@opengeni/api-router 0.7.3 → 0.11.1

package/dist/index.js

@@ -1,6 +1,6 @@
 import {
   createApp
-} from "./chunk-EYYTFA7N.js";
+} from "./chunk-7PQKPKW5.js";
 
 // src/index.ts
 import {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/api-router",
-  "version": "0.7.3",
+  "version": "0.11.1",
   "description": "OpenGeni HTTP surface: the Hono adapter/router (createApp), routes, MCP HTTP transport, and HTTP access adapters over @opengeni/core. An engine-distribution surface — its runtime closure includes engine-internal packages.",
   "license": "Apache-2.0",
   "repository": {
@@ -43,17 +43,18 @@
     "@hono/zod-validator": "^0.7.6",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@opengeni/agent-proto": "^0.3.0",
-    "@opengeni/codex": "^0.2.5",
-    "@opengeni/config": "^0.6.2",
-    "@opengeni/contracts": "^0.15.0",
-    "@opengeni/core": "^0.8.0",
-    "@opengeni/db": "^0.9.3",
-    "@opengeni/documents": "^0.2.19",
-    "@opengeni/events": "^0.3.10",
-    "@opengeni/github": "^0.3.3",
+    "@opengeni/codex": "^0.2.7",
+    "@opengeni/config": "^0.7.0",
+    "@opengeni/contracts": "^0.19.0",
+    "@opengeni/core": "^0.11.1",
+    "@opengeni/db": "^0.12.0",
+    "@opengeni/documents": "^0.2.30",
+    "@opengeni/events": "^0.3.21",
+    "@opengeni/github": "^0.3.12",
+    "@opengeni/network": "^0.1.1",
     "@opengeni/observability": "^0.3.0",
-    "@opengeni/runtime": "^0.11.0",
-    "@opengeni/storage": "^0.2.15",
+    "@opengeni/runtime": "^0.13.3",
+    "@opengeni/storage": "^0.2.24",
     "@temporalio/client": "^1.17.0",
     "better-auth": "^1.6.14",
     "hono": "^4.12.18",

package/src/app.ts

@@ -1,4 +1,5 @@
 import {
+  canonicalizeConfiguredModelId,
   configuredAllowedModels,
   configuredAllowedReasoningEfforts,
   configuredModels,
@@ -37,6 +38,7 @@ import { createApiSandboxClient, makeResumeBoxById } from "./sandbox/access";
 import { requireLimit } from "@opengeni/core";
 import { buildOpenGeniMcpServer } from "./mcp/server";
 import { isToolspaceGrant, prepareToolspaceMcpSurface } from "./mcp/toolspace";
+import { boundedMcpRequest, McpPayloadTooLargeError } from "@opengeni/runtime/mcp-network";
 import { requireAccessKey } from "./http/auth";
 import { registerCapabilityRoutes } from "./routes/capabilities";
 import { registerCatalogAssetRoutes } from "./routes/catalog-assets";
@@ -57,6 +59,7 @@ import { registerScheduledTaskRoutes } from "./routes/scheduled-tasks";
 import { registerSessionRoutes } from "./routes/sessions";
 import { registerSocialRoutes } from "./routes/social";
 import { registerWorkspaceRoutes } from "./routes/workspaces";
+import { projectClientModel } from "./model-catalog";
 
