@vantran-se/openchamber-web 1.23.1 → 1.24.4

package/server/lib/guests/request.js

@@ -0,0 +1,112 @@
+import {
+  GUEST_REQUEST_RESPONSE_MAX,
+  GUEST_REQUEST_TIMEOUT_MS,
+  isGuestRequestPath,
+  resolveIntegrationApi,
+} from '@openchamber/sdk';
+
+import { dropGuestTokens } from './auth-store.js';
+import { resolveHostAccessToken } from './host-session.js';
+import { GuestOAuthError, guestAuthorizationHeader, refreshGuestAccessToken, takeUsableGuestAuth } from './oauth.js';
+
+const METHODS = new Set(['GET', 'POST', 'PUT', 'PATCH', 'DELETE']);
+
+export const joinGuestRequestUrl = (apiOrigin, path, query) => {
+  if (!isGuestRequestPath(path)) {
+    return null;
+  }
+  let url;
+  try {
+    url = new URL(path, `${apiOrigin}/`);
+  } catch {
+    return null;
+  }
+  if (url.origin !== apiOrigin) {
+    return null;
+  }
+  if (query) {
+    for (const [key, value] of Object.entries(query)) {
+      if (typeof key !== 'string' || typeof value !== 'string') {
+        return null;
+      }
+      url.searchParams.set(key, value);
+    }
+  }
+  return url;
+};
+
+const readCappedBody = async (response) => {
+  const text = await response.text();
+  if (text.length <= GUEST_REQUEST_RESPONSE_MAX) {
+    return text;
+  }
+  return text.slice(0, GUEST_REQUEST_RESPONSE_MAX);
+};
+
+const sendAuthorized = async (url, method, body, accessToken, authorization) => {
+  const headers = {
+    Accept: 'application/json',
+    Authorization: guestAuthorizationHeader(accessToken, authorization),
+  };
+  if (body !== undefined && method !== 'GET') {
+    headers['Content-Type'] = 'application/json';
+  }
+  return fetch(url, {
+    method,
+    headers,
+    body: method === 'GET' || body === undefined ? undefined : body,
+    redirect: 'manual',
+    signal: AbortSignal.timeout(GUEST_REQUEST_TIMEOUT_MS),
+  });
+};
+
+export const proxyGuestRequest = async ({ guest, persistPath, method, path, query, body }) => {
+  const api = resolveIntegrationApi(guest.integration ?? {});
+  if (!api) {
+    throw new GuestOAuthError('This guest does not declare an API origin.', 'NO_INTEGRATION');
+  }
+  if (!METHODS.has(method)) {
+    throw new GuestOAuthError('Unsupported request method.', 'BAD_METHOD');
+  }
+  const url = joinGuestRequestUrl(api.apiOrigin, path, query);
+  if (!url) {
+    throw new GuestOAuthError('Request path must stay on the declared apiOrigin.', 'BAD_PATH');
+  }
+  const hostToken = await resolveHostAccessToken(guest.integration);
+  const stored = hostToken ? null : await takeUsableGuestAuth(guest, persistPath);
+  let accessToken = hostToken ?? stored?.accessToken;
+  if (!accessToken) {
+    throw new GuestOAuthError('Not connected.', 'DISCONNECTED');
+  }
+
+  let response = await sendAuthorized(url, method, body, accessToken, api.authorization);
+  if (response.status === 401) {
+    const refreshed = hostToken
+      ? await resolveHostAccessToken(guest.integration)
+      : await refreshGuestAccessToken({ guest, persistPath }).catch(() => null);
+    // Only the tokens this request was refused with are dropped. A refresh
+    // that came back null because the user connected again meanwhile (new
+    // tokens, maybe a new target) must leave that new connection alone.
