@frontmcp/sdk 1.5.2 → 1.5.4

package/esm/index.mjs

@@ -20916,18 +20916,28 @@ var init_call_tool_flow = __esm({
         const consentCtx = this.input.ctx;
         if (!consentCtx?.internalCall) {
           const consentedToolIds = getConsentedToolIds(authInfo);
-          if (consentedToolIds && tool && !isToolConsented(consentedToolIds, tool.name, tool.fullName)) {
-            this.logger.info(
-              `checkToolAuthorization: tool "${tool.fullName || tool.name}" not in consented set \u2014 rejecting`
-            );
-            throw new ToolNotConsentedError(tool.fullName || tool.name);
+          if (consentedToolIds && tool) {
+            const bareNameCount = this.scope.tools.getTools(true).filter((t) => t.name === tool.name).length;
+            const consented = bareNameCount > 1 ? isToolConsented(consentedToolIds, tool.fullName) : isToolConsented(consentedToolIds, tool.name, tool.fullName);
+            if (!consented) {
+              this.logger.info(
+                `checkToolAuthorization: tool "${tool.fullName || tool.name}" not in consented set \u2014 rejecting`
+              );
+              throw new ToolNotConsentedError(tool.fullName || tool.name);
+            }
           }
         }
         const claimAuthorizedApps = getAuthorizedAppIds(authInfo);
         const legacyAuthorization = authInfo?.extra?.["authorization"];
         if (!claimAuthorizedApps && !legacyAuthorization) {
-          this.logger.verbose("checkToolAuthorization:skip (no auth context)");
-          return;
+          const incrementalEnabled = !consentCtx?.internalCall && !!authInfo?.token && this.scope.auth?.options?.incrementalAuth?.enabled === true;
+          if (!incrementalEnabled) {
+            this.logger.verbose("checkToolAuthorization:skip (no auth context)");
+            return;
+          }
+          this.logger.warn(
+            "checkToolAuthorization: incrementalAuth enabled but the verified token carries no authorized_apps claim \u2014 failing closed"
+          );
         }
         const appId = tool?.owner?.id;
         if (!appId) {
@@ -34253,7 +34263,7 @@ var init_oauth_authorize_flow = __esm({
         if (!result.success) {
           const errors = this.formatZodErrors(result.error);
           this.logger.warn(`Authorization request validation failed: ${errors.join(", ")}`);
-          this.respondWithError(errors, rawRedirectUri, rawState);
+          this.respondWithError(errors, void 0, rawState);
           return;
         }
         this.state.set("validatedRequest", result.data);
@@ -34308,6 +34318,22 @@ var init_oauth_authorize_flow = __esm({
             this.respondWithError(["redirect_uri is not registered for this client"], void 0, rawState);
             return;
           }
+          if (!registered) {
+            const authOptions = this.scope.auth?.options;
+            const requireRegistered = authOptions?.requireRegisteredClients === true;
+            const redirectAllowlisted = registry?.hasRedirectAllowlist?.() === true;
+            if (requireRegistered && !redirectAllowlisted) {
+              this.logger.warn(
+                `OAuth authorize: rejecting unregistered client_id "${client_id}" (requireRegisteredClients)`
+              );
+              this.respondWithError(
+                ["Unknown client_id: register the client (DCR / pre-registered) or use a CIMD client-id URL"],
+                void 0,
+                rawState
+              );
+              return;
+            }
+          }
         }
       }
       async checkIfAuthorized() {
@@ -35034,6 +35060,11 @@ var init_oauth_callback_flow = __esm({
             return;
           }
         }
+        if (this.isCrossOriginSubmission()) {
+          this.logger.warn("Cross-origin login submission rejected (CSRF)");
+          this.respond(httpRespond.html(this.renderErrorPage("invalid_request", "Cross-origin request blocked"), 400));
+          return;
+        }
         let userSub;
         if (email) {
           userSub = this.generateUserSub(email);
@@ -35490,6 +35521,33 @@ var init_oauth_callback_flow = __esm({
         }
         return void 0;
       }
+      /**
+       * Same-origin (CSRF) check for a state-changing login/consent submission.
+       *
+       * Returns true when the request carries an `Origin` or `Referer` header whose
+       * host does NOT match the request's own host — the signature of a cross-site
+       * login-CSRF/fixation. `Origin`/`Referer` are set by the browser and cannot
+       * be forged by a malicious page, so this reliably distinguishes a legitimate
+       * same-origin submission (the built-in form is served by THIS server) from a
+       * cross-site one. Returns false (do NOT block) when neither header is present
+       * or the request's own host cannot be determined — defense-in-depth, not a
+       * hard gate, so header-stripped GET navigations and existing flows keep working.
