@kya-os/mcp-i-cloudflare 1.7.24 → 1.7.26

package/dist/services/consent.service.js

@@ -1345,6 +1345,10 @@ export class ConsentService {
             // When credential auth completes, userDid is passed through redirect URL
             // This ensures storeDelegationToken can use the correct user+agent key immediately
             const userDidFromParams = params.get("user_did");
+            // ✅ Extract user info from credential provider for delegation metadata
+            // These are used for human-readable display in AgentShield dashboard
+            const credentialUserEmail = params.get("credential_user_email");
+            const credentialProviderUserId = params.get("credential_provider_user_id");
             // ✅ Extract mode param for post-credential clickwrap detection
             // When credential auth completes, user is redirected to /consent?mode=consent-only&credential_provider_type=password
             const mode = params.get("mode");
@@ -1684,22 +1688,32 @@ export class ConsentService {
                 // ✅ CRITICAL: Pass userDid to bypass KV eventual consistency issues
                 // This is passed through the redirect URL from credential auth
                 userDid: userDidFromParams || undefined,
+                // ✅ Pass user info from credential provider for delegation metadata
+                credentialUserEmail: credentialUserEmail || undefined,
+                credentialProviderUserId: credentialProviderUserId || undefined,
             };
             // CRED-003: Render credential form if this is a credential provider
             // Guard conditions:
             // 1. credentialProviderConfig must exist (already fetched above)
             // 2. Must NOT be in post-credential clickwrap mode (would cause infinite loop)
             if (credentialProviderConfig && !isPostCredentialClickwrap) {
+                // Determine authorization type from tool protection config
+                // Default to 'password' for credential flows (matches AgentShield expectations)
+                // The authorization.type from tool protection tells us what type of auth the tool expects
+                const authorizationType = protection?.authorization?.type ?? "password";
                 logger.debug("[ConsentService] Credential provider detected, rendering credential page", {
                     projectId,
                     provider,
                     providerType: credentialProviderConfig.type,
                     displayName: credentialProviderConfig.displayName,
+                    authorizationType, // Log the authorization type being used
                 });
                 // Generate and store CSRF token for form security
                 const csrfToken = await this.storeCredentialCsrfToken(sessionId);
                 // Render credential login page instead of OAuth consent
-                const html = this.renderer.renderCredentialPage(pageConfig, credentialProviderConfig, provider, csrfToken);
+                // Pass authorizationType from tool protection config for dynamic provider_type
+                const html = this.renderer.renderCredentialPage(pageConfig, credentialProviderConfig, provider, csrfToken, authorizationType // Dynamic authorization type from tool protection
+                );
                 return new Response(html, {
                     status: 200,
                     headers: {
@@ -2879,23 +2893,33 @@ export class ConsentService {
                         // Ensure userDid is in bodyObj for createDelegation and storeDelegationToken
                         bodyObj.user_did = userDidFromRedirect;
                     }
-                    // Read credential_user_id from redirect URL params for UX metadata
-                    // This is the human-readable identifier (email, username) from credential auth
-                    const credentialUserIdFromRedirect = bodyObj.credential_user_id;
-                    if (credentialUserIdFromRedirect) {
-                        logger.debug("[ConsentService] ✅ Using credential_user_id from redirect:", {
+                    // Read user info from redirect URL params
+                    // Field mapping (clear naming):
+                    //   credential_user_email → user_identifier (human-readable for display)
+                    //   credential_provider_user_id → user_id (provider's internal ID)
+                    const credentialUserEmailFromRedirect = bodyObj.credential_user_email;
+                    const credentialProviderUserIdFromRedirect = bodyObj.credential_provider_user_id;
+                    if (credentialUserEmailFromRedirect ||
+                        credentialProviderUserIdFromRedirect) {
+                        logger.debug("[ConsentService] ✅ Using credential user info from redirect:", {
                             sessionId: sessionId?.substring(0, 20) + "...",
-                            credential_user_id: credentialUserIdFromRedirect.substring(0, 20) + "...",
+                            credential_user_email: credentialUserEmailFromRedirect
+                                ? credentialUserEmailFromRedirect.substring(0, 20) + "..."
