@anchrd/intel-api 0.6.0 → 0.6.1

package/dist/adapters/openid/openid.js

@@ -59,11 +59,25 @@ export function createOpenId(deps) {
             ...(insecure ? { execute: [client.allowInsecureRequests] } : {}),
         };
     }
+    // openid-client resolves issuer metadata via OIDC discovery unless told otherwise. Gate serves
+    // that document, but a plain OAuth 2.0 authorization server — the MCP portal on its custom
+    // domain is one — publishes only RFC 8414's oauth-authorization-server path and answers the OIDC
+    // one with a 404, which surfaced as a bare 500 on /auth/connect (#93). The fallback repeats the
+    // operation once with the OAuth document; when both fail, the second error is thrown because it
+    // belongs to the attempt that got further for the issuer that needed the fallback at all.
+    async function withAlgorithmFallback(run) {
+        try {
+            return await run();
+        }
+        catch {
+            return await run("oauth2");
+        }
+    }
     async function discover(issuer, clientId) {
         const key = `${issuer}#${clientId}`;
         let configuration = configurations.get(key);
         if (!configuration) {
-            configuration = client.discovery(new URL(issuer), clientId, { token_endpoint_auth_method: "none" }, client.None(), options(issuer));
+            configuration = withAlgorithmFallback((algorithm) => client.discovery(new URL(issuer), clientId, { token_endpoint_auth_method: "none" }, client.None(), { ...options(issuer), ...(algorithm ? { algorithm } : {}) }));
             configurations.set(key, configuration);
             void configuration.catch(() => configurations.delete(key));
         }
@@ -118,7 +132,7 @@ export function createOpenId(deps) {
             throw new Error("MCP resource did not publish valid OAuth metadata");
         },
         async register(input) {
-            const configuration = await client.dynamicClientRegistration(new URL(input.issuer), {
+            const configuration = await withAlgorithmFallback((algorithm) => client.dynamicClientRegistration(new URL(input.issuer), {
                 client_name: input.clientName,
                 redirect_uris: [input.redirectUri],
                 response_types: ["code"],
@@ -128,7 +142,7 @@ export function createOpenId(deps) {
                     : { scope: "openid profile email offline_access" }),
                 token_endpoint_auth_method: "none",
                 ...(isCloudflareAccess(input.issuer) ? { resource: input.resource } : {}),
-            }, client.None(), options(input.issuer));
+            }, client.None(), { ...options(input.issuer), ...(algorithm ? { algorithm } : {}) }));
             return configuration.clientMetadata().client_id;
         },
         async authorizationUrl(input) {

package/dist/auth/auth.js

@@ -1,5 +1,6 @@
 import { calculatePKCECodeChallenge, randomPKCECodeVerifier, randomState } from "openid-client";
 import { IntelError } from "../shared/intel-error/intel-error.js";
+import { reportUnexpectedError } from "../shared/report-unexpected-error/report-unexpected-error.js";
 import { SafeReturnPath } from "../shared/safe-return-path/safe-return-path.js";
 const cookieName = "intel_session";
 // What an authorization server answers when `prompt=none` would have worked, but only with somebody
@@ -54,11 +55,19 @@ export function createBrowserAuth(deps) {
         const stored = await deps.clients.get(registrationKey, redirectUri);
         if (stored)
             return stored;
-        const registered = await deps.oauth.register({
+        // A refused registration becomes a named state instead of a bare 500 (#93). The conversion
+        // must not eat the reason: an IntelError is an expected refusal nobody logs, so the library's
+        // own exception is written here — it is the only place that still holds it.
+        const registered = await deps.oauth
+            .register({
             issuer,
             redirectUri,
             clientName: "Intel",
             resource,
+        })
+            .catch((error) => {
+            reportUnexpectedError(error);
+            throw new IntelError(502, "client_registration_failed", "The authorization server refused the client registration");
         });
         return await deps.clients.put({
             issuer: registrationKey,

