@kya-os/mcp-i-cloudflare 1.13.3 → 1.13.4

package/dist/services/consent.service.js

@@ -9,7 +9,7 @@
 import { ConsentConfigService } from "./consent-config.service";
 import { TemplateRenderer } from "./consent-templates/template-renderer";
 import { DEFAULT_AGENTSHIELD_URL, DEFAULT_SESSION_CACHE_TTL, KEY_PAIR_TTL_SECONDS, CONSENT_PROVIDER_TYPES, } from "../constants";
-import { STORAGE_KEYS } from "../constants/storage-keys";
+import { STORAGE_KEYS, isPendingDelegationId, } from "../constants/storage-keys";
 import { loadDay0Config, getDelegationFieldName } from "../utils/day0-config";
 import { buildProviderAuthorizeUrl } from "../runtime/oidc/authorize-url.js";
 import { resolveIdpScopes } from "../runtime/oidc/idp-scopes.js";
@@ -4045,7 +4045,34 @@ export class ConsentService {
         const delegationStorage = this.env.DELEGATION_STORAGE;
         // Task B2: normalize once (folds deprecated aliases: oauth→oauth2) so every
         // stored record and every read compares in the same vocabulary.
-        const normalizedAuthorizationType = normalizeAuthType(authorizationType);
+        //
+        // SECURITY — the authoritative pre-consent guard. This method is the single
+        // choke point through which an authorization type reaches BOTH destinations
+        // the enforcement gate can read: the Durable Object record
+        // (`storeDelegationViaDO` below) and the KV sidecar. A `pending_` delegation
+        // id means the OAuth callback parked a placeholder whose token is still the
+        // raw IdP access token — the real delegation is only minted once the user
+        // approves on the clickwrap. Recording a type for it would let the gate
+        // treat a pre-consent token as a satisfying delegation and run a protected
+        // tool before the user ever consented.
+        //
+        // Guarding HERE rather than at each caller is deliberate: `oauth-handler.ts`
+        // reaches this via `storeDelegationForOAuth` with a hardcoded "oauth2" and
+        // the pending tokenData, so a per-call-site guard would have to be repeated
+        // at every present and future writer. Dropping the type to undefined makes
+        // every downstream consumer fail safe, because absent already means
+        // "reject" at the gate.
+        const isPendingDelegation = isPendingDelegationId(delegationId);
+        const normalizedAuthorizationType = isPendingDelegation
+            ? undefined
+            : normalizeAuthType(authorizationType);
+        if (isPendingDelegation && authorizationType) {
+            logger.warn("[ConsentService] Refusing to record an authorization type for a pending (pre-consent) delegation", {
+                delegationId,
+                requestedAuthorizationType: authorizationType,
+                note: "The real delegation is minted after clickwrap approval; typing this token would authorize it pre-consent.",
+            });
+        }
         // Resolve userDid if not provided
         let userDid = providedUserDid;
         if (!userDid && delegationStorage) {
@@ -4079,6 +4106,36 @@ export class ConsentService {
                     await delegationStorage.put(userAgentKey, token, {
                         expirationTtl: ttl,
                     });
+                    // Record the auth type alongside it (separate key — the value above
+                    // is a bare token that several readers consume as the JWT itself).
+                    // Without this, a delegation recovered via the KV-legacy path in
+                    // agent.ts carries no type and can never satisfy a typed tool, so a
+                    // DO miss becomes a permanent re-challenge loop rather than a
+                    // one-time re-auth.
+                    //
+                    // INVARIANT: a sidecar present ⇒ it describes the token currently
+                    // under the key above. So an untyped write must CLEAR any existing
+                    // sidecar rather than leave it: the token was just replaced, and a
+                    // leftover type from a previous mint would be inherited by the new
+                    // (weaker or unknown) token on the next KV read. Revocation already
+                    // deletes the sidecar for exactly this reason; a remint must too.
+                    const authTypeKey = STORAGE_KEYS.delegationAuthType(userDid, agentDid);
+                    if (normalizedAuthorizationType) {
+                        await delegationStorage.put(authTypeKey, normalizedAuthorizationType, { expirationTtl: ttl });
+                    }
+                    else {
+                        // Clearing a stale sidecar is cleanup, not the primary write: it
+                        // must never abort the session-key write that follows. Swallow its
+                        // failure rather than letting it escape to the enclosing catch.
+                        // Failing to clear is safe in the conservative direction only for
+                        // the token it described, so it is logged rather than ignored.
+                        try {
+                            await delegationStorage.delete?.(authTypeKey);
+                        }
+                        catch (clearError) {
+                            logger.warn("[ConsentService] Could not clear stale delegation auth-type sidecar", clearError);
+                        }
+                    }
                     logger.debug("[ConsentService] Token also stored to KV (user+agent key)");
                 }
                 // Store session key (for session data preservation)