@oomol-lab/open-connector 1.9.1 → 1.9.3

package/src/core/request.js

@@ -1,3 +1,4 @@
+import { getProviderNetworkPolicy } from "./provider-network-policy.js";
 /**
  * Convert defined scalar values into URL query strings.
  *
@@ -250,8 +251,8 @@ const ipv4EmbeddedIpv6Cidrs = [
     [ipv6ToBytes("2002::"), 16, 2],
 ];
 /**
- * Deployment-level opt-in that lets self-hosted provider connections (currently
- * Dokploy) target RFC 1918, carrier-grade-NAT, and private-hostname addresses.
+ * Read the active asynchronous runtime context’s private-network permission.
+ * Self-hosted providers opt into this permission through their URL and transport guards.
  *
  * Off by default so a shared/multi-tenant runtime keeps a public-only SSRF guard
  * and a tenant cannot turn a self-hosted connection into an SSRF pivot into the
@@ -261,14 +262,8 @@ const ipv4EmbeddedIpv6Cidrs = [
  * Even when enabled, reserved, loopback, link-local, cloud-metadata, multicast,
  * and IPv6 targets remain blocked by {@link assertPublicHttpUrl}.
  */
-let privateNetworkAccessAllowed = false;
-/** Configure whether opted-in providers may target private networks (called once at deployment bootstrap). */
-export function setPrivateNetworkAccessAllowed(allowed) {
-    privateNetworkAccessAllowed = allowed;
-}
-/** Whether the current deployment allows opted-in providers to target private networks. */
 export function isPrivateNetworkAccessAllowed() {
-    return privateNetworkAccessAllowed;
+    return getProviderNetworkPolicy().allowPrivateNetwork ?? false;
 }
 /** Parse the `OOMOL_CONNECT_ALLOW_PRIVATE_NETWORK` flag; only explicit truthy values enable it. */
 export function parsePrivateNetworkAccessFlag(value) {
@@ -279,35 +274,16 @@ export function parsePrivateNetworkAccessFlag(value) {
     return normalized === "1" || normalized === "true" || normalized === "yes" || normalized === "on";
 }
 /**
- * Hosts whose DNS-resolved addresses may use private or VPN-mapped ranges.
- *
- * Zero-trust corporate VPNs (aTrust / EasyConnect class) resolve public SaaS
- * domains into a reserved range — commonly `198.18.0.0/15` — and tunnel the
- * traffic from there, so on those networks a reserved address is the normal
- * path to the real service rather than an SSRF target. Reserved ranges are
- * checked unconditionally, so {@link isPrivateNetworkAccessAllowed} cannot open
- * them, and there is otherwise no way for an operator to say "this host is
- * reachable through my VPN". Loopback, link-local, cloud-metadata, multicast,
- * and other unsafe special-use ranges remain blocked. Empty by default.
- */
-let egressTrustedHosts = [];
-/**
- * Configure the hosts that may resolve through private or VPN-mapped ranges
- * (called once at deployment bootstrap).
- */
-export function setEgressTrustedHosts(hosts) {
-    egressTrustedHosts = hosts;
-}
-/**
- * Whether `hostname` may resolve through private or VPN-mapped ranges.
+ * Whether the active runtime trusts this hostname's private or VPN-mapped DNS answers.
+ * No hosts are trusted outside a configured runtime context.
  *
- * An entry starting with `.` matches that domain and its subdomains
- * (`.feishu.cn` covers `feishu.cn` and `open.feishu.cn`); any other entry must
- * match the host exactly. Only affects addresses a hostname resolves to — a URL
- * whose host is already a literal private or reserved IP is rejected earlier by
- * {@link assertPublicHttpUrl} and this list does not reach it.
+ * An entry starting with `.` matches the domain and its subdomains; other entries
+ * match exactly. The exception applies only to DNS answers, not literal IP URLs.
+ * It supports corporate VPNs that map public domains into private or benchmark
+ * ranges. Loopback, link-local, cloud-metadata and other unsafe addresses remain blocked.
  */
 export function isEgressTrustedHost(hostname) {
+    const egressTrustedHosts = getProviderNetworkPolicy().trustedHosts ?? [];
     if (egressTrustedHosts.length === 0) {
         return false;
     }

