@cloudgrid-io/mcp 0.21.9 → 0.21.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloudgrid-io/mcp",
-  "version": "0.21.9",
+  "version": "0.21.10",
   "description": "MCP access to CloudGrid — the live runtime environment where the user's apps run WITH the infrastructure they need out of the box: managed MongoDB, Redis (cache/queues/pub-sub), a pgvector store, persistent disk, and built-in AI with no API keys, in any language or stack, no Docker or Kubernetes to manage. Brainstorm, build, plug, and improve apps, games, dashboards, and tools; instant single-page publishes and full runtime-app deploys with a live URL — for developers and non-technical users. Three editions: local stdio (full toolset), hosted web (light, CLI-free), and a public docs-search server.",
   "type": "module",
   "bin": {
@@ -69,6 +69,7 @@
     "test:web-identity": "node --test test/web-identity.test.mjs",
     "test:web-auth-integration": "node --test test/web-auth-integration.test.mjs",
     "test:web-restart-recovery": "node --test test/web-restart-recovery.test.mjs",
+    "test:oauth-client-persistence": "node --test test/oauth-client-persistence.test.mjs",
     "test:web-capabilities-log": "node --test test/web-capabilities-log.test.mjs",
     "test:internal-refs": "node --test test/no-internal-refs.test.mjs",
     "test:login-app": "node test/login-app.test.mjs",

package/src/oauth.js

@@ -8,15 +8,19 @@
 // then redirect back to the client with an authorization code. /oauth/token
 // exchanges it (PKCE-verified) for the CloudGrid JWT as the access token.
 //
-// No new identity provider. State is in-memory (single replica, like sessions).
+// No new identity provider. Client REGISTRATIONS are stateless (a signed,
+// self-describing client_id — durable across restarts and replicas, see #3060);
+// only the short-lived authorize sessions and auth codes are in-memory.
 
-import { randomUUID, createHash } from "node:crypto";
+import { randomUUID, createHash, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 import { newLoginCode, buildLoginUrl, pollStatusOnce, decodeJwt } from "./auth.js";
 
 const CODE_TTL_MS = 5 * 60 * 1000; // authorize sessions + auth codes live 5 minutes
 
-// In-memory stores. { [id]: record } with created timestamps for TTL sweeps.
-const clients = new Map(); // client_id -> { redirect_uris }
+// In-memory stores for the SHORT-LIVED, single-flight halves of the flow. These
+// are 5-minute, retry-on-failure sessions: losing them to a restart just means
+// the user clicks "sign in" again, never that they must re-add the connector.
+// Client REGISTRATIONS are NOT here — they are stateless (see below, #3060).
 const authSessions = new Map(); // sid -> { cgCode, client_id, redirect_uri, state, code_challenge, created }
 const authCodes = new Map(); // code -> { jwt, client_id, redirect_uri, code_challenge, created }
 
