Test hosted token limits import bounds and diagnostic redaction

Author: RhysSullivan

apps/cloud/src/auth/access-token-options.test.ts

@@ -0,0 +1,33 @@
+import { describe, expect, it } from "@effect/vitest";
+import { SignJWT, jwtVerify } from "jose";
+import { workosAccessTokenOptions } from "./access-token-options";
+
+describe("WorkOS token age boundary", () => {
+  it("accepts a fresh token, rejects it after 24 hours, and rejects future issuance", async () => {
+    const key = new TextEncoder().encode("synthetic-signing-key-for-unit-test-only");
+    const issuedAt = 1_700_000_000;
+    const token = await new SignJWT({})
+      .setProtectedHeader({ alg: "HS256" })
+      .setIssuedAt(issuedAt)
+      .setExpirationTime(issuedAt + 7 * 86400)
+      .sign(key);
+    await expect(
+      jwtVerify(token, key, {
+        ...workosAccessTokenOptions,
+        currentDate: new Date((issuedAt + 86399) * 1000),
+      }),
+    ).resolves.toHaveProperty("payload.iat", issuedAt);
+    await expect(
+      jwtVerify(token, key, {
+        ...workosAccessTokenOptions,
+        currentDate: new Date((issuedAt + 86401) * 1000),
+      }),
+    ).rejects.toHaveProperty("code", "ERR_JWT_EXPIRED");
+    await expect(
+      jwtVerify(token, key, {
+        ...workosAccessTokenOptions,
+        currentDate: new Date((issuedAt - 1) * 1000),
+      }),
+    ).rejects.toHaveProperty("code", "ERR_JWT_CLAIM_VALIDATION_FAILED");
+  });
+});

apps/cloud/src/auth/workos.node.test.ts

@@ -59,6 +59,7 @@ const signAccessToken = (
     readonly organizationId?: string;
     readonly sessionId?: string;
     readonly expiresIn?: string | number;
+    readonly issuedAt?: number;
   } = {},
 ) => {
   const jwt = new SignJWT({
@@ -67,7 +68,7 @@ const signAccessToken = (
   })
     .setProtectedHeader({ alg: "RS256", kid: keypair.kid })
     .setSubject(claims.subject ?? USER.id)
-    .setIssuedAt();
+    .setIssuedAt(claims.issuedAt);
 
   return (
     typeof claims.expiresIn === "number"
@@ -317,6 +318,21 @@ describe("authenticateSealedSession", () => {
     });
   });
 
+  it("refreshes a token beyond the local age limit even when WorkOS exp is later", async () => {
+    const keypair = await generateKeypair("k_old");
+    await withWorkOSStub(keypair, async (stub) => {
+      const now = Math.floor(Date.now() / 1000);
+      const token = await signAccessToken(keypair, {
+        issuedAt: now - 86401,
+        expiresIn: now + 86400,
+      });
+      const result = await runAuthenticate(await sealSession(token), stub.baseUrl);
+      expect(result?.sessionId).toBe("session_refreshed");
+      expect(result?.refreshedSession).toEqual(expect.any(String));
+      expect(stub.requests()[1]?.body).toMatchObject({ grant_type: "refresh_token" });
+    });
+  });
+
   it("returns null for garbage session data", async () => {
     const keypair = await generateKeypair("k_garbage");
     await withWorkOSStub(keypair, async (stub) => {

apps/cloud/src/mcp/mcp-auth.node.test.ts

@@ -151,7 +151,7 @@ describe("access token expiry and identity boundaries", () => {
         }),
       );
     }
-    it.effect(`${kind} accepts a token issued more than a day ago that has not expired`, () =>
+    it.effect(`${kind} rejects a token issued more than a day ago even when exp is later`, () =>
       Effect.gen(function* () {
         const { publicKey, privateKey } = yield* Effect.promise(() => generateKeyPair("RS256"));
         const jwk = yield* Effect.promise(() => exportJWK(publicKey));
@@ -169,10 +169,13 @@ describe("access token expiry and identity boundaries", () => {
             .setProtectedHeader({ alg: "RS256", kid: "expiry-key" })
             .sign(privateKey),
         );
-        const verified = yield* kind === "mcp"
-          ? verifyMcpAccessToken(token, jwks, { issuer, audience: resource })
-          : verifyWorkosUserManagementToken(token, jwks);
-        expect(verified).toEqual({ accountId: "user_test", organizationId: "org_test" });
+        const error = yield* Effect.flip(
+          kind === "mcp"
+            ? verifyMcpAccessToken(token, jwks, { issuer, audience: resource })
+            : verifyWorkosUserManagementToken(token, jwks),
+        );
+        expect(error).toBeInstanceOf(McpJwtVerificationError);
+        expect(error.reason).toBe("expired");
       }),
     );
     it.effect(`${kind} rejects a non-string organization claim`, () =>