package/src/credential-resolver.d.ts

@@ -0,0 +1,24 @@
+import type { IConnectionStore, StoredLocalConnection } from "./connection-store.ts";
+import type { ProviderHttpDispatchOptions } from "./core/provider-http-dispatch.ts";
+import type { ResolvedCredential } from "./core/types.ts";
+import type { IOAuthCredentialRefresher } from "./oauth/oauth-credential-refresh-service.ts";
+interface CredentialResolverOptions {
+    store: IConnectionStore;
+    oauthCredentials?: IOAuthCredentialRefresher;
+    providerHttpDispatch?: ProviderHttpDispatchOptions;
+}
+/** Resolves stored credentials and owns refresh coalescing and revision-safe persistence. */
+export declare class CredentialResolver {
+    private readonly store;
+    private readonly oauthCredentials?;
+    private readonly providerHttpDispatch?;
+    private readonly oauthCredentialRefreshes;
+    constructor(options: CredentialResolverOptions);
+    resolve(connection: StoredLocalConnection): Promise<ResolvedCredential>;
+    private resolveOAuthCredential;
+    private refreshOAuthCredential;
+}
+export declare function isOAuthCredentialExpired(credential: Extract<ResolvedCredential, {
+    authType: "oauth2";
+}>): boolean;
+export {};

package/src/credential-resolver.js

@@ -0,0 +1,131 @@
+import { ConnectionError } from "./connection-error.js";
+import { withProviderHttpDispatchResult } from "./providers/provider-runtime.js";
+const OAUTH_REFRESH_PERSIST_ATTEMPTS = 3;
+/**
+ * Lays a refresh result onto the connection's current credential. A refresh owns the token
+ * fields and the metadata keys it changed; everything else on `current` belongs to whoever
+ * bumped the revision and is kept.
+ */
+function mergeRefreshedOAuthCredential(current, spent, refreshed) {
+    const metadata = { ...current.metadata };
+    for (const [key, value] of Object.entries(refreshed.metadata)) {
+        if (JSON.stringify(value) !== JSON.stringify(spent.metadata[key]))
+            metadata[key] = value;
+    }
+    // A successful refresh proves the authorization is live, so a concurrent refusal's mark is stale.
+    delete metadata.oauthReauthRequired;
+    return {
+        ...current,
+        accessToken: refreshed.accessToken,
+        tokenType: refreshed.tokenType,
+        expiresAt: refreshed.expiresAt,
+        refreshToken: refreshed.refreshToken,
+        providerSecret: refreshed.providerSecret,
+        metadata,
+    };
+}
+/** Resolves stored credentials and owns refresh coalescing and revision-safe persistence. */
+export class CredentialResolver {
+    store;
+    oauthCredentials;
+    providerHttpDispatch;
+    oauthCredentialRefreshes = new Map();
+    constructor(options) {
+        this.store = options.store;
+        this.oauthCredentials = options.oauthCredentials;
+        this.providerHttpDispatch = options.providerHttpDispatch;
+    }
+    async resolve(connection) {
+        return connection.credential.authType === "oauth2"
+            ? this.resolveOAuthCredential(connection, connection.credential)
+            : connection.credential;
+    }
+    async resolveOAuthCredential(connection, credential) {
+        const service = connection.service;
+        if (credential.metadata.oauthReauthRequired === true) {
+            throw new ConnectionError("oauth_reauth_required", `OAuth authorization is no longer valid. Reconnect ${service}.`);
+        }
+        if (!isOAuthCredentialExpired(credential)) {
+            return credential;
+        }
+        if (!credential.refreshToken) {
+            throw new ConnectionError("oauth_token_expired", `${service} OAuth access token expired and no refresh token is available. Reconnect ${service}.`);
+        }
+        if (!this.oauthCredentials) {
+            throw new ConnectionError("oauth_refresh_unavailable", `${service} OAuth access token expired and this runtime cannot refresh it.`);
+        }
+        // Single-flight on the refresh token being spent, not the row revision: a single-use
+        // (rotating) refresh token must reach the provider once even when an unrelated write
+        // bumps the revision mid-refresh. A new authorization must refresh independently,
+        // even when the provider reuses the same refresh token across reconnects.
+        const refreshKey = JSON.stringify([
+            connection.id,
+            credential.refreshToken,
+            credential.metadata.oauthAuthorizationId,
+        ]);
+        const currentRefresh = this.oauthCredentialRefreshes.get(refreshKey);
+        if (currentRefresh) {
+            return currentRefresh;
+        }
+        const refresh = this.refreshOAuthCredential(connection, credential, this.oauthCredentials);
+        this.oauthCredentialRefreshes.set(refreshKey, refresh);
+        try {
+            return await refresh;
+        }
+        finally {
+            if (this.oauthCredentialRefreshes.get(refreshKey) === refresh) {
+                this.oauthCredentialRefreshes.delete(refreshKey);
+            }
+        }
+    }
+    async refreshOAuthCredential(connection, credential, refresher) {
+        const { id, revision, service, connectionName } = connection;
+        let nextCredential;
+        try {
+            nextCredential = await withProviderHttpDispatchResult({ operation: "oauth", service, connectionId: id, connectionName }, () => refresher.refresh(service, credential), this.providerHttpDispatch);
+        }
+        catch (error) {
+            if (error instanceof ConnectionError && error.code === "oauth_reauth_required") {
+                // The revision fence prevents a late refusal from marking a replacement authorization as expired.
+                await this.store.updateCredential({
+                    id,
+                    revision,
+                    service,
+                    connectionName,
+                    credential: { ...credential, metadata: { ...credential.metadata, oauthReauthRequired: true } },
+                }, true);
+            }
+            throw error;
+        }
+        // The provider has now spent the old refresh token. With rotating single-use refresh
+        // tokens, discarding `nextCredential` loses the connection for good, so a lost
+        // revision race re-reads the row and lands the refreshed token fields on the latest
+        // revision, as long as that row still holds the credential this refresh spent.
+        let target = { ...connection, source: "local", credential: nextCredential };
+        for (let attempt = 0; attempt < OAUTH_REFRESH_PERSIST_ATTEMPTS; attempt++) {
+            if (await this.store.updateCredential(target, true))
+                return target.credential;
+            const current = await this.store.get(service, connectionName);
+            if (current?.source === "saas" ||
+                current?.id !== id ||
+                current.credential.authType !== "oauth2" ||
+                current.credential.refreshToken !== credential.refreshToken ||
+                current.credential.metadata.oauthAuthorizationId !== credential.metadata.oauthAuthorizationId) {
+                // Deleted, converted, reconnected, or already rotated elsewhere: never overwrite it.
+                break;
+            }
+            target = {
+                ...current,
+                credential: mergeRefreshedOAuthCredential(current.credential, credential, nextCredential),
+            };
+        }
+        throw new ConnectionError("connection_not_found", `${service} connection changed while its OAuth credential was refreshing. Retry the action.`);
+    }
+}
+export function isOAuthCredentialExpired(credential) {
+    if (!credential.expiresAt) {
+        return false;
+    }
+    const expiresAt = Date.parse(credential.expiresAt);
+    return Number.isFinite(expiresAt) && expiresAt <= Date.now() + 60_000;
+}

