@the-open-engine/zeroshot 6.29.0 → 6.30.0

package/src/target/bounded-response.ts

@@ -0,0 +1,68 @@
+async function declaredResponseBytes(
+  response: Response,
+  maxBytes: number,
+  error: (kind: 'size' | 'json') => Error,
+): Promise<number> {
+  const declared = response.headers.get('content-length');
+  if (declared === null) return 0;
+  if (!/^\d+$/.test(declared) || Number(declared) > maxBytes) {
+    await response.body?.cancel().catch(() => undefined);
+    throw error('size');
+  }
+  return Number(declared);
+}
+
+function growBuffer(
+  bytes: Uint8Array,
+  required: number,
+  used: number,
+  maxBytes: number,
+): Uint8Array {
+  const capacity = Math.min(
+    maxBytes,
+    Math.max(required, Math.max(bytes.byteLength * 2, 8 * 1024)),
+  );
+  const grown = new Uint8Array(capacity);
+  grown.set(bytes.subarray(0, used));
+  return grown;
+}
+
+function decodeJson(
+  bytes: Uint8Array,
+  error: (kind: 'size' | 'json') => Error,
+): unknown {
+  try {
+    return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+  } catch {
+    throw error('json');
+  }
+}
+
+export async function readBoundedResponseJson(
+  response: Response,
+  maxBytes: number,
+  error: (kind: 'size' | 'json') => Error,
+): Promise<unknown> {
+  const declaredBytes = await declaredResponseBytes(response, maxBytes, error);
+  const reader = response.body?.getReader();
+  if (reader === undefined) return decodeJson(new Uint8Array(), error);
+  let bytes: Uint8Array = new Uint8Array(
+    Math.min(maxBytes, Math.max(declaredBytes, 8 * 1024)),
+  );
+  let total = 0;
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    const nextTotal = total + value.byteLength;
+    if (nextTotal > maxBytes) {
+      await reader.cancel().catch(() => undefined);
+      throw error('size');
+    }
+    if (nextTotal > bytes.byteLength) {
+      bytes = growBuffer(bytes, nextTotal, total, maxBytes);
+    }
+    bytes.set(value, total);
+    total = nextTotal;
+  }
+  return decodeJson(bytes.subarray(0, total), error);
+}

package/src/target/credential-lock.ts

@@ -29,7 +29,5 @@ export async function acquireTargetLock(targetId: string): Promise<() => Promise
     },
   });
 
-  return async () => {
-    await release();
-  };
+  return release;
 }

package/src/target/credential-store.ts

@@ -22,16 +22,16 @@ export const TARGET_ACCOUNT = 'refresh-token';
 
 export class KeyringCredentialStore implements TargetCredentialStore {
   private readonly Entry: new (service: string, account: string) => {
-    getPassword(): string;
+    getPassword(): string | null;
     setPassword(password: string): void;
-    deletePassword(): void;
+    deletePassword(): boolean;
   };
 
   private constructor(
     Entry: new (service: string, account: string) => {
-      getPassword(): string;
+      getPassword(): string | null;
       setPassword(password: string): void;
-      deletePassword(): void;
+      deletePassword(): boolean;
     },
   ) {
     this.Entry = Entry;
@@ -39,9 +39,9 @@ export class KeyringCredentialStore implements TargetCredentialStore {
 
   static async create(): Promise<KeyringCredentialStore> {
     let keyringModule: { Entry: new (service: string, account: string) => {
-      getPassword(): string;
+      getPassword(): string | null;
       setPassword(password: string): void;
-      deletePassword(): void;
+      deletePassword(): boolean;
     } };
     try {
       keyringModule = await import('@napi-rs/keyring') as typeof keyringModule;
@@ -59,13 +59,17 @@ export class KeyringCredentialStore implements TargetCredentialStore {
       const entry = new this.Entry(service, account);
       return entry.getPassword();
     } catch {
-      return null;
+      throw new CredentialStoreUnavailableError('The secure credential store could not be read.');
     }
   }
 
   async set(service: string, account: string, token: string): Promise<void> {
-    const entry = new this.Entry(service, account);
-    entry.setPassword(token);
+    try {
+      const entry = new this.Entry(service, account);
+      entry.setPassword(token);
+    } catch {
+      throw new CredentialStoreUnavailableError('The secure credential store could not be updated.');
+    }
   }
 