+       */
+      isCrossOriginSubmission() {
+        const headers = this.rawInput?.request?.headers ?? {};
+        const first = (v) => Array.isArray(v) ? v[0] : typeof v === "string" ? v : void 0;
+        const source = first(headers["origin"]) ?? first(headers["referer"]);
+        if (!source) return false;
+        let sourceHost;
+        try {
+          sourceHost = new URL(source).host.toLowerCase();
+        } catch {
+          return true;
+        }
+        const selfHosts = [first(headers["host"]), first(headers["x-forwarded-host"])].filter((h2) => !!h2).map((h2) => h2.toLowerCase());
+        if (selfHosts.length === 0) return false;
+        return !selfHosts.includes(sourceHost);
+      }
       collectLoginFields(request) {
         const fields = {};
         const absorb = (source) => {
@@ -36262,19 +36320,21 @@ var init_oauth_provider_callback_flow = __esm({
           );
           return;
         }
-        const stateValidation = this.getStateValidation();
-        if (stateValidation === "strict") {
-          const expectedState = session.currentProviderState;
-          if (!expectedState || expectedState !== providerState) {
-            this.logger.warn("State mismatch for provider callback");
-            this.respond(
-              httpRespond.html(
-                this.renderErrorPage("invalid_request", "Invalid state parameter. Please restart authentication."),
-                400
-              )
+        const expectedState = session.currentProviderState;
+        if (!expectedState || expectedState !== providerState) {
+          if (this.getStateValidation() === "format") {
+            this.logger.warn(
+              'federatedAuth.stateValidation:"format" no longer skips provider-state nonce verification (security hardening) \u2014 the callback state must match the value issued for this session'
             );
-            return;
           }
+          this.logger.warn("State mismatch for provider callback");
+          this.respond(
+            httpRespond.html(
+              this.renderErrorPage("invalid_request", "Invalid state parameter. Please restart authentication."),
+              400
+            )
+          );
+          return;
         }
         this.state.set("federatedSession", session);
       }
@@ -36361,11 +36421,19 @@ var init_oauth_provider_callback_flow = __esm({
               this.state.set("providerUserInfo", userInfo);
             } catch (err) {
               const errMsg = err instanceof Error ? err.message : "Unknown error";
-              this.logger.warn(`Failed to get user info from provider ${providerId}: ${errMsg}`);
+              this.logger.warn(`Failed to resolve user identity from provider ${providerId}: ${errMsg}`);
+              this.respond(
+                httpRespond.html(
+                  this.renderErrorPage("access_denied", "Could not determine your identity from the provider"),
+                  400
+                )
+              );
+              return;
             }
           }
           this.logger.info(`Successfully exchanged code for tokens with provider: ${providerId}`);
         } catch (err) {
+          if (err instanceof FlowControl) throw err;
           const errMsg = err instanceof Error ? err.message : "Unknown error";
           this.logger.error(`Provider token exchange error: ${errMsg}`);
           this.respond(
@@ -36745,6 +36813,24 @@ function extractBearer(headers) {
   const match = /^Bearer\s+(.+)$/i.exec(raw.trim());
   return match ? match[1].trim() : void 0;
 }
+function isLoopbackRedirectUri(uri) {
+  let url;
+  try {
+    url = new URL(uri);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") return false;
+  if (url.username || url.password) return false;
+  const host = url.hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  if (host === "localhost" || host === "::1") return true;
+  const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+  if (m) {
+    const octets = m.slice(1).map((n) => Number(n));
+    return octets.every((o) => o >= 0 && o <= 255) && octets[0] === 127;
+  }
+  return false;
+}
 var inputSchema20, outputSchema19, registrationRequestSchema, stateSchema19, plan19, name19, Stage19, OauthRegisterFlow;
 var init_oauth_register_flow = __esm({
   "libs/sdk/src/auth/flows/oauth.register.flow.ts"() {
@@ -36871,13 +36957,13 @@ var init_oauth_register_flow = __esm({
             return;
           }
         } else {
-          const bad = redirect_uris.find((u) => !/^https?:\/\/(localhost|\d+\.\d+\.\d+\.\d+|127\.0\.0\.1)/.test(u));
+          const bad = redirect_uris.find((u) => !isLoopbackRedirectUri(u));
           if (bad) {
             this.respond(
               httpRespond.json(
                 {
                   error: "invalid_redirect_uri",
-                  error_description: `Registration allows only localhost-style redirect_uris; got ${bad}`
+                  error_description: `Registration allows only loopback redirect_uris (localhost, 127.0.0.0/8, ::1) without an allowlist; got ${bad}`
                 },
                 { status: 400 }
               )
@@ -36918,7 +37004,20 @@ var init_oauth_register_flow = __esm({
           created_at: now,
           dev: true
         };
-        this.localAuth.dcrClientRegistry.register(this.registered);
+        const accepted = this.localAuth.dcrClientRegistry.register(this.registered);
+        if (!accepted) {
+          this.scopeLogger.warn("OAuth register: dynamic client capacity reached \u2014 rejecting registration");
+          this.respond(
+            httpRespond.json(
+              {
+                error: "temporarily_unavailable",
+                error_description: "Client registration capacity reached; please try again later."
