Implement endpoint discovery

Author: mateuuszzzzz

src/CONFIG.ts

@@ -145,6 +145,9 @@ export default {
         API_ROOT: qaExpensifyURL ? addTrailingForwardSlash(qaExpensifyURL) : '',
         TEAM_DOMAIN: get(Config, 'QA_CF_TEAM_DOMAIN', ''),
         CLIENT_ID: get(Config, 'QA_CF_OAUTH_CLIENT_ID', ''),
+        // Which Access-protected endpoint the test tool calls to verify auth is a property of the
+        // environment — the dev worker exposes an echo route, another QA host will offer something else
+        CHECK_PATH: get(Config, 'QA_AUTH_CHECK_PATH', '').replace(/^\/+/, ''),
     },
     SENTRY_DSN: get(Config, 'SENTRY_DSN', 'https://7b463fb4d4402d342d1166d929a62f4e@o4510228013121536.ingest.us.sentry.io/4510228107427840'),
 } as const;

src/libs/CloudflareAccess/AuthServerMetadata.ts

@@ -0,0 +1,89 @@
+/**
+ * RFC 8414 authorization server metadata discovery for the QA server's Managed OAuth. The authorize and
+ * token endpoints are fetched from the well-known document Cloudflare serves on the QA origin rather than
+ * assumed, and validated against the configured team domain before anything is sent to them.
+ */
+import {isRecord} from '@libs/ObjectUtils';
+
+import CONFIG from '@src/CONFIG';
+
+import {getQAOrigin} from './Config';
+
+/** RFC 8414 §3 fixes the path; Cloudflare serves the document at the edge on the protected origin */
+const WELL_KNOWN_PATH = '/.well-known/oauth-authorization-server';
+
+/** A hung metadata fetch would stall the sign-in flow (and, via refresh, the cross-tab lock) */
+const METADATA_TIMEOUT_MS = 10_000;
+
+type AuthServerEndpoints = {
+    /** Where the browser navigates to authorize (RFC 8414 `authorization_endpoint`) */
+    authorizationEndpoint: string;
+
+    /** Where codes and refresh tokens are exchanged (RFC 8414 `token_endpoint`) */
+    tokenEndpoint: string;
+};
+
+let metadataPromise: Promise<AuthServerEndpoints> | null = null;
+
+/** The single issuer this client trusts, pinned by configuration before any fetched endpoint is believed */
+function getExpectedIssuer(): string {
+    return `https://${CONFIG.QA_AUTH.TEAM_DOMAIN}`;
+}
+
+function validateEndpoint(value: unknown, issuerOrigin: string, name: string): string {
+    let parsed: URL;
+    try {
+        parsed = new URL(typeof value === 'string' ? value : '');
+    } catch {
+        throw new Error(`Authorization server metadata has a missing or malformed ${name}`);
+    }
+    // Endpoints receive the authorization code and refresh tokens, so they must live on the pinned issuer
+    if (parsed.origin !== issuerOrigin) {
+        throw new Error(`Authorization server metadata ${name} does not belong to the expected issuer`);
+    }
+    return parsed.href;
+}
+
+async function fetchAndValidateMetadata(): Promise<AuthServerEndpoints> {
+    const response = await fetch(new URL(WELL_KNOWN_PATH, getQAOrigin()).href, {
+        credentials: 'omit',
+        signal: AbortSignal.timeout(METADATA_TIMEOUT_MS),
+    });
+    if (!response.ok) {
+        throw new Error(`Authorization server metadata request failed with HTTP ${response.status}`);
+    }
+    const json: unknown = await response.json().catch(() => null);
+    if (!isRecord(json)) {
+        throw new Error('Authorization server metadata is not a JSON object');
+    }
+    // RFC 8414 §3.3: the issuer in the document must exactly match the issuer the client expects
+    const expectedIssuer = getExpectedIssuer();
+    if (json.issuer !== expectedIssuer) {
+        throw new Error('Authorization server metadata issuer does not match the configured team domain');
+    }
+    // This client only implements S256 (RFC 7636), so an issuer without it could never complete a flow
+    if (!Array.isArray(json.code_challenge_methods_supported) || !json.code_challenge_methods_supported.includes('S256')) {
+        throw new Error('Authorization server does not support the S256 PKCE challenge method');
+    }
+    const issuerOrigin = new URL(expectedIssuer).origin;
+    return {
+        authorizationEndpoint: validateEndpoint(json.authorization_endpoint, issuerOrigin, 'authorization_endpoint'),
+        tokenEndpoint: validateEndpoint(json.token_endpoint, issuerOrigin, 'token_endpoint'),
+    };
+}
+
+/**
+ * Single-flight and cached for the page's lifetime — the metadata is static per environment. A failure
+ * clears the cache so the next attempt retries, and rejects as a plain error: transient for the callers'
+ * terminal/transient split, never an OAuthError.
+ */
+function getAuthServerEndpoints(): Promise<AuthServerEndpoints> {
+    metadataPromise ??= fetchAndValidateMetadata().catch((error: unknown) => {
+        metadataPromise = null;
+        throw error;
+    });
+    return metadataPromise;
+}
+
+export {getAuthServerEndpoints};
+export type {AuthServerEndpoints};