 export type {
   ApiRouteDeps,
@@ -292,22 +295,13 @@ export function createApp(deps: AppDependencies): Hono {
         deploymentRevision: deps.settings.deploymentRevision,
         apiContractRevision: OPENGENI_API_CONTRACT_REVISION,
         ...(deps.settings.serverVersion ? { serverVersion: deps.settings.serverVersion } : {}),
-        defaultModel: deps.settings.openaiModel,
+        defaultModel: canonicalizeConfiguredModelId(deps.settings, deps.settings.openaiModel),
         allowedModels: configuredAllowedModels(deps.settings),
         // Provider-grouped model list for the picker. configuredModels() carries the
         // union of the built-in allow-list and every registry provider's models, in
         // selection order (default model first); project each to the client-safe
         // ClientModel shape (ConfiguredModel.providerId → ClientModel.provider).
-        models: configuredModels(deps.settings).map((model) => ({
-          id: model.id,
-          label: model.label,
-          provider: model.providerId,
-          providerLabel: model.providerLabel,
-          api: model.api,
-          ...(model.contextWindowTokens === undefined
-            ? {}
-            : { contextWindowTokens: model.contextWindowTokens }),
-        })),
+        models: configuredModels(deps.settings).map(projectClientModel),
         defaultReasoningEffort: deps.settings.openaiReasoningEffort,
         allowedReasoningEfforts: configuredAllowedReasoningEfforts(deps.settings),
         mcpServers: deps.settings.mcpServers.map((server) => ({
@@ -330,6 +324,15 @@ export function createApp(deps: AppDependencies): Hono {
 
   app.all("/v1/workspaces/:workspaceId/mcp", async (c) => {
     const workspaceId = c.req.param("workspaceId");
+    let boundedRequest: Request;
+    try {
+      boundedRequest = await boundedMcpRequest(c.req.raw);
+    } catch (error) {
+      if (error instanceof McpPayloadTooLargeError) {
+        throw new HTTPException(413, { message: "MCP request body exceeds the safety limit" });
+      }
+      throw error;
+    }
     const grant = await requireMcpAccessGrant(c, routeDeps, workspaceId);
     const toolspaceGrant = isToolspaceGrant(routeDeps.settings, grant);
     const boundSessionId = grant.metadata?.sessionId;
@@ -353,9 +356,17 @@ export function createApp(deps: AppDependencies): Hono {
         throw error;
       }
     }
-    const toolspace = toolspaceGrant
-      ? await prepareToolspaceMcpSurface({ deps: routeDeps, grant })
-      : null;
+    let toolspace: Awaited<ReturnType<typeof prepareToolspaceMcpSurface>> = null;
+    if (toolspaceGrant) {
+      try {
+        toolspace = await prepareToolspaceMcpSurface({ deps: routeDeps, grant });
+      } catch (error) {
+        if (error instanceof McpPayloadTooLargeError) {
+          throw new HTTPException(413, { message: "MCP tool list exceeds the safety limit" });
+        }
+        throw error;
+      }
+    }
     const workspace = await getWorkspace(routeDeps.db, workspaceId);
     const workspaceMemoryEnabled = resolveWorkspaceMemoryEnabled(workspace?.settings);
     const transport = new WebStandardStreamableHTTPServerTransport({
@@ -368,7 +379,7 @@ export function createApp(deps: AppDependencies): Hono {
     });
     try {
       await mcp.connect(transport);
-      return await transport.handleRequest(c.req.raw);
+      return await transport.handleRequest(boundedRequest);
     } finally {
       await toolspace?.close().catch(() => undefined);
     }
@@ -450,6 +461,9 @@ export function httpStatusForError(error: unknown): number {
   if (error instanceof HTTPException) {
     return error.status;
   }
+  if (error instanceof McpPayloadTooLargeError) {
+    return 413;
+  }
   return 500;
 }
 
@@ -662,6 +676,14 @@ const routeLabelPatterns: Array<{ pattern: RegExp; label: string }> = [
     pattern: /^\/v1\/workspaces\/[^/]+\/files\/[^/]+$/,
     label: "/v1/workspaces/:workspaceId/files/:id",
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/artifacts\/[^/]+\/content$/,
+    label: "/v1/workspaces/:workspaceId/artifacts/:id/content",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/artifacts\/[^/]+$/,
+    label: "/v1/workspaces/:workspaceId/artifacts/:id",
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/api-keys$/,
     label: "/v1/workspaces/:workspaceId/api-keys",

