@kya-os/mcp-i-cloudflare 1.13.0 → 1.13.3

package/dist/services/consent.service.js

@@ -12,10 +12,11 @@ import { DEFAULT_AGENTSHIELD_URL, DEFAULT_SESSION_CACHE_TTL, KEY_PAIR_TTL_SECOND
 import { STORAGE_KEYS } from "../constants/storage-keys";
 import { loadDay0Config, getDelegationFieldName } from "../utils/day0-config";
 import { buildProviderAuthorizeUrl } from "../runtime/oidc/authorize-url.js";
+import { resolveIdpScopes } from "../runtime/oidc/idp-scopes.js";
 import { validateConsentApprovalRequest, } from "@kya-os/contracts/consent";
 import { AGENTSHIELD_ENDPOINTS, createDelegationAPIResponseSchema, createDelegationResponseSchema, } from "@kya-os/contracts/agentshield-api";
 import { createUnsignedVCJWT, completeVCJWT, parseVCJWT, generateDidKeyFromBase64, createDelegationVerifier, createDidKeyResolver, logger, base64urlEncodeFromBytes, base64urlDecodeToBytes, bytesToBase64, wrapDelegationAsVC, } from "@kya-os/mcp";
-import { fetchRemoteConfig, } from "@kya-os/mcp-i-runtime"; // product-layer symbols stay on OLD (C2 #2918)
+import { fetchRemoteConfig, normalizeAuthType, } from "@kya-os/mcp-i-runtime"; // product-layer symbols stay on OLD (C2 #2918)
 import { WebCryptoProvider } from "../providers/crypto";
 import { ConsentAuditService } from "./consent-audit.service";
 import { CloudflareProofGenerator } from "../proof-generator";
@@ -145,7 +146,7 @@ export class ConsentService {
      * @returns true if DO storage succeeded (strongly consistent), false if fell back to KV only
      */
     async storeDelegationForOAuth(params, serverOrigin) {
-        return this.storeDelegationToken(params.sessionId, params.agentDid, params.delegationToken, params.delegationId, params.userDid, serverOrigin);
+        return this.storeDelegationToken(params.sessionId, params.agentDid, params.delegationToken, params.delegationId, params.userDid, serverOrigin, params.authorizationType);
     }
     /**
      * Initialize audit service - fetches config from remote API
@@ -1154,13 +1155,19 @@ export class ConsentService {
             !providerConfig.proxyMode) {
             // Use providerConfig.clientId from AgentShield dashboard config
             const oauthClientId = providerConfig.clientId || projectId;
+            // The `scopes` argument holds MCP-I delegation scopes (e.g. "greet:execute"),
+            // which the identity provider has never heard of. Only the provider's own
+            // scopes belong in its authorization URL; delegation scopes already travel
+            // separately in `stateData.scopes` above, for the callback to mint the
+            // delegation.
+            const idpScopes = resolveIdpScopes(providerConfig);
             logger.debug("[ConsentService] Using direct OAuth mode (PKCE)", {
                 provider: provider || "unknown",
                 authorizationUrl: providerConfig.authorizationUrl,
                 supportsPKCE: providerConfig.supportsPKCE,
                 clientId: oauthClientId.substring(0, 8) + "...",
             });
-            return this.buildDirectOAuthUrl(providerConfig, oauthClientId, `${serverUrl}/oauth/callback`, scopes, stateParam, codeChallenge);
+            return this.buildDirectOAuthUrl(providerConfig, oauthClientId, `${serverUrl}/oauth/callback`, idpScopes, stateParam, codeChallenge);
         }
         // Phase 3: Validate custom parameters don't conflict with reserved parameters
         const RESERVED_PARAMS = [
@@ -1195,7 +1202,9 @@ export class ConsentService {
         oauthUrl.searchParams.set("response_type", "code");
         oauthUrl.searchParams.set("client_id", projectId); // Use projectId as client_id
         oauthUrl.searchParams.set("redirect_uri", `${serverUrl}/oauth/callback`);
-        oauthUrl.searchParams.set("scope", scopes.join(" "));
+        // Same separation as the direct-PKCE branch above: `scopes` is the MCP-I
+        // delegation scopes, not what belongs in the IdP-facing `scope` param.
+        oauthUrl.searchParams.set("scope", resolveIdpScopes(providerConfig).join(" "));
         oauthUrl.searchParams.set("state", stateParam);
         // ✅ Pass provider to AgentShield bouncer so it selects the correct auth method
         // This is critical when multiple providers are configured for a project
@@ -2121,6 +2130,10 @@ export class ConsentService {
                     headers: {
                         "Content-Type": "text/html; charset=utf-8",
                         "Cache-Control": "no-cache, no-store, must-revalidate",
+                        // SECURITY (A2, spec §3.1): the identity assertion is delivered to
+                        // this page in the URL fragment; `no-referrer` guarantees the token
+                        // (and any query state) never leaks to a third party via `Referer`.
+                        "Referrer-Policy": "no-referrer",
                     },
                 });
             }
@@ -2131,6 +2144,10 @@ export class ConsentService {
                 headers: {
                     "Content-Type": "text/html; charset=utf-8",
                     "Cache-Control": "no-cache, no-store, must-revalidate",
+                    // SECURITY (A2, spec §3.1): the identity assertion is delivered to
+                    // this page in the URL fragment; `no-referrer` guarantees the token
+                    // (and any query state) never leaks to a third party via `Referer`.
+                    "Referrer-Policy": "no-referrer",
                 },
             });
         }
@@ -3219,6 +3236,36 @@ export class ConsentService {
             throw new Error(`Failed to parse request body: ${error instanceof Error ? error.message : "Unknown error"}`);
         }
     }
+    /**
+     * Interpret the `CONSENT_REQUIRE_IDENTITY` env override that gates the
+     * identity-required refusal in `handleApproval`. Defaults to enabled - only
+     * an explicit `"false"`/`"0"` disables it, mirroring the escape-hatch
+     * convention used for `MCPI_HTTP_CHALLENGE` in config.ts.
