linear, fireflies: each path is answered by the layer that routes it at the vendor

backlot/main.py

@@ -43,6 +43,7 @@
     notion,
     oauth,
     s3,
+    sent_path,
     slack,
 )
 from backlot.telemetry import naming, recorder
@@ -847,6 +848,31 @@ async def serve_a_slashed_hubspot_path_as_the_path_without_it(request: Request,
     return await call_next(request)
 
 
+_GRAPHQL_ENDPOINTS = ("/linear/graphql", "/fireflies/graphql")
+
+
+def _off_a_graphql_endpoint(scope: Scope) -> bool:
+    path = scope["path"]
+    return path.startswith(("/linear/", "/fireflies/")) and path not in _GRAPHQL_ENDPOINTS
+
+
+@_middleware(_off_a_graphql_endpoint)
+async def route_a_linear_or_fireflies_path_as_its_front_does(request: Request, call_next):
+    """Route a `/linear` or `/fireflies` path but the endpoint's own to the route that answers it as
+    the vendor's front does: a `/linear` path Express hands Apollo Server
+    (``linear.routes_to_apollo``) to ``linear.graphql``, and any other to the vendor's root route
+    (``linear.express``, ``fireflies.unrouted``), each of which reads the path as sent off the raw
+    path, which is left alone. Starlette's own routing is not asked: its pattern for the endpoint
+    takes a path with a newline after it (`/graphql%0A`), and its `path` convertor none with a
+    newline inside it, where each vendor's front reads both as another path."""
+    vendor = request.scope["path"].split("/")[1]
+    served = vendor == "linear" and linear.routes_to_apollo(
+        linear.express_path(sent_path(request.scope))
+    )
+    request.scope["path"] = f"/{vendor}/graphql" if served else f"/{vendor}/"
+    return await call_next(request)
+
+
 def _google_route_match(scope: Scope) -> Match:
     """How the best Google route matches this scope: in full, by its path alone (``PARTIAL``, the
     router's 405), or not at all. Asked of ``backlot.routers.google.router``, which holds the Google
@@ -1434,6 +1460,30 @@ async def refuse_a_repeated_header_on_notion_linear_fireflies_and_hubspot(
     )
 
 
+def _a_broken_escape(scope: Scope) -> bool:
+    return request_target.broken_escape(scope.get("raw_path") or scope["path"].encode())
+
+
+@_middleware(
+    lambda scope: (
+        _at_or_under(_url_path(scope), ("/linear", "/fireflies")) and _a_broken_escape(scope)
+    )
+)
+async def refuse_a_broken_escape_on_linear_and_fireflies(request: Request, call_next):
+    """Answer a `/linear` or `/fireflies` request whose path holds `%00`, or a `%` two hex digits do
+    not follow, with :data:`backlot.request_target.CLOUDFLARE_PAGE`'s 400, ahead of
+    :func:`refuse_cloudflares_methods_on_linear_and_fireflies`. api.linear.app and api.fireflies.ai
+    answered so `/a%zz` and `/a%00b` by each method of :data:`_CLOUDFLARE_METHOD`, and `/a%2`,
+    `/graphql%zz` and a `%` before `b` by `POST`, on 2026-10-25 (UTC), and passed `?a=%zz`, `?a=%`,
+    `?a=%2` and `?a=%00` after `/graphql` on to the vendor. Both closed the connection after the 400
+    (`POST /graphql%zz`, `POST /a%00b`, `GET /a%2`, 2026-10-26)."""
+    return Response(
+        request_target.CLOUDFLARE_PAGE,
+        status_code=400,
+        headers={"Content-Type": "text/html", "Connection": "close"},
+    )
+
+
 @_middleware(lambda scope: _url_path(scope).startswith("/github"))
 async def put_a_request_id_on_github_answers(request: Request, call_next):
     """Put an `x-github-request-id` on every `/github` answer the API gives, as real does on each

backlot/request_target.py

@@ -194,6 +194,18 @@ def _google(path_kinds: list[str], query_kinds: list[str]) -> Response | None:
     return None
 
