create-windy 0.8.3 → 0.9.1

package/template/apps/agent-server/native/boundary-product.ts

@@ -0,0 +1,107 @@
+import type { DshProductRequest } from "../host-contracts.js";
+import {
+  abortable,
+  boundedProjectResponse,
+  ProjectBoundaryError,
+} from "./boundary-io.js";
+
+export function projectProductFetch(input: {
+  readonly origin: string;
+  readonly session: string;
+  readonly method: "GET" | "POST";
+  readonly maxBodyBytes: number;
+  readonly maxResponseBytes: number;
+  readonly signal: AbortSignal;
+  readonly authorize: () => Promise<boolean>;
+  readonly fetcher: typeof fetch;
+}) {
+  const origin = new URL(input.origin);
+  if (
+    !["http:", "https:"].includes(origin.protocol) ||
+    origin.username ||
+    origin.password
+  )
+    throw new Error("Invalid product origin");
+  return async (path: string, options: DshProductRequest = {}) => {
+    input.signal.throwIfAborted();
+    if (
+      typeof path !== "string" ||
+      path.length > 8192 ||
+      !path.startsWith("/api/") ||
+      /[\\#]/.test(path) ||
+      [...path].some(
+        (char) => char.charCodeAt(0) <= 32 || char.charCodeAt(0) === 127,
+      ) ||
+      Object.keys(options).some(
+        (key) => !["method", "body", "contentType"].includes(key),
+      )
+    )
+      throw new ProjectBoundaryError(400, "INVALID_PROJECT_PRODUCT_REQUEST");
+    let pathname: string;
+    try {
+      pathname = decodeURIComponent(path.split("?")[0]!);
+    } catch {
+      throw new ProjectBoundaryError(400, "INVALID_PROJECT_PRODUCT_PATH");
+    }
+    if (
+      !pathname.startsWith("/api/") ||
+      pathname.startsWith("/api/internal/") ||
+      pathname === "/api/internal" ||
+      pathname.includes("\\") ||
+      pathname
+        .slice(1)
+        .split("/")
+        .some((part) => !part || part === "." || part === "..")
+    )
+      throw new ProjectBoundaryError(400, "INVALID_PROJECT_PRODUCT_PATH");
+    const target = new URL(path, origin);
+    const method = options.method ?? input.method;
+    const contentType = options.contentType ?? "application/json";
+    if (
+      target.origin !== origin.origin ||
+      method !== input.method ||
+      !["application/json", "application/octet-stream"].includes(contentType) ||
+      (options.body !== undefined &&
+        typeof options.body !== "string" &&
+        !(options.body instanceof Uint8Array))
+    )
+      throw new ProjectBoundaryError(400, "INVALID_PROJECT_PRODUCT_REQUEST");
+    const body =
+      typeof options.body === "string"
+        ? new TextEncoder().encode(options.body)
+        : options.body
+          ? new Uint8Array(options.body)
+          : undefined;
+    if (
+      (body?.byteLength ?? 0) > input.maxBodyBytes ||
+      (method === "GET" && body)
+    )
+      throw new ProjectBoundaryError(413, "PROJECT_BODY_TOO_LARGE");
+    if (!(await abortable(input.authorize(), input.signal)))
+      throw new ProjectBoundaryError(401, "UNAUTHENTICATED");
+    input.signal.throwIfAborted();
+    const response = await abortable(
+      input.fetcher(target, {
+        method,
+        headers: {
+          authorization: `Bearer ${input.session}`,
+          accept: "application/json",
+          ...(method === "POST" ? { "content-type": contentType } : {}),
+        },
+        ...(body ? { body } : {}),
+        signal: input.signal,
+        redirect: "error",
+      }),
+      input.signal,
+    );
+    if (response.status >= 300 && response.status < 400) {
+      void response.body?.cancel().catch(() => {});
+      throw new ProjectBoundaryError(502, "PROJECT_PRODUCT_REDIRECT");
+    }
+    return boundedProjectResponse(
+      response,
+      input.maxResponseBytes,
+      input.signal,
+    );
+  };
+}

package/template/apps/agent-server/native/boundary-project.test.ts