package/src/mcp.js

@@ -1,6 +1,6 @@
 import { createMcpHandler, McpServer } from "@modelcontextprotocol/server";
 import * as z from "zod/v4";
-import { ConnectionError } from "./connection-service.js";
+import { ConnectionError } from "./connection-error.js";
 import { createActionSearchIndexProvider, searchActions as searchActionIndex } from "./core/action-search.js";
 import { describeSchemaType, readSchemaProperties, readSchemaRequired } from "./core/json-schema.js";
 import { renderActionMarkdown } from "./server/api/action-markdown.js";

package/src/oauth/oauth-client-config-service.d.ts

@@ -20,7 +20,7 @@ export type OAuthClientConfig = {
 };
 export interface OAuthClientConfigInput {
     clientId: string;
-    clientSecret: string;
+    clientSecret?: string;
     /** Non-empty provider-declared scope subset to request. Omit to use every provider default. */
     requestedScopes?: string[];
     /** Absolute redirect URI override, any scheme. Omit to use the runtime callback. */

package/src/oauth/oauth-client-config-service.js

@@ -34,14 +34,26 @@ export class OAuthClientConfigService {
         return normalizeStoredOAuthClientConfig(await this.store.get(service));
     }
     async upsertConfig(input) {
-        const config = this.normalizeConfig(input.service, input);
+        const previous = await this.getConfig(input.service);
+        const sameClient = previous?.clientId === input.clientId.trim();
+        const secretExtra = sameClient ? { ...previous?.secretExtra } : {};
+        for (const field of filterClientConfigFields(this.getOAuthDefinition(input.service).clientConfigFields, "secretExtra")) {
+            if (input.extra && field.key in input.extra)
+                secretExtra[field.key] = input.extra[field.key];
+        }
+        Object.assign(secretExtra, input.secretExtra);
+        const config = this.normalizeConfig(input.service, {
+            ...input,
+            clientSecret: input.clientSecret ?? (sameClient ? previous?.clientSecret : undefined),
+            secretExtra,
+        });
         await this.store.set(config);
         return this.toSummary(input.service, this.getOAuthDefinition(input.service), config);
     }
     normalizeConfig(service, input) {
         const auth = this.getOAuthDefinition(service);
         const clientId = input.clientId.trim();
-        const clientSecret = input.clientSecret.trim();
+        const clientSecret = (input.clientSecret ?? "").trim();
         if (!clientId) {
             throw new OAuthClientConfigError("invalid_input", "clientId is required.");
         }

package/src/oauth/oauth-credential-refresh-service.js

@@ -1,4 +1,4 @@
-import { ConnectionError } from "../connection-service.js";
+import { ConnectionError } from "../connection-error.js";
 import { optionalRecord, stringRecord } from "../core/cast.js";
 import { providerFetch } from "../providers/provider-runtime.js";
 import { readOAuthClientConfigMetadata } from "./oauth-client-config-service.js";

