fix(oci): preserve endpoint and failure invariants

Author: Bill Leoutsakos

apps/sim/app/api/v2/credentials/[credentialId]/route.test.ts

@@ -127,7 +127,7 @@ describe('PATCH /api/v2/credentials/[credentialId]', () => {
     expect(body).not.toContain('MUST_NOT_LEAK_CIPHERTEXT')
   })
 
-  it('forwards a complete OCI rotation tuple and preserves explicit passphrase clearing', async () => {
+  it('forwards a complete OCI rotation tuple with an omitted replacement passphrase', async () => {
     const request = patchRequest({
       tenancyOcid: 'ocid1.tenancy.oc1..tenant',
       userOcid: 'ocid1.user.oc1..replacement',

apps/sim/lib/credentials/oci-api-key-service-account.server.test.ts

@@ -181,6 +181,14 @@ describe('OCI API-key credential setup', () => {
     expect(dependencies.encryptSecret).not.toHaveBeenCalled()
   })
 
+  it('preserves an encryption failure after successful provider verification', async () => {
+    const encryptionFailure = new Error('internal encryption failure')
+    dependencies.encryptSecret.mockRejectedValueOnce(encryptionFailure)
+
+    await expect(verifyAndEncryptOciApiKeyCredential(fields())).rejects.toBe(encryptionFailure)
+    expect(dependencies.verifySetup).toHaveBeenCalledOnce()
+  })
+
   it('forwards cancellation and never encrypts an aborted verification', async () => {
     const controller = new AbortController()
     const reason = new DOMException('canceled', 'AbortError')

apps/sim/lib/credentials/service-account-secret.test.ts

@@ -217,28 +217,44 @@ describe('verifyAndBuildServiceAccountSecret', () => {
     expect(mockVerifyAndEncryptOci).not.toHaveBeenCalled()
   })
 
-  it('classifies OCI verification outages without exposing provider details', async () => {
-    const { OciCredentialVerificationError } = await import(
-      '@/lib/credentials/oci-api-key-service-account.server'
-    )
-    mockVerifyAndEncryptOci.mockRejectedValue(
-      new OciCredentialVerificationError('service_unavailable')
-    )
+  it.each(['service_unavailable', 'invalid_response'] as const)(
+    'classifies OCI %s failures as provider outages without exposing provider details',
+    async (code) => {
+      const { OciCredentialVerificationError } = await import(
+        '@/lib/credentials/oci-api-key-service-account.server'
+      )
+      mockVerifyAndEncryptOci.mockRejectedValue(new OciCredentialVerificationError(code))
 
-    const failure = await verifyAndBuildServiceAccountSecret('oci-api-key-service-account', {
-      tenancyOcid: 'ocid1.tenancy.oc1..tenant',
-      userOcid: 'ocid1.user.oc1..principal',
-      fingerprint: '00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff',
-      privateKey: 'provider-secret-key',
-      region: 'us-ashburn-1',
-    }).catch((error: unknown) => error)
+      const failure = await verifyAndBuildServiceAccountSecret('oci-api-key-service-account', {
+        tenancyOcid: 'ocid1.tenancy.oc1..tenant',
+        userOcid: 'ocid1.user.oc1..principal',
+        fingerprint: '00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff',
+        privateKey: 'provider-secret-key',
+        region: 'us-ashburn-1',
+      }).catch((error: unknown) => error)
 
-    expect(failure).toBeInstanceOf(ServiceAccountSecretError)
-    expect(failure).toMatchObject({
-      message: 'OCI is temporarily unavailable for credential verification',
-      providerErrorCode: 'provider_unavailable',
-    })
-    expect(JSON.stringify(failure)).not.toContain('provider-secret-key')
+      expect(failure).toBeInstanceOf(ServiceAccountSecretError)
+      expect(failure).toMatchObject({
+        message: 'OCI is temporarily unavailable for credential verification',
+        providerErrorCode: 'provider_unavailable',
+      })
+      expect(JSON.stringify(failure)).not.toContain('provider-secret-key')
+    }
+  )
+
+  it('does not misclassify an internal OCI credential failure as rejected credentials', async () => {
+    const internalFailure = new Error('internal encryption failure')
+    mockVerifyAndEncryptOci.mockRejectedValue(internalFailure)
+
+    await expect(
+      verifyAndBuildServiceAccountSecret('oci-api-key-service-account', {
+        tenancyOcid: 'ocid1.tenancy.oc1..tenant',
+        userOcid: 'ocid1.user.oc1..principal',
+        fingerprint: '00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff',
+        privateKey: 'provider-secret-key',
+        region: 'us-ashburn-1',
+      })
+    ).rejects.toBe(internalFailure)
   })
 
   it('rejects an unknown non-empty providerId instead of persisting it as Google', async () => {

apps/sim/lib/credentials/service-account-secret.ts

@@ -259,14 +259,16 @@ async function buildOciApiKeyServiceAccountSecret(
     }
   } catch (error) {
     if (error instanceof OciCredentialVerificationError) {
+      const providerUnavailable =
+        error.code === 'service_unavailable' || error.code === 'invalid_response'
       throw new ServiceAccountSecretError(
-        error.code === 'service_unavailable'
+        providerUnavailable
           ? 'OCI is temporarily unavailable for credential verification'
           : 'OCI rejected the API-key credential',
-        error.code === 'service_unavailable' ? 'provider_unavailable' : 'invalid_credentials'
+        providerUnavailable ? 'provider_unavailable' : 'invalid_credentials'
       )
     }
-    throw new ServiceAccountSecretError('OCI API-key credential is invalid')
+    throw error
   }
 }
 

