root
bed970a175
Log the requested tenant, endpoint, operation and exposure for organization HTTP 401/403 responses. Keep credentials and upstream response bodies out of diagnostics and retain the deployment gate. Validation: source checks and 118 tests pass, including forbidden-root identification and diagnostic privacy coverage.
53 lines
2.2 KiB
JavaScript
53 lines
2.2 KiB
JavaScript
import { getOrgDirectory } from '../src/org-context.js';
|
|
import { deploymentOrgSettings } from './org-context-settings.mjs';
|
|
import { setTimeout as wait } from 'node:timers/promises';
|
|
import { pathToFileURL } from 'node:url';
|
|
|
|
export async function verifyOrganization(env = process.env, { fetchImpl = fetch, pause = wait, log = console.log } = {}) {
|
|
const { vars, secrets } = deploymentOrgSettings(env);
|
|
if (vars.ORG_CONTEXT_ENABLED !== 'true') {
|
|
log('Organization integration disabled; existing behavior retained.');
|
|
return;
|
|
}
|
|
const checkedFetch = async (url, options) => {
|
|
const response = await fetchImpl(url, options);
|
|
if (response.status === 401 || response.status === 403) {
|
|
const request = new URL(url);
|
|
log(JSON.stringify({
|
|
status: 'organization_access_denied', httpStatus: response.status,
|
|
endpoint: request.origin + request.pathname,
|
|
tenantId: request.searchParams.get('tenantId'),
|
|
operation: 'baron.org-context.read', exposure: 'identifiers'
|
|
}));
|
|
}
|
|
return response;
|
|
};
|
|
for (let attempt = 1; attempt <= 3; attempt++) {
|
|
try {
|
|
// CI can wait for a slow upstream without extending the page request timeout.
|
|
const directory = await getOrgDirectory({ ...vars, ...secrets }, { fetchImpl: checkedFetch, timeoutMs: 15000 });
|
|
const summary = {
|
|
status: 'verified', rootCount: JSON.parse(vars.ORG_CONTEXT_TENANT_IDS).length,
|
|
tenantCount: directory.tenantCount, userCount: directory.byUser.size,
|
|
membershipCount: directory.membershipCount
|
|
};
|
|
log(JSON.stringify(summary));
|
|
return summary;
|
|
} catch (error) {
|
|
const retryable = /^org_context_(timeout|request_failed|http_(429|502|503|504))$/.test(error?.message || '');
|
|
if (!retryable || attempt === 3) throw error;
|
|
log(`Organization verification attempt ${attempt}/3 failed (${error.message}); retrying.`);
|
|
await pause(2000);
|
|
}
|
|
}
|
|
}
|
|
|
|
if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
|
|
try {
|
|
await verifyOrganization();
|
|
} catch (error) {
|
|
console.error(/^org_context_[a-z0-9_]+$/.test(error?.message || '') ? error.message : 'Organization integration configuration or verification failed.');
|
|
process.exitCode = 1;
|
|
}
|
|
}
|