package/src/codex-redemption-security.ts

@@ -0,0 +1,96 @@
+type CodexRedemptionConfirmationClaims = {
+  version: 1;
+  attemptId: string;
+  workspaceId: string;
+  credentialId: string;
+  creditId: string;
+  subjectId: string;
+  browserSessionHash: string;
+  expiresAt: number;
+};
+
+const encoder = new TextEncoder();
+
+function base64UrlEncode(bytes: Uint8Array): string {
+  return Buffer.from(bytes).toString("base64url");
+}
+
+function base64UrlDecode(value: string): Uint8Array | null {
+  try {
+    return new Uint8Array(Buffer.from(value, "base64url"));
+  } catch {
+    return null;
+  }
+}
+
+async function hmac(secret: string, payload: string): Promise<Uint8Array> {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"],
+  );
+  return new Uint8Array(await crypto.subtle.sign("HMAC", key, encoder.encode(payload)));
+}
+
+function constantTimeEqual(left: Uint8Array, right: Uint8Array): boolean {
+  if (left.length !== right.length) return false;
+  let diff = 0;
+  for (let index = 0; index < left.length; index += 1) {
+    diff |= left[index]! ^ right[index]!;
+  }
+  return diff === 0;
+}
+
+export async function hashCodexBrowserSession(sessionId: string): Promise<string> {
+  const digest = await crypto.subtle.digest("SHA-256", encoder.encode(sessionId));
+  return base64UrlEncode(new Uint8Array(digest));
+}
+
+/** Five-minute, session-bound, HMAC-confirmed browser mutation token. */
+export async function signCodexRedemptionConfirmation(
+  secret: string,
+  claims: CodexRedemptionConfirmationClaims,
+): Promise<string> {
+  const payload = base64UrlEncode(encoder.encode(JSON.stringify(claims)));
+  return `${payload}.${base64UrlEncode(await hmac(secret, payload))}`;
+}
+
+export async function verifyCodexRedemptionConfirmation(
+  secret: string,
+  token: string,
+  now = Date.now(),
+): Promise<CodexRedemptionConfirmationClaims | null> {
+  const [payload, signature, extra] = token.split(".");
+  if (!payload || !signature || extra !== undefined) return null;
+  const supplied = base64UrlDecode(signature);
+  const encodedClaims = base64UrlDecode(payload);
+  if (!supplied || !encodedClaims) return null;
+  if (!constantTimeEqual(supplied, await hmac(secret, payload))) return null;
+  let claims: unknown;
+  try {
+    claims = JSON.parse(new TextDecoder().decode(encodedClaims));
+  } catch {
+    return null;
+  }
+  if (!claims || typeof claims !== "object") return null;
+  const value = claims as Record<string, unknown>;
+  if (
+    value.version !== 1 ||
+    typeof value.attemptId !== "string" ||
+    typeof value.workspaceId !== "string" ||
+    typeof value.credentialId !== "string" ||
+    typeof value.creditId !== "string" ||
+    typeof value.subjectId !== "string" ||
+    typeof value.browserSessionHash !== "string" ||
+    typeof value.expiresAt !== "number" ||
+    !Number.isFinite(value.expiresAt) ||
+    value.expiresAt * 1000 <= now
+  ) {
+    return null;
+  }
+  return value as CodexRedemptionConfirmationClaims;
+}
+
+export type { CodexRedemptionConfirmationClaims };

package/src/integrations/oauth-client.ts

@@ -11,7 +11,6 @@ import {
   decryptEnvironmentValue,
   encryptEnvironmentValue,
   getConnectionMetadata,
-  isPrivateAddress,
   listConnectionsMetadata,
   loadIntegrationOAuthClient,
   normalizeBearerScheme,
@@ -20,14 +19,21 @@ import {
   type Database,
 } from "@opengeni/db";
 import { createSignedState, readSignedState } from "@opengeni/github";
+import {
+  DestinationPolicyError,
+  OAUTH_MAX_RESPONSE_BYTES,
+  isLocalTestEnvironment,
+  pinnedFetch,
+  readResponseJsonBounded,
+  validateHttpUrl,
+} from "@opengeni/network";
 import { Buffer } from "node:buffer";
 import { createHash, randomBytes } from "node:crypto";
-import { lookup } from "node:dns/promises";
-import { isIP } from "node:net";
 import { HTTPException } from "hono/http-exception";
 import { canonicalProviderDomain } from "./provider-domain";
 
