create-windy 0.8.3 → 0.10.0

package/template/apps/agent-server/native/authorization.ts

@@ -0,0 +1,118 @@
+import type { WorkbenchAuthority } from "./config.js";
+
+export type AuthorizationUnavailableReason =
+  | "upstream_status"
+  | "invalid_response"
+  | "network"
+  | "timeout"
+  | "aborted";
+
+/** Contains only safe classification metadata; never retain response bodies or credentials. */
+export class WorkbenchAuthorizationUnavailable extends Error {
+  readonly code = "WORKBENCH_AUTHORIZATION_UNAVAILABLE";
+
+  constructor(
+    readonly reason: AuthorizationUnavailableReason,
+    readonly status?: number,
+  ) {
+    super("Workbench authorization is temporarily unavailable");
+    this.name = "WorkbenchAuthorizationUnavailable";
+  }
+}
+
+export function isWorkbenchAuthorizationUnavailable(
+  error: unknown,
+): error is WorkbenchAuthorizationUnavailable {
+  return error instanceof WorkbenchAuthorizationUnavailable;
+}
+
+export function authorizationUnavailableResponse(): Response {
+  return Response.json(
+    { error: "WORKBENCH_AUTHORIZATION_UNAVAILABLE" },
+    {
+      status: 503,
+      headers: { "retry-after": "2", "cache-control": "no-store" },
+    },
+  );
+}
+
+export function productOrigin(): string {
+  const url = new URL(
+    process.env.AI_TOOL_HOST_URL ??
+      process.env.AGENT_CONTEXT_HOST_URL ??
+      "http://server:9747",
+  );
+  if (
+    url.username ||
+    url.password ||
+    url.search ||
+    url.hash ||
+    url.pathname !== "/"
+  )
+    throw new Error("Invalid product host");
+  return url.origin;
+}
+
+export interface WorkbenchAuthorizationOptions {
+  fetcher?: (url: string, init: RequestInit) => Promise<Response>;
+  timeoutMs?: number;
+  productOrigin?: string;
+}
+
+/** false means confirmed denial; unknown authorization must never become permission or revocation. */
+export async function authorizeWorkbench(
+  authority: WorkbenchAuthority,
+  signal: AbortSignal,
+  options: WorkbenchAuthorizationOptions = {},
+): Promise<boolean> {
+  const timeout = AbortSignal.timeout(options.timeoutMs ?? 5000);
+  const combined = AbortSignal.any([signal, timeout]);
+  const unavailable = () =>
+    new WorkbenchAuthorizationUnavailable(
+      signal.aborted ? "aborted" : timeout.aborted ? "timeout" : "network",
+    );
+  let response: Response;
+  try {
+    response = await (options.fetcher ?? fetch)(
+      `${options.productOrigin ?? productOrigin()}/api/agent/workbench/admission`,
+      {
+        headers: { authorization: `Bearer ${authority.session}` },
+        signal: combined,
+        redirect: "error",
+      },
+    );
+  } catch {
+    throw unavailable();
+  }
+  if (response.status !== 200) {
+    // Classification comes from status, never from an untrusted error payload.