+              },
+              { status: 503 }
+            )
+          );
+          return;
+        }
       }
       async respondRegistration() {
         const c = this.registered;
@@ -36984,6 +37083,23 @@ var init_oauth_register_flow = __esm({
 // libs/sdk/src/auth/flows/oauth.token.flow.ts
 import { z as z69 } from "@frontmcp/lazy-zod";
 import { randomUUID as randomUUID19 } from "@frontmcp/utils";
+function parseBasicAuthorization(header) {
+  if (typeof header !== "string") return void 0;
+  const m = /^Basic\s+(.+)$/i.exec(header.trim());
+  if (!m) return void 0;
+  let decoded;
+  try {
+    const b64 = m[1].trim();
+    if (typeof Buffer !== "undefined") decoded = Buffer.from(b64, "base64").toString("utf8");
+    else if (typeof atob === "function") decoded = atob(b64);
+    else return void 0;
+  } catch {
+    return void 0;
+  }
+  const idx = decoded.indexOf(":");
+  if (idx < 0) return void 0;
+  return { clientId: decoded.slice(0, idx), clientSecret: decoded.slice(idx + 1) };
+}
 function coerceTokenRequestBody(request) {
   const body = request.body;
   if (body && typeof body === "object" && !Array.isArray(body) && Object.keys(body).length > 0) {
@@ -37028,6 +37144,8 @@ var init_oauth_token_flow = __esm({
       redirect_uri: z69.string().url(),
       /** Public client identifier */
       client_id: z69.string().min(1),
+      /** Client secret (confidential clients; also accepted via HTTP Basic). */
+      client_secret: z69.string().optional(),
       /** PKCE verifier bound to the code */
       code_verifier: z69.string().regex(pkceVerifierRegex, "code_verifier must be 43\u2013128 chars of A\u2013Z, a\u2013z, 0\u20139, '-', '.', '_' or '~'")
     });
@@ -37036,7 +37154,9 @@ var init_oauth_token_flow = __esm({
       /** The refresh token */
       refresh_token: z69.string().min(1, "refresh_token is required"),
       /** Public client identifier */
-      client_id: z69.string().min(1)
+      client_id: z69.string().min(1),
+      /** Client secret (confidential clients; also accepted via HTTP Basic). */
+      client_secret: z69.string().optional()
     });
     anonymousGrant = z69.object({
       grant_type: z69.literal("anonymous"),
@@ -37083,6 +37203,12 @@ var init_oauth_token_flow = __esm({
         const isDefaultAuthProvider = !metadata.auth;
         const isOrchestrated = !isDefaultAuthProvider;
         const rawBody = coerceTokenRequestBody(request);
+        const basic = parseBasicAuthorization(request.headers?.["authorization"]);
+        if (basic && rawBody && typeof rawBody === "object") {
+          const b = rawBody;
+          if (b["client_id"] === void 0) b["client_id"] = basic.clientId;
+          if (b["client_secret"] === void 0) b["client_secret"] = basic.clientSecret;
+        }
         const parsed = tokenRequestSchema.safeParse(rawBody);
         if (parsed.success) {
           this.state.set({
@@ -37133,7 +37259,13 @@ var init_oauth_token_flow = __esm({
           return;
         }
         const localAuth = this.scope.auth;
-        const result = await localAuth.exchangeCode(body.code, body.client_id, body.redirect_uri, body.code_verifier);
+        const result = await localAuth.exchangeCode(
+          body.code,
+          body.client_id,
+          body.redirect_uri,
+          body.code_verifier,
+          body.client_secret
+        );
         if ("error" in result) {
           this.logger.warn(`Code exchange failed: ${result.error}`);
           this.respond(
@@ -37180,7 +37312,7 @@ var init_oauth_token_flow = __esm({
           return;
         }
         const localAuth = this.scope.auth;
-        const result = await localAuth.refreshAccessToken(body.refresh_token, body.client_id);
+        const result = await localAuth.refreshAccessToken(body.refresh_token, body.client_id, body.client_secret);
         if ("error" in result) {
           this.logger.warn(`Refresh token failed: ${result.error}`);
           this.respond(
@@ -37408,15 +37540,17 @@ import {
