Community store: apps added after today's ssrf fix never appear in the public listing

[andreasdueren]

Since commit 09c562f (ssrf protection, deployed today), newly added community apps show under My Apps but their public page returns 404 and they are missing from /api/apps.

Probable cause: in downloadIcon in src/apps.js, secureGet(iconUrl) is now wrapped in safe(() => ...). A superagent request is a thenable, so safe() awaits it and returns a Promise instead of the request object. The next line then calls request.ok(...), which throws TypeError: request.ok is not a function. The error propagates out of resolveEntry, and refreshCache skips the app entirely with Skipping community app <title> (<url>): request.ok is not a function in the log.

Existing apps are unaffected because their icons are already cached and downloadIcon returns before the broken line. Any app added after the deploy has no cached icon and is dropped from the listing on every refresh.

Reproduced locally against the current repo with npm ci and a valid versions file (it passes parseVersions and checkVersionsRequirements cleanly).

Suggested fix: build the request in a plain try/catch instead of safe(), for example

let request;
try { request = secureGet(iconUrl); } catch { return; }
const [error, response] = await safe(request.ok(() => true));

Affected example: Nextcloud Talk HPB, added today. https://ca.cloudron.io/app/nextcloud-talk-hpb returns 404 while the entry exists in My Apps.

[girish]

My bad... fixing

[girish]

Deployed