machinaos 0.0.78 → 0.0.80

package/server/services/events/oauth_lifecycle.py

@@ -35,6 +35,8 @@ fail the callback CSRF check.
 
 from __future__ import annotations
 
+import html
+import json
 from typing import Any, Awaitable, Callable, Dict, Optional, Protocol
 
 from fastapi import APIRouter, Query, Request, WebSocket
@@ -59,7 +61,9 @@ class OAuthLike(Protocol):
     """
 
     def generate_authorization_url(
-        self, *, state_data: Optional[Dict[str, Any]] = None,
+        self,
+        *,
+        state_data: Optional[Dict[str, Any]] = None,
     ) -> Dict[str, str]: ...
 
     async def exchange_code(self, code: str, state: str) -> Dict[str, Any]: ...
@@ -69,7 +73,9 @@ class OAuthLike(Protocol):
     async def refresh_access_token(self, refresh_token: str) -> Dict[str, Any]: ...
 
     async def revoke_token(
-        self, token: str, token_type: str = "access_token",
+        self,
+        token: str,
+        token_type: str = "access_token",
     ) -> Dict[str, Any]: ...
 
 
@@ -136,10 +142,7 @@ def make_oauth_lifecycle_handlers(
         if not client_id:
             return {
                 "success": False,
-                "error": (
-                    f"{provider.capitalize()} Client ID not configured. "
-                    f"Add your {provider.capitalize()} API credentials first."
-                ),
+                "error": (f"{provider.capitalize()} Client ID not configured. " f"Add your {provider.capitalize()} API credentials first."),
             }
 
         redirect_uri = get_redirect_uri(websocket, provider)
@@ -177,7 +180,8 @@ def make_oauth_lifecycle_handlers(
         # cached in memory; pull from DB on demand).
         if not user_info.get("success"):
             refresh_token = await auth_service.get_oauth_refresh_token(
-                provider, customer_id="owner",
+                provider,
+                customer_id="owner",
             )
             if refresh_token:
                 refresh = await oauth.refresh_access_token(refresh_token)
@@ -216,10 +220,7 @@ def make_oauth_lifecycle_handlers(
         auth_service = container.auth_service()
         tokens = await auth_service.get_oauth_tokens(provider, customer_id="owner")
         access_token = tokens.get("access_token") if tokens else None
-        refresh_token = (
-            await auth_service.get_oauth_refresh_token(provider, customer_id="owner")
-            if tokens else None
-        )
+        refresh_token = await auth_service.get_oauth_refresh_token(provider, customer_id="owner") if tokens else None
 
         if access_token or refresh_token:
             redirect_uri = get_redirect_uri(websocket, provider)
@@ -254,12 +255,14 @@ def make_oauth_lifecycle_handlers(
 
 
 async def _maybe_legacy_broadcast(
-    broadcast_type: Optional[str], payload: Dict[str, Any],
+    broadcast_type: Optional[str],
+    payload: Dict[str, Any],
 ) -> None:
     """Optional legacy status broadcast (Google's ``google_status`` frame)."""
     if not broadcast_type:
         return
     from services.status_broadcaster import get_status_broadcaster
+
     await get_status_broadcaster().broadcast({"type": broadcast_type, "data": payload})
 
