@opengeni/db 0.7.3 → 0.10.7

package/src/connection-token-resolver.ts

@@ -3,8 +3,25 @@ import {
   type McpServerConnectionRef,
   type Settings,
 } from "@opengeni/config";
+import type {
+  ConnectionCredentialsPort,
+  McpConnectionResourceScope,
+  McpCredentialAuthNeededReason,
+  McpCredentialsRequest,
+  TurnInitiator,
+  TurnInitiatorContext,
+} from "@opengeni/contracts";
+import {
+  OAUTH_MAX_RESPONSE_BYTES,
+  pinnedFetch,
+  readResponseJsonBounded,
+  undiciFetch,
+  validateHttpUrl,
+  type DnsLookup,
+  type FetchLike,
+} from "@opengeni/network";
+export { isPrivateAddress } from "@opengeni/network";
 import { Buffer } from "node:buffer";
-import { lookup } from "node:dns/promises";
 import { isIP } from "node:net";
 import { encryptEnvironmentValue } from "./environment-crypto";
 import {
@@ -20,11 +37,13 @@ export type ResolveConnectionCredentialResult =
   | { status: "ok"; headers: Record<string, string>; connectionId: string; expiresAt?: Date | null }
   | {
       status: "auth_needed";
-      reason: "missing_connection" | "expired" | "insufficient_scope" | "refresh_failed";
+      reason: McpCredentialAuthNeededReason;
       providerDomain: string;
+      provider?: string;
       connectionId?: string;
       scopes?: string[];
       resource?: string;
+      selectedResources?: McpConnectionResourceScope[];
       authorizationUrl?: string;
     };
 type AuthNeededReason = Extract<
@@ -36,11 +55,277 @@ export type ResolveConnectionCredentialInput = {
   workspaceId: string;
   subjectId?: string;
   serverId: string;
+  toolName?: string;
+  /** @deprecated Use toolName. Retained for the API's pre-existing broker call shape. */
   toolId?: string;
   connectionRef: McpServerConnectionRef;
+  /** Exact MCP destination whose request would receive the resolved headers. */
+  destinationUrl: string;
   forceRefresh?: boolean;
 };
 
+export type HostMcpCredentialResolverContext = {
+  accountId: string;
+  workspaceId: string;
+  sessionId: string;
+  rootSessionId: string;
+  turnId: string;
+  attemptId: string | null;
+  executionGeneration: number;
+  initiator: TurnInitiator;
+  initiatorContext: TurnInitiatorContext;
+  surface: McpCredentialsRequest["surface"];
+};
+
+export class HostMcpCredentialScopeError extends Error {
+  constructor(field: "accountId" | "workspaceId" | "sessionId") {
+    super(`host MCP credential ${field} scope mismatch`);
+    this.name = "HostMcpCredentialScopeError";
+  }
+}
+
+export class HostMcpCredentialBindingError extends Error {
+  constructor(
+    field:
+      | "provider"
+      | "providerDomain"
+      | "connectionId"
+      | "scopes"
+      | "resource"
+      | "selectedResources"
+      | "destinationUrl",
+  ) {
+    super(`host MCP credential ${field} binding mismatch`);
+    this.name = "HostMcpCredentialBindingError";
+  }
+}
+
+/**
+ * Adapts the public embedding credential port to the runtime's connection
+ * resolver contract. Scope echoes are checked before credential headers can
+ * reach a request; the returned object is a fresh copy so a host cannot mutate
+ * headers after resolution.
