fix(oci): tighten request lifecycle

Author: Bill Leoutsakos

apps/sim/lib/internal/oci/client.server.test.ts

@@ -201,7 +201,15 @@ describe('credential-bound OCI client', () => {
   })
 
   it('loads only an exact credential/workspace/type/provider row before decryption', async () => {
-    await createPreparedClient()
+    const { client, endpoint } = await createPreparedClient()
+
+    await client.request({
+      endpoint,
+      method: 'GET',
+      encodedPath: '/v1/test',
+      timeoutMs: 10_000,
+      maxResponseBytes: 1024,
+    })
 
     expect(mocks.predicates).toEqual([
       { field: 'credential.id', value: 'credential-authoritative' },
@@ -490,6 +498,28 @@ describe('credential-bound OCI client', () => {
     expect(mocks.secureFetch).not.toHaveBeenCalled()
   })
 
+  it.each(['DELETE', 'POST', 'PUT', 'PATCH'] as const)(
+    'rejects caller-asserted safe retries for %s before signing or transport',
+    async (method) => {
+      const { client, endpoint } = await createPreparedClient()
+      const bodyFields =
+        method === 'DELETE' ? {} : { body: new Uint8Array(), contentType: 'text/plain' }
+
+      await expect(
+        client.request({
+          endpoint,
+          method,
+          encodedPath: '/v1/test',
+          ...bodyFields,
+          retry: { kind: 'safe', maxAttempts: 2 },
+          timeoutMs: 10_000,
+          maxResponseBytes: 1024,
+        } as unknown as OciRequest)
+      ).rejects.toMatchObject({ code: 'invalid_request' })
+      expect(mocks.secureFetch).not.toHaveBeenCalled()
+    }
+  )
+
   it('does not retry unless the operation opts in', async () => {
     mocks.secureFetch.mockResolvedValue(
       secureResponse({ status: 503, body: '{"message":"secret"}' })
@@ -508,12 +538,15 @@ describe('credential-bound OCI client', () => {
   })
 
   it('re-signs every retry while preserving exact bytes and retry token', async () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(new Date('2026-09-03T19:00:00.000Z'))
+    mocks.backoff.mockReturnValue(1000)
     mocks.secureFetch
       .mockResolvedValueOnce(secureResponse({ status: 503, body: '{"code":"Busy"}' }))
       .mockResolvedValueOnce(secureResponse({ status: 200, body: 'ok' }))
     const { client, endpoint } = await createPreparedClient()
     const body = new Uint8Array([9, 8, 7])
-    await client.request({
+    const pending = client.request({
       endpoint,
       method: 'PUT',
       encodedPath: '/v1/test',
@@ -523,6 +556,8 @@ describe('credential-bound OCI client', () => {
       timeoutMs: 10_000,
       maxResponseBytes: 1024,
     })
+    await vi.advanceTimersByTimeAsync(1000)
+    await pending
 
     const first = mocks.secureFetch.mock.calls[0][2]
     const second = mocks.secureFetch.mock.calls[1][2]
@@ -533,6 +568,31 @@ describe('credential-bound OCI client', () => {
     expect(first.headers.authorization).not.toBe(second.headers.authorization)
   })
 
+  it('never manufactures future signing dates under rapid request volume', async () => {
+    vi.useFakeTimers()
+    const now = new Date('2026-09-03T19:00:00.000Z')
+    vi.setSystemTime(now)
+    mocks.secureFetch.mockImplementation(async () => secureResponse({}))
+    const { client, endpoint } = await createPreparedClient()
+
+    await Promise.all(
+      Array.from({ length: 305 }, () =>
+        client.request({
+          endpoint,
+          method: 'GET',
+          encodedPath: '/v1/test',
+          timeoutMs: 10_000,
+          maxResponseBytes: 1024,
+        })
+      )
+    )
+
+    const signingDates = mocks.secureFetch.mock.calls.map(
+      (call) => (call[2] as { headers: Record<string, string> }).headers['x-date']
+    )
+    expect(new Set(signingDates)).toEqual(new Set([now.toUTCString()]))
+  })
+
   it('retries only the exact internal IncorrectState 409 classification', async () => {
     mocks.secureFetch
       .mockResolvedValueOnce(secureResponse({ status: 409, body: '{"code":"IncorrectState"}' }))

apps/sim/lib/internal/oci/client.server.ts

@@ -47,25 +47,50 @@ import { getServiceConfigByServiceId } from '@/lib/oauth/utils'
 
 export type OciRequestMethod = 'GET' | 'HEAD' | 'DELETE' | 'POST' | 'PUT' | 'PATCH'
 
-export type OciRetryPolicy =
-  | { readonly kind: 'safe'; readonly maxAttempts: number }
-  | { readonly kind: 'tokenized'; readonly maxAttempts: number; readonly retryToken: string }
+export interface OciSafeRetryPolicy {
+  readonly kind: 'safe'
+  readonly maxAttempts: number
+}
+
+export interface OciTokenizedRetryPolicy {
+  readonly kind: 'tokenized'
+  readonly maxAttempts: number
+  readonly retryToken: string
+}
 
-export interface OciRequest {
+export type OciRetryPolicy = OciSafeRetryPolicy | OciTokenizedRetryPolicy
+
+interface OciRequestBase {
   readonly endpoint: OciPreparedEndpoint
-  readonly method: OciRequestMethod
   readonly encodedPath: string
   readonly queryPairs?: readonly (readonly [string, string])[]
   readonly headers?: Readonly<Record<string, string>>
-  readonly body?: Uint8Array
-  readonly contentType?: string
   readonly timeoutMs: number
   readonly maxResponseBytes: number
   readonly responseHeaders?: readonly string[]
-  readonly retry?: OciRetryPolicy
   readonly signal?: AbortSignal
 }
 
