fix(webapp): harden integration request boundaries

Mono-RevId: 758ad3b12bbf52c279507669883135b1c1e441d9

Author: carderne

apps/webapp/app/models/vercelIntegration.server.ts

@@ -27,6 +27,7 @@ import {
 import { EnvironmentVariablesRepository } from "~/v3/environmentVariables/environmentVariablesRepository.server";
 import { isReservedForExternalSync } from "~/v3/environmentVariableRules.server";
 import { boundedIn } from "@trigger.dev/database";
+import { toVercelApiError, type VercelApiError } from "~/v3/vercel/vercelApiError";
 import {
   callVercelWithRecovery,
   wrapVercelCallWithRecovery,
@@ -120,70 +121,7 @@ function extractCreateProjectEnvFailures(response: unknown): string[] {
 // Error handling
 // ---------------------------------------------------------------------------
 
-export type VercelApiError = {
-  message: string;
-  authInvalid: boolean;
-};
-
-const VercelErrorSchema = z.union([
-  z.object({ status: z.number() }),
-  z.object({ response: z.object({ status: z.number() }) }),
-  z.object({ statusCode: z.number() }),
-]);
-
-function extractVercelErrorStatus(error: unknown): number | null {
-  if (error && typeof error === "object" && "status" in error) {
-    const parsed = VercelErrorSchema.safeParse(error);
-    if (parsed.success && "status" in parsed.data) {
-      return parsed.data.status;
-    }
-  }
-
-  if (error && typeof error === "object" && "response" in error) {
-    const parsed = VercelErrorSchema.safeParse(error);
-    if (parsed.success && "response" in parsed.data) {
-      return parsed.data.response.status;
-    }
-  }
-
-  if (error && typeof error === "object" && "statusCode" in error) {
-    const parsed = VercelErrorSchema.safeParse(error);
-    if (parsed.success && "statusCode" in parsed.data) {
-      return parsed.data.statusCode;
-    }
-  }
-
-  if (typeof error === "string") {
-    if (error.includes("401")) return 401;
-    if (error.includes("403")) return 403;
-  }
-
-  return null;
-}
-
-function isVercelAuthError(error: unknown): boolean {
-  const status = extractVercelErrorStatus(error);
-  return status === 401 || status === 403;
-}
-
-function toVercelApiError(error: unknown): VercelApiError {
-  if (isVercelApiErrorShape(error)) return error;
-  return {
-    message: error instanceof Error ? error.message : "Unknown error",
-    authInvalid: isVercelAuthError(error),
-  };
-}
-
-function isVercelApiErrorShape(error: unknown): error is VercelApiError {
-  return (
-    error !== null &&
-    typeof error === "object" &&
-    "message" in error &&
-    "authInvalid" in error &&
-    typeof (error as VercelApiError).message === "string" &&
-    typeof (error as VercelApiError).authInvalid === "boolean"
-  );
-}
+export type { VercelApiError } from "~/v3/vercel/vercelApiError";
 // ---------------------------------------------------------------------------
 // Schemas & token types
 // ---------------------------------------------------------------------------
@@ -597,7 +535,10 @@ export class VercelIntegrationRepository {
       logger.warn("Failed to decrypt Vercel env var", {
         projectId,
         envVarKey: env.key,
-        error: result.error instanceof Error ? result.error.message : String(result.error),
+        error: result.error.message,
+        errorType: result.error.errorType,
+        status: result.error.status,
+        authInvalid: result.error.authInvalid,
       });
       return null;
     }
@@ -784,10 +725,10 @@ export class VercelIntegrationRepository {
                 projectId,
                 envId,
                 envKey,
-                error:
-                  getResult.error instanceof Error
-                    ? getResult.error.message
-                    : String(getResult.error),
+                error: getResult.error.message,
+                errorType: getResult.error.errorType,
+                status: getResult.error.status,
+                authInvalid: getResult.error.authInvalid,
               });
               return null;
             })
@@ -2096,7 +2037,7 @@ export class VercelIntegrationRepository {
         )
           .map(() => ({ authInvalid: false }))
           .orElse((error) => {
-            const isAuthError = isVercelAuthError(error);
+            const isAuthError = toVercelApiError(error).authInvalid;
             logger.error("Failed to uninstall Vercel integration", {
               installationId,
               error: error instanceof Error ? error.message : "Unknown error",

apps/webapp/app/models/vercelSdkRecovery.server.ts

@@ -1,7 +1,8 @@
 import { z } from "zod";
 import { ResultAsync, okAsync, errAsync } from "neverthrow";
 import { logger } from "~/services/logger.server";
-import type { VercelApiError } from "./vercelIntegration.server";
+import { toVercelApiError, type VercelApiError } from "~/v3/vercel/vercelApiError";
+import { vercelErrorLogMetadata } from "~/v3/vercel/vercelErrorLogMetadata";
 
