@opengeni/api-router 0.30.3 → 1.0.0

package/src/integrations/pr-review-provider.ts

@@ -0,0 +1,246 @@
+import type { PrReviewProvider } from "@opengeni/contracts";
+import {
+  pinnedFetch,
+  readResponseJsonBounded,
+  readResponseTextBounded,
+  type FetchLike,
+  type OutboundNetworkSettings,
+} from "@opengeni/network";
+
+const providerVerificationTimeoutMs = 15_000;
+const providerVerificationResponseMaxBytes = 256 * 1024;
+const providerVerificationErrorMaxBytes = 8 * 1024;
+
+export class PrReviewProviderRepositoryError extends Error {
+  constructor(
+    readonly reason: "denied" | "identity_mismatch" | "unavailable",
+    message: string,
+  ) {
+    super(message);
+    this.name = "PrReviewProviderRepositoryError";
+  }
+}
+
+export type VerifiedPrReviewProviderRepository = {
+  repositoryUri: string;
+  repositoryFullName: string;
+  providerRepositoryId: string;
+  projectId: string;
+};
+
+export async function verifyPrReviewProviderRepository(input: {
+  provider: Exclude<PrReviewProvider, "github">;
+  providerBaseUrl: string;
+  providerRepositoryId: string;
+  projectId?: string;
+  token: string;
+  username: string | null;
+  settings: OutboundNetworkSettings;
+  fetchImpl?: FetchLike;
+}): Promise<VerifiedPrReviewProviderRepository> {
+  return input.provider === "gitlab"
+    ? await verifyGitLabRepository(input)
+    : await verifyAzureDevOpsRepository(input);
+}
+
+async function verifyGitLabRepository(
+  input: Parameters<typeof verifyPrReviewProviderRepository>[0],
+): Promise<VerifiedPrReviewProviderRepository> {
+  if (!/^\d+$/.test(input.providerRepositoryId)) {
+    throw new PrReviewProviderRepositoryError(
+      "identity_mismatch",
+      "GitLab repository bindings require the numeric project ID",
+    );
+  }
+  const url = providerApiUrl(
+    input.providerBaseUrl,
+    `api/v4/projects/${encodeURIComponent(input.providerRepositoryId)}`,
+  );
+  const payload = await providerJson(input, url, {
+    authorization: `Bearer ${input.token}`,
+  });
+  const id = scalarId(payload.id);
+  const fullName = nonEmptyText(payload.path_with_namespace);
+  const repositoryUri = credentialFreeHttps(payload.http_url_to_repo, input.providerBaseUrl);
+  if (id !== input.providerRepositoryId || !fullName || !repositoryUri) {
+    throw new PrReviewProviderRepositoryError(
+      "identity_mismatch",
+      "GitLab returned a different or incomplete project identity",
+    );
+  }
+  return {
+    repositoryUri,
+    repositoryFullName: fullName,
+    providerRepositoryId: id,
+    projectId: id,
+  };
+}
+
+async function verifyAzureDevOpsRepository(
+  input: Parameters<typeof verifyPrReviewProviderRepository>[0],
+): Promise<VerifiedPrReviewProviderRepository> {
+  if (!input.projectId) {
+    throw new PrReviewProviderRepositoryError(
+      "identity_mismatch",
+      "Azure DevOps repository bindings require the exact project ID",
+    );
+  }
+  const url = providerApiUrl(
+    input.providerBaseUrl,
+    `${encodeURIComponent(input.projectId)}/_apis/git/repositories/${encodeURIComponent(input.providerRepositoryId)}`,
+  );
+  url.searchParams.set("api-version", "7.1");
+  const authorization = Buffer.from(`${input.username ?? "pr-review"}:${input.token}`).toString(
+    "base64",
+  );
+  const payload = await providerJson(input, url, {
+    authorization: `Basic ${authorization}`,
+  });
+  const project = record(payload.project);
+  const id = scalarId(payload.id);
+  const projectId = scalarId(project?.id);
+  const repositoryName = nonEmptyText(payload.name);
+  const projectName = nonEmptyText(project?.name);
+  const repositoryUri = credentialFreeHttps(payload.remoteUrl, input.providerBaseUrl);
+  if (
+    !id ||
+    id.toLowerCase() !== input.providerRepositoryId.toLowerCase() ||
+    !projectId ||
+    projectId.toLowerCase() !== input.projectId.toLowerCase() ||
+    !repositoryName ||
+    !repositoryUri
+  ) {
+    throw new PrReviewProviderRepositoryError(
+      "identity_mismatch",
+      "Azure DevOps returned a different or incomplete repository identity",