+ */
+export function buildHostConnectionTokenResolver(
+  resolve: NonNullable<ConnectionCredentialsPort["mcpCredentials"]>,
+  context: HostMcpCredentialResolverContext,
+): (input: ResolveConnectionCredentialInput) => Promise<ResolveConnectionCredentialResult> {
+  return async (input) => {
+    if (input.workspaceId !== context.workspaceId) {
+      throw new HostMcpCredentialScopeError("workspaceId");
+    }
+    const destinationUrl = canonicalHttpUrl(input.destinationUrl);
+    if (
+      !destinationUrl ||
+      !destinationHostMatchesProvider(destinationUrl, input.connectionRef.providerDomain)
+    ) {
+      throw new HostMcpCredentialBindingError("destinationUrl");
+    }
+    const toolName = input.toolName ?? input.toolId;
+    const request: McpCredentialsRequest = {
+      accountId: context.accountId,
+      workspaceId: context.workspaceId,
+      sessionId: context.sessionId,
+      rootSessionId: context.rootSessionId,
+      turnId: context.turnId,
+      attemptId: context.attemptId,
+      executionGeneration: context.executionGeneration,
+      initiator: context.initiator,
+      initiatorContext: { ...context.initiatorContext },
+      surface: context.surface,
+      destinationUrl,
+      serverId: input.serverId,
+      connectionRef: {
+        providerDomain: input.connectionRef.providerDomain,
+        ...(input.connectionRef.provider ? { provider: input.connectionRef.provider } : {}),
+        ...(input.connectionRef.connectionId
+          ? { connectionId: input.connectionRef.connectionId }
+          : {}),
+        ...(input.connectionRef.kind ? { kind: input.connectionRef.kind } : {}),
+        ...(input.connectionRef.scopes ? { scopes: [...input.connectionRef.scopes] } : {}),
+        ...(input.connectionRef.resource ? { resource: input.connectionRef.resource } : {}),
+        ...(input.connectionRef.selectedResources
+          ? { selectedResources: copySelectedResources(input.connectionRef.selectedResources) }
+          : {}),
+        ...(input.connectionRef.subjectScope
+          ? { subjectScope: input.connectionRef.subjectScope }
+          : {}),
+      },
+      forceRefresh: input.forceRefresh === true,
+      ...(toolName ? { toolName } : {}),
+      ...(input.subjectId ? { callerSubjectId: input.subjectId } : {}),
+    };
+    const result = await resolve(request);
+    assertHostMcpCredentialScope(result, context);
+    assertHostMcpCredentialBinding(result, input.connectionRef);
+    if (result.status === "auth_needed") {
+      const authorizationUrl = normalizedAuthorizationUrl(result.authorizationUrl);
+      return {
+        status: "auth_needed",
+        reason: result.reason,
+        providerDomain: result.providerDomain,
+        ...(result.provider ? { provider: result.provider } : {}),
+        ...(result.connectionId ? { connectionId: result.connectionId } : {}),
+        ...(result.scopes ? { scopes: [...result.scopes] } : {}),
+        ...(result.resource ? { resource: result.resource } : {}),
+        ...(result.selectedResources
+          ? { selectedResources: copySelectedResources(result.selectedResources) }
+          : {}),
+        ...(authorizationUrl ? { authorizationUrl } : {}),
+      };
+    }
+    if (result.connectionId.length === 0) {
+      throw new Error("host MCP credential returned an empty connectionId");
+    }
+    const expiresAt = parseHostCredentialExpiry(result.expiresAt);
+    return {
+      status: "ok",
+      headers: normalizedHostCredentialHeaders(result.headers),
+      connectionId: result.connectionId,
+      ...(expiresAt !== undefined ? { expiresAt } : {}),
+    };
+  };
+}
+
+function assertHostMcpCredentialBinding(
+  result: Awaited<ReturnType<NonNullable<ConnectionCredentialsPort["mcpCredentials"]>>>,
+  requested: McpServerConnectionRef,
+): void {
+  if (result.providerDomain !== requested.providerDomain) {
+    throw new HostMcpCredentialBindingError("providerDomain");
+  }
+  if (result.provider !== requested.provider) {
+    throw new HostMcpCredentialBindingError("provider");
+  }
+  if (requested.connectionId && result.connectionId !== requested.connectionId) {
+    throw new HostMcpCredentialBindingError("connectionId");
+  }