 export const oauthStateTtlMs = 10 * 60 * 1000;
+export { OAUTH_MAX_RESPONSE_BYTES } from "@opengeni/network";
 
 type OAuthClientDeps = {
   db: Database;
@@ -192,6 +198,7 @@ export async function startMcpOAuth(
   });
   const authorizationUrl = buildAuthorizationUrl({
     endpoint: discovery.as.authorizationEndpoint,
+    settings,
     clientId: client.clientId,
     redirectUri,
     state,
@@ -386,10 +393,14 @@ async function probeMcpChallenge(
     method: "GET",
     headers: { accept: "application/json" },
   });
-  if (response.status !== 401) {
-    return {};
+  try {
+    if (response.status !== 401) {
+      return {};
+    }
+    return parseWwwAuthenticate(response.headers.get("www-authenticate"));
+  } finally {
+    await cancelResponseBody(response);
   }
-  return parseWwwAuthenticate(response.headers.get("www-authenticate"));
 }
 
 async function discoverProtectedResourceMetadata(
@@ -429,10 +440,15 @@ async function discoverAuthorizationServerMetadata(
   authorizationServer: string,
   settings: Settings,
 ): Promise<AuthorizationServerMetadata> {
-  const candidates = uniqueStrings([
+  const safeAuthorizationServer = oauthEndpointUrl(
     authorizationServer,
-    ...wellKnownCandidates(authorizationServer, "oauth-authorization-server"),
-    ...wellKnownCandidates(authorizationServer, "openid-configuration"),
+    settings,
+    "OAuth authorization server",
+  ).replace(/\/+$/, "");
+  const candidates = uniqueStrings([
+    safeAuthorizationServer,
+    ...wellKnownCandidates(safeAuthorizationServer, "oauth-authorization-server"),
+    ...wellKnownCandidates(safeAuthorizationServer, "openid-configuration"),
   ]);
   for (const candidate of candidates) {
     const payload = await fetchJsonObject(candidate, settings).catch((error) => {
@@ -449,18 +465,31 @@ async function discoverAuthorizationServerMetadata(
     if (!authorizationEndpoint || !tokenEndpoint) {
       continue;
     }
-    return {
-      issuer: stringValue(payload.issuer) ?? authorizationServer.replace(/\/+$/, ""),
-      authorizationServer: authorizationServer.replace(/\/+$/, ""),
+    const safeAuthorizationEndpoint = oauthEndpointUrl(
       authorizationEndpoint,
-      tokenEndpoint,
+      settings,
+      "OAuth authorization endpoint",
+    );
+    const safeTokenEndpoint = oauthEndpointUrl(tokenEndpoint, settings, "OAuth token endpoint");
+    const registrationEndpoint = stringValue(payload.registration_endpoint);
+    const issuer = oauthEndpointUrl(
+      stringValue(payload.issuer) ?? safeAuthorizationServer,
+      settings,
+      "OAuth issuer",
+    );
+    const safeRegistrationEndpoint = registrationEndpoint
+      ? oauthEndpointUrl(registrationEndpoint, settings, "OAuth registration endpoint")
+      : undefined;
+    return {
+      issuer,
+      authorizationServer: safeAuthorizationServer,
+      authorizationEndpoint: safeAuthorizationEndpoint,
+      tokenEndpoint: safeTokenEndpoint,
       clientIdMetadataDocumentSupported: payload.client_id_metadata_document_supported === true,
       tokenEndpointAuthMethodsSupported: stringArray(payload.token_endpoint_auth_methods_supported),
       codeChallengeMethodsSupported: stringArray(payload.code_challenge_methods_supported),
       raw: payload,
-      ...(stringValue(payload.registration_endpoint)
-        ? { registrationEndpoint: stringValue(payload.registration_endpoint)! }
-        : {}),
+      ...(safeRegistrationEndpoint ? { registrationEndpoint: safeRegistrationEndpoint } : {}),
     };
   }
   throw new HTTPException(422, {
@@ -661,7 +690,6 @@ async function dynamicClientRegistration(
       message: "authorization server does not support dynamic client registration",
     });
   }
-  await assertOAuthFetchAllowed(as.registrationEndpoint, settings);
   const response = await fetchOAuth(as.registrationEndpoint, settings, {
     method: "POST",
     headers: { "content-type": "application/json", accept: "application/json" },
@@ -675,11 +703,16 @@ async function dynamicClientRegistration(
     }),
   });
   if (!response.ok) {
+    await cancelResponseBody(response);
     throw new HTTPException(422, {
       message: `dynamic client registration failed with HTTP ${response.status}`,
     });
   }
-  const payload = (await response.json()) as Record<string, unknown>;
+  const payload = await readResponseJsonBounded<Record<string, unknown>>(
+    response,
+    OAUTH_MAX_RESPONSE_BYTES,
+    "OAuth dynamic registration response",
+  );
   const clientId = stringValue(payload.client_id);
   if (!clientId) {
     throw new HTTPException(422, {
@@ -726,6 +759,7 @@ async function existingOAuthConnectionForStart(
 
