@mathismeadows/roamer-device-auth 1.5.5 → 1.5.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mathismeadows/roamer-device-auth",
-  "version": "1.5.5",
+  "version": "1.5.6",
   "private": false,
   "mcpName": "com.mathismeadows/roamer-mcp",
   "type": "module",

package/roamer-device-auth.mjs

@@ -355,6 +355,13 @@ async function readCachedTokens(clientSlug, identityKey = null) {
     // A cache from an incompatible prior format must never be trusted just because it
     // happens to have the right field names — see CACHE_VERSION's comment.
     if (tokens?.cacheVersion !== CACHE_VERSION) return null;
+    // AUTH-38/AUTH-device-code-cache-issuer-blind: same protection readLoopbackTokens already
+    // has — a token cached against a prior authorization server (e.g. Cloudflare Access
+    // Managed OAuth, before AUTH-38) must never be trusted just because cacheVersion matches.
+    // No live discovery needed here (unlike the loopback cache): RoamerMcp declares itself as
+    // its own AS in its .well-known/oauth-protected-resource document, so the fixed
+    // ROAMER_MCP_ORIGIN constant is exactly as authoritative as a freshly-discovered value.
+    if (tokens?.issuerUrl !== ROAMER_MCP_ORIGIN) return null;
     return tokens;
   } catch {
     return null;
@@ -368,7 +375,12 @@ async function writeCachedTokens(clientSlug, tokens, identityKey = null) {
   const path = cacheFilePath("roamer_tokens", clientSlug, identityKey);
   if (!path) return; // AUTH-51: no usable client identity — never persisted.
   await mkdir(CACHE_DIR, { recursive: true, mode: 0o700 });
-  const stamped = { ...tokens, cacheVersion: CACHE_VERSION, label: identityLabelFromTokens(tokens) };
+  const stamped = {
+    ...tokens,
+    cacheVersion: CACHE_VERSION,
+    issuerUrl: ROAMER_MCP_ORIGIN,
+    label: identityLabelFromTokens(tokens),
+  };
   await writeFile(path, JSON.stringify(stamped, null, 2), { mode: 0o600 });
 }