apps/sim/lib/internal/oci/client.server.test.ts

@@ -583,10 +583,14 @@ describe('credential-bound OCI client', () => {
   })
 
   it('discards provider messages and exposes only safe status and request IDs', async () => {
+    const opaqueProviderSecret = 'opaque-diagnostic-secret-7f3a'
     mocks.secureFetch.mockResolvedValueOnce(
       secureResponse({
         status: 401,
-        body: JSON.stringify({ message: PRIVATE_KEY, nested: { authorization: 'secret' } }),
+        body: JSON.stringify({
+          message: opaqueProviderSecret,
+          nested: { authorization: 'another-opaque-secret' },
+        }),
         headers: { 'opc-request-id': 'request-401' },
       })
     )
@@ -607,7 +611,8 @@ describe('credential-bound OCI client', () => {
       status: 401,
       opcRequestId: 'request-401',
     })
-    expect(JSON.stringify(failure)).not.toContain('BEGIN PRIVATE KEY')
+    expect(JSON.stringify(failure)).not.toContain(opaqueProviderSecret)
+    expect(JSON.stringify(failure)).not.toContain('another-opaque-secret')
     expect(JSON.stringify(failure)).not.toContain('authorization')
   })
 
@@ -785,6 +790,29 @@ describe('credential-bound OCI client', () => {
     expect(cancel).toHaveBeenCalled()
   })
 
+  it('propagates caller abort while reading a failed response body', async () => {
+    const controller = new AbortController()
+    const cancel = vi.fn()
+    mocks.secureFetch.mockResolvedValueOnce({
+      ...secureResponse({ status: 409 }),
+      headers: new Headers(),
+      body: new ReadableStream<Uint8Array>({ cancel }),
+    })
+    const { client, endpoint } = await createPreparedClient()
+    const pending = client.request({
+      endpoint,
+      method: 'GET',
+      encodedPath: '/v1/test',
+      signal: controller.signal,
+      timeoutMs: 10_000,
+      maxResponseBytes: 1024,
+    })
+    await vi.waitFor(() => expect(mocks.secureFetch).toHaveBeenCalledOnce())
+    controller.abort()
+    await expect(pending).rejects.toMatchObject({ code: 'aborted' })
+    expect(cancel).toHaveBeenCalled()
+  })
+
   it('propagates caller abort during retry backoff', async () => {
     vi.useFakeTimers()
     mocks.backoff.mockReturnValue(1000)

apps/sim/lib/internal/oci/client.server.ts

@@ -583,8 +583,9 @@ async function readFailureCode(
     if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return undefined
     const code = (parsed as Record<string, unknown>).code
     return typeof code === 'string' && code.length <= 128 ? code : undefined
-  } catch {
+  } catch (error) {
     await response.body?.cancel().catch(() => {})
+    if (signal.aborted) throw toError(signal.reason ?? error)
     return undefined
   }
 }

apps/sim/lib/internal/oci/endpoints.test.ts

@@ -56,13 +56,21 @@ describe('OCI endpoint policies', () => {
 
   it('freezes declarative policies and derives exact static origins', () => {
     expect(Object.isFrozen(staticPolicy)).toBe(true)
-    expect(resolveStaticOciEndpoint(staticPolicy, region)).toMatchObject({
+    const endpoint = resolveStaticOciEndpoint(staticPolicy, region)
+    expect(endpoint).toMatchObject({
       origin: 'https://identity.us-ashburn-1.oraclecloud.com',
       hostname: 'identity.us-ashburn-1.oraclecloud.com',
       serviceId: OCI_SERVICE_ID,
       serviceName: 'identity',
       provenance: 'static',
     })
+    expect(Object.isFrozen(endpoint)).toBe(true)
+    expect(Object.isFrozen(endpoint.region)).toBe(true)
+    expect(Object.isFrozen(endpoint.region.realm)).toBe(true)
+    expect(Reflect.set(endpoint, 'origin', 'https://attacker.example')).toBe(false)
+    expect(Reflect.set(endpoint.region, 'id', 'attacker-region-1')).toBe(false)
+    expect(endpoint.origin).toBe('https://identity.us-ashburn-1.oraclecloud.com')
+    expect(endpoint.region.id).toBe('us-ashburn-1')
   })
 
   it('accepts discovered resource hosts only beneath the declared service, region, and realm', () => {

apps/sim/lib/internal/oci/endpoints.ts

@@ -182,10 +182,10 @@ export function getOciRegion(regionId: string): OciRegion {
     ? REGION_REALMS[normalized as keyof typeof REGION_REALMS]
     : undefined
   if (!realmId) throw new Error('OCI region is not recognized')
-  return {
+  return Object.freeze({
     id: normalized,
-    realm: { id: realmId, domain: REALM_DOMAINS[realmId] },
-  }
+    realm: Object.freeze({ id: realmId, domain: REALM_DOMAINS[realmId] }),
+  })
 }
 
 export function resolveEffectiveOciRegion(defaultRegion: string, override?: string): OciRegion {
@@ -312,14 +312,14 @@ function validateOciOrigin(params: {
   if (!hostnameMatches) {
     throw new Error('OCI destination hostname is not owned by the requested service')
   }
-  return {
+  return Object.freeze({
     origin: url.origin,
     hostname: url.hostname,
     serviceId: params.policy.serviceId,
     serviceName: params.policy.serviceName,
     region: knownRegion,
     provenance: params.provenance,
-  } as OciPreparedEndpoint
+  }) as OciPreparedEndpoint
 }
 
 /** Resolves a static policy exclusively from its service and validated region. */