HTTP Server & Resolvers

Hub extends the localhost HttpServer with security filtering and tunnel routing, and provides 16 specialized HTTP resolvers for API access, file handling, agent communication, and more.

HttpServer

HttpProcessor/HttpServer.ts extends the localhost HttpServer with two Hub-specific behaviors:

Security Filtering

The isRequestAllowed() method blocks requests to common attack vectors before they reach any resolver:

Blocked Pattern	Reason
/.git/	Git repository exposure
/.svn	SVN repository exposure
/webdav/	WebDAV probing
/wp-includes/, /wp-admin/	WordPress exploit attempts
*.jsp	Java Server Pages probing
*.cgi	CGI script probing

Tunnel Routing

The resolveRequest() method checks the Host (or X-Forwarded-Host) header against configured tunnels.server aliases. When a match is found, the request is transparently rerouted:

• Root path (/) → /forward (agent landing page)
• Any other path → /forward/continue (proxied request to agent)

This allows agents to be accessed via dedicated subdomains without any client-side awareness of the forwarding mechanism.

Resolver Catalog

All resolvers are in HttpProcessor/Resolvers/ and use the @Resolver decorator to register their URL patterns.

API Resolvers

Resolver	URL Pattern	Auth	Purpose
RESTResolver	/api/{section}/...	Bearer token	REST API with up to 6 nested path segments. Validates Bearer token or falls back to service account authentication
GraphQLResolver	/graphql	Bearer token	GraphQL query execution. Extends RESTResolver — supports GET and POST. Validates schema, parses AST, executes with auth context
GraphiQLLoader	/graphiql	No	Serves the GraphiQL interactive IDE for exploring the GraphQL API

Authentication Resolvers

Resolver	URL Pattern	Auth	Purpose
AuthenticationResolver	/authenticate	OAuth2 ticket	OAuth2 callback handler. Validates ticket with provider, sets token in Set-Cookie header, redirects to hub-gui
NotAuthorizedResolver	(error handler)	—	Returns 401 response for unauthorized requests
Http403ForbiddenResolver	(error handler)	—	Returns 403 response for forbidden requests

File Resolvers

Resolver	URL Pattern	Auth	Purpose
FileUploadResolver	/Upload/{type}/{clientId}	Yes	Chunked file upload processing. Supports multiple files, binary format, max 25 MB. Returns postMessage JSON for iframe context
FileRequestResolver	/Download/{fileId}, /Configuration/{appName}/{configName}[/{version}], /Update/{appName}[/{releaseName}[/{platform}[/{version}]]]	Optional	File, configuration and self-update package download with proper MIME types and range request support. Without a version, /Update/... serves the latest registered package; private packages require a Bearer token with access to them
UpdateChecksumResolver	/UpdateChecksum/{appName}/{releaseName}/{platform}[/{version}]	Optional	JSON {name, version, sha256} of exactly the package the same /Update/... arguments download (same version selection and access rules). The hash is cached per package file. Agents read it first and then download the returned version explicitly, so a package registered in between cannot be checked against another package's hash
ImageRequestResolver	/image/...	Varies	Image serving with caching headers

Agent & Monitoring Resolvers

Resolver	URL Pattern	Auth	Purpose
ForwardingResolver	/forward, /forward/continue	Agent token	WebSocket reverse tunneling for agents. See Request Forwarding
AgentStatusResolver	/agent-status	Yes	Agent health and status monitoring
PingResolver	/ping	No	Health check endpoint — returns simple acknowledgment
LiveContentResolver	/live/...	Yes	Server-sent events for real-time content updates

Content & Plugin Resolvers

Resolver	URL Pattern	Auth	Purpose
FrontEndLoader	/ (fallback)	No	Serves the hub-gui SPA bundle (HTML, JS, CSS)
PluginsRepository	/plugins/...	Yes	Plugin management and serving
Http404NotFoundResolver	(fallback)	—	Returns 404 response for unmatched URLs

RESTResolver Details

The REST API uses Bearer token authentication with a fallback to service account credentials:

GET /api/users HTTP/1.1
Authorization: Bearer <token>

The accessValidator() flow:

1. Extract Bearer token from Authorization header
2. Validate token via AuthManager.IsAuthenticated()
3. If token is invalid, attempt service account authentication via AuthManager.Authenticate()
4. If both fail, return 401

URL patterns support up to 6 nested segments: /api/{section}/{sub1}/{sub2}/{sub3}/{sub4}/{sub5}.

GraphQLResolver Details

Extends RESTResolver to inherit its authentication. The resolver:

1. Validates the GraphQL schema structure
2. Parses the query string into an AST
3. Validates the AST against the schema
4. Executes with an auth-aware context — every field resolution is wrapped in AuthManager.IsAuthorizedFor()
5. Returns results via GraphQLResponse formatter

Supports both GET (query parameter) and POST (request body) methods.

---

See also: HTTP Processing Pipeline | Request Forwarding | GraphQL API | Hub Backend Overview