chore(web): guard OAuth API routes against 307/308 redirects

[brendan-kellam]

Fixes SOU-945

Summary

• Adds packages/web/src/ee/features/oauth/apiHandler.ts — a thin wrapper around apiHandler that throws if the wrapped handler ever returns HTTP 307 or 308. Per RFC 9700 §4.12, the OAuth authorization server must not use 307/308 on redirects carrying user credentials, since those statuses preserve the request method and body. The error message cites the spec.
• Swaps apiHandler → oauthApiHandler in every authorization-server route handler:
  • app/api/(server)/ee/oauth/token/route.ts
  • app/api/(server)/ee/oauth/register/route.ts
  • app/api/(server)/ee/oauth/revoke/route.ts
  • app/api/(server)/ee/.well-known/oauth-authorization-server/route.ts (RFC 8414)
  • app/api/(server)/ee/.well-known/oauth-protected-resource/[...path]/route.ts (RFC 9728)
• Adds unit tests for the wrapper covering pass-through (200/302/303/400) and rejection (307/308) cases.

This is defense-in-depth on top of the existing posture: no authorization-server endpoint emits 307 or 308 today, but this wrapper makes regressions fail at request time rather than ship silently.

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • OAuth authorization-server routes now reject HTTP 307 and 308 responses at runtime.

• Tests

  • Added test coverage for OAuth handler validation of HTTP redirect statuses.

[coderabbitai]

Walkthrough

This PR introduces a runtime guard for OAuth authorization-server route handlers that rejects HTTP 307 and 308 redirect responses in accordance with RFC 9700 §4.12. A new oauthApiHandler wrapper is implemented and applied across five OAuth endpoint routes.

Changes

Cohort / File(s)	Summary
Documentation CHANGELOG.md	Added "Changed" entry documenting the runtime guard for HTTP 307/308 response rejection on OAuth routes.
OAuth Route Handlers packages/web/src/app/api/(server)/ee/.well-known/oauth-authorization-server/route.ts, packages/web/src/app/api/(server)/ee/.well-known/oauth-protected-resource/[...path]/route.ts, packages/web/src/app/api/(server)/ee/oauth/register/route.ts, packages/web/src/app/api/(server)/ee/oauth/revoke/route.ts, packages/web/src/app/api/(server)/ee/oauth/token/route.ts	Replaced apiHandler wrapper with oauthApiHandler on all exported route handlers; internal logic and request validation remain unchanged.
OAuth Handler Implementation packages/web/src/ee/features/oauth/apiHandler.ts	New oauthApiHandler wrapper function that delegates to apiHandler and throws an error if the wrapped handler returns HTTP 307 or 308 status codes, otherwise returns the response unmodified.
Handler Tests packages/web/src/ee/features/oauth/apiHandler.test.ts	New test suite verifying oauthApiHandler preserves status codes for 200, 302, 303, and 400 responses, and throws an RFC 9700-referencing error when encountering 307 or 308 responses.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related PRs

• fix(web): prevent XSS via OAuth redirect URI scheme injection #1136: Both PRs modify the OAuth dynamic client registration route; this PR applies the oauthApiHandler wrapper while the other validates redirect URI schemes within the same endpoint.
• chore(web): make session and OAuth token lifetimes configurable #1162: Both PRs modify the OAuth token endpoint route; this PR wraps it with oauthApiHandler while the other adjusts token expiry logic in the same handler.
• fix(web): stop advertising MCP OAuth without entitlement #985: Both PRs affect the well-known OAuth routes; this PR applies oauthApiHandler wrappers while the other adds entitlement gating and error messaging to those same endpoints.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'chore(web): guard OAuth API routes against 307/308 redirects' accurately and specifically describes the main change: implementing a runtime guard against HTTP 307/308 responses in OAuth routes.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch brendan/oauth-307-redirect-guard-SOU-945

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Review rate limit: 6/8 reviews remaining, refill in 14 minutes and 4 seconds.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@CHANGELOG.md`:
- Line 23: The changelog entry "Guarded all OAuth authorization-server route
handlers with a runtime assertion that rejects HTTP 307 and 308 responses, per
RFC 9700 §4.12. [`#1163`](https://github.com/sourcebot-dev/sourcebot/pull/1163)"
is missing the enterprise-only prefix; update that line to prepend "[EE]" to the
entry (so it reads starting with "[EE] Guarded all OAuth authorization-server
route handlers...") to comply with the changelog rules.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 70b33b5d-68e3-41db-b58e-c2a6a3a88fc1

📥 Commits

Reviewing files that changed from the base of the PR and between d691e90 and afdbe91.

📒 Files selected for processing (8)

• CHANGELOG.md
• packages/web/src/app/api/(server)/ee/.well-known/oauth-authorization-server/route.ts
• packages/web/src/app/api/(server)/ee/.well-known/oauth-protected-resource/[...path]/route.ts
• packages/web/src/app/api/(server)/ee/oauth/register/route.ts
• packages/web/src/app/api/(server)/ee/oauth/revoke/route.ts
• packages/web/src/app/api/(server)/ee/oauth/token/route.ts
• packages/web/src/ee/features/oauth/apiHandler.test.ts
• packages/web/src/ee/features/oauth/apiHandler.ts