+  if (!sameSelectedResources(result.selectedResources, requested.selectedResources)) {
+    throw new HostMcpCredentialBindingError("selectedResources");
+  }
+  if (result.status === "ok") {
+    if (!sameStringSet(result.scopes, requested.scopes)) {
+      throw new HostMcpCredentialBindingError("scopes");
+    }
+    if (result.resource !== requested.resource) {
+      throw new HostMcpCredentialBindingError("resource");
+    }
+  }
+}
+
+function sameStringSet(left: string[] | undefined, right: string[] | undefined): boolean {
+  if (left === undefined || right === undefined) return left === right;
+  if (left.length !== right.length) return false;
+  const sortedLeft = [...left].sort();
+  const sortedRight = [...right].sort();
+  return sortedLeft.every((value, index) => value === sortedRight[index]);
+}
+
+function sameSelectedResources(
+  left: McpConnectionResourceScope[] | undefined,
+  right: McpConnectionResourceScope[] | undefined,
+): boolean {
+  if (left === undefined || right === undefined) return left === right;
+  const leftKeys = copySelectedResources(left)
+    .map((resource) => `${resource.kind}\0${resource.id}`)
+    .sort();
+  const rightKeys = copySelectedResources(right)
+    .map((resource) => `${resource.kind}\0${resource.id}`)
+    .sort();
+  return (
+    leftKeys.length === rightKeys.length &&
+    leftKeys.every((value, index) => value === rightKeys[index])
+  );
+}
+
+function copySelectedResources(
+  resources: McpConnectionResourceScope[],
+): McpConnectionResourceScope[] {
+  if (resources.length === 0 || resources.length > 256) {
+    throw new Error("host MCP credential returned an invalid selected resource count");
+  }
+  const seen = new Set<string>();
+  return resources.map((resource) => {
+    if (
+      resource.kind !== "repository" ||
+      typeof resource.id !== "string" ||
+      resource.id.length === 0 ||
+      resource.id.length > 512
+    ) {
+      throw new Error("host MCP credential returned an invalid selected resource");
+    }
+    const key = `${resource.kind}\0${resource.id}`;
+    if (seen.has(key)) {
+      throw new Error("host MCP credential returned duplicate selected resources");
+    }
+    seen.add(key);
+    return { kind: resource.kind, id: resource.id };
+  });
+}
+
+function assertHostMcpCredentialScope(
+  result: { accountId: string; workspaceId: string; sessionId: string },
+  context: HostMcpCredentialResolverContext,
+): void {
+  for (const field of ["accountId", "workspaceId", "sessionId"] as const) {
+    if (result[field] !== context[field]) {
+      throw new HostMcpCredentialScopeError(field);
+    }
+  }
+}
+
+function normalizedHostCredentialHeaders(headers: Record<string, string>): Record<string, string> {
+  const entries = Object.entries(headers);
+  if (entries.length === 0 || entries.length > 32) {
+    throw new Error("host MCP credential returned an invalid header count");
+  }
+  const normalized: Record<string, string> = {};
+  for (const [name, value] of entries) {
+    if (
+      name.length > 256 ||
+      !/^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/.test(name) ||
+      value.length === 0 ||
+      value.length > 16_384 ||
+      /[\r\n\0]/.test(value)
+    ) {
+      throw new Error("host MCP credential returned an invalid header");
+    }
+    normalized[name] = value;
+  }
+  return normalized;
+}
+
+function normalizedAuthorizationUrl(value: string | undefined): string | undefined {
+  if (!value) return undefined;
+  let url: URL;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error("host MCP credential returned an invalid authorizationUrl");
+  }
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && isLoopbackHost(url.hostname))) {
+    throw new Error("host MCP credential returned an invalid authorizationUrl");
+  }
+  return url.toString();
+}
+
+function isLoopbackHost(hostname: string): boolean {
+  if (hostname === "localhost" || hostname === "::1") return true;
+  if (isIP(hostname) !== 4) return false;
+  const [first] = hostname.split(".");
+  return first === "127";
+}
+
+function parseHostCredentialExpiry(value: string | null | undefined): Date | null | undefined {
+  if (value === undefined) return undefined;
+  if (value === null) return null;
