@grest-ts/oauth 0.0.89 → 0.0.90

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@grest-ts/oauth",
-  "version": "0.0.89",
+  "version": "0.0.90",
   "type": "module",
   "license": "MIT",
   "description": "OAuth 2.1 authorization server (panva oidc-provider on GGHttpServer) issuing @grest-ts/auth tokens, plus a browser code+PKCE client for GGAuthSession",
@@ -65,9 +65,9 @@
     "oidc-provider": "9.13.0"
   },
   "peerDependencies": {
-    "@grest-ts/auth": "0.0.89",
-    "@grest-ts/db-dynamodb": "0.0.89",
-    "@grest-ts/http": "0.0.89",
-    "@grest-ts/schema": "0.0.89"
+    "@grest-ts/auth": "0.0.90",
+    "@grest-ts/db-dynamodb": "0.0.90",
+    "@grest-ts/http": "0.0.90",
+    "@grest-ts/schema": "0.0.90"
   }
 }

package/src/_dedupCheck.ts

@@ -12,7 +12,7 @@
 const __KEY = Symbol.for("grest-ts:dedup:@grest-ts/oauth");
 const __slot = globalThis as Record<symbol, unknown>;
 const __existing = __slot[__KEY] as { path: string; version: string } | undefined;
-const __here = { path: import.meta.url, version: "0.0.89" };
+const __here = { path: import.meta.url, version: "0.0.90" };
 // Same path + same version means the same physical package is being
 // re-evaluated by a different ESM runner (e.g. vitest projects share one
 // process but each project has its own module cache). That isn't a true

package/src/node/GGOAuthServer.test.ts

@@ -82,7 +82,7 @@ class OAuthTestRuntime extends GGRuntime {
             interactionUrl: (uid) => `${APP_LOGIN}?uid=${uid}`,
             firstPartyClients: () => [{clientId: "app", name: "The App", redirectUris: [FIRST_PARTY_REDIRECT], postLogoutRedirectUris: ["https://app.example/"]}],
             dynamicRegistration: true,
-            clientIdMetadataDocument: {allowedHosts: () => ["clients.example"]},
+            clientIdMetadataDocument: {allowedUrlPrefixes: () => ["https://clients.example/oauth/"]},
             proxy: true,
         })
         oauth.mount(server)
@@ -172,6 +172,22 @@ async function register(redirectUris = [THIRD_PARTY_REDIRECT]): Promise<string>
     return (await res.json()).client_id
 }
 
+describe("GGOAuthServer resources", () => {
+    const base = {issuer: () => ISSUER, store: new InMemoryOAuthStore(), secret: () => "s", interactionUrl: () => "", scopes: ["x"] as [string]}
+    const resource = (audience: string | undefined) => ({
+        resource: () => `${ISSUER}/${audience ?? "none"}`,
+        accessToken: new GGAuthAccessToken({signer: new HmacSigner("k"), claimSchema: IsClaims, audience}),
+        scopes: ["x"] as [string],
+        claims: async () => ({permissions: []}),
+    })
+
+    test("each resource needs its own audience (shared signer)", () => {
+        expect(() => new GGOAuthServer({...base, resources: [resource("a"), resource(undefined)]})).toThrow(/own audience/)
+        expect(() => new GGOAuthServer({...base, resources: [resource("a"), resource("a")]})).toThrow(/own audience/)
+        expect(() => new GGOAuthServer({...base, resources: [resource("a"), resource("b")]})).not.toThrow()
+    })
+})
+
 describe("GGOAuthServer", () => {
     let runtime: OAuthTestRuntime
     beforeAll(async () => { runtime = await new OAuthTestRuntime().start() })
@@ -257,10 +273,18 @@ describe("GGOAuthServer", () => {
         expect(again.origin + again.pathname).toBe(APP_LOGIN)
     })
 