+                                : undefined,
+                            credential_provider_user_id: credentialProviderUserIdFromRedirect
+                                ? credentialProviderUserIdFromRedirect.substring(0, 20) +
+                                    "..."
+                                : undefined,
                             source: "redirect-param",
                         });
-                        // credential_user_id is already in bodyObj from form, no need to reassign
                     }
                     logger.debug("[ConsentService] ✅ Using credential auth provider_type for delegation:", {
                         sessionId: sessionId?.substring(0, 20) + "...",
                         providerType: CONSENT_PROVIDER_TYPES.PASSWORD,
                         provider: credentialProvider,
                         hasUserDid: !!userDidFromRedirect,
-                        hasCredentialUserId: !!credentialUserIdFromRedirect,
+                        hasCredentialUserEmail: !!credentialUserEmailFromRedirect,
+                        hasProviderUserId: !!credentialProviderUserIdFromRedirect,
                         note: "Delegation will have authorization.type='password' to match tool protection",
                     });
                     // The userDid is passed via redirect URL - no need to read from KV
@@ -3743,12 +3767,18 @@ export class ConsentService {
             if (Array.isArray(scopes) && scopes.length > 0) {
                 clickwrapUrl.searchParams.set("scopes", scopes.join(","));
             }
-            // Include user info for display on clickwrap page
+            // Include user info for delegation request
+            // Field mapping (clear naming):
+            //   credential_user_email → user_identifier (human-readable for display)
+            //   credential_provider_user_id → user_id (provider's internal ID for business reference)
+            //   user_did → user_did (cryptographic identity, always present)
             if (authResult.userEmail) {
+                // Email for human-readable display in AgentShield dashboard
                 clickwrapUrl.searchParams.set("credential_user_email", authResult.userEmail);
             }
             if (authResult.userId) {
-                clickwrapUrl.searchParams.set("credential_user_id", authResult.userId);
+                // Provider's internal ID (e.g., customer ID 696395) for business reference
+                clickwrapUrl.searchParams.set("credential_provider_user_id", authResult.userId);
             }
             // CRITICAL FIX: Pass userDid through redirect to avoid KV eventual consistency issues
             // Without this, the clickwrap approval might read stale session data from KV
@@ -4158,30 +4188,98 @@ export class ConsentService {
         // CRITICAL: user_did is required for proper user identification in dashboard
         // user_identifier is for display purposes (email, username, etc.)
         // user_id is the provider-specific ID from credential auth (for UX metadata)
+        //
+        // Fallback Strategy:
+        // 1. If email available → user_identifier = email (preferred)
+        // 2. If no email → user_identifier = userDid (fallback so AgentShield has something to display)
+        // AgentShield will also check metadata.user_email for extraction
         if (userDid) {
             // user_did is the primary identifier - the actual DID
             result.user_did = userDid;
-            // user_identifier: Use credential_user_id if available (human-readable),
-            // otherwise fall back to DID
-            result.user_identifier = request.credential_user_id || userDid;
-            // user_id: Include the credential provider's user ID for UX display in dashboard
-            // This is separate from user_did (cryptographic identity) and user_identifier
-            if (request.credential_user_id) {
-                result.user_id = request.credential_user_id;
-                logger.debug("[ConsentService] Full format: Including user_id from credential auth:", {
-                    user_id: request.credential_user_id.substring(0, 20) + "...",
+            // user_identifier: Human-readable identifier (email/username) for AgentShield dashboard display
+            // user_id: Provider's internal ID (e.g., customer ID 696395) for business reference
+            // user_did: Cryptographic DID for identity verification
+            if (request.credential_user_email) {
+                // Have email - use it as human-readable identifier
+                result.user_identifier = request.credential_user_email;
+            }
+            else {
+                // No email - fall back to DID so dashboard has something to display
+                // AgentShield will detect this is a DID and may display differently
+                result.user_identifier = userDid;
+            }
+            // user_id is the provider's internal ID (separate from email)
+            // Use credential_provider_user_id if available
+            const fullFormatProviderId = request.credential_provider_user_id;
+            if (fullFormatProviderId) {
+                result.user_id = fullFormatProviderId;
+                logger.debug("[ConsentService] Full format: Including provider user_id from credential auth:", {
+                    user_id: fullFormatProviderId.substring(0, 20) + "...",
+                    user_identifier: request.credential_user_email?.substring(0, 20) + "...",
                 });
             }
             logger.debug("[ConsentService] Full format: Including user identity fields:", {
                 user_did: userDid.substring(0, 20) + "...",
-                user_identifier: result.user_identifier.substring(0, 20),
-                has_user_id: !!request.credential_user_id,
+                user_identifier: request.credential_user_email
+                    ? request.credential_user_email.substring(0, 20) + "..."
