From e57125eb18b00d5bfc3322926b4bbd5d1c5e080e Mon Sep 17 00:00:00 2001
From: kptdobe <acapt@adobe.com>
Date: Thu, 30 Apr 2026 08:22:02 +0200
Subject: [PATCH] fix: handle KV 414 error when IMS auth fragment leaks into
 org path
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

IMS OAuth redirect fragments (#access_token=..., #ld_hash=...) were leaking
into the admin API URL path on the client side, producing an org segment up
to 1986 bytes — far exceeding Cloudflare KV's 512-byte key limit. The KV
GET in getAclCtx() threw a 414 error that propagated to a 500 response.

Guard the DA_CONFIG.get() call with try/catch and return an empty action set
on any KV error, so the request receives a clean 403 instead of a 500.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 src/utils/auth.js       |  9 ++++++++-
 test/utils/auth.test.js | 20 ++++++++++++++++++++
 2 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/src/utils/auth.js b/src/utils/auth.js
index 309ef41c..fffc3d14 100644
--- a/src/utils/auth.js
+++ b/src/utils/auth.js
@@ -238,7 +238,14 @@ export async function getAclCtx(env, org, users, key, api) {
     };
   }
 
-  const props = await env.DA_CONFIG?.get(org, { type: 'json' });
+  let props;
+  try {
+    props = await env.DA_CONFIG?.get(org, { type: 'json' });
+  } catch {
+    // KV rejects keys longer than 512 bytes (e.g. IMS auth fragments leaking into the URL path).
+    // Treat as no config found — deny all access rather than propagating a 500.
+    return { pathLookup, actionSet: new Set() };
+  }
 
   if (props && props[':type'] === 'sheet' && props[':sheetname'] === 'permissions') {
     // It's a single-sheet, move the data to the right place
diff --git a/test/utils/auth.test.js b/test/utils/auth.test.js
index 6e33349f..c95da531 100644
--- a/test/utils/auth.test.js
+++ b/test/utils/auth.test.js
@@ -557,6 +557,26 @@ describe('DA auth', () => {
         users, org: 'test', aclCtx, key: '',
       }, '/some/deep/path', 'write'));
     });
+
+    it('returns empty action set when DA_CONFIG KV GET throws 414 key-too-long error', async () => {
+      // IMS auth redirect fragments (access_token=..., ld_hash=...) leak into the URL path,
+      // producing an org segment >512 bytes. KV rejects the lookup with a 414 error;
+      // without a guard this unhandled exception propagates to a 500 response.
+      const longOrg = 'a'.repeat(513);
+      const kv414Error = new Error(
+        `KV GET failed: 414 UTF-8 encoded length of ${longOrg.length} exceeds key length limit of 512.`,
+      );
+      const failEnv = {
+        DA_CONFIG: {
+          get: () => {
+            throw kv414Error;
+          },
+        },
+      };
+      const users = [{ email: 'user@example.com' }];
+      const aclCtx = await getAclCtx(failEnv, longOrg, users, '/test');
+      assert.strictEqual(aclCtx.actionSet.size, 0, 'oversized org name must produce empty action set, not throw');
+    });
   });
 
   describe('persmissions single sheet', () => {