René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Gateway: API-key secret injection preempts OAuth app injection on shared hosts (www.googleapis.com)","articleBody":"## Summary\n\nWhen a host carries **both** a vaulted API-key secret and one or more OAuth **app** connections, the gateway injects only the secret and **skips OAuth app resolution entirely** for that host. OAuth requests then reach the provider with no `Authorization` header and fail upstream with `401`, which the gateway surfaces as `app_not_connected`.\n\nThis breaks **every** Google Workspace OAuth app (Calendar, Drive, and the Gmail legacy path) for any project that also has a **YouTube Data API key** vaulted — because all of them live on `www.googleapis.com`. Requests to the providers' **dedicated** hosts (`gmail.googleapis.com`, `tasks.googleapis.com`) are unaffected, which is the tell.\n\nThis is distinct from #236/#237 (which added missing `/batch/` path rules): here the path rules are correct and present, but app resolution never runs because a secret is bound to the same host.\n\n## Repro\n\nIn a project that has (a) a Google Calendar OAuth app connected **and** (b) a YouTube Data API key vaulted as a secret on `www.googleapis.com` (path `/youtube/`, query param `key`):\n\n```bash\n# Agent request through the gateway, no auth header — gateway should inject the Bearer:\ncurl -s -o /dev/null -w \"%{http_code}\\n\" \\\n  \"https://www.googleapis.com/calendar/v3/users/me/calendarList\"\n# =\u003e 401   (gateway logs: \"app not connected ... provider=google-calendar\")\n\n# Same OAuth connection, dedicated host — works:\ncurl -s -o /dev/null -w \"%{http_code}\\n\" \\\n  \"https://gmail.googleapis.com/gmail/v1/users/me/profile\"\n# =\u003e 200\n```\n\nRemove the YouTube key (or query the provider before the key is vaulted) and the calendar request returns `200`. So it is the *coexistence* of a secret and an app on the same host that triggers it — the OAuth token itself is valid (it works on the dedicated host).\n\n## Root cause\n\nApp-connection resolution is gated on there being **no** secret rules. In `apps/gateway/src/gateway/mitm.rs`:\n\n```rust\nlet mut injection_rules = resp.injection_rules; // from secrets\n// If no secret rules, try app connections (per-request disambiguation)\nif injection_rules.is_empty() \u0026\u0026 !resp.app_connections.is_empty() {\n    // ... resolve_app_injection_for_request ...\n    injection_rules = rules;   // and: replace, not merge\n}\n```\n\nThe YouTube key makes `injection_rules` non-empty, so the whole block is skipped and `resolve_app_injection_for_request` is never called. The identical pattern is in `apps/gateway/src/gateway.rs` (the HTTP-proxy path).\n\nSecret rules and app rules are both **path-scoped** `InjectionRule`s (`/youtube/*` for the key vs `/calendar/*` for the OAuth Bearer), so they can and should coexist rather than one preempting the other.\n\n## Evidence\n\nInstrumenting the `apply_injections` call site, a calendar request carries only the youtube rule:\n\n```\npath=/calendar/v3/... n_rules=1 patterns=[(\"/youtube/*\", 1)] injection_count=0 auth_len=0\n```\n\nAfter the fix (run app resolution regardless and merge), the same request carries both, and the `/calendar/*` Bearer applies:\n\n```\npath=/calendar/v3/... n_rules=3 patterns=[(\"/youtube/*\",1),(\"/calendar/*\",1),(\"/batch/calendar/*\",1)] injection_count=1 auth_len=260\n```\n\nA `/youtube/*` request still injects the key and correctly ignores the non-matching OAuth rules.\n\n## Proposed fix\n\nRun app resolution whenever app connections exist, and **merge** the resulting rules with any secret rules (`injection_rules.extend(rules)`) instead of gating on `injection_rules.is_empty()` and replacing. Apply to both `mitm.rs` and `gateway.rs`. Reproduced against `main` (32b5852).\n\nHappy to open a PR with the fix + a regression test (I have both ready) if the direction looks right.\n\n## Environment\n\n- OneCLI `main` (32b5852); also reproduced on the released `latest` image.\n- Self-hosted, Google BYOC OAuth apps (Gmail/Calendar/Tasks/Drive) + YouTube Data API key as a vaulted secret.\n\nRelated: #236 / #237 (batch path rules — different root cause), #307 (token endpoint routing — adjacent).\n\n---\n\n*Disclosure: I found this bug while integrating OneCLI, diagnosed it with an AI coding assistant, and verified the repro, root cause, and fix against a local build myself before filing.*\n","author":{"url":"https://github.com/jbaruch","@type":"Person","name":"jbaruch"},"datePublished":"2026-07-15T20:18:54.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/428/onecli/issues/428"}