feat(apps): add MantisHub connector - #467
Open
biztex wants to merge 2 commits into
Open
Conversation
Testiny's REST API (app.testiny.io/api/v1) authenticates with an API key sent raw in the X-Api-Key header - no Bearer prefix - which no existing AuthStrategy covers. Add a generic Header variant that injects the credential into a provider-named header, and use it for the Testiny provider. The variant also unblocks other raw-header providers (e.g. MantisHub's raw Authorization token, onecli#298). The permission catalog mirrors Testiny's uniform CRUD: per-entity read and write tools for projects, test cases and folders, test runs, test plans, milestones, and comments, plus the POST /find query endpoints as a read tool. The finds travel as POST, so the GET-only read wildcard is deliberately not a superset (Jira JQL precedent); the write wildcard gates every mutating method under /api/v1/* and is a true superset. Closes onecli#422
MantisHub is hosted MantisBT on per-customer hosts (<name>.mantishub.io) whose REST API takes an API token raw in the Authorization header - no scheme prefix - exactly the shape the AuthStrategy::Header variant introduced for Testiny covers. Injection is gated to the connection's stored host via credential_host_field (the JFrog pattern), so a token never leaks to another tenant on the shared suffix. The permission catalog covers issues (incl. notes, tags, attachments, relationships), projects, filters, users, and config, with read and write umbrellas that are true supersets of their groups. Self-hosted MantisBT on arbitrary domains is out of scope until a user-supplied-host pattern lands (see onecli#374); *.mantishub.io is the whole MantisHub surface per the issue thread. Closes onecli#298
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
I have read the CONTRIBUTING.md file.
YES
What kind of change does this PR introduce?
Feature — a new app connector. Closes #298.
What is the current behavior?
MantisHub is not in the catalog. Its REST API authenticates with an API token sent raw in the
Authorizationheader — no Bearer prefix — on per-customer hosts (<name>.mantishub.io), which needs both the raw-header strategy from #466 and per-tenant host gating.What is the new behavior?
A MantisHub connector:
acme.mantishub.io), following the JFrog Artifactory two-field shape. The gateway injects the raw token viaAuthStrategy::Header { name: "authorization" }onHostPattern::Suffix(".mantishub.io"), gated to the connection's stored host withcredential_host_field— a token can never leak to another tenant on the shared suffix (same protection as JFrog).GET /api/rest/users/meagainst the stored host (validated against the*.mantishub.ioshape before any fetch); falls back to echoing the host.Additional context
*.mantishub.io, so that suffix is the whole surface. Self-hosted MantisBT on arbitrary domains (also raised in the thread) is deliberately out of scope until a user-supplied-host pattern exists (feat(gateway): add HostPattern::Env for self-hosted connector hosts #374 proposesHostPattern::Env); the connector is ready to grow that second host rule when it does.