Skip to content

[DAT-707] Add Harness integration support to the relay agent - #113

Merged
quicksnap merged 3 commits into
mainfrom
ds/harnessAxonSupport
Jul 15, 2026
Merged

[DAT-707] Add Harness integration support to the relay agent#113
quicksnap merged 3 commits into
mainfrom
ds/harnessAxonSupport

Conversation

@quicksnap

@quicksnap quicksnap commented Jul 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

I would like to verify the Axon flow e2e locally before I merge this.

Claude description

Adds Harness (harness.io) as a first-class relay integration — the first integration to authenticate via header injection (x-api-key) instead of the basic/bearer auth stanza used by all shipped accept files.

Changes

  • agent/common/integration.go: new IntegrationHarness = "harness", included in ValidIntegrations().
  • agent/server/snykbroker/accept_files/accept.harness.json: routes any /* to ${HARNESS_API} and injects x-api-key: ${HARNESS_TOKEN} via the accept-file headers mechanism. Header values support ${VAR} env expansion (validated at load time) and ${plugin:...} invocation; injection happens in the reflector, so it requires relay reflector traffic mode (ENABLE_RELAY_REFLECTOR = all/traffic; all is the default).
  • agent/server/snykbroker/accept_files/config.harness.json: credential-validation endpoint GET $HARNESS_API/ng/api/user/currentUser (precedent: github/gitlab/jira/bitbucket). The final endpoint choice is being verified in the brain-backend work under DAT-708.
  • READMEs: Harness listed as a supported relay integration, with HARNESS_API/HARNESS_TOKEN in the env var table.

Header semantics (relevant to the backend relay design)
The reflector applies injected headers with req.Header.Set(...), so an inbound placeholder x-api-key from Cortex cloud is replaced by the real key — not duplicated. TestHarnessAcceptFileInjectsApiKeyHeader proves this end-to-end against the shipped accept file: the backend receives exactly one x-api-key value (the real token) whether or not the inbound request carried a placeholder.

Known limitation (validation only)
The broker's systemcheck can only send validation credentials in the Authorization header (BROKER_CLIENT_VALIDATION_AUTHORIZATION_HEADER) or as basic auth — there is no way to express an arbitrary header name like x-api-key. Harness API keys are only accepted via x-api-key, so the systemcheck validation in config.harness.json will report failure against a real Harness until the cortexapps/snyk-broker fork supports custom validation header names. This does not affect relayed traffic — proxied requests authenticate correctly via the injected header. Live end-to-end relay verification against a real Harness is out of scope here and is coordinated separately.

Test plan

  • go build ./... in agent/ — passes.
  • go test ./... in agent/ — all 12 packages pass.
  • New: TestHarnessAcceptFileInjectsApiKeyHeader (live reflector round-trip, inject + replace assertions), TestLoadIntegrationAcceptFileHarness, TestLoadIntegrationAcceptFileHarnessMissingVars, TestLoadValidationParamsHarness.

quicksnap and others added 2 commits July 14, 2026 15:20
@quicksnap @claude
[DAT-707] Add Harness integration support to the relay agent
69c443a 
## Claude description

> Registers `harness` as a valid relay integration and adds its accept
> file, the first one to authenticate via header injection instead of
> basic/bearer `auth`: the route sends `any /*` to `${HARNESS_API}` and
> injects `x-api-key` from `${HARNESS_TOKEN}` through the accept-file
> `headers` mechanism (requires reflector traffic mode, the default).
>
> Adds `config.harness.json` with a `GET $HARNESS_API/ng/api/user/currentUser`
> credential-validation endpoint; the final endpoint choice is being
> verified in brain-backend work (DAT-708). Note the broker systemcheck
> can only send validation credentials in the `Authorization` header
> today, so this validation will not authenticate against Harness until
> the broker fork supports custom validation header names.
>
> Tests: accept-file load/render + missing-var + validation-config cases
> in `common`, and a live reflector test proving the shipped accept file
> injects `x-api-key` on proxied requests and that an inbound placeholder
> `x-api-key` is replaced rather than duplicated.
>
> Also lists Harness in both READMEs.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@quicksnap @claude
[DAT-707] Pin npm and move broker images to Node 22 to fix image builds
6601dae 
## Claude description

> CI `build` and `docker-tests` jobs fail on any branch since npm@12.0.1
> released: both broker images run `npm install --global npm@latest` on
> Node 20, and npm 12 requires Node >= 22.22.2 (EBADENGINE). Unrelated to
> the Harness change on this branch.
>
> Mirrors the fix from PR #114 exactly so the branches merge cleanly:
> `NODE_VERSION` 20 -> 22 and `npm@latest` -> `npm@11.18.0` in
> `docker/Dockerfile` and `agent/test/relay/Dockerfile.snyk-broker-server`.
>
> Verified locally: `make docker-build` and a direct build of
> `Dockerfile.snyk-broker-server` both complete; `go build ./...` and
> `go test ./...` still pass.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
quicksnap
quicksnap commented Jul 15, 2026
View reviewed changes
Comment thread docker/Dockerfile
ARG SNYK_BROKER_VERSION=v1.0.16-axon
RUN wget -q -O - https://deb.nodesource.com/setup_${NODE_VERSION}.x | bash - && apt-get install -y nodejs
RUN npm install --global npm@latest typescript@4.9.3
RUN npm install --global npm@11.18.0 typescript@4.9.3

@quicksnap quicksnap Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why are we adjusting these files?

@quicksnap quicksnap Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 CI was broken repo-wide at the image-build step: npm@12.0.1 (released 2026-07-14) dropped Node 20 support, so npm install --global npm@latest failed with EBADENGINE in both broker images — every branch's build/docker-tests was red, unrelated to the Harness change. I pinned npm to unblock this PR, mirroring the then-in-flight #114. Now that #114 is merged, I've merged main and restored these files to match main exactly, so they no longer appear in this PR's diff.

@quicksnap
quicksnap marked this pull request as ready for review July 15, 2026 21:22
@quicksnap
quicksnap merged commit d65ce73 into main Jul 15, 2026
17 checks passed
@quicksnap
quicksnap deleted the ds/harnessAxonSupport branch July 15, 2026 21:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ryanduffin ryanduffin ryanduffin approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@quicksnap @ryanduffin