fix: expose authenticated HTTP module redirects by kojiwakayama · Pull Request #3839 · veryfront/veryfront-code

kojiwakayama · 2026-08-18T01:42:07Z

Outcome

Surface the deterministic authentication redirect that precedes an HTTP module HTML response. The loader now reports the last fully admitted redirect status and a bounded destination instead of misclassifying this failure as an esm.sh build or alias-resolution problem.

This is intentionally diagnostic-only. It does not retry the redirect, weaken endpoint authentication, or claim to restore the affected project render.

RED → GREEN

RED: a module request returning 302 to a sign-in URL and then HTML produced the old generic alias diagnostic.
GREEN: the error now identifies HTTP 302 and the canonical sign-in destination, with arbitrary path, query, fragment, and userinfo data removed.
RED: ordinary redirects were mislabeled as interactive authentication and credential-bearing path segments reached diagnostics.
GREEN: only canonical /sign-in routes receive authentication guidance; all other destinations reduce to their origin and receive neutral JavaScript-module guidance.
RED: a public redirect into a private DNS address notified the observer before the egress guard blocked it.
GREEN: observers see only redirects whose guarded destination request returned a response.
Regression: a throwing observer preserves its error and cancels the destination response body exactly once.

Safety

Redirect following and retry policy are unchanged.
Every destination still passes caller authorization and egress validation.
Cross-origin credentials are still stripped before following.
Logged and public redirect metadata omits untrusted path, query, fragment, and userinfo data.

Verification

Focused redirect, egress, and HTTP-cache matrix: 5 tests / 136 steps.
Full pre-push unit suite: 3,929 tests / 30,094 steps, plus cwd suites.
Deno check, lint, format, diff, anti-slop, and test-typecheck baselines pass.
CI-pinned Deno 2.7.7 API docs: 44 files current.
Public docs, error docs, generated artifact, release, and CI workflow checks pass.
Independent Spec and Standards reviews approve exact head b19240c.

Follow-up

The project owner still needs to replace the public-domain ResponsiveImage import with an authenticated/content-addressed registry source. Issue #240 remains the structural product fix.

Related: veryfront/veryfront-issue-inbox#177
Related: veryfront/veryfront-issue-inbox#240

HTTP module imports can follow a valid redirect into an interactive sign-in page, leaving the cache to misclassify the final HTML response. Preserve the guarded redirect flow while carrying only the last fully admitted hop's status and sanitized destination into the diagnostic. Constraint: Redirect following, egress validation, credential stripping, retry policy, and endpoint authentication remain unchanged. Rejected: Stop at the first redirect | valid CDN and package redirects must continue to work. Rejected: Retry authentication redirects | the boundary is deterministic and requires project-owner migration. Confidence: high Scope-risk: moderate Reversibility: clean Directive: Keep redirect destinations sanitized before logs or public errors, and never notify observers about a destination the egress guard blocks. Tested: RED/GREEN redirect observer, blocked-destination, and HTTP cache regressions; 5 focused tests/134 steps; 3929 pre-push tests/30091 steps; check, lint, fmt, anti-slop, test-typecheck, pinned API docs, public docs, release checks. Not-tested: Project-owner migration of the private ResponsiveImage import. Related: veryfront/veryfront-issue-inbox#177 Related: veryfront/veryfront-issue-inbox#240

The redirect observer runs after the destination response is available, so an observer rejection must not strand that response body. Record the cleanup and error-propagation contract with a cancel-counting regression. Constraint: Preserve the observer error while releasing the unread response body. Confidence: high Scope-risk: narrow Reversibility: clean Directive: Keep observer-failure cleanup covered when redirect notification timing changes. Tested: Focused redirect/egress/cache matrix, 5 tests/135 steps; check, lint, fmt, diff check. Related: veryfront/veryfront-issue-inbox#177

coderabbitai · 2026-08-18T01:42:24Z

Warning

Review limit reached

@kojiwakayama, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 56 minutes

Limit details: You’ve used all 1 included review currently available under your plan.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 46cf69a1-0619-4519-a7c7-edb96e7a2e53

📥 Commits

Reviewing files that changed from the base of the PR and between 010a396 and b19240c.