   async delete(service: string, account: string): Promise<void> {
@@ -73,7 +77,7 @@ export class KeyringCredentialStore implements TargetCredentialStore {
       const entry = new this.Entry(service, account);
       entry.deletePassword();
     } catch {
-      // Already deleted or not present
+      throw new CredentialStoreUnavailableError('The secure credential store could not be cleared.');
     }
   }
 }

package/src/target/device-flow.ts

@@ -1,3 +1,6 @@
+import { readBoundedResponseJson } from './bounded-response.js';
+import { parseTokenResponse, type TokenResponse } from './token-response.js';
+export { parseTokenResponse, type TokenResponse } from './token-response.js';
 export interface DeviceCodeResponse {
   readonly device_code: string;
   readonly user_code: string;
@@ -7,12 +10,36 @@ export interface DeviceCodeResponse {
   readonly interval: number;
 }
 
-export interface TokenResponse {
-  readonly access_token: string;
-  readonly refresh_token: string;
-  readonly token_type: string;
-  readonly expires_in: number;
-  readonly organization?: { readonly id: string; readonly name: string };
+
+export interface DeviceExchangeContext {
+  readonly grantType: string;
+  readonly deviceToken: string;
+  readonly deviceLabel: string;
+  readonly audience: string;
+}
+
+export interface DeviceIdentity {
+  readonly token: string;
+  readonly label: string;
+}
+
+function exchangeFields(
+  exchange: DeviceExchangeContext | DeviceIdentity | undefined,
+): Readonly<Record<string, string>> {
+  if (exchange === undefined) return {};
+  if ('grantType' in exchange) {
+    return {
+      grant_type: exchange.grantType,
+      device_token: exchange.deviceToken,
+      device_label: exchange.deviceLabel,
+      audience: exchange.audience,
+    };
+  }
+  return {
+    device_token: exchange.token,
+    device_label: exchange.label,
+    audience: 'admin',
+  };
 }
 
 export interface HttpTransport {
@@ -23,11 +50,6 @@ export interface Clock {
   now(): number;
 }
 
-export interface DeviceIdentity {
-  readonly token: string;
-  readonly label: string;
-}
-
 export class DeviceFlowDeniedError extends Error {
   constructor() {
     super('Device authorization denied by user');
@@ -46,7 +68,7 @@ export class UnboundSessionError extends Error {
   readonly verificationUri: string;
   constructor(verificationUri: string) {
     super(
-      `Session not bound to an organization. Re-approve at ${verificationUri} and select an organization.`
+      `Session not bound to an organization. Re-approve at ${verificationUri} and select an organization.`,
     );
     this.name = 'UnboundSessionError';
     this.verificationUri = verificationUri;
@@ -54,6 +76,124 @@ export class UnboundSessionError extends Error {
 }
 
