feat(oci): support region-first endpoint policies

Author: Bill Leoutsakos

apps/sim/lib/internal/oci/client.server.test.ts

@@ -773,6 +773,57 @@ describe('credential-bound OCI client', () => {
     expect(mocks.secureFetch).toHaveBeenCalledOnce()
   })
 
+  it('invokes a Functions endpoint discovered through the same client and management policy', async () => {
+    const managementPolicy = createOciStaticEndpointPolicy({
+      serviceId: OCI_SERVICE_ID,
+      serviceName: 'functions',
+      hostnameTemplate: 'regional-oci',
+    })
+    const invocationPolicy = createOciDiscoveredEndpointPolicy({
+      serviceId: OCI_SERVICE_ID,
+      serviceName: 'functions',
+      hostnameTemplate: 'region-first-oci',
+      responsePolicy: managementPolicy,
+      source: { kind: 'json', path: ['invokeEndpoint'] },
+    })
+    const invokeOrigin = 'https://fixture.us-ashburn-1.functions.oci.oraclecloud.com'
+    mocks.secureFetch
+      .mockResolvedValueOnce(
+        secureResponse({ body: JSON.stringify({ invokeEndpoint: invokeOrigin }) })
+      )
+      .mockResolvedValueOnce(secureResponse({ body: 'invoked' }))
+    const { client } = await createPreparedClient()
+    const managementEndpoint = await client.prepareStaticEndpoint(managementPolicy)
+    const response = await client.request({
+      endpoint: managementEndpoint,
+      method: 'GET',
+      encodedPath: '/20181201/functions/synthetic-function',
+      timeoutMs: 10_000,
+      maxResponseBytes: 1024,
+    })
+    const invocationEndpoint = await client.prepareDiscoveredEndpoint(invocationPolicy, response)
+    const body = new TextEncoder().encode('{"message":"hello"}')
+    const result = await client.request({
+      endpoint: invocationEndpoint,
+      method: 'POST',
+      encodedPath: '/20181201/functions/synthetic-function/actions/invoke',
+      body,
+      contentType: 'application/json',
+      timeoutMs: 10_000,
+      maxResponseBytes: 1024,
+    })
+    expect(mocks.secureFetch).toHaveBeenCalledTimes(2)
+    expect(mocks.secureFetch.mock.calls[0][0]).toBe(
+      'https://functions.us-ashburn-1.oci.oraclecloud.com/20181201/functions/synthetic-function'
+    )
+    expect(mocks.secureFetch.mock.calls[1][0]).toBe(
+      `${invokeOrigin}/20181201/functions/synthetic-function/actions/invoke`
+    )
+    expect(mocks.secureFetch.mock.calls[1][2]).toMatchObject({ method: 'POST', body })
+    expect(authorizationFromLastRequest()).toMatch(/^Signature version="1"/)
+    expect(new TextDecoder().decode(result.body)).toBe('invoked')
+  })
+
   it('rejects fabricated and cross-client authenticated discovery responses', async () => {
     const policy = createOciDiscoveredEndpointPolicy({
       serviceId: OCI_SERVICE_ID,

apps/sim/lib/internal/oci/endpoints.test.ts

@@ -41,6 +41,9 @@ describe('OCI region registry', () => {
       expect(regionalOciHostname('objectstorage', region, 'regional')).toBe(
         `objectstorage.${id}.${region.realm.domain}`
       )
+      expect(regionalOciHostname('functions', region, 'region-first-oci')).toBe(
+        `${id}.functions.oci.${region.realm.domain}`
+      )
     }
   })
 