📒 Files selected for processing (6)

src/security/http/outbound-fetch.test.ts
src/security/http/outbound-fetch.ts
src/security/sandbox/worker-egress-guard.ts
src/transforms/esm/http-cache-helpers.ts
src/transforms/esm/http-cache.test.ts
src/transforms/esm/http-cache.ts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-08-18T01:42:28Z

📦 Client bundle boundary

Entrypoint	Modules	Source size	Server leaks
`src/index.client.ts`	325	1939 KiB	✅ 0

A server module in a client graph aborts hydration in the browser. New leaks fail CI; known leaks are tracked in scripts/lint/client-bundle-baseline.json to burn down.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e53d2e33a9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Redirect destinations can carry one-time codes or signed credentials in path segments, and ordinary redirects do not prove authentication. Reduce neutral destinations to their origin, retain only the canonical sign-in marker, and choose guidance from that bounded classification. Constraint: Preserve the observed HTTP status and the known sign-in diagnosis without storing untrusted path, query, fragment, or userinfo data. Rejected: Reuse generic URL sanitization | it intentionally preserves path components that can contain credentials. Rejected: Label every redirected HTML response as authentication | canonical and moved-module redirects need neutral guidance. Confidence: high Scope-risk: narrow Reversibility: clean Directive: Do not add arbitrary redirect path components back to logs or public errors. Tested: RED/GREEN moved-module and path-credential redirects; sign-in path/query redaction; focused matrix 5 tests/136 steps; check, lint, fmt, anti-slop, test-typecheck, diff check. Related: veryfront/veryfront-issue-inbox#177

kojiwakayama · 2026-08-18T02:05:25Z

@codex review exact head b19240c8e4a77f3d53bf52e96b34cf33b69de81e. Please verify redirect observer timing, response-body cleanup, SSRF and authorization ordering, cross-origin credential stripping, bounded redirect diagnostics, sign-in classification, and secret redaction. Report only findings reproducible on this exact commit.

kojiwakayama

Addressed the linked review finding in b19240c.

kojiwakayama

Addressed the linked review finding in b19240c.

kojiwakayama · 2026-08-18T02:07:12Z

@coderabbitai review

coderabbitai · 2026-08-18T02:07:27Z

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

chatgpt-codex-connector · 2026-08-18T02:08:15Z

Codex Review: Didn't find any major issues. Keep them coming!

Reviewed commit: b19240c8e4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

kojiwakayama added 2 commits August 18, 2026 03:37

kojiwakayama requested a review from kwakayama as a code owner August 18, 2026 01:42

chatgpt-codex-connector Bot reviewed Aug 18, 2026

View reviewed changes

Comment thread src/transforms/esm/http-cache.ts

Comment thread src/transforms/esm/http-cache-helpers.ts Outdated

kojiwakayama commented Aug 18, 2026

View reviewed changes

Comment thread src/transforms/esm/http-cache-helpers.ts Outdated

kojiwakayama commented Aug 18, 2026

View reviewed changes

Comment thread src/transforms/esm/http-cache.ts

kojiwakayama added this pull request to the merge queue Aug 18, 2026

github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Aug 18, 2026

kojiwakayama added this pull request to the merge queue Aug 18, 2026

Merged via the queue into main with commit e76bb15 Aug 18, 2026
34 checks passed

kojiwakayama deleted the fix/issue-177-http-redirect-diagnostic branch August 18, 2026 02:27

Navigation Menu

fix: expose authenticated HTTP module redirects - #3839

fix: expose authenticated HTTP module redirects#3839
kojiwakayama merged 3 commits into
mainfrom
fix/issue-177-http-redirect-diagnostic

kojiwakayama commented Aug 18, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Aug 18, 2026 •

edited

Loading

Review limit reached

Uh oh!

github-actions Bot commented Aug 18, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

Uh oh!

kojiwakayama commented Aug 18, 2026

Uh oh!

kojiwakayama left a comment

Uh oh!

Uh oh!

kojiwakayama left a comment

Uh oh!

Uh oh!

kojiwakayama commented Aug 18, 2026

Uh oh!

coderabbitai Bot commented Aug 18, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Aug 18, 2026

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

kojiwakayama commented Aug 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Outcome

RED → GREEN

Safety

Verification

Follow-up

Uh oh!

coderabbitai Bot commented Aug 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

github-actions Bot commented Aug 18, 2026

📦 Client bundle boundary

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

kojiwakayama commented Aug 18, 2026

Uh oh!

kojiwakayama left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

kojiwakayama left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

kojiwakayama commented Aug 18, 2026

Uh oh!

coderabbitai Bot commented Aug 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Aug 18, 2026

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

kojiwakayama commented Aug 18, 2026 •

edited

Loading

coderabbitai Bot commented Aug 18, 2026 •

edited

Loading

coderabbitai Bot commented Aug 18, 2026 •

edited

Loading