+  const parsed = new Date(value);
+  if (!Number.isFinite(parsed.getTime())) {
+    throw new Error("host MCP credential returned an invalid expiresAt");
+  }
+  return parsed;
+}
+
 export type ConnectionBrokerDeps = {
   loadCredential: typeof loadConnectionCredentialForBroker;
   recordRefresh: typeof recordConnectionTokenRefresh;
@@ -52,6 +337,11 @@ export type ConnectionBrokerDeps = {
   now: () => Date;
 };
 
+export type RefreshTransportOptions = {
+  fetchImpl?: FetchLike;
+  dnsLookup?: DnsLookup;
+};
+
 const defaultDeps: ConnectionBrokerDeps = {
   loadCredential: loadConnectionCredentialForBroker,
   recordRefresh: recordConnectionTokenRefresh,
@@ -65,14 +355,19 @@ const defaultDeps: ConnectionBrokerDeps = {
 
 const inflight = new Map<string, Promise<ConnectionCredentialForBroker>>();
 const REFRESH_WINDOW_MS = 60_000;
+const CONNECTION_REFRESH_TIMEOUT_MS = 10_000;
 
 export function buildConnectionTokenResolver(
   db: Database,
   settings: Settings,
   deps: ConnectionBrokerDeps = defaultDeps,
 ): (input: ResolveConnectionCredentialInput) => Promise<ResolveConnectionCredentialResult> {
+  type CredentialLookupInput = Pick<
+    ResolveConnectionCredentialInput,
+    "workspaceId" | "connectionRef" | "subjectId"
+  >;
   const load = async (
-    input: ResolveConnectionCredentialInput,
+    input: CredentialLookupInput,
   ): Promise<ConnectionCredentialForBroker | null> => {
     const request: Parameters<typeof loadConnectionCredentialForBroker>[2] = {
       workspaceId: input.workspaceId,
@@ -95,19 +390,27 @@ export function buildConnectionTokenResolver(
   const snapshot = async (
     cred: ConnectionCredentialForBroker,
     ref: McpServerConnectionRef,
+    destinationUrl: string,
   ): Promise<ResolveConnectionCredentialResult> => {
     if (cred.status !== "active") {
       return authNeededForStatus(cred, ref);
     }
+    if (!connectionBindingMatches(cred, ref, destinationUrl)) {
+      return authNeeded(ref, "missing_connection", cred.id);
+    }
     const missingScopes = missingRequestedScopes(ref.scopes, cred.grantedScopes);
     if (missingScopes.length > 0) {
       return {
         status: "auth_needed",
         reason: "insufficient_scope",
         providerDomain: ref.providerDomain,
+        ...(ref.provider ? { provider: ref.provider } : {}),
         connectionId: cred.id,
         scopes: missingScopes,
         ...(ref.resource ? { resource: ref.resource } : {}),
+        ...(ref.selectedResources
+          ? { selectedResources: copySelectedResources(ref.selectedResources) }
+          : {}),
       };
     }
     const headers = headersForCredential(cred);
@@ -116,9 +419,13 @@ export function buildConnectionTokenResolver(
         status: "auth_needed",
         reason: "refresh_failed",
         providerDomain: ref.providerDomain,
+        ...(ref.provider ? { provider: ref.provider } : {}),
         connectionId: cred.id,
         ...(ref.scopes ? { scopes: ref.scopes } : {}),
         ...(ref.resource ? { resource: ref.resource } : {}),
+        ...(ref.selectedResources
+          ? { selectedResources: copySelectedResources(ref.selectedResources) }
+          : {}),
       };
     }
     await deps.recordUsed(db, cred.workspaceId, cred.id);
@@ -154,7 +461,6 @@ export function buildConnectionTokenResolver(
     if (persisted) {
       const current = await load({
         workspaceId: cred.workspaceId,
-        serverId: "",
         connectionRef: { ...ref, connectionId: cred.id },
       });
       if (current) {
@@ -163,7 +469,6 @@ export function buildConnectionTokenResolver(
     }
     const winner = await load({
       workspaceId: cred.workspaceId,
-      serverId: "",
       connectionRef: { ...ref, connectionId: cred.id },
     });
     if (winner?.status === "active") {
@@ -192,6 +497,13 @@ export function buildConnectionTokenResolver(
 
   return async (input) => {
     const ref = input.connectionRef;
+    // Repository-scoped provider bindings require a broker that can prove the
+    // selected-resource boundary. The generic standalone credential store has
+    // no provider-specific containment adapter, so it must fail closed instead
+    // of handing an account-wide token to the configured endpoint.
