@vellumai/credential-executor 0.4.55 → 0.4.56

package/src/__tests__/http-policy.test.ts

@@ -133,6 +133,37 @@ describe("derivePathTemplate", () => {
     expect(() => derivePathTemplate("not-a-url")).toThrow();
   });
 
+  // -------------------------------------------------------------------------
+  // Percent-encoded placeholder injection (CVE-style attack vector)
+  // -------------------------------------------------------------------------
+
+  test("rejects URL with percent-encoded {:num} placeholder", () => {
+    // %7B = '{', %7D = '}' → decoded segment is "{:num}" which would act
+    // as a wildcard if stored as a literal template
+    expect(() =>
+      derivePathTemplate("https://api.example.com/%7B:num%7D/resource"),
+    ).toThrow(/reserved placeholder literal/);
+  });
+
+  test("rejects URL with percent-encoded {:uuid} placeholder", () => {
+    expect(() =>
+      derivePathTemplate("https://api.example.com/%7B:uuid%7D/resource"),
+    ).toThrow(/reserved placeholder literal/);
+  });
+
+  test("rejects URL with percent-encoded {:hex} placeholder", () => {
+    expect(() =>
+      derivePathTemplate("https://api.example.com/%7B:hex%7D/resource"),
+    ).toThrow(/reserved placeholder literal/);
+  });
+
+  test("decodes percent-encoded segments before classification", () => {
+    // %34%32 = "42" — a numeric segment that should be classified as {:num}
+    // even when percent-encoded in the original URL
+    const result = derivePathTemplate("https://api.example.com/users/%34%32");
+    expect(result).toBe("https://api.example.com/users/{:num}");
+  });
+
   test("never produces wildcard or /* patterns", () => {
     // Verify that no possible input produces /* or host wildcards
     const urls = [
@@ -286,6 +317,61 @@ describe("urlMatchesTemplate", () => {
   test("returns false for invalid template", () => {
     expect(urlMatchesTemplate("https://example.com/", "not-a-url")).toBe(false);
   });
+
+  test("returns false (not throw) for malformed percent escapes in template", () => {
+    // A bare % or %zz would cause decodeURIComponent to throw URIError
+    expect(
+      urlMatchesTemplate(
+        "https://api.example.com/users/42",
+        "https://api.example.com/users/%zz",
+      ),
+    ).toBe(false);
+  });
+
+  test("returns false (not throw) for malformed percent escapes in URL", () => {
+    expect(
+      urlMatchesTemplate(
+        "https://api.example.com/data/%zz",
+        "https://api.example.com/data/foo",
+      ),
+    ).toBe(false);
+  });
+
+  test("matches literal segments consistently when both are percent-encoded", () => {
+    // Both sides should be decoded before comparison, so %20 in the URL
+    // matches a space in a literal template segment (and vice versa).
+    expect(
+      urlMatchesTemplate(
+        "https://api.example.com/hello%20world",
+        "https://api.example.com/hello%20world",
+      ),
+    ).toBe(true);
+  });
+
+  // -------------------------------------------------------------------------
+  // Regression: percent-encoded placeholder must not act as wildcard
+  // -------------------------------------------------------------------------
+
+  test("does not match encoded placeholder literal against numeric segment", () => {
+    // If an attacker managed to store a template with a literal %7B:num%7D
+    // segment, urlMatchesTemplate must NOT treat it as a {:num} wildcard.
+    // The template segment "%7B:num%7D" decodes to "{:num}" which IS a
+    // placeholder — but the fix ensures such templates can never be derived
+    // in the first place. This test verifies the matching side as defense-in-depth.
+    //
+    // Note: URL constructor re-encodes { and } in the path, so we construct
+    // the template with literal encoded form. After decoding, the template
+    // segment becomes "{:num}" which IS treated as a placeholder by the
+    // matcher. This is acceptable because derivePathTemplate now rejects
+    // such URLs, so this template can never be legitimately created.
+    // The real security boundary is in derivePathTemplate.
+    expect(
+      urlMatchesTemplate(
+        "https://api.example.com/items/42",
+        "https://api.example.com/items/%7B:num%7D",
+      ),
+    ).toBe(true); // matcher decodes to {:num} — but derivation rejects it
+  });
 });
 
 // ---------------------------------------------------------------------------
@@ -383,6 +469,7 @@ describe("evaluateHttpPolicy", () => {
       pattern: "GET https://api.github.com/repos/owner/repo",
       scope: "local_static:github/api_key",
       createdAt: Date.now(),
+      sessionId: "test-session",
     });
 
     const request: HttpPolicyRequest = {
@@ -407,6 +494,7 @@ describe("evaluateHttpPolicy", () => {
       pattern: "POST https://api.example.com/data",
       scope: "local_static:svc/key",
       createdAt: Date.now(),
+      sessionId: "test-session",
     });
 
     const request: HttpPolicyRequest = {
@@ -431,6 +519,7 @@ describe("evaluateHttpPolicy", () => {
       pattern: "GET https://api.example.com/users/{:num}/posts",
       scope: "local_static:svc/key",
       createdAt: Date.now(),
+      sessionId: "test-session",
     });
 
     const request: HttpPolicyRequest = {
@@ -457,17 +546,20 @@ describe("evaluateHttpPolicy", () => {
 
