Repository navigation
Conversation
🦋 Changeset detectedLatest commit: 89b4faa The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
There was a problem hiding this comment.
Pull request overview
Adds permission-downgraded API-key and request-context forwarding for MOS API routes.
Changes:
- Uses
PublicBearerauthentication for MOS API requests. - Adds identity and client metadata headers to custom endpoints.
- Adds three authenticated API routes and expanded tests.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
.changeset/thick-icons-greet.md |
Documents the minor release. |
src/MOSProxy.ts |
Passes metadata providers to custom endpoints. |
src/MOSProxyBuilder.ts |
Registers additional MOS API routes. |
src/stages/customEndpoint.ts |
Forwards key, identity, and client metadata. |
src/stages/mosAuthenticatedApi.ts |
Uses PublicBearer authorization. |
test/MOSProxy.spec.ts |
Tests authenticated routes and authorization. |
test/stages/customEndpoint.spec.ts |
Tests custom-endpoint forwarding headers. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
429ad4e to
89b4faa
Compare
heinvde-mos
left a comment
heinvde-mos
left a comment
There was a problem hiding this comment.
Two things that I'm unsure of to be honest, thought I'd flag it for incase.
| const apiRequest = new Request(target, request) | ||
| setMosProxyHeaders(apiRequest.headers) | ||
| apiRequest.headers.set('x-mos-key', `PublicBearer ${config.mosSecretKey}`) | ||
| apiRequest.headers.set('x-mos-endpoint-request-context', JSON.stringify({ identity, clientMetadata })) |
There was a problem hiding this comment.
And maybe user agent? Middleware might use it. The authenticatedApi thing gets it from request.headers.get('User-Agent').
There was a problem hiding this comment.
user agent, and all the other headers, will be as-is from the original request :)
to be merged after BE changes