+    await response.body?.cancel().catch(() => {});
+    if (response.status === 401 || response.status === 403) return false;
+    throw new WorkbenchAuthorizationUnavailable(
+      "upstream_status",
+      response.status,
+    );
+  }
+  let body: unknown;
+  try {
+    body = await response.json();
+  } catch {
+    if (combined.aborted) throw unavailable();
+    throw new WorkbenchAuthorizationUnavailable("invalid_response");
+  }
+  if (combined.aborted) throw unavailable();
+  const actor =
+    body && typeof body === "object" && "actor" in body ? body.actor : null;
+  if (
+    !actor ||
+    typeof actor !== "object" ||
+    !("id" in actor) ||
+    typeof actor.id !== "string" ||
+    !actor.id ||
+    !("type" in actor) ||
+    typeof actor.type !== "string" ||
+    !actor.type
+  )
+    throw new WorkbenchAuthorizationUnavailable("invalid_response");
+  return actor.id === authority.actorId && actor.type === "user";
+}

package/template/apps/agent-server/native/boundary-io.ts

@@ -0,0 +1,93 @@
+export class ProjectBoundaryError extends Error {
+  constructor(
+    readonly status: number,
+    readonly code: string,
+  ) {
+    super(code);
+  }
+}
+
+export async function abortable<T>(
+  pending: Promise<T>,
+  signal: AbortSignal,
+): Promise<T> {
+  if (signal.aborted) {
+    void pending.catch(() => {});
+    signal.throwIfAborted();
+  }
+  let abort!: () => void;
+  try {
+    return await Promise.race([
+      pending,
+      new Promise<never>((_accept, reject) => {
+        abort = () => reject(signal.reason);
+        signal.addEventListener("abort", abort, { once: true });
+        if (signal.aborted) abort();
+      }),
+    ]);
+  } finally {
+    if (abort) signal.removeEventListener("abort", abort);
+  }
+}
+
+export async function boundedBytes(
+  stream: ReadableStream<Uint8Array> | null,
+  limit: number,
+  signal: AbortSignal,
+): Promise<Uint8Array<ArrayBuffer>> {
+  signal.throwIfAborted();
+  if (!stream) return new Uint8Array();
+  const reader = stream.getReader();
+  const chunks: Uint8Array[] = [];
+  let size = 0;
+  try {
+    for (;;) {
+      const part = await abortable(reader.read(), signal);
+      if (part.done) break;
+      size += part.value.byteLength;
+      if (size > limit)
+        throw new ProjectBoundaryError(413, "PROJECT_BODY_TOO_LARGE");
+      chunks.push(part.value);
+    }
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+      bytes.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    return bytes;
+  } finally {
+    void reader.cancel().catch(() => {});
+  }
+}
+
+export async function boundedProjectResponse(
+  response: Response,
+  maximum: number,
+  signal: AbortSignal,
+): Promise<Response> {
+  const declared = Number(response.headers.get("content-length"));
+  if (Number.isFinite(declared) && declared > maximum) {
+    void response.body?.cancel().catch(() => {});
+    throw new ProjectBoundaryError(502, "PROJECT_RESPONSE_TOO_LARGE");
+  }
+  let bytes: Uint8Array<ArrayBuffer>;
+  try {
+    bytes = await boundedBytes(response.body, maximum, signal);
+  } catch (error) {
+    if (error instanceof ProjectBoundaryError)
+      throw new ProjectBoundaryError(502, "PROJECT_RESPONSE_TOO_LARGE");
+    throw error;
+  }
+  return new Response(
+    [204, 205, 304].includes(response.status) ? null : bytes,
+    {
+      status: response.status,
+      headers: {
+        "content-type":
+          response.headers.get("content-type") ?? "application/json",
+        "cache-control": "no-store",
+      },
+    },
+  );
+}

package/template/apps/agent-server/native/boundary-product.ts

@@ -0,0 +1,107 @@
+import type { DshProductRequest } from "../host-contracts.js";
+import {
+  abortable,
+  boundedProjectResponse,
+  ProjectBoundaryError,
+} from "./boundary-io.js";
+
+export function projectProductFetch(input: {
+  readonly origin: string;
+  readonly session: string;
+  readonly method: "GET" | "POST";
+  readonly maxBodyBytes: number;
+  readonly maxResponseBytes: number;
+  readonly signal: AbortSignal;
+  readonly authorize: () => Promise<boolean>;
+  readonly fetcher: typeof fetch;
+}) {
+  const origin = new URL(input.origin);
+  if (
+    !["http:", "https:"].includes(origin.protocol) ||
+    origin.username ||
+    origin.password
+  )
+    throw new Error("Invalid product origin");
+  return async (path: string, options: DshProductRequest = {}) => {
+    input.signal.throwIfAborted();
+    if (
+      typeof path !== "string" ||
+      path.length > 8192 ||
+      !path.startsWith("/api/") ||
+      /[\\#]/.test(path) ||
+      [...path].some(
+        (char) => char.charCodeAt(0) <= 32 || char.charCodeAt(0) === 127,
+      ) ||
+      Object.keys(options).some(
+        (key) => !["method", "body", "contentType"].includes(key),
+      )
+    )
+      throw new ProjectBoundaryError(400, "INVALID_PROJECT_PRODUCT_REQUEST");
+    let pathname: string;
+    try {
+      pathname = decodeURIComponent(path.split("?")[0]!);
+    } catch {
+      throw new ProjectBoundaryError(400, "INVALID_PROJECT_PRODUCT_PATH");
+    }
+    if (
+      !pathname.startsWith("/api/") ||
+      pathname.startsWith("/api/internal/") ||
+      pathname === "/api/internal" ||
+      pathname.includes("\\") ||
+      pathname
+        .slice(1)
+        .split("/")
+        .some((part) => !part || part === "." || part === "..")
