feat(contributor): implement header forwarding and proxying for remote page requests

Author: juicycleff

extensions/dashboard/contributor/remote.go

@@ -20,6 +20,49 @@ type RemoteContributor struct {
 	lastFetch time.Time
 }
 
+// forwardedHeadersKey is the context key the proxy uses to pass through
+// inbound-request headers (typically `Authorization` and `Cookie`) on
+// the server-to-server call to a remote contributor. Without this, the
+// remote sees an unauthenticated S2S request and cannot identify the
+// end user — that breaks any contributor handler that needs the
+// caller's identity (e.g. authsome's dashboard "Create API Key" form,
+// which binds the new key to the dashboard user's UserID).
+type forwardedHeadersKey struct{}
+
+// WithForwardedHeaders returns a derived context that carries the
+// supplied headers; RemoteContributor.send forwards a fixed allowlist
+// of them (Authorization, Cookie) on the outbound HTTP request. Pass
+// the inbound *http.Request.Header verbatim — only the allowlisted
+// keys are forwarded, so unrelated headers (Host, Content-Length, …)
+// are not leaked.
+//
+// Trust model: the host explicitly registers a remote contributor via
+// WatchRemoteContributor / AddRemoteContributor, so forwarding the
+// end user's auth to that registered URL is in-scope of an existing
+// trust boundary. Do NOT forward to arbitrary URLs.
+func WithForwardedHeaders(ctx context.Context, h http.Header) context.Context {
+	if h == nil {
+		return ctx
+	}
+
+	return context.WithValue(ctx, forwardedHeadersKey{}, h.Clone())
+}
+
+// forwardedHeadersFrom returns the forwarded headers attached to ctx,
+// or nil if none were set.
+func forwardedHeadersFrom(ctx context.Context) http.Header {
+	v, _ := ctx.Value(forwardedHeadersKey{}).(http.Header) //nolint:errcheck // type-safe via key
+
+	return v
+}
+
+// forwardableHeaderNames lists the inbound headers RemoteContributor
+// will forward on S2S calls. Authorization carries Bearer tokens (JWT
+// or session), Cookie carries the host-side session cookie when the
+// dashboard uses cookie auth. Anything else is dropped to avoid
+// leaking unrelated request metadata to the remote.
+var forwardableHeaderNames = []string{"Authorization", "Cookie"}
+
 // RemoteContributorOption configures a RemoteContributor.
 type RemoteContributorOption func(*RemoteContributor)
 
@@ -77,6 +120,20 @@ func (rc *RemoteContributor) FetchPage(ctx context.Context, route, rawQuery stri
 	return rc.fetch(ctx, url)
 }
 
+// PostPage forwards a POST to the remote contributor's page endpoint.
+// Used to proxy form submissions from the host dashboard. The remote handler
+// re-renders the page with FormData populated from the parsed body. body and
+// contentType come straight from the inbound request — typically
+// application/x-www-form-urlencoded or multipart/form-data.
+func (rc *RemoteContributor) PostPage(ctx context.Context, route, rawQuery string, body io.Reader, contentType string) ([]byte, error) {
+	url := rc.baseURL + "/_forge/dashboard/pages" + route
+	if rawQuery != "" {
+		url += "?" + rawQuery
+	}
+
+	return rc.send(ctx, http.MethodPost, url, body, contentType)
+}
+
 // FetchWidget fetches an HTML widget fragment from the remote service.
 func (rc *RemoteContributor) FetchWidget(ctx context.Context, widgetID string) ([]byte, error) {
 	url := rc.baseURL + "/_forge/dashboard/widgets/" + widgetID
@@ -91,9 +148,15 @@ func (rc *RemoteContributor) FetchSettings(ctx context.Context, settingID string
 	return rc.fetch(ctx, url)
 }
 
-// fetch makes an authenticated HTTP request and returns the response body.
+// fetch makes an authenticated GET request and returns the response body.
 func (rc *RemoteContributor) fetch(ctx context.Context, url string) ([]byte, error) {
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	return rc.send(ctx, http.MethodGet, url, nil, "")
+}
+
+// send executes an authenticated request against the remote contributor's
+// protocol with the given method/body. Returns the response body bytes.
+func (rc *RemoteContributor) send(ctx context.Context, method, url string, body io.Reader, contentType string) ([]byte, error) {
+	req, err := http.NewRequestWithContext(ctx, method, url, body)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create request: %w", err)
 	}
@@ -102,10 +165,28 @@ func (rc *RemoteContributor) fetch(ctx context.Context, url string) ([]byte, err
 	req.Header.Set("X-Forge-Dashboard", "true")
 	req.Header.Set("Accept", "text/html")
 
+	if contentType != "" {
+		req.Header.Set("Content-Type", contentType)
+	}
+
 	if rc.apiKey != "" {
 		req.Header.Set("X-Forge-Api-Key", rc.apiKey)
 	}
 