+    if (ref.selectedResources) {
+      return authNeeded(ref, "resource_scope_unavailable", ref.connectionId);
+    }
     let cred: ConnectionCredentialForBroker | null;
     try {
       cred = await load(input);
@@ -204,6 +516,12 @@ export function buildConnectionTokenResolver(
     if (cred.status !== "active") {
       return authNeededForStatus(cred, ref);
     }
+    // Reject an audience/destination mismatch before any provider-side refresh
+    // or usage update. Refreshing first would still create an unauthorized
+    // external side effect even though the token was never sent to the target.
+    if (!connectionBindingMatches(cred, ref, input.destinationUrl)) {
+      return authNeeded(ref, "missing_connection", cred.id);
+    }
     if (shouldRefresh(cred, input.forceRefresh === true, deps.now())) {
       try {
         cred = await refreshSingleFlight(cred, ref);
@@ -227,10 +545,75 @@ export function buildConnectionTokenResolver(
         return authNeeded(ref, "refresh_failed", cred.id);
       }
     }
-    return await snapshot(cred, ref);
+    return await snapshot(cred, ref, input.destinationUrl);
   };
 }
 
+function connectionBindingMatches(
+  cred: ConnectionCredentialForBroker,
+  ref: McpServerConnectionRef,
+  destinationUrl: string,
+): boolean {
+  if (cred.providerDomain.toLowerCase() !== ref.providerDomain.toLowerCase()) return false;
+  if (ref.kind && cred.kind !== ref.kind) return false;
+
+  const credential = cred.credential as Record<string, unknown>;
+  const metadata = cred.metadata as Record<string, unknown>;
+  const boundMcpUrl = stringValue(credential.mcp_url) ?? stringValue(metadata.mcpUrl);
+  const destination = canonicalHttpUrl(destinationUrl);
+  if (!destination) return false;
+  if (boundMcpUrl) {
+    const binding = canonicalHttpUrl(boundMcpUrl);
+    if (!binding || destination !== binding) return false;
+  } else if (!destinationHostMatchesProvider(destination, cred.providerDomain)) {
+    // Legacy/manual API-key rows may predate mcpUrl metadata. They are still
+    // host-bound to their canonical provider domain, never usable as an
+    // arbitrary bearer/header source for an unrelated MCP destination.
