@anchrd/intel-api 0.6.0 → 0.6.2

package/dist/adapters/openid/openid.js

@@ -59,11 +59,25 @@ export function createOpenId(deps) {
             ...(insecure ? { execute: [client.allowInsecureRequests] } : {}),
         };
     }
+    // openid-client resolves issuer metadata via OIDC discovery unless told otherwise. Gate serves
+    // that document, but a plain OAuth 2.0 authorization server — the MCP portal on its custom
+    // domain is one — publishes only RFC 8414's oauth-authorization-server path and answers the OIDC
+    // one with a 404, which surfaced as a bare 500 on /auth/connect (#93). The fallback repeats the
+    // operation once with the OAuth document; when both fail, the second error is thrown because it
+    // belongs to the attempt that got further for the issuer that needed the fallback at all.
+    async function withAlgorithmFallback(run) {
+        try {
+            return await run();
+        }
+        catch {
+            return await run("oauth2");
+        }
+    }
     async function discover(issuer, clientId) {
         const key = `${issuer}#${clientId}`;
         let configuration = configurations.get(key);
         if (!configuration) {
-            configuration = client.discovery(new URL(issuer), clientId, { token_endpoint_auth_method: "none" }, client.None(), options(issuer));
+            configuration = withAlgorithmFallback((algorithm) => client.discovery(new URL(issuer), clientId, { token_endpoint_auth_method: "none" }, client.None(), { ...options(issuer), ...(algorithm ? { algorithm } : {}) }));
             configurations.set(key, configuration);
             void configuration.catch(() => configurations.delete(key));
         }
@@ -118,7 +132,7 @@ export function createOpenId(deps) {
             throw new Error("MCP resource did not publish valid OAuth metadata");
         },
         async register(input) {
-            const configuration = await client.dynamicClientRegistration(new URL(input.issuer), {
+            const configuration = await withAlgorithmFallback((algorithm) => client.dynamicClientRegistration(new URL(input.issuer), {
                 client_name: input.clientName,
                 redirect_uris: [input.redirectUri],
                 response_types: ["code"],
@@ -128,7 +142,7 @@ export function createOpenId(deps) {
                     : { scope: "openid profile email offline_access" }),
                 token_endpoint_auth_method: "none",
                 ...(isCloudflareAccess(input.issuer) ? { resource: input.resource } : {}),
-            }, client.None(), options(input.issuer));
+            }, client.None(), { ...options(input.issuer), ...(algorithm ? { algorithm } : {}) }));
             return configuration.clientMetadata().client_id;
         },
         async authorizationUrl(input) {

package/dist/adapters/session-cookie/session-cookie.js

@@ -30,6 +30,9 @@ const ConnectionPendingSession = z.strictObject({
     // Older cookies carry no `silent`, and one in flight across a deploy must not become an invalid
     // session: absent means the visible flow, which is what those attempts were.
     silent: z.boolean().default(false),
+    // Same for `resumed`: absent means a first attempt, so a handoff written before the deploy still
+    // gets its one restart rather than dying at the parser.
+    resumed: z.boolean().default(false),
     expiresAt: z.number().int().positive(),
 });
 const Session = z.discriminatedUnion("kind", [

