From f02f201101f0900e7417578ad3e7e65f92c3ba11 Mon Sep 17 00:00:00 2001 From: David Cramer Date: Fri, 15 May 2026 09:32:21 -0700 Subject: [PATCH 1/2] fix(sandbox): Require OIDC config for egress proxy Fail sandbox credential egress setup before command execution when the deployment lacks the public proxy URL or Vercel OIDC verifier inputs. This prevents host-managed credentials from degrading into misleading provider 401s after the egress proxy is enabled. Document the required sandbox credential egress environment and add regressions for the missing callback URL, audience, and project ID cases. Co-Authored-By: GPT-5 Codex --- .../content/docs/reference/config-and-env.md | 11 ++++++ .../junior/src/chat/sandbox/egress-oidc.ts | 34 +++++++++++++------ .../junior/src/chat/sandbox/egress-policy.ts | 12 ++++--- .../handlers/sandbox-egress-proxy.test.ts | 30 ++++++++++++++++ 4 files changed, 72 insertions(+), 15 deletions(-) diff --git a/packages/docs/src/content/docs/reference/config-and-env.md b/packages/docs/src/content/docs/reference/config-and-env.md index cba7bcfe6..08626fa0c 100644 --- a/packages/docs/src/content/docs/reference/config-and-env.md +++ b/packages/docs/src/content/docs/reference/config-and-env.md @@ -32,6 +32,17 @@ If your build command runs `junior snapshot create`: - `REDIS_URL` must be available during build. - `VERCEL_OIDC_TOKEN` must be available during build (via Vercel OIDC settings). +## Sandbox credential egress + +If enabled plugins use host-managed credentials inside Vercel Sandbox, Junior forwards registered provider domains through its credential egress proxy. The deployment must be able to verify that each proxied request came from the expected Vercel project before it injects credentials. + +| Variable | Required | Purpose | +| ---------------------- | ----------- | ---------------------------------------------------------------------------- | +| `JUNIOR_BASE_URL` | Conditional | Public URL for the credential egress proxy, unless Vercel URL envs cover it. | +| `VERCEL_OIDC_AUDIENCE` | Conditional | Expected Vercel OIDC audience, usually `https://vercel.com/`. | +| `VERCEL_PROJECT_ID` | Conditional | Expected Vercel project ID for sandbox egress proxy requests. | +| `VERCEL_TEAM_ID` | No | Optional team ID check for sandbox egress proxy requests. | + ## GitHub plugin | Variable | Required | Purpose | diff --git a/packages/junior/src/chat/sandbox/egress-oidc.ts b/packages/junior/src/chat/sandbox/egress-oidc.ts index 4971b8d79..93d4c7e8f 100644 --- a/packages/junior/src/chat/sandbox/egress-oidc.ts +++ b/packages/junior/src/chat/sandbox/egress-oidc.ts @@ -77,12 +77,28 @@ async function getJwks( return jwks; } -function expectedVercelOidcAudience(): string { +interface VercelSandboxOidcConfig { + audience: string; + projectId: string; + teamId?: string; +} + +/** Require the verifier inputs before enabling host-brokered sandbox egress. */ +export function requireVercelSandboxOidcConfig(): VercelSandboxOidcConfig { const audience = process.env.VERCEL_OIDC_AUDIENCE?.trim(); if (!audience) { throw new Error("VERCEL_OIDC_AUDIENCE is required for sandbox egress OIDC"); } - return audience; + const expectedTeamId = process.env.VERCEL_TEAM_ID?.trim(); + const expectedProjectId = process.env.VERCEL_PROJECT_ID?.trim(); + if (!expectedProjectId) { + throw new Error("VERCEL_PROJECT_ID is required for sandbox egress OIDC"); + } + return { + audience, + projectId: expectedProjectId, + ...(expectedTeamId ? { teamId: expectedTeamId } : {}), + }; } /** Validate deployment and sandbox binding claims in a verified Vercel Sandbox OIDC payload. */ @@ -90,21 +106,17 @@ export function validateVercelSandboxOidcClaims( payload: JWTPayload, sandboxId: string, ): void { - const expectedTeamId = process.env.VERCEL_TEAM_ID?.trim(); - const expectedProjectId = process.env.VERCEL_PROJECT_ID?.trim(); - if (!expectedProjectId) { - throw new Error("VERCEL_PROJECT_ID is required for sandbox egress OIDC"); - } + const expected = requireVercelSandboxOidcConfig(); if ( - expectedTeamId && + expected.teamId && (typeof payload.owner_id !== "string" || - payload.owner_id !== expectedTeamId) + payload.owner_id !