@superblocksteam/shared 0.9608.2 → 0.9609.0

package/src/jwt/verifier.test.ts

@@ -1,4 +1,5 @@
 import { generateKeyPairSync } from 'node:crypto';
+import { createServer, type Socket } from 'node:net';
 
 import { SignJWT, importPKCS8 } from 'jose';
 import { type JWTPayload } from 'jose';
@@ -17,12 +18,17 @@ const createSigningMaterial = (kid = KEY_ID): SigningMaterial => {
     modulusLength: 2048
   });
 
-  const jwk = {
-    ...publicKey.export({ format: 'jwk' }),
+  const exportedJwk = publicKey.export({ format: 'jwk' });
+  if (!exportedJwk.kty) {
+    throw new Error('Generated public key is missing kty');
+  }
+  const jwk: JwtKey = {
+    ...exportedJwk,
+    kty: exportedJwk.kty,
     kid,
     alg: 'RS256',
     use: 'sig'
-  } as SigningMaterial['jwk'];
+  };
 
   return {
     jwk,
@@ -42,6 +48,14 @@ const buildJwtVerifier = (jwk: SigningMaterial['jwk']) => {
   return { verifier: new JwtVerifier(options), getKeysInterceptor };
 };
 
+const errorCodes = (error: unknown): string[] => {
+  if (!error || typeof error !== 'object') return [];
+  const codes: string[] = [];
+  if ('code' in error && typeof error.code === 'string') codes.push(error.code);
+  if ('cause' in error) codes.push(...errorCodes(error.cause));
+  return codes;
+};
+
 describe('JwtVerifier', () => {
   let signingMaterial: SigningMaterial;
   beforeAll(() => {
@@ -79,7 +93,8 @@ describe('JwtVerifier', () => {
 
     await expect(verifier.verify(invalidToken, { algorithms: ['RS256'] })).rejects.toMatchObject({
       status: 401,
-      message: expect.stringContaining('signature verification failed')
+      message: expect.stringContaining('signature verification failed'),
+      cause: expect.objectContaining({ code: 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED' })
     });
   });
 
@@ -163,4 +178,47 @@ describe('JwtVerifier', () => {
     await expect(verifier.verify(token, { algorithms: ['ES256'] })).rejects.toMatchObject({ status: 401 });
     expect(getKeysInterceptor).not.toHaveBeenCalled();
   });
+
+  it('preserves malformed remote JWKS protocol failures for callers to classify', async () => {
+    const sockets = new Set<Socket>();
+    const server = createServer((socket) => {
+      sockets.add(socket);
+      socket.once('close', () => sockets.delete(socket));
+      socket.end('NOT HTTP\r\n\r\n');
+    });
+    await new Promise<void>((resolve, reject) => {
+      server.once('error', reject);
+      server.listen(0, '127.0.0.1', () => {
+        server.off('error', reject);
+        resolve();
+      });
+    });
+
+    try {
+      const address = server.address();
+      if (!address || typeof address === 'string') throw new Error('Expected a TCP address');
+      const verifier = new JwtVerifier({ jwksUri: `http://127.0.0.1:${address.port}/jwks` });
+      const key = await importPKCS8(signingMaterial.privateKeyPem, 'RS256');
+      const token = await new SignJWT({ sub: 'user-bad-jwks' })
+        .setProtectedHeader({ alg: 'RS256', kid: signingMaterial.jwk.kid })
+        .sign(key);
+
+      let failure: unknown;
+      try {
+        await verifier.verify(token, { algorithms: ['RS256'] });
+      } catch (error) {
+        failure = error;
+      }
+
+      expect(errorCodes(failure)).toContain('HPE_INVALID_CONSTANT');
+    } finally {
+      for (const socket of sockets) socket.destroy();
+      await new Promise<void>((resolve, reject) => {
+        server.close((error) => {
+          if (error) reject(error);
+          else resolve();
+        });
+      });
+    }
+  });
 });

package/src/jwt/verifier.ts

@@ -44,7 +44,12 @@ export class JwtVerifier {
       const result = await jwtVerify<T>(token, jwkSet, options);
       return result.payload;
     } catch (err) {
-      throw new UnauthorizedError(`JWT verification failed: ${(err as Error).message}`);
+      // Keep the original error reachable. jose tags it with a `code` that is
+      // the only reliable way to tell an expired token from a key lookup that
+      // timed out, and callers need that to answer the client honestly.
+      const failure = new UnauthorizedError(`JWT verification failed: ${(err as Error).message}`);
+      failure.cause = err;
+      throw failure;
     }
   }
 

package/src/types/application/index.ts

@@ -472,6 +472,17 @@ export interface IApplicationV2Dto {
   removedProfiles?: Record<string, Array<{ id: string; key: string; displayName: string }>>;
 }
 
