Skip to content

fix(api): bound and quiet the routes that answer before any credential - #2563

Merged
Makisuo merged 2 commits into
mainfrom
sec/public-surface-bounds
Nov 13, 2026
Merged

fix(api): bound and quiet the routes that answer before any credential#2563
Makisuo merged 2 commits into
mainfrom
sec/public-surface-bounds

fix(web): match the proxy's reference-page exclusion on the path the …

2fe6e0a
Select commit
Loading
Failed to load commit list.
Maple Review Bot / Maple / review succeeded Nov 13, 2026 in 1m 21s

Confidence 10/10 · No issues found

🟢 Confidence 10/10 · safe to merge. Small, contained hardening pinned by new tests in each touched route; the proxy exclusion matches the two reference paths the API registers today.
no findings · tests covered · risk medium

Bounds pre-auth request bodies, pins Scalar's viewer version, keeps the API's reference pages off the web proxy and escapes the org name in the Slack welcome. Neither VcsWebhookEnqueueFailure nor McpOAuthProtocolError is fixed: the diff only changes the latter's message text.

  • readBoundedText caps OAuth bodies at 64 KB and PlanetScale deliveries at 1 MB
  • The webhook refuses an unsigned delivery before reading its body
  • apiProxyPath leaves /docs and /v2/docs to the API origin
  • Persistence errors answer with a fixed message; Scalar is pinned to 1.76.4

Production impact

Open errors in the changed files (2)
Issue Service Occurrences File
@maple/api/routes/VcsWebhookEnqueueFailure (2 issues) maple-api 9 apps/api/src/runtime/http-graph.ts
@maple/backend/errors/McpOAuthProtocolError maple-api 4 apps/api/src/runtime/http-graph.ts

After this merges, Maple checks whether they stop.

Production traffic of the changed files (last 7 days)
File Calls/day Busiest operations
apps/api/src/routes/oauth-discovery.http.ts 681 McpOAuthRouter.toWebRequest 342/day, 0.0% err
McpOAuthRouter.readForm 339/day, 0.0% err
Telemetry this change adds and removes (2)
  • ➖ span name McpOAuthRouter.toWebRequest (~342/day today) · apps/api/src/routes/oauth-discovery.http.ts:66
  • ➕ span name McpOAuthRouter.readBody · apps/api/src/routes/oauth-discovery.http.ts:69
What was checked
  • Exclusion normalizes the way the router reads it: ; suffix cut, decodeURI, trailing slashes dropped (apps/web/src/api-proxy.ts:11)
  • makeDbExecute already logs the driver message the two persistence errors stopped carrying (packages/backend/src/platform/db-execute.ts:68)
  • orgName is string | null, so === null keeps the old ?? fallback (packages/backend/src/services/support/SupportChannelService.ts:331)

2fe6e0a · Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.

View more details on Maple Review Bot