+                    : "(fallback to DID)",
+                has_user_id: !!fullFormatProviderId,
+                source: request.credential_user_email ? "email" : "did-fallback",
             });
         }
         // Phase 2 VC-Only: Include credential_jwt if available
         if (credentialJwt) {
             result.credential_jwt = credentialJwt;
         }
+        // MCP-I Compatibility: Include user_email and user_id in custom_fields (becomes metadata)
+        // This matches buildSimplifiedFormatRequest behavior for consistency
+        // AgentShield extracts these from metadata when user_identifier is not provided
+        //
+        // user_email = human-readable email (for display)
+        // user_id = provider's internal ID (for business reference)
+        const fullFormatUserEmail = request.credential_user_email || null;
+        const fullFormatProviderUserId = request
+            .credential_provider_user_id || null;
+        const providerType = request.provider_type || "none";
+        const customFieldsFromRequest = request.customFields || {};
+        if (userDid || fullFormatUserEmail || providerType !== "none") {
+            result.custom_fields = {
+                ...(userDid
+                    ? {
+                        issuer_did: userDid,
+                        subject_did: request.agent_did,
+                    }
+                    : {}),
+                format_version: "full_v1",
+                ...(providerType ? { provider_type: providerType } : {}),
+                // MCP-I Compatibility: Include user_email and user_id in metadata
+                // AgentShield will extract these if user_identifier is not provided
+                // user_email = human-readable email (for display)
+                // user_id = provider's internal ID (for business reference, e.g., customer ID 696395)
+                ...(fullFormatUserEmail ? { user_email: fullFormatUserEmail } : {}),
+                ...(fullFormatProviderUserId
+                    ? { user_id: fullFormatProviderUserId }
+                    : {}),
+                // Merge with any existing custom_fields from request
+                ...customFieldsFromRequest,
+            };
+            if (fullFormatUserEmail || fullFormatProviderUserId) {
+                logger.debug("[ConsentService] Full format: Including user info in custom_fields for AgentShield compatibility:", {
+                    user_email: fullFormatUserEmail
+                        ? fullFormatUserEmail.substring(0, 20) + "..."
+                        : undefined,
+                    user_id: fullFormatProviderUserId
+                        ? fullFormatProviderUserId.substring(0, 20) + "..."
+                        : undefined,
+                });
+            }
+        }
+        else if (request.customFields &&
+            Object.keys(request.customFields).length > 0) {
+            // Include custom_fields from request even if no userDid (matches buildSimplifiedFormatRequest)
+            result.custom_fields = request.customFields;
+        }
+        // If no userDid, no customFields, and no provider info, custom_fields is omitted (valid)
         return result;
     }
     /**
@@ -4221,25 +4319,44 @@ export class ConsentService {
         // CRITICAL: user_did is required for proper user identification in dashboard
         // user_identifier is for display purposes (email, username, etc.)
