[kilo-code-bot]

Summary

Five near-identical bounded JSON-body readers in services/git-token-service each re-implemented the same security-critical logic: enforce a byte cap while reading, validate that every chunk is a Uint8Array, cancel the stream and fail closed when the cap is exceeded, and strict UTF-8 decode before JSON.parse.

• src/index.ts — readBoundedInternalJsonRequest
• src/bitbucket-api.ts — readBoundedJson
• src/bitbucket-code-review-service.ts — readBoundedJson
• src/gitlab-oauth-credential-refresher.ts — readBoundedJson
• src/gitlab-runtime-token-resolver.ts — readBoundedProjectIdentity

These copies had already drifted (differing reader.cancel() error handling, differing Uint8Array chunk guards, differing byte-cap constants and decode paths), so a fix to one would not reliably propagate to the others.

Change

Introduce src/lib/bounded-read.ts with:

• readBoundedJsonBody(stream, maxBytes) — bounded read + strict UTF-8 decode + JSON.parse
• ResponseTooLargeError — the single signal callers use to distinguish overflow from other failures

Each caller becomes a thin adapter that keeps its own error type (BitbucketApiError, BitbucketCodeReviewProviderError, Error, or a null return) and pre-flight Content-Length/Content-Type checks. No runtime behavior changes: overflow still fails closed, invalid chunks still reject, and AbortSignal timeouts in bitbucket-api still map to request_timed_out.

Net: 157 lines deleted, 22 added across callers plus one 51-line module.

Verification

• pnpm --filter cloudflare-git-token-service typecheck — clean
• pnpm -w exec oxlint ... on changed files — 0 errors
• pnpm --filter cloudflare-git-token-service test — 24 files, 662 tests passed

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (6 files)

• services/git-token-service/src/lib/bounded-read.ts
• services/git-token-service/src/bitbucket-api.ts
• services/git-token-service/src/bitbucket-code-review-service.ts
• services/git-token-service/src/gitlab-oauth-credential-refresher.ts
• services/git-token-service/src/gitlab-runtime-token-resolver.ts
• services/git-token-service/src/index.ts

Verified the consolidated readBoundedBytes/readBoundedJsonBody reproduces each caller's original behavior: per-chunk Uint8Array guard, byte-cap enforcement with reader.cancel() before failing closed, releaseLock() in finally, and strict UTF-8 decode before JSON.parse. Each caller keeps its own error mapping (response_too_large, invalid_response, request_timed_out, or null), and the pre-flight Content-Length/Content-Type checks are preserved. No further duplicate getReader()/TextDecoder call sites remain in the service.

---

_{Reviewed by deepseek-v4.1-flash · Input: 67.3K · Output: 16.9K · Cached: 600.7K}

_{Review guidance: REVIEW.md from base branch main}

[eshurakov]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Independently reviewed head 19b83ebbae7655a959f220b123ce6c7c09a9fe11 against base 7b6d23c90b7291238dbdced8d444ac08fd91762c, including all changed files and callers. No major correctness, security, or resource-handling issues found: byte limits, overflow cancellation, reader lock release, strict UTF-8/JSON parsing, and caller error sanitization remain fail closed.

Verification: 280 in-memory assertions comparing pinned base/head readers, eight production-cap boundary checks, and mid-read abort handling passed. CI logs confirm 24 test files / 662 tests passed and service typechecking succeeded; lint, format, and security checks are green. Existing review/discussion inspected. Limitation: focused execution and existing unit tests use Node, not Workerd; no local full-suite or deployment validation.

Files Reviewed (6 files)

• services/git-token-service/src/lib/bounded-read.ts
• services/git-token-service/src/bitbucket-api.ts
• services/git-token-service/src/bitbucket-code-review-service.ts
• services/git-token-service/src/gitlab-oauth-credential-refresher.ts
• services/git-token-service/src/gitlab-runtime-token-resolver.ts
• services/git-token-service/src/index.ts