+	// Forward the allowlisted inbound headers (e.g. Authorization,
+	// Cookie) when the host has populated them via
+	// WithForwardedHeaders. The remote contributor's auth middleware
+	// reads these to resolve the end user — without it, S2S calls
+	// from the host arrive unauthenticated and any handler that
+	// needs a UserID has no choice but to fail or fabricate one.
+	if fwd := forwardedHeadersFrom(ctx); fwd != nil {
+		for _, name := range forwardableHeaderNames {
+			if v := fwd.Get(name); v != "" {
+				req.Header.Set(name, v)
+			}
+		}
+	}
+
 	resp, err := rc.client.Do(req)
 	if err != nil {
 		return nil, fmt.Errorf("remote request failed: %w", err)
@@ -116,14 +197,14 @@ func (rc *RemoteContributor) fetch(ctx context.Context, url string) ([]byte, err
 		return nil, fmt.Errorf("remote returned status %d for %s", resp.StatusCode, url)
 	}
 
-	body, err := io.ReadAll(io.LimitReader(resp.Body, 5*1024*1024)) // 5MB limit
+	respBody, err := io.ReadAll(io.LimitReader(resp.Body, 5*1024*1024)) // 5MB limit
 	if err != nil {
 		return nil, fmt.Errorf("failed to read response body: %w", err)
 	}
 
 	rc.lastFetch = time.Now()
 
-	return body, nil
+	return respBody, nil
 }
 
 // FetchManifest fetches the dashboard manifest from a remote service URL.

extensions/dashboard/contributor/remote_test.go

@@ -3,10 +3,12 @@ package contributor
 import (
 	"context"
 	"encoding/json"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 	"time"
 )
@@ -105,6 +107,56 @@ func TestRemoteContributor_FetchPage_PropagatesAPIKey(t *testing.T) {
 	}
 }
 
+// TestRemoteContributor_ForwardsAuthAndCookie pins the user-identity
+// forwarding contract: when the host attaches inbound headers via
+// WithForwardedHeaders, the S2S request to the remote MUST carry the
+// allowlisted Authorization and Cookie headers and MUST NOT carry
+// other inbound headers (Host metadata, custom internal markers,
+// etc.) that would leak unrelated request context.
+func TestRemoteContributor_ForwardsAuthAndCookie(t *testing.T) {
+	rs := newRecorderServer(t)
+	rc := NewRemoteContributor(rs.server.URL, &Manifest{Name: "authsome"})
+
+	inbound := http.Header{}
+	inbound.Set("Authorization", "Bearer user-tok-abc")
+	inbound.Set("Cookie", "authsome_session_token=cookie-val")
+	inbound.Set("X-Internal-Trace", "should-not-be-forwarded")
+
+	ctx := WithForwardedHeaders(context.Background(), inbound)
+
+	if _, err := rc.FetchPage(ctx, "/users", ""); err != nil {
+		t.Fatalf("FetchPage: %v", err)
+	}
+
+	if got, want := rs.lastHeaders.Get("Authorization"), "Bearer user-tok-abc"; got != want {
+		t.Fatalf("Authorization = %q, want %q", got, want)
+	}
+	if got, want := rs.lastHeaders.Get("Cookie"), "authsome_session_token=cookie-val"; got != want {
+		t.Fatalf("Cookie = %q, want %q", got, want)
+	}
+	if got := rs.lastHeaders.Get("X-Internal-Trace"); got != "" {
+		t.Fatalf("X-Internal-Trace must not be forwarded; got %q", got)
+	}
+}
+
+// TestRemoteContributor_NoForwardedHeaders pins backward compat: with
+// no WithForwardedHeaders on the context, the outbound request must
+// not carry an Authorization header (which would otherwise leak from
+// some unrelated source). This is the historical behaviour every
+// existing caller relies on.
+func TestRemoteContributor_NoForwardedHeaders(t *testing.T) {
+	rs := newRecorderServer(t)
+	rc := NewRemoteContributor(rs.server.URL, &Manifest{Name: "authsome"})
+
+	if _, err := rc.FetchPage(context.Background(), "/users", ""); err != nil {
+		t.Fatalf("FetchPage: %v", err)
+	}
+
+	if got := rs.lastHeaders.Get("Authorization"); got != "" {
+		t.Fatalf("Authorization must be empty without WithForwardedHeaders; got %q", got)
+	}
+}
+
 func TestRemoteContributor_FetchPage_ErrorOnNon2xx(t *testing.T) {
 	rs := newRecorderServer(t)
 	rs.respond = func(w http.ResponseWriter, _ *http.Request) {
@@ -119,6 +171,53 @@ func TestRemoteContributor_FetchPage_ErrorOnNon2xx(t *testing.T) {
 	}
 }
 