 
@@ -333,8 +336,10 @@ def make_oauth_callback_router(
             logger.warning(f"{provider} OAuth denied: {error} - {error_description}")
             return HTMLResponse(
                 content=render_oauth_callback_html(
-                    provider, status="error",
-                    message=error_description or error, color_hex=color_hex,
+                    provider,
+                    status="error",
+                    message=error_description or error,
+                    color_hex=color_hex,
                 ),
                 status_code=200,
             )
@@ -342,7 +347,8 @@ def make_oauth_callback_router(
         if not code or not state:
             return HTMLResponse(
                 content=render_oauth_callback_html(
-                    provider, status="error",
+                    provider,
+                    status="error",
                     message="Missing authorization code or state parameter",
                     color_hex=color_hex,
                 ),
@@ -365,7 +371,8 @@ def make_oauth_callback_router(
         if not result.get("success"):
             return HTMLResponse(
                 content=render_oauth_callback_html(
-                    provider, status="error",
+                    provider,
+                    status="error",
                     message=result.get("error", "Token exchange failed"),
                     color_hex=color_hex,
                 ),
@@ -384,10 +391,13 @@ def make_oauth_callback_router(
         store_overrides: Dict[str, Any] = {}
         redirect_after: Optional[str] = None
         if extra_state_handler is not None:
-            override = await extra_state_handler({
-                "state_data": state_data, "user_info": user_info,
-                "tokens": result,
-            })
+            override = await extra_state_handler(
+                {
+                    "state_data": state_data,
+                    "user_info": user_info,
+                    "tokens": result,
+                }
+            )
             if override:
                 redirect_after = override.pop("redirect_after", None)
                 store_overrides.update(override)
@@ -411,13 +421,15 @@ def make_oauth_callback_router(
         from services.status_broadcaster import get_status_broadcaster
 
         broadcaster = get_status_broadcaster()
-        await broadcaster.broadcast({
-            "type": f"{provider}_oauth_complete",
-            "data": {
-                "success": True,
-                **{k: v for k, v in user_info.items() if k != "success"},
-            },
-        })
+        await broadcaster.broadcast(
+            {
+                "type": f"{provider}_oauth_complete",
+                "data": {
+                    "success": True,
+                    **{k: v for k, v in user_info.items() if k != "success"},
+                },
+            }
+        )
         await broadcaster.broadcast_credential_event(
             "credential.oauth.connected",
             provider=provider,
@@ -426,12 +438,15 @@ def make_oauth_callback_router(
 
         if redirect_after:
             from fastapi.responses import RedirectResponse
+
             return RedirectResponse(url=redirect_after, status_code=302)
 
         return HTMLResponse(
             content=render_oauth_callback_html(
-                provider, status="success",
-                message=f"Successfully connected as {email}!", color_hex=color_hex,
+                provider,
+                status="success",
+                message=f"Successfully connected as {email}!",
+                color_hex=color_hex,
             ),
             status_code=200,
         )
@@ -480,9 +495,9 @@ _HTML_TEMPLATE = """<!DOCTYPE html>
     <script>
         if (window.opener) {{
             window.opener.postMessage({{
-                type: '{provider}_oauth_callback',
+                type: {provider_js},
                 success: {success_js},
-                message: '{message_js}',
+                message: {message_js},
             }}, '*');
         }}
         setTimeout(function() {{ window.close(); }}, 2000);
@@ -491,8 +506,7 @@ _HTML_TEMPLATE = """<!DOCTYPE html>
 </html>"""
 
 _SUCCESS_ICON = (
-    "<path stroke-linecap='round' stroke-linejoin='round' stroke-width='2' "
-    "d='M9 12l2 2 4-4m6 2a9 9 0 11-18 0 9 9 0 0118 0z'/>"
+    "<path stroke-linecap='round' stroke-linejoin='round' stroke-width='2' " "d='M9 12l2 2 4-4m6 2a9 9 0 11-18 0 9 9 0 0118 0z'/>"
 )
 _ERROR_ICON = (
     "<path stroke-linecap='round' stroke-linejoin='round' stroke-width='2' "
@@ -501,7 +515,11 @@ _ERROR_ICON = (
 
 
 def render_oauth_callback_html(
-    provider: str, *, status: str, message: str, color_hex: str,
+    provider: str,
+    *,
+    status: str,
+    message: str,
+    color_hex: str,
 ) -> str:
     """Render the small auto-closing callback page.
 