src/libs/CloudflareAccess/Config/index.native.ts

@@ -15,16 +15,8 @@ function getQAOrigin(): string {
     return '';
 }
 
-function getAuthorizationEndpoint(): string {
-    return '';
-}
-
-function getTokenEndpoint(): string {
-    return '';
-}
-
 function getOAuthRedirectURI(): string {
     return '';
 }
 
-export {getAuthorizationEndpoint, getOAuthRedirectURI, getQAOrigin, getTokenEndpoint, isQAAuthConfigured, isQAServerRequest};
+export {getOAuthRedirectURI, getQAOrigin, isQAAuthConfigured, isQAServerRequest};

src/libs/CloudflareAccess/Config/index.ts

@@ -9,9 +9,9 @@ const TEAM_DOMAIN_SHAPE = /^[a-zA-Z0-9][a-zA-Z0-9.-]*\.[a-zA-Z]{2,}$/;
 
 /** Anything short of a complete, well-formed config and every consumer behaves as if the feature is absent */
 function isQAAuthConfigured(): boolean {
-    const {API_ROOT, TEAM_DOMAIN, CLIENT_ID} = CONFIG.QA_AUTH;
+    const {API_ROOT, TEAM_DOMAIN, CLIENT_ID, CHECK_PATH} = CONFIG.QA_AUTH;
 
-    if (!API_ROOT || !TEAM_DOMAIN || !CLIENT_ID) {
+    if (!API_ROOT || !TEAM_DOMAIN || !CLIENT_ID || !CHECK_PATH) {
         return false;
     }
 
@@ -47,17 +47,9 @@ function isQAServerRequest(url: string): boolean {
     }
 }
 
-function getAuthorizationEndpoint(): string {
-    return `https://${CONFIG.QA_AUTH.TEAM_DOMAIN}/cdn-cgi/access/oauth/authorization`;
-}
-
-function getTokenEndpoint(): string {
-    return `https://${CONFIG.QA_AUTH.TEAM_DOMAIN}/cdn-cgi/access/oauth/token`;
-}
-
 /** Must be registered as an allowed redirect URI on the Access application. Read lazily: no `window` on native. */
 function getOAuthRedirectURI(): string {
     return `${window.location.origin}/oauth/callback`;
 }
 
-export {getAuthorizationEndpoint, getOAuthRedirectURI, getQAOrigin, getTokenEndpoint, isQAAuthConfigured, isQAServerRequest};
+export {getOAuthRedirectURI, getQAOrigin, isQAAuthConfigured, isQAServerRequest};

src/libs/CloudflareAccess/OAuthClient.ts

@@ -7,7 +7,8 @@ import {isRecord} from '@libs/ObjectUtils';
 import CONFIG from '@src/CONFIG';
 import type CloudflareSession from '@src/types/onyx/CloudflareSession';
 