   buildInsufficientScopeHeader,
   buildInvalidTokenHeader,
   buildUnauthorizedHeader,
+  deriveExpectedAudience,
   deriveTypedUser,
   encryptJson as encryptJson2,
   extractBearerToken as extractBearerToken2,
   isJwt,
-  JwksService
+  JwksService,
+  validateAudience
 } from "@frontmcp/auth";
 import { z as z71 } from "@frontmcp/lazy-zod";
 import { getMachineId as getMachineId2, randomUUID as randomUUID20 } from "@frontmcp/utils";
-var inputSchema23, stateSchema22, UnauthorizedSchema, AuthorizedSchema, ForbiddenSchema, sessionVerifyOutputSchema, plan22, name22, Stage22, SessionVerifyFlow;
+var inputSchema23, stateSchema22, UnauthorizedSchema, AuthorizedSchema, ForbiddenSchema, sessionVerifyOutputSchema, plan22, name22, Stage22, warnedUnpinnedAudience, SessionVerifyFlow;
 var init_session_verify_flow = __esm({
   "libs/sdk/src/auth/flows/session.verify.flow.ts"() {
     "use strict";
@@ -37461,6 +37595,7 @@ var init_session_verify_flow = __esm({
     };
     name22 = "session:verify";
     Stage22 = StageHookOf(name22);
+    warnedUnpinnedAudience = false;
     SessionVerifyFlow = class extends FlowBase {
       logger = this.scopeLogger.child("SessionVerifyFlow");
       maskSub(sub) {
@@ -37478,20 +37613,20 @@ var init_session_verify_flow = __esm({
         const machineId = getMachineId2();
         if (sessionIdHeader) {
           const existingPayload = decryptPublicSession(sessionIdHeader);
-          const user2 = existingPayload ? { sub: `anon:${existingPayload.iat * 1e3}`, iss: issuer, name: "Anonymous", scope: scopes.join(" ") } : { sub: `anon:${randomUUID20()}`, iss: issuer, name: "Anonymous", scope: scopes.join(" ") };
-          const finalPayload = existingPayload && existingPayload.nodeId === machineId ? existingPayload : void 0;
-          this.respond({
-            kind: "authorized",
-            authorization: {
-              token: "",
-              user: user2,
-              session: {
-                id: sessionIdHeader,
-                payload: finalPayload
+          if (existingPayload && existingPayload.nodeId === machineId) {
+            const anonId = existingPayload.uuid ?? `${existingPayload.iat * 1e3}`;
+            const user2 = { sub: `anon:${anonId}`, iss: issuer, name: "Anonymous", scope: scopes.join(" ") };
+            this.respond({
+              kind: "authorized",
+              authorization: {
+                token: "",
+                user: user2,
+                session: { id: sessionIdHeader, payload: existingPayload }
               }
-            }
-          });
-          return;
+            });
+            return;
+          }
+          this.logger.verbose("createAnonymousSession: ignoring unrecognized client session id; minting a fresh one");
         }
         const now = Date.now();
         const user = {
@@ -37629,6 +37764,8 @@ var init_session_verify_flow = __esm({
             {
               id: primary.providerConfig?.id ?? "default",
               issuerUrl: issuer,
+              additionalIssuers: primary.providerConfig?.additionalIssuers,
+              verifyIssuer: primary.providerConfig?.verifyIssuer,
               jwks: primary.providerConfig?.jwks,
               jwksUri: primary.providerConfig?.jwksUri
             }
@@ -37640,6 +37777,37 @@ var init_session_verify_flow = __esm({
         const result = await verify;
         if (result.ok) {
           this.state.set({ jwtPayload: result.payload });
+          if (isTransparentMode(authOptions)) {
+            const configuredAudience = authOptions.expectedAudience;
+            if (!configuredAudience && !isPublicUrlPinned() && !warnedUnpinnedAudience) {
+              warnedUnpinnedAudience = true;
+              this.logger.warn(
+                "transparent audience validation is deriving the expected audience from the request Host: set auth.expectedAudience or FRONTMCP_PUBLIC_URL to bind tokens to a fixed resource. X-Forwarded-Host is ignored unless FRONTMCP_TRUST_PROXY is enabled."