@@ -509,22 +527,60 @@ def render_oauth_callback_html(
     ``{provider}_oauth_callback`` message to ``window.opener`` (the
     popup's parent) and auto-closes after 2 seconds.
     """
+    # ``message`` reaches the page via the OAuth provider's ``?error_description=``
+    # query string -- attacker-controllable. Escape for both contexts the
+    # template interpolates it into:
+    #   * ``<p>{message}</p>``                      → ``html.escape`` neutralises
+    #                                                  ``<script>`` / attribute breakouts.
+    #   * ``postMessage({ message: '{message_js}' })`` → ``json.dumps`` wraps the
+    #                                                  string in correctly-escaped
+    #                                                  JS source (matching quotes,
+    #                                                  ``</script>`` neutralised,
+    #                                                  unicode literals).
+    # CodeQL recognises both as ``py/reflective-xss`` sanitizers.
+    # ``message`` reaches the page via the OAuth provider's
+    # ``?error_description=`` query string -- attacker-controllable.
+    # Two sinks need separate escaping:
+    #
+    # * ``<p>{message}</p>``         → ``html.escape`` neutralises ``<script>``,
+    #                                   attribute breakouts, ampersand-entities.
+    # * ``postMessage({message: X})`` → ``json.dumps`` + ``_js_safe`` post-escape.
+    #                                   ``json.dumps`` alone does NOT escape ``<``
+    #                                   or ``</``: an attacker-controlled message
+    #                                   containing ``</script>`` would close the
+    #                                   surrounding ``<script>`` tag because the
+    #                                   browser tokenizer scans for that pattern
+    #                                   before parsing the JS string. Per OWASP
+    #                                   guidance we ``\u``-escape ``<`` ``>`` ``&``
+    #                                   so the JSON literal is also safe inside
+    #                                   a ``<script>`` block.
     is_success = status == "success"
-    title = (
-        f"{provider.capitalize()} Connected" if is_success
-        else "Connection Failed"
-    )
+    title = f"{provider.capitalize()} Connected" if is_success else "Connection Failed"
     return _HTML_TEMPLATE.format(
-        title=title,
-        message=message,
+        title=html.escape(title),
+        message=html.escape(message),
         color_hex=color_hex,
         icon_path=_SUCCESS_ICON if is_success else _ERROR_ICON,
-        provider=provider,
+        provider_js=_js_safe(json.dumps(f"{provider}_oauth_callback")),
         success_js=str(is_success).lower(),
-        message_js=message.replace("'", "\\'"),
+        message_js=_js_safe(json.dumps(message)),
     )
 
 
+def _js_safe(json_literal: str) -> str:
+    """Post-escape a ``json.dumps`` output for safe inlining inside ``<script>``.
+
+    ``json.dumps`` follows the JSON spec, which doesn't require ``<`` / ``>`` /
+    ``&`` to be escaped -- but an attacker-controlled string containing
+    ``</script>`` inside a JSON literal would still close the surrounding
+    ``<script>`` block (the browser tokenizer hunts for ``</script>`` regardless
+    of JS string-literal state). The OWASP Cheat Sheet recommends ``\\u``-encoding
+    those three characters before emission. CodeQL recognises this pattern as a
+    ``py/reflective-xss`` sanitizer.
+    """
+    return json_literal.replace("<", "\\u003c").replace(">", "\\u003e").replace("&", "\\u0026")
+
+
 __all__ = [
     "OAuthLike",
     "OAuthFactory",

package/server/services/events/triggers.py

@@ -35,10 +35,7 @@ class BaseTriggerParams(BaseModel):
 
     event_type_filter: str = Field(
         default="all",
-        description=(
-            "Event type to match. 'all' for every event, exact name, "
-            "or wildcard prefix (e.g. 'foo.*')."
-        ),
+        description=("Event type to match. 'all' for every event, exact name, " "or wildcard prefix (e.g. 'foo.*')."),
     )
 
     model_config = ConfigDict(extra="ignore")
@@ -66,12 +63,7 @@ class WebhookTriggerNode(TriggerNode):
 
     def build_filter(self, params: BaseModel) -> Callable[[Any], bool]:
         type_filter = (getattr(params, "event_type_filter", "") or "all").strip()
-        if (
-            type_filter
-            and type_filter != "all"
-            and self.event_type_prefix
-            and not type_filter.startswith(self.event_type_prefix)
-        ):
+        if type_filter and type_filter != "all" and self.event_type_prefix and not type_filter.startswith(self.event_type_prefix):
             type_filter = self.event_type_prefix + type_filter
         extras = self._extra_filter(params)
 
