molecule-cli/internal/cmd/http.go

package cmd

import (
	"fmt"
	"io"
	"net/http"
	"os"
	"strings"
	"time"
)

// authToken returns the management API key the CLI authenticates with.
// This is the org-scoped tenant-admin key ("Org API Key" in the dashboard),
// presented to the tenant host as a bearer token. Read from MOLECULE_API_KEY.
func authToken() string {
	return os.Getenv("MOLECULE_API_KEY")
}

// orgID returns the org id used to satisfy the tenant's X-Molecule-Org-Id
// routing gate (TenantGuard). Read from MOLECULE_ORG_ID.
func orgID() string {
	return os.Getenv("MOLECULE_ORG_ID")
}

// cpAdminToken returns the control-plane ADMIN bearer used for org-lifecycle
// verbs that hit the CP admin surface (POST/GET /api/v1/admin/orgs).
//
// This is a DISTINCT credential from MOLECULE_API_KEY (the tenant Org API
// Key). The CP's customer-facing /api/v1/orgs* routes are gated by a WorkOS
// browser session (RequireSession), which a bearer-token CLI cannot satisfy —
// and the Org API Key has no standing on the CP at all. The admin routes are
// gated by AdminGate, which accepts a server-to-server bearer. We deliberately
// keep this in its own env var so the tenant org key is NEVER sent to the CP.
// Read from MOLECULE_CP_ADMIN_TOKEN.
func cpAdminToken() string {
	return os.Getenv("MOLECULE_CP_ADMIN_TOKEN")
}

// setAuthHeaders attaches the management credentials to req.
//
// Before this existed, management calls (workspace create/delete, secrets,
// tokens, …) reached a hardened tenant with NO Authorization header and were
// rejected with 401. The Org API Key is a tenant credential presented as
// `Authorization: Bearer <key>`; the tenant's TenantGuard additionally
// requires `X-Molecule-Org-Id: <orgId>` to route the request to the right
// org host. We set the org header only when MOLECULE_ORG_ID is configured so
// single-tenant / dev hosts (which don't gate on it) keep working.
func setAuthHeaders(req *http.Request) {
	if tok := authToken(); tok != "" {
		req.Header.Set("Authorization", "Bearer "+tok)
	}
	if oid := orgID(); oid != "" {
		req.Header.Set("X-Molecule-Org-Id", oid)
	}
}

// runHTTP does a raw HTTP call with management authentication attached.
func runHTTP(method, url string, body []byte) ([]byte, error) {
	var reader io.Reader
	if body != nil {
		reader = strings.NewReader(string(body))
	}
	req, err := http.NewRequest(method, url, reader)
	if err != nil {
		return nil, err
	}
	if body != nil {
		req.Header.Set("Content-Type", "application/json")
	}
	setAuthHeaders(req)
	resp, err := httpClient().Do(req)
	if err != nil {
		return nil, err
	}
	defer resp.Body.Close()
	b, _ := io.ReadAll(resp.Body)
	if resp.StatusCode >= 400 {
		return nil, fmt.Errorf("HTTP %d — %s", resp.StatusCode, string(b))
	}
	return b, nil
}

func httpClient() *http.Client {
	return &http.Client{Timeout: 30 * time.Second}
}