Dev-feedback fixes + HTTP/HTTPS TLS via Certificates module - #42
Merged
Conversation
…ssage back-nav
Three issues surfaced from local dev use:
- CRITICAL: the seeded global preprocessor ran `return message;`, but the sandbox
global is `msg` (not `message`, a Mirth-ism) — so EVERY message in EVERY channel
failed at the global-preprocessor stage with "ReferenceError: message is not
defined". Fixed the seed (seed-showcase.ts) to `return msg;` with a comment
listing the real globals; also patched the running dev DB row.
- The engine tsconfig excluded `*.test.ts` but not `*.itest.ts` / the suffix-less
`gates.ts`, so `pnpm dev`'s `tsc --watch` compiled the integration-lane files and
flashed 12 errors on first pass. Excluded `src/__tests__/integration/**`.
- The message view's "Back to Channel" button (and breadcrumb) navigated to the
channel EDITOR, which is nonsensical from a message list. Repointed to the
Dashboard ("Back to Dashboard") and fixed the breadcrumb (Dashboard > name > Messages).
Full recursive build green.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F1ad6jb5mCYxzFVXHbksqi
`db:seed` created example channels but no messages, so the message browser was empty. Adds seed-example-messages.ts: 25 sample messages across the 11 example channels, written through the real MessageService write-path (RAW + TRANSFORMED + per-destination SENT/RESPONSE/PROCESSING_ERROR, correct connector statuses and stats). Includes non-happy paths (FILTERED source, ERROR destinations, dest-level FILTERED) and a correlated A→B cascade (HL7 ADT Router → HL7 to JSON share a correlation id, visible across both browsers). Idempotent per channel; wired into run-seed after seedShowcase. Obviously-fake data (DOE^JOHN / TEST12345). Integration test (mirthless_test): 4/4 green — rows land, non-happy paths, cascade correlation, second-run no-op. Ran against the dev DB to populate it. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F1ad6jb5mCYxzFVXHbksqi
The HTTP connector did TLS only via raw PEM pasted into connector props, with no mode toggle and no link to the (fully-built but unused) Certificates module. Now: - Explicit HTTP/HTTPS mode on both the HTTP source and destination. In HTTPS mode the UI shows certificate PICKERS (CertificateSelect, backed by the certificates list) instead of PEM textareas — hard cut: connector props store cert-ID references only (dest: caCertId/clientCertId/rejectUnauthorized; source: serverCertId/caCertId/requireClientCert). - Server-side resolution at deploy time (connector-tls-resolver.ts): id -> PEM via the new server-internal CertificateService.getMaterialById (returns the private key; NOT wired to any route — verified). engine.ts resolves HTTP source/dest cert-IDs before building the connector and FAILS THE DEPLOY loudly on a missing/ invalid id or a client/server cert with no private key. Output keys match tls.ts readTls*Options exactly. - CertificateService.list now projects hasPrivateKey (computed SQL boolean; key bytes never selected) so pickers can require a key for server/client certs. - Test Connection for HTTPS resolves the selected certs and does a real node:https handshake (honors ca/cert/key/rejectUnauthorized), including the SOURCE-mode fix. - http-dispatcher: scheme==='HTTPS' is authoritative for the TLS path (absent scheme keeps legacy URL inference — existing tests untouched). - eslint: ignore *.d.ts (ambient declaration files legitimately use `declare var`). Verified: pnpm -r build clean; pnpm lint clean; resolver+cert+connection-test 98, http connectors 35, web TLS forms 19 — all green. Built via orchestrated workflow (server spine -> web -> adversarial verify pass, which caught + fixed the HTTPS source Test-Connection defect). Owner decisions: both sides, hard cut, real-handshake test. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F1ad6jb5mCYxzFVXHbksqi
…OADMAP Commit the prior-session gap analyses that were sitting uncommitted in the tree (input for the connector-parity work): docs/design/12 (connector parity vs Mirth/OIE 4.6.0, 12 ranked gaps), 13 (non-connector gaps), 14 (beyond-Mirth competitive). ROADMAP gains the ranked parity checklists referencing them. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F1ad6jb5mCYxzFVXHbksqi
There was a problem hiding this comment.
Pull request overview
This PR addresses several local-dev feedback items and introduces certificate-store–backed TLS for HTTP connectors by switching connector TLS configuration from inline PEM to certificate ID references, resolved server-side at deploy/test time.
Changes:
- Update navigation/breadcrumb behavior in the message browser and refresh Certificates page messaging to reflect ID-based TLS usage.
- Add HTTP/HTTPS “Mode” toggles to HTTP source/destination forms, backed by a reusable certificate-picker component and updated defaults/tests.
- Implement server-side certificate ID → PEM resolution for HTTP connectors (deploy + connection-test paths), add example message seeding + integration test coverage, and adjust tooling/config (tsconfig excludes, eslint ignores, roadmap/design docs).