+    )
+      throw new ProjectBoundaryError(400, "INVALID_PROJECT_PRODUCT_PATH");
+    const target = new URL(path, origin);
+    const method = options.method ?? input.method;
+    const contentType = options.contentType ?? "application/json";
+    if (
+      target.origin !== origin.origin ||
+      method !== input.method ||
+      !["application/json", "application/octet-stream"].includes(contentType) ||
+      (options.body !== undefined &&
+        typeof options.body !== "string" &&
+        !(options.body instanceof Uint8Array))
+    )
+      throw new ProjectBoundaryError(400, "INVALID_PROJECT_PRODUCT_REQUEST");
+    const body =
+      typeof options.body === "string"
+        ? new TextEncoder().encode(options.body)
+        : options.body
+          ? new Uint8Array(options.body)
+          : undefined;
+    if (
+      (body?.byteLength ?? 0) > input.maxBodyBytes ||
+      (method === "GET" && body)
+    )
+      throw new ProjectBoundaryError(413, "PROJECT_BODY_TOO_LARGE");
+    if (!(await abortable(input.authorize(), input.signal)))
+      throw new ProjectBoundaryError(401, "UNAUTHENTICATED");
+    input.signal.throwIfAborted();
+    const response = await abortable(
+      input.fetcher(target, {
+        method,
+        headers: {
+          authorization: `Bearer ${input.session}`,
+          accept: "application/json",
+          ...(method === "POST" ? { "content-type": contentType } : {}),
+        },
+        ...(body ? { body } : {}),
+        signal: input.signal,
+        redirect: "error",
+      }),
+      input.signal,
+    );
+    if (response.status >= 300 && response.status < 400) {
+      void response.body?.cancel().catch(() => {});
+      throw new ProjectBoundaryError(502, "PROJECT_PRODUCT_REDIRECT");
+    }
+    return boundedProjectResponse(
+      response,
+      input.maxResponseBytes,
+      input.signal,
+    );
+  };
+}

package/template/apps/agent-server/native/boundary-project.test.ts

@@ -0,0 +1,247 @@
+import { expect, test } from "bun:test";
+import type { DshBoundaryRoute, DshProductRequest } from "../host-contracts.js";
+import { compileProjectBoundary } from "./boundary-project.js";
+
+function route(overrides: Partial<DshBoundaryRoute> = {}): DshBoundaryRoute {
+  return {
+    key: "project.history",
+    method: "GET",
+    path: "/history/:id",
+    handle: (request, context) =>
+      context.fetchProduct(`/api/history/${request.parameters.id}`),
+    ...overrides,
+  };
+}
+
+function fixture(routes: readonly DshBoundaryRoute[]) {
+  const calls: Request[] = [];
+  let allowed = true;
+  let response = () =>
+    Response.json(
+      { verified: true },
+      {
+        headers: { "set-cookie": "private=secret", authorization: "private" },
+      },
+    );
+  const controller = new AbortController();
+  const dispatch = compileProjectBoundary(routes);
+  return {
+    calls,
+    controller,
+    allow(value: boolean) {
+      allowed = value;
+    },
+    respond(value: () => Response) {
+      response = value;
+    },
+    async request(path = "/history/item-1", init: RequestInit = {}) {
+      const request = new Request(
+        `http://agent.internal/internal/boundary${path}`,
+        init,
+      );
+      return dispatch({
+        request,
+        path: new URL(request.url).pathname.slice("/internal/boundary".length),