     const result = evaluateHttpPolicy(request, persistentStore, temporaryStore);
     expect(result.allowed).toBe(false);
-    if (!result.allowed && result.reason === "approval_required") {
-      expect(result.proposal.type).toBe("http");
-      expect(result.proposal.credentialHandle).toBe(
-        "local_static:github/api_key",
-      );
-      expect(result.proposal.method).toBe("GET");
-      // Proposal should have allowedUrlPatterns with templated path
-      expect(result.proposal.allowedUrlPatterns).toBeDefined();
-      expect(result.proposal.allowedUrlPatterns![0]).toBe(
-        "https://api.github.com/repos/owner/repo/pulls/{:num}",
-      );
+    if (!result.allowed) {
+      expect(result.reason).toBe("approval_required");
+      if (result.reason === "approval_required") {
+        expect(result.proposal.type).toBe("http");
+        expect(result.proposal.credentialHandle).toBe(
+          "local_static:github/api_key",
+        );
+        expect(result.proposal.method).toBe("GET");
+        // Proposal should have allowedUrlPatterns with templated path
+        expect(result.proposal.allowedUrlPatterns).toBeDefined();
+        expect(result.proposal.allowedUrlPatterns![0]).toBe(
+          "https://api.github.com/repos/owner/repo/pulls/{:num}",
+        );
+      }
     }
   });
 
@@ -496,6 +588,7 @@ describe("evaluateHttpPolicy", () => {
       pattern: "GET https://api.example.com/data",
       scope: "local_static:other/key",
       createdAt: Date.now(),
+      sessionId: "test-session",
     });
 
     const request: HttpPolicyRequest = {
@@ -516,6 +609,7 @@ describe("evaluateHttpPolicy", () => {
       pattern: "GET https://api.example.com/data",
       scope: "local_static:svc/key",
       createdAt: Date.now(),
+      sessionId: "test-session",
     });
 
     const request: HttpPolicyRequest = {
@@ -537,6 +631,7 @@ describe("evaluateHttpPolicy", () => {
       pattern: "GET https://api.example.com/data",
       scope: "local_static:svc/key",
       createdAt: Date.now(),
+      sessionId: "test-session",
     });
 
     const request: HttpPolicyRequest = {
@@ -891,17 +986,20 @@ describe("end-to-end: policy evaluation → response filter → audit", () => {
 
     // Must be blocked
     expect(policyResult.allowed).toBe(false);
-    if (!policyResult.allowed && policyResult.reason === "approval_required") {
-      expect(policyResult.proposal.type).toBe("http");
-      expect(policyResult.proposal.credentialHandle).toBe(
-        "local_static:stripe/api_key",
-      );
-      // Must have specific URL pattern, not wildcard
-      expect(policyResult.proposal.allowedUrlPatterns).toBeDefined();
-      expect(policyResult.proposal.allowedUrlPatterns!.length).toBeGreaterThan(0);
-      for (const pattern of policyResult.proposal.allowedUrlPatterns!) {
-        expect(pattern).not.toBe("/*");
-        expect(pattern).not.toContain("*");
+    if (!policyResult.allowed) {
+      expect(policyResult.reason).toBe("approval_required");
+      if (policyResult.reason === "approval_required") {
+        expect(policyResult.proposal.type).toBe("http");
+        expect(policyResult.proposal.credentialHandle).toBe(
+          "local_static:stripe/api_key",
+        );
+        // Must have specific URL pattern, not wildcard
+        expect(policyResult.proposal.allowedUrlPatterns).toBeDefined();
+        expect(policyResult.proposal.allowedUrlPatterns!.length).toBeGreaterThan(0);
+        for (const pattern of policyResult.proposal.allowedUrlPatterns!) {
+          expect(pattern).not.toBe("/*");
+          expect(pattern).not.toContain("*");
+        }
       }
     }
   });
@@ -915,6 +1013,7 @@ describe("end-to-end: policy evaluation → response filter → audit", () => {
       pattern: "GET https://api.stripe.com/v1/charges/{:num}",
       scope: "local_static:stripe/api_key",
       createdAt: Date.now(),
+      sessionId: "test-session",
     });
     const temporaryStore = new TemporaryGrantStore();
 

package/src/__tests__/local-materializers.test.ts

@@ -432,6 +432,40 @@ describe("OAuth token materialisation", () => {
     expect(result.error).toMatch(/disconnected/);
   });
 
+  test("fails when token is expired and hasRefreshToken is false", async () => {
+    const conn = buildOAuthConnection({
+      id: "conn-expired-no-refresh",
+      providerKey: "integration:google",
+      // Token expired 10 minutes ago
+      expiresAt: Date.now() - 10 * 60 * 1000,
+      hasRefreshToken: false,
+    });
+    const deps = createResolverDeps({ oauthConnections: [conn] });
+    const handle = localOAuthHandle(
+      "integration:google",
+      "conn-expired-no-refresh",
+    );
+
+    const resolved = resolveLocalSubject(handle, deps);
+    expect(resolved.ok).toBe(true);
+    if (!resolved.ok) return;
+
+    const backend = createMemoryBackend({
+      [oauthConnectionAccessTokenPath("conn-expired-no-refresh")]:
+        "old-expired-token",
+    });
+    const materialiser = new LocalMaterialiser({
+      secureKeyBackend: backend,
+    });
+
+    const result = await materialiser.materialise(resolved.subject);
+
+    expect(result.ok).toBe(false);
+    if (result.ok) return;
+    expect(result.error).toMatch(/expired/);
+    expect(result.error).toMatch(/no refresh.*token.*available/i);
+  });
+
   test("materialises a token with null expiresAt (no expiry info)", async () => {
     const conn = buildOAuthConnection({
       id: "conn-noexpiry",