         // user_id is the provider-specific ID from credential auth (for UX metadata)
+        //
+        // Fallback Strategy:
+        // 1. If email available → user_identifier = email (preferred)
+        // 2. If no email → user_identifier = userDid (fallback so AgentShield has something to display)
+        // AgentShield will also check metadata.user_email for extraction
         if (userDid) {
             // user_did is the primary identifier - the actual DID
             simplifiedRequest.user_did = userDid;
-            // user_identifier: Use credential_user_id if available (human-readable),
-            // otherwise fall back to DID
-            simplifiedRequest.user_identifier =
-                request.credential_user_id || userDid;
-            // user_id: Include the credential provider's user ID for UX display in dashboard
-            // This is separate from user_did (cryptographic identity) and user_identifier
-            if (request.credential_user_id) {
-                simplifiedRequest.user_id = request.credential_user_id;
-                logger.debug("[ConsentService] Including user_id from credential auth:", {
-                    user_id: request.credential_user_id.substring(0, 20) + "...",
+            // user_identifier: Human-readable identifier (email/username) for AgentShield dashboard display
+            // user_id: Provider's internal ID (e.g., customer ID 696395) for business reference
+            // user_did: Cryptographic DID for identity verification
+            if (request.credential_user_email) {
+                // Have email - use it as human-readable identifier
+                simplifiedRequest.user_identifier = request.credential_user_email;
+            }
+            else {
+                // No email - fall back to DID so dashboard has something to display
+                // AgentShield will detect this is a DID and may display differently
+                simplifiedRequest.user_identifier = userDid;
+            }
+            // user_id is the provider's internal ID (separate from email)
+            // Use credential_provider_user_id if available
+            const providerId = request
+                .credential_provider_user_id;
+            if (providerId) {
+                simplifiedRequest.user_id = providerId;
+                logger.debug("[ConsentService] Including provider user_id from credential auth:", {
+                    user_id: providerId.substring(0, 20) + "...",
+                    user_identifier: request.credential_user_email?.substring(0, 20) + "...",
                 });
             }
-            logger.debug("[ConsentService] Including user_did in delegation request:", {
+            logger.debug("[ConsentService] Including user info in delegation request:", {
                 user_did: userDid.substring(0, 20) + "...",
-                user_identifier: simplifiedRequest.user_identifier.substring(0, 20),
-                has_user_id: !!request.credential_user_id,
+                user_identifier: request.credential_user_email
+                    ? request.credential_user_email.substring(0, 20) + "..."
+                    : "(fallback to DID)",
+                has_user_id: !!providerId,
+                source: request.credential_user_email ? "email" : "did-fallback",
             });
         }
         else {
@@ -4264,7 +4381,16 @@ export class ConsentService {
         const providerType = request.provider_type || customFieldsFromRequest.provider_type;
         const provider = customFieldsFromRequest.provider;
         const hasProviderInfo = providerType || provider;
-        if (userDid || hasProviderInfo) {
+        // MCP-I Compatibility: Include user_email and user_id in custom_fields (becomes metadata)
+        // AgentShield extracts these from metadata when user_identifier is a DID or not provided
+        // This ensures human-readable identifiers are always available for dashboard display
+        //
+        // user_email = human-readable email (for display)
+        // user_id = provider's internal ID (for business reference)
+        const userEmail = request.credential_user_email || null;
+        const providerUserId = request
+            .credential_provider_user_id || null;
+        if (userDid || hasProviderInfo || userEmail) {
             // Include issuer_did and subject_did in custom_fields when we have userDid
             // Also include provider_type and provider for AgentShield dashboard
             // CRITICAL: AgentShield derives authorization from metadata.provider_type:
@@ -4282,6 +4408,12 @@ export class ConsentService {
                 format_version: "simplified_v1",
                 // Include provider_type at the custom_fields level (where AgentShield reads it)
                 ...(providerType ? { provider_type: providerType } : {}),
+                // MCP-I Compatibility: Include user_email and user_id in metadata
+                // AgentShield will extract these if user_identifier is not provided or is a DID
+                // user_email = human-readable email (for display)
+                // user_id = provider's internal ID (for business reference, e.g., customer ID 696395)
+                ...(userEmail ? { user_email: userEmail } : {}),
+                ...(providerUserId ? { user_id: providerUserId } : {}),
                 // Merge with any existing custom_fields from request
                 ...customFieldsFromRequest,
             };
@@ -4294,6 +4426,16 @@ export class ConsentService {
                         : "customFields",
                 });
             }
+            if (userEmail || providerUserId) {
+                logger.debug("[ConsentService] Including user info in custom_fields for AgentShield compatibility:", {
+                    user_email: userEmail
+                        ? userEmail.substring(0, 20) + "..."
+                        : undefined,
+                    user_id: providerUserId
+                        ? providerUserId.substring(0, 20) + "..."
+                        : undefined,
+                });
+            }
         }
         else if (request.customFields &&
             Object.keys(request.customFields).length > 0) {