@@ -29,6 +33,95 @@ function b64url(buf) {
   return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 
+// --- Stateless client registration (#3060) -----------------------------------
+// A `client_id` is a signed token that CARRIES its own redirect-URI set, not a
+// random handle into a process-local Map. Registration signs the (sorted,
+// deduped) set under a server secret; /oauth/authorize verifies by recomputing
+// the HMAC and checking `redirect_uri` against the signed set. This makes
+// registration durable across restarts, deploys, and ANY replica count with no
+// datastore, and removes the old unbounded-growth `clients` Map entirely.
+//
+// PKCE and redirect validation are untouched — if anything stricter: the
+// redirect set is now cryptographically bound into the client_id, so a tampered
+// client_id fails the HMAC and is rejected.
+//
+// SECRET: MCP_OAUTH_HMAC_SECRET, read from env, sourced from a Kubernetes Secret
+// (NEVER a ConfigMap), never logged. It is a whitespace/comma-separated list:
+// the FIRST entry signs, ALL entries verify.
+//
+// ROTATION (rolling-update safe — order matters). Do NOT simply prepend the new
+// secret: during a rollout, new pods would sign under a key the not-yet-updated
+// old pods cannot verify, so authorize returns transient 400s. Instead:
+//   1. APPEND the new secret (last position = verify-only) and deploy. Every pod
+//      now VERIFIES both keys; all pods still SIGN under the old first entry.
+//   2. Once the rollout is complete, PROMOTE the new secret to first position
+//      (the signing slot) and deploy. New client_ids are signed under it; the
+//      old key still verifies outstanding ones.
+//   3. Later, DROP the old key. client_ids minted under it stop verifying and
+//      those users re-add the connector ONCE — the deliberate-rotation cost,
+//      versus today's every-deploy breakage.
+// An attacker who obtains the secret can forge a client_id for an arbitrary
+// redirect set — but /oauth/register already mints one for any redirect set
+// unauthenticated, so the secret gates INTEGRITY, not registration; PKCE +
+// CloudGrid sign-in still gate getting a token.
+const CLIENT_ID_PREFIX = "cg1"; // versioned so the scheme can evolve
+
+// A client_id CARRIES its redirect set and travels in a query string, so the set
+// must stay bounded or the token grows without limit. Caps chosen well above any
+// real client (ChatGPT/Claude register one or two URIs).
+const MAX_REDIRECT_URIS = 10;
+const MAX_REDIRECT_URIS_BYTES = 4096;
+// A configured signing key shorter than this is weak for an HMAC secret; we warn
+// but still accept it — any configured key beats the ephemeral fallback (#3060).
+const MIN_SECRET_LENGTH = 32;
+
+function resolveClientSecrets(env = process.env) {
+  const configured = (env.MCP_OAUTH_HMAC_SECRET || "").split(/[\s,]+/).filter(Boolean);
+  if (configured.length > 0) return { secrets: configured, ephemeral: false };
+  // No configured secret: a per-process ephemeral one. The flow works within a
+  // single process, but registrations do NOT survive a restart — i.e. #3060 is
+  // unfixed. Production MUST set the secret; the boot log states which mode is
+  // active so a deploy can be verified.
+  return { secrets: [randomBytes(32).toString("hex")], ephemeral: true };
+}
+
+// Canonical form the signature covers: sorted + deduped, as JSON.
+function canonicalRedirectUris(uris) {
+  return JSON.stringify([...new Set(uris.map((u) => String(u)))].sort());
+}
+
+function signClientId(canonical, secret) {
+  const payload = b64url(Buffer.from(canonical, "utf8"));
+  const signingInput = `${CLIENT_ID_PREFIX}.${payload}`;
+  const sig = b64url(createHmac("sha256", secret).update(signingInput).digest());
+  return `${signingInput}.${sig}`;
+}
+
+// Verify a client_id against any accepted secret; returns { redirect_uris } or null.
+function verifyClientId(clientId, secrets) {
+  const parts = String(clientId).split(".");
+  if (parts.length !== 3 || parts[0] !== CLIENT_ID_PREFIX) return null;
+  const [, payload, sig] = parts;
+  const signingInput = `${CLIENT_ID_PREFIX}.${payload}`;
+  const given = Buffer.from(sig);
+  let ok = false;
+  for (const secret of secrets) {
+    const expected = Buffer.from(b64url(createHmac("sha256", secret).update(signingInput).digest()));
+    if (expected.length === given.length && timingSafeEqual(expected, given)) {
+      ok = true;
+      break;
+    }
+  }
+  if (!ok) return null;
+  try {
+    const json = Buffer.from(payload.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8");
+    const uris = JSON.parse(json);
+    return Array.isArray(uris) ? { redirect_uris: uris } : null;
+  } catch {
+    return null;
+  }
+}
+
 function corsOk(res) {
   res.setHeader("Access-Control-Allow-Origin", "*");
   res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
@@ -81,6 +174,33 @@ export function mountOAuth(app, publicBase, opts = {}) {
   if (!opts.requireAuth) return;
   const base = publicBase.replace(/\/+$/, "");
 
