Function configureServer

apps/local/vite.config.ts:90–221

(server)

  return {
    name: "executor-api",
    configureServer(server) {
      devToken ??= loadOrMintLocalAuthToken();

      // Print the bootstrap URL when vite is the front (plain `bun run dev`).
      // When the CLI daemon spawns vite as a child (EXECUTOR_DEV_VITE_PORT set),
      // the daemon prints its own `?_token=` URL and the app is loaded from the
      // daemon port, so we stay quiet to avoid two conflicting URLs.
      if (!process.env.EXECUTOR_DEV_VITE_PORT) {
        server.httpServer?.once("listening", () => {
          const address = server.httpServer?.address();
          const port =
            typeof address === "object" && address ? address.port : server.config.server.port;
          server.config.logger.info(
            `\n  Open with auth:  http://127.0.0.1:${port}/?_token=${devToken}\n`,
          );
        });
      }

      server.watcher.on("change", (path) => {
        if (path.includes("/apps/local/src/") || path.endsWith("/executor.config.ts")) {
          handlers = null;
        }
      });
      server.middlewares.use(async (req, res, next) => {
        const rawUrl = req.url ?? "/";
        const pathOnly = rawUrl.split("?")[0] ?? "/";
        const isApi = pathOnly.startsWith("/api/") || pathOnly === "/api";
        const isMcp = pathOnly === "/mcp" || pathOnly.startsWith("/mcp/");
        // App-level routes the Effect app serves at root, outside the `/api`
        // prefix (e.g. `/v1/app/npm/dist-tags`, the update-check the web shell
        // fetches). Public, like `/api/health` below.
        const isV1 = pathOnly === "/v1" || pathOnly.startsWith("/v1/");

        if (!isApi && !isMcp && !isV1) return next();

        // Gate parity with the production Bun shell (serve.ts): the vite server
        // is reachable by any local process, so /api and /mcp require the bearer
        // here too — otherwise /mcp would be unauthenticated arbitrary code
        // execution in dev. Exempt the health probe and the state-gated OAuth
        // callback. The SPA carries the token from its `?_token`/localStorage
        // bootstrap, so the UI is unaffected; external MCP clients use the
        // daemon port.
        const authExempt =
          pathOnly === "/api/health" || isV1 || isUnauthenticatedOAuthPath(pathOnly);
        if (!authExempt) {
          const presented = req.headers.authorization;
          const authValue = Array.isArray(presented) ? presented[0] : presented;
          const probe = new Request(
            "http://localhost/",
            authValue ? { headers: { authorization: authValue } } : undefined,
          );
          if (!makeIsAuthorized(devToken ?? loadOrMintLocalAuthToken())(probe)) {
            res.statusCode = 401;
            res.setHeader("www-authenticate", 'Bearer realm="executor"');
            res.end("Unauthorized");
            return;
          }
        }