verify: okStatuses now requires a paired bodyMustContain body proof to certify a key

3c08671852d2dd44eb693406ce99d0f1ec3d6167 · 2026-09-22 14:50:34 -0700 · Steve

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DP24DdLpG6PHXgmjr47TVb

Files touched

M cli.js

Diff

commit 3c08671852d2dd44eb693406ce99d0f1ec3d6167
Author: Steve <steve@designerwallcoverings.com>
Date:   Tue Sep 22 14:50:34 2026 -0700

    verify: okStatuses now requires a paired bodyMustContain body proof to certify a key
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
    Claude-Session: https://claude.ai/code/session_01DP24DdLpG6PHXgmjr47TVb
---
 cli.js | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/cli.js b/cli.js
index 8296781..5fc3fe1 100755
--- a/cli.js
+++ b/cli.js
@@ -257,7 +257,14 @@ async function verifyToken(key, value) {
     // Anthropic-specific: 400 with "credit balance" means the key auth'd but the account is out of credits.
     // That's still a valid key; persist but flag with status.
     const creditOk = r.status === 400 && /credit balance|insufficient/i.test(r.body);
-    let httpOk = (r.status >= 200 && r.status < 300) || creditOk;
+    // Some providers auth the key but reject the probe's minimal body with a
+    // schema/validation status (e.g. typesafe.ai returns 422 "Field required"
+    // on an empty body while a bad key would 401). A route may whitelist such
+    // statuses via cfg.okStatuses, but okStatuses now REQUIRES a paired
+    // cfg.bodyMustContain to take effect — a whitelisted non-2xx status can
+    // never alone certify a key; the positive body proof must also match.
+    const okStatus = Array.isArray(cfg.okStatuses) && cfg.okStatuses.includes(r.status) && !!cfg.bodyMustContain;
+    let httpOk = (r.status >= 200 && r.status < 300) || creditOk || okStatus;
     // Body-content guards (e.g. Purelymail returns HTTP 200 + {"type":"error"} on bad token).
     // Cap the probe at 4096 bytes to bound regex worst-case.
     const probe = (r.body || '').slice(0, 4096);

← ceab226 Register DW_SESSION_SECRET route -> room-setting-app/.env.lo · back to Secrets Manager · routes: register BROWSERBASE_API_KEY + PROJECT_ID destinatio 542d9ff →