+    return false;
+  }
+  if (cred.kind !== "oauth2") return true;
+  const boundResource = stringValue(credential.resource) ?? stringValue(metadata.resource);
+  if (ref.resource) {
+    if (!boundResource) return false;
+    if (canonicalResource(ref.resource) !== canonicalResource(boundResource)) return false;
+  }
+  return true;
+}
+
+function destinationHostMatchesProvider(destinationUrl: string, providerDomain: string): boolean {
+  const destinationHost = new URL(destinationUrl).hostname.toLowerCase();
+  const provider = providerDomain
+    .trim()
+    .toLowerCase()
+    .replace(/^\.+|\.+$/g, "");
+  return (
+    Boolean(provider) && (destinationHost === provider || destinationHost.endsWith(`.${provider}`))
+  );
+}
+
+function canonicalHttpUrl(value: string): string | null {
+  try {
+    const url = new URL(value);
+    if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+    url.hash = "";
+    url.hostname = url.hostname.toLowerCase();
+    if (
+      (url.protocol === "https:" && url.port === "443") ||
+      (url.protocol === "http:" && url.port === "80")
+    ) {
+      url.port = "";
+    }
+    url.pathname = url.pathname.replace(/\/+$/, "") || "/";
+    return url.toString();
+  } catch {
+    return null;
+  }
+}
+
+function canonicalResource(value: string): string {
+  return canonicalHttpUrl(value) ?? value.trim();
+}
+
 export class ConnectionRefreshHttpError extends Error {
   readonly httpStatus: number;
 
@@ -276,9 +659,13 @@ function authNeeded(
     status: "auth_needed",
     reason,
     providerDomain: ref.providerDomain,
+    ...(ref.provider ? { provider: ref.provider } : {}),
     ...(connectionId ? { connectionId } : {}),
     ...(ref.scopes ? { scopes: ref.scopes } : {}),
     ...(ref.resource ? { resource: ref.resource } : {}),
+    ...(ref.selectedResources
+      ? { selectedResources: copySelectedResources(ref.selectedResources) }
+      : {}),
   };
 }
 
@@ -333,7 +720,8 @@ function headersForCredential(cred: ConnectionCredentialForBroker): Record<strin
 export async function refreshOAuthConnectionCredential(
   cred: ConnectionCredentialForBroker,
   ref: McpServerConnectionRef,
-  settings?: Settings,
+  settings: Settings,
+  transportOptions: RefreshTransportOptions = {},
 ): Promise<{
   credential: Record<string, unknown>;
   expiresAt: Date | null;
@@ -354,8 +742,14 @@ export async function refreshOAuthConnectionCredential(
   if (!refreshToken || !tokenEndpoint) {
     throw new Error("connection has no refresh token endpoint");
   }
-  if (settings) {
-    await assertOAuthEndpointAllowed(tokenEndpoint, settings);
+  let validatedTokenEndpoint: string;
+  try {
+    validatedTokenEndpoint = validateHttpUrl(tokenEndpoint, {
+      label: "OAuth refresh token endpoint",
+      allowLoopbackHttp: settings.environment === "local" || settings.environment === "test",
+    });
+  } catch {
+    throw new Error("connection has an invalid refresh token endpoint");
   }
   const body = new URLSearchParams();
   body.set("grant_type", "refresh_token");
@@ -389,19 +783,35 @@ export async function refreshOAuthConnectionCredential(
   if (ref.scopes?.length) {
     body.set("scope", ref.scopes.join(" "));
   }
-  const response = await fetch(tokenEndpoint, {
-    method: "POST",
-    headers,
-    body,
-    redirect: "manual",
-  });
+  const response = await pinnedFetch(
+    validatedTokenEndpoint,
+    {
+      method: "POST",
+      headers,
+      body,
+      signal: AbortSignal.timeout(CONNECTION_REFRESH_TIMEOUT_MS),
+    },
+    settings,
+    {
+      fetchImpl: transportOptions.fetchImpl ?? undiciFetch,
+      ...(transportOptions.dnsLookup ? { dnsLookup: transportOptions.dnsLookup } : {}),
+      label: "OAuth token endpoint",
+      requireHttpsOutsideLocalTest: true,
+    },
+  );
   if (response.status >= 300 && response.status < 400) {
+    await cancelResponseBody(response);
     throw new ConnectionRefreshHttpError(response.status);
