthUtilsModule();
477507const requestAuth = await authorizeGatewayHttpRequestOrReply({
478508req: params.req,
479509res: params.res,
@@ -487,6 +517,8 @@ function buildPluginRequestStages(params: {
487517}
488518pluginGatewayAuthSatisfied = true;
489519pluginGatewayRequestAuth = requestAuth;
520+const { resolvePluginRouteRuntimeOperatorScopes } =
521+await getPluginRouteRuntimeScopesModule();
490522pluginRequestOperatorScopes = resolvePluginRouteRuntimeOperatorScopes(
491523params.req,
492524requestAuth,
@@ -1092,6 +1124,7 @@ export function createGatewayHttpServer(opts: {
10921124if (!isCanvasPath(scopedRequestPath)) {
10931125return false;
10941126}
1127+const { authorizeCanvasRequest } = await getCanvasAuthModule();
10951128const ok = await authorizeCanvasRequest({
10961129 req,
10971130auth: resolvedAuth,
@@ -1258,6 +1291,7 @@ export function attachGatewayUpgradeHandler(opts: {
12581291const url = new URL(req.url ?? "/", "http://localhost");
12591292if (canvasHost) {
12601293if (url.pathname === CANVAS_WS_PATH) {
1294+const { authorizeCanvasRequest } = await getCanvasAuthModule();
12611295const ok = await authorizeCanvasRequest({
12621296 req,
12631297auth: resolvedAuth,
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。