 function buildAuthorizationUrl(input: {
   endpoint: string;
+  settings: Settings;
   clientId: string;
   redirectUri: string;
   state: string;
@@ -733,7 +767,8 @@ function buildAuthorizationUrl(input: {
   verifier: string;
   scopes: string[];
 }): string {
-  const url = new URL(input.endpoint);
+  const endpoint = oauthEndpointUrl(input.endpoint, input.settings, "OAuth authorization endpoint");
+  const url = new URL(endpoint);
   url.searchParams.set("response_type", "code");
   url.searchParams.set("client_id", input.clientId);
   url.searchParams.set("redirect_uri", input.redirectUri);
@@ -775,9 +810,21 @@ function readOAuthState(state: string, settings: Settings): OAuthStatePayload {
       "state.encryptedPkceVerifier",
     ),
     clientId: requiredString(payload.clientId, "state.clientId"),
-    tokenEndpoint: requiredString(payload.tokenEndpoint, "state.tokenEndpoint"),
-    authorizationServer: requiredString(payload.authorizationServer, "state.authorizationServer"),
-    issuer: requiredString(payload.issuer, "state.issuer"),
+    tokenEndpoint: oauthEndpointUrl(
+      requiredString(payload.tokenEndpoint, "state.tokenEndpoint"),
+      settings,
+      "OAuth token endpoint",
+    ),
+    authorizationServer: oauthEndpointUrl(
+      requiredString(payload.authorizationServer, "state.authorizationServer"),
+      settings,
+      "OAuth authorization server",
+    ).replace(/\/+$/, ""),
+    issuer: oauthEndpointUrl(
+      requiredString(payload.issuer, "state.issuer"),
+      settings,
+      "OAuth issuer",
+    ),
     clientRegistrationMethod: registrationMethod(payload.clientRegistrationMethod),
     tokenEndpointAuthMethod: tokenAuthMethod(stringValue(payload.tokenEndpointAuthMethod), false),
     ...(stringValue(payload.encryptedClientSecret)
@@ -825,7 +872,12 @@ async function clientForState(
   }
   if (state.clientRegistrationMethod === "dcr") {
     const stored = await loadIntegrationOAuthClient(db, settings, state.issuer);
-    if (!stored || stored.clientId !== state.clientId) {
+    if (
+      !stored ||
+      stored.clientId !== state.clientId ||
+      stored.issuer !== state.issuer ||
+      stored.authorizationServer !== state.authorizationServer
+    ) {
       throw new HTTPException(400, { message: "OAuth client registration is no longer available" });
     }
     return {
@@ -870,7 +922,6 @@ async function exchangeAuthorizationCode(
     client: OAuthClientRegistration;
   },
 ): Promise<TokenResponse> {
-  await assertOAuthFetchAllowed(input.tokenEndpoint, settings);
   const body = new URLSearchParams();
   body.set("grant_type", "authorization_code");
   body.set("code", input.code);
@@ -905,7 +956,11 @@ async function exchangeAuthorizationCode(
       new Error(`OAuth token endpoint returned HTTP ${response.status}`),
     );
   }
-  const payload = (await response.json()) as Record<string, unknown>;
+  const payload = await readResponseJsonBounded<Record<string, unknown>>(
+    response,
+    OAUTH_MAX_RESPONSE_BYTES,
+    "OAuth token response",
+  );
   const accessToken = stringValue(payload.access_token);
   if (!accessToken) {
     throw new Error("OAuth token response did not include access_token");
@@ -997,12 +1052,17 @@ function safeHost(rawUrl: string): string | undefined {
 async function oauthErrorFromResponse(response: Response): Promise<string | null> {
   const contentType = response.headers.get("content-type") ?? "";
   if (!contentType.toLowerCase().includes("application/json")) {
+    await cancelResponseBody(response);
     return null;
   }
-  const payload = (await response
-    .clone()
-    .json()
-    .catch(() => null)) as Record<string, unknown> | null;
+  // Consume the original response, not a clone. The pinned transport owns a
+  // per-response dispatcher, so leaving the original body unread would retain
+  // its socket pool after a token endpoint error.
+  const payload = await readResponseJsonBounded<Record<string, unknown>>(
+    response,
+    OAUTH_MAX_RESPONSE_BYTES,
+    "OAuth token error response",
+  ).catch(() => null);
   const error = stringValue(payload?.error);
   if (!error || !/^[a-zA-Z0-9_.-]{1,80}$/.test(error)) {
     return null;
@@ -1015,7 +1075,6 @@ async function verifyMcpToolsList(
   resource: string,
   token: TokenResponse,
 ): Promise<Array<{ name: string; description?: string }>> {
-  await assertOAuthFetchAllowed(resource, settings);
   const client = new Client(
     { name: "opengeni-integration-verify", version: "0.1.0" },
     { capabilities: {} },
@@ -1158,6 +1217,20 @@ function canonicalOAuthResource(value: string): string {
   }
 }
 