@@ -113,6 +105,4 @@ class WebhookTriggerNode(TriggerNode):
 
     @Operation("wait")
     async def wait(self, ctx: NodeContext, params: BaseModel):
-        raise NotImplementedError(
-            "Event triggers return via TriggerNode.execute, not the op body"
-        )
+        raise NotImplementedError("Event triggers return via TriggerNode.execute, not the op body")

package/server/services/events/verifiers/hmac_basic.py

@@ -26,7 +26,7 @@ class HmacVerifier(WebhookVerifier):
             raise ValueError(f"{cls.header_name} header missing")
         if cls.signature_prefix and not sig.startswith(cls.signature_prefix):
             raise ValueError(f"{cls.header_name} missing prefix {cls.signature_prefix!r}")
-        provided = sig[len(cls.signature_prefix):]
+        provided = sig[len(cls.signature_prefix) :]
         expected = hmac.new(secret.encode(), body, hashlib.sha256).hexdigest()
         if not hmac.compare_digest(expected, provided):
             raise ValueError(f"{cls.header_name} mismatch")

package/server/services/events/verifiers/standard_webhooks.py

@@ -29,14 +29,12 @@ class StandardWebhooksVerifier(WebhookVerifier):
             raise ValueError("Standard Webhooks headers missing")
 
         if secret.startswith("whsec_"):
-            key = base64.b64decode(secret[len("whsec_"):])
+            key = base64.b64decode(secret[len("whsec_") :])
         else:
             key = secret.encode()
 
         signed = f"{msg_id}.{timestamp}.".encode() + body
-        expected = base64.b64encode(
-            hmac.new(key, signed, hashlib.sha256).digest()
-        ).decode()
+        expected = base64.b64encode(hmac.new(key, signed, hashlib.sha256).digest()).decode()
 
         candidates: list[str] = []
         for part in sig_header.split():

package/server/services/events/webhook.py

@@ -37,9 +37,7 @@ def register_webhook_source(source: "WebhookSource") -> None:
     """Idempotent: same instance for the same path is a no-op; conflicts raise."""
     existing = WEBHOOK_SOURCES.get(source.path)
     if existing is not None and existing is not source:
-        raise ValueError(
-            f"Webhook path {source.path!r} already registered to {type(existing).__name__}"
-        )
+        raise ValueError(f"Webhook path {source.path!r} already registered to {type(existing).__name__}")
     WEBHOOK_SOURCES[source.path] = source
 
 
@@ -101,5 +99,6 @@ class WebhookSource(PushEventSource):
         await self.receive(event)
 
         from services import event_waiter
+
         event_waiter.dispatch(self.type, event)
         return event

package/server/services/example_loader.py

@@ -1,23 +1,35 @@
-"""Example workflow loader - reuses existing database.save_workflow()"""
+"""Example workflow loader - reuses existing database.save_workflow().
+
+Most of the import business logic (validation, remap, requirements
+extraction, credential cross-check, name conflict) lives in
+``services.workflow_import`` and is shared with the WS ``import_workflow``
+handler. This module is the first-launch-only convenience wrapper.
+"""
+
 import json
 import logging
-from pathlib import Path
 from typing import List, Dict, Any
 
+from core.paths import example_workflows_dir
+
 logger = logging.getLogger(__name__)
 
