@cloudgrid-io/mcp 0.21.12 → 0.21.14

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloudgrid-io/mcp",
-  "version": "0.21.12",
+  "version": "0.21.14",
   "description": "MCP access to CloudGrid — the live runtime environment where the user's apps run WITH the infrastructure they need out of the box: managed MongoDB, Redis (cache/queues/pub-sub), a pgvector store, persistent disk, and built-in AI with no API keys, in any language or stack, no Docker or Kubernetes to manage. Brainstorm, build, plug, and improve apps, games, dashboards, and tools; instant single-page publishes and full runtime-app deploys with a live URL — for developers and non-technical users. Three editions: local stdio (full toolset), hosted web (light, CLI-free), and a public docs-search server.",
   "type": "module",
   "bin": {
@@ -73,6 +73,7 @@
     "test:web-restart-recovery": "node --test test/web-restart-recovery.test.mjs",
     "test:oauth-client-persistence": "node --test test/oauth-client-persistence.test.mjs",
     "test:oauth-token-exchange": "node --test test/oauth-token-exchange.test.mjs",
+    "test:oauth-observability": "node --test test/oauth-flow-observability.test.mjs",
     "test:web-capabilities-log": "node --test test/web-capabilities-log.test.mjs",
     "test:internal-refs": "node --test test/no-internal-refs.test.mjs",
     "test:login-app": "node test/login-app.test.mjs",

package/src/auth.js

@@ -45,8 +45,23 @@ export function newLoginCode() {
 }
 
 // The sign-in URL the user opens in a browser — always the public host.
+//
+// Two independent params, matching what the CLI sends (cloudgrid packages/cli
+// commands/login.ts, #2979):
+//
+//   source=mcp        signup ATTRIBUTION. Stamped as `signup_source` on the
+//                     user row, and only when this login CREATES the user.
+//   arrival=ai_tool   the onboarding PATH selector. Nothing to do with source.
+//
+// `arrival` is sent explicitly rather than left to the server. The API defaults
+// a missing arrival to `website`, which is the seven-screen browser onboarding
+// instead of the two-screen path that ends back in the tool — that default is
+// exactly what bit the CLI before #2979 added it there. The API does currently
+// infer `ai_tool` for source=mcp, so this changes nothing observable today; it
+// stops the flow depending on an inference we do not own and would not notice
+// losing.
 export function buildLoginUrl(code) {
-  return `${PUBLIC_API_BASE}/auth/login?code=${encodeURIComponent(code)}&source=mcp`;
+  return `${PUBLIC_API_BASE}/auth/login?code=${encodeURIComponent(code)}&source=mcp&arrival=ai_tool`;
 }
 
 const CERT_ERROR_GUIDANCE =

package/src/oauth.js

@@ -33,6 +33,31 @@ function b64url(buf) {
   return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 
+// Observability helpers (#345). The OAuth flow was only observable on the paths
+// it did NOT take — a refused token exchange logs (denyToken), but a successful
+// one and the authorize arrival logged nothing, so "no log line" meant both
+// "never happened" and "worked fine". These emit SHAPE and PRESENCE, never
+// values: this is an auth path and a log aggregator is not private. See the
+// issue's redaction list — code, verifier, code_challenge value, JWT, secret,
+// the full client_id, and the full redirect_uri all stay out of the log.
+
+// A ~12-char prefix correlates lines without printing the signed client_id,
+// which embeds the redirect set.
+function clientIdPrefix(clientId) {
+  return clientId ? `${String(clientId).slice(0, 12)}…` : "absent";
+}
+
+// The HOST is the diagnostic value; the path can carry a per-install identifier,
+// so it is dropped.
+function hostOf(uri) {
+  if (!uri) return "absent";
+  try {
+    return new URL(String(uri)).host;
+  } catch {
+    return "invalid";
+  }
+}
+
 // --- Stateless client registration (#3060) -----------------------------------
 // A `client_id` is a signed token that CARRIES its own redirect-URI set, not a
 // random handle into a process-local Map. Registration signs the (sorted,
@@ -278,6 +303,16 @@ export function mountOAuth(app, publicBase, opts = {}) {
   app.get("/oauth/authorize", (req, res) => {
     sweep(authSessions);
     const { client_id, redirect_uri, state, code_challenge, code_challenge_method, response_type } = req.query;
+    // Observability (#345): the request SHAPE the client actually sent, logged
+    // before any check so a rejected request is still visible. Presence, not
+    // values — nothing here is reusable in a log aggregator.
+    console.error(
+      `[oauth] authorize request: client_id=${clientIdPrefix(client_id)} ` +
+        `response_type=${response_type ? String(response_type) : "absent"} ` +
+        `state=${state ? "present" : "absent"} ` +
+        `pkce=${code_challenge ? (code_challenge_method ? String(code_challenge_method) : "present(no-method)") : "absent"} ` +
+        `redirect_host=${hostOf(redirect_uri)}`,
+    );
     const client = verifyClientId(client_id, clientSecrets.secrets);
     if (!client || !client.redirect_uris.includes(String(redirect_uri))) {
       res.status(400).send("Unknown client or redirect_uri. Re-add the connector and try again.");
@@ -331,6 +366,10 @@ export function mountOAuth(app, publicBase, opts = {}) {
       console.error("[oauth] authorization code issued after sign-in; awaiting token exchange");
       const sep = sess.redirect_uri.includes("?") ? "&" : "?";
       const redirect = `${sess.redirect_uri}${sep}code=${encodeURIComponent(code)}${sess.state ? `&state=${encodeURIComponent(sess.state)}` : ""}`;
+      // Observability (#345): we handed control back to the client, and to
+      // where. The host only — the full redirect carries the code and a
+      // per-install path.
+      console.error(`[oauth] redirect handed back to client; redirect_host=${hostOf(sess.redirect_uri)}`);
       res.json({ status: "ready", redirect });
       return;
     }
@@ -386,13 +425,15 @@ export function mountOAuth(app, publicBase, opts = {}) {
       denyToken(res, "unsupported_grant_type", "grant_type must be authorization_code", `(got ${JSON.stringify(grant_type ?? null)})`);
       return;
     }
-    const rec = authCodes.get(String(code));
+    const codeKey = String(code);
+    const rec = authCodes.get(codeKey);
     if (!rec) {
       // Also the retry case: codes are single-use, so a second exchange of a
       // code that already succeeded lands here.
       denyToken(res, "invalid_grant", "authorization code is unknown, expired or already exchanged");
       return;
     }
+    authCodes.delete(codeKey); // single use — consume before validation so a failed attempt cannot be retried
     if (rec.client_id !== String(client_id)) {
       denyToken(
         res,
@@ -412,9 +453,12 @@ export function mountOAuth(app, publicBase, opts = {}) {
       denyToken(res, "invalid_grant", code_verifier === undefined ? "code_verifier is required (PKCE)" : "PKCE verification failed");
       return;
     }
-    authCodes.delete(String(code)); // single use
     const claims = decodeJwt(rec.jwt);
     const expiresIn = claims.exp ? Math.max(60, claims.exp - Math.floor(Date.now() / 1000)) : 30 * 86400;
+    // Observability (#345): the success path. Without this, a successful
+    // exchange and total silence were the same observation. The token is never
+    // logged; client_id is a prefix only.
+    console.error(`[oauth] token exchange succeeded; access token issued (client_id=${clientIdPrefix(client_id)})`);
     res.json({ access_token: rec.jwt, token_type: "Bearer", expires_in: expiresIn, scope: "cloudgrid" });
   });
 }