+    );
+  }
+  return {
+    repositoryUri,
+    repositoryFullName: projectName ? `${projectName}/${repositoryName}` : repositoryName,
+    providerRepositoryId: id,
+    projectId,
+  };
+}
+
+async function providerJson(
+  input: Parameters<typeof verifyPrReviewProviderRepository>[0],
+  url: URL,
+  headers: Record<string, string>,
+): Promise<Record<string, unknown>> {
+  const signal = AbortSignal.timeout(providerVerificationTimeoutMs);
+  let response: Response;
+  try {
+    const requestInit = {
+      headers: { accept: "application/json", ...headers },
+      signal,
+    } satisfies RequestInit;
+    response = input.fetchImpl
+      ? await input.fetchImpl(url, requestInit)
+      : await pinnedFetch(url, requestInit, input.settings, {
+          label: `${input.provider} PR Review repository verification`,
+          requireHttpsOutsideLocalTest: true,
+        });
+  } catch {
+    throw new PrReviewProviderRepositoryError(
+      "unavailable",
+      `${input.provider} repository verification is unavailable`,
+    );
+  }
+  if (response.status === 401 || response.status === 403 || response.status === 404) {
+    await readResponseTextBounded(
+      response,
+      providerVerificationErrorMaxBytes,
+      `${input.provider} repository verification error`,
+      { signal },
+    ).catch(() => undefined);
+    throw new PrReviewProviderRepositoryError(
+      "denied",
+      `${input.provider} credential cannot access the requested repository`,
+    );
+  }
+  if (!response.ok) {
+    await readResponseTextBounded(
+      response,
+      providerVerificationErrorMaxBytes,
+      `${input.provider} repository verification error`,
+      { signal },
+    ).catch(() => undefined);
+    throw new PrReviewProviderRepositoryError(
+      "unavailable",
+      `${input.provider} repository verification failed`,
+    );
+  }
+  let payload: unknown;
+  try {
+    payload = await readResponseJsonBounded(
+      response,
+      providerVerificationResponseMaxBytes,
+      `${input.provider} repository metadata`,
+      { signal },
+    );
+  } catch {
+    throw new PrReviewProviderRepositoryError(
+      "unavailable",
+      `${input.provider} returned invalid repository metadata`,
+    );
+  }
+  const parsed = record(payload);
+  if (!parsed) {
+    throw new PrReviewProviderRepositoryError(
+      "unavailable",
+      `${input.provider} returned invalid repository metadata`,
+    );
+  }
+  return parsed;
+}
+
+function providerApiUrl(base: string, suffix: string): URL {
+  const url = new URL(base);
+  url.pathname = `${url.pathname.replace(/\/+$/, "")}/${suffix}`;
+  url.search = "";
+  url.hash = "";
+  return url;
+}
+
+function credentialFreeHttps(value: unknown, providerBaseUrl: string): string | null {
+  if (typeof value !== "string") return null;
+  let candidate: URL;
+  const provider = new URL(providerBaseUrl);
+  try {
+    candidate = new URL(value);
+  } catch {
+    return null;
+  }
+  const providerPath = provider.pathname.replace(/\/+$/, "");
+  if (
+    candidate.protocol !== "https:" ||
+    candidate.username ||
+    candidate.password ||
+    candidate.href.length > 2048 ||
+    candidate.host.toLowerCase() !== provider.host.toLowerCase() ||
+    (providerPath !== "" &&
+      providerPath !== "/" &&
+      candidate.pathname !== providerPath &&
+      !candidate.pathname.startsWith(`${providerPath}/`))
+  ) {
+    return null;
+  }
+  return candidate.href;
+}
+
+function record(value: unknown): Record<string, unknown> | null {
+  return typeof value === "object" && value !== null && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : null;
+}
+
+function scalarId(value: unknown): string | null {
+  if (typeof value === "string" && value.length > 0 && value.length <= 512) return value;
+  if (typeof value === "number" && Number.isSafeInteger(value) && value >= 0) return String(value);
+  return null;
+}
+
+function nonEmptyText(value: unknown): string | null {
+  return typeof value === "string" && value.length > 0 && value.length <= 1024 ? value : null;
+}