apps/cloud/src/observability/observability.test.ts

@@ -409,3 +409,51 @@ describe("Durable Object platform reset noise", () => {
     expect(options.beforeSend(event)).toBeNull();
   });
 });
+
+describe("Sentry privacy boundary", () => {
+  it("strips secrets from auto-captured errors while retaining diagnostic locations", () => {
+    const secret = "SYNTHETIC_PRIVATE_MARKER";
+    const sent = cloudSentryOptions({
+      SENTRY_DSN: "https://public@example.invalid/1",
+    } as Env).beforeSend({
+      type: undefined,
+      event_id: "safe-event-id",
+      message: secret,
+      user: { email: secret },
+      request: {
+        url: `https://example.test/?token=${secret}`,
+        headers: { authorization: secret },
+        data: secret,
+      },
+      extra: { cause: secret },
+      breadcrumbs: [{ message: secret }],
+      tags: { token: secret, otel_trace_id: traceId },
+      exception: {
+        values: [
+          {
+            type: "TypeError",
+            value: secret,
+            stacktrace: {
+              frames: [
+                {
+                  filename: `/assets/example.js?token=${secret}`,
+                  function: "handleRequest",
+                  lineno: 42,
+                  vars: { secret },
+                },
+              ],
+            },
+          },
+        ],
+      },
+    });
+    expect(JSON.stringify(sent)).not.toContain(secret);
+    expect(sent?.event_id).toBe("safe-event-id");
+    expect(sent?.tags?.otel_trace_id).toBe(traceId);
+    expect(sent?.exception?.values?.[0]?.stacktrace?.frames?.[0]).toMatchObject({
+      filename: "/assets/example.js",
+      function: "handleRequest",
+      lineno: 42,
+    });
+  });
+});

apps/cloud/src/observability/redact-span-urls.test.ts

@@ -216,13 +216,13 @@ describe("UrlRedactingSpanProcessor", () => {
       span.setStatus({ code: SpanStatusCode.ERROR, message });
     });
 
-    // Non-vacuous: the exception event exists and kept its scrubbed URL.
+    // The exception event and classification survive without raw error text.
     const events = JSON.stringify(exported?.events);
     expect(events).toContain("exception");
-    expect(events).toContain("https://api.test/graphql");
+    expect(events).toContain("[REDACTED]");
     expect(events).not.toContain("synthetic-userinfo-secret");
     expect(events).not.toContain("synthetic-key-secret");
-    expect(exported?.status.message).toBe("Transport: fetch failed (GET https://api.test/graphql)");
+    expect(exported?.status.message).toBe("[REDACTED]");
   });
 });
 
@@ -284,3 +284,22 @@ describe("credential canary — no export channel carries the secret", () => {
     },
   );
 });
+
+describe("non-URL secrets in exceptions", () => {
+  it("does not export a provider response or SQL values as error text", () => {
+    const secret = "synthetic-plain-secret";
+    const exported = exportSpanWith({ "http.response.status_code": "500" }, (span) => {
+      span.recordException({
+        name: "ProviderError",
+        message: `Failed query values: ${secret}`,
+        stack: `at provider: ${secret}`,
+      });
+      span.setStatus({ code: SpanStatusCode.ERROR, message: secret });
+    });
+    expect(JSON.stringify({ events: exported?.events, status: exported?.status })).not.toContain(
+      secret,
+    );
+    expect(exported?.status.code).toBe(SpanStatusCode.ERROR);
+    expect(exported?.events[0]?.attributes?.["exception.type"]).toBe("ProviderError");
+  });
+});

apps/cloud/src/request-limits.test.ts

@@ -0,0 +1,63 @@
+import { describe, expect, it } from "@effect/vitest";
+import { limitRequestBody } from "./request-limits";
+
+const streamedRequest = (chunks: readonly string[], headers?: HeadersInit) => {
+  let index = 0;
+  let cancelled = false;
+  const stream = new ReadableStream({
+    pull(controller) {
+      const value = chunks[index++];
+      if (value === undefined) controller.close();
+      else controller.enqueue(new TextEncoder().encode(value));
+    },
+    cancel() {
+      cancelled = true;
+    },
+  });
+  return {
+    request: new Request("https://example.test/api/import?format=json", {
+      method: "POST",
+      headers,
+      body: stream,
+      duplex: "half",
+    } as RequestInit),
+    cancelled: () => cancelled,
+  };
+};
+
+describe("request body boundary", () => {
+  it("preserves body, URL, method and headers at the exact byte limit", async () => {
+    const { request } = streamedRequest(['{"a":', '"é"}'], {
+      "content-type": "application/json",
+      authorization: "Bearer fixture",
+    });
+    const limited = await limitRequestBody(request, 10);
+    expect(limited).toBeInstanceOf(Request);
+    if (!(limited instanceof Request)) return;
+    expect(limited.url).toBe(request.url);
+    expect(limited.method).toBe("POST");
+    expect(limited.headers.get("authorization")).toBe("Bearer fixture");
+    expect(await limited.json()).toEqual({ a: "é" });
+  });
+  for (const headers of [undefined, { "content-length": "1" }]) {
+    it(`rejects oversized streamed bodies with ${headers ? "understated" : "absent"} length`, async () => {
+      const source = streamedRequest(["123", "456", "789", "more"], headers);
+      const response = await limitRequestBody(source.request, 5);
+      expect(response).toBeInstanceOf(Response);
+      if (!(response instanceof Response)) return;
+      expect(response.status).toBe(413);
+      expect(await response.json()).toEqual({ error: "Request body too large" });
+      expect(source.cancelled()).toBe(true);
+    });
+  }
+  it("rejects an oversized declared length before reading", async () => {
+    const source = streamedRequest(["body"], { "content-length": "100" });
+    const response = await limitRequestBody(source.request, 5);
+    expect(response instanceof Response && response.status).toBe(413);
+    expect(source.cancelled()).toBe(true);
+  });
+  it("passes bodyless requests through", async () => {
+    const request = new Request("https://example.test/mcp");
+    expect(await limitRequestBody(request, 5)).toBe(request);
+  });
+});

