pastilhasandClaude Opus 5
edf26323da
wraps the self-hosted memos instance, same shape as transmission and slskd. no schema change was needed: service_connections already says `service` is text because "adding a service should not be a schema change", and memos is the one-instance-per-owner case that table was built for. the sidecar holds the url and the personal access token; the platform side is 16 lines of createSidecarProxy and holds neither. /_api/* is a pass-through onto the instance's own /api/v1 rather than a hand-written wrapper per endpoint — memos generates its rest api from protobufs and it moves between minor versions, so re-describing it here would be a second thing to keep in sync. the allow-list is the one piece of policy, and it keeps this from being a general ssrf hop. auth routes are excluded: signin/signout would mint sessions on the instance, and this authenticates with a stored token. probing is two calls on purpose. /healthz answers unauthenticated, so a bad url is distinguishable from a bad token — memos returns 200 and an empty list for unauthenticated reads rather than 401, so "the list came back" proves nothing. verified against the live container: unconfigured reports not-connected, a bad token is rejected WITH the reason and nothing is stored, and the platform mount 401s without a session. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
17 lines
574 B
TypeScript
17 lines
574 B
TypeScript
import { createSidecarProxy } from '../../sidecar/create-proxy';
|
|
|
|
// /api/memos/* — auth, then forward to officer-memos. No routes of its own and no Memos knowledge:
|
|
// this file must never grow app logic.
|
|
//
|
|
// The sidecar owns the Memos contract and holds the personal access token. The platform knows neither.
|
|
|
|
const proxy = createSidecarProxy({
|
|
name: 'memos',
|
|
prefix: '/api/memos',
|
|
});
|
|
|
|
export const memosRouter = proxy.router;
|
|
|
|
/** Base URL of the sidecar's HTTP server, or null if it hasn't reported in yet. */
|
|
export const getMemosServerUrl = proxy.getHttpUrl;
|