package/src/oauth/oauth-flow-service.d.ts

@@ -1,4 +1,5 @@
-import type { StoredConnection, ConnectionService } from "../connection-service.ts";
+import type { ConnectionService } from "../connection-service.ts";
+import type { StoredConnection } from "../connection-store.ts";
 import type { IProviderLoader } from "../providers/provider-loader.ts";
 import type { SaasOAuthService } from "../saas/saas-oauth-service.ts";
 import type { ISecretCodec } from "../server/secrets/secret-codec-core.ts";
@@ -81,6 +82,13 @@ export declare class OAuthFlowService {
     startConnectionRequest(input: OAuthConnectionRequestInput): Promise<OAuthConnectionRequestStart>;
     getConnectionRequest(id: string, owner: string): Promise<ConnectionRequest | undefined>;
     rejectAuthorization(state: string, denied: boolean): Promise<string | undefined>;
+    /**
+     * Ends a runtime authorization (`POST /api/oauth/authorizations`) that the
+     * provider refused, so a later callback for the same state cannot complete
+     * it. Returns false when no such authorization was pending (unknown, or
+     * already completed or refused by another callback).
+     */
+    discardAuthorization(state: string): Promise<boolean>;
     private prepareAuthorization;
     completeAuthorization(input: OAuthAuthorizationCompleteInput): Promise<{
         service: string;

package/src/oauth/oauth-flow-service.js

@@ -1,5 +1,6 @@
 import { createHash, randomBytes } from "node:crypto";
-import { ConnectionError, normalizeConnectionName } from "../connection-service.js";
+import { ConnectionError } from "../connection-error.js";
+import { normalizeConnectionName } from "../connection-service.js";
 import { providerFetch, ProviderDispatchRequestError, withProviderHttpDispatchResult, } from "../providers/provider-runtime.js";
 import { requestAuthorizationCodeToken } from "./oauth-token.js";
 /**
@@ -97,6 +98,15 @@ export class OAuthFlowService {
         await this.requests.fail(pending.connectionRequestId, denied ? "invalid_input" : "provider_error", denied ? "Authorization was denied." : "OAuth connection failed.");
         return callbackReturnUri(pending, "error", denied ? "invalid_input" : "provider_error", denied ? "Authorization was denied." : "OAuth connection failed.");
     }
+    /**
+     * Ends a runtime authorization (`POST /api/oauth/authorizations`) that the
+     * provider refused, so a later callback for the same state cannot complete
+     * it. Returns false when no such authorization was pending (unknown, or
+     * already completed or refused by another callback).
+     */
+    async discardAuthorization(state) {
+        return (await this.states.take(state)) !== undefined;
+    }
     async prepareAuthorization(input, requestConfig) {
         const { service } = input;
         const connectionName = normalizeConnectionName(input.connectionName);

package/src/providers/abuseipdb/executors.js

@@ -1,9 +1,8 @@
 import { isIP } from "node:net";
 import { nullableString, optionalBoolean, optionalInteger, optionalRecord, optionalString } from "../../core/cast.js";
-import { defineProviderExecutors, defineProviderProxy, isAbortLikeError, providerUserAgent, ProviderRequestError, requireApiKeyCredential, requiredResponseRecord, } from "../provider-runtime.js";
+import { defineProviderExecutors, defineProviderProxy, isAbortLikeError, providerUserAgent, ProviderRequestError, requireApiKeyCredential, requiredResponseRecord, defaultProviderRequestTimeoutMs, } from "../provider-runtime.js";
 const service = "abuseipdb";
 const abuseipdbApiBaseUrl = "https://api.abuseipdb.com/api/v2";
-const abuseipdbDefaultRequestTimeoutMs = 30_000;
 const abuseipdbValidationIpAddress = "8.8.8.8";
 export const abuseipdbActionHandlers = {
     check_ip(input, context) {
@@ -182,8 +181,8 @@ async function requestAbuseipdbJson(input) {
     let response;
     let payload;
     const signal = input.context.signal
-        ? AbortSignal.any([input.context.signal, AbortSignal.timeout(abuseipdbDefaultRequestTimeoutMs)])
-        : AbortSignal.timeout(abuseipdbDefaultRequestTimeoutMs);
+        ? AbortSignal.any([input.context.signal, AbortSignal.timeout(defaultProviderRequestTimeoutMs)])
+        : AbortSignal.timeout(defaultProviderRequestTimeoutMs);
     try {
         response = await input.context.fetcher(buildAbuseipdbUrl(input.path, input.query ?? {}), {
             method: "GET",