Reviewed changes
Copilot reviewed 29 out of 29 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| packages/web/src/pages/MessageBrowserPage.tsx | Repoints breadcrumbs/back-nav to Dashboard. |
| packages/web/src/pages/CertificatesPage.tsx | Updates info text to reflect ID-based certificate referencing. |
| packages/web/src/hooks/use-certificates.ts | Adds hasPrivateKey to certificate summary typing. |
| packages/web/src/components/channels/source/HttpSourceForm.tsx | Adds HTTP/HTTPS mode + server cert/CA/mTLS controls. |
| packages/web/src/components/channels/source/connector-defaults.ts | Adds scheme + id-based TLS defaults for HTTP source. |
| packages/web/src/components/channels/destinations/HttpDestinationForm.tsx | Adds HTTP/HTTPS mode + CA/client cert pickers for HTTP destination. |
| packages/web/src/components/channels/destinations/connector-defaults.ts | Adds scheme + id-based TLS defaults for HTTP destination. |
| packages/web/src/components/channels/common/CertificateSelect.tsx | New autocomplete picker for selecting certificates by ID. |
| packages/web/src/components/channels/tests/HttpTlsForms.test.tsx | New UI tests for HTTP TLS mode/picker behavior and id-based TLS bag writes. |
| packages/web/src/components/channels/tests/connector-defaults.test.ts | Extends defaults tests to verify id-based TLS defaults (no raw PEM keys). |
| packages/server/test/integration/seed-example-messages.itest.ts | Adds real-Postgres integration coverage for example message seeding. |
| packages/server/src/services/connector-tls-resolver.ts | New server-side resolver for HTTP connector TLS cert IDs → PEM. |
| packages/server/src/services/connection-test.service.ts | Enhances HTTP connection tests to perform real TLS/mTLS handshakes using resolved PEM. |
| packages/server/src/services/certificate.service.ts | Adds SQL-projected hasPrivateKey and introduces internal getMaterialById for server-only key access. |
| packages/server/src/services/tests/connector-tls-resolver.test.ts | Unit tests for TLS resolver pass-through/resolve/fail-loud behavior. |
| packages/server/src/services/tests/connection-test.service.test.ts | Adds coverage for HTTPS source loopback handshake and failure modes. |
| packages/server/src/services/tests/certificate.service.test.ts | Updates mocks/coverage for new SQL expression + getMaterialById. |
| packages/server/src/engine.ts | Resolves HTTP connector TLS at deploy time (source + destinations), failing deploy loudly on resolution errors. |
| packages/server/src/db/seeds/seed-showcase.ts | Fixes seeded global preprocessor script to return msg (not message). |
| packages/server/src/db/seeds/seed-example-messages.ts | Adds idempotent example message seeding via real MessageService write-path. |
| packages/server/src/db/seeds/run-seed.ts | Wires the example message seed into db:seed. |
| packages/engine/tsconfig.json | Excludes integration-lane test files from watch/build compilation. |
| packages/connectors/src/registry.ts | Passes scheme into HTTP dispatcher config. |
| packages/connectors/src/http/http-dispatcher.ts | Uses explicit scheme to decide fetch vs node:https path for HTTPS. |
| eslint.config.js | Ignores *.d.ts from lint to avoid false positives in ambient declarations. |
| docs/progress/ROADMAP.md | Adds connector/non-connector parity gap checklist sections. |
| docs/design/12-connector-parity-gap-analysis.md | Adds detailed connector parity gap analysis doc. |
| docs/design/13-non-connector-gap-analysis.md | Adds detailed non-connector parity gap analysis doc. |
| docs/design/14-beyond-mirth-competitive-gaps.md | Adds “beyond Mirth” competitive gaps strategy doc. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+104
to
+106
| const schemeHttps = this.config.scheme === 'HTTPS'; | ||
| const isHttps = schemeHttps || new URL(this.config.url).protocol === 'https:'; | ||
| if (isHttps && (schemeHttps || hasActiveTlsOptions(this.config.tls))) { |
Comment on lines
327
to
+333
| const url = requireString(props, 'url'); | ||
| const parsed = new URL(url); | ||
| await assertHostAllowed(parsed.hostname); | ||
|
|
||
| if (props['scheme'] === 'HTTPS') { | ||
| return testHttpsWithTls(url, props); | ||
| } |
Comment on lines
20
to
24
| readonly notBefore: string; | ||
| readonly notAfter: string; | ||
| readonly hasPrivateKey: boolean; | ||
| readonly createdAt: string; | ||
| readonly updatedAt: string; |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves the six dev-feedback items from local dev use.
return message;but the sandbox global ismsg— so every message in every channel threwReferenceError: message is not defined. Fixed the seed + patched the dev DB.tsconfigdidn't exclude*.itest.ts/gates.ts, sopnpm dev'stsc --watchcompiled them and flashed 12 errors. Excluded the integration lane.seed-example-messages.ts— 25 messages across 11 example channels (happy + FILTERED + ERROR paths + a correlated A→B cascade), via the real MessageService write-path. Idempotent; wired intodb:seed.node:httpshandshake. Private keys never leave the server (getMaterialByIdis not routed).Plus: committed the prior-session parity gap analyses (docs/design/12–14) + ROADMAP checklists as the input for the connector-parity work.
Verified:
pnpm -r buildclean,pnpm lintclean; targeted suites green (server resolver/cert/connection-test 98, http connectors 35, web TLS forms 19). Item 3 built via an orchestrated workflow with an adversarial verify pass.🤖 Generated with Claude Code