package/dist/auth/auth.js

@@ -1,7 +1,16 @@
 import { calculatePKCECodeChallenge, randomPKCECodeVerifier, randomState } from "openid-client";
 import { IntelError } from "../shared/intel-error/intel-error.js";
+import { reportUnexpectedError } from "../shared/report-unexpected-error/report-unexpected-error.js";
 import { SafeReturnPath } from "../shared/safe-return-path/safe-return-path.js";
 const cookieName = "intel_session";
+// ⚠️ The cookie outlives the handoff on purpose. Ten minutes is right for something carrying a PKCE
+// verifier, but the portal's consent screen can stand open longer — it waits for every server to
+// connect, and a person steps away meanwhile. An expired handoff that is still *readable* tells the
+// callback what was being attempted, where the person wanted to go, and whether their Intel session
+// survived; a cookie that vanished with it leaves nothing but a raw error page (#95). `expiresAt`
+// remains the only authority — a stale verifier is never exchanged, no matter how long it is legible.
+const HandoffValidSeconds = 10 * 60;
+const HandoffCookieSeconds = 60 * 60;
 // What an authorization server answers when `prompt=none` would have worked, but only with somebody
 // looking at a screen. It is the expected answer to a silent attempt, not a broken deployment.
 const InteractionRequired = new Set([
@@ -10,12 +19,14 @@ const InteractionRequired = new Set([
     "consent_required",
     "account_selection_required",
 ]);
-// One fixed marker, never the portal's own words. `error_description` is a sentence written by the
+// Fixed markers, never the portal's own words. `error_description` is a sentence written by the
 // authorization server about somebody else's policy: putting it in the URL would hand whatever
-// renders the page next a string Intel does not control.
-function withConnectError(returnTo) {
+// renders the page next a string Intel does not control. Which marker matters — a refusal is about
+// access, running out of time is not, and a screen that confuses the two sends the reader hunting
+// in the wrong place (#93).
+function withConnectError(returnTo, code = "portal_sign_in_refused") {
     const url = new URL(returnTo, "https://intel.invalid");
-    url.searchParams.set("connectError", "portal_sign_in_refused");
+    url.searchParams.set("connectError", code);
     return `${url.pathname}${url.search}`;
 }
 function cookieValue(headers) {
@@ -54,11 +65,19 @@ export function createBrowserAuth(deps) {
         const stored = await deps.clients.get(registrationKey, redirectUri);
         if (stored)
             return stored;
-        const registered = await deps.oauth.register({
+        // A refused registration becomes a named state instead of a bare 500 (#93). The conversion
+        // must not eat the reason: an IntelError is an expected refusal nobody logs, so the library's
+        // own exception is written here — it is the only place that still holds it.
+        const registered = await deps.oauth
+            .register({
             issuer,
             redirectUri,
             clientName: "Intel",
             resource,
+        })
+            .catch((error) => {
+            reportUnexpectedError(error);
+            throw new IntelError(502, "client_registration_failed", "The authorization server refused the client registration");
         });
         return await deps.clients.put({
             issuer: registrationKey,
@@ -122,6 +141,7 @@ export function createBrowserAuth(deps) {
             // session is already the person the portal would ask about. `prompt=none` says exactly that:
             // answer from the session that exists, and refuse rather than show anybody a login (#60).
             const silent = requestUrl.searchParams.get("silent") === "1";
+            const resumed = requestUrl.searchParams.get("resumed") === "1";
             if (!deps.portalUrl) {
                 throw new IntelError(503, "portal_not_configured", "No MCP portal is configured for this deployment");
             }
@@ -143,7 +163,8 @@ export function createBrowserAuth(deps) {
                 userId,
                 user,
                 silent,
-                expiresAt: deps.now().getTime() + 10 * 60 * 1_000,
+                resumed,
+                expiresAt: deps.now().getTime() + HandoffValidSeconds * 1_000,
             };
             const authorizationUrl = await deps.oauth.authorizationUrl({
                 issuer: discovered.issuer,
@@ -155,13 +176,25 @@ export function createBrowserAuth(deps) {
                 ...(discovered.scope ? { scope: discovered.scope } : {}),
                 ...(silent ? { prompt: "none" } : {}),
             });
-            return redirect(authorizationUrl.href, sessionCookie(await deps.sessions.seal(pending), secure, 10 * 60));
+            return redirect(authorizationUrl.href, sessionCookie(await deps.sessions.seal(pending), secure, HandoffCookieSeconds));
         },
         async callback(requestUrl, headers) {
             const encoded = cookieValue(headers);
             const pending = encoded ? await deps.sessions.open(encoded) : null;
-            if ((pending?.kind !== "pending" && pending?.kind !== "connection-pending") ||
-                pending.expiresAt <= deps.now().getTime()) {
+            if (pending?.kind !== "pending" && pending?.kind !== "connection-pending") {
+                throw new IntelError(400, "oauth_session_invalid", "OAuth session is missing or expired");
+            }
+            // A handoff that ran out while somebody was still on the consent screen is not a failure they
+            // caused, and everything needed to carry on is in it: their parked Intel session and where
+            // they were going. `restore` decides which — it sends them back to the Gate login when that
+            // session is gone too, rather than into an attempt that could not finish (#95).
+            if (pending.kind === "connection-pending" && pending.expiresAt <= deps.now().getTime()) {
+                return await restore(pending.user, pending.returnTo, pending.resumed
+                    ? withConnectError(pending.returnTo, "portal_sign_in_expired")
+                    : `/auth/connect?returnTo=${encodeURIComponent(pending.returnTo)}&resumed=1`);
+            }
+            // The Gate login handoff parks nothing, so an expired one has nowhere to return to.
+            if (pending.expiresAt <= deps.now().getTime()) {
                 throw new IntelError(400, "oauth_session_invalid", "OAuth session is missing or expired");
             }
             // ⚠️ An authorization server reports a refusal on the redirect URI, not by failing the token

package/dist/auth/auth.types.d.ts

@@ -78,6 +78,7 @@ export type AuthSession = {
     userId: string;
     user: UserAuthSession;
     silent: boolean;
+    resumed: boolean;
     expiresAt: number;
 } | UserAuthSession;
 export interface SessionCodec {