+export type DatabaseDisposition = 'delete' | 'retain';
+
+export type DatabaseRetirementEnqueueFailure = {
+  applicationId: string;
+  bindingKey: string;
+};
+
+export type DatabaseRetirementEnqueueResult = {
+  databaseRetirementEnqueueFailures: DatabaseRetirementEnqueueFailure[];
+};
+
 export interface IHomepageApplicationV2Dto extends IResourceMetadata {
   deployedAt?: Date | null;
   creator?: {

package/src/types/audit/ocsf.ts

@@ -289,7 +289,9 @@ export const AUDIT_EVENT_TYPE_CATALOG: AuditEventTypeEntry[] = [
       'reviewpolicy.allowlist.applications.added',
       'reviewpolicy.allowlist.applications.removed',
       'reviewpolicy.create',
-      'reviewpolicy.delete'
+      'reviewpolicy.delete',
+      'reviewpolicy.disable',
+      'reviewpolicy.enable'
     ]
   },
   {

package/src/types/common/response.ts

@@ -72,7 +72,14 @@ export enum SuperblocksError {
   APIKeyInvalid = 'APIKeyInvalid',
   AuthenticatedUserNotFound = 'AuthenticatedUserNotFound',
   UserTokenInvalid = 'UserTokenInvalid',
-  JWTExpired = 'JWTExpired'
+  JWTExpired = 'JWTExpired',
+  /**
+   * We could not tell whether the token is good, because looking up the
+   * signing key failed (the request timed out, or the connection was
+   * refused). The token itself may be perfectly valid, so this is not a
+   * reason for the client to give up the way an expiry or a bad signature is.
+   */
+  JWTVerificationUnavailable = 'JWTVerificationUnavailable'
 }
 
 /**

package/src/types/datasource/auth.test.ts

@@ -5,6 +5,7 @@ import {
   TokenScope,
   extractPublic,
   getAuthId,
+  getAuthIdCandidates,
   getDisplayName,
   getOAuthCodeVerifierStorageKey,
   isPkceEnabled
@@ -229,6 +230,85 @@ describe('getAuthId normalizes boolean tokenScope in getClientId', () => {
   });
 });
 