@@ -0,0 +1,247 @@
+import { expect, test } from "bun:test";
+import type { DshBoundaryRoute, DshProductRequest } from "../host-contracts.js";
+import { compileProjectBoundary } from "./boundary-project.js";
+
+function route(overrides: Partial<DshBoundaryRoute> = {}): DshBoundaryRoute {
+  return {
+    key: "project.history",
+    method: "GET",
+    path: "/history/:id",
+    handle: (request, context) =>
+      context.fetchProduct(`/api/history/${request.parameters.id}`),
+    ...overrides,
+  };
+}
+
+function fixture(routes: readonly DshBoundaryRoute[]) {
+  const calls: Request[] = [];
+  let allowed = true;
+  let response = () =>
+    Response.json(
+      { verified: true },
+      {
+        headers: { "set-cookie": "private=secret", authorization: "private" },
+      },
+    );
+  const controller = new AbortController();
+  const dispatch = compileProjectBoundary(routes);
+  return {
+    calls,
+    controller,
+    allow(value: boolean) {
+      allowed = value;
+    },
+    respond(value: () => Response) {
+      response = value;
+    },
+    async request(path = "/history/item-1", init: RequestInit = {}) {
+      const request = new Request(
+        `http://agent.internal/internal/boundary${path}`,
+        init,
+      );
+      return dispatch({
+        request,
+        path: new URL(request.url).pathname.slice("/internal/boundary".length),
+        actorId: "actor-1",
+        session: "private-product-session",
+        productOrigin: "http://product.internal",
+        signal: controller.signal,
+        authorize: async () => allowed,
+        fetcher: (async (input, options) => {
+          calls.push(new Request(input, options));
+          return response();
+        }) as typeof fetch,
+      });
+    },
+  };
+}
+
+test("project routes preserve current identity while exposing only bounded public context", async () => {
+  let keys: string[] = [];
+  const f = fixture([
+    route({
+      handle: async (request, context) => {
+        keys = Object.keys(context).sort();
+        expect(context.actorId).toBe("actor-1");
+        expect(request.parameters.id).toBe("item-1");
+        return context.fetchProduct(`/api/history/${request.parameters.id}`);
+      },
+    }),
+  ]);
+  const response = await f.request(undefined, {
+    headers: {
+      authorization: "Bearer forged",
+      cookie: "forged=1",
+      "x-windy-actor-id": "other",
+    },
+  });
+  expect(keys).toEqual(["actorId", "fetchProduct", "signal"]);
+  expect(f.calls[0]!.url).toBe("http://product.internal/api/history/item-1");
+  const headerNames: string[] = [];
+  f.calls[0]!.headers.forEach((_value, key) => headerNames.push(key));
+  expect(headerNames.sort()).toEqual(["accept", "authorization"]);
+  expect(f.calls[0]!.headers.get("authorization")).toBe(
+    "Bearer private-product-session",
+  );
+  expect(response!.headers.get("set-cookie")).toBeNull();
+  expect(response!.headers.get("authorization")).toBeNull();
+  expect(response!.headers.get("cache-control")).toBe("no-store");
+  expect(await response!.json()).toEqual({ verified: true });
+});
+
+test("unknown routes and invalid path parameters never invoke product handlers", async () => {
+  const f = fixture([route()]);
+  for (const path of [
+    "/unknown",
+    "/history/has.dot",
+    "/history/item/extra",
+    "/history/%2e%2e",
+  ])
+    expect(await f.request(path)).toBeUndefined();
+  expect(
+    await f.request("/history/item-1", { method: "POST", body: "ignored" }),
+  ).toBeUndefined();
+  expect(f.calls).toHaveLength(0);
+});
+
+test("route declarations reject ambiguous, reserved, oversized and duplicate entries", () => {
+  for (const invalid of [
+    { path: "/mcp" },
+    { path: "/skills/other" },
+    { path: "/v1/other" },
+    { path: "/history/*" },
+    { path: "/history/:id/:id" },
