@foldrun/core 9.2.1 → 9.4.0

package/src/secrets.ts

@@ -24,6 +24,8 @@ import path from "node:path";
 import { dataRoot } from "./paths.ts";
 import { platform } from "./platform.ts";
 import { fetchUntrusted } from "./untrusted-fetch.ts";
+import { oauthTokenRequest, readTokenResponse, tokenAuthProblem, type TokenAuth } from "./oauth-token.ts";
+import { isSecureUrl } from "./oauth-discovery.ts";
 
 /**
  * GCM's auth tag, pinned to its full 16 bytes at every cipher call. Without
@@ -934,6 +936,15 @@ export interface OAuth2Config {
   grant_type?: "refresh_token" | "client_credentials";
   /** Extra form fields some providers want (audience, scope, …). */
   extra?: Record<string, string>;
+  /** How the client authenticates at the token endpoint (oauth-token.ts):
+   *  absent is the form body, with the secret when there is one. */
+  token_auth?: TokenAuth;
+  /** Plain fields the provider returned beside the first token (Salesforce's
+   *  instance_url) — kept with the recipe, never a credential. */
+  fields?: Record<string, string>;
+  /** The provider's revocation endpoint (RFC 7009): deleting or replacing
+   *  this secret revokes its tokens there (revokeOAuth2). */
+  revocation_url?: string;
 }
 
 const OAUTH2_PREFIX = "@oauth2 ";
@@ -965,9 +976,14 @@ export function setOAuth2Secret(
   if (config.grant_type !== "client_credentials" && !config.refresh_token?.trim()) {
     throw new Error("oauth2 secret needs refresh_token (or grant_type: client_credentials)");
   }
+  if (config.revocation_url !== undefined && (typeof config.revocation_url !== "string" || !isSecureUrl(config.revocation_url))) {
+    throw new Error("revocation_url must be https");
+  }
+  const authProblem = tokenAuthProblem(config);
+  if (authProblem) throw new Error(`oauth2 secret: ${authProblem}`);
   // Loopback is exempt: a token endpoint on this same machine (tests, a
   // local mock, a sidecar) crosses no wire for http to leak on.
-  if (!/^https:\/\//.test(config.token_url) && !/^http:\/\/(127\.0\.0\.1|localhost)[:/]/.test(config.token_url)) {
+  if (!isSecureUrl(config.token_url)) {
     throw new Error("token_url must be https — a refresh token over http is a leaked one");
   }
   setSecret(tenant, name, OAUTH2_PREFIX + JSON.stringify(config), workspace, "oauth2", limit);
@@ -1050,11 +1066,11 @@ async function exchange(config: OAuth2Config, cacheKey: string): Promise<OAuthLi
   if (pending) return pending;
 
   const flight = (async () => {
-    const body = new URLSearchParams({
+    // One builder for every token request (oauth-token.ts): the client's
+    // identity goes where its token_auth says, and an `extra` cannot set it.
+    const request = oauthTokenRequest(config, {
       grant_type: config.grant_type ?? "refresh_token",
       ...(config.grant_type === "client_credentials" ? {} : { refresh_token: config.refresh_token! }),
-      client_id: config.client_id,
-      ...(config.client_secret ? { client_secret: config.client_secret } : {}),
       ...(config.extra ?? {}),
     });
     // A network blip is retried; a provider's answer is not. "fetch failed"
@@ -1069,8 +1085,8 @@ async function exchange(config: OAuth2Config, cacheKey: string): Promise<OAuthLi
       try {
         res = await fetchUntrusted(config.token_url, {
           method: "POST",
-          headers: { "content-type": "application/x-www-form-urlencoded" },
-          body: body.toString(),
+          headers: request.headers,
+          body: request.body,
           signal: AbortSignal.timeout(15_000),
         }, { sameOrigin: true });
       } catch (err) {
@@ -1082,13 +1098,8 @@ async function exchange(config: OAuth2Config, cacheKey: string): Promise<OAuthLi
       break;
     }
     if (!res) throw lastNetwork instanceof Error ? lastNetwork : new Error(String(lastNetwork));
-    const payload = (await res.json().catch(() => ({}))) as {
-      access_token?: string;
-      refresh_token?: string;
-      expires_in?: number;
-      error?: string;
-      error_description?: string;
-    };
+    // JSON or form-encoded, Slack's nested user token, expires_in as a string.
+    const payload = readTokenResponse(await res.text().catch(() => ""), res.headers.get("content-type") ?? "");
     if (!res.ok || !payload.access_token) {
       throw new Error(
         `token refresh failed (${res.status}): ${payload.error_description ?? payload.error ?? "no access_token in the reply"}`,
@@ -1113,6 +1124,135 @@ async function exchange(config: OAuth2Config, cacheKey: string): Promise<OAuthLi
   }
 }
 