 const DEFAULT_CLOCK: Clock = { now: () => Date.now() };
+const MAX_OAUTH_RESPONSE_BYTES = 64 * 1024;
+const MAX_DEVICE_CODE_BYTES = 16 * 1024;
+const LOOPBACK_HOSTS: Readonly<Record<string, true>> = Object.freeze({
+  '127.0.0.1': true,
+  '::1': true,
+  '[::1]': true,
+});
+const MAX_URI_BYTES = 4 * 1024;
+export function oauthFormRequest(
+  body: URLSearchParams,
+  signal?: AbortSignal,
+): RequestInit & { redirect: 'error' } {
+  const init: RequestInit & { redirect: 'error' } = {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body: body.toString(),
+    redirect: 'error',
+  };
+  if (signal !== undefined) init.signal = signal;
+  return init;
+}
+
+async function requireResponseRoute(response: Response, expectedUrl: string): Promise<void> {
+  if (!response.url || new URL(response.url).href === expectedUrl) return;
+  await response.body?.cancel().catch(() => undefined);
+  throw new Error('OAuth response changed target route or authority');
+}
+
+
+async function readBoundedJson(response: Response): Promise<unknown> {
+  return readBoundedResponseJson(response, MAX_OAUTH_RESPONSE_BYTES, (kind) =>
+    new Error(kind === 'size' ? 'OAuth response exceeds the size limit' : 'OAuth response is malformed'),
+  );
+}
+
+function boundedString(value: unknown, maxBytes: number): value is string {
+  return (
+    typeof value === 'string' &&
+    value.length > 0 &&
+    new TextEncoder().encode(value).byteLength <= maxBytes
+  );
+}
+
+function safeVerificationAuthority(url: URL, allowQuery: boolean): boolean {
+  const literalLoopback = LOOPBACK_HOSTS[url.hostname] === true;
+  return !url.username && !url.password && !url.hash &&
+    (allowQuery || !url.search) &&
+    (url.protocol === 'https:' || (url.protocol === 'http:' && literalLoopback));
+}
+
+function verificationUrl(value: unknown, allowQuery: boolean): value is string {
+  if (
+    !boundedString(value, MAX_URI_BYTES) ||
+    /[\u0000-\u0020\u007f]|\s/u.test(value)
+  ) {
+    return false;
+  }
+  try {
+    const url = new URL(value);
+    return url.href === value && safeVerificationAuthority(url, allowQuery);
+  } catch {
+    return false;
+  }
+}
+function deviceFieldsValid(device: Record<string, unknown>): boolean {
+  const fields = Object.keys(device);
+  const required = ['device_code', 'user_code', 'verification_uri', 'expires_in', 'interval'];
+  return fields.every((field) =>
+    required.includes(field) || field === 'verification_uri_complete',
+  ) && required.every((field) => field in device);
+}
+
+function deviceStringsValid(device: Record<string, unknown>): boolean {
+  return boundedString(device.device_code, MAX_DEVICE_CODE_BYTES) &&
+    boundedString(device.user_code, 256) &&
+    verificationUrl(device.verification_uri, false) &&
+    (device.verification_uri_complete === undefined ||
+      verificationUrl(device.verification_uri_complete, true));
+}
+
+function deviceTimingValid(device: Record<string, unknown>): boolean {
+  return Number.isSafeInteger(device.expires_in) &&
+    (device.expires_in as number) >= 1 &&
+    (device.expires_in as number) <= 86_400 &&
+    Number.isSafeInteger(device.interval) &&
+    (device.interval as number) >= 0 &&
+    (device.interval as number) <= 300;
+}
+
+function browserAuthorityMatches(device: Record<string, unknown>): boolean {
+  return device.verification_uri_complete === undefined ||
+    new URL(device.verification_uri_complete as string).origin ===
+      new URL(device.verification_uri as string).origin;
+}
+
+
+function parseDeviceCodeResponse(value: unknown): DeviceCodeResponse {
+  const device = object(value, 'Device code');
+  if (!deviceFieldsValid(device) || !deviceStringsValid(device) ||
+      !deviceTimingValid(device) || !browserAuthorityMatches(device)) {
+    throw new Error('Device code response is malformed');
+  }
+  return Object.freeze(device) as unknown as DeviceCodeResponse;
+}
+
+function parseOAuthError(value: unknown): string {
+  const error = object(value, 'OAuth error');
+  if (Object.keys(error).length !== 1 || typeof error.error !== 'string') {
+    throw new Error('OAuth error response is malformed');
+  }
+  return error.error;
+}
+function object(value: unknown, field: string): Record<string, unknown> {
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+    throw new Error(`${field} response is malformed`);
+  }
+  return value as Record<string, unknown>;
+}
 
 function sleep(ms: number, signal?: AbortSignal): Promise<void> {
   return new Promise((resolve, reject) => {
@@ -68,7 +208,7 @@ function sleep(ms: number, signal?: AbortSignal): Promise<void> {
         clearTimeout(timer);
         reject(signal.reason ?? new DOMException('Aborted', 'AbortError'));
       },
-      { once: true }
+      { once: true },
     );
   });
 }
@@ -77,92 +217,76 @@ export async function requestDeviceCode(
   deviceAuthorizationEndpoint: string,
   clientId: string,
   http: HttpTransport,
-  signal?: AbortSignal
+  signal?: AbortSignal,
 ): Promise<DeviceCodeResponse> {
-  const body = new URLSearchParams({
-    client_id: clientId,
-    scope: 'openid',
-  });
-
-  const init: RequestInit & { redirect: 'error' } = {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-    body: body.toString(),
-    redirect: 'error',
-  };
-  if (signal) init.signal = signal;
+  const body = new URLSearchParams({ client_id: clientId });
 
-  const response = await http.fetch(deviceAuthorizationEndpoint, init);
+  const response = await http.fetch(
+    deviceAuthorizationEndpoint,
+    oauthFormRequest(body, signal),
+  );
+  await requireResponseRoute(response, deviceAuthorizationEndpoint);
 
   if (!response.ok) {
-    const text = await response.text();
-    throw new Error(`Device code request failed (${response.status}): ${text}`);
+    parseOAuthError(await readBoundedJson(response));
+    throw new Error(`Device code request failed (${response.status})`);
   }
 