+function oauthEndpointUrl(rawUrl: string, settings: Settings, label: string): string {
+  try {
+    return validateHttpUrl(rawUrl, {
+      label,
+      allowLoopbackHttp: isLocalTestEnvironment(settings.environment),
+    });
+  } catch (error) {
+    if (error instanceof DestinationPolicyError) {
+      throw new HTTPException(422, { message: error.message });
+    }
+    throw error;
+  }
+}
+
 function safeReturnPath(value: string): string {
   if (!value.startsWith("/") || value.startsWith("//")) {
     throw new HTTPException(400, { message: "OAuth returnPath must be a relative path" });
@@ -1172,9 +1245,14 @@ function safeReturnPath(value: string): string {
 async function fetchJsonObject(url: string, settings: Settings): Promise<Record<string, unknown>> {
   const response = await fetchOAuth(url, settings, { headers: { accept: "application/json" } });
   if (!response.ok) {
+    await cancelResponseBody(response);
     throw new Error(`HTTP ${response.status}`);
   }
-  const payload = await response.json();
+  const payload = await readResponseJsonBounded<unknown>(
+    response,
+    OAUTH_MAX_RESPONSE_BYTES,
+    "OAuth metadata response",
+  );
   if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
     throw new Error("metadata response was not a JSON object");
   }
@@ -1187,56 +1265,64 @@ async function fetchOAuth(
   init: RequestInit = {},
   hop = 0,
 ): Promise<Response> {
-  await assertOAuthFetchAllowed(rawUrl, settings);
-  const response = await fetch(rawUrl, { ...init, redirect: "manual" });
+  let response: Response;
+  try {
+    const endpoint = oauthEndpointUrl(rawUrl, settings, "OAuth endpoint");
+    response = await pinnedFetch(endpoint, init, settings, {
+      label: "OAuth discovery",
+      requireHttpsOutsideLocalTest: true,
+    });
+  } catch (error) {
+    if (error instanceof DestinationPolicyError) {
+      throw new HTTPException(422, { message: error.message });
+    }
+    throw error;
+  }
   if (response.status < 300 || response.status >= 400) {
     return response;
   }
+  // Discovery is the only redirectable OAuth traffic. Replaying a token
+  // exchange, dynamic registration, or authenticated MCP request would send
+  // its body and/or credential headers to a provider-controlled Location.
+  // Keep this allowlist deliberately narrow so future credential headers fail
+  // closed instead of silently becoming redirectable.
+  if (!oauthRequestMayFollowRedirect(init)) {
+    await cancelResponseBody(response);
+    throw new HTTPException(422, {
+      message: "OAuth credential-bearing requests may not follow redirects",
+    });
+  }
   if (hop >= 3) {
+    await cancelResponseBody(response);
     throw new HTTPException(422, { message: "OAuth fetch exceeded maximum redirect hops" });
   }
   const location = response.headers.get("location");
   if (!location) {
+    await cancelResponseBody(response);
     throw new HTTPException(422, { message: "OAuth fetch redirect was missing Location" });
   }
   let nextUrl: string;
   try {
     nextUrl = new URL(location, rawUrl).toString();
   } catch {
+    await cancelResponseBody(response);
     throw new HTTPException(422, { message: "OAuth fetch redirect Location was invalid" });
   }
+  await cancelResponseBody(response);
   return await fetchOAuth(nextUrl, settings, init, hop + 1);
 }
 