+func TestRemoteContributor_PostPage_ForwardsBodyAndContentType(t *testing.T) {
+	rs := newRecorderServer(t)
+
+	var seenBody []byte
+	var seenMethod, seenContentType string
+
+	rs.respond = func(w http.ResponseWriter, r *http.Request) {
+		seenMethod = r.Method
+		seenContentType = r.Header.Get("Content-Type")
+		seenBody, _ = io.ReadAll(r.Body)
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+		_, _ = w.Write([]byte("<div>posted</div>"))
+	}
+
+	rc := NewRemoteContributor(rs.server.URL, &Manifest{Name: "authsome"})
+
+	body := strings.NewReader("name=alice&role=admin")
+	got, err := rc.PostPage(context.Background(), "/users/create", "id=ausr_1", body, "application/x-www-form-urlencoded")
+	if err != nil {
+		t.Fatalf("PostPage: %v", err)
+	}
+
+	if string(got) != "<div>posted</div>" {
+		t.Fatalf("response = %q, want <div>posted</div>", got)
+	}
+
+	if seenMethod != http.MethodPost {
+		t.Errorf("upstream method = %q, want POST", seenMethod)
+	}
+
+	if got, want := rs.lastPath, "/_forge/dashboard/pages/users/create"; got != want {
+		t.Errorf("path = %q, want %q", got, want)
+	}
+
+	if got, want := rs.lastQuery, "id=ausr_1"; got != want {
+		t.Errorf("query = %q, want %q", got, want)
+	}
+
+	if seenContentType != "application/x-www-form-urlencoded" {
+		t.Errorf("Content-Type = %q, want application/x-www-form-urlencoded", seenContentType)
+	}
+
+	if got, want := string(seenBody), "name=alice&role=admin"; got != want {
+		t.Errorf("body = %q, want %q", got, want)
+	}
+}
+
 func TestRemoteContributor_FetchPage_ContextCancelled(t *testing.T) {
 	rs := newRecorderServer(t)
 	rs.respond = func(w http.ResponseWriter, r *http.Request) {

extensions/dashboard/discovery/integration.go

@@ -362,7 +362,6 @@ func (i *Integration) refreshRemoteService(ctx context.Context, inst *ServiceIns
 	)
 }
 
-
 // TrackedCount returns the number of tracked remote contributors.
 func (i *Integration) TrackedCount() int {
 	i.mu.Lock()

extensions/dashboard/pages/pages.go

@@ -263,7 +263,7 @@ func (pm *PagesManager) remoteExtensionHandler(contribName string) router.PageHa
 		pageBase := fmt.Sprintf("%s/remote/%s/pages", pm.basePath, contribName)
 		fetchQuery := buildProxyFetchQuery(ctx.Request.URL.RawQuery, pm.basePath, pageBase)
 
-		data, err := pm.fragmentProxy.FetchPage(ctx.Context(), contribName, route, fetchQuery)
+		data, err := proxyToRemote(ctx, pm.fragmentProxy, contribName, route, fetchQuery)
 		if err != nil {
 			return uipages.ErrorPage(502, "Remote Unavailable", //nolint:nilerr // surface as page rather than propagating
 				"Failed to load page from remote extension '"+contribName+"': "+err.Error(),
@@ -274,6 +274,31 @@ func (pm *PagesManager) remoteExtensionHandler(contribName string) router.PageHa
 	}
 }
 
+// proxyToRemote forwards a host page request (GET or POST) to a remote
+// contributor via the FragmentProxy. POSTs route through PostPage so the
+// inbound body + content-type reach the upstream's form handler; GETs use
+// the cached FetchPage.
+//
+// The inbound request's Authorization and Cookie headers are forwarded
+// to the remote via contributor.WithForwardedHeaders so handlers there
+// can identify the end user (the registered remote is already a
+// trusted target — the host registered it explicitly via
+// WatchRemoteContributor / AddRemoteContributor).
+func proxyToRemote(ctx *router.PageContext, fp *proxy.FragmentProxy, name, route, query string) ([]byte, error) {
+	fwdCtx := contributor.WithForwardedHeaders(ctx.Context(), ctx.Request.Header)
+
+	if ctx.Request.Method == http.MethodPost {
+		contentType := ctx.Request.Header.Get("Content-Type")
+		// We pass the raw body through. The upstream's POST handler is
+		// responsible for parsing the form (whether url-encoded or
+		// multipart). Closing of the body is handled by the http.Request
+		// lifecycle on the host side.
+		return fp.PostPage(fwdCtx, name, route, query, ctx.Request.Body, contentType)
+	}
+
+	return fp.FetchPage(fwdCtx, name, route, query)
+}
+
 // buildProxyFetchQuery merges the user's incoming query string with the
 // reserved bp (basePath) and pb (pageBase) parameters that contributor
 // protocol handlers consume to render correctly-prefixed links back to the
@@ -712,7 +737,7 @@ func (pm *PagesManager) RemotePage(ctx *router.PageContext) (templ.Component, er
 	pageBase := fmt.Sprintf("%s/remote/%s/pages", pm.basePath, name)
 	fetchQuery := buildProxyFetchQuery(ctx.Request.URL.RawQuery, pm.basePath, pageBase)
 
-	data, err := pm.fragmentProxy.FetchPage(ctx.Context(), name, route, fetchQuery)
+	data, err := proxyToRemote(ctx, pm.fragmentProxy, name, route, fetchQuery)
 	if err != nil {
 		return uipages.ErrorPage(502, "Remote Unavailable", //nolint:nilerr // render error page instead of propagating
 			"Failed to load page from remote extension '"+name+"': "+err.Error(),