 
+#: A `%` with fewer than two hex digits after it.
+_BROKEN_ESCAPE = re.compile(rb"%(?![0-9A-Fa-f]{2})")
+
+
+def broken_escape(path: bytes) -> bool:
+    """Whether ``backlot.main.refuse_a_broken_escape_on_linear_and_fireflies`` refuses ``path``.
+    Cloudflare's page for it comes ahead of its answer to a raw byte: on 2026-10-26 (UTC) both hosts
+    drew :data:`CLOUDFLARE_PAGE` for `/a%zz` with a raw `é` before or after it or `\\x01` before
+    it, and for `/a%00` after a raw `é`, where a raw `é` alone drew the empty 400."""
+    return b"%00" in path or _BROKEN_ESCAPE.search(path) is not None
+
+
 def _cloudflare(scope: Scope, path_kinds: list[str], query_kinds: list[str]) -> Response | None:
     """:data:`CLOUDFLARE_PAGE` where a `nul` or a `cr` is anywhere, and where `Authorization` or
     one of the five conditional headers comes more than once
@@ -315,6 +327,8 @@ def answer(scope: Scope) -> Response | None:
         return _google(in_path, in_query)
     if errors.atlassian.owns(path):
         return _atlassian(scope, in_path, in_query)
+    if any(_under(path, p) for p in ("/linear", "/fireflies")) and broken_escape(sent_path):
+        return _page(CLOUDFLARE_PAGE, "text/html")
     if any(_under(path, p) for p in ("/notion", "/hubspot", "/linear", "/fireflies")):
         return _cloudflare(scope, in_path, in_query)
     if errors.s3.owns(path):

backlot/routers/__init__.py

@@ -9,6 +9,15 @@
 from __future__ import annotations
 
 from fastapi import Request
+from starlette.types import Scope
+
+
+def sent_path(scope: Scope) -> str:
+    """The path a client sends the vendor's own host: this request's as it arrived, escapes and
+    all, with the first segment, which names the vendor here, taken off. A first segment with no
+    slash after it leaves `/`."""
+    raw = (scope.get("raw_path") or scope["path"].encode()).decode("latin-1")
+    return "/" + raw.partition("/")[2].partition("/")[2]
 
 
 async def json_body(request: Request) -> dict:

backlot/routers/fireflies.py

@@ -1,10 +1,10 @@
 """Fireflies.ai's GraphQL API, served at ``/fireflies/graphql``.
 
 Fireflies is **GraphQL only** — there is no REST surface to emulate — so this router is one
-endpoint. The schema and the resolvers live in ``backlot/graphql/`` (``fireflies.graphql`` +
-``fireflies_resolvers.py``); everything here is HTTP: a request and credentials in, a GraphQL
-envelope out, or the answer of a layer in front of Apollo Server's run, in the order
-:func:`graphql` lists them.
+endpoint, and what answers at any other path (:func:`unrouted`). The schema and the resolvers live
+in ``backlot/graphql/`` (``fireflies.graphql`` + ``fireflies_resolvers.py``); everything here is
+HTTP: a request and credentials in, a GraphQL envelope out, or the answer of a layer in front of
+Apollo Server's run, in the order :func:`graphql` lists them.
 