+     */
+    isIdentityRequired() {
+        const raw = this.env.CONSENT_REQUIRE_IDENTITY;
+        if (raw === undefined || raw === null)
+            return true;
+        const normalized = String(raw).trim().toLowerCase();
+        return normalized !== "false" && normalized !== "0";
+    }
+    /**
+     * 403 returned by `handleApproval` when a credential/OAuth clickwrap mint is
+     * attempted without a valid, grant-bound identity assertion (A3, spec §3.2).
+     * A distinct `error_code` from the plain `identity_required` gate so callers
+     * and tests can tell "no server-signed proof of authentication" apart from
+     * "no identity resolved at all".
+     */
+    identityAssertionRequiredResponse() {
+        return new Response(JSON.stringify({
+            success: false,
+            error: "A valid identity assertion is required to approve this request",
+            error_code: "identity_assertion_required",
+        }), {
+            status: 403,
+            headers: { "Content-Type": "application/json" },
+        });
+    }
     /**
      * Handle consent approval
      *
@@ -3244,6 +3291,16 @@ export class ConsentService {
             // - 'none': Consent-only mode (clickwrap) - user agrees without authentication
             const bodyObj = body;
             const providerType = bodyObj?.provider_type;
+            // SECURITY (A3, spec §3.1/§3.2, defect #2): the identity a delegation is
+            // minted under is authoritative ONLY from a trusted source resolved below
+            // — a server-signed identity assertion (credential/OAuth clickwrap) or the
+            // server-generated ephemeral / session-stored DID (pure consent-only).
+            // A caller-supplied `user_did` body field is NEVER an identity source.
+            // This holds the trusted value; it overwrites `bodyObj.user_did`
+            // unconditionally before validation so no downstream consumer can read a
+            // forged one. `undefined` for the plain authenticated (non-clickwrap)
+            // shapes, which fall back to server-side session resolution.
+            let trustedUserDid;
             // CRED-003: Check for credential provider submission
             // Credential submissions include `provider_type: 'credential'` or 'password' and are handled separately
             // IMPORTANT: AgentShield tool protection uses 'password' for credential-based auth validation,
@@ -3282,18 +3339,36 @@ export class ConsentService {
                             provider_type: CONSENT_PROVIDER_TYPES.PASSWORD,
                         };
                     }
-                    // CRITICAL FIX: Read userDid from URL params passed through redirect
-                    // This bypasses KV eventual consistency issues - we don't need to read
-                    // from KV because userDid was passed directly in the redirect URL
-                    const userDidFromRedirect = bodyObj.user_did;
-                    if (userDidFromRedirect) {
-                        logger.debug("[ConsentService] ✅ Using userDid from redirect (bypassing KV):", {
-                            sessionId: sessionId?.substring(0, 20) + "...",
-                            userDid: userDidFromRedirect.substring(0, 30) + "...",
-                            source: "redirect-param",
-                        });
-                        // Ensure userDid is in bodyObj for createDelegation and storeDelegationToken
-                        bodyObj.user_did = userDidFromRedirect;
+                    // SECURITY (A3, spec §3.2): the userDid for a post-credential
+                    // clickwrap mint comes ONLY from the server-signed identity assertion
+                    // minted by handleCredentialApproval after it authenticated against
+                    // the provider — bound to this sid AND grant (agent/tool/scopes/
+                    // project). The bare `user_did` redirect param that used to be trusted
+                    // here is gone: it was caller-forgeable (subject/issuer forgery). A
+                    // missing/invalid/expired/mismatched assertion → 403, no mint.
+                    if (this.isDevConsentTestMode()) {
+                        // Dev/test escape hatch (BOTH MCPI_TEST_CONSENT and a development
+                        // env), mirroring consent-anchor-bridge's call-site CSRF relaxation:
+                        // no signed assertion is required, so local/miniflare runs work
+                        // without OAUTH_ENCRYPTION_SECRET. Never on prod/staging/unset.
+                        trustedUserDid = bodyObj.user_did;
+                    }
+                    else {
+                        const assertion = bodyObj.identity_assertion;
+                        const verifiedUserDid = typeof assertion === "string"
+                            ? await this.verifyIdentityAssertion(assertion, {
+                                sid: sessionId,
+                                agentDid: bodyObj.agent_did ?? "",
+                                tool: bodyObj.tool ?? "",
+                                scopes: this.parseScopes(bodyObj.scopes),
+                                projectId: bodyObj.project_id ?? "",
+                            })
+                            : null;
+                        if (!verifiedUserDid) {
+                            logger.warn("[ConsentService] Post-credential clickwrap has no valid identity assertion — refusing to mint");
+                            return this.identityAssertionRequiredResponse();
+                        }
+                        trustedUserDid = verifiedUserDid;
                     }
                     // Read user info from redirect URL params
                     // Field mapping (clear naming):
@@ -3319,7 +3394,7 @@ export class ConsentService {
                         sessionId: sessionId?.substring(0, 20) + "...",
                         providerType: CONSENT_PROVIDER_TYPES.PASSWORD,
                         provider: credentialProvider,
-                        hasUserDid: !!userDidFromRedirect,
+                        hasUserDid: !!trustedUserDid,
                         hasCredentialUserEmail: !!credentialUserEmailFromRedirect,
                         hasProviderUserId: !!credentialProviderUserIdFromRedirect,
                         note: "Delegation will have authorization.type='password' to match tool protection",
@@ -3348,12 +3423,46 @@ export class ConsentService {
                         provider: oauthProvider || bodyObj.provider,
                         note: "Delegation will have authorization.type='oauth' to match tool protection",
                     });
+                    // SECURITY (A3, spec §3.2): as with the credential clickwrap, the
+                    // userDid for a post-OAuth clickwrap mint comes ONLY from the
+                    // server-signed identity assertion minted by the OAuth callback
+                    // (oauth-handler.ts) after it linked the OAuth identity to the user
+                    // DID — bound to this sid AND grant. No valid assertion → 403, no
+                    // mint. The bare `user_did` redirect param is no longer trusted here.