package/dist/http/http.js

@@ -4,6 +4,7 @@ import { z } from "zod";
 import { authorizeBearer, bearer, permits, } from "../shared/gate-authorization/gate-authorization.js";
 import { IntelError } from "../shared/intel-error/intel-error.js";
 import { problemDetails as problem } from "../shared/problem-details/problem-details.js";
+import { reportUnexpectedError } from "../shared/report-unexpected-error/report-unexpected-error.js";
 // A query string is a door to the outside like a body is, so what arrives through it is closed
 // rather than tolerated: `z.strictObject` refuses an unknown field, and this is that refusal for the
 // half of the input Zod never sees. A silently ignored parameter is how a caller believes it asked
@@ -64,6 +65,9 @@ export function createHttp(deps) {
         if (error instanceof z.ZodError) {
             return context.json(problem(400, "invalid_request", "Request validation failed", z.prettifyError(error)), 400);
         }
+        // Same rule as the outer app: an expected refusal explains itself, an unknown exception must
+        // leave a trace — otherwise the 500 is a fact without a reason anywhere (#93).
+        reportUnexpectedError(error);
         return context.json(problem(500, "internal_error", "Internal server error"), 500);
     });
     app.use("*", async (context, next) => {

package/dist/intel/intel.js

@@ -4,6 +4,7 @@ import { handleMcp } from "../mcp/mcp.js";
 import { authorize, authorizeBearer } from "../shared/gate-authorization/gate-authorization.js";
 import { IntelError } from "../shared/intel-error/intel-error.js";
 import { problemDetails } from "../shared/problem-details/problem-details.js";
+import { reportUnexpectedError } from "../shared/report-unexpected-error/report-unexpected-error.js";
 export function createIntel(deps) {
     const baseUrl = deps.baseUrl.replace(/\/+$/, "");
     const resource = `${baseUrl}/mcp`;
@@ -17,6 +18,10 @@ export function createIntel(deps) {
         if (error instanceof IntelError) {
             return context.json(problemDetails(error.status, error.code, error.message), error.status);
         }
+        // An IntelError is an expected refusal and explains itself; the unknown exception must leave a
+        // trace, or the 500 is undiagnosable — the worker answered, so the platform records no
+        // exception of its own (#93). The body stays generic: the log is the operator's channel.
+        reportUnexpectedError(error);
         return context.json(problemDetails(500, "internal_error", "Internal server error"), 500);
     });
     app.get("/health", (context) => context.json({ status: "ok" }));

package/dist/shared/report-unexpected-error/report-unexpected-error.d.ts

@@ -0,0 +1 @@
+export declare function reportUnexpectedError(error: unknown): void;

package/dist/shared/report-unexpected-error/report-unexpected-error.js

@@ -0,0 +1,37 @@
+// A library error can quote whatever the peer sent — an echoed Authorization header, a token in a
+// URL, a response body. The log must show the failure and never the credential, so everything
+// shaped like one is cut before the line is written. The patterns match shapes, not sources: a JWT
+// is recognizable on its own, and other tokens only ever appear behind their label.
+function redact(text) {
+    // ⚠️ The order is load-bearing: "Authorization: Bearer x" must hit the bearer rule first — a
+    // combined alternation would let the label rule win the leftmost match, swallow the word
+    // "Bearer" as the value, and leave the token itself standing.
+    return text
+        .replace(/\beyJ[\w-]{4,}\.[\w-]+\.[\w-]*/g, "[redacted]")
+        .replace(/\b(bearer\s+)[\w.~+/-]+=*/gi, "$1[redacted]")
+        .replace(/\b((?:access_token|refresh_token|id_token|client_secret|api_key|authorization)"?\s*[:=]\s*"?)[\w.~+/-]+=*/gi, "$1[redacted]");
+}
+function describe(error) {
+    if (error instanceof Error)
+        return error.stack ?? `${error.name}: ${error.message}`;
+    if (typeof error === "string")
+        return error;
+    try {
+        return JSON.stringify(error);
+    }
+    catch {
+        return String(error);
+    }
+}
+// openid-client wraps the informative part — the HTTP response, the OAuth error body — into
+// `cause`, so a log line without the cause chain would name the wrapper and hide the reason (#93).
+const MaxCauseDepth = 5;
+export function reportUnexpectedError(error) {
+    const parts = [];
+    let current = error;
+    for (let depth = 0; depth < MaxCauseDepth && current !== undefined; depth += 1) {
+        parts.push(describe(current));
+        current = current instanceof Error ? current.cause : undefined;
+    }
+    console.error(redact(parts.join("\ncaused by: ")));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anchrd/intel-api",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "type": "module",
   "license": "UNLICENSED",
   "repository": {