+    { method: "DELETE" },
+    { maxBodyBytes: 1 },
+    { maxResponseBytes: 20 * 1024 * 1024 + 1 },
+    { timeoutMs: 30001 },
+  ])
+    expect(() =>
+      compileProjectBoundary([route(invalid as Partial<DshBoundaryRoute>)]),
+    ).toThrow();
+  expect(() =>
+    compileProjectBoundary([
+      route(),
+      route({ key: "other", path: "/history/fixed" }),
+    ]),
+  ).toThrow("Ambiguous");
+  expect(() =>
+    compileProjectBoundary([route(), route({ path: "/other/:id" })]),
+  ).toThrow();
+});
+
+test("SSRF, traversal, internal endpoints and caller-selected headers or redirects fail before fetch", async () => {
+  for (const path of [
+    "https://evil.test/api/history",
+    "//evil.test/api/history",
+    "/api/../auth",
+    "/api/%2e%2e/auth",
+    "/api/internal/secret",
+    "/api/history\\other",
+    "/api/history#fragment",
+    "/api/history/%invalid",
+    `/api/history?query=${"x".repeat(8192)}`,
+  ]) {
+    const f = fixture([
+      route({ handle: (_request, context) => context.fetchProduct(path) }),
+    ]);
+    expect((await f.request())!.status).toBe(400);
+    expect(f.calls).toHaveLength(0);
+  }
+  for (const options of [
+    { headers: { authorization: "Bearer forged" } },
+    { redirect: "follow" },
+    { method: "POST" },
+  ]) {
+    const f = fixture([
+      route({
+        handle: (_request, context) =>
+          context.fetchProduct("/api/history", options as DshProductRequest),
+      }),
+    ]);
+    expect((await f.request())!.status).toBe(400);
+    expect(f.calls).toHaveLength(0);
+  }
+});
+
+test("POST input is bounded before project code and cannot expand beyond its route limit", async () => {
+  let invoked = 0;
+  const f = fixture([
+    route({
+      method: "POST",
+      path: "/upload",
+      maxBodyBytes: 4,
+      handle: async (_request, context) => {
+        invoked++;
+        return context.fetchProduct("/api/upload", { body: "12345" });
+      },
+    }),
+  ]);
+  expect(
+    (await f.request("/upload", { method: "POST", body: "12345" }))!.status,
+  ).toBe(413);
+  expect(invoked).toBe(0);
+  expect(
+    (await f.request("/upload", { method: "POST", body: "1234" }))!.status,
+  ).toBe(413);
+  expect(invoked).toBe(1);
+  expect(f.calls).toHaveLength(0);
+});
+
+test("request query length is bounded before project code", async () => {
+  const f = fixture([route()]);
+  expect(
+    (await f.request(`/history/item-1?query=${"x".repeat(4096)}`))!.status,
+  ).toBe(414);
+  expect(f.calls).toHaveLength(0);
+});
+
+test("every product fetch reauthorizes instead of retaining a successful login decision", async () => {
+  const f = fixture([
+    route({
+      handle: async (_request, context) => {
+        await context.fetchProduct("/api/first");
+        f.allow(false);
+        return context.fetchProduct("/api/second");
+      },
+    }),
+  ]);
+  expect((await f.request())!.status).toBe(401);
+  expect(f.calls).toHaveLength(1);
+});
+
+test("revocation before a handler completes prevents its result from being returned", async () => {
+  const f = fixture([
+    route({
+      handle: async (_request, context) => {
+        const response = await context.fetchProduct("/api/history");
+        f.allow(false);
+        return response;
+      },
+    }),
+  ]);
+  expect((await f.request())!.status).toBe(401);
+  expect(f.calls).toHaveLength(1);
+});
+
+test("response bytes, upstream redirects, deadline and cancellation have explicit bounds", async () => {
+  const f = fixture([route({ maxResponseBytes: 4 })]);
+  f.respond(() => new Response("oversized"));
+  expect((await f.request())!.status).toBe(502);
+  f.respond(
+    () =>
+      new Response(null, {
+        status: 302,
+        headers: { location: "https://evil.test" },
+      }),
+  );