+  // Resolve the client-registration signing secret(s) once at mount. Log which
+  // mode is active — durable vs. ephemeral — so a production deploy can be
+  // verified from the boot log without ever printing the secret itself.
+  const clientSecrets = resolveClientSecrets();
+  if (clientSecrets.ephemeral) {
+    console.warn(
+      "[oauth] MCP_OAUTH_HMAC_SECRET is NOT set — OAuth client registrations use a per-process " +
+        "ephemeral secret (see #3060). This is NOT just a survives-restart issue: with more than " +
+        "one replica, each process mints under its own key, so a client_id registered on one " +
+        "replica fails on another — authorize breaks intermittently, per request, with no restart " +
+        "involved, which diagnoses as an unrelated bug. Set the secret in production.",
+    );
+  } else {
+    const weak = clientSecrets.secrets.filter((s) => s.length < MIN_SECRET_LENGTH).length;
+    if (weak > 0) {
+      console.warn(
+        `[oauth] MCP_OAUTH_HMAC_SECRET has ${weak} key(s) shorter than ${MIN_SECRET_LENGTH} chars — ` +
+          "weak for an HMAC signing key; use a long random value (e.g. `openssl rand -hex 32`). " +
+          "Accepted anyway (still better than the ephemeral fallback).",
+      );
+    }
+    console.log(
+      `[oauth] client-registration secret configured (${clientSecrets.secrets.length} key(s)); ` +
+        "registrations are durable across restarts and replicas.",
+    );
+  }
+
   const asMetadata = {
     issuer: base,
     authorization_endpoint: `${base}/oauth/authorize`,
@@ -122,14 +242,28 @@ export function mountOAuth(app, publicBase, opts = {}) {
       res.status(400).json({ error: "invalid_client_metadata", error_description: "redirect_uris is required." });
       return;
     }
-    const clientId = randomUUID();
-    clients.set(clientId, { redirect_uris: redirectUris, created: Date.now() });
+    if (redirectUris.length > MAX_REDIRECT_URIS) {
+      res.status(400).json({
+        error: "invalid_client_metadata",
+        error_description: `At most ${MAX_REDIRECT_URIS} redirect_uris are allowed.`,
+      });
+      return;
+    }
+    const canonical = canonicalRedirectUris(redirectUris);
+    if (Buffer.byteLength(canonical, "utf8") > MAX_REDIRECT_URIS_BYTES) {
+      res.status(400).json({
+        error: "invalid_client_metadata",
+        error_description: `redirect_uris exceed the ${MAX_REDIRECT_URIS_BYTES}-byte limit.`,
+      });
+      return;
+    }
+    const clientId = signClientId(canonical, clientSecrets.secrets[0]);
     res.status(201).json({
       client_id: clientId,
       token_endpoint_auth_method: "none",
       grant_types: ["authorization_code"],
       response_types: ["code"],
-      redirect_uris: redirectUris,
+      redirect_uris: JSON.parse(canonical),
     });
   });
 
@@ -137,7 +271,7 @@ export function mountOAuth(app, publicBase, opts = {}) {
   app.get("/oauth/authorize", (req, res) => {
     sweep(authSessions);
     const { client_id, redirect_uri, state, code_challenge, code_challenge_method, response_type } = req.query;
-    const client = clients.get(String(client_id));
+    const client = verifyClientId(client_id, clientSecrets.secrets);
     if (!client || !client.redirect_uris.includes(String(redirect_uri))) {
       res.status(400).send("Unknown client or redirect_uri. Re-add the connector and try again.");
       return;

package/src/tools/deploy.js

@@ -2230,16 +2230,32 @@ export async function runPlug(ctx, input, deps = {}) {
     lines.push("The owner_token was re-minted for the reset expiry — replace the stored one.");
   }
 