+        actorId: "actor-1",
+        session: "private-product-session",
+        productOrigin: "http://product.internal",
+        signal: controller.signal,
+        authorize: async () => allowed,
+        fetcher: (async (input, options) => {
+          calls.push(new Request(input, options));
+          return response();
+        }) as typeof fetch,
+      });
+    },
+  };
+}
+
+test("project routes preserve current identity while exposing only bounded public context", async () => {
+  let keys: string[] = [];
+  const f = fixture([
+    route({
+      handle: async (request, context) => {
+        keys = Object.keys(context).sort();
+        expect(context.actorId).toBe("actor-1");
+        expect(request.parameters.id).toBe("item-1");
+        return context.fetchProduct(`/api/history/${request.parameters.id}`);
+      },
+    }),
+  ]);
+  const response = await f.request(undefined, {
+    headers: {
+      authorization: "Bearer forged",
+      cookie: "forged=1",
+      "x-windy-actor-id": "other",
+    },
+  });
+  expect(keys).toEqual(["actorId", "fetchProduct", "signal"]);
+  expect(f.calls[0]!.url).toBe("http://product.internal/api/history/item-1");
+  const headerNames: string[] = [];
+  f.calls[0]!.headers.forEach((_value, key) => headerNames.push(key));
+  expect(headerNames.sort()).toEqual(["accept", "authorization"]);
+  expect(f.calls[0]!.headers.get("authorization")).toBe(
+    "Bearer private-product-session",
+  );
+  expect(response!.headers.get("set-cookie")).toBeNull();
+  expect(response!.headers.get("authorization")).toBeNull();
+  expect(response!.headers.get("cache-control")).toBe("no-store");
+  expect(await response!.json()).toEqual({ verified: true });
+});
+
+test("unknown routes and invalid path parameters never invoke product handlers", async () => {
+  const f = fixture([route()]);
+  for (const path of [
+    "/unknown",
+    "/history/has.dot",
+    "/history/item/extra",
+    "/history/%2e%2e",
+  ])
+    expect(await f.request(path)).toBeUndefined();
+  expect(
+    await f.request("/history/item-1", { method: "POST", body: "ignored" }),
+  ).toBeUndefined();
+  expect(f.calls).toHaveLength(0);
+});
+
+test("route declarations reject ambiguous, reserved, oversized and duplicate entries", () => {
+  for (const invalid of [
+    { path: "/mcp" },
+    { path: "/skills/other" },
+    { path: "/v1/other" },
+    { path: "/history/*" },
+    { path: "/history/:id/:id" },
+    { method: "DELETE" },
+    { maxBodyBytes: 1 },
+    { maxResponseBytes: 20 * 1024 * 1024 + 1 },
+    { timeoutMs: 30001 },
+  ])
+    expect(() =>
+      compileProjectBoundary([route(invalid as Partial<DshBoundaryRoute>)]),
+    ).toThrow();
+  expect(() =>
+    compileProjectBoundary([
+      route(),
+      route({ key: "other", path: "/history/fixed" }),
+    ]),
+  ).toThrow("Ambiguous");
+  expect(() =>
+    compileProjectBoundary([route(), route({ path: "/other/:id" })]),
+  ).toThrow();
+});
+
+test("SSRF, traversal, internal endpoints and caller-selected headers or redirects fail before fetch", async () => {
+  for (const path of [
+    "https://evil.test/api/history",
+    "//evil.test/api/history",
+    "/api/../auth",
+    "/api/%2e%2e/auth",
+    "/api/internal/secret",
+    "/api/history\\other",
+    "/api/history#fragment",