+// ---------------------------------------------------------------- revocation
+
+/** The oauth2 recipe stored at exactly this scope — never the account copy a
+ *  workspace would fall back to: revoking is about the copy being removed. */
+export function oauth2ValueAt(tenant: string, name: string, workspace?: string): string | null {
+  const v = openRecord(tenant, workspace, name, read(tenant, workspace)[name]);
+  return v !== null && isOAuth2Value(v) ? v : null;
+}
+
+/** The workspaces with a vault file of their own (current and legacy layout). */
+function workspacesWithSecrets(tenant: string): string[] {
+  const out = new Set<string>();
+  for (const dir of ["workspaces", "projects"]) {
+    const base = path.join(dataRoot(), tenant, dir);
+    let names: string[] = [];
+    try {
+      names = fs.readdirSync(base);
+    } catch {
+      continue;
+    }
+    for (const n of names) if (fs.existsSync(path.join(base, n, "secrets.json"))) out.add(n);
+  }
+  return [...out];
+}
+
+/**
+ * Another stored secret of this account holds a grant revoking this one could
+ * end: the same refresh token (a copy made by hand, or one rotation reached),
+ * or any grant from the same app (token URL and client id). Providers such as
+ * Google revoke every token of a user's grant to an app together, so deleting
+ * the Ads connection would take down the Search Console one made with the
+ * same app (Codex review, 1 Nov 2026). Such a grant is left alone.
+ */
+export function oauthGrantSharedElsewhere(tenant: string, name: string, workspace: string | undefined, refreshToken: string, app?: { token_url: string; client_id: string }): boolean {
+  for (const scope of [undefined, ...workspacesWithSecrets(tenant)]) {
+    for (const [other, rec] of Object.entries(read(tenant, scope))) {
+      if (other === name && scope === workspace) continue;
+      // By the value, not the optional kind tag: a recipe copied with a
+      // plain setSecret is still one materializeSecrets refreshes.
+      const v = openRecord(tenant, scope, other, rec);
+      if (!v || !isOAuth2Value(v)) continue;
+      try {
+        const other = JSON.parse(v.slice(OAUTH2_PREFIX.length)) as OAuth2Config;
+        if (other.refresh_token === refreshToken) return true;
+        if (app && other.grant_type !== "client_credentials" && other.token_url === app.token_url && other.client_id === app.client_id) return true;
+      } catch {
+        continue;
+      }
+    }
+  }
+  return false;
+}
+
+/** What revoking an oauth2 secret's tokens came to. */
+export interface OAuthRevokeResult {
+  /** Nothing was asked: no revocation endpoint; another secret holds the
+   *  same grant or one from the same app; the replacement is from the same
+   *  app (a reconnect: revoking would end the new grant too at providers
+   *  that revoke per app); or the stored recipe could not be read. */
+  skipped?: "no-revocation-url" | "shared-grant" | "same-app" | "unreadable";
+  /** The token types the provider accepted the revocation of. */
+  revoked: ("refresh_token" | "access_token")[];
+  /** Why one failed — reported, never a reason to keep a secret. */
+  error?: string;
+}
+
+type RevokeFetcher = (url: string, init: RequestInit) => Promise<Response>;
+
+/**
+ * Revoke what an oauth2 recipe holds at its provider (RFC 7009): the refresh
+ * token, then the access token this process has cached for it. The client
+ * authenticates as at the token URL (its token_auth). A 200 is success —
+ * the RFC answers 200 for a token already invalid too; anything else is
+ * reported in `error`, and the next token is still tried. `replacement`: the
+ * recipe taking this one's place; one from the same app (token URL and client
+ * id) means nothing is revoked, since a provider that revokes per app would
+ * end the new grant with the old.
+ */
+export async function revokeOAuth2Value(
+  value: string,
+  opts: { tenant?: string; name?: string; workspace?: string; fetcher?: RevokeFetcher; replacement?: { token_url: string; client_id: string } } = {},
+): Promise<OAuthRevokeResult> {