 Auth is the bearer path (``Authorization: Bearer <api_key>``), which is what the vendor's own
 quickstart shows for all four of its raw-HTTP examples, read by
@@ -20,6 +20,8 @@
 
 from __future__ import annotations
 
+import re
+import urllib.parse
 from typing import Any
 
 from fastapi import APIRouter, Request
@@ -39,6 +41,7 @@
 from backlot.graphql import apollo_http, engine
 from backlot.graphql import body as request_body
 from backlot.graphql.fireflies_resolvers import build_engine
+from backlot.routers import sent_path
 
 router = APIRouter(prefix="/fireflies", tags=["fireflies"])
 
@@ -121,18 +124,20 @@ def _auth_failed(seen: dict[str, str], message: str) -> Response:
     "object_not_found": True,
 }
 
-# The methods Fastify reads a body for and has no route for at this path: it reads the body, then
-# answers its not-found handler's 404 (:func:`_not_found`).
-_READ_THEN_NOT_FOUND = ("DELETE", "PATCH", "PUT")
+# The methods Fastify reads a body for but `OPTIONS`, which `@fastify/cors` answers first: at a path
+# or under a method no route takes, it reads the body, then answers its not-found handler's 404
+# (:func:`_not_found`). Any other method's body goes unread: a `PROPFIND` to `/graphql/` under
+# `a/b/c` or with `{` as JSON drew the 404 on 2026-10-26 (UTC).
+_BODIED = ("DELETE", "PATCH", "POST", "PUT")
 
 
 @router.api_route("/graphql", methods=list(apollo_http.METHODS), include_in_schema=False)
 async def graphql(request: Request):
-    """The single Fireflies endpoint, in front of which Fireflies runs Fastify and
-    ``@fastify/cors``. Not in the OpenAPI document on purpose: this is a GraphQL service, and
-    describing one route that accepts an arbitrary query would tell an OpenAPI→MCP bridge nothing
-    useful (hence no ``SOURCE_PREFIXES`` entry either — see ``backlot/openapi.py``). Introspection
-    is the schema description for this endpoint.
+    """Fireflies' endpoint, the one path Fastify routes, in front of which Fireflies runs nginx
+    (:func:`nginx_passes`), Fastify and ``@fastify/cors``. Not in the OpenAPI document on purpose:
+    this is a GraphQL service, and describing one route that accepts an arbitrary query would
+    tell an OpenAPI→MCP bridge nothing useful (hence no ``SOURCE_PREFIXES`` entry either — see
+    ``backlot/openapi.py``). Introspection is the schema description for this endpoint.
 
     The layers answer in this order, each measured against api.fireflies.ai on 2026-10-25 (UTC)
     with the one after it wrong too: ``@fastify/cors`` (:func:`_preflight`), Fastify
@@ -143,7 +148,7 @@ async def graphql(request: Request):
     if method == "OPTIONS":
         return _preflight(request)
     if method not in ("GET", "HEAD", "POST"):
-        if method in _READ_THEN_NOT_FOUND:
+        if method in _BODIED:
             read = await _fastify_read(request, routed=False)
             if isinstance(read, Response):
                 return read
@@ -238,19 +243,55 @@ def _preflight(request: Request) -> Response:
 
 
 def _not_found(request: Request) -> Response:
-    """Fireflies' 404 for a method its route does not take, the method and the path quoted in it as
-    a client puts them after ``https://api.fireflies.ai``, the query string as sent.
+    """Fireflies' 404 for a method or a path no route takes, the method, the path as a client sent
+    it (:func:`~backlot.routers.sent_path`) and the query string as sent quoted in it.
     api.fireflies.ai answered so each of the 28 methods of :data:`apollo_http.METHODS` but GET,
-    HEAD, POST, OPTIONS and Cloudflare's three on 2026-10-25 (UTC), `PUT`, `DELETE` and `PATCH` once
-    Fastify had read their body (:func:`_fastify_read`), and quoted `/graphql?x=%7B%20y&z&a=b+c` as
-    sent."""
-    # The path as sent, but for the segment that names Fireflies here.
-    path = "/" + request.scope["raw_path"].decode("latin-1").split("/", 2)[2]
+    HEAD, POST, OPTIONS and Cloudflare's three at `/graphql` on 2026-10-25 (UTC), `PUT`, `DELETE`
+    and `PATCH` once Fastify had read their body (:func:`_fastify_read`), and quoted
+    `/graphql?x=%7B%20y&z&a=b+c` as sent; and `POST`, `GET`, `HEAD`, `PUT`, `PROPFIND` and `BIND`
+    at `/GRAPHQL`, `/graphql/x`, `//graphql` and `/graphql%2F`, `POST` at `/%2Fgraphql` and
+    `/graphql%0A`, and `PUT` at `/graph%71l`, quoting each path as sent."""
     query = request.scope["query_string"].decode("latin-1")
-    message = f"Cannot {request.method} {path}{'?' if query else ''}{query}"
+    message = f"Cannot {request.method} {sent_path(request.scope)}{'?' if query else ''}{query}"
     return _body_refusal(message, 404, "not_found")
 
