fix(security): adds Turnstile domains to CSP, removes dead body.code path, adds rate limiter error test

Author: wgordon17

public/_headers

@@ -1,5 +1,5 @@
 /*
-  Content-Security-Policy: default-src 'none'; script-src 'self' 'sha256-uEFqyYCMaNy1Su5VmWLZ1hOCRBjkhm4+ieHHxQW6d3Y='; style-src-elem 'self'; style-src-attr 'unsafe-inline'; img-src 'self' data: https://avatars.githubusercontent.com; connect-src 'self' https://api.github.com ws://127.0.0.1:*; font-src 'self'; worker-src 'self'; manifest-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'none'; upgrade-insecure-requests; report-uri /api/csp-report; report-to csp-endpoint
+  Content-Security-Policy: default-src 'none'; script-src 'self' 'sha256-uEFqyYCMaNy1Su5VmWLZ1hOCRBjkhm4+ieHHxQW6d3Y=' https://challenges.cloudflare.com; style-src-elem 'self'; style-src-attr 'unsafe-inline'; img-src 'self' data: https://avatars.githubusercontent.com; connect-src 'self' https://api.github.com ws://127.0.0.1:*; font-src 'self'; worker-src 'self'; manifest-src 'self'; frame-src https://challenges.cloudflare.com; frame-ancestors 'none'; base-uri 'self'; form-action 'none'; upgrade-insecure-requests; report-uri /api/csp-report; report-to csp-endpoint
   Reporting-Endpoints: csp-endpoint="/api/csp-report"
   X-Content-Type-Options: nosniff
   Referrer-Policy: strict-origin-when-cross-origin

src/app/lib/proxy.ts

@@ -118,7 +118,7 @@ export async function sealApiToken(token: string, purpose: string): Promise<stri
     let message = "unknown_error";
     try {
       const body = (await res.json()) as { code?: string; error?: string };
-      message = body.code ?? body.error ?? message;
+      message = body.error ?? message;
     } catch {
       // ignore parse errors — keep default message
     }

tests/app/lib/proxy.test.ts

@@ -288,20 +288,6 @@ describe("sealApiToken", () => {
   it("throws { status, message } on 403 response", async () => {
     setupMockedTurnstile("turnstile-tok");
 
-    const mockFetch = vi.fn().mockResolvedValue(
-      new Response(JSON.stringify({ code: "turnstile_failed" }), { status: 403 }),
-    );
-    vi.stubGlobal("fetch", mockFetch);
-
-    await expect(mod.sealApiToken("my-token", "jira-api-token")).rejects.toMatchObject({
-      status: 403,
-      message: "turnstile_failed",
-    });
-  });
-
-  it("throws { status, message } on 403 response using error field", async () => {
-    setupMockedTurnstile("turnstile-tok");
-
     const mockFetch = vi.fn().mockResolvedValue(
       new Response(JSON.stringify({ error: "turnstile_failed" }), { status: 403 }),
     );
@@ -317,7 +303,7 @@ describe("sealApiToken", () => {
     setupMockedTurnstile("turnstile-tok");
 
     const mockFetch = vi.fn().mockResolvedValue(
-      new Response(JSON.stringify({ code: "rate_limited" }), { status: 429 }),
+      new Response(JSON.stringify({ error: "rate_limited" }), { status: 429 }),
     );
     vi.stubGlobal("fetch", mockFetch);
 
@@ -331,7 +317,7 @@ describe("sealApiToken", () => {
     setupMockedTurnstile("turnstile-tok");
 
     const mockFetch = vi.fn().mockResolvedValue(
-      new Response(JSON.stringify({ code: "seal_failed" }), { status: 500 }),
+      new Response(JSON.stringify({ error: "seal_failed" }), { status: 500 }),
     );
     vi.stubGlobal("fetch", mockFetch);
 

tests/worker/seal.test.ts

@@ -171,6 +171,21 @@ describe("Worker /api/proxy/seal endpoint", () => {
     expect(res.headers.get("Retry-After")).toBe("60");
   });
 
+  it("request proceeds when rate limiter throws (fail-open)", async () => {
+    globalThis.fetch = vi.fn().mockResolvedValue(
+      new Response(JSON.stringify({ success: true }), { status: 200 })
+    );
+
+    const rateLimiter = { limit: vi.fn().mockRejectedValue(new Error("binding unavailable")) };
+    const req = makeSealRequest();
+    const res = await worker.fetch(req, makeEnv({ PROXY_RATE_LIMITER: rateLimiter }));
+
+    // Should NOT be 429 or 500 — rate limiter failure is fail-open
+    expect(res.status).toBe(200);
+    const json = await res.json() as Record<string, unknown>;
+    expect(json["sealed"]).toBeDefined();
+  });
+
   // ── Input validation ──────────────────────────────────────────────────────
 
   it("request with token exceeding 2048 chars returns 400 with invalid_request", async () => {