-import {getAuthorizationEndpoint, getOAuthRedirectURI, getQAOrigin, getTokenEndpoint} from './Config';
+import {getAuthServerEndpoints} from './AuthServerMetadata';
+import {getOAuthRedirectURI, getQAOrigin} from './Config';
 
 /** A hung token endpoint would otherwise hold the cross-tab refresh lock indefinitely */
 const TOKEN_ENDPOINT_TIMEOUT_MS = 10_000;
@@ -24,7 +25,8 @@ class OAuthError extends Error {
 
 /** POSTs form-encoded params to the token endpoint and validates the response into a CloudflareSession */
 async function postTokenEndpoint(body: URLSearchParams): Promise<CloudflareSession> {
-    const response = await fetch(getTokenEndpoint(), {
+    const {tokenEndpoint} = await getAuthServerEndpoints();
+    const response = await fetch(tokenEndpoint, {
         method: 'POST',
         headers: [['Content-Type', 'application/x-www-form-urlencoded']],
         body: body.toString(),
@@ -67,8 +69,9 @@ async function postTokenEndpoint(body: URLSearchParams): Promise<CloudflareSessi
 }
 
 /** Builds the authorization URL the browser navigates to */
-function buildAuthorizeURL({state, codeChallenge}: {state: string; codeChallenge: string}): string {
-    const url = new URL(getAuthorizationEndpoint());
+async function buildAuthorizeURL({state, codeChallenge}: {state: string; codeChallenge: string}): Promise<string> {
+    const {authorizationEndpoint} = await getAuthServerEndpoints();
+    const url = new URL(authorizationEndpoint);
     url.searchParams.set('response_type', 'code');
     url.searchParams.set('client_id', CONFIG.QA_AUTH.CLIENT_ID);
     url.searchParams.set('redirect_uri', getOAuthRedirectURI());

src/libs/actions/CloudflareProbe.ts

@@ -63,7 +63,7 @@ async function runCloudflareAuthProbe({shouldRedirectOnReauthRequired = false}:
             }
         }
 
-        const response = await fetchWithQAAuth(`${CONFIG.QA_AUTH.API_ROOT}api/CloudflareAuthProbe`, {method: CONST.NETWORK.METHOD.POST});
+        const response = await fetchWithQAAuth(`${CONFIG.QA_AUTH.API_ROOT}${CONFIG.QA_AUTH.CHECK_PATH}`, {method: CONST.NETWORK.METHOD.POST});
         if (!response.ok) {
             return {status: 'error', detail: `HTTP ${response.status}`};
         }

src/libs/actions/CloudflareSession.ts

@@ -83,13 +83,15 @@ async function beginCloudflareAuthRedirect(returnURL: string = window.location.h
     try {
         const pkce = await generatePKCEPair();
         const state = generateState();
+        // Resolved before the flow record is stored, so a failed discovery leaves nothing behind
+        const authorizeURL = await buildAuthorizeURL({state, codeChallenge: pkce.codeChallenge});
         if (generation !== sessionGeneration) {
-            // Signed out while the key material was generated — do not navigate a signed-out tab
+            // Signed out while this flow was being prepared — do not navigate a signed-out tab
             throw new Error('Cloudflare auth flow was cancelled by sign-out');
         }
         // Must be stored before the navigation — module memory does not survive the unload
         savePendingAuthFlow({state, codeVerifier: pkce.codeVerifier, returnURL, createdAt: Date.now()});
-        window.location.assign(buildAuthorizeURL({state, codeChallenge: pkce.codeChallenge}));
+        window.location.assign(authorizeURL);
     } catch (error) {
         isRedirectInFlight = false;
         throw error;