+describe('getAuthIdCandidates', () => {
+  test('user-scoped config also probes the org-unique configId keying (recognizes a datasource->user flip)', () => {
+    const authConfig = { clientId: 'my-client', tokenScope: TokenScope.USER, scope: 'read' };
+    const candidates = getAuthIdCandidates(IntegrationAuthType.OAUTH2_CODE, authConfig, 'int-1', 'cfg-1');
+    // The config's own current keying (user -> client id) PLUS the widened datasource keying (config id).
+    expect(candidates).toContain(getAuthId(IntegrationAuthType.OAUTH2_CODE, authConfig, 'int-1', 'cfg-1'));
+    expect(candidates).toContain(
+      getAuthId(
+        IntegrationAuthType.OAUTH2_CODE,
+        { clientId: 'my-client', tokenScope: TokenScope.DATASOURCE, scope: 'read' },
+        'int-1',
+        'cfg-1'
+      )
+    );
+    expect(candidates).toHaveLength(2);
+    expect(candidates.some((c) => c.startsWith('oauth-code.cfg-1'))).toBe(true); // org-unique config id
+    expect(candidates.some((c) => c.startsWith('oauth-code.my-client'))).toBe(true); // its own current client-id key
+  });
+
+  test('datasource-scoped config widens ONLY to the configId keying, never synthesizes the client-id keying (SEC-73)', () => {
+    // The client-id keying is shared across tenants (many orgs can share a clientId + scope); synthesizing
+    // it for a datasource-scoped config would let one org witness ownership of another org's client-id-keyed
+    // shared token. It must never appear as a candidate for a datasource-scoped config.
+    const authConfig = { clientId: 'shared-client', tokenScope: TokenScope.DATASOURCE, scope: 'read' };
+    const candidates = getAuthIdCandidates(IntegrationAuthType.OAUTH2_CODE, authConfig, 'int-1', 'cfg-1');
+    expect(candidates).toEqual([getAuthId(IntegrationAuthType.OAUTH2_CODE, authConfig, 'int-1', 'cfg-1')]);
+    expect(candidates).toHaveLength(1);
+    expect(candidates[0]).toMatch(/^oauth-code\.cfg-1/); // org-unique config id
+    expect(candidates.some((c) => c.startsWith('oauth-code.shared-client'))).toBe(false); // no cross-tenant client-id key
+  });
+
+  test('collapses to one candidate when config id equals client id', () => {
+    const authConfig = { clientId: 'same', tokenScope: TokenScope.USER, scope: 'read' };
+    const candidates = getAuthIdCandidates(IntegrationAuthType.OAUTH2_CODE, authConfig, 'int-1', 'same');
+    expect(candidates).toHaveLength(1);
+  });
+
+  test.each([IntegrationAuthType.OAUTH2_CLIENT_CREDS, IntegrationAuthType.OAUTH2_IMPLICIT])(
+    'OAuth-split type %s (user-scoped) also probes the configId keying',
+    (authType) => {
+      const authConfig = { clientId: 'my-client', tokenScope: TokenScope.USER, scope: 'read' };
+      const candidates = getAuthIdCandidates(authType, authConfig, 'int-1', 'cfg-1');
+      expect(candidates).toHaveLength(2);
+      expect(candidates).toContain(
+        getAuthId(authType, { clientId: 'my-client', tokenScope: TokenScope.DATASOURCE, scope: 'read' }, 'int-1', 'cfg-1')
+      );
+    }
+  );
+
+  test.each([IntegrationAuthType.BASIC, IntegrationAuthType.FIREBASE, IntegrationAuthType.OAUTH2_PASSWORD])(
+    'scope-invariant type %s returns a single candidate (tokenScope does not affect keying)',
+    (authType) => {
+      const authConfig = { clientId: 'my-client', apiKey: '{"projectId":"p"}', scope: 'read' };
+      const candidates = getAuthIdCandidates(authType, authConfig, 'int-1', 'cfg-1');
+      expect(candidates).toHaveLength(1);
+      expect(candidates[0]).toBe(getAuthId(authType, authConfig, 'int-1', 'cfg-1'));
+    }
+  );
+
+  test('scope-invariant auth type returns a single candidate (tokenScope does not affect keying)', () => {
+    const authConfig = {
+      subjectTokenSource: 'SUBJECT_TOKEN_SOURCE_STATIC_TOKEN',
+      subjectTokenSourceStaticToken: 't',
+      tokenUrl: 'https://idp.example.com/token',
+      scope: 'read',
+      audience: 'aud',
+      clientId: 'c'
+    };
+    const candidates = getAuthIdCandidates(IntegrationAuthType.OAUTH2_TOKEN_EXCHANGE, authConfig, 'int-1', 'cfg-1');
+    expect(candidates).toHaveLength(1);
+    expect(candidates[0]).toBe(getAuthId(IntegrationAuthType.OAUTH2_TOKEN_EXCHANGE, authConfig, 'int-1', 'cfg-1'));
+  });
+
+  test('undefined authConfig yields a single candidate', () => {
+    const candidates = getAuthIdCandidates(IntegrationAuthType.OAUTH2_CODE, undefined, 'int-1', 'cfg-1');
+    expect(candidates).toHaveLength(1);
+  });
+});
+
 describe('getAuthId', () => {
   test('uses unknown-client for OAUTH2_IDP_TOKEN_PASSTHROUGH (no client identity)', () => {
     const authId = getAuthId(IntegrationAuthType.OAUTH2_IDP_TOKEN_PASSTHROUGH, {}, 'int-1', 'cfg-1');

package/src/types/datasource/auth.ts

@@ -60,6 +60,38 @@ export function getAuthId(
   return `${authType}.${getClientId(authType, authConfig, integrationId, integrationConfigurationId)}`;
 }
 
