@markmnl/fmsg-mcp 1.2.1 → 1.2.3

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## Unreleased
 
+- Over OAuth, the owner comes from the `owner` claim the IdP puts on the app's access token
+  (and on the exchanged Web API token), so agents that sign in (ChatGPT connectors) include
+  their owner like API-key callers do. 1.2.0 only read the API-key token's claim, so a
+  signed-in sub-address sent without its owner and `whoami` showed none.
 - A sub-address (such as `@user_agent@example.com`, owned by `@user@example.com`) now sends to
   its owner by default: `send_message`, `reply` and `create_draft` add the owner as a recipient so
   they can follow and reply to the thread, with a new `include_owner` argument (default true) to

package/dist/http.js

@@ -4,7 +4,7 @@ import { createMcpHandler, hostHeaderValidationResponse, localhostAllowedHostnam
 import { ApiKeyCallerProvider, FMSG_SCOPE } from "./auth.js";
 import { createFmsgMcpServer } from "./server.js";
 import { OAuthCallerProvider } from "./oauth/provider.js";
-import { invalidToken, insufficientScope, missingToken, OAuthRequestError, oauthErrorResponse, oauthRequestState } from "./oauth/errors.js";
+import { invalidToken, insufficientScope, missingToken, notBearer, OAuthRequestError, oauthErrorResponse, oauthRequestState } from "./oauth/errors.js";
 import { MESSAGING_SCOPES, READ_SCOPE, WRITE_SCOPE, requestScopes } from "./oauth/scopes.js";
 import { DOWNLOAD_PATH, downloadBaseUrl, downloadHeaders, parseDownloadPath } from "./download.js";
 import { CHECKSUM_HEADER, UPLOAD_DRAIN_IDLE_MS, UPLOAD_PATH, UploadBodyError, decodedUploadBody, drainableBody, parseUploadPath, uploadEncoding } from "./upload.js";
@@ -350,7 +350,7 @@ export function createHttpServer(config, log = (l) => console.error(l)) {
                 try {
                     const bearer = /^Bearer ([A-Za-z0-9._~+\/-]+=*)$/iu.exec(authorization);
                     if (!bearer)
-                        throw authorization ? invalidToken() : missingToken();
+                        throw !authorization ? missingToken() : /^Bearer\s/iu.test(authorization) ? invalidToken() : notBearer(!!apiKeyProvider);
                     const authenticated = await oauthProvider.verifyAccessToken(bearer[1]);
                     release = () => oauthProvider.release(authenticated);
                     let parsedBody;

package/dist/oauth/errors.d.ts

@@ -14,6 +14,8 @@ export declare class OAuthRequestError extends Error {
     constructor(status: 401 | 403 | 500 | 503, code: string, message: string, scopes?: string[]);
 }
 export declare const invalidToken: () => OAuthRequestError;
+/** An Authorization header without the Bearer scheme, such as a bare API key. */
+export declare const notBearer: (apiKeys: boolean) => OAuthRequestError;
 export declare const missingToken: () => OAuthRequestError;
 export declare const insufficientScope: (scopes: string[]) => OAuthRequestError;
 export declare function oauthErrorResponse(error: OAuthRequestError, metadataUrl: string): Response;

package/dist/oauth/errors.js

@@ -27,6 +27,10 @@ export class OAuthRequestError extends Error {
     }
 }
 export const invalidToken = () => new OAuthRequestError(401, "invalid_token", "The OAuth connection must be refreshed or reconnected.");
+/** An Authorization header without the Bearer scheme, such as a bare API key. */
+export const notBearer = (apiKeys) => new OAuthRequestError(401, "invalid_token", apiKeys
+    ? "The Authorization header must be `Bearer <token>`; send an API key as `Authorization: Bearer fmsgk_...`."
+    : "The Authorization header must be `Bearer <token>`.");
 export const missingToken = () => new OAuthRequestError(401, "invalid_token", "No access token was sent; send this MCP connection's Authorization header.");
 export const insufficientScope = (scopes) => new OAuthRequestError(403, "insufficient_scope", "The OAuth connection does not authorize this operation.", scopes);
 export function oauthErrorResponse(error, metadataUrl) {

