fix: scope ZoomMate cookies by host

Author: steipete

Sources/CodexBarCore/Providers/ZoomMate/ZoomMateBearerTokenCache.swift

@@ -12,7 +12,7 @@ import Crypto
 /// lets a still-valid token be reused across refreshes instead.
 ///
 /// Safety properties (why reuse can't serve a bad token):
-///   - Entries are keyed by a non-reversible SHA-256 of the originating cookie header, so distinct
+///   - Entries are keyed by a non-reversible SHA-256 of the originating host-scoped cookie headers, so distinct
 ///     browser sessions / accounts never collide and the raw cookies are never stored as a key.
 ///   - A token is cached *only* when its JWT carries a decodable `exp` claim, and is served only
 ///     while `now < exp - refreshSkew`. A token whose expiry cannot be determined is never cached
@@ -36,9 +36,10 @@ actor ZoomMateBearerTokenCache {
 
     private var entries: [String: Entry] = [:]
 
-    /// Non-reversible cache key for a cookie session. SHA-256 hex of the raw cookie header.
-    static func key(forCookieHeader cookieHeader: String) -> String {
-        let digest = SHA256.hash(data: Data(cookieHeader.utf8))
+    /// Non-reversible cache key for a cookie session. SHA-256 hex of its canonical host map.
+    static func key(forCookieHeaders cookieHeaders: ZoomMateCookieHeaders) -> String {
+        let canonical = cookieHeaders.encodedForStorage() ?? ""
+        let digest = SHA256.hash(data: Data(canonical.utf8))
         return digest.map { String(format: "%02x", $0) }.joined()
     }
 

Sources/CodexBarCore/Providers/ZoomMate/ZoomMateCookieImporter.swift

@@ -3,6 +3,46 @@ import Foundation
 import SweetCookieKit
 #endif
 
+/// Cookie headers narrowed to ZoomMate's fixed request hosts. Keeping the destination in the
+/// credential value makes it impossible for host failover to reuse a leaf-host cookie on its
+/// sibling host.
+public struct ZoomMateCookieHeaders: Codable, Equatable, Sendable {
+    static let allowedHosts = ["ai.zoom.us", "zoommate.zoom.us"]
+
+    private let headersByHost: [String: String]
+
+    public init(headersByHost: [String: String]) {
+        self.headersByHost = Dictionary(uniqueKeysWithValues: Self.allowedHosts.compactMap { host in
+            guard let header = headersByHost[host]?.trimmingCharacters(in: .whitespacesAndNewlines),
+                  !header.isEmpty
+            else {
+                return nil
+            }
+            return (host, header)
+        })
+    }
+
+    public func header(forHost host: String) -> String? {
+        self.headersByHost[host.lowercased()]
+    }
+
+    public var isEmpty: Bool {
+        self.headersByHost.isEmpty
+    }
+
+    func encodedForStorage() -> String? {
+        let encoder = JSONEncoder()
+        encoder.outputFormatting = [.sortedKeys]
+        guard let data = try? encoder.encode(self) else { return nil }
+        return String(data: data, encoding: .utf8)
+    }
+
+    static func decodeFromStorage(_ value: String) -> Self? {
+        guard let data = value.data(using: .utf8) else { return nil }
+        return try? JSONDecoder().decode(Self.self, from: data)
+    }
+}
+
 #if os(macOS)
 private let zoomMateCookieImportOrder: BrowserCookieImportOrder =
     ProviderDefaults.metadata[.zoommate]?.browserCookieOrder ?? Browser.defaultImportOrder
@@ -19,17 +59,12 @@ public enum ZoomMateCookieImporter {
     /// then narrowed at send time by `isSendable(toSessionHosts:)`.
     private static let cookieDomains = ["zoommate.zoom.us", "ai.zoom.us", "zoom.us"]
 
-    /// Hosts whose cookies the fetchers actually transmit (the login-bootstrap and credits calls
-    /// hit `ai.zoom.us`; the browser session lives on both). Used to drop cookies that a browser
-    /// would never attach to these requests — see `isSendable(cookieDomain:)`.
-    private static let sessionHosts = ["ai.zoom.us", "zoommate.zoom.us"]
-
     public struct SessionInfo: Sendable {
-        public let cookieHeader: String
+        public let cookieHeaders: ZoomMateCookieHeaders
         public let sourceLabel: String
 
-        public init(cookieHeader: String, sourceLabel: String) {
-            self.cookieHeader = cookieHeader
+        public init(cookieHeaders: ZoomMateCookieHeaders, sourceLabel: String) {
+            self.cookieHeaders = cookieHeaders
             self.sourceLabel = sourceLabel
         }
     }
@@ -58,11 +93,10 @@ public enum ZoomMateCookieImporter {
                     logger: log)
                 for source in sources where !source.records.isEmpty {
                     let cookies = BrowserCookieClient.makeHTTPCookies(source.records, origin: query.origin)
-                        .filter { Self.isSendable(cookieDomain: $0.domain) }
-                    guard !cookies.isEmpty else { continue }
-                    log("\(source.label): found \(cookies.count) matching cookies")
-                    let header = cookies.map { "\($0.name)=\($0.value)" }.joined(separator: "; ")
-                    sessions.append(SessionInfo(cookieHeader: header, sourceLabel: source.label))
+                    let cookieHeaders = Self.cookieHeaders(from: cookies)
+                    guard !cookieHeaders.isEmpty else { continue }
+                    log("\(source.label): found host-scoped cookie headers")
+                    sessions.append(SessionInfo(cookieHeaders: cookieHeaders, sourceLabel: source.label))
                 }
             } catch {
                 BrowserCookieAccessGate.recordIfNeeded(error)
@@ -74,19 +108,31 @@ public enum ZoomMateCookieImporter {
         return sessions
     }
 