+// A token minted while a config's tokenScope was 'datasource' keys on the org-unique configuration id;
+// after the config is flipped to 'user' a fresh recompute keys on the client id instead and no longer
+// matches, false-denying the legitimate owner. getAuthIdCandidates returns the config's current-scope
+// authId PLUS the datasource (configuration-id) keying, so an ownership recompute recognizes a token
+// across a post-mint datasource->user flip.
+//
+// It widens ONLY toward the datasource keying, which is org-unique (the configuration id is a per-config
+// UUID). It deliberately does NOT synthesize the user (client-id) keying for a datasource-scoped config:
+// the client-id key is shared across tenants (multiple orgs can share a clientId + scope), so adding it
+// would let one org's config witness ownership of another org's client-id-keyed shared token. Recognizing
+// the reverse user->datasource flip would require matching that shared key, so it is intentionally not
+// done here; closing it safely needs org-scoped token storage, tracked separately. See SEC-73.
+export function getAuthIdCandidates(
+  authType: AuthType | undefined,
+  authConfig: AuthConfig | undefined,
+  integrationId?: string,
+  integrationConfigurationId?: string
+): AuthId[] {
+  const current = getAuthId(authType, authConfig, integrationId, integrationConfigurationId);
+  const asDatasource = getAuthId(authType, withTokenScope(authConfig, TokenScope.DATASOURCE), integrationId, integrationConfigurationId);
+  return current === asDatasource ? [current] : [current, asDatasource];
+}
+
+// Return a shallow copy of authConfig with tokenScope overridden, without mutating the caller's object.
+// undefined passes through so getAuthId falls back to its unknown-client key.
+function withTokenScope(authConfig: AuthConfig | undefined, tokenScope: TokenScope): AuthConfig | undefined {
+  if (!authConfig) {
+    return authConfig;
+  }
+  return { ...authConfig, tokenScope } as AuthConfig;
+}
+
 function getClientId(
   authType: AuthType | undefined,
   config: AuthConfig | undefined,

package/src/types/policyGate/index.ts

@@ -1,3 +1,5 @@
+import type { ReviewFindingCategory, ReviewFindingConfidence, ReviewFindingSeverity } from '../reviewPolicy/index.js';
+
 /**
  * @deprecated Use the `superblocks.policy-gates.security-scans.enabled` LaunchDarkly flag instead.
  * Kept as `false` to match the fail-closed LD default; create and enable the
@@ -68,6 +70,25 @@ export type PolicyGateReadinessItem = {
   status: PolicyGateReadinessItemStatus;
 };
 
+export function isHardBlockingPolicyItem(item: Pick<PolicyGateReadinessItem, 'mode' | 'status'>): boolean {
+  if (item.mode !== 'blocking' && item.mode !== 'approval') {
+    return false;
+  }
+  return item.status === 'blocked' || item.status === 'failed';
+}
+
+/**
+ * Whether every item is an outcome an acknowledged "Publish anyway" hold is
+ * allowed to bypass. `missing`/`stale`/`running`/`failed`/`approval_required`
+ * mean some gate has not finished or hard-blocks unconditionally; an ack
+ * granted while any of those exist could waive a review that never happened.
+ */
+export function areReadinessItemsAckEligible(items: Pick<PolicyGateReadinessItem, 'status'>[]): boolean {
+  return (
+    items.length > 0 && items.every((item) => item.status === 'blocked' || item.status === 'passed' || item.status === 'advisory_findings')
+  );
+}
+
 export type PolicyGateReadinessRun = {
   completedAt?: string;
   createdAt?: string;
@@ -122,3 +143,35 @@ export const POLICY_GATE_BLOCKED_ERROR = 'POLICY_GATE_BLOCKED';
  */
 export const POLICY_GATE_STALE_LIVE_EDIT_ERROR =
   'Policy gates can only run for the current app state. Deploy the current changes or restore to this commit and then deploy.';
+
+export type ScanScopeChangeType = 'added' | 'deleted' | 'modified';
+
+export type ScanScopeChangedFile = {
+  changeType: ScanScopeChangeType;
+  path: string;
+};
+
+export type ScanScopePriorFinding = {
+  blocking: boolean;
+  category: ReviewFindingCategory;
+  clarkRemediable?: boolean;
+  confidence?: ReviewFindingConfidence | null;
+  evidenceJson?: Record<string, unknown>;
+  fingerprint: string;
+  humanSummary?: string | null;
+  locations: unknown[];
+  remediationHintJson?: Record<string, unknown>;
+  severity: ReviewFindingSeverity;
+  technicalSummary?: string | null;
+  title: string;
+};
+
+export type ScanScopeJson = {
+  baseApplicationCommitId: string;
+  changedFiles: ScanScopeChangedFile[];
+  diffTruncated: boolean;
+  priorAiAgentRunId?: string;
+  priorFindings: ScanScopePriorFinding[];
+  priorReviewRunId?: string;
+  unifiedDiff: string;
+};

