@ni-c/mcp-hub 0.9.2 → 0.11.0

package/dist/auth/oidc/interactions.js

@@ -0,0 +1,187 @@
+import crypto from 'node:crypto';
+import bcrypt from 'bcryptjs';
+import express, { Router } from 'express';
+import { renderConsentPage } from '../consent-page.js';
+import { allowFormActionTo, authSecurityHeaders } from '../headers.js';
+import { renderLoginPage } from '../login-page.js';
+import { earlyRateLimit, LoginRateLimiter } from '../rate-limit.js';
+import { isLoopbackOnly } from '../redirect-uri.js';
+import { createSessionCookie, csrfToken, readSessionCookie, SESSION_COOKIE, SESSION_TTL_MS, verifyCsrfToken } from '../session.js';
+import { logSafe } from '../text.js';
+import { HUB_ACCOUNT_ID } from './provider.js';
+/**
+ * The hub's own login and consent pages, driven by oidc-provider's interaction
+ * loop instead of by HubOAuthProvider's hand-rolled one.
+ *
+ * The pages themselves are unchanged. They post to a RELATIVE `login` and
+ * `consent`, and that resolves to `/interaction/<uid>/login` because the page is
+ * served from a path ending in a slash — which it has to be anyway, since
+ * oidc-provider scopes the interaction cookie to exactly that path. The
+ * interaction id still travels in the hidden `request` field too, and is checked
+ * so a form cannot be replayed against a different interaction.
+ *
+ * Two behaviours from the old flow are load-bearing and preserved here:
+ *
+ *   - **Typing the password is the consent.** A first-time client is approved
+ *     by the login itself, so the consent page is only ever shown to someone
+ *     who is already signed in and is being asked about a NEW client.
+ *   - **One session cookie.** `mcp_hub_session` is set alongside
+ *     oidc-provider's own, because `hasValidSession()` is read outside the auth
+ *     layer by the upstream OAuth callback. Without it the operator would have
+ *     to log in twice for two different things.
+ */
+export function createOidcInteractionRoutes(options) {
+    const { provider, store } = options;
+    const router = Router();
+    const rateLimiter = new LoginRateLimiter();
+    // The pages this router serves are the ones with a password field on them, so
+    // they need the anti-clickjacking and no-store headers at least as much as
+    // the token endpoint does. `allowFormActionTo` narrows the CSP afterwards for
+    // the single page that has a redirect target to allow.
+    router.use(authSecurityHeaders);
+    const secure = new URL(options.externalUrl).protocol === 'https:';
+    const checkPassword = (password) => {
+        if (options.passwordHash)
+            return bcrypt.compareSync(password, options.passwordHash);
+        const expected = Buffer.from(options.password ?? '');
+        const given = Buffer.from(password);
+        return expected.length === given.length && crypto.timingSafeEqual(expected, given);
+    };
+    /** What the page may say about who is asking, and what it must not claim. */
+    const identityOf = async (clientId, resource) => {
+        const client = await provider.Client.find(clientId);
+        const metadata = client?.metadata();
+        return {
+            clientName: typeof metadata?.client_name === 'string' ? metadata.client_name : undefined,
+            resource,
+            // A metadata-document client is identified by a URL nobody can forge, so
+            // the page can show where the self-declared name came from.
+            clientId: options.cimd && clientId.startsWith('https://') ? clientId : undefined,
+            loopbackOnly: isLoopbackOnly(metadata?.redirect_uris)
+        };
+    };
+    const expired = (res, status, message) => {
+        res.status(status).type('html').send(`<p>${message}</p>`);
+    };
+    // The two POSTs below carry a limiter and this GET did not, which is the
+    // asymmetry CodeQL noticed and it was right. The page is unauthenticated by
+    // construction — the uid is all a caller has — and rendering it costs a
+    // provider store lookup, so a flood is cheap to send and not free to serve.
+    // The same window as its siblings; a person opening a login page a hundred
+    // times in fifteen minutes has a different problem.
+    router.get('/interaction/:uid', earlyRateLimit(15 * 60_000, 100, 500), async (req, res, next) => {
+        try {
+            const details = await provider.interactionDetails(req, res);
+            const params = details.params;
+            const redirectUri = String(params.redirect_uri ?? '');
+            const identity = await identityOf(String(params.client_id), params.resource