+export type OciRequest =
+  | (OciRequestBase & {
+      readonly method: 'GET' | 'HEAD'
+      readonly body?: never
+      readonly contentType?: never
+      readonly retry?: OciRetryPolicy
+    })
+  | (OciRequestBase & {
+      readonly method: 'DELETE'
+      readonly body?: never
+      readonly contentType?: never
+      readonly retry?: OciTokenizedRetryPolicy
+    })
+  | (OciRequestBase & {
+      readonly method: 'POST' | 'PUT' | 'PATCH'
+      readonly body: Uint8Array
+      readonly contentType: string
+      readonly retry?: OciTokenizedRetryPolicy
+    })
+
 declare const authenticatedOciResponseBrand: unique symbol
 
 export interface OciAuthenticatedResponse {
@@ -121,6 +146,7 @@ interface SignedOciRequest {
 }
 
 const BODY_METHODS: ReadonlySet<OciRequestMethod> = new Set(['POST', 'PUT', 'PATCH'])
+const SAFE_RETRY_METHODS: ReadonlySet<OciRequestMethod> = new Set(['GET', 'HEAD'])
 const REQUEST_METHODS: ReadonlySet<string> = new Set([
   'GET',
   'HEAD',
@@ -470,6 +496,7 @@ function validateRequest(request: OciRequest): {
       typeof request.retry !== 'object' ||
       Array.isArray(request.retry) ||
       (request.retry.kind !== 'safe' && request.retry.kind !== 'tokenized') ||
+      (request.retry.kind === 'safe' && !SAFE_RETRY_METHODS.has(request.method)) ||
       Object.keys(request.retry).some(
         (key) =>
           key !== 'kind' &&
@@ -715,17 +742,19 @@ export async function createOciClient(params: CreateOciClientParams): Promise<Oc
   }
 
   let materialPromise: Promise<OciCredentialMaterial> | undefined
-  let lastSigningTime = 0
+  let credentialMaterial: OciCredentialMaterial | undefined
   const preparedEndpoints = new WeakSet<object>()
   const endpointPolicies = new WeakMap<object, OciEndpointPolicy>()
   const responseSnapshots = new WeakMap<object, BoundResponseSnapshot>()
 
-  const getMaterial = () => {
+  const getMaterial = async () => {
     materialPromise ??= loadCredentialMaterial({
       credentialId: params.credentialId,
       workspaceId: params.workspaceId,
     })
-    return materialPromise
+    const material = await materialPromise
+    credentialMaterial = material
+    return material
   }
   const assertPolicyOwner = (policy: OciEndpointPolicy) => {
     if (policy.serviceId !== params.serviceId) throw new OciClientError('invalid_endpoint')
@@ -734,12 +763,6 @@ export async function createOciClient(params: CreateOciClientParams): Promise<Oc
     const material = await getMaterial()
     return resolveEffectiveOciRegion(material.region, params.region)
   }
-  const nextSigningDate = () => {
-    const now = Math.max(Date.now(), lastSigningTime + 1000)
-    lastSigningTime = now
-    return new Date(now)
-  }
-
   const client: OciClient = {
     async prepareStaticEndpoint(policy) {
       assertPolicyOwner(policy)
@@ -781,11 +804,12 @@ export async function createOciClient(params: CreateOciClientParams): Promise<Oc
       }
       const endpointPolicy = endpointPolicies.get(request.endpoint)
       if (!endpointPolicy) throw new OciClientError('invalid_endpoint')
+      const material = credentialMaterial
+      if (!material) throw new OciClientError('invalid_endpoint')
       const validated = validateRequest(request)
       const url = buildRequestUrl(request.endpoint, request.encodedPath, validated.queryPairs)
       const deadline = createDeadline(request.timeoutMs, request.signal)
       try {
-        const material = await getMaterial()
         for (let attempt = 1; attempt <= validated.attempts; attempt += 1) {
           if (deadline.signal.aborted) {
             throw new OciClientError(deadline.expired() ? 'deadline_exceeded' : 'aborted')
@@ -802,7 +826,7 @@ export async function createOciClient(params: CreateOciClientParams): Promise<Oc
             },
             body: validated.body,
             contentType: request.contentType,
-            signingDate: nextSigningDate(),
+            signingDate: new Date(),
           })
 
           let response: SecureFetchResponse

apps/sim/lib/internal/oci/endpoints.ts

@@ -57,8 +57,10 @@ export type OciEndpointPolicy = OciStaticEndpointPolicy | OciDiscoveredEndpointP
 /**
  * Realm and region snapshot copied from `oci-common@2.140.0` files
  * `lib/realm.js` and `lib/region.js`, and verified byte-for-byte against the
- * same registry files in `2.140.1`. Unknown runtime metadata is deliberately
- * excluded so credentials cannot weaken endpoint trust with local OCI config.
+ * same registry files in `2.140.1`. When Oracle adds regions or realms, update
+ * both maps from the official SDK in one reviewed change and keep the exhaustive
+ * registry test passing. Unknown runtime metadata is deliberately excluded so
+ * credentials cannot weaken endpoint trust with local OCI config.
  */
 const REALM_DOMAINS = {
   oc1: 'oraclecloud.com',