+              );
+            }
+            const expectedAudiences = configuredAudience ? Array.isArray(configuredAudience) ? configuredAudience : [configuredAudience] : deriveExpectedAudience(this.state.required.baseUrl);
+            const audResult = validateAudience(result.payload?.["aud"], {
+              expectedAudiences,
+              // By default accept tokens with no `aud` claim: many IdPs omit it, and
+              // rejecting them here would break existing transparent deployments.
+              // Tokens that DO carry an `aud` for another service are still rejected,
+              // which blocks the cross-service replay in GHSA-hvvp-67p3-j379.
+              // Operators whose IdP always sets `aud` can flip `requireAudience:true`
+              // to reject audience-less tokens outright.
+              allowNoAudience: authOptions.requireAudience !== true
+            });
+            if (!audResult.valid) {
+              this.logger.warn("verifyIfJwt: audience validation failed", { error: audResult.error });
+              this.respond({
+                kind: "unauthorized",
+                prmMetadataHeader: buildInvalidTokenHeader(
+                  this.state.required.prmUrl,
+                  audResult.error ?? "Token audience is not valid for this resource"
+                )
+              });
+              return;
+            }
+          }
           const requiredScopes = authOptions?.["requiredScopes"];
           if (requiredScopes && requiredScopes.length > 0) {
             const scopeClaim = result.payload?.["scope"];
@@ -37859,6 +38027,10 @@ var init_well_known_oauth_authorization_server_flow = __esm({
       kind: z73.literal("json"),
       status: z73.literal(200),
       contentType: z73.literal("application/json; charset=utf-8"),
+      // Response headers (e.g. `Cache-Control: no-store`). This flow uses a custom
+      // output schema rather than `HttpJsonSchema`, so `headers` must be declared
+      // explicitly for the renderer to emit it.
+      headers: z73.record(z73.string(), z73.string()).optional(),
       body: z73.object({
         issuer: z73.string().min(1),
         authorization_endpoint: z73.string().min(1),
@@ -37940,6 +38112,10 @@ var init_well_known_oauth_authorization_server_flow = __esm({
             kind: "json",
             contentType: "application/json; charset=utf-8",
             status: 200,
+            // Never cache: the advertised endpoints are derived from the request
+            // origin, so a shared cache could serve a poisoned authorization/token
+            // endpoint to another client (OAuth mix-up).
+            headers: { "cache-control": "no-store" },
             body: {
               issuer: baseIssuer,
               authorization_endpoint: `${oauthBaseUrl}/oauth/authorize`,
@@ -38043,6 +38219,10 @@ var init_well_known_prm_flow = __esm({
             kind: "json",
             contentType: "application/json; charset=utf-8",
             status: 200,
+            // Never cache: the body embeds the request-derived origin, so a shared
+            // cache keyed only on (Host, path) could otherwise serve a poisoned
+            // `authorization_servers` value to another client (OAuth mix-up).
+            headers: { "cache-control": "no-store" },
             body: {
               resource,
               authorization_servers: [baseUrl],
@@ -38056,6 +38236,7 @@ var init_well_known_prm_flow = __esm({
           kind: "json",
           status: 200,
           contentType: "application/json; charset=utf-8",
+          headers: { "cache-control": "no-store" },
           body: {
             resource,
             authorization_servers: [baseUrl],
@@ -38645,7 +38826,11 @@ var init_instance_local_primary_auth = __esm({
       /**
        * Exchange an authorization code for tokens
        */
-      async exchangeCode(code, clientId, redirectUri, codeVerifier) {
+      async exchangeCode(code, clientId, redirectUri, codeVerifier, clientSecret) {
+        if (this.dcrClientRegistryImpl.verifyClientSecret(clientId, clientSecret) === "invalid") {
+          this.logger.warn("Client authentication failed at token endpoint (authorization_code)");
+          return { error: "invalid_client", error_description: "Client authentication failed" };
+        }
         const codeRecord = await this.authorizationStore.getAuthorizationCode(code);
         if (!codeRecord) {
           this.logger.warn(`Authorization code not found or expired: ${code.substring(0, 8)}...`);
@@ -38656,6 +38841,13 @@ var init_instance_local_primary_auth = __esm({