+  expect((await f.request())!.status).toBe(502);
+  const timed = fixture([
+    route({ timeoutMs: 5, handle: () => new Promise(() => {}) }),
+  ]);
+  expect((await timed.request())!.status).toBe(504);
+  const cancelled = fixture([route()]);
+  cancelled.controller.abort();
+  expect((await cancelled.request())!.status).toBe(499);
+  expect(cancelled.calls).toHaveLength(0);
+});

package/template/apps/agent-server/native/boundary-project.ts

@@ -0,0 +1,188 @@
+import type { DshBoundaryRoute } from "../host-contracts.js";
+import {
+  abortable,
+  boundedBytes,
+  boundedProjectResponse,
+  ProjectBoundaryError,
+} from "./boundary-io.js";
+import { projectProductFetch } from "./boundary-product.js";
+import {
+  authorizationUnavailableResponse,
+  isWorkbenchAuthorizationUnavailable,
+} from "./authorization.js";
+
+const maximumBytes = 20 * 1024 * 1024;
+interface CompiledRoute {
+  readonly definition: DshBoundaryRoute;
+  readonly segments: readonly string[];
+  readonly maxBodyBytes: number;
+  readonly maxResponseBytes: number;
+  readonly timeoutMs: number;
+}
+
+export function compileProjectBoundary(routes: readonly DshBoundaryRoute[]) {
+  const compiled: CompiledRoute[] = [];
+  const keys = new Set<string>();
+  for (const route of routes) {
+    const segments = route.path.split("/").slice(1);
+    const parameters = segments.filter((value) => value.startsWith(":"));
+    const maxBodyBytes =
+      route.maxBodyBytes ?? (route.method === "GET" ? 0 : 65536);
+    const maxResponseBytes = route.maxResponseBytes ?? 2 * 1024 * 1024;
+    const timeoutMs = route.timeoutMs ?? 15000;
+    if (
+      !/^[a-z][a-z0-9.-]{0,63}$/.test(route.key) ||
+      keys.has(route.key) ||
+      !["GET", "POST"].includes(route.method) ||
+      !route.path.startsWith("/") ||
+      route.path.length > 256 ||
+      segments.length === 0 ||
+      segments.some(
+        (part) => !/^(?:[A-Za-z0-9_-]+|:[a-z][A-Za-z0-9_]*)$/.test(part),
+      ) ||
+      ["mcp", "skills", "v1"].includes(segments[0]!) ||
+      new Set(parameters).size !== parameters.length ||
+      !Number.isSafeInteger(maxBodyBytes) ||
+      maxBodyBytes < 0 ||
+      maxBodyBytes > maximumBytes ||
+      (route.method === "GET" && maxBodyBytes !== 0) ||
+      !Number.isSafeInteger(maxResponseBytes) ||
+      maxResponseBytes < 1 ||
+      maxResponseBytes > maximumBytes ||
+      !Number.isSafeInteger(timeoutMs) ||
+      timeoutMs < 1 ||
+      timeoutMs > 30000 ||
+      typeof route.handle !== "function"
+    )
+      throw new Error("Invalid project boundary route");
+    if (
+      compiled.some(
+        (previous) =>
+          previous.definition.method === route.method &&
+          previous.segments.length === segments.length &&
+          previous.segments.every(
+            (part, index) =>
+              part === segments[index] ||
+              part.startsWith(":") ||
+              segments[index]!.startsWith(":"),
+          ),
+      )
+    )
+      throw new Error("Ambiguous project boundary route");
+    keys.add(route.key);
+    compiled.push({
+      definition: route,
+      segments,
+      maxBodyBytes,
+      maxResponseBytes,
+      timeoutMs,
+    });
+  }
+  return async (input: {
+    request: Request;
+    path: string;
+    actorId: string;
+    session: string;
+    productOrigin: string;
+    signal: AbortSignal;
+    authorize: () => Promise<boolean>;
+    fetcher?: typeof fetch;
+  }): Promise<Response | undefined> => {
+    const parts = input.path.split("/").slice(1);
+    const selected = compiled.find(
+      ({ definition, segments }) =>
+        definition.method === input.request.method &&
+        segments.length === parts.length &&
+        segments.every((part, index) =>
+          part.startsWith(":")
+            ? /^[A-Za-z0-9_-]{1,128}$/.test(parts[index]!)