@@ -60,6 +63,79 @@ describe('OCI region registry', () => {
 
 describe('OCI endpoint policies', () => {
   const region = getOciRegion('us-ashburn-1')
+  const functionsManagementPolicy = createOciStaticEndpointPolicy({
+    serviceId: OCI_SERVICE_ID,
+    serviceName: 'functions',
+    hostnameTemplate: 'regional-oci',
+  })
+  const functionsInvocationPolicy = createOciDiscoveredEndpointPolicy({
+    serviceId: OCI_SERVICE_ID,
+    serviceName: 'functions',
+    hostnameTemplate: 'region-first-oci',
+    responsePolicy: functionsManagementPolicy,
+    source: { kind: 'json', path: ['invokeEndpoint'] },
+  })
+
+  it.each(['us-ashburn-1', 'us-gov-ashburn-1'])(
+    'supports region-first policies and authenticated Functions discovery in %s',
+    (regionId) => {
+      const selectedRegion = getOciRegion(regionId)
+      const hostname = `${regionId}.functions.oci.${selectedRegion.realm.domain}`
+      expect(
+        resolveStaticOciEndpoint(
+          createOciStaticEndpointPolicy({
+            serviceId: OCI_SERVICE_ID,
+            serviceName: 'functions',
+            hostnameTemplate: 'region-first-oci',
+          }),
+          selectedRegion
+        ).origin
+      ).toBe(`https://${hostname}`)
+      expect(
+        resolveDiscoveredOciEndpoint(
+          functionsInvocationPolicy,
+          selectedRegion,
+          `https://resource.${hostname}`
+        )
+      ).toMatchObject({
+        origin: `https://resource.${hostname}`,
+        serviceId: OCI_SERVICE_ID,
+        provenance: 'authenticated-discovery',
+      })
+      expect(Object.isFrozen(functionsInvocationPolicy)).toBe(true)
+      expect(functionsInvocationPolicy.hostnameTemplate).toBe('region-first-oci')
+      expect(functionsInvocationPolicy.allowRegionalHost).toBe(false)
+      expect(
+        resolveDiscoveredOciEndpoint(
+          createOciDiscoveredEndpointPolicy({
+            ...functionsInvocationPolicy,
+            allowRegionalHost: true,
+          }),
+          selectedRegion,
+          `https://${hostname}`
+        ).hostname
+      ).toBe(hostname)
+    }
+  )
+
+  it.each([
+    'https://resource.functions.us-ashburn-1.oci.oraclecloud.com',
+    'https://resource.eu-frankfurt-1.functions.oci.oraclecloud.com',
+    'https://resource.us-ashburn-1.functions.oci.oraclegovcloud.com',
+    'https://resource.us-ashburn-1.database.oci.oraclecloud.com',
+    'https://resource.us-ashburn-1.functions.oci.oraclecloud.com.attacker.example',
+    'https://resourceus-ashburn-1.functions.oci.oraclecloud.com',
+    'https://us-ashburn-1.functions.oci.oraclecloud.com',
+    'http://resource.us-ashburn-1.functions.oci.oraclecloud.com',
+    'https://resource.us-ashburn-1.functions.oci.oraclecloud.com:8443',
+    'https://user:password@resource.us-ashburn-1.functions.oci.oraclecloud.com',
+    'https://resource.us-ashburn-1.functions.oci.oraclecloud.com/path',
+    'https://resource.us-ashburn-1.functions.oci.oraclecloud.com?query=1',
+    'https://resource.us-ashburn-1.functions.oci.oraclecloud.com#fragment',
+    'https://127.0.0.1',
+  ])('rejects invalid Functions invocation origins: %s', (origin) => {
+    expect(() => resolveDiscoveredOciEndpoint(functionsInvocationPolicy, region, origin)).toThrow()
+  })
 
   it('freezes declarative policies and derives exact static origins', () => {
     expect(Object.isFrozen(staticPolicy)).toBe(true)

apps/sim/lib/internal/oci/endpoints.ts

@@ -2,7 +2,7 @@ import { isIpLiteral, unwrapIpv6Brackets } from '@sim/security/ssrf'
 import type { OAuthService } from '@/lib/oauth/types'
 
 export type OciDestinationProvenance = 'static' | 'authenticated-discovery'
-export type OciHostnameTemplate = 'regional' | 'regional-oci'
+export type OciHostnameTemplate = 'regional' | 'regional-oci' | 'region-first-oci'
 
 export interface OciRealm {
   readonly id: string
@@ -216,7 +216,7 @@ function assertServiceName(value: string): void {
 }
 
 function assertHostnameTemplate(value: OciHostnameTemplate): void {
-  if (value !== 'regional' && value !== 'regional-oci') {
+  if (value !== 'regional' && value !== 'regional-oci' && value !== 'region-first-oci') {
     throw new Error('OCI endpoint policy hostname template is invalid')
   }
 }
@@ -295,7 +295,10 @@ export function regionalOciHostname(
   assertServiceName(serviceName)
   assertHostnameTemplate(hostnameTemplate)
   const ociLabel = hostnameTemplate === 'regional-oci' ? '.oci' : ''
-  const hostname = `${serviceName}.${region.id}${ociLabel}.${region.realm.domain}`
+  const hostname =
+    hostnameTemplate === 'region-first-oci'
+      ? `${region.id}.${serviceName}.oci.${region.realm.domain}`
+      : `${serviceName}.${region.id}${ociLabel}.${region.realm.domain}`
   if (hostname.length > MAX_HOSTNAME_LENGTH) {
     throw new Error('OCI endpoint policy hostname is invalid')
   }