fix(api): reject duplicate decoded target_repository keys

[seonghobae]

Purpose

Fail closed when a bounded POST /exchange JSON body contains more than one decoded target_repository member name before GitHub API trust setup or credential-bearing work can observe ordinary last-key-wins parsing.

Stack identity

• protected main: c85d710804139c0697d7ef8fa47d02b1389e6d84;
• base branch: fix/exchange-method-short-circuit-on-main / PR fix(api): reject unsupported exchange methods before side effects #101;
• exact live base at this update: 50af2026b30693524d5307b4e9449c888d4dc8b8;
• RED head: abdb8aa55c392d74a5eac7a3b443e4f41f953a24;
• first GREEN implementation head: e15eabce06609c585fcd10a7e916c126fd462771;
• current exact head after coverage hardening: ecd42efbc4c2dc21804faa0b4e317b83e59141cb.

This remains a Draft because it is dependency-ordered behind #101. Its feature-branch base is not eligible for the current central Security Scan pull-request trigger, so scanner evidence is non-passing defer_until_trigger until the work is refreshed onto an eligible protected-base lineage.

RCA -> RED -> GREEN -> proof

The first failing boundary was body-integrity validation. boundExchangeJsonBody() enforced byte limits, then downstream parsing used normal JSON semantics. A body containing both target_repository and escape-equivalent target_reposit\u006fry therefore had an ambiguous security-relevant member identity and could reach last-key-wins parsing.

Exact RED head abdb8aa55c392d74a5eac7a3b443e4f41f953a24 was checked out by application CI run 31407630318. Existing tests remained green while the new regression failed exactly because the bounded request was accepted instead of returning 400 duplicate_keys.

The narrow GREEN implementation at e15eabce06609c585fcd10a7e916c126fd462771 scans only decoded JSON member names relevant to target_repository, rejects a second occurrence before GitHub egress/configuration work, and emits the existing no-store validation response/logging contract. Application CI run 31407827784 then proved all behavior tests green but correctly failed the repository's exact 100% coverage gate on one defensive scanner branch; the run was not promoted to passing evidence.

Current head ecd42efbc4c2dc21804faa0b4e317b83e59141cb adds realistic coverage for unrelated member names, malformed key escapes delegated to the existing downstream JSON parser, and the full entrypoint fail-closed response before GitHub egress configuration.

Current exact-head technical evidence

For unchanged head ecd42efbc4c2dc21804faa0b4e317b83e59141cb:

• application ci run 31408260346: terminal success; verify job 93519804541 checked out the exact head;
• reviewer-ci run 31408260681: terminal success;
• release:verify: 64 test files / 656 tests passed;
• configured owned statements, branches, functions, and lines: 100% / 100% / 100% / 100%;
• npm audit --audit-level=high: 0 vulnerabilities;
• current formal GitHub reviews: 0;
• current inline review threads: 0;
• GitHub reports the content graph mergeable;
• central Security Scan: absent because this PR targets a feature branch, therefore non-passing defer_until_trigger, not scanner success.

The non-strict KPI step still reports SKIP because real 30-day production exchange evidence is absent. Acquisition-manifest generation succeeds only as manifest construction and still identifies missing final-gate production KPI/provenance, security-validation, immutable release-publication, deployment/attestation/environment-governance, revenue, and transfer evidence. None of those results are acquisition readiness.

Behavioral boundary

The implementation intentionally guards the security-relevant target_repository member rather than claiming a general duplicate-key JSON parser. It preserves request byte limits, malformed-JSON handling, OIDC/JWT bounds, distributed rate limiting, exact workflow trust, replay behavior, GitHub API egress policy, token minting semantics, dependency/workflow permissions, licensing, release, and deployment authority.

Merge / authority boundary

No predecessor check or review evidence transfers after source movement. Before this work can become merge-eligible, #101 must reach the protected lineage under live governance, this unique two-file delta must be refreshed/rebuilt onto the then-current eligible base without destructive history rewriting, and fresh application/reviewer/central Security Scan/current-review evidence must pass on that exact head. Live #27 governance and any qualifying independent non-author formal approval required by #29 remain separate fail-closed authority. No self-approval, protection weakening, synthetic status, release, deployment, outbound-license decision, or acquisition-readiness claim is made.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 9caf60ee-7917-4f35-aa0e-eda42ede8d39

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}