+                    if (this.isDevConsentTestMode()) {
+                        trustedUserDid = bodyObj.user_did;
+                    }
+                    else {
+                        const assertion = bodyObj.identity_assertion;
+                        const verifiedUserDid = typeof assertion === "string"
+                            ? await this.verifyIdentityAssertion(assertion, {
+                                sid: sessionId,
+                                agentDid: bodyObj.agent_did ?? "",
+                                tool: bodyObj.tool ?? "",
+                                scopes: this.parseScopes(bodyObj.scopes),
+                                projectId: bodyObj.project_id ?? "",
+                            })
+                            : null;
+                        if (!verifiedUserDid) {
+                            logger.warn("[ConsentService] Post-OAuth clickwrap has no valid identity assertion — refusing to mint");
+                            return this.identityAssertionRequiredResponse();
+                        }
+                        trustedUserDid = verifiedUserDid;
+                    }
                 }
                 // If neither credential nor OAuth, this is pure consent-only
                 if (!(credentialProviderType === CONSENT_PROVIDER_TYPES.PASSWORD ||
                     oauthProviderType === "oauth")) {
                     // Pure consent-only mode - no prior authentication
                     logger.debug("[ConsentService] Consent-only mode detected (pure clickwrap)");
+                    // SECURITY (A3, spec §3.2, review #5): a pure consent-only mint is
+                    // intentionally anonymous/ephemeral — it never had a victim identity
+                    // to attribute. Any caller-supplied `user_did` is forgeable and must
+                    // NEVER survive. Discard it up-front, before the ephemeral/session DID
+                    // is (maybe) resolved below, so no sub-path — including the
+                    // DELEGATION_STORAGE-unbound `else` fallback that used to leave the
+                    // body value intact — can carry a forged DID into the mint.
+                    trustedUserDid = undefined;
                     if (sessionId && this.env.DELEGATION_STORAGE) {
                         // Check if session already has userDid (from credential auth or OAuth)
                         let existingUserDid;
@@ -3371,7 +3480,9 @@ export class ConsentService {
                                 sessionId: sessionId.substring(0, 20) + "...",
                                 userDid: existingUserDid.substring(0, 30) + "...",
                             });
-                            bodyObj.user_did = existingUserDid;
+                            // Server-side session identity (set by a prior auth step), not a
+                            // caller-supplied body value — safe to trust.
+                            trustedUserDid = existingUserDid;
                         }
                         else {
                             // Generate ephemeral userDid for pure consent-only
@@ -3382,8 +3493,9 @@ export class ConsentService {
                                 // This ensures storeDelegationToken can find it and use PRIORITY 1 key
                                 await this.updateSessionWithIdentity(sessionId, ephemeralUserDid, null // No OAuth identity for consent-only
                                 );
-                                // Also inject the user_did into the request body so createDelegation receives it
-                                bodyObj.user_did = ephemeralUserDid;
+                                // Server-generated ephemeral DID (not a caller-supplied value)
+                                // — safe to trust as the anonymous consent-only subject.
+                                trustedUserDid = ephemeralUserDid;
                                 logger.debug("[ConsentService] ✅ Ephemeral userDid stored in session for consent-only flow:", {
                                     sessionId: sessionId.substring(0, 20) + "...",
                                     userDid: ephemeralUserDid.substring(0, 30) + "...",
@@ -3400,6 +3512,16 @@ export class ConsentService {
                     }
                 }
             }
+            // SECURITY (A3, spec §3.2, defect #2 :4419/:4477): overwrite the forgeable
+            // `user_did` body field with the trusted value resolved above — a signed
+            // assertion, or the server-generated ephemeral / session DID — for EVERY
+            // shape, unconditionally. For the plain authenticated (non-clickwrap)
+            // shapes `trustedUserDid` is undefined, which wipes any caller-supplied
+            // `user_did` so it can never be an identity source; those shapes then fall
+            // back to server-side session resolution below. This is the single choke
+            // point that guarantees no downstream consumer (validation,
+            // createDelegation, storeDelegationToken) ever reads a caller-forged DID.
+            bodyObj.user_did = trustedUserDid;
             // Convert null oauth_identity to undefined for proper schema validation
             // Zod's .nullish() should handle null, but converting to undefined is more explicit
             // and avoids potential edge cases with FormData parsing
@@ -3453,11 +3575,30 @@ export class ConsentService {
             // ✅ Lazy initialization with projectId
             const auditService = await this.getAuditService(projectId);
             // Check if user needs credentials before delegation
-            // Skip credential requirement for consent-only mode (provider_type: 'none')
-            const isConsentOnlyMode = providerType === CONSENT_PROVIDER_TYPES.NONE;
-            const needsCredentials = !isConsentOnlyMode &&
-                !approvalRequest.user_did &&
-                !approvalRequest.oauth_identity;
+            // Skip credential requirement for consent-only mode (provider_type: 'none').
+            // Read the EFFECTIVE provider_type off bodyObj, not the `providerType`
+            // captured above: the post-OAuth/post-credential clickwrap branches above
+            // rewrite bodyObj.provider_type to 'oauth'/'password' while `providerType`
+            // stays the original raw 'none'. Gating on the stale value would treat
+            // those already-authenticated clickwrap submissions as consent-only and
+            // skip the identity check entirely.
+            const effectiveProviderType = bodyObj.provider_type;
+            const isConsentOnlyMode = effectiveProviderType === CONSENT_PROVIDER_TYPES.NONE;
+            // Resolve identity once, ahead of the gate below, using the same priority
+            // createDelegation used to apply internally (request.user_did first, then
+            // session lookup). The resolved value is threaded into createDelegation so
+            // it is never resolved a second time.
+            let resolvedUserDid = approvalRequest.user_did;
+            if (!resolvedUserDid && approvalRequest.session_id) {
+                try {
+                    resolvedUserDid =
+                        (await this.getUserDidForSession(approvalRequest.session_id, approvalRequest.oauth_identity || undefined)) ?? undefined;
+                }
+                catch (error) {
+                    logger.debug("[ConsentService] Failed to resolve userDid ahead of identity gate:", error);
+                }
+            }
+            const needsCredentials = !isConsentOnlyMode && !resolvedUserDid;
             if (needsCredentials && auditService) {
                 await auditService
                     .logCredentialRequired({
@@ -3475,12 +3616,25 @@ export class ConsentService {
                         error: err instanceof Error ? err.message : String(err),
                     });
                 });
-                // Note: We don't redirect here - the consent flow continues
-                // The credential_required event is just for audit tracking
+            }
+            // Fail closed: an authenticated-provider approval with no resolvable user
+            // identity must not mint a delegation. Consent-only mode is exempt - it
+            // legitimately has no user identity. Gated on CONSENT_REQUIRE_IDENTITY so
+            // a bad interaction can be switched off in production without a redeploy;
+            // defaults to enabled.
+            if (needsCredentials && this.isIdentityRequired()) {
+                return new Response(JSON.stringify({
+                    success: false,
+                    error: "User identity is required to approve this request",
+                    error_code: "identity_required",
+                }), {
+                    status: 403,
+                    headers: { "Content-Type": "application/json" },
+                });
             }
             // Create delegation via AgentShield API
             logger.debug("[ConsentService] Creating delegation...");
-            const delegationResult = await this.createDelegation(approvalRequest, resolveExpirationDays(consentConfig.expirationDays));
+            const delegationResult = await this.createDelegation(approvalRequest, resolveExpirationDays(consentConfig.expirationDays), resolvedUserDid ?? null);
             if (!delegationResult.success) {
                 logger.error("[ConsentService] Delegation creation failed:", {
                     error: delegationResult.error,
@@ -3499,27 +3653,27 @@ export class ConsentService {
                 delegationId: delegationResult.delegation_id?.substring(0, 20) + "...",
             });
             // Store delegation token to DO (strongly consistent) and KV (backward compat)
-            // Pass user_did directly if available (from redirect params) to bypass KV consistency issues
+            // SECURITY (A3, defect #2 :4477): pass the trusted `resolvedUserDid`
+            // (assertion / ephemeral / session-resolved), NOT the raw body
+            // `approvalRequest.user_did`, so the stored delegation key is never scoped
+            // to a caller-forged DID. `resolvedUserDid` is a superset of the body
+            // value (which is already neutralised above) plus server-side resolution.
             const serverOrigin = new URL(request.url).origin;
-            await this.storeDelegationToken(approvalRequest.session_id, approvalRequest.agent_did, delegationResult.delegation_token, delegationResult.delegation_id, approvalRequest.user_did, // Pass userDid directly to bypass KV read
-            serverOrigin // Pass origin for DO URL construction
-            );
+            await this.storeDelegationToken(approvalRequest.session_id, approvalRequest.agent_did, delegationResult.delegation_token, delegationResult.delegation_id, resolvedUserDid, // trusted identity only (see above)
+            serverOrigin, // Pass origin for DO URL construction
+            // Task B2: the EFFECTIVE provider_type is the delegation's auth type.
+            // On this ('none') branch it is one of 'none' | 'password' | 'oauth'
+            // (the post-credential / post-OAuth clickwrap branches rewrote it to
+            // match the tool's authorization.type; 'credential'/'password' form
+            // submissions were routed to handleCredentialApproval earlier), so it
+            // maps cleanly through normalizeAuthType — no 'credential' mis-fold here.
+            effectiveProviderType);
             // ✅ After successful delegation creation - log audit events
             if (auditService && delegationResult.success) {
                 try {
-                    // Get userDid (resolved via OAuth identity resolution)
-                    // getUserDidForSession can work without DELEGATION_STORAGE (uses in-memory UserDidManager)
-                    let userDid;
-                    if (approvalRequest.session_id) {
-                        try {
-                            userDid =
-                                (await this.getUserDidForSession(approvalRequest.session_id, approvalRequest.oauth_identity || undefined)) ?? undefined; // Phase 5: Convert null to undefined
-                        }
-                        catch (error) {
-                            logger.warn("[ConsentService] Failed to get userDid for lifecycle recording:", error);
-                            // Continue without userDid - audit events can still be logged
-                        }
-                    }
+                    // Reuse the identity resolved ahead of the gate above - do not
+                    // read KV a second time for the same session.
+                    const userDid = resolvedUserDid;
                     await auditService.logConsentApproval({
                         sessionId: approvalRequest.session_id,
                         userDid,
@@ -3583,7 +3737,7 @@ export class ConsentService {
      * @param request - Approval request
      * @returns Delegation creation result
      */
-    async createDelegation(request, expirationDaysOverride) {
+    async createDelegation(request, expirationDaysOverride, resolvedUserDid) {
         const agentShieldUrl = this.env.AGENTSHIELD_API_URL || DEFAULT_AGENTSHIELD_URL;
         const apiKey = this.env.AGENTSHIELD_API_KEY;
         if (!apiKey) {
@@ -3598,46 +3752,59 @@ export class ConsentService {
             // Load Day0 configuration to determine field name and API capabilities
             await loadDay0Config(this.env.DELEGATION_STORAGE);
             const fieldName = await getDelegationFieldName(this.env.DELEGATION_STORAGE);
-            // Get userDID - FIRST check if passed in request, THEN fallback to session storage
-            // request.user_did takes priority to avoid KV eventual consistency issues
-            // This fixes the bug where credential auth resolves userDid but it's not found in storage
-            let userDid = request.user_did;
-            // Only fetch from storage if not already provided in request
-            if (!userDid && request.session_id) {
-                try {
-                    logger.debug("[ConsentService] Getting User DID for session:", {
-                        sessionId: request.session_id.substring(0, 20) + "...",
-                        hasOAuthIdentity: !!request.oauth_identity,
-                        oauthProvider: request.oauth_identity?.provider,
-                        hasStorage: !!this.env.DELEGATION_STORAGE,
-                    });
-                    // Pass OAuth identity if available in approval request (can be null/undefined)
-                    // getUserDidForSession can work without DELEGATION_STORAGE (uses in-memory UserDidManager)
-                    // Phase 5: Returns null if no identity found (session stays anonymous)
-                    userDid =
-                        (await this.getUserDidForSession(request.session_id, request.oauth_identity || undefined // Explicitly handle null as undefined
-                        )) ?? undefined;
-                    logger.debug("[ConsentService] User DID retrieved from storage:", {
-                        userDid: userDid?.substring(0, 20) + "...",
-                        hasUserDid: !!userDid,
-                    });
-                }
-                catch (error) {
-                    logger.debug("[ConsentService] Failed to get/generate userDid:", error);
-                    // Continue without userDid - delegation will work without user_identifier
-                    // This is valid for non-OAuth scenarios, but we should log this as a warning
-                    logger.warn("[ConsentService] Delegation will be created without user_identifier - this may affect user tracking");
-                }
-            }
-            else if (userDid) {
-                // userDid was provided in request (e.g., from credential auth flow)
-                logger.debug("[ConsentService] Using provided user_did from request:", {
-                    userDid: userDid.substring(0, 20) + "...",
-                    source: "request.user_did",
+            // Get userDID. If the caller (handleApproval) already resolved it, use that
+            // directly and skip the lookup below entirely - it was already attempted
+            // with the same priority (request.user_did first, then session storage),
+            // and repeating it would read KV a second time for no benefit.
+            let userDid;
+            if (resolvedUserDid !== undefined) {
+                userDid = resolvedUserDid ?? undefined;
+                logger.debug("[ConsentService] Using pre-resolved userDid:", {
+                    hasUserDid: !!userDid,
                 });
             }
             else {
-                logger.debug("[ConsentService] No session_id provided - skipping User DID generation");
+                // FIRST check if passed in request, THEN fallback to session storage
+                // request.user_did takes priority to avoid KV eventual consistency issues
+                // This fixes the bug where credential auth resolves userDid but it's not found in storage
+                userDid = request.user_did;
+                // Only fetch from storage if not already provided in request
+                if (!userDid && request.session_id) {
+                    try {
+                        logger.debug("[ConsentService] Getting User DID for session:", {
+                            sessionId: request.session_id.substring(0, 20) + "...",
+                            hasOAuthIdentity: !!request.oauth_identity,
+                            oauthProvider: request.oauth_identity?.provider,
+                            hasStorage: !!this.env.DELEGATION_STORAGE,
+                        });
+                        // Pass OAuth identity if available in approval request (can be null/undefined)
+                        // getUserDidForSession can work without DELEGATION_STORAGE (uses in-memory UserDidManager)
+                        // Phase 5: Returns null if no identity found (session stays anonymous)
+                        userDid =
+                            (await this.getUserDidForSession(request.session_id, request.oauth_identity || undefined // Explicitly handle null as undefined
+                            )) ?? undefined;
+                        logger.debug("[ConsentService] User DID retrieved from storage:", {
+                            userDid: userDid?.substring(0, 20) + "...",
+                            hasUserDid: !!userDid,
+                        });
+                    }
+                    catch (error) {
+                        logger.debug("[ConsentService] Failed to get/generate userDid:", error);
+                        // Continue without userDid - delegation will work without user_identifier
+                        // This is valid for non-OAuth scenarios, but we should log this as a warning
+                        logger.warn("[ConsentService] Delegation will be created without user_identifier - this may affect user tracking");
+                    }
+                }
+                else if (userDid) {
+                    // userDid was provided in request (e.g., from credential auth flow)
+                    logger.debug("[ConsentService] Using provided user_did from request:", {
+                        userDid: userDid.substring(0, 20) + "...",
+                        source: "request.user_did",
+                    });
+                }
+                else {
+                    logger.debug("[ConsentService] No session_id provided - skipping User DID generation");
+                }
             }
             const expiresInDays = expirationDaysOverride ?? DEFAULT_EXPIRATION_DAYS;
             // Phase 2 VC-Only: Issue Delegation VC if we have a session and userDid
@@ -3868,9 +4035,17 @@ export class ConsentService {
      * @param delegationId - Delegation ID
      * @param providedUserDid - Optional userDid passed directly (bypasses KV read for consistency)
      * @param serverOrigin - Server origin for DO URL construction
+     * @param authorizationType - The delegation's authorization type as recorded
+     *   at mint (raw provider_type / authorization.type). Normalized here before
+     *   persisting so the call-time enforcement gate (Task B2/B3) reads a
+     *   consistent value ("password" | "oauth2" | "none" | …). Undefined → the
+     *   field is omitted and the gate fails safe (never satisfies a typed tool).
      */
-    async storeDelegationToken(sessionId, agentDid, token, delegationId, providedUserDid, serverOrigin) {
+    async storeDelegationToken(sessionId, agentDid, token, delegationId, providedUserDid, serverOrigin, authorizationType) {
         const delegationStorage = this.env.DELEGATION_STORAGE;
+        // Task B2: normalize once (folds deprecated aliases: oauth→oauth2) so every
+        // stored record and every read compares in the same vocabulary.
+        const normalizedAuthorizationType = normalizeAuthType(authorizationType);
         // Resolve userDid if not provided
         let userDid = providedUserDid;
         if (!userDid && delegationStorage) {
@@ -3886,7 +4061,14 @@ export class ConsentService {
         // PRIMARY: Store to Durable Object (strongly consistent)
         // This eliminates eventual consistency issues with KV
         const origin = serverOrigin || this.env.MCP_SERVER_URL || "https://localhost";
-        const storedViaDO = await this.storeDelegationViaDO({ sessionId, delegationToken: token, delegationId, userDid, agentDid }, origin);
+        const storedViaDO = await this.storeDelegationViaDO({
+            sessionId,
+            delegationToken: token,
+            delegationId,
+            userDid,
+            agentDid,
+            authorizationType: normalizedAuthorizationType,
+        }, origin);
         // ALSO store to KV for backward compatibility and cross-session persistence
         if (delegationStorage) {
             try {
@@ -3908,6 +4090,10 @@ export class ConsentService {
                     agentDid,
                     delegationToken: token,
                     delegationId,
+                    // Task B2: mirror the auth type into the KV session record too, so
+                    // the two store paths (DO + KV) stay consistent. The DO record is
+                    // the one the enforcement gate reads; this is for parity/debugging.
+                    authorizationType: normalizedAuthorizationType,
                     cachedAt: Date.now(),
                 }), { expirationTtl: ttl });
                 logger.debug("[ConsentService] Token also stored to KV (session key)");
@@ -4053,7 +4239,14 @@ export class ConsentService {
         // tool handler runs server-side through the MCP tools/call proxy, so
         // CSRF is not applicable.
         const isInlineMode = body.inline_mode === true;
-        if (!isInlineMode) {
+        // SECURITY (A4, spec §3.3): the ONLY sanctioned CSRF relaxation is the
+        // dev/test escape hatch — BOTH MCPI_TEST_CONSENT and a development env —
+        // applied here at the call site (mirroring consent-anchor-bridge's
+        // `isTestConsentMode` gate on `validateCsrfToken`), never inside the
+        // validator/minter, which are strictly fail-closed. Production, staging,
+        // and unset always enforce CSRF.
+        const skipCsrf = isInlineMode || this.isDevConsentTestMode();
+        if (!skipCsrf) {
             // Validate CSRF token
             if (!csrf_token || typeof csrf_token !== "string") {
                 logger.warn("[ConsentService] Missing or invalid CSRF token");
@@ -4247,7 +4440,12 @@ export class ConsentService {
                 }
                 // Store delegation token (DO + KV)
                 const serverUrl = this.env.MCP_SERVER_URL || new URL(request.url).origin;
-                await this.storeDelegationToken(session_id, agent_did, delegationResult.delegation_token, delegationResult.delegation_id, identityResult.userDid, serverUrl);
+                await this.storeDelegationToken(session_id, agent_did, delegationResult.delegation_token, delegationResult.delegation_id, identityResult.userDid, serverUrl, 
+                // Task B2: the inline path is the credential (password) auth flow —
+                // it authenticated against the provider and minted with
+                // provider_type=PASSWORD (see approvalBody above), so the delegation's
+                // authorization type is "password".
+                CONSENT_PROVIDER_TYPES.PASSWORD);
                 logger.info("[ConsentService] ✅ Inline credential auth + delegation complete", {
                     delegationId: delegationResult.delegation_id?.substring(0, 20) + "...",
                 });
@@ -4330,17 +4528,49 @@ export class ConsentService {
                 // Provider's internal ID (e.g., customer ID 696395) for business reference
                 clickwrapUrl.searchParams.set("credential_provider_user_id", authResult.userId);
             }
-            // CRITICAL FIX: Pass userDid through redirect to avoid KV eventual consistency issues
-            // Without this, the clickwrap approval might read stale session data from KV
-            // that doesn't yet have the userDid from updateSessionWithIdentity above.
-            // By passing userDid in the URL, we ensure the delegation is stored with the
-            // correct user+agent scoped key regardless of KV propagation timing.
-            clickwrapUrl.searchParams.set("user_did", identityResult.userDid);
+            // SECURITY (A2, spec §3.1): carry the authenticated identity to the
+            // clickwrap as a server-signed, grant-bound `identity_assertion` instead
+            // of the bare, caller-forgeable `user_did` query param that used to live
+            // here. The assertion binds {sid, userDid, provider, agentDid, tool,
+            // scopesHash, projectId}; handleApproval re-verifies it before minting, so
+            // the delegation's subject can no longer be forged and the KV-race the old
+            // param dodged is still dodged (the identity travels in the signed token).
+            //
+            // Delivery: the token goes in the URL *fragment* (`#identity_assertion=…`),
+            // never the query string, so it stays out of access logs, `Referer`, and
+            // browser history. The consent page's client script reads the fragment and
+            // posts it back (see the @kya-os/consent component). The consent render
+            // Response also sets `Referrer-Policy: no-referrer` as defence in depth.
+            if (this.isDevConsentTestMode()) {
+                // Dev/test escape hatch (BOTH MCPI_TEST_CONSENT and a development env):
+                // no signed assertion is minted, so local/miniflare runs work without
+                // OAUTH_ENCRYPTION_SECRET. Mirrors consent-anchor-bridge's call-site
+                // relaxation. Never reached on production/staging/unset deployments.
+                clickwrapUrl.searchParams.set("user_did", identityResult.userDid);
+            }
+            else {
+                // Fail-closed: mintIdentityAssertion throws if OAUTH_ENCRYPTION_SECRET
+                // is unset, surfacing as a 500 rather than a silent unsigned fallback.
+                const identityAssertion = await this.mintIdentityAssertion({
+                    sid: session_id,
+                    userDid: identityResult.userDid,
+                    provider: provider,
+                    agentDid: agent_did,
+                    tool: tool,
+                    scopes,
+                    projectId: project_id,
+                });
+                clickwrapUrl.hash = `identity_assertion=${identityAssertion}`;
+            }
             logger.debug("[ConsentService] ✅ Credential auth complete, redirecting to clickwrap", {
                 sessionId: session_id.substring(0, 20) + "...",
                 userDid: identityResult.userDid.substring(0, 30) + "...",
                 provider: provider,
-                clickwrapUrl: clickwrapUrl.toString().substring(0, 100) + "...",
+                // Never log clickwrapUrl.toString()/.href here: the URL's fragment
+                // carries the signed identity_assertion (see clickwrapUrl.hash
+                // above), and query params carry other session identifiers. Log
+                // only the origin + pathname.
+                clickwrapUrl: clickwrapUrl.origin + clickwrapUrl.pathname,
             });
             // Return success with redirect to clickwrap page
             return new Response(JSON.stringify({
@@ -4644,9 +4874,15 @@ export class ConsentService {
     async validateCredentialCsrfToken(token, sessionId) {
         const secret = this.env.OAUTH_ENCRYPTION_SECRET;
         if (!secret) {
-            logger.warn("[ConsentService] No OAUTH_ENCRYPTION_SECRET for CSRF validation, skipping");
-            // Return true to allow flow to continue (graceful degradation)
-            return true;
+            // SECURITY (A4, spec §3.3, defect #4): fail CLOSED. The old code returned
+            // `true` here ("graceful degradation"), silently disabling CSRF on a
+            // state-changing endpoint whenever the secret was unset — the exact
+            // fail-open this PR removes. Matches consent-anchor-bridge's
+            // `validateCsrfToken`. The single allowed relaxation is the dev/test
+            // escape hatch applied at the CALL SITE (see `handleCredentialApproval`),
+            // never here in the validator.
+            logger.warn("[ConsentService] No OAUTH_ENCRYPTION_SECRET for CSRF validation — rejecting (fail-closed)");
+            return false;
         }
         try {
             const dotIndex = token.indexOf(".");
@@ -4690,10 +4926,19 @@ export class ConsentService {
     async storeCredentialCsrfToken(sessionId) {
         const secret = this.env.OAUTH_ENCRYPTION_SECRET;
         if (!secret) {
-            logger.warn("[ConsentService] No OAUTH_ENCRYPTION_SECRET for CSRF generation");
-            // Fallback: random token (won't validate but allows graceful degradation)
-            const tokenBytes = crypto.getRandomValues(new Uint8Array(32));
-            return this.base64UrlEncode(tokenBytes);
+            // SECURITY (A4, spec §3.3, defect #4): do NOT mint a random,
+            // never-validating token when the secret is unset. The old fallback
+            // handed the form a token that `validateCredentialCsrfToken` (now
+            // fail-closed) can never accept — pure theatre that paired with the old
+            // validate fail-OPEN to silently disable CSRF. Fail closed instead: only
+            // the dev/test escape hatch may render a form without a real secret, in
+            // which case the call-site skips CSRF entirely so a placeholder is safe.
+            if (this.isDevConsentTestMode()) {
+                logger.warn("[ConsentService] No OAUTH_ENCRYPTION_SECRET; issuing a dev/test placeholder CSRF token (CSRF is skipped at the call site in dev mode)");
+                const tokenBytes = crypto.getRandomValues(new Uint8Array(32));
+                return this.base64UrlEncode(tokenBytes);
+            }
+            throw new Error("[ConsentService] OAUTH_ENCRYPTION_SECRET is unset; refusing to mint a CSRF token (fail-closed)");
         }
         // 10 minute expiration (matches previous KV TTL)
         const exp = Math.floor(Date.now() / 1000) + 600;
@@ -4750,6 +4995,202 @@ export class ConsentService {
         }
         return result === 0;
     }
+    /**
+     * Whether local/miniflare testing may relax consent security checks.
+     *
+     * Mirrors `consent-anchor-bridge.ts`'s `isTestConsentMode` verbatim: requires
+     * BOTH `MCPI_TEST_CONSENT === "true"` AND an explicit `development`
+     * environment. The flag alone must NEVER relax a check on a
+     * production/staging/unset deployment.
+     *
+     * NOT used by `mintIdentityAssertion`/`verifyIdentityAssertion` — those are
+     * strictly fail-closed with no dev relaxation of any kind (a review found
+     * that signing/verifying under an attacker-known empty key when this flag
+     * is active was a latent total-forgery bypass if the two dev flags ever
+     * co-occurred in production). If a dev bypass for the identity-assertion
+     * requirement is ever needed, it belongs at the CALL SITE (mirroring how
+     * the anchor bridge bypasses CSRF via this flag at the handler, before
+     * `validateCsrfToken` is even invoked — never inside the crypto itself).
+     * Public so the OAuth callback path (runtime/oauth-handler.ts) can gate its
+     * own redirect mint on the identical dev/test relaxation used by the
+     * credential redirect above, rather than re-deriving the two-flag check.
+     */
+    isDevConsentTestMode() {
+        if (this.env.MCPI_TEST_CONSENT !== "true") {
+            return false;
+        }
+        const environment = (this.env.ENVIRONMENT ??
+            this.env.MCPI_ENV ??
+            "").toLowerCase();
+        return environment === "development";
+    }
+    /**
+     * SHA-256 hex digest of the given scopes, sorted ascending and
+     * JSON-array-encoded. Used as the identity assertion's `scopesHash` so the
+     * signed grant binds to the scope *set* regardless of the order scopes
+     * arrive in the request body. Mirrors the digest-to-hex shape already used
+     * elsewhere in this codebase (e.g. `DelegationService.hashToken`).
+     *
+     * `JSON.stringify` (not a `\n`-joined string) is required for injectivity:
+     * a plain join collides distinct scope sets that share the same joined
+     * bytes — e.g. `["a\nb"]` and `["a", "b"]` both join to `"a\nb"`. JSON
+     * array encoding preserves each element's boundary (quoting + `,`
+     * separators), so distinct scope sets can never hash identically.
+     */
+    async hashScopes(scopes) {
+        const canonical = JSON.stringify([...scopes].sort());
+        const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(canonical));
+        return Array.from(new Uint8Array(digest))
+            .map((b) => b.toString(16).padStart(2, "0"))
+            .join("");
+    }
+    /**
+     * Compute HMAC-SHA256 for identity-assertion generation/validation.
+     *
+     * Structurally identical to `computeCsrfHmac`, but `computeCsrfHmac`
+     * hardcodes the `csrf:` key prefix internally so it cannot be reused for a
+     * different domain — this mirrors its shape with an `identity:` prefix
+     * instead, so a CSRF token and an identity assertion are signed under
+     * disjoint keys and can never validate as one another.
+     */
+    async computeIdentityHmac(secret, data) {
+        const encoder = new TextEncoder();
+        const keyMaterial = encoder.encode(`identity:${secret}`);
+        const key = await crypto.subtle.importKey("raw", keyMaterial, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+        return crypto.subtle.sign("HMAC", key, encoder.encode(data));
+    }
+    /**
+     * Mint a grant-bound, domain-separated HMAC identity assertion.
+     *
+     * Carries the `userDid` resolved by a completed authentication step
+     * (credential or OAuth) across the consent redirect, replacing the
+     * caller-forgeable `user_did` body field (see
+     * docs/superpowers/specs/2026-07-29-consent-approve-auth-gate-design.md
+     * §3.1). Format mirrors `storeCredentialCsrfToken`:
+     * `${hmacB64url}.${payloadB64url}`.
+     *
+     * Binds the grant, not just the identity: `agentDid`, `tool`, `scopesHash`
+     * (SHA-256 of the sorted scope set), and `projectId` are signed in and must
+     * be re-checked against the request body at mint time by the caller — a
+     * leaked assertion must not be replayable to mint an arbitrary grant under
+     * the victim's `userDid` within the 10-minute window.
+     *
+     * FAIL-CLOSED, ALWAYS: throws if `OAUTH_ENCRYPTION_SECRET` is unset or
+     * empty. There is deliberately NO dev/test relaxation inside this helper —
+     * signing under a predictable key (e.g. an empty-string fallback) would be
+     * an attacker-known key and a latent total-forgery bypass if a dev flag
+     * were ever misconfigured in production. A mint must never silently
+     * produce an unsigned/unverifiable token — unlike
+     * `storeCredentialCsrfToken`'s legacy "graceful degradation," which this
+     * assertion deliberately does not inherit. Any future dev/test bypass
+     * belongs at the call site (see `isDevConsentTestMode`'s docstring).
+     *
+     * Public so both authenticated redirect sites can mint under this service's
+     * `identity:`-keyed secret: the credential redirect (in-class) and the OAuth
+     * callback redirect (runtime/oauth-handler.ts, a separate module).
+     */
+    async mintIdentityAssertion(params) {
+        const secret = this.env.OAUTH_ENCRYPTION_SECRET;
+        if (!secret) {
+            throw new Error("[ConsentService] OAUTH_ENCRYPTION_SECRET is unset; refusing to mint an identity assertion (fail-closed)");
+        }
+        const exp = Math.floor(Date.now() / 1000) + 600;
+        const scopesHash = await this.hashScopes(params.scopes);
+        const payload = JSON.stringify({
+            v: 1,
+            sid: params.sid,
+            userDid: params.userDid,
+            provider: params.provider,
+            agentDid: params.agentDid,
+            tool: params.tool,
+            scopesHash,
+            projectId: params.projectId,
+            exp,
+        });
+        const payloadB64 = this.base64UrlEncodeString(payload);
+        const hmac = await this.computeIdentityHmac(secret, payloadB64);
+        const hmacB64 = this.base64UrlEncode(new Uint8Array(hmac));
+        return `${hmacB64}.${payloadB64}`;
+    }
+    /**
+     * Verify a grant-bound identity assertion minted by `mintIdentityAssertion`.
+     *
+     * Returns the payload's `userDid` iff: the HMAC matches (constant-time),
+     * the assertion has not expired, and every bound field (`sid`, `agentDid`,
+     * `tool`, `projectId`, and `scopesHash` recomputed from `expected.scopes`)
+     * equals the caller-supplied `expected` values. Any mismatch, tamper, or
+     * expiry returns `null` — never throws, so callers can treat `null`
+     * uniformly as "no verified identity."
+     *
+     * FAIL-CLOSED, ALWAYS: returns `null` if `OAUTH_ENCRYPTION_SECRET` is unset
+     * or empty. There is deliberately NO dev/test relaxation inside this
+     * helper — mirrors `consent-anchor-bridge.ts`'s `validateCsrfToken`, NOT
+     * `validateCredentialCsrfToken`'s legacy "return true to allow flow to
+     * continue" behavior (the fail-open this PR closes). Any future dev/test
+     * bypass belongs at the call site (see `isDevConsentTestMode`'s
+     * docstring), never as a predictable/empty signing key inside this helper.
+     */
+    async verifyIdentityAssertion(token, expected) {
+        const secret = this.env.OAUTH_ENCRYPTION_SECRET;
+        if (!secret) {
+            logger.warn("[ConsentService] No OAUTH_ENCRYPTION_SECRET for identity-assertion verification; rejecting (fail-closed)");
+            return null;
+        }
+        try {
+            const dotIndex = token.indexOf(".");
+            if (dotIndex === -1) {
+                logger.warn("[ConsentService] Identity assertion missing separator");
+                return null;
+            }
+            const hmacB64 = token.substring(0, dotIndex);
+            const payloadB64 = token.substring(dotIndex + 1);
+            const payloadJson = this.base64UrlDecodeString(payloadB64);
+            const payload = JSON.parse(payloadJson);
+            if (payload.sid !== expected.sid) {
+                logger.warn("[ConsentService] Identity assertion sid mismatch");
+                return null;
+            }
+            if (payload.agentDid !== expected.agentDid) {
+                logger.warn("[ConsentService] Identity assertion agentDid mismatch");
+                return null;
+            }
+            if (payload.tool !== expected.tool) {
+                logger.warn("[ConsentService] Identity assertion tool mismatch");
+                return null;
+            }
+            if (payload.projectId !== expected.projectId) {
+                logger.warn("[ConsentService] Identity assertion projectId mismatch");
+                return null;
+            }
+            const expectedScopesHash = await this.hashScopes(expected.scopes);
+            if (payload.scopesHash !== expectedScopesHash) {
+                logger.warn("[ConsentService] Identity assertion scopes mismatch");
+                return null;
+            }
+            if (typeof payload.exp !== "number" ||
+                payload.exp < Math.floor(Date.now() / 1000)) {
+                logger.warn("[ConsentService] Identity assertion expired");
+                return null;
+            }
+            // Recompute HMAC and constant-time compare. Kept last so tampering with
+            // any bound field above is already caught by the field checks; this is
+            // the authoritative integrity check.
+            const expectedHmac = await this.computeIdentityHmac(secret, payloadB64);
+            const expectedB64 = this.base64UrlEncode(new Uint8Array(expectedHmac));
+            if (!this.constantTimeCompare(hmacB64, expectedB64)) {
+                logger.warn("[ConsentService] Identity assertion HMAC mismatch");
+                return null;
+            }
+            if (typeof payload.userDid !== "string" || !payload.userDid) {
+                return null;
+            }
+            return payload.userDid;
+        }
+        catch (error) {
+            logger.error("[ConsentService] Identity assertion verification error:", error);
+            return null;
+        }
+    }
     /**
      * Build full DelegationRecord format request (future format)
      */