+    const refusedWith = accessToken;
+    const dropRefused = () => dropGuestTokens(guest.id, persistPath, (current) => current?.accessToken === refusedWith);
+    if (!refreshed || refreshed === accessToken) {
+      if (!hostToken) {
+        await dropRefused();
+      }
+      throw new GuestOAuthError('Not connected.', 'DISCONNECTED');
+    }
+    accessToken = refreshed;
+    response = await sendAuthorized(url, method, body, accessToken, api.authorization);
+    if (response.status === 401) {
+      if (!hostToken) {
+        await dropGuestTokens(guest.id, persistPath, (current) => current?.accessToken === refreshed);
+      }
+      throw new GuestOAuthError('Not connected.', 'DISCONNECTED');
+    }
+  }
+
+  return {
+    status: response.status,
+    body: await readCappedBody(response),
+  };
+};

package/server/lib/guests/request.test.js

@@ -0,0 +1,206 @@
+import { describe, expect, test } from 'bun:test';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+import { getGuestAuth, guestAuthPersistPath, patchGuestAuth } from './auth-store.js';
+import { credentialTarget } from './oauth.js';
+import { joinGuestRequestUrl, proxyGuestRequest } from './request.js';
+
+const clickupGuest = {
+  id: 'clickup',
+  integration: {
+    name: 'ClickUp',
+    description: 'Tasks',
+    oauth: {
+      authorizeUrl: 'https://app.clickup.com/api',
+      tokenUrl: 'https://api.clickup.com/api/v2/oauth/token',
+      apiOrigin: 'https://api.clickup.com',
+    },
+  },
+};
+
+describe('joinGuestRequestUrl', () => {
+  test('stays on the declared origin and rejects escapes', () => {
+    expect(joinGuestRequestUrl('https://api.clickup.com', '/api/v2/user')?.href)
+      .toBe('https://api.clickup.com/api/v2/user');
+    expect(joinGuestRequestUrl('https://api.clickup.com', '/api/../secret')).toBeNull();
+    expect(joinGuestRequestUrl('https://api.clickup.com', 'https://evil.example/x')).toBeNull();
+    expect(joinGuestRequestUrl('https://api.clickup.com', '//evil.example/x')).toBeNull();
+  });
+});
+
+describe('proxyGuestRequest', () => {
+  test('attaches the stored bearer and returns the capped body', async () => {
+    const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'oc-guest-req-'));
+    const persistPath = guestAuthPersistPath(dir);
+    await patchGuestAuth('clickup', { accessToken: 'tok-1', target: credentialTarget(clickupGuest.integration) }, persistPath);
+    const originalFetch = globalThis.fetch;
+    const seen = [];
+    globalThis.fetch = async (url, init) => {
+      seen.push({ href: String(url), auth: init.headers.Authorization });
+      return new Response('{"ok":true}', { status: 200 });
+    };
+    try {
+      const result = await proxyGuestRequest({
+        guest: clickupGuest,
+        persistPath,
+        method: 'GET',
+        path: '/api/v2/list/1/task',
+      });
+      expect(result).toEqual({ status: 200, body: '{"ok":true}' });
+      expect(seen).toEqual([{
+        href: 'https://api.clickup.com/api/v2/list/1/task',
+        auth: 'Bearer tok-1',
+      }]);
+    } finally {
+      globalThis.fetch = originalFetch;
+      await fs.rm(dir, { recursive: true, force: true });
+    }
+  });
+
+  test('sends a pasted token as the Authorization header', async () => {
+    const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'oc-guest-req-'));
+    const persistPath = guestAuthPersistPath(dir);
+    await patchGuestAuth('clickup', { accessToken: 'pk_tok', target: { apiOrigin: 'https://api.clickup.com' } }, persistPath);
+    const originalFetch = globalThis.fetch;
+    const seen = [];
+    globalThis.fetch = async (url, init) => {
+      seen.push({ href: String(url), auth: init.headers.Authorization });
+      return new Response('{"ok":true}', { status: 200 });
+    };
+    try {
+      const result = await proxyGuestRequest({
+        guest: {
+          id: 'clickup',
+          integration: {
+            name: 'ClickUp',
+            description: 'Tasks',
+            token: { apiOrigin: 'https://api.clickup.com' },
+          },
+        },
+        persistPath,
+        method: 'GET',
+        path: '/api/v2/user',
+      });
+      expect(result).toEqual({ status: 200, body: '{"ok":true}' });
+      expect(seen).toEqual([{
+        href: 'https://api.clickup.com/api/v2/user',
+        auth: 'pk_tok',
+      }]);
+    } finally {
+      globalThis.fetch = originalFetch;
+      await fs.rm(dir, { recursive: true, force: true });
+    }
+  });
+
+  test('drops tokens when a 401 cannot refresh', async () => {
+    const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'oc-guest-req-'));
+    const persistPath = guestAuthPersistPath(dir);