 // ---------------------------------------------------------------------------
 // Recovery utilities for Vercel SDK validation errors
@@ -67,8 +68,7 @@ function recoverFromVercelSdkError<T>(
 
   logger.warn("Recovered data from Vercel SDK validation error", {
     context: options?.context,
-    errorMessage: error instanceof Error ? error.message : String(error),
-    errorType: error?.constructor?.name,
+    ...vercelErrorLogMetadata(error),
   });
 
   return result.data;
@@ -80,17 +80,26 @@ function recoverFromVercelSdkError<T>(
  * On success: returns the SDK result as-is.
  * On error: attempts recovery via rawValue + schema validation (validation errors only).
  */
+export type VercelSdkCallError = VercelApiError & {
+  errorType: string;
+  status?: number;
+};
+
 export function callVercelWithRecovery<T>(
   sdkCall: Promise<T>,
   schema: z.ZodType<any>,
   options?: { context?: string }
-): ResultAsync<T, unknown> {
+): ResultAsync<T, VercelSdkCallError> {
   return ResultAsync.fromPromise(sdkCall, (error) => error).orElse((error) => {
     const recovered = recoverFromVercelSdkError<T>(error, schema, options);
     if (recovered !== undefined) {
       return okAsync(recovered);
     }
-    return errAsync(error);
+
+    return errAsync({
+      ...toVercelApiError(error),
+      ...vercelErrorLogMetadata(error),
+    });
   });
 }
 
@@ -109,8 +118,13 @@ export function wrapVercelCallWithRecovery<T>(
 ): ResultAsync<T, VercelApiError> {
   return callVercelWithRecovery(promise, schema, { context: message }).mapErr((error) => {
     const apiError = toError(error);
-    logger.error(message, { ...context, error, authInvalid: apiError.authInvalid });
-    return apiError;
+    logger.error(message, {
+      ...context,
+      errorType: error.errorType,
+      ...(error.status === undefined ? {} : { status: error.status }),
+      authInvalid: apiError.authInvalid,
+    });
+    return { message, authInvalid: apiError.authInvalid };
   });
 }
 

apps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.github.tsx

@@ -58,6 +58,7 @@ import {
 import { resolveOrgIdFromSlug } from "~/models/organization.server";
 import { findProjectBySlug } from "~/models/project.server";
 import { findEnvironmentBySlug } from "~/models/runtimeEnvironment.server";
+import { env } from "~/env.server";
 import { GitHubSettingsPresenter } from "~/presenters/v3/GitHubSettingsPresenter.server";
 import { logger } from "~/services/logger.server";
 import { triggerInitialDeployment } from "~/services/platform.v3.server";
@@ -73,6 +74,7 @@ import {
   v3ProjectSettingsIntegrationsPath,
 } from "~/utils/pathBuilder";
 import { type BranchTrackingConfig } from "~/v3/github";
+import { sanitizeGitHubSettingsRedirect } from "~/v3/github/githubSettingsRedirect.server";
 
 // ============================================================================
 // Types
@@ -238,10 +240,13 @@ export const action = dashboardAction(
 
     const { projectId, organizationId } = membershipResultOrFail.value;
     const { action: actionType } = submission.value;
+    const redirectUrl =
+      sanitizeGitHubSettingsRedirect(submission.value.redirectUrl, env.APP_ORIGIN) ??
+      v3ProjectSettingsIntegrationsPath({ slug: organizationSlug }, project, environment);
 
     // Handle connect-repo action
     if (actionType === "connect-repo") {
-      const { repositoryId, installationId, redirectUrl } = submission.value;
+      const { repositoryId, installationId } = submission.value;
 
       const resultOrFail = await projectSettingsService.connectGitHubRepo(
         projectId,
@@ -306,8 +311,6 @@ export const action = dashboardAction(
 
     // Handle disconnect-repo action
     if (actionType === "disconnect-repo") {
-      const { redirectUrl } = submission.value;
-
       const resultOrFail = await projectSettingsService.disconnectGitHubRepo(projectId);
 
       if (resultOrFail.isOk()) {
@@ -330,8 +333,7 @@ export const action = dashboardAction(
 
     // Handle update-git-settings action
     if (actionType === "update-git-settings") {
-      const { productionBranch, stagingBranch, previewDeploymentsEnabled, redirectUrl } =
-        submission.value;
+      const { productionBranch, stagingBranch, previewDeploymentsEnabled } = submission.value;
 
       const resultOrFail = await projectSettingsService.updateGitSettings(
         projectId,

apps/webapp/app/routes/vercel.configure.tsx

@@ -13,7 +13,7 @@ const SearchParamsSchema = z.object({
  * Endpoint to handle Vercel integration configuration request coming from marketplace
  */
 export const loader = async ({ request }: LoaderFunctionArgs) => {
-  await requireUserId(request);
+  const userId = await requireUserId(request);
   const url = new URL(request.url);
   const searchParams = Object.fromEntries(url.searchParams);
 