 
+_NGINX_404 = (
+    b"<html>\r\n<head><title>404 Not Found</title></head>\r\n<body>\r\n"
+    b"<center><h1>404 Not Found</h1></center>\r\n<hr><center>nginx</center>\r\n</body>\r\n</html>\r\n"
+)
+_NGINX_LOCATION = re.compile(rb"/graphql(/|$)", re.IGNORECASE)
+
+
+def nginx_passes(path: str) -> bool:
+    """Whether nginx in front of Fastify passes on ``path``, as a client sent it
+    (:func:`~backlot.routers.sent_path`): once each escape is decoded and each run of slashes is
+    one, it starts with `/graphql`, in any case, followed by a slash, by nothing or by a newline
+    that ends it. api.fireflies.ai answered with Fastify's 404 at each path :func:`_not_found`
+    names, and with nginx's (:data:`_NGINX_404`) at `/graphqlx`, `/graphql.json`, `/graphql;x`,
+    `/graphql%20`, `/graphql%7E`, `/x/graphql` and `/`, on 2026-10-25 (UTC)."""
+    decoded = re.sub(rb"/{2,}", b"/", urllib.parse.unquote_to_bytes(path))
+    return _NGINX_LOCATION.match(decoded) is not None
+
+
+@router.api_route("/", methods=list(apollo_http.METHODS), include_in_schema=False)
+async def unrouted(request: Request):
+    """Fireflies' answer at a path Fastify has no route for, each of which ``backlot.main`` routes
+    here: :data:`_NGINX_404` where nginx keeps the request (:func:`nginx_passes`), and Fastify's
+    where it passes it on, :func:`_preflight` to an `OPTIONS` and its not-found handler's 404
+    (:func:`_not_found`) to any other method, after reading the body of one of :data:`_BODIED`
+    (:func:`_fastify_read`)."""
+    if not nginx_passes(sent_path(request.scope)):
+        return Response(_NGINX_404, status_code=404, headers={"content-type": "text/html"})
+    if request.method == "OPTIONS":
+        return _preflight(request)
+    if request.method in _BODIED:
+        read = await _fastify_read(request, routed=False)
+        if isinstance(read, Response):
+            return read
+    return _not_found(request)
+
+
 _FASTIFY_PARSED = ("application/json", "text/plain", "application/x-www-form-urlencoded")
 
 
@@ -267,7 +308,9 @@ async def _fastify_read(request: Request, routed: bool) -> Any:
     api.fireflies.ai answered so each body sent on 2026-10-25 (UTC) to `POST`, `PUT`, `DELETE`
     and `PATCH`: no type with a body was the 415 by `POST` and the 404 by `PUT`, `a/b/c` and an
     empty type the 415 by both, `application/graphql` the 415 by `POST`, past the limit too, and
-    the 404 by `PUT`, and a form or plain text past the limit the 413 by both."""
+    the 404 by `PUT`, and a form or plain text past the limit the 413 by both. A `POST` to
+    `/graphql/`, which no route takes, was read as a `PUT` to `/graphql` is: `{` and an empty body
+    drew the 400s, `a/b/c` the 415, and plain text, `application/graphql` and no type the 404."""
     content_type = request.headers.get("content-type")
     if content_type is None:
         length = request.headers.get("content-length")