[daliu]

The two Strava OAuth token paths now reject oversized or malformed native response bodies before JSON parsing or persistence, while preserving their existing fixed public outcomes.

Closes #614
Parent: #88

Change

• Read authorization-exchange and refresh JSON only from exact native Node Response/Headers/ReadableStream objects through captured native methods.
• Enforce 65,536 content-decoded bytes and 4,096 chunks before copying, with actual streamed bytes authoritative even when Content-Length is absent or false-low.
• Cancel unfinished failures best-effort without waiting, logging, or exposing cleanup errors; decode fatal UTF-8 and parse only after EOF.
• Keep bounded invalid schemas on the existing fixed internal path and transport/decode/parse failures on the existing fixed unavailable path.
• Preserve one-use authorization state, prevent token/connection writes after exchange-body failure, and preserve the old refresh secret with no CAS or bearer request after refresh-body failure.
• Retain impossible-JSON Proxy/accessor/projector tests through a frozen seam that functions/index.js does not export.
• Record the exact current-source and residual boundary in SECURITY.md.

Trustworthy RED

Exact base 644d9f1fe3e6c06427412fd3ae37973dbbfeca20; minimal test-only binary diff SHA-256 94dc7e995384a8398d918e688fb2690920d20a5d541a55a52c8ff399eec6f813.

Node 20 focused result on that base: 1 failed / 721 skipped / 722 total. The old implementation consumed both native stream chunks (65,536 + 1 bytes), did not cancel, returned success, and made both writes. The strengthened witness requires the same two pulls, one cancellation, fixed unavailable, consumed state, and zero writes. Evidence: #614 (comment)

Verification

• Node 20 focused OAUTH-001A2K: 45 passed / 721 skipped / 766 total.
• Node 20 full strava.test.js: 766 passed.
• Node 20 full Functions: 69 suites passed / 7,569 tests passed / 64 skipped.
• Functions ESLint: passed.
• Static workflow, release, Firebase verification, artifact-safety, and root dependency-security suite: 93 passed.
• Frontend reviewed lint baseline: 118 files / 113 legacy errors / 6 legacy warnings, exact baseline passed.
• git diff --check: passed.
• Root audit unchanged: 59 total (23 high, 23 moderate, 13 low); production tree 4 total (1 high, 2 moderate, 1 low).
• Functions audit unchanged: 8 moderate in both all and production trees.
• No dependency or lockfile changed; no forced upgrade applied.

Independent runtime, exact-diff, test-quality, privacy/logging, documentation, and backup-officer reviews found no remaining STOP after one inaccurate test title was corrected and re-reviewed.

Residual risk

This ceiling covers only content-decoded chunks consumed here. It does not bound headers, compressed wire bytes, Undici buffering, one already-allocated chunk, parsed-object heap growth, CPU, or request/connect/read time. Cancellation cannot undo an exchange or token rotation; lost acknowledgement still requires reconciliation and must not be retried blindly. Activities/statistics body limits and sibling cleanup remain a separate unclaimed #88 child. Scope/account policy, refresh/revoke reconciliation, audit, IAM/encryption, deployment, provider configuration, production data, and live proof remain open.

Officer impact: None — this server-only guard preserves the existing member-visible success and fixed failure states while bounding OAuth token-response memory before parsing.

Officer documentation: None — no officer task, page structure, data route, permission, account ownership, deployment procedure, or visible wording changed. Existing source-only Strava guidance remains current.

Deployment evidence: Source commit 165934dee32ecc1daaafb596bab16160ff52e6b0 is pushed and local tests passed. Code is not yet merged. No website publication or runmprc.com revision is claimed. Firebase was not deployed. No Strava or outside-provider configuration/action occurred. No production data was read or changed. Production/live behavior was not tested or verified.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	165934d
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a6f038b9701b00008066000
😎 Deploy Preview	https://deploy-preview-615--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[daliu]

SELF-REVIEW / EXACT-HEAD RELEASE GATE: GO

Exact head 165934dee32ecc1daaafb596bab16160ff52e6b0; base 644d9f1fe3e6c06427412fd3ae37973dbbfeca20; tree 3683a9ccb982b6a2bb1c67a8e0fd27a86f38bcc9; binary base-to-head diff SHA-256 0ca738c94f25e8ba7507d28e40b5fc3410f32774288afba12d0721540c1c2433.

Independent exact-head runtime/resource-lifecycle, test-quality/reliability, security/scope, privacy/logging, documentation, and backup-officer reviews found no remaining STOP. One inaccurate refactored test title was corrected before commit and independently re-reviewed. Worktree and diff check are clean; scope is exactly SECURITY.md, functions/strava.js, and functions/strava.test.js.

Hosted CI run 30740379852 passed all five GitHub jobs. Netlify preview deploy 6a6f038b9701b00008066000 is ready for exact head; page-change result is neutral because no site file changed, and published_at is null. This is preview/source evidence only.

No code is merged by this comment. No Firebase deployment, production website publication, runmprc.com revision verification, Strava/provider configuration/action, production-data read/write, or live OAuth behavior is claimed.

[daliu]

COMPLETE / MERGED / CLAIM RELEASED

Reviewed head 165934dee32ecc1daaafb596bab16160ff52e6b0 merged as exact main b94622bd42775d84704d5fc05ee87da81f5a76e0; both have tree 3683a9ccb982b6a2bb1c67a8e0fd27a86f38bcc9. PR CI 30740379852 and exact-main CI 30740495924 each passed all five GitHub jobs. All exact-head release reviews were GO.

Deployment evidence: exact-head Netlify preview 6a6f038b9701b00008066000 is ready but unpublished. No site file changed, no release workflow ran, and exact-main GitHub deployments are []. No website publication, runmprc.com revision, Firebase deployment, Strava/provider action, production-data action, checkout/payment change, or live behavior is claimed. The queued exact-main Netlify/GitHub Pages suites had zero check runs at audit time and are not publication evidence.

Officer impact: None — existing visible success/failure states are preserved.

Officer documentation: None — this is a server-only provider-body containment with no officer procedure or visible surface change; SECURITY.md records the boundary and residuals.

Issue #614 closure and full local/hosted evidence: #614 (comment)

COMPLETE / CLOSED / CLAIM RELEASED at b94622bd42775d84704d5fc05ee87da81f5a76e0.