package/src/types/response/DeleteApplicationResponseBody.ts

@@ -1,3 +1,3 @@
-import { IApplicationV2Dto } from '../application/index.js';
+import type { DatabaseRetirementEnqueueResult, IApplicationV2Dto } from '../application/index.js';
 
-export type DeleteApplicationResponseBody = IApplicationV2Dto;
+export type DeleteApplicationResponseBody = IApplicationV2Dto & Partial<DatabaseRetirementEnqueueResult>;

package/src/utils/index.ts

@@ -6,6 +6,7 @@ export * from './configuration.js';
 export * from './env.js';
 export * from './environment.js';
 export * from './git-url.js';
+export * from './launchDarkly.js';
 export * from './maskCredential.js';
 export * from './normalize.js';
 export * from './normalizeRoleName.js';

package/src/utils/launchDarkly.test.ts

@@ -0,0 +1,25 @@
+import { describe, test, expect } from 'vitest';
+
+import { shouldSendLaunchDarklyEvents } from './launchDarkly.js';
+
+describe('shouldSendLaunchDarklyEvents', () => {
+  test('sends events by default when unset', () => {
+    expect(shouldSendLaunchDarklyEvents(undefined)).toBe(true);
+    expect(shouldSendLaunchDarklyEvents(null)).toBe(true);
+    expect(shouldSendLaunchDarklyEvents('')).toBe(true);
+  });
+
+  test('only an explicit false disables events', () => {
+    expect(shouldSendLaunchDarklyEvents('false')).toBe(false);
+    expect(shouldSendLaunchDarklyEvents('FALSE')).toBe(false);
+    expect(shouldSendLaunchDarklyEvents('  false  ')).toBe(false);
+    expect(shouldSendLaunchDarklyEvents(false)).toBe(false);
+  });
+
+  test('sends events for truthy and unrecognized values', () => {
+    expect(shouldSendLaunchDarklyEvents('true')).toBe(true);
+    expect(shouldSendLaunchDarklyEvents(true)).toBe(true);
+    expect(shouldSendLaunchDarklyEvents('0')).toBe(true);
+    expect(shouldSendLaunchDarklyEvents('no')).toBe(true);
+  });
+});

package/src/utils/launchDarkly.ts

@@ -0,0 +1,23 @@
+/**
+ * A LaunchDarkly send-events setting as it arrives from configuration: either an
+ * already-parsed boolean or the raw string form an env var carries.
+ */
+export type LaunchDarklySendEventsSetting = boolean | string | undefined | null;
+
+/**
+ * Analytics events drive LaunchDarkly's per-context billing: monthly active users are
+ * counted from the unique context keys LaunchDarkly receives events for. Throwaway
+ * contexts, such as the per-run organizations created by end-to-end tests, each bill as
+ * an additional monthly active user, so events should be off outside real deployments.
+ *
+ * Events are on by default and only an explicit 'false' turns them off, matching
+ * SUPERBLOCKS_SERVER_LAUNCH_DARKLY_SEND_EVENTS_ENABLED on the server-side SDK. Any
+ * unrecognized value keeps events on so a malformed setting cannot silently disable
+ * reporting for a real deployment.
+ */
+export function shouldSendLaunchDarklyEvents(value: LaunchDarklySendEventsSetting): boolean {
+  if (typeof value === 'boolean') {
+    return value;
+  }
+  return value?.trim().toLowerCase() !== 'false';
+}