package/dist/http/http.js

@@ -4,6 +4,7 @@ import { z } from "zod";
 import { authorizeBearer, bearer, permits, } from "../shared/gate-authorization/gate-authorization.js";
 import { IntelError } from "../shared/intel-error/intel-error.js";
 import { problemDetails as problem } from "../shared/problem-details/problem-details.js";
+import { reportUnexpectedError } from "../shared/report-unexpected-error/report-unexpected-error.js";
 // A query string is a door to the outside like a body is, so what arrives through it is closed
 // rather than tolerated: `z.strictObject` refuses an unknown field, and this is that refusal for the
 // half of the input Zod never sees. A silently ignored parameter is how a caller believes it asked
@@ -64,6 +65,9 @@ export function createHttp(deps) {
         if (error instanceof z.ZodError) {
             return context.json(problem(400, "invalid_request", "Request validation failed", z.prettifyError(error)), 400);
         }
+        // Same rule as the outer app: an expected refusal explains itself, an unknown exception must
+        // leave a trace — otherwise the 500 is a fact without a reason anywhere (#93).
+        reportUnexpectedError(error);
         return context.json(problem(500, "internal_error", "Internal server error"), 500);
     });
     app.use("*", async (context, next) => {

package/dist/intel/intel.js

@@ -4,6 +4,7 @@ import { handleMcp } from "../mcp/mcp.js";
 import { authorize, authorizeBearer } from "../shared/gate-authorization/gate-authorization.js";
 import { IntelError } from "../shared/intel-error/intel-error.js";
 import { problemDetails } from "../shared/problem-details/problem-details.js";
+import { reportUnexpectedError } from "../shared/report-unexpected-error/report-unexpected-error.js";
 export function createIntel(deps) {
     const baseUrl = deps.baseUrl.replace(/\/+$/, "");
     const resource = `${baseUrl}/mcp`;
@@ -17,6 +18,10 @@ export function createIntel(deps) {
         if (error instanceof IntelError) {
             return context.json(problemDetails(error.status, error.code, error.message), error.status);
         }
+        // An IntelError is an expected refusal and explains itself; the unknown exception must leave a
+        // trace, or the 500 is undiagnosable — the worker answered, so the platform records no
+        // exception of its own (#93). The body stays generic: the log is the operator's channel.
+        reportUnexpectedError(error);
         return context.json(problemDetails(500, "internal_error", "Internal server error"), 500);
     });
     app.get("/health", (context) => context.json({ status: "ok" }));

package/dist/shared/report-unexpected-error/report-unexpected-error.d.ts

@@ -0,0 +1 @@
+export declare function reportUnexpectedError(error: unknown): void;

package/dist/shared/report-unexpected-error/report-unexpected-error.js

@@ -0,0 +1,37 @@
+// A library error can quote whatever the peer sent — an echoed Authorization header, a token in a
+// URL, a response body. The log must show the failure and never the credential, so everything
+// shaped like one is cut before the line is written. The patterns match shapes, not sources: a JWT
+// is recognizable on its own, and other tokens only ever appear behind their label.
+function redact(text) {
+    // ⚠️ The order is load-bearing: "Authorization: Bearer x" must hit the bearer rule first — a
+    // combined alternation would let the label rule win the leftmost match, swallow the word
+    // "Bearer" as the value, and leave the token itself standing.
+    return text
+        .replace(/\beyJ[\w-]{4,}\.[\w-]+\.[\w-]*/g, "[redacted]")
+        .replace(/\b(bearer\s+)[\w.~+/-]+=*/gi, "$1[redacted]")
+        .replace(/\b((?:access_token|refresh_token|id_token|client_secret|api_key|authorization)"?\s*[:=]\s*"?)[\w.~+/-]+=*/gi, "$1[redacted]");
+}
+function describe(error) {
+    if (error instanceof Error)
+        return error.stack ?? `${error.name}: ${error.message}`;
+    if (typeof error === "string")
+        return error;
+    try {
+        return JSON.stringify(error);
+    }
+    catch {
+        return String(error);
+    }
+}
+// openid-client wraps the informative part — the HTTP response, the OAuth error body — into
+// `cause`, so a log line without the cause chain would name the wrapper and hide the reason (#93).
+const MaxCauseDepth = 5;
+export function reportUnexpectedError(error) {
+    const parts = [];
+    let current = error;
+    for (let depth = 0; depth < MaxCauseDepth && current !== undefined; depth += 1) {
+        parts.push(describe(current));
+        current = current instanceof Error ? current.cause : undefined;
+    }
+    console.error(redact(parts.join("\ncaused by: ")));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anchrd/intel-api",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "type": "module",
   "license": "UNLICENSED",
   "repository": {