         }
         if (codeRecord.used) {
           this.logger.warn(`Authorization code already used: ${code.substring(0, 8)}...`);
+          if (codeRecord.issuedRefreshToken) {
+            try {
+              await this.authorizationStore.revokeRefreshToken(codeRecord.issuedRefreshToken);
+            } catch (err) {
+              this.logger.warn(`Failed to revoke refresh token on authorization-code replay: ${err}`);
+            }
+          }
           await this.authorizationStore.deleteAuthorizationCode(code);
           return {
             error: "invalid_grant",
@@ -38717,9 +38909,19 @@ var init_instance_local_primary_auth = __esm({
           clientId,
           userSub: user.sub,
           scopes: codeRecord.scopes,
-          resource: codeRecord.resource
+          resource: codeRecord.resource,
+          userEmail: user.email,
+          userName: user.name,
+          consentEnabled: codeRecord.consentEnabled,
+          selectedToolIds: codeRecord.selectedToolIds,
+          authorizedAppIds: codeRecord.authorizedAppIds,
+          customClaims: codeRecord.customClaims,
+          federatedLoginUsed: codeRecord.federatedLoginUsed,
+          selectedProviderIds: codeRecord.selectedProviderIds,
+          skippedProviderIds: codeRecord.skippedProviderIds
         });
         await this.authorizationStore.storeRefreshToken(refreshTokenRecord);
+        await this.authorizationStore.markCodeUsed(code, refreshTokenRecord.token);
         this.logger.info(`Tokens issued for user: ${user.sub}`);
         return {
           access_token: accessToken,
@@ -38732,7 +38934,11 @@ var init_instance_local_primary_auth = __esm({
       /**
        * Refresh an access token using a refresh token
        */
-      async refreshAccessToken(refreshToken, clientId) {
+      async refreshAccessToken(refreshToken, clientId, clientSecret) {
+        if (this.dcrClientRegistryImpl.verifyClientSecret(clientId, clientSecret) === "invalid") {
+          this.logger.warn("Client authentication failed at token endpoint (refresh_token)");
+          return { error: "invalid_client", error_description: "Client authentication failed" };
+        }
         const tokenRecord = await this.authorizationStore.getRefreshToken(refreshToken);
         if (!tokenRecord) {
           this.logger.warn("Refresh token not found or expired");
@@ -38748,13 +38954,37 @@ var init_instance_local_primary_auth = __esm({
             error_description: "Client ID does not match"
           };
         }
-        const user = { sub: tokenRecord.userSub };
-        const accessToken = await this.signAccessToken(user, tokenRecord.scopes, tokenRecord.resource);
+        const user = {
+          sub: tokenRecord.userSub,
+          email: tokenRecord.userEmail,
+          name: tokenRecord.userName
+        };
+        const hasAuthorizedApps = Array.isArray(tokenRecord.authorizedAppIds);
+        const hasCustomClaims = !!tokenRecord.customClaims && Object.keys(tokenRecord.customClaims).length > 0;
+        const consentMetadata = tokenRecord.consentEnabled || tokenRecord.federatedLoginUsed || hasCustomClaims || hasAuthorizedApps ? {
+          selectedToolIds: tokenRecord.selectedToolIds,
+          selectedProviderIds: tokenRecord.selectedProviderIds,
+          skippedProviderIds: tokenRecord.skippedProviderIds,
+          consentEnabled: tokenRecord.consentEnabled,
+          federatedLoginUsed: tokenRecord.federatedLoginUsed,
+          authorizedAppIds: tokenRecord.authorizedAppIds,
+          customClaims: tokenRecord.customClaims
+        } : void 0;
+        const accessToken = await this.signAccessToken(user, tokenRecord.scopes, tokenRecord.resource, consentMetadata);
         const newRefreshRecord = this.authorizationStore.createRefreshTokenRecord({
           clientId,
           userSub: tokenRecord.userSub,
           scopes: tokenRecord.scopes,
-          resource: tokenRecord.resource
+          resource: tokenRecord.resource,
+          userEmail: tokenRecord.userEmail,
+          userName: tokenRecord.userName,
+          consentEnabled: tokenRecord.consentEnabled,
+          selectedToolIds: tokenRecord.selectedToolIds,
+          authorizedAppIds: tokenRecord.authorizedAppIds,
+          customClaims: tokenRecord.customClaims,
+          federatedLoginUsed: tokenRecord.federatedLoginUsed,
+          selectedProviderIds: tokenRecord.selectedProviderIds,
+          skippedProviderIds: tokenRecord.skippedProviderIds
         });
         await this.authorizationStore.rotateRefreshToken(refreshToken, newRefreshRecord);