+    await patchGuestAuth('clickup', { accessToken: 'tok-old', target: credentialTarget(clickupGuest.integration) }, persistPath);
+    const originalFetch = globalThis.fetch;
+    globalThis.fetch = async () => new Response('nope', { status: 401 });
+    try {
+      await proxyGuestRequest({
+        guest: clickupGuest,
+        persistPath,
+        method: 'GET',
+        path: '/api/v2/user',
+      });
+      throw new Error('should have thrown');
+    } catch (error) {
+      expect(error.code).toBe('DISCONNECTED');
+    }
+    expect((await getGuestAuth('clickup', persistPath))?.accessToken).toBeUndefined();
+    globalThis.fetch = originalFetch;
+    await fs.rm(dir, { recursive: true, force: true });
+  });
+
+  test('refuses a disconnected guest', async () => {
+    const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'oc-guest-req-'));
+    const persistPath = guestAuthPersistPath(dir);
+    try {
+      await proxyGuestRequest({
+        guest: clickupGuest,
+        persistPath,
+        method: 'GET',
+        path: '/api/v2/user',
+      });
+      throw new Error('should have thrown');
+    } catch (error) {
+      expect(error.code).toBe('DISCONNECTED');
+    }
+    await fs.rm(dir, { recursive: true, force: true });
+  });
+});
+
+describe('credential target', () => {
+  test('drops a token minted for another API origin instead of sending it', async () => {
+    const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'oc-guest-req-'));
+    const persistPath = guestAuthPersistPath(dir);
+    await patchGuestAuth('clickup', { accessToken: 'tok-1', target: { apiOrigin: 'https://api.old.example' } }, persistPath);
+    const originalFetch = globalThis.fetch;
+    let requested = 0;
+    globalThis.fetch = async () => {
+      requested += 1;
+      return new Response('{"ok":true}', { status: 200 });
+    };
+    try {
+      await expect(proxyGuestRequest({ guest: clickupGuest, persistPath, method: 'GET', path: '/api/v2/user' }))
+        .rejects.toMatchObject({ code: 'DISCONNECTED' });
+      expect(requested).toBe(0);
+      expect((await getGuestAuth('clickup', persistPath))?.accessToken).toBeUndefined();
+    } finally {
+      globalThis.fetch = originalFetch;
+      await fs.rm(dir, { recursive: true, force: true });
+    }
+  });
+
+  test('a token without a recorded target never counts', async () => {
+    const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'oc-guest-req-'));
+    const persistPath = guestAuthPersistPath(dir);
+    await patchGuestAuth('clickup', { accessToken: 'tok-1' }, persistPath);
+    try {
+      await expect(proxyGuestRequest({ guest: clickupGuest, persistPath, method: 'GET', path: '/api/v2/user' }))
+        .rejects.toMatchObject({ code: 'DISCONNECTED' });
+    } finally {
+      await fs.rm(dir, { recursive: true, force: true });
+    }
+  });
+});
+
+describe('a 401 while the user reconnects', () => {
+  test('drops only the tokens the request was refused with, not the new connection', async () => {
+    const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'oc-guest-req-'));
+    const persistPath = guestAuthPersistPath(dir);
+    const target = credentialTarget(clickupGuest.integration);
+    await patchGuestAuth('clickup', {
+      clientId: 'app-id', clientSecret: 'app-secret', clientTarget: target,
+      accessToken: 'access-a', refreshToken: 'refresh-a', target,
+    }, persistPath);
+    const originalFetch = globalThis.fetch;
+    let releaseRefresh;
+    const refreshGate = new Promise((resolve) => { releaseRefresh = resolve; });
+    globalThis.fetch = async (url) => {
+      if (String(url) === 'https://api.clickup.com/api/v2/oauth/token') {
+        await refreshGate;
+        return new Response(JSON.stringify({ access_token: 'access-a2', refresh_token: 'refresh-a2', token_type: 'Bearer', expires_in: 3600 }), { status: 200, headers: { 'Content-Type': 'application/json' } });
+      }
+      return new Response('nope', { status: 401 });
+    };
+    try {
+      const request = proxyGuestRequest({ guest: clickupGuest, persistPath, method: 'GET', path: '/api/v2/user' });
+      // The user connects again while the refresh is in flight.
+      await new Promise((resolve) => setTimeout(resolve, 20));
+      await patchGuestAuth('clickup', { accessToken: 'access-b', refreshToken: 'refresh-b', target }, persistPath);
+      releaseRefresh();
+      await expect(request).rejects.toMatchObject({ code: 'DISCONNECTED' });
+      const stored = await getGuestAuth('clickup', persistPath);
+      expect(stored.accessToken).toBe('access-b');
+      expect(stored.refreshToken).toBe('refresh-b');
+    } finally {
+      globalThis.fetch = originalFetch;
+      await fs.rm(dir, { recursive: true, force: true });
+    }
+  });
+});