feat(connectors): GTIN/barcode lookup adapter + fix stale authConfig on env-var updates#386
Merged
Merged
Conversation
…on env-var updates GTIN / Barcode Lookup (intl/gtin-lookup): resolve GTIN/EAN/UPC/ISBN barcodes via four free public databases — Open Food Facts (food/CPG), UPCitemdb (general retail), Open Beauty Facts (cosmetics), Google Books (ISBN). No credentials required; every tool opts into the proxy (useProxy) because these sources rate-limit per client IP. Verified live (Nutella EAN, Diet Coke UPC, keyword search). Ships a live spec with always-on static checks. Credential handling fix (found debugging an MFR 401 in production): - PUT /connectors/:id/env-vars only updated env_vars, while BASIC_AUTH & co. authenticate from the encrypted auth_config frozen at import — so editing credentials in the UI silently had no effect on auth. For catalog-installed connectors, re-resolve authConfig/baseUrl/headers from the adapter template with the merged env vars on every update. - Trim credential values at adapter import and env-var update: a pasted leading space in MFR_USERNAME was encrypted into auth_config and produced 401s that were invisible in the UI.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Skip __proto__/constructor/prototype keys when trimming credential and env-var values, resolving CodeQL js/remote-property-injection alerts.
Object.create(null) is the canonical sanitizer for CodeQL js/remote-property-injection — removes the prototype-pollution sink.
Avoids the dynamic user-keyed property write that CodeQL flags as js/remote-property-injection, while still trimming credential values.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
1. New adapter: GTIN / Barcode Lookup (
intl/gtin-lookup)Resolve GTIN / EAN / UPC / ISBN barcodes to product data via four free public databases — no API key needed:
gtin_lookup_food/_search_foodgtin_lookup_retail/_search_retailgtin_lookup_beautygtin_lookup_bookEvery tool sets
useProxy: true— these sources rate-limit per client IP (UPCitemdb ~100/day/IP, Google Books shared anonymous quota), so proxy routing is the point. Verified live (Nutella EAN 3017620422003, Diet Coke UPC, keyword search). Shipsgtin-lookup.live.spec.ts.2. Credential fix (root-caused from an MFR 401 in production)
A user fixed a mistyped
MFR_USERNAME(leading space) in the UI, but requests kept failing with 401 while Postman worked. Cause, verified by decrypting the prod record:PUT /connectors/:id/env-varsonly writesenv_vars, while BASIC_AUTH & co. authenticate from the encryptedauth_configfrozen at import — the UI showed the corrected value, auth kept using the stale one (1demo@…, hex20prefix).updateEnvVarsnow re-resolvesauthConfig/baseUrl/headersfrom the catalog adapter template with the merged env vars (catalog-installed connectors only;update()re-encrypts).The affected prod record was already hot-fixed by re-encrypting
auth_configwith the trimmed username.