+  // Point the user at their grid (the console) after a deploy that is LIVE — new
+  // or re-plug (#321). The app URL says where the app lives; the console line says
+  // where the grid lives, so the common follow-up interaction (an edit) does not
+  // end with a bare URL and no way back. The console root self-routes per account
+  // state (sign-in wall → their grid → onboarding); there is no per-grid page to
+  // link, so keep the root — a `/grids/<slug>` path 404s today.
+  //
+  // NOT on the building branch: the line says "view it live", and a still-building
+  // app is not live — emitting it two lines under "Do NOT tell the user it is live"
+  // would hand a model the word "live" next to a pending app. For an async runtime
+  // build the console line arrives when liveness is confirmed, in runCheckDeploy's
+  // success branch.
+  if (data.entity_id && !isBuilding) {
+    structured.console_url = CONSOLE_URL;
+    lines.push(`You can view it live in your grid along with all the apps you build here: ${CONSOLE_URL}`);
+  }
+
   // Visibility is the user's choice — never set silently. On a NEW deploy,
   // surface the current visibility + the full option set and have the agent ASK
   // the user, then apply their answer via grid_visibility. On an edit, leave the
-  // entity's existing visibility untouched (don't re-ask on every re-plug).
+  // entity's existing visibility untouched (don't re-ask on every re-plug) — this
+  // stays `!isEdit` deliberately, decoupled from the console line above.
   if (!isEdit && data.entity_id) {
     const current = typeof data.visibility === "string" ? data.visibility : null;
-    structured.console_url = CONSOLE_URL;
     if (current) structured.current_visibility = current;
     structured.visibility_options = VISIBILITY_OPTIONS.map((v) => ({ value: v, label: VISIBILITY_LABELS[v] }));
-    lines.push(`Manage all your apps in your grid: ${CONSOLE_URL}`);
     lines.push(
       `Now ASK the user who should be able to open this${current ? ` (currently ${VISIBILITY_LABELS[current] ?? current})` : ""}, then set their choice with grid_visibility — do not decide it for them. Options: ${
         VISIBILITY_OPTIONS
@@ -2717,8 +2733,12 @@ export async function runCheckDeploy(ctx, { poll_url, grid } = {}) {
   const url = ctx.state.lastDrop?.url;
   if (verdict.status === "success") {
     return {
-      text: `Live${url ? `: ${url}` : ""} — the build finished. Give the user the URL.`,
-      structured: { status: "success", live: true, ...(url ? { url } : {}) },
+      // The "now live" moment for an async runtime build lands here, not in
+      // runPlug (which returned "building"). Point the user at their grid too
+      // (#321) — this is where liveness is confirmed, so "view it live" is true.
+      text: `Live${url ? `: ${url}` : ""} — the build finished. Give the user the URL.\n` +
+        `You can view it live in your grid along with all the apps you build here: ${CONSOLE_URL}`,
+      structured: { status: "success", live: true, ...(url ? { url } : {}), console_url: CONSOLE_URL },
     };
   }
   if (verdict.status === "failed") {

package/src/tools/register.js

@@ -845,6 +845,7 @@ export function registerTools(server, ctx) {
         status: z.string().describe("The build status: success | failed | building | queued | unknown."),
         live: z.boolean().describe("True only when the build finished successfully and the URL serves."),
         url: z.string().optional().describe("The live URL, when known."),
+        console_url: z.string().optional().describe("On success: URL to view the app live in the grid alongside all the user's apps."),
         error: z.string().optional().describe("User-language failure reason, when the build failed."),
         build_log_tail: z.string().optional().describe("Sanitized tail of the Cloud Build log (the real error), when the build failed."),
         suggested_fix: z.string().optional().describe("A suggested fix for the failure, when the platform provides one."),