feat(catalog): add 13 service templates and fix four incorrect ones

[saifsmailbox98]

Summary

Brings the built-in service catalog closer to Infisical's proxied-service templates. Four files: internal/catalog/catalog.go, internal/catalog/catalog_test.go (new), cmd/catalog.go, web/src/pages/vault/ServicesTab.tsx.

New templates (13)

Every host and auth header checked against the vendor's current docs.

Template	Host	Auth
cohere	api.cohere.com	bearer
deepseek	api.deepseek.com	bearer
discord	discord.com/api/*	api-key, Authorization: Bot
fireworks	api.fireworks.ai	bearer
gemini	generativelanguage.googleapis.com	api-key, x-goog-api-key
gitlab	gitlab.com/api/*	api-key, PRIVATE-TOKEN
groq	api.groq.com	bearer
mistral	api.mistral.ai	bearer
openrouter	openrouter.ai	bearer
perplexity	api.perplexity.ai	bearer
telegram	api.telegram.org	passthrough + path substitution
together	api.together.ai	bearer
xai	api.x.ai	bearer

Fixed templates (4)

The first three were bearer, but none of those services accept Authorization: Bearer <key>.

Template	Was	Now
linear	bearer	api-key on Authorization, no prefix (Linear wants the bare token)
supabase	bearer	api-key on apikey
pagerduty	bearer	custom header Token token={{ PAGERDUTY_TOKEN }}
stripe	key STRIPE_KEY	key STRIPE_SECRET_KEY

pagerduty needs custom because an api-key prefix cannot produce Token token=<key>: Auth.Resolve concatenates the prefix verbatim, with no room for the trailing =.

Heads up on stripe: a vault already holding a STRIPE_KEY credential will stop getting the "unused credential, add Stripe as a service?" suggestion, since that matches on suggested_credential_key.

catalog.Template gains two fields

Headers seeds custom auth, Substitutions seeds the substitution editor independent of auth type. This lets a preset broker a credential that does not travel in a constructed header. telegram is the only such template: its token is a URL path segment (/bot<token>/sendMessage).

Side effect worth noting: selecting a custom preset now produces a submittable form. Previously applyPreset set the auth type but left the header rows blank, so canSubmit always failed.

agent-vault catalog output

Renders passthrough + substitution when a template carries one. Without it, telegram showed as bare passthrough, which reads as "no credential involved" and would lead someone configuring by hand to omit the substitution and get no injection.

Type of change

• Bug fix
• New feature
• Refactor / cleanup
• Documentation
• CI / build

Test plan

New catalog_test.go runs every template through the same mapping applyPreset uses and validates the result, so a preset that would produce an unsubmittable form or a rejected proposal fails the build. One test covers Telegram's <id>:<token> surviving path escaping.

Manually verified against a local instance:

• All 35 templates accepted by the real HTTP ingest via vault service add --file

• Real proxy traffic against a loopback echo server confirmed what upstreams receive: Token token=..., Bot <token>, bare Authorization: lin_api_..., apikey: ..., PRIVATE-TOKEN: ..., and Telegram's rewritten path

• Browser click-through of every changed preset, plus the credential-suggestion deep link (?preset=openrouter)

• Existing tests pass (make test)

• Added/updated tests for new behavior

• Manual testing (describe below)

Security checklist

• No secrets or credentials in code
• No new unauthenticated endpoints
• Input validation on new API surfaces
• Checked for OWASP top 10 (injection, XSS, etc.)

[infisical-review-police]

💬 Discussion in Slack: #pr-review-agent-vault-361-feat-catalog-add-14-service-templates-and-fix-four-inc

Posted by Review Police — reviews, comments, new commits, and CI failures will stream into this channel.

[greptile-apps]

Greptile Summary

The PR expands and corrects the built-in service catalog while teaching the add-service form to initialize custom headers and substitutions from presets.

• Adds 14 service templates and corrects authentication metadata for Linear, Supabase, PagerDuty, and Stripe.
• Adds custom-header and substitution fields to catalog templates and applies them in the service modal.
• Adds catalog validation and wire-behavior tests for Telegram, Google Workspace, and overlapping Gemini host matching.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete blocking or independently actionable non-blocking defects identified.

Preset state is cleared before each selection, the new template data maps into validated service shapes, and the security leads examined do not produce an unacknowledged reachable failure.

Important Files Changed

Filename	Overview
internal/catalog/catalog.go	Adds the new templates and catalog fields, including custom PagerDuty headers and substitution-based Telegram and Google Workspace authentication.
internal/catalog/catalog_test.go	Validates template conversion, identifiers, substitution keys, and representative request-rewrite and host-precedence behavior.
web/src/pages/vault/ServicesTab.tsx	Seeds custom headers and substitutions from selected presets while resetting prior form state before each selection.

_{Reviews (1): Last reviewed commit: "Add 14 service templates and fix four in..." | Re-trigger Greptile}

[veria-ai]

PR overview

All previously flagged issues have been addressed. No open security concerns remain on this pull request.

Security review

No open security issues remain on this pull request.

Fixed/addressed: 1 · PR risk: 0/10