+  let config: OAuth2Config;
+  try {
+    config = JSON.parse(value.slice(OAUTH2_PREFIX.length)) as OAuth2Config;
+  } catch {
+    return { skipped: "unreadable", revoked: [] };
+  }
+  if (!config.revocation_url) return { skipped: "no-revocation-url", revoked: [] };
+  if (opts.replacement && opts.replacement.token_url === config.token_url && opts.replacement.client_id === config.client_id) {
+    return { skipped: "same-app", revoked: [] };
+  }
+  if (config.grant_type !== "client_credentials" && opts.tenant && opts.name
+    && oauthGrantSharedElsewhere(opts.tenant, opts.name, opts.workspace, config.refresh_token ?? "", { token_url: config.token_url, client_id: config.client_id })) {
+    return { skipped: "shared-grant", revoked: [] };
+  }
+  // No redirect is followed: a 3xx is not ok, so a revocation endpoint that
+  // sends us to a login page is reported, never counted as revoked.
+  const fetcher: RevokeFetcher = opts.fetcher ?? ((url, init) => fetchUntrusted(url, init, { sameOrigin: true, noRedirects: true }));
+  const key = tokenCacheKey("oauth2", value, opts.tenant);
+  const access = oauthCache.get(key)?.token;
+  const tokens: ["refresh_token" | "access_token", string][] = [];
+  if (config.grant_type !== "client_credentials" && config.refresh_token) tokens.push(["refresh_token", config.refresh_token]);
+  if (access) tokens.push(["access_token", access]);
+  const out: OAuthRevokeResult = { revoked: [] };
+  for (const [hint, token] of tokens) {
+    try {
+      const request = oauthTokenRequest(config, { token, token_type_hint: hint });
+      const res = await fetcher(config.revocation_url, { method: "POST", headers: request.headers, body: request.body, redirect: "error", signal: AbortSignal.timeout(10_000) });
+      if (res.ok) {
+        await res.body?.cancel().catch(() => {});
+        out.revoked.push(hint);
+      } else {
+        // Reported, and the next token is still tried: a provider that will
+        // not revoke refresh tokens may still revoke the access token.
+        const why = readTokenResponse(await res.text().catch(() => ""), res.headers.get("content-type") ?? "");
+        out.error ??= `the provider refused to revoke the ${hint.replace("_", " ")} (${res.status}${why.error ? `: ${why.error_description ?? why.error}` : ""})`;
+      }
+    } catch (err) {
+      out.error ??= `revoking the ${hint.replace("_", " ")} failed: ${err instanceof Error ? err.message : String(err)}`;
+    }
+  }
+  // Every entry serving that access token goes: after a rotation the same
+  // token is cached under the recipe before and after it (Codex review).
+  oauthCache.delete(key);
+  if (access) for (const [k, v] of oauthCache) if (v.token === access) oauthCache.delete(k);
+  return out;
+}
+
 /**
  * Swap every oauth2 recipe in an env map for a live access token. The one
  * async moment in secret resolution, kept out of the sync paths: callers

package/src/untrusted-fetch.ts

@@ -104,6 +104,10 @@ export async function fetchUntrusted(
     sameOrigin?: boolean;
     /** The most the answer may be, read; MAX_BYTES unless said. */
     maxBytes?: number;
+    /** Follow no redirect at all: a 3xx comes back as the answer, for the
+     *  caller to treat as the failure it is (a revocation that redirects to
+     *  a login page did not revoke anything). */
+    noRedirects?: boolean;
   } = {},
 ): Promise<Response> {
   const maxBytes = opts.maxBytes ?? MAX_BYTES;
@@ -112,7 +116,7 @@ export async function fetchUntrusted(
   for (let hop = 0; ; hop++) {
     const res = await platform.fetchUntrusted(current, { ...req, redirect: "manual" }, { maxBytes });
     const location = REDIRECT.has(res.status) ? res.headers.get("location") : null;
-    if (!location) return capBody(res, maxBytes, current);
+    if (!location || opts.noRedirects) return capBody(res, maxBytes, current);
     // The body of a redirect is never read; free the socket.
     await res.body?.cancel().catch(() => {});
     if (hop >= MAX_REDIRECTS) throw new RedirectRefused(`${url}: more than ${MAX_REDIRECTS} redirects — not followed`);