@@ -28,8 +28,13 @@ export const loader = async ({ request }: LoaderFunctionArgs) => {
         path: ["installationId"],
         equals: configurationId,
       },
+      organization: {
+        members: {
+          some: { userId },
+        },
+      },
     },
-    include: {
+    select: {
       organization: {
         select: {
           slug: true,

apps/webapp/app/v3/github/githubSettingsRedirect.server.ts

@@ -0,0 +1,48 @@
+import { sanitizeRedirectPath } from "~/utils";
+
+function isVercelHostname(hostname: string): boolean {
+  return hostname === "vercel.com" || hostname.endsWith(".vercel.com");
+}
+
+export function sanitizeGitHubSettingsRedirect(
+  redirectUrl: string | undefined,
+  applicationOrigin: string
+): string | undefined {
+  if (!redirectUrl) {
+    return undefined;
+  }
+
+  if (redirectUrl.startsWith("/")) {
+    const sanitized = sanitizeRedirectPath(redirectUrl, "");
+    return sanitized || undefined;
+  }
+
+  let destination: URL;
+  let trustedOrigin: string;
+  try {
+    destination = new URL(redirectUrl);
+    trustedOrigin = new URL(applicationOrigin).origin;
+  } catch {
+    return undefined;
+  }
+
+  if (destination.username || destination.password) {
+    return undefined;
+  }
+
+  if (destination.origin === trustedOrigin) {
+    const relativeUrl = `${destination.pathname}${destination.search}${destination.hash}`;
+    const sanitized = sanitizeRedirectPath(relativeUrl, "");
+    return sanitized || undefined;
+  }
+
+  if (
+    destination.protocol === "https:" &&
+    !destination.port &&
+    isVercelHostname(destination.hostname.toLowerCase())
+  ) {
+    return destination.toString();
+  }
+
+  return undefined;
+}

apps/webapp/app/v3/vercel/vercelApiError.ts

@@ -0,0 +1,33 @@
+import { vercelErrorLogMetadata } from "./vercelErrorLogMetadata";
+
+export const VERCEL_API_ERROR_MESSAGE = "Vercel API request failed";
+
+export type VercelApiError = {
+  message: string;
+  authInvalid: boolean;
+};
+
+function isVercelApiError(error: unknown): error is VercelApiError {
+  return (
+    error !== null &&
+    typeof error === "object" &&
+    "message" in error &&
+    "authInvalid" in error &&
+    typeof (error as VercelApiError).message === "string" &&
+    typeof (error as VercelApiError).authInvalid === "boolean"
+  );
+}
+
+export function toVercelApiError(error: unknown): VercelApiError {
+  const status = vercelErrorLogMetadata(error).status;
+  const authInvalid = isVercelApiError(error)
+    ? error.authInvalid
+    : status === 401 ||
+      status === 403 ||
+      (typeof error === "string" && (error.includes("401") || error.includes("403")));
+
+  return {
+    message: VERCEL_API_ERROR_MESSAGE,
+    authInvalid,
+  };
+}

apps/webapp/app/v3/vercel/vercelErrorLogMetadata.ts

@@ -0,0 +1,60 @@
+const SAFE_VERCEL_ERROR_NAMES = new Set([
+  "BadRequest",
+  "ConnectionError",
+  "Error",
+  "Forbidden",
+  "HTTPClientError",
+  "HttpApiDecodeError",
+  "InternalServerError",
+  "InvalidRequestError",
+  "NotAuthorizedForScope",
+  "NotFound",
+  "RequestAbortedError",
+  "RequestTimeoutError",
+  "ResponseValidationError",
+  "SDKError",
+  "SDKValidationError",
+  "TooManyRequests",
+  "Unauthorized",
+  "UnexpectedClientError",
+  "VercelError",
+]);
+
+function safeErrorName(error: unknown): string {
+  if (!(error instanceof Error)) return "UnknownError";
+
+  const candidates = [error.constructor.name, error.name];
+  return (
+    candidates.find((name) => name !== "Error" && SAFE_VERCEL_ERROR_NAMES.has(name)) ?? "Error"
+  );
+}
+
+function validHttpStatus(value: unknown): number | undefined {
+  return typeof value === "number" && Number.isInteger(value) && value >= 100 && value <= 599
+    ? value
+    : undefined;
+}
+
+export function vercelErrorLogMetadata(error: unknown): {
+  errorType: string;
+  status?: number;
+} {
+  if (!error || typeof error !== "object") {
+    return { errorType: "UnknownError" };
+  }
+
+  const candidate = error as {
+    status?: unknown;
+    statusCode?: unknown;
+    response?: { status?: unknown };
+  };
+
+  const status =
+    validHttpStatus(candidate.statusCode) ??
+    validHttpStatus(candidate.status) ??
+    validHttpStatus(candidate.response?.status);
+
+  return status === undefined
+    ? { errorType: safeErrorName(error) }
+    : { errorType: safeErrorName(error), status };
+}