mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-09-19 05:12:16 +03:00
5d1f4687eb
Merged in the 2026-09-16 sweep of the maintainer's own open PRs, at the owner's explicit instruction. No push was made to the PR branch: the merge took the head as the owning session left it (verified OPEN, non-draft and MERGEABLE against the release tip immediately before merging).
25 lines
1.2 KiB
TypeScript
25 lines
1.2 KiB
TypeScript
import { resolveProxyForConnection } from "@/lib/db/settings";
|
|
import { hasBlockingProxyAssignment } from "@/lib/db/proxies";
|
|
|
|
/**
|
|
* #13470: fail-closed guard for the token-health-check sweep, mirroring the #6246
|
|
* contract the interactive chat/executor path enforces via
|
|
* `safeResolveProxy`/`hasBlockingProxyAssignment` (src/sse/handlers/chatHelpers.ts).
|
|
* Before this guard, the sweep called `resolveProxyForConnection` directly and a
|
|
* connection whose assigned proxy pool had gone fully dead resolved silently to
|
|
* direct/env-proxy egress — leaking the refresh-token exchange on the real IP.
|
|
* Callers must skip (log + return) rather than throw: this sweeps many connections
|
|
* per tick and one blocked connection must not abort the rest.
|
|
*/
|
|
export async function resolveGuardedProxyConfig(
|
|
connectionId: string,
|
|
provider?: string
|
|
): Promise<{ proxyConfig: unknown; blocked: boolean }> {
|
|
const resolved = (await resolveProxyForConnection(connectionId)) as { proxy?: unknown } | null;
|
|
const proxyConfig = resolved?.proxy ?? null;
|
|
if (!proxyConfig && hasBlockingProxyAssignment(connectionId, provider)) {
|
|
return { proxyConfig: null, blocked: true };
|
|
}
|
|
return { proxyConfig, blocked: false };
|
|
}
|