== expected.teamId) ) { throw new Error("Vercel OIDC token belongs to a different team"); } if ( typeof payload.project_id !== "string" || - payload.project_id !== expectedProjectId + payload.project_id !== expected.projectId ) { throw new Error("Vercel OIDC token belongs to a different project"); } @@ -122,7 +134,7 @@ export async function verifyVercelSandboxOidcToken( if (typeof unverified.iss !== "string") { throw new Error("Vercel OIDC token did not include an issuer"); } - const audience = expectedVercelOidcAudience(); + const { audience } = requireVercelSandboxOidcConfig(); const jwks = await getJwks(unverified.iss); const verified = await jwtVerify(token, jwks, { issuer: unverified.iss, diff --git a/packages/junior/src/chat/sandbox/egress-policy.ts b/packages/junior/src/chat/sandbox/egress-policy.ts index 55f4ca57c..ca0ad92c7 100644 --- a/packages/junior/src/chat/sandbox/egress-policy.ts +++ b/packages/junior/src/chat/sandbox/egress-policy.ts @@ -4,6 +4,7 @@ import { resolvePluginCommandEnv } from "@/chat/plugins/command-env"; import { getPluginProviders } from "@/chat/plugins/registry"; import type { PluginManifest } from "@/chat/plugins/types"; import { resolveBaseUrl } from "@/chat/oauth-flow"; +import { requireVercelSandboxOidcConfig } from "@/chat/sandbox/egress-oidc"; const SANDBOX_EGRESS_PROXY_PATH = "/api/internal/sandbox-egress"; @@ -58,14 +59,17 @@ function proxyUrl(sandboxId: string): string | undefined { export function buildSandboxEgressNetworkPolicy( sandboxId: string, ): NetworkPolicy | undefined { - const forwardURL = proxyUrl(sandboxId); - if (!forwardURL) { - return undefined; - } const entries = providerEntries(); if (entries.length === 0) { return undefined; } + const forwardURL = proxyUrl(sandboxId); + if (!forwardURL) { + throw new Error( + "Cannot determine base URL for sandbox credential egress (set JUNIOR_BASE_URL or deploy to Vercel)", + ); + } + requireVercelSandboxOidcConfig(); const allow: Record = { "*": [], diff --git a/packages/junior/tests/unit/handlers/sandbox-egress-proxy.test.ts b/packages/junior/tests/unit/handlers/sandbox-egress-proxy.test.ts index 7cb002b45..ddccfccb2 100644 --- a/packages/junior/tests/unit/handlers/sandbox-egress-proxy.test.ts +++ b/packages/junior/tests/unit/handlers/sandbox-egress-proxy.test.ts @@ -169,6 +169,9 @@ describe("sandbox egress proxy", () => { }); it("builds provider forwarding policy for sandbox egress", () => { + process.env.VERCEL_OIDC_AUDIENCE = "https://vercel.com/acme"; + process.env.VERCEL_PROJECT_ID = "prj_123"; + expect(matchesSandboxEgressDomain("SENTRY.IO", "sentry.io")).toBe(true); expect(matchesSandboxEgressDomain("eu.sentry.io", "sentry.io")).toBe(false); expect(buildSandboxEgressNetworkPolicy(SANDBOX_ID)).toEqual({ @@ -188,6 +191,32 @@ describe("sandbox egress proxy", () => { }); }); + it("fails sandbox egress policy setup without a public callback URL", () => { + delete process.env.JUNIOR_BASE_URL; + process.env.VERCEL_OIDC_AUDIENCE = "https://vercel.com/acme"; + process.env.VERCEL_PROJECT_ID = "prj_123"; + + expect(() => buildSandboxEgressNetworkPolicy(SANDBOX_ID)).toThrow( + "Cannot determine base URL for sandbox credential egress", + ); + }); + + it("fails sandbox egress policy setup without trusted OIDC configuration", () => { + process.env.VERCEL_PROJECT_ID = "prj_123"; + + expect(() => buildSandboxEgressNetworkPolicy(SANDBOX_ID)).toThrow( + "VERCEL_OIDC_AUDIENCE is required for sandbox egress OIDC", + ); + }); + + it("fails sandbox egress policy setup without the expected Vercel project", () => { + process.env.VERCEL_OIDC_AUDIENCE = "https://vercel.com/acme"; + + expect(() => buildSandboxEgressNetworkPolicy(SANDBOX_ID)).toThrow( + "VERCEL_PROJECT_ID is required for sandbox egress OIDC", + ); + }); + it("resolves command env for registered sandbox providers", async () => { await expect(resolveSandboxCommandEnvironment()).resolves.toEqual({ SENTRY_READ_ONLY: "1", @@ -627,6 +656,7 @@ describe("sandbox egress proxy", () => { }); it("requires OIDC claims to match the Vercel project and sandbox", () => { + process.env.VERCEL_OIDC_AUDIENCE = "https://vercel.com/acme"; process.env.VERCEL_PROJECT_ID = "prj_123"; process.env.VERCEL_TEAM_ID = "team_123"; From a988e9fa282395cb2c452c8095ccee1fa8c529fb Mon Sep 17 00:00:00 2001 From: David Cramer Date: Fri, 15 May 2026 09:41:44 -0700 Subject: [PATCH 2/2] fix(sandbox): Narrow OIDC claim config loading Keep sandbox claim validation scoped to the project and team values it checks. The full proxy setup still requires the trusted audience before credential egress is enabled, while token verification reuses that loaded config instead of reading it twice. Co-Authored-By: GPT-5 Codex --- .../junior/src/chat/sandbox/egress-oidc.ts | 45 +++++++++++++------ .../handlers/sandbox-egress-proxy.test.ts | 1 - 2 files changed, 32 insertions(+), 14 deletions(-) diff --git a/packages/junior/src/chat/sandbox/egress-oidc.ts b/packages/junior/src/chat/sandbox/egress-oidc.ts index 93d4c7e8f..ea46c02b7 100644 --- a/packages/junior/src/chat/sandbox/egress-oidc.ts +++ b/packages/junior/src/chat/sandbox/egress-oidc.ts @@ -83,30 +83,37 @@ interface VercelSandboxOidcConfig { teamId?: string; } -/** Require the verifier inputs before enabling host-brokered sandbox egress. */ -export function requireVercelSandboxOidcConfig(): VercelSandboxOidcConfig { - const audience = process.env.VERCEL_OIDC_AUDIENCE?.trim(); - if (!audience) { - throw new Error("VERCEL_OIDC_AUDIENCE is required for sandbox egress OIDC"); - } +type VercelSandboxOidcClaimConfig = Omit; + +function requireVercelSandboxOidcClaimConfig(): VercelSandboxOidcClaimConfig { const expectedTeamId = process.env.VERCEL_TEAM_ID?.trim(); const expectedProjectId = process.env.VERCEL_PROJECT_ID?.trim(); if (!expectedProjectId) { throw new Error("VERCEL_PROJECT_ID is required for sandbox egress OIDC"); } return { - audience, projectId: expectedProjectId, ...(expectedTeamId ? { teamId: expectedTeamId } : {}), }; } -/** Validate deployment and sandbox binding claims in a verified Vercel Sandbox OIDC payload. */ -export function validateVercelSandboxOidcClaims( +/** Require the verifier inputs before enabling host-brokered sandbox egress. */ +export function requireVercelSandboxOidcConfig(): VercelSandboxOidcConfig { + const audience = process.env.VERCEL_OIDC_AUDIENCE?.trim(); + if (!audience) { + throw new Error("VERCEL_OIDC_AUDIENCE is required for sandbox egress OIDC"); + } + return { + audience, + ...requireVercelSandboxOidcClaimConfig(), + }; +} + +function validateClaimsWithConfig( payload: JWTPayload, sandboxId: string, + expected: VercelSandboxOidcClaimConfig, ): void { - const expected = requireVercelSandboxOidcConfig(); if ( expected.teamId && (typeof payload.owner_id !== "string" || @@ -125,6 +132,18 @@ export function validateVercelSandboxOidcClaims( } } +/** Validate deployment and sandbox binding claims in a verified Vercel Sandbox OIDC payload. */ +export function validateVercelSandboxOidcClaims( + payload: JWTPayload, + sandboxId: string, +): void { + validateClaimsWithConfig( + payload, + sandboxId, + requireVercelSandboxOidcClaimConfig(), + ); +} + /** Verify the Vercel-issued OIDC token attached to a sandbox firewall proxy request. */ export async function verifyVercelSandboxOidcToken( token: string, @@ -134,12 +153,12 @@ export async function verifyVercelSandboxOidcToken( if (typeof unverified.iss !== "string") { throw new Error("Vercel OIDC token did not include an issuer"); } - const { audience } = requireVercelSandboxOidcConfig(); + const expected = requireVercelSandboxOidcConfig(); const jwks = await getJwks(unverified.iss); const verified = await jwtVerify(token, jwks, { issuer: unverified.iss, - audience, + audience: expected.audience, }); - validateVercelSandboxOidcClaims(verified.payload, sandboxId); + validateClaimsWithConfig(verified.payload, sandboxId, expected); return verified.payload; } diff --git a/packages/junior/tests/unit/handlers/sandbox-egress-proxy.test.ts b/packages/junior/tests/unit/handlers/sandbox-egress-proxy.test.ts index ddccfccb2..a4208e021 100644 --- a/packages/junior/tests/unit/handlers/sandbox-egress-proxy.test.ts +++ b/packages/junior/tests/unit/handlers/sandbox-egress-proxy.test.ts @@ -656,7 +656,6 @@ describe("sandbox egress proxy", () => { }); it("requires OIDC claims to match the Vercel project and sandbox", () => { - process.env.VERCEL_OIDC_AUDIENCE = "https://vercel.com/acme"; process.env.VERCEL_PROJECT_ID = "prj_123"; process.env.VERCEL_TEAM_ID = "team_123";