fix: ignore invalid empty or undefined idempotency tokens and fallback to generating a UUID

Author: thiyaguk09

handwritten/storage/src/nodejs-common/service.ts

@@ -273,8 +273,10 @@ export class Service {
     const userTokenKey = Object.keys(headers).find(
       key => key.toLowerCase() === 'x-goog-gcs-idempotency-token'
     );
-    const idempotencyToken = userTokenKey
-      ? (headers[userTokenKey] as string)
+    const userTokenValue = userTokenKey ? headers[userTokenKey] : undefined;
+    const hasValidUserToken = typeof userTokenValue === 'string' && userTokenValue;
+    const idempotencyToken = hasValidUserToken
+      ? (userTokenValue as string)
       : crypto.randomUUID();
     reqOpts.headers = {
       ...headers,
@@ -283,7 +285,7 @@ export class Service {
         pkg.version
       }-${getModuleFormat()} gccl-invocation-id/${idempotencyToken}`,
     };
-    if (!userTokenKey) {
+    if (!hasValidUserToken) {
       reqOpts.headers['x-goog-gcs-idempotency-token'] = idempotencyToken;
     }
 

handwritten/storage/src/resumable-upload.ts

@@ -813,8 +813,10 @@ export class Upload extends Writable {
     const userTokenKey = Object.keys(this.customRequestOptions?.headers || {}).find(
       key => key.toLowerCase() === 'x-goog-gcs-idempotency-token'
     );
-    if (userTokenKey) {
-      this.currentInvocationId.uri = this.customRequestOptions?.headers?.[userTokenKey] as string;
+    const userTokenValue = userTokenKey ? this.customRequestOptions?.headers?.[userTokenKey] : undefined;
+    const hasValidUserToken = typeof userTokenValue === 'string' && userTokenValue;
+    if (hasValidUserToken) {
+      this.currentInvocationId.uri = userTokenValue as string;
     }
 
     let googAPIClient = `${getRuntimeTrackingString()} gccl/${
@@ -844,7 +846,7 @@ export class Upload extends Writable {
       },
     };
 
-    if (!userTokenKey) {
+    if (!hasValidUserToken) {
       reqOpts.headers!['x-goog-gcs-idempotency-token'] = this.currentInvocationId.uri;
     }
 
@@ -1013,8 +1015,10 @@ export class Upload extends Writable {
     const userTokenKey = Object.keys(this.customRequestOptions?.headers || {}).find(
       key => key.toLowerCase() === 'x-goog-gcs-idempotency-token'
     );
-    if (userTokenKey) {
-      this.currentInvocationId.chunk = this.customRequestOptions?.headers?.[userTokenKey] as string;
+    const userTokenValue = userTokenKey ? this.customRequestOptions?.headers?.[userTokenKey] : undefined;
+    const hasValidUserToken = typeof userTokenValue === 'string' && userTokenValue;
+    if (hasValidUserToken) {
+      this.currentInvocationId.chunk = userTokenValue as string;
     }
 
     let googAPIClient = `${getRuntimeTrackingString()} gccl/${
@@ -1032,7 +1036,7 @@ export class Upload extends Writable {
       'x-goog-api-client': googAPIClient,
     };
 
-    if (!userTokenKey) {
+    if (!hasValidUserToken) {
       headers['x-goog-gcs-idempotency-token'] = this.currentInvocationId.chunk;
     }
 
@@ -1238,8 +1242,10 @@ export class Upload extends Writable {
     const userTokenKey = Object.keys(this.customRequestOptions?.headers || {}).find(
       key => key.toLowerCase() === 'x-goog-gcs-idempotency-token'
     );
-    if (userTokenKey) {
-      this.currentInvocationId.checkUploadStatus = this.customRequestOptions?.headers?.[userTokenKey] as string;
+    const userTokenValue = userTokenKey ? this.customRequestOptions?.headers?.[userTokenKey] : undefined;
+    const hasValidUserToken = typeof userTokenValue === 'string' && userTokenValue;
+    if (hasValidUserToken) {
+      this.currentInvocationId.checkUploadStatus = userTokenValue as string;
     }
 
     let googAPIClient = `${getRuntimeTrackingString()} gccl/${
@@ -1263,7 +1269,7 @@ export class Upload extends Writable {
       },
     };
 
-    if (!userTokenKey) {
+    if (!hasValidUserToken) {
       opts.headers!['x-goog-gcs-idempotency-token'] = this.currentInvocationId.checkUploadStatus;
     }
 

handwritten/storage/test/nodejs-common/service.ts

@@ -536,6 +536,33 @@ describe('Service', () => {
       service.request_(customReqOpts, assert.ifError);
     });
 
+    it('should ignore invalid user-provided idempotency tokens and fallback to generating a UUID', done => {
+      const customReqOpts = {
+        ...reqOpts,
+        headers: {
+          'X-Goog-Gcs-Idempotency-Token': undefined as unknown as string,
+        },
+      };
+
+      service.makeAuthenticatedRequest = (reqOpts: DecorateRequestOptions) => {
+        const pkg = service.packageJson;
+        const r = new RegExp(
+          `^gl-node/${process.versions.node} gccl/${pkg.version
+          }-${getModuleFormat()} gccl-invocation-id/(?<gcclInvocationId>[^W]+)$`
+        );
+        const match = r.exec(reqOpts.headers!['x-goog-api-client']);
+        assert.ok(match);
+        const invocationId = match.groups!.gcclInvocationId;
+
+        // Verify a fallback token was generated and matches the invocation ID
+        const idempotencyToken = reqOpts.headers!['x-goog-gcs-idempotency-token'];
+        assert.strictEqual(idempotencyToken, invocationId);
+        done();
+      };
+
+      service.request_(customReqOpts, assert.ifError);
+    });
+
     it('should add the `gccl-gcs-cmd` to the api-client header when provided', done => {
       const expected = 'example.expected/value';
       service.makeAuthenticatedRequest = (reqOpts: DecorateRequestOptions) => {

handwritten/storage/test/resumable-upload.ts

@@ -915,6 +915,29 @@ describe('resumable-upload', () => {
       await up.createURI();
     });
 
+    it('should ignore invalid user-provided idempotency tokens and fallback to generating a UUID in createURI', async () => {
+      up.customRequestOptions = {
+        headers: {
+          'X-Goog-Gcs-Idempotency-Token': '', // invalid empty string
+        },
+      };
+
+      up.authClient.request = async (combinedReqOpts: GaxiosOptions) => {
+        assert(combinedReqOpts.headers);
+        const apiClientHeader = combinedReqOpts.headers['x-goog-api-client'];
+        const match = X_GOOG_API_HEADER_REGEX.exec(apiClientHeader as string);
+        assert.ok(match);
+        const invocationId = match.groups!.gcclInvocationId;
+        
+        // Verify a fallback token was generated and matches the invocation ID
+        const idempotencyToken = combinedReqOpts.headers['x-goog-gcs-idempotency-token'];
+        assert.strictEqual(idempotencyToken, invocationId);
+        return {headers: {location: '/foo'}};
+      };
+
+      await up.createURI();
+    });
+
     it('should reuse the same x-goog-gcs-idempotency-token on retry of createURI', async () => {
       let invocationCount = 0;
       let token1 = '';