+    "/api/history/%invalid",
+    `/api/history?query=${"x".repeat(8192)}`,
+  ]) {
+    const f = fixture([
+      route({ handle: (_request, context) => context.fetchProduct(path) }),
+    ]);
+    expect((await f.request())!.status).toBe(400);
+    expect(f.calls).toHaveLength(0);
+  }
+  for (const options of [
+    { headers: { authorization: "Bearer forged" } },
+    { redirect: "follow" },
+    { method: "POST" },
+  ]) {
+    const f = fixture([
+      route({
+        handle: (_request, context) =>
+          context.fetchProduct("/api/history", options as DshProductRequest),
+      }),
+    ]);
+    expect((await f.request())!.status).toBe(400);
+    expect(f.calls).toHaveLength(0);
+  }
+});
+
+test("POST input is bounded before project code and cannot expand beyond its route limit", async () => {
+  let invoked = 0;
+  const f = fixture([
+    route({
+      method: "POST",
+      path: "/upload",
+      maxBodyBytes: 4,
+      handle: async (_request, context) => {
+        invoked++;
+        return context.fetchProduct("/api/upload", { body: "12345" });
+      },
+    }),
+  ]);
+  expect(
+    (await f.request("/upload", { method: "POST", body: "12345" }))!.status,
+  ).toBe(413);
+  expect(invoked).toBe(0);
+  expect(
+    (await f.request("/upload", { method: "POST", body: "1234" }))!.status,
+  ).toBe(413);
+  expect(invoked).toBe(1);
+  expect(f.calls).toHaveLength(0);
+});
+
+test("request query length is bounded before project code", async () => {
+  const f = fixture([route()]);
+  expect(
+    (await f.request(`/history/item-1?query=${"x".repeat(4096)}`))!.status,
+  ).toBe(414);
+  expect(f.calls).toHaveLength(0);
+});
+
+test("every product fetch reauthorizes instead of retaining a successful login decision", async () => {
+  const f = fixture([
+    route({
+      handle: async (_request, context) => {
+        await context.fetchProduct("/api/first");
+        f.allow(false);
+        return context.fetchProduct("/api/second");
+      },
+    }),
+  ]);
+  expect((await f.request())!.status).toBe(401);
+  expect(f.calls).toHaveLength(1);
+});
+
+test("revocation before a handler completes prevents its result from being returned", async () => {
+  const f = fixture([
+    route({
+      handle: async (_request, context) => {
+        const response = await context.fetchProduct("/api/history");
+        f.allow(false);
+        return response;
+      },
+    }),
+  ]);
+  expect((await f.request())!.status).toBe(401);
+  expect(f.calls).toHaveLength(1);
+});
+
+test("response bytes, upstream redirects, deadline and cancellation have explicit bounds", async () => {
+  const f = fixture([route({ maxResponseBytes: 4 })]);
+  f.respond(() => new Response("oversized"));
+  expect((await f.request())!.status).toBe(502);
+  f.respond(
+    () =>
+      new Response(null, {
+        status: 302,
+        headers: { location: "https://evil.test" },
+      }),
+  );
+  expect((await f.request())!.status).toBe(502);
+  const timed = fixture([
+    route({ timeoutMs: 5, handle: () => new Promise(() => {}) }),
+  ]);
+  expect((await timed.request())!.status).toBe(504);
+  const cancelled = fixture([route()]);
+  cancelled.controller.abort();
+  expect((await cancelled.request())!.status).toBe(499);
+  expect(cancelled.calls).toHaveLength(0);
+});