         this.logger.info(`Tokens refreshed for user: ${user.sub}`);
@@ -39054,13 +39284,22 @@ var init_instance_local_primary_auth = __esm({
           try {
             const [, payloadB64] = idToken.split(".");
             const payload = JSON.parse(new TextDecoder().decode(base64urlDecode2(payloadB64)));
-            return {
-              sub: payload["sub"],
-              email: payload["email"],
-              name: payload["name"],
-              picture: payload["picture"],
-              claims: payload
-            };
+            const exp = typeof payload["exp"] === "number" ? payload["exp"] : void 0;
+            if (exp !== void 0 && exp * 1e3 < Date.now()) {
+              this.logger.warn(`ID token for ${providerId} is expired; falling back to userinfo`);
+            } else {
+              const sub = typeof payload["sub"] === "string" && payload["sub"].trim() ? payload["sub"] : void 0;
+              if (sub) {
+                return {
+                  sub,
+                  email: payload["email"],
+                  name: payload["name"],
+                  picture: payload["picture"],
+                  claims: payload
+                };
+              }
+              this.logger.warn(`ID token for ${providerId} has no usable sub; falling back to userinfo`);
+            }
           } catch (err) {
             this.logger.warn(`Failed to parse ID token for ${providerId}: ${err}`);
           }
@@ -39075,21 +39314,25 @@ var init_instance_local_primary_auth = __esm({
             });
             if (response.ok) {
               const userInfo = await response.json();
-              return {
-                sub: userInfo["sub"],
-                email: userInfo["email"],
-                name: userInfo["name"],
-                picture: userInfo["picture"],
-                claims: userInfo
-              };
+              const sub = typeof userInfo["sub"] === "string" && userInfo["sub"].trim() ? userInfo["sub"] : void 0;
+              if (sub) {
+                return {
+                  sub,
+                  email: userInfo["email"],
+                  name: userInfo["name"],
+                  picture: userInfo["picture"],
+                  claims: userInfo
+                };
+              }
+              this.logger.warn(`userinfo for ${providerId} returned no usable sub`);
             }
           } catch (err) {
             this.logger.warn(`Failed to get userinfo from ${providerId}: ${err}`);
           }
         }
-        return {
-          sub: `${providerId}:unknown`
-        };
+        throw new Error(
+          `Unable to determine a stable user identity from provider "${providerId}" (no id_token sub and no usable userinfo endpoint)`
+        );
       }
       /**
        * Refresh tokens from upstream provider
@@ -49313,6 +49556,16 @@ function decideIntent(req, cfg) {
     debug: { key, channel: channel2, flags }
   };
 }
+function authorizeSessionTermination(verifyResult, requestedSessionId) {
+  if (!verifyResult || verifyResult.kind !== "authorized" || !verifyResult.authorization) {
+    return { kind: "unauthorized" };
+  }
+  const ownedSessionId = verifyResult.authorization.session?.id;
+  if (!ownedSessionId || !requestedSessionId || requestedSessionId !== ownedSessionId) {
+    return { kind: "forbidden" };
+  }
+  return { kind: "ok", sessionId: ownedSessionId };
+}
 var intentSchema, decisionSchema, CH_OTHER, CH_GET_SSE, CH_POST_INIT_JSON, CH_POST_INIT_SSE, CH_POST_JSON, CH_POST_SSE, CH_POST_MESSAGE, CH_GET_SSE_PATH, CH_MASK, B_HAS_SESSION, B_STATELESS_EN, B_REQ_SESSION, B_LEGACY_HINT, B_SSE_LISTENER_EN, B_STREAMABLE_EN, B_STATEFUL_EN, B_LEGACY_EN, h, wantsSSE, wantsJSON, isInitialize, RULES;
 var init_decide_request_intent_utils = __esm({
   "libs/sdk/src/common/utils/decide-request-intent.utils.ts"() {
@@ -49576,13 +49829,29 @@ function readPublicUrlPin() {
   }
   return void 0;
 }
+function isPublicUrlPinned() {
+  return readPublicUrlPin() !== void 0;
+}
+function isProxyTrusted() {
+  try {
+    if (typeof process !== "undefined" && process.env) {
+      const v = process.env["FRONTMCP_TRUST_PROXY"];
+      return typeof v === "string" && /^(1|true|yes|on)$/i.test(v.trim());
+    }
+  } catch {
+  }
+  return false;
+}
 function getRequestBaseUrl(req, entryPath) {
   const pin = readPublicUrlPin();
   if (pin) {
     return `${pin}${entryPath ?? ""}`;
   }
-  const proto = req.headers["x-forwarded-proto"] || req.protocol || "http";
-  const host = req.headers["x-forwarded-host"] || req.headers["host"];
