fix(security): harden OIDC replay media-type protocol

[seonghobae]

Purpose

Harden both sides of Noema's internal OIDC replay-guard JSON protocol. The Durable Object request boundary and caller response boundary authenticate the exact JSON media type before parsing or replay-state decisions.

Exact identities

• protected/live base: 933471b954512710bb9635f18f45fe8f323adcff
• current restacked head: 2e9475007545a0c760061ab8e30a9050e28d0680
• branch: fix/oidc-replay-content-type-boundary

Security contract

• Durable Object request media type is parsed as the token before parameters and must equal application/json, case-insensitively.
• Misleading media types fail with 415 before claim storage; rejected input cannot consume replay state.
• Caller requires exact JSON media type before parsing the replay response.
• Success is only HTTP 201 with accepted:true; replay is only HTTP 409 with accepted:false; other statuses fail closed.
• Existing expiry bounds, atomic storage, alarms, and replay semantics remain unchanged.

The branch is merged with protected main after #270. Its current four-path diff is limited to src/oidc-replay.ts and focused protocol tests. Application ci, reviewer-ci, protected-base-eligible Security Scan, and fresh review must all succeed on unchanged current head before merge. Historical or pending evidence is non-passing.

No replay-state relaxation, audit waiver, protection bypass, release, or deployment claim.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 769f6e88-5c9f-4998-9d2f-18014794ed90

📥 Commits

Reviewing files that changed from the base of the PR and between 6bc8ed0 and 6621b71.

📒 Files selected for processing (4)

• src/oidc-replay.ts
• test/oidc-replay-media-type.test.ts
• test/oidc-replay-status-contract.test.ts
• test/oidc-replay.test.ts

---

📝 Walkthrough

Walkthrough

OIDC replay guard가 Content-Type을 정규화하고 application/json만 허용한다. 성공 응답은 HTTP 201과 승인 결정이 모두 있어야 한다. 요청 거부, 응답 계약, 상태 저장 동작을 검증하는 테스트를 추가했다.

Changes

OIDC replay 계약

Layer / File(s)	Summary
미디어 타입 정규화 및 요청 검증 src/oidc-replay.ts, test/oidc-replay-media-type.test.ts, test/oidc-replay.test.ts	Content-Type의 매개변수와 대소문자를 정규화한다. application/json은 허용하고 application/problem+json 및 비JSON 미디어 타입은 415로 거부한다. 거부된 요청은 저장소와 알람을 변경하지 않는다.
응답 상태 및 미디어 타입 계약 src/oidc-replay.ts, test/oidc-replay-status-contract.test.ts	Replay guard 응답이 정확히 application/json이고 HTTP 201이며 승인 결정일 때만 성공으로 처리한다. 그 외 응답은 OidcReplayUnavailable 오류로 처리한다.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: 🟡 Moderate · up to 6621b

The PR hardens OIDC replay media-type validation, but the exact head is not merge-ready because required application CI fails on the inherited nanoid dependency vulnerability; merge should wait for the separate remediation and a fresh successful CI run.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 OIDC replay 미디어 타입 프로토콜을 강화하는 변경 사항을 정확하고 간결하게 설명합니다.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/oidc-replay-content-type-boundary

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

Review exact current head 224dbb810141e4dfc78d410add396b806c8b843b against protected base 4573a6f7eaf904e19a6e3198c8cabcfd4be40c40. Verify exact request and response JSON media-type authentication, no replay-state consumption on rejected input, strict HTTP status contract, and unchanged durable replay semantics. Do not transfer conclusions from predecessor heads.

[coderabbitai]

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 27 minutes and 3 seconds before sending another message.

[seonghobae]

@coderabbitai review

Review exact head 2e9475007545a0c760061ab8e30a9050e28d0680 against protected base 933471b954512710bb9635f18f45fe8f323adcff. Verify exact request/response JSON media-type authentication, no replay-state consumption on rejected input, strict 201/409 semantics, and compatibility with #270's verified-before-mint path.

[coderabbitai]

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 10 minutes and 41 seconds before sending another message.