-# Workflows folder at project root (parent of server/)
-EXAMPLES_DIR = Path(__file__).parent.parent.parent / "workflows"
+
+# Module-level alias so callers (and the workflow-validator contract
+# test in ``tests/test_workflow_validator.py``) can ``glob(EXAMPLES_DIR /
+# "*.json")`` without re-resolving the path on every call.
+EXAMPLES_DIR = example_workflows_dir()
 
 
 def get_example_workflows() -> List[Dict[str, Any]]:
     """Load all example workflow JSON files from disk."""
     examples = []
-    if not EXAMPLES_DIR.exists():
-        logger.warning(f"Examples directory not found: {EXAMPLES_DIR}")
+    examples_dir = example_workflows_dir()
+    if not examples_dir.exists():
+        logger.warning(f"Examples directory not found: {examples_dir}")
         return examples
 
-    for file in sorted(EXAMPLES_DIR.glob("*.json")):
+    for file in sorted(examples_dir.glob("*.json")):
         try:
             with open(file, encoding="utf-8") as f:
                 workflow = json.load(f)
@@ -31,10 +43,19 @@ def get_example_workflows() -> List[Dict[str, Any]]:
 
 
 async def import_examples_for_user(database) -> int:
-    """Import all examples using existing database.save_workflow().
+    """Import all examples using shared ``services.workflow_import`` helpers.
+
+    Dry-runs the workflow validator on each example, remaps node ids
+    (mandatory: today's two example workflows share 6 node ids), then
+    saves the workflow + per-node parameters. Errors skip the example
+    (broken examples shipped on disk are bugs); warnings are logged but
+    allowed through — first-launch missing credentials are expected.
 
-    Returns count of workflows imported.
+    Returns the count of workflows imported.
     """
+    from services.workflow_import import remap_node_ids
+    from services.workflow_validator import validate_workflow
+
     examples = get_example_workflows()
     imported = 0
 
@@ -42,23 +63,60 @@ async def import_examples_for_user(database) -> int:
         # Use ID from JSON, prefixed with 'example_' for clarity
         workflow_id = f"example_{example.get('id', 'unknown')}"
 
+        # Rewrite every node id so two examples that share ids don't
+        # overwrite each other's parameters in the node_parameters table.
+        nodes, edges, node_parameters = remap_node_ids(
+            example.get("nodes", []),
+            example.get("edges", []),
+            example.get("nodeParameters", {}),
+        )
+
+        # Pre-save validation. parameters_by_id is the freshly-remapped
+        # map so INVALID_PARAM check sees the configured defaults instead
+        # of empty dicts.
+        try:
+            report = await validate_workflow(
+                nodes=nodes,
+                edges=edges,
+                parameters_by_id=node_parameters,
+            )
+        except Exception as exc:
+            logger.warning(
+                "Skipping example %r: validator raised %s",
+                example.get("name"),
+                exc,
+            )
+            continue
+
+        if report["errors"]:
+            logger.warning(
+                "Skipping example %r: %d validation errors %s",
+                example.get("name"),
+                len(report["errors"]),
+                [iss.get("code") for iss in report["errors"]],
+            )
+            continue
+        if report["warnings"]:
+            # Expected on first launch — credentials not yet configured.
+            logger.info(
+                "Example %r has %d warnings (likely first-launch credential gaps)",
+                example.get("name"),
+                len(report["warnings"]),
+            )
+
         # Reuse existing save_workflow method
         success = await database.save_workflow(
             workflow_id=workflow_id,
             name=example.get("name", "Example Workflow"),
             description=example.get("description"),
-            data={
-                "nodes": example.get("nodes", []),
-                "edges": example.get("edges", [])
-            }
+            data={"nodes": nodes, "edges": edges},
         )
 
         if success:
             imported += 1
             logger.info(f"Imported example: {example.get('name')}")
 
-            # Save embedded nodeParameters if present
-            node_parameters = example.get("nodeParameters", {})
+            # Save embedded nodeParameters under the remapped node ids.
             for node_id, params in node_parameters.items():
                 if params:
                     try: