@hotmeshio/long-tail 0.25.3 → 0.25.4

package/build/routes/oauth-server/authorize.js

@@ -16,8 +16,8 @@ function sendAuthorizationError(res, check, issuer, asJson) {
         res.status(400).json({ error: check.error, error_description: check.description });
         return;
     }
-    const redirect = (0, authorization_1.withQuery)(check.redirectUri, {
-        error: check.error, error_description: check.description, state: check.state, iss: issuer,
+    const redirect = (0, authorization_1.authorizationResponseUri)(check.redirectUri, issuer, {
+        error: check.error, error_description: check.description, state: check.state,
     });
     if (asJson)
         res.json({ redirect });
@@ -76,7 +76,7 @@ router.post('/authorize', auth_1.requireCredentialAuth, async (req, res) => {
         userId: req.auth.userId, clientId: client.client_id, policy: { preset }, scope: oauth_server_2.PRESET_SCOPE[preset],
         redirectUri, codeChallenge, resource, ttlSeconds: defaults_1.OAUTH_CODE_TTL_SECONDS,
     });
-    res.json({ redirect: (0, authorization_1.withQuery)(redirectUri, { code, state, iss: settings.issuer }) });
+    res.json({ redirect: (0, authorization_1.authorizationResponseUri)(redirectUri, settings.issuer, { code, state }) });
 });
 /**
  * POST /api/oauth/deny
@@ -93,7 +93,7 @@ router.post('/deny', auth_1.requireCredentialAuth, async (req, res) => {
         return;
     }
     const state = typeof req.body?.state === 'string' ? req.body.state : undefined;
-    res.json({ redirect: (0, authorization_1.withQuery)(redirectUri, { error: 'access_denied', state, iss: settings.issuer }) });
+    res.json({ redirect: (0, authorization_1.authorizationResponseUri)(redirectUri, settings.issuer, { error: 'access_denied', state }) });
 });
 /**
  * GET /api/oauth/clients/:id

package/build/services/auth/oauth-server/authorization.d.ts

@@ -37,6 +37,11 @@ export declare function checkAuthorizationRequest(params: Record<string, unknown
 export declare function isGrantPreset(value: unknown): value is LTGrantPreset;
 /** `uri` with `params` added to its query, keeping any query it already has. */
 export declare function withQuery(uri: string, params: Record<string, string | undefined>): string;
+/**
+ * The client's redirect for an authorization response, a code or an error.
+ * Always carries `iss` (RFC 9207), as the server metadata advertises.
+ */
+export declare function authorizationResponseUri(redirectUri: string, issuer: string, params: Record<string, string | undefined>): string;
 /**
  * The presets the person may grant. Read-only always; Just be me only when it
  * adds something: a membership that can write, or an admin tier.

package/build/services/auth/oauth-server/authorization.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkAuthorizationRequest = checkAuthorizationRequest;
 exports.isGrantPreset = isGrantPreset;
 exports.withQuery = withQuery;
+exports.authorizationResponseUri = authorizationResponseUri;
 exports.grantablePresets = grantablePresets;
 const registration_1 = require("./registration");
 const store_1 = require("./store");
@@ -44,6 +45,13 @@ function withQuery(uri, params) {
             url.searchParams.set(key, value);
     return url.toString();
 }
+/**
+ * The client's redirect for an authorization response, a code or an error.
+ * Always carries `iss` (RFC 9207), as the server metadata advertises.
+ */
+function authorizationResponseUri(redirectUri, issuer, params) {
+    return withQuery(redirectUri, { ...params, iss: issuer });
+}
 /**
  * The presets the person may grant. Read-only always; Just be me only when it
  * adds something: a membership that can write, or an admin tier.

package/build/services/auth/oauth-server/metadata.d.ts

@@ -6,7 +6,7 @@ export declare const OAUTH_ENDPOINT_PATHS: {
     readonly REGISTER: "/api/oauth/register";
     readonly REVOKE: "/api/oauth/revoke";
 };
-/** RFC 8414 authorization server metadata. */
+/** RFC 8414 authorization server metadata. Authorization responses carry `iss` (RFC 9207). */
 export declare function authorizationServerMetadata(settings: OAuthServerSettings): Record<string, unknown>;
 /** RFC 9728 protected resource metadata for `/mcp`. */
 export declare function protectedResourceMetadata(settings: OAuthServerSettings): Record<string, unknown>;

package/build/services/auth/oauth-server/metadata.js

@@ -13,7 +13,7 @@ exports.OAUTH_ENDPOINT_PATHS = {
     REVOKE: '/api/oauth/revoke',
 };
 const SCOPES_SUPPORTED = [constants_1.MCP_SCOPES.READ, constants_1.MCP_SCOPES.FULL];
-/** RFC 8414 authorization server metadata. */
+/** RFC 8414 authorization server metadata. Authorization responses carry `iss` (RFC 9207). */
 function authorizationServerMetadata(settings) {
     const at = (path) => `${settings.issuer}${path}`;
     return {
@@ -28,6 +28,7 @@ function authorizationServerMetadata(settings) {
         token_endpoint_auth_methods_supported: ['none'],
         revocation_endpoint_auth_methods_supported: ['none'],
         scopes_supported: SCOPES_SUPPORTED,
+        authorization_response_iss_parameter_supported: true,
     };
 }
 /** RFC 9728 protected resource metadata for `/mcp`. */

package/docs/mcp.md

@@ -216,7 +216,10 @@ start({
   auth: {
     oauthServer: {
       issuer: 'https://api.example.com/longtail', // the public base URL Long Tail is served under
-      allowedRedirectUris: ['https://claude.ai/api/mcp/auth_callback'], // exact https redirects, beyond loopback
+      allowedRedirectUris: [                      // exact https redirects, beyond loopback
+        'https://claude.ai/api/mcp/auth_callback',
+        'https://chatgpt.com/connector_platform_oauth_redirect',
+      ],
     },
   },
 });
@@ -224,6 +227,8 @@ start({
 
 Clients register themselves (RFC 7591). Loopback redirects (`http://127.0.0.1`, `localhost`, `[::1]`, any port) are always allowed, which covers Claude Code and Claude Desktop; an `https` redirect is allowed only when it equals a URI in `allowedRedirectUris`.
 
+Every authorization response, a code or an error, carries the issuer as `iss` (RFC 9207), and the server metadata advertises it with `authorization_response_iss_parameter_supported`. Clients that check the issuer use one fixed callback for every connection, which a single `allowedRedirectUris` entry covers: ChatGPT's is `https://chatgpt.com/connector_platform_oauth_redirect`.
+
 **Embedded deployments** mount two routers, and let four paths reach Long Tail without the host's login:
 
 - `adapter.getRouter()` under the base path, as today, and `adapter.getWellKnownRouter()` at the host's root. The well-known router answers only its two documents and passes every other request on.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hotmeshio/long-tail",
-  "version": "0.25.3",
+  "version": "0.25.4",
   "description": "Long Tail Workflows — Durable AI workflows with human-in-the-loop escalation. Powered by PostgreSQL.",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",