+            : part === parts[index],
+        ),
+    );
+    if (!selected) return;
+    const lifetime = new AbortController();
+    const timer = setTimeout(
+      () => lifetime.abort(new Error("PROJECT_BOUNDARY_TIMEOUT")),
+      selected.timeoutMs,
+    );
+    const signal = AbortSignal.any([input.signal, lifetime.signal]);
+    try {
+      const url = new URL(input.request.url);
+      if (url.pathname.length > 2048 || url.search.length > 4096)
+        throw new ProjectBoundaryError(414, "PROJECT_URL_TOO_LARGE");
+      const body = await boundedBytes(
+        input.request.body,
+        selected.maxBodyBytes,
+        signal,
+      );
+      const parameters = Object.fromEntries(
+        selected.segments.flatMap((part, index) =>
+          part.startsWith(":") ? [[part.slice(1), parts[index]!]] : [],
+        ),
+      );
+      const response = await abortable(
+        selected.definition.handle(
+          {
+            method: selected.definition.method,
+            path: input.path,
+            parameters,
+            searchParams: url.searchParams,
+            body,
+            signal,
+          },
+          {
+            actorId: input.actorId,
+            signal,
+            fetchProduct: projectProductFetch({
+              origin: input.productOrigin,
+              session: input.session,
+              method: selected.definition.method,
+              maxBodyBytes: selected.maxBodyBytes,
+              maxResponseBytes: selected.maxResponseBytes,
+              signal,
+              authorize: input.authorize,
+              fetcher: input.fetcher ?? fetch,
+            }),
+          },
+        ),
+        signal,
+      );
+      if (!(await abortable(input.authorize(), signal))) {
+        void response.body?.cancel().catch(() => {});
+        throw new ProjectBoundaryError(401, "UNAUTHENTICATED");
+      }
+      return await boundedProjectResponse(
+        response,
+        selected.maxResponseBytes,
+        signal,
+      );
+    } catch (error) {
+      if (
+        isWorkbenchAuthorizationUnavailable(error) ||
+        isWorkbenchAuthorizationUnavailable(input.signal.reason)
+      )
+        return authorizationUnavailableResponse();
+      const known = error instanceof ProjectBoundaryError ? error : undefined;
+      return Response.json(
+        {
+          error:
+            known?.code ??
+            (lifetime.signal.aborted
+              ? "PROJECT_BOUNDARY_TIMEOUT"
+              : input.signal.aborted
+                ? "CANCELLED"
+                : "PROJECT_BOUNDARY_UNAVAILABLE"),
+        },
+        {
+          status:
+            known?.status ??
+            (lifetime.signal.aborted ? 504 : input.signal.aborted ? 499 : 502),
+          headers: { "cache-control": "no-store" },
+        },
+      );
+    } finally {
+      clearTimeout(timer);
+      lifetime.abort();
+    }
+  };
+}