@opengeni/api-router 0.30.3 → 1.0.0

package/src/integrations/connect-authority.ts

@@ -0,0 +1,2 @@
+// API adapters and core host-binding admission share one authority implementation.
+export { requireConnectOwnerAuthority } from "@opengeni/core";

package/src/integrations/connect-callback-return.ts

@@ -0,0 +1,86 @@
+import type { Hono } from "hono";
+import type { ApiRouteDeps } from "@opengeni/core";
+import { getConnectAttempt } from "@opengeni/db";
+import { readSignedState } from "@opengeni/github";
+import { z } from "zod";
+
+const callbacks = new Set([
+  "/v1/integrations/slack/callback",
+  "/v1/integrations/fiken/callback",
+  "/v1/integrations/atlassian/callback",
+  "/v1/integrations/google-drive/callback",
+  "/v1/integrations/oauth/callback",
+  "/v1/integrations/provider-oauth/callback",
+  "/v1/integrations/github-personal/oauth/callback",
+  "/v1/social/oauth/callback",
+  "/v1/github/oauth/callback",
+  "/v1/github/setup",
+  "/v1/github/install/callback",
+  "/v1/pr-review/github/oauth/callback",
+  "/v1/pr-review/github/setup",
+  "/v1/pr-review/github/install/callback",
+]);
+const locator = z.object({
+  accountId: z.string().uuid(),
+  workspaceId: z.string().uuid(),
+  subjectId: z.string().min(1).max(1024),
+  connectAttemptId: z.string().uuid(),
+  iat: z.number().int().nonnegative(),
+});
+
+/** Navigation-only recovery. Recently expired signed state can identify the host's saved
+ * destination, but cannot authorize exchange, persistence, or credential use.
+ * Normal callbacks independently enforce current time and live authority. */
+export function registerConnectCallbackReturns(app: Hono, deps: ApiRouteDeps) {
+  app.use("/v1/*", async (c, next) => {
+    if (c.req.method !== "GET" || !callbacks.has(c.req.path)) return next();
+    const raw = c.req.query("state");
+    if (!raw || raw.length > 32_768) return next();
+    let candidate: z.infer<typeof locator>;
+    try {
+      candidate = locator.parse(
+        JSON.parse(Buffer.from(raw.split(".")[0]!, "base64url").toString("utf8")),
+      );
+    } catch {
+      return next();
+    }
+    const secret =
+      c.req.path.startsWith("/v1/github/") || c.req.path.startsWith("/v1/pr-review/github/")
+        ? deps.githubStateSecret
+        : deps.settings.integrationsStateSecret?.trim();
+    // Verify at the signed timestamp ONLY for a read of the immutable return
+    // destination. Never pass this timestamp to the actual provider callback.
+    // Keep recovery useful after a normal provider timeout, without making a
+    // signed callback an indefinitely reusable redirect. This does not change
+    // the trusted backend's exact destination or provider exchange expiry.
+    const now = Math.floor(Date.now() / 1000);
+    const recoveryWindow = candidate.iat <= now + 60 && candidate.iat >= now - 24 * 60 * 60;
+    const verified =
+      secret && recoveryWindow
+        ? locator.safeParse(readSignedState(raw, secret, candidate.iat))
+        : null;
+    let destination: string | undefined;
+    if (verified?.success) {
+      try {
+        destination = (
+          await getConnectAttempt(deps.db, verified.data, verified.data.connectAttemptId)
+        ).returnUrl;
+      } catch {
+        /* Deleted attempts or unavailable storage cannot supply a return. */
+      }
+    }
+    await next();
+    c.res = destination
+      ? new Response(null, {
+          status: 302,
+          headers: { location: destination, "cache-control": "no-store" },
+        })
+      : new Response(
+          "Connection setup could not be completed. Return to the application and start again.",
+          {
+            status: 400,
+            headers: { "content-type": "text/plain; charset=utf-8", "cache-control": "no-store" },
+          },
+        );
+  });
+}