package/dist/oauth/issuer.d.ts

@@ -1,7 +1,9 @@
 import type { AccessToken } from "../client/types.js";
 import { type OAuthConfig } from "./config.js";
+/** The verified app token: who it acts as and, for a sub-address, the `owner` claim the IdP puts on it. */
 export type OAuthIdentity = {
     address: string;
+    owner?: string;
     expiresAtMs: number;
     scopes: string[];
     clientId: string;

package/dist/oauth/issuer.js

@@ -1,6 +1,7 @@
 import { createRemoteJWKSet, customFetch, decodeJwt, decodeProtectedHeader, jwtVerify, errors } from "jose";
 import { normalizeFmsgAddress } from "../address.js";
 import { readBytes } from "../client/stream.js";
+import { ownerOf } from "../client/token-provider.js";
 import { oauthUrl } from "./config.js";
 import { invalidToken, OAuthRequestError } from "./errors.js";
 import { parseScopes } from "./scopes.js";
@@ -103,7 +104,8 @@ export class OAuthIssuer {
             const expiresAtMs = Math.floor(payload.exp * 1000);
             if (audience !== this.config.resourceUrl || !address || !scopes || !Number.isFinite(expiresAtMs) || expiresAtMs <= Date.now())
                 throw invalidToken();
-            return { address, scopes, expiresAtMs, clientId: typeof payload.client_id === "string" ? payload.client_id : "oauth-client" };
+            const owner = ownerOf(payload, address);
+            return { address, ...(owner ? { owner } : {}), scopes, expiresAtMs, clientId: typeof payload.client_id === "string" ? payload.client_id : "oauth-client" };
         }
         catch (error) {
             if (error instanceof OAuthRequestError)
@@ -173,7 +175,9 @@ export class OAuthIssuer {
             const expiresAtMs = Math.min(startedAt + body.expires_in * 1000, claims.exp * 1000, identity.expiresAtMs, startedAt + EXCHANGE_CACHE_MAX_MS);
             if (expiresAtMs <= Date.now())
                 throw new Error();
-            return { accessToken: body.access_token, address: identity.address, expiresAtMs };
+            // The exchanged token names the owner too; the app token's claim is the fallback.
+            const owner = ownerOf(claims, identity.address) ?? identity.owner;
+            return { accessToken: body.access_token, address: identity.address, ...(owner ? { owner } : {}), expiresAtMs };
         }
         catch {
             if (identity.expiresAtMs <= Date.now())

package/dist/oauth/provider.js

@@ -45,7 +45,8 @@ export class OAuthCallerProvider {
                 close: () => { subject = ""; },
             }, { allowInsecureHttp: this.config.allowInsecureHttp, reconnectOnTokenExpiry: true });
             entry = { key, identity, active: 0, lastUsed: Date.now(), caller: {
-                    client, address: identity.address, tokenExpiresAt: async () => (await client.getToken()).expiresAtMs,
+                    client, address: identity.address, ...(identity.owner ? { owner: identity.owner } : {}),
+                    tokenExpiresAt: async () => (await client.getToken()).expiresAtMs,
                 } };
             this.entries.set(key, entry);
         }
@@ -55,7 +56,7 @@ export class OAuthCallerProvider {
         const lease = randomUUID();
         this.leases.set(lease, entry);
         return { token: key, clientId: identity.clientId, scopes: identity.scopes, expiresAt: identity.expiresAtMs / 1000,
-            extra: { callerLease: lease, address: identity.address } };
+            extra: { callerLease: lease, address: identity.address, ...(identity.owner ? { owner: identity.owner } : {}) } };
     }
     entryFor(auth) {
         const lease = auth?.extra?.callerLease;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@markmnl/fmsg-mcp",
   "mcpName": "io.github.markmnl/fmsg-mcp",
-  "version": "1.2.1",
+  "version": "1.2.3",
   "description": "MCP server for fmsg: send and receive federated messages from any AI agent via a deployed fmsg Web API",
   "type": "module",
   "license": "MIT",

package/server.json

@@ -8,13 +8,13 @@
     "url": "https://github.com/markmnl/fmsg-mcp",
     "source": "github"
   },
-  "version": "1.2.1",
+  "version": "1.2.3",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@markmnl/fmsg-mcp",
-      "version": "1.2.1",
+      "version": "1.2.3",
       "transport": {
         "type": "stdio"
       },