@markmnl/fmsg-mcp 1.2.0 → 1.2.2

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## Unreleased
 
+- Over OAuth, the owner comes from the `owner` claim the IdP puts on the app's access token
+  (and on the exchanged Web API token), so agents that sign in (ChatGPT connectors) include
+  their owner like API-key callers do. 1.2.0 only read the API-key token's claim, so a
+  signed-in sub-address sent without its owner and `whoami` showed none.
 - A sub-address (such as `@user_agent@example.com`, owned by `@user@example.com`) now sends to
   its owner by default: `send_message`, `reply` and `create_draft` add the owner as a recipient so
   they can follow and reply to the thread, with a new `include_owner` argument (default true) to

package/dist/oauth/issuer.d.ts

@@ -1,7 +1,9 @@
 import type { AccessToken } from "../client/types.js";
 import { type OAuthConfig } from "./config.js";
+/** The verified app token: who it acts as and, for a sub-address, the `owner` claim the IdP puts on it. */
 export type OAuthIdentity = {
     address: string;
+    owner?: string;
     expiresAtMs: number;
     scopes: string[];
     clientId: string;

package/dist/oauth/issuer.js

@@ -1,6 +1,7 @@
 import { createRemoteJWKSet, customFetch, decodeJwt, decodeProtectedHeader, jwtVerify, errors } from "jose";
 import { normalizeFmsgAddress } from "../address.js";
 import { readBytes } from "../client/stream.js";
+import { ownerOf } from "../client/token-provider.js";
 import { oauthUrl } from "./config.js";
 import { invalidToken, OAuthRequestError } from "./errors.js";
 import { parseScopes } from "./scopes.js";
@@ -103,7 +104,8 @@ export class OAuthIssuer {
             const expiresAtMs = Math.floor(payload.exp * 1000);
             if (audience !== this.config.resourceUrl || !address || !scopes || !Number.isFinite(expiresAtMs) || expiresAtMs <= Date.now())
                 throw invalidToken();
-            return { address, scopes, expiresAtMs, clientId: typeof payload.client_id === "string" ? payload.client_id : "oauth-client" };
+            const owner = ownerOf(payload, address);
+            return { address, ...(owner ? { owner } : {}), scopes, expiresAtMs, clientId: typeof payload.client_id === "string" ? payload.client_id : "oauth-client" };
         }
         catch (error) {
             if (error instanceof OAuthRequestError)
@@ -173,7 +175,9 @@ export class OAuthIssuer {
             const expiresAtMs = Math.min(startedAt + body.expires_in * 1000, claims.exp * 1000, identity.expiresAtMs, startedAt + EXCHANGE_CACHE_MAX_MS);
             if (expiresAtMs <= Date.now())
                 throw new Error();
-            return { accessToken: body.access_token, address: identity.address, expiresAtMs };
+            // The exchanged token names the owner too; the app token's claim is the fallback.
+            const owner = ownerOf(claims, identity.address) ?? identity.owner;
+            return { accessToken: body.access_token, address: identity.address, ...(owner ? { owner } : {}), expiresAtMs };
         }
         catch {
             if (identity.expiresAtMs <= Date.now())

package/dist/oauth/provider.js

@@ -45,7 +45,8 @@ export class OAuthCallerProvider {
                 close: () => { subject = ""; },
             }, { allowInsecureHttp: this.config.allowInsecureHttp, reconnectOnTokenExpiry: true });
             entry = { key, identity, active: 0, lastUsed: Date.now(), caller: {
-                    client, address: identity.address, tokenExpiresAt: async () => (await client.getToken()).expiresAtMs,
+                    client, address: identity.address, ...(identity.owner ? { owner: identity.owner } : {}),
+                    tokenExpiresAt: async () => (await client.getToken()).expiresAtMs,
                 } };
             this.entries.set(key, entry);
         }
@@ -55,7 +56,7 @@ export class OAuthCallerProvider {
         const lease = randomUUID();
         this.leases.set(lease, entry);
         return { token: key, clientId: identity.clientId, scopes: identity.scopes, expiresAt: identity.expiresAtMs / 1000,
-            extra: { callerLease: lease, address: identity.address } };
+            extra: { callerLease: lease, address: identity.address, ...(identity.owner ? { owner: identity.owner } : {}) } };
     }
     entryFor(auth) {
         const lease = auth?.extra?.callerLease;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@markmnl/fmsg-mcp",
   "mcpName": "io.github.markmnl/fmsg-mcp",
-  "version": "1.2.0",
+  "version": "1.2.2",
   "description": "MCP server for fmsg: send and receive federated messages from any AI agent via a deployed fmsg Web API",
   "type": "module",
   "license": "MIT",

package/server.json

@@ -8,13 +8,13 @@
     "url": "https://github.com/markmnl/fmsg-mcp",
     "source": "github"
   },
-  "version": "1.2.0",
+  "version": "1.2.2",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@markmnl/fmsg-mcp",
-      "version": "1.2.0",
+      "version": "1.2.2",
       "transport": {
         "type": "stdio"
       },