-  return (await response.json()) as DeviceCodeResponse;
+  return parseDeviceCodeResponse(await readBoundedJson(response));
 }
 
-export async function pollForToken(
-  tokenEndpoint: string,
-  clientId: string,
-  deviceCode: string,
-  interval: number,
-  expiresIn: number,
-  http: HttpTransport,
-  clock: Clock = DEFAULT_CLOCK,
-  signal?: AbortSignal,
-  deviceIdentity?: DeviceIdentity
-): Promise<TokenResponse> {
-  const deadline = clock.now() + expiresIn * 1000;
-  let currentInterval = interval;
-
-  while (clock.now() < deadline) {
-    if (signal?.aborted) {
-      throw signal.reason ?? new DOMException('Aborted', 'AbortError');
-    }
+export interface PollForTokenRequest {
+  readonly tokenEndpoint: string;
+  readonly clientId: string;
+  readonly deviceCode: string;
+  readonly interval: number;
+  readonly expiresIn: number;
+  readonly http: HttpTransport;
+  readonly clock?: Clock;
+  readonly signal?: AbortSignal;
+  readonly exchange?: DeviceExchangeContext | DeviceIdentity;
+}
+type PollResult = TokenResponse | 'authorization_pending' | 'slow_down';
 
-    await sleep(currentInterval * 1000, signal);
-
-    const body = new URLSearchParams({
-      grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
-      device_code: deviceCode,
-      client_id: clientId,
-    });
-    if (deviceIdentity) {
-      body.set('audience', 'admin');
-      body.set('device_token', deviceIdentity.token);
-      body.set('device_label', deviceIdentity.label);
-    }
+async function parsePollResponse(response: Response): Promise<PollResult> {
+  if (response.ok) return parseTokenResponse(await readBoundedJson(response));
+  const error = parseOAuthError(await readBoundedJson(response));
+  if (error === 'authorization_pending' || error === 'slow_down') return error;
+  if (error === 'access_denied') throw new DeviceFlowDeniedError();
+  if (error === 'expired_token') throw new DeviceFlowExpiredError();
+  throw new Error('Token endpoint returned an unsupported OAuth error');
+}
 
-    const init: RequestInit & { redirect: 'error' } = {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-      body: body.toString(),
-      redirect: 'error',
-    };
-    if (signal) init.signal = signal;
+function pollBody(request: PollForTokenRequest): URLSearchParams {
+  return new URLSearchParams({
+    grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+    device_code: request.deviceCode,
+    client_id: request.clientId,
+    ...exchangeFields(request.exchange),
+  });
+}
 
-    const response = await http.fetch(tokenEndpoint, init);
+export async function pollForToken(request: PollForTokenRequest): Promise<TokenResponse> {
+  const clock = request.clock ?? DEFAULT_CLOCK;
+  const deadline = clock.now() + request.expiresIn * 1000;
+  let currentInterval = request.interval;
 
-    if (response.ok) {
-      return (await response.json()) as TokenResponse;
+  while (clock.now() < deadline) {
+    if (request.signal?.aborted) {
+      throw request.signal.reason ?? new DOMException('Aborted', 'AbortError');
     }
-
-    const errorBody = (await response.json()) as { error: string };
-    switch (errorBody.error) {
-      case 'authorization_pending':
-        continue;
-      case 'slow_down':
-        currentInterval += 5;
-        continue;
-      case 'access_denied':
-        throw new DeviceFlowDeniedError();
-      case 'expired_token':
-        throw new DeviceFlowExpiredError();
-      default:
-        throw new Error(`Token endpoint error: ${errorBody.error}`);
+    await sleep(currentInterval * 1000, request.signal);
+    const response = await request.http.fetch(
+      request.tokenEndpoint,
+      oauthFormRequest(pollBody(request), request.signal),
+    );
+    const result = await parsePollResponse(response);
+    if (result === 'authorization_pending') continue;
+    if (result === 'slow_down') {
+      currentInterval += 5;
+      continue;
     }
+    return result;
   }
-
   throw new DeviceFlowExpiredError();
 }

package/src/target/discovery-errors.ts

@@ -0,0 +1,6 @@
+export class TargetDiscoveryError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = 'TargetDiscoveryError';
+  }
+}