-async function assertOAuthFetchAllowed(rawUrl: string, settings: Settings): Promise<void> {
-  const url = new URL(rawUrl);
-  if (!["https:", "http:"].includes(url.protocol)) {
-    throw new HTTPException(422, { message: "OAuth discovery only supports http and https URLs" });
-  }
-  if (
-    settings.integrationsAllowPrivateNetworkTargets ||
-    ["local", "test"].includes(settings.environment)
-  ) {
-    return;
-  }
-  if (url.protocol !== "https:") {
-    throw new HTTPException(422, {
-      message: "OAuth discovery targets must use https outside local/test",
-    });
-  }
-  const hostname = url.hostname.toLowerCase();
-  if (hostname === "localhost" || hostname.endsWith(".localhost")) {
-    throw new HTTPException(422, { message: "OAuth discovery may not target localhost" });
-  }
-  const literal = isIP(hostname);
-  const addresses = literal
-    ? [hostname]
-    : (await lookup(hostname, { all: true })).map((entry) => entry.address);
-  if (addresses.some(isPrivateAddress)) {
-    throw new HTTPException(422, {
-      message: "OAuth discovery may not target private network addresses",
-    });
+function oauthRequestMayFollowRedirect(init: RequestInit): boolean {
+  const method = (init.method ?? "GET").toUpperCase();
+  if ((method !== "GET" && method !== "HEAD") || init.body != null) {
+    return false;
   }
+  const headers = new Headers(init.headers);
+  return [...headers.keys()].every((name) => name === "accept");
+}
+
+async function cancelResponseBody(response: Response): Promise<void> {
+  await response.body?.cancel().catch(() => undefined);
 }
 
 function parseWwwAuthenticate(header: string | null): WwwAuthenticateChallenge {