e2e/cloud/request-body-limits.test.ts

@@ -0,0 +1,27 @@
+import { expect } from "@effect/vitest";
+import { Effect } from "effect";
+import { scenario } from "../src/scenario";
+import { Target } from "../src/services";
+
+scenario(
+  "Request limits · API and MCP reject oversized bodies before parsing",
+  { timeout: 120_000 },
+  Effect.gen(function* () {
+    const target = yield* Target;
+    for (const path of ["/api/integrations", "/mcp"]) {
+      const response = yield* Effect.promise(() =>
+        fetch(new URL(path, target.baseUrl), {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: "x".repeat(32 * 1024 * 1024 + 1),
+        }),
+      );
+      expect(response.status).toBe(413);
+      expect(yield* Effect.promise(() => response.json())).toEqual({
+        error: "Request body too large",
+      });
+    }
+    const health = yield* Effect.promise(() => fetch(new URL("/api/account/me", target.baseUrl)));
+    expect(health.status).toBe(401);
+  }),
+);

packages/plugins/graphql/src/sdk/introspect-body-limit.test.ts

@@ -0,0 +1,34 @@
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Layer } from "effect";
+import { HttpClient, HttpClientResponse } from "effect/unstable/http";
+import { introspect } from "./introspect";
+
+describe("GraphQL introspection body limit", () => {
+  for (const status of [200, 500]) {
+    it.effect(`cancels an oversized streamed ${status} response before parsing`, () =>
+      Effect.gen(function* () {
+        let cancelled = false;
+        const response = new Response(
+          new ReadableStream({
+            pull(controller) {
+              controller.enqueue(new Uint8Array(1024 * 1024));
+            },
+            cancel() {
+              cancelled = true;
+            },
+          }),
+          { status, headers: { "content-length": "1" } },
+        );
+        const client = HttpClient.make((request) =>
+          Effect.succeed(HttpClientResponse.fromWeb(request, response)),
+        );
+        const error = yield* introspect("https://example.test/graphql").pipe(
+          Effect.provide(Layer.succeed(HttpClient.HttpClient)(client)),
+          Effect.flip,
+        );
+        expect(error).toHaveProperty("reason", "response-too-large");
+        expect(cancelled).toBe(true);
+      }),
+    );
+  }
+});

packages/plugins/graphql/src/sdk/introspect-credential-logging.test.ts

@@ -31,7 +31,8 @@ const ENDPOINT = "https://graph.example.test/graphql";
  *  live `message` getter, which is the exact path the leak took. */
 const capturingLogger = (sink: Array<string>) =>
   Logger.make<unknown, void>((options) => {
-    sink.push(String(options.message));
+    // Preserve structured log fields so the secret check covers them too.
+    sink.push(JSON.stringify(options.message));
     sink.push(Cause.pretty(options.cause));
   });
 

packages/plugins/openapi/src/sdk/parse.test.ts

@@ -155,6 +155,29 @@ describe("OpenAPI fetchSpecText", () => {
     }),
   );
 
+  it.effect("bounds a streamed response even when Content-Length understates it", () =>
+    Effect.gen(function* () {
+      let cancelled = false;
+      const response = new Response(
+        new ReadableStream({
+          pull(controller) {
+            controller.enqueue(new Uint8Array(1024 * 1024));
+          },
+          cancel() {
+            cancelled = true;
+          },
+        }),
+        { headers: { "content-length": "1" } },
+      );
+      const error = yield* fetchSpecText(specUrl).pipe(
+        Effect.provide(layerWithResponse(response)),
+        Effect.flip,
+      );
+      expect(error).toHaveProperty("message", expect.stringMatching(/too large to parse/));
+      expect(cancelled).toBe(true);
+    }),
+  );
+
   it.effect("fetches a document with an in-range declared length", () =>
     Effect.gen(function* () {
       const specText = yield* fetchSpecText(specUrl).pipe(