fix(security): claim verified OIDC replay before token mint

[seonghobae]

Purpose

Close the replay window in Noema's credential-exchange path. A cryptographically valid GitHub Actions OIDC credential must be atomically claimed as single-use after workflow and target-repository authorization but before any GitHub App installation token is minted.

Exact identities

• protected/live base: 4573a6f7eaf904e19a6e3198c8cabcfd4be40c40
• original RED head: 3eab25763687e89a88c47fbe84fcbd3a96fb9fa5
• current GREEN head: 0e7bd32d0fbc7e91972d5feb73bd8fe73799b16a
• branch: fix/replay-before-token-mint-current-main

Security ordering

distributed rate limit → bounded exact-workflow prefilter → cryptographic OIDC verification → target-repository authorization → atomic distributed replay claim → GitHub App installation-token mint → response

The implementation:

• carries verified jti and exp claims through the base exchange handler;
• claims the distributed replay guard immediately before createInstallationToken();
• returns 401 ERR_AUTH_REPLAY for an already-consumed verified credential without calling the installation-token endpoint;
• returns 503 ERR_AUTH_REPLAY when the replay binding, bounded verified claims, or replay service is unavailable;
• emits x-oidc-replay-protection: verified-before-mint internally and normalizes it to single-use at the production wrapper;
• prevents the outer wrapper from claiming a credential a second time after the base handler proves pre-mint enforcement;
• retains the existing unverified-claim workflow prefilter only as an early deny path; authorization still depends on full RS256 verification in the base handler;
• adds real RS256-signed fixtures proving replay rejection makes zero GitHub installation-token POSTs and accepted first use orders the replay claim before token mint.

Restack and verification boundary

The branch was merged with protected main after #272, #266, and #275. The merge tree overlays only src/index.ts, src/worker.ts, test/replay-before-token-mint.test.ts, and test/worker-defensive-replay.test.ts on current protected-main bytes.

All predecessor results are historical only. Application ci, reviewer-ci, protected-base-eligible Security Scan, and fresh review must complete successfully on unchanged current head 0e7bd32d0fbc7e91972d5feb73bd8fe73799b16a before merge. Pending, queued, skipped, absent, neutral, failed, cancelled, stale, predecessor, status-only, model-only, or rate-limited evidence is non-passing.

No unverified replay-state consumption, audit waiver, protection bypass, secret invention, version bump, release, or deployment claim.

Related: #81, #83.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 76 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b4ee9b0f-ee9c-4c0e-abff-9721f2bf15d9

📥 Commits

Reviewing files that changed from the base of the PR and between 4573a6f and 0e7bd32.

📒 Files selected for processing (4)

• src/index.ts
• src/worker.ts
• test/replay-before-token-mint.test.ts
• test/worker-defensive-replay.test.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

Review exact current head 0e7bd32d0fbc7e91972d5feb73bd8fe73799b16a against protected base 4573a6f7eaf904e19a6e3198c8cabcfd4be40c40. Verify the cryptographic-verification → authorization → atomic replay claim → installation-token mint ordering, zero mint calls on replay/unavailability, wrapper double-claim avoidance, and fail-closed production behavior. Do not transfer conclusions from predecessor heads.

[coderabbitai]

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 34 minutes and 30 seconds before sending another message.