-    /// Whether a browser would attach a cookie scoped to `cookieDomain` to a request to one of
-    /// `sessionHosts`, per RFC 6265 domain-matching: a host-only cookie matches its exact host; a
+    /// Whether a browser would attach a cookie scoped to `cookieDomain` to a request to `host`, per
+    /// RFC 6265 domain-matching: a host-only cookie matches its exact host; a
     /// domain cookie (stored with a leading dot) matches that host and all of its subdomains. This
-    /// keeps the parent `.zoom.us` SSO cookies the endpoints need while dropping cookies host-scoped
-    /// to unrelated `*.zoom.us` siblings (marketing/support/web) swept in by the coarse `.contains`
-    /// domain read above — cookies those endpoints would never receive.
-    static func isSendable(cookieDomain: String) -> Bool {
-        let bare = cookieDomain.hasPrefix(".") ? String(cookieDomain.dropFirst()) : cookieDomain
-        let normalized = bare.lowercased()
-        guard !normalized.isEmpty else { return false }
-        return self.sessionHosts.contains { host in
-            host == normalized || host.hasSuffix("." + normalized)
+    /// keeps parent `.zoom.us` SSO cookies while preventing an `ai.zoom.us` host-only cookie from
+    /// reaching `zoommate.zoom.us` (and vice versa).
+    static func isSendable(cookieDomain: String, toHost host: String) -> Bool {
+        let normalizedDomain = cookieDomain.lowercased()
+        let normalizedHost = host.lowercased()
+        guard ZoomMateCookieHeaders.allowedHosts.contains(normalizedHost), !normalizedDomain.isEmpty else {
+            return false
+        }
+        guard normalizedDomain.hasPrefix(".") else { return normalizedHost == normalizedDomain }
+        let bareDomain = String(normalizedDomain.dropFirst())
+        guard !bareDomain.isEmpty else { return false }
+        return normalizedHost == bareDomain || normalizedHost.hasSuffix("." + bareDomain)
+    }
+
+    static func cookieHeaders(from cookies: [HTTPCookie]) -> ZoomMateCookieHeaders {
+        let pairs: [(String, String)] = ZoomMateCookieHeaders.allowedHosts.compactMap { host in
+            let sendable = cookies.filter { Self.isSendable(cookieDomain: $0.domain, toHost: host) }
+            guard !sendable.isEmpty else { return nil }
+            let header = sendable.map { "\($0.name)=\($0.value)" }.joined(separator: "; ")
+            return (host, header)
         }
+        return ZoomMateCookieHeaders(headersByHost: Dictionary(uniqueKeysWithValues: pairs))
     }
 }
 #endif

Sources/CodexBarCore/Providers/ZoomMate/ZoomMateCreditsHistoryFetcher.swift

@@ -110,7 +110,9 @@ public struct ZoomMateCreditsHistoryFetcher: Sendable {
     {
         // The whole pagination loop fails over as a unit so all pages of one snapshot come from
         // the same host.
-        try await ZoomMateUsageFetcher.withAPIHostFailover { host in
+        try await ZoomMateUsageFetcher.withAPIHostFailover(
+            hosts: ZoomMateUsageFetcher.hosts(preferred: context.preferredHost))
+        { host in
             var allRecords: [ZoomMateCreditHistoryRecord] = []
             var page = 0
             var total = Int.max
@@ -184,6 +186,9 @@ public struct ZoomMateCreditsHistoryFetcher: Sendable {
         for (name, value) in pageRequest.context.headers {
             request.setValue(value, forHTTPHeaderField: name)
         }
+        request.setValue(
+            pageRequest.context.cookieHeaders.header(forHost: pageRequest.host),
+            forHTTPHeaderField: "Cookie")
         request.setValue(pageRequest.context.authorization, forHTTPHeaderField: "Authorization")
         request.setValue(self.refererURL.absoluteString, forHTTPHeaderField: "Origin")
         request.setValue(self.refererURL.absoluteString, forHTTPHeaderField: "Referer")
@@ -217,7 +222,9 @@ public struct ZoomMateCreditsHistoryFetcher: Sendable {
     private static func parseRecordTime(_ text: String) -> Date? {
         let withFractional = ISO8601DateFormatter()
         withFractional.formatOptions = [.withInternetDateTime, .withFractionalSeconds]
-        if let date = withFractional.date(from: text) { return date }
+        if let date = withFractional.date(from: text) {
+            return date
+        }
         let plain = ISO8601DateFormatter()
         plain.formatOptions = [.withInternetDateTime]
         return plain.date(from: text)