|
| 1 | +import { randomUUID } from 'node:crypto' |
| 2 | +import { db } from '@sim/db' |
| 3 | +import { oauthApplication } from '@sim/db/schema' |
| 4 | +import { createLogger } from '@sim/logger' |
| 5 | +import { secureFetchWithValidation } from '@/lib/core/security/input-validation.server' |
| 6 | + |
| 7 | +const logger = createLogger('cimd') |
| 8 | + |
| 9 | +interface ClientMetadataDocument { |
| 10 | + client_id: string |
| 11 | + client_name: string |
| 12 | + logo_uri?: string |
| 13 | + redirect_uris: string[] |
| 14 | + client_uri?: string |
| 15 | + policy_uri?: string |
| 16 | + tos_uri?: string |
| 17 | + contacts?: string[] |
| 18 | + scope?: string |
| 19 | +} |
| 20 | + |
| 21 | +export function isMetadataUrl(clientId: string): boolean { |
| 22 | + return clientId.startsWith('https://') |
| 23 | +} |
| 24 | + |
| 25 | +async function fetchClientMetadata(url: string): Promise<ClientMetadataDocument> { |
| 26 | + const parsed = new URL(url) |
| 27 | + if (parsed.protocol !== 'https:') { |
| 28 | + throw new Error('CIMD URL must use HTTPS') |
| 29 | + } |
| 30 | + |
| 31 | + const res = await secureFetchWithValidation(url, { |
| 32 | + headers: { Accept: 'application/json' }, |
| 33 | + timeout: 5000, |
| 34 | + }) |
| 35 | + |
| 36 | + if (!res.ok) { |
| 37 | + throw new Error(`CIMD fetch failed: ${res.status} ${res.statusText}`) |
| 38 | + } |
| 39 | + |
| 40 | + const doc = (await res.json()) as ClientMetadataDocument |
| 41 | + |
| 42 | + if (doc.client_id !== url) { |
| 43 | + throw new Error(`CIMD client_id mismatch: document has "${doc.client_id}", expected "${url}"`) |
| 44 | + } |
| 45 | + |
| 46 | + if (!Array.isArray(doc.redirect_uris) || doc.redirect_uris.length === 0) { |
| 47 | + throw new Error('CIMD document must contain at least one redirect_uri') |
| 48 | + } |
| 49 | + |
| 50 | + if (!doc.client_name || typeof doc.client_name !== 'string') { |
| 51 | + throw new Error('CIMD document must contain a client_name') |
| 52 | + } |
| 53 | + |
| 54 | + return doc |
| 55 | +} |
| 56 | + |
| 57 | +const CACHE_TTL_MS = 5 * 60 * 1000 |
| 58 | +const NEGATIVE_CACHE_TTL_MS = 60 * 1000 |
| 59 | +const cache = new Map<string, { doc: ClientMetadataDocument; expiresAt: number }>() |
| 60 | +const failureCache = new Map<string, { error: string; expiresAt: number }>() |
| 61 | +const inflight = new Map<string, Promise<ClientMetadataDocument>>() |
| 62 | + |
| 63 | +export async function resolveClientMetadata(url: string): Promise<ClientMetadataDocument> { |
| 64 | + const cached = cache.get(url) |
| 65 | + if (cached && Date.now() < cached.expiresAt) { |
| 66 | + return cached.doc |
| 67 | + } |
| 68 | + |
| 69 | + const failed = failureCache.get(url) |
| 70 | + if (failed && Date.now() < failed.expiresAt) { |
| 71 | + throw new Error(failed.error) |
| 72 | + } |
| 73 | + |
| 74 | + const pending = inflight.get(url) |
| 75 | + if (pending) { |
| 76 | + return pending |
| 77 | + } |
| 78 | + |
| 79 | + const promise = fetchClientMetadata(url) |
| 80 | + .then((doc) => { |
| 81 | + cache.set(url, { doc, expiresAt: Date.now() + CACHE_TTL_MS }) |
| 82 | + failureCache.delete(url) |
| 83 | + return doc |
| 84 | + }) |
| 85 | + .catch((err) => { |
| 86 | + const message = err instanceof Error ? err.message : String(err) |
| 87 | + failureCache.set(url, { error: message, expiresAt: Date.now() + NEGATIVE_CACHE_TTL_MS }) |
| 88 | + throw err |
| 89 | + }) |
| 90 | + .finally(() => { |
| 91 | + inflight.delete(url) |
| 92 | + }) |
| 93 | + |
| 94 | + inflight.set(url, promise) |
| 95 | + return promise |
| 96 | +} |
| 97 | + |
| 98 | +export async function upsertCimdClient(metadata: ClientMetadataDocument): Promise<void> { |
| 99 | + const now = new Date() |
| 100 | + const redirectURLs = metadata.redirect_uris.join(',') |
| 101 | + |
| 102 | + await db |
| 103 | + .insert(oauthApplication) |
| 104 | + .values({ |
| 105 | + id: randomUUID(), |
| 106 | + clientId: metadata.client_id, |
| 107 | + name: metadata.client_name, |
| 108 | + icon: metadata.logo_uri ?? null, |
| 109 | + redirectURLs, |
| 110 | + type: 'public', |
| 111 | + clientSecret: null, |
| 112 | + createdAt: now, |
| 113 | + updatedAt: now, |
| 114 | + }) |
| 115 | + .onConflictDoUpdate({ |
| 116 | + target: oauthApplication.clientId, |
| 117 | + set: { |
| 118 | + name: metadata.client_name, |
| 119 | + icon: metadata.logo_uri ?? null, |
| 120 | + redirectURLs, |
| 121 | + type: 'public', |
| 122 | + clientSecret: null, |
| 123 | + updatedAt: now, |
| 124 | + }, |
| 125 | + }) |
| 126 | + |
| 127 | + logger.info('Upserted CIMD client', { |
| 128 | + clientId: metadata.client_id, |
| 129 | + name: metadata.client_name, |
| 130 | + }) |
| 131 | +} |
0 commit comments