+  const trustProxy = isProxyTrusted();
+  const fwdProto = trustProxy ? req.headers["x-forwarded-proto"] : void 0;
+  const fwdHost = trustProxy ? req.headers["x-forwarded-host"] : void 0;
+  const proto = fwdProto || req.protocol || "http";
+  const host = fwdHost || req.headers["host"];
   return `${proto}://${host}${entryPath ?? ""}`;
 }
 function computeIssuer(req, entryPath, scopeBase) {
@@ -54348,6 +54617,10 @@ import {
 } from "@frontmcp/auth";
 import { z as z103 } from "@frontmcp/lazy-zod";
 import { randomUUID as randomUUID27 } from "@frontmcp/utils";
+function parseUserScopes(user) {
+  const s = user?.scope;
+  return typeof s === "string" ? s.split(/\s+/).filter(Boolean) : [];
+}
 var plan39, httpRequestStateSchema, name40, Stage40, HttpRequestFlow;
 var init_http_request_flow = __esm({
   "libs/sdk/src/scope/flows/http.request.flow.ts"() {
@@ -54489,7 +54762,10 @@ var init_http_request_flow = __esm({
               ctx.updateAuthInfo({
                 token,
                 clientId: user.sub,
-                scopes: [],
+                // Populate scopes from the verified token's `scope` claim instead of
+                // hardcoding `[]`, so any consumer that authorizes on
+                // `authInfo.scopes` sees the real grant (same accessor as the web path).
+                scopes: parseUserScopes(user),
                 // JWT exp is in seconds, SDK uses milliseconds throughout (e.g., Date.now())
                 expiresAt: user.exp ? user.exp * 1e3 : void 0,
                 extra: {
@@ -54608,6 +54884,27 @@ var init_http_request_flow = __esm({
               this.next();
               return;
             }
+            const deleteVerify = this.state.required.verifyResult;
+            const requestedSessionId = request[ServerRequestTokens.sessionId] ?? request.headers["mcp-session-id"] ?? request.query?.["sessionId"];
+            const deleteAuthz = authorizeSessionTermination(deleteVerify, requestedSessionId);
+            if (deleteAuthz.kind === "unauthorized") {
+              this.logger.warn(`[${this.requestId}] DELETE session denied: request is not authenticated`);
+              this.respond(
+                httpRespond.unauthorized({
+                  headers: {
+                    "WWW-Authenticate": deleteVerify.prmMetadataHeader ?? "Bearer"
+                  }
+                })
+              );
+              return;
+            }
+            if (deleteAuthz.kind === "forbidden") {
+              this.logger.warn(`[${this.requestId}] DELETE session denied: caller does not own the requested session id`);
+              this.respond(httpRespond.notFound("Session not found"));
+              return;
+            }
+            request[ServerRequestTokens.auth] = deleteVerify.authorization;
+            request[ServerRequestTokens.sessionId] = deleteAuthz.sessionId;
             this.state.set("intent", decision.intent);
             return;
           }
@@ -54720,7 +55017,9 @@ var init_http_request_flow = __esm({
           const authInfo = authorization ? {
             token: authorization.token,
             clientId: authorization.user?.sub,
-            scopes: [],
+            // Same scope parsing as the Node path so scope-aware handlers behave
+            // identically on the web transport.
+            scopes: parseUserScopes(authorization.user),
             expiresAt: authorization.user?.exp ? authorization.user.exp * 1e3 : void 0,
             extra: {
               user: authorization.user,
@@ -57686,6 +57985,17 @@ function createHostValidationMiddleware(options) {
         });
         return;
       }
+      const forwardedHost = req.headers?.["x-forwarded-host"];
+      if (forwardedHost) {
+        const candidates = forwardedHost.split(",").map((h2) => h2.trim()).filter(Boolean);
+        if (candidates.some((h2) => !allowedHostsSet.has(h2))) {
+          res.status(403).json({
+            error: "Forbidden",
+            message: "Invalid X-Forwarded-Host header"
+          });
+          return;
+        }
+      }
     }
     if (allowedOriginsSet) {
       const origin = req.headers?.["origin"];
@@ -61522,6 +61832,7 @@ export {
   authorizationRequiredMetaSchema,
   authorizationRequiredParamsSchema,
   authorizationSchema,
+  authorizeSessionTermination,
   buildChannelInstructions,
   buildEsmPromptRecord,
   buildEsmResourceRecord,
@@ -61695,6 +62006,7 @@ export {
   isPackageSpecifier,
   isPublicError,
   isPublicMode,
+  isPublicUrlPinned,
   isPubsubConfigured,
   isRedisProvider,
   isRemoteMode,