   }
   if (!response.ok) {
+    await cancelResponseBody(response);
     throw new ConnectionRefreshHttpError(response.status);
   }
-  const payload = (await response.json()) as Record<string, unknown>;
+  const payload = await readResponseJsonBounded<Record<string, unknown>>(
+    response,
+    OAUTH_MAX_RESPONSE_BYTES,
+    "OAuth refresh token response",
+  );
   const accessToken = stringValue(payload.access_token);
   if (!accessToken) {
     throw new Error("connection refresh response did not include access_token");
@@ -464,107 +874,6 @@ function stringValue(value: unknown): string | undefined {
   return typeof value === "string" && value.length > 0 ? value : undefined;
 }
 
-async function assertOAuthEndpointAllowed(rawUrl: string, settings: Settings): Promise<void> {
-  if (
-    settings.integrationsAllowPrivateNetworkTargets ||
-    ["local", "test"].includes(settings.environment)
-  ) {
-    return;
-  }
-  const url = new URL(rawUrl);
-  if (url.protocol !== "https:") {
-    throw new Error("OAuth token endpoint must use https outside local/test");
-  }
-  const hostname = url.hostname.toLowerCase();
-  if (hostname === "localhost" || hostname.endsWith(".localhost")) {
-    throw new Error("OAuth token endpoint may not target localhost");
-  }
-  const literal = isIP(hostname);
-  const addresses = literal
-    ? [hostname]
-    : (await lookup(hostname, { all: true })).map((entry) => entry.address);
-  if (addresses.some(isPrivateAddress)) {
-    throw new Error("OAuth token endpoint may not target a private network address");
-  }
-}
-
-export function isPrivateAddress(address: string): boolean {
-  const normalized = normalizeAddress(address);
-  const mapped = ipv4FromMappedIpv6(normalized);
-  if (mapped) {
-    return isPrivateIpv4Address(mapped);
-  }
-  if (normalized.includes(":")) {
-    if (isIP(normalized) !== 6) {
-      return true;
-    }
-    return (
-      normalized === "::1" ||
-      normalized === "::" ||
-      normalized.startsWith("fc") ||
-      normalized.startsWith("fd") ||
-      normalized.startsWith("fe8") ||
-      normalized.startsWith("fe9") ||
-      normalized.startsWith("fea") ||
-      normalized.startsWith("feb")
-    );
-  }
-  return isPrivateIpv4Address(normalized);
-}
-
-function normalizeAddress(address: string): string {
-  const trimmed = address.trim().toLowerCase();
-  if (trimmed.startsWith("[") && trimmed.endsWith("]")) {
-    return trimmed.slice(1, -1);
-  }
-  return trimmed;
-}
-
-function ipv4FromMappedIpv6(address: string): string | null {
-  if (!address.startsWith("::ffff:")) {
-    return null;
-  }
-  const embedded = address.slice("::ffff:".length);
-  if (embedded.includes(".")) {
-    return embedded;
-  }
-  const parts = embedded.split(":");
-  if (parts.length !== 2 || parts.some((part) => !/^[0-9a-f]{1,4}$/.test(part))) {
-    return null;
-  }
-  const high = Number.parseInt(parts[0]!, 16);
-  const low = Number.parseInt(parts[1]!, 16);
-  if (
-    !Number.isInteger(high) ||
-    !Number.isInteger(low) ||
-    high < 0 ||
-    high > 0xffff ||
-    low < 0 ||
-    low > 0xffff
-  ) {
-    return null;
-  }
-  return `${(high >> 8) & 0xff}.${high & 0xff}.${(low >> 8) & 0xff}.${low & 0xff}`;
-}
-
-function isPrivateIpv4Address(address: string): boolean {
-  if (isIP(address) !== 4) {
-    return true;
-  }
-  const parts = address.split(".").map((part) => Number(part));
-  if (
-    parts.length !== 4 ||
-    parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)
-  ) {
-    return true;
-  }
-  const [a, b] = parts as [number, number, number, number];
-  return (
-    a === 0 ||
-    a === 10 ||
-    a === 127 ||
-    (a === 169 && b === 254) ||
-    (a === 172 && b >= 16 && b <= 31) ||
-    (a === 192 && b === 168)
-  );
+async function cancelResponseBody(response: Response): Promise<void> {
+  await response.body?.cancel().catch(() => undefined);
 }