-    test("client metadata documents are fetched only from allowed hosts", async () => {
-        const res = await new Browser().get(authorizeUrl("https://elsewhere.example/client.json", THIRD_PARTY_REDIRECT, pkce().challenge))
-        expect(res.status).toBe(400)
-        expect(await res.text()).toContain("invalid_client")
+    test("client metadata documents are fetched only from allowed URL prefixes", async () => {
+        for (const clientId of [
+            "https://elsewhere.example/oauth/client.json",
+            "https://clients.example/other/client.json",
+            "https://clients.example/oauthx/client.json",
+            "https://clients.example:8443/oauth/client.json",
+            "https://user@clients.example/oauth/client.json",
+        ]) {
+            const res = await new Browser().get(authorizeUrl(clientId, THIRD_PARTY_REDIRECT, pkce().challenge))
+            expect(res.status, clientId).toBe(400)
+            expect(await res.text(), clientId).toContain("invalid_client")
+        }
     })
 
     test("deny sends access_denied to the client", async () => {
@@ -347,6 +371,9 @@ describe("GGOAuthServer", () => {
         const uid = new URL(res.headers.get("location")!, "https://evil.example").pathname.split("/").pop()!
         const approved = await interaction((await userToken.issue("alice", {permissions: []})).token)("approve", uid)
         expect(new URL(approved.data.redirectUrl).origin).toBe(ISSUER)
+
+        const meta = await (await fetch(`${ISSUER}/.well-known/oauth-authorization-server`, {headers: {"x-forwarded-host": "evil.example"}})).json()
+        expect(new URL(meta.token_endpoint).origin).toBe(ISSUER)
     })
 
     test("a refresh that fails before issuing (claims unavailable) can be retried", async () => {

package/src/node/GGOAuthServer.ts

@@ -51,12 +51,14 @@ export interface GGOAuthServerOptions {
     // Let any client self-register (RFC 7591).
     dynamicRegistration?: boolean
     // Accept clients identified by a metadata document URL (CIMD, what MCP clients prefer), fetched
-    // only from these hosts — e.g. a vendor's hosted client documents.
-    clientIdMetadataDocument?: {allowedHosts: () => string[]}
+    // only from https URLs on the default port under one of these prefixes (end each with "/"),
+    // e.g. a vendor's hosted client documents: "https://claude.ai/oauth/".
+    clientIdMetadataDocument?: {allowedUrlPrefixes: () => string[]}
     // Absolute refresh lifetime: rotation never extends it (OAuth for browser apps, RFC 10017).
     refreshTtlSec?: number
     sessionTtlSec?: number
-    // Trust X-Forwarded-* (behind a TLS-terminating load balancer).
+    // Trust X-Forwarded-Proto (behind a TLS-terminating load balancer). X-Forwarded-Host is never
+    // trusted: clients can send it through a load balancer that doesn't set it.
     proxy?: boolean
 }
 
@@ -79,6 +81,12 @@ export class GGOAuthServer {
     private readonly options: GGOAuthServerOptions
 
     constructor(options: GGOAuthServerOptions) {
+        // Resources sharing a signer are told apart only by audience: a token for one must never
+        // verify as another's (e.g. an app's MCP token as the first-party API token).
+        const audiences = options.resources.map(r => r.accessToken.audience)
+        if (audiences.some(a => !a) || new Set(audiences).size !== audiences.length) {
+            throw new Error("GGOAuthServer: every resource's accessToken needs its own audience")
+        }
         this.options = options
     }
 
@@ -89,6 +97,7 @@ export class GGOAuthServer {
 
     public mount(server: GGHttpServer): void {
         const handle = async (req: IncomingMessage, res: ServerResponse) => {
+            delete req.headers["x-forwarded-host"]
             const path = new URL(req.url ?? "/", "http://x").pathname
             const interaction = path.match(/^\/oauth\/interaction\/([^/]+)(\/complete)?$/)
             if (interaction && req.method === "GET") {
@@ -346,7 +355,7 @@ export class GGOAuthServer {
                 ...(o.clientIdMetadataDocument ? {clientIdMetadataDocument: {
                     enabled: true,
                     ack: "draft-02",
-                    allowFetch: async (_ctx: unknown, clientId: string) => o.clientIdMetadataDocument!.allowedHosts().includes(new URL(clientId).hostname),
+                    allowFetch: async (_ctx: unknown, clientId: string) => isAllowedDocumentUrl(clientId, o.clientIdMetadataDocument!.allowedUrlPrefixes()),
                 }} : {}),
                 rpInitiatedLogout: {
                     enabled: true,
@@ -464,6 +473,12 @@ export class GGOAuthServer {
 }
 
 
+function isAllowedDocumentUrl(clientId: string, prefixes: string[]): boolean {
+    const url = URL.parse(clientId)
+    if (!url || url.protocol !== "https:" || url.port !== "" || url.username || url.password) return false
+    return prefixes.some(prefix => (url.origin + url.pathname).startsWith(prefix))
+}
+
 function requestedScopes(params: Record<string, unknown>): string[] {
     return String(params.scope ?? "").split(" ").filter(Boolean)
 }