From 82f3219c59b841865aa901769b8ae969226c74d4 Mon Sep 17 00:00:00 2001
From: "kubestellar-hive[bot]" <kubestellar-hive@hive.kubestellar.io>
Date: Mon, 21 Sep 2026 21:12:28 -0400
Subject: [PATCH] fix: pin collect-launch-metrics pagination to the first
 request's origin

scripts/collect-launch-metrics.mjs defines its own githubAll() helper, which
followed the server-supplied Link rel="next" URL to any origin while
attaching Authorization: Bearer $GH_TOKEN to every hop. The same defect was
fixed for scripts/collect-metrics.mjs in #226; that change did not cover this
copy.

Add sameOriginNext() and resolve each rel="next" candidate against the origin
of the first request, dropping unparseable or cross-origin targets with a
warning instead of sending the token to them.

Closes #438

Signed-off-by: kubestellar-hive[bot] <kubestellar-hive@hive.kubestellar.io>
---
 scripts/collect-launch-metrics.mjs | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/scripts/collect-launch-metrics.mjs b/scripts/collect-launch-metrics.mjs
index e5627096..64339441 100644
--- a/scripts/collect-launch-metrics.mjs
+++ b/scripts/collect-launch-metrics.mjs
@@ -131,6 +131,7 @@ function signal(id, label, baseline, sourceUrl, collectedAt) {
 }
 
 async function githubAll(url, token) {
+  const origin = new URL(url).origin;
   const results = [];
   let next = url;
   while (next) {
@@ -145,9 +146,29 @@ async function githubAll(url, token) {
     results.push(...(await response.json()));
     const link = response.headers.get('link') || '';
     const match = link.match(/<([^>]+)>;\s*rel="next"/);
-    next = match ? match[1] : null;
+    next = match ? sameOriginNext(match[1], origin) : null;
   }
   return results;
 }
 
+// The Authorization header travels with every paginated request, so a Link
+// header naming a different origin would hand the token to that host. Only
+// continue paginating within the origin the first request was sent to.
+function sameOriginNext(candidate, origin) {
+  let parsed;
+  try {
+    parsed = new URL(candidate, origin);
+  } catch {
+    console.warn(`Ignoring unparseable Link rel="next" target: ${candidate}`);
+    return null;
+  }
+  if (parsed.origin !== origin) {
+    console.warn(
+      `Ignoring cross-origin Link rel="next" target: ${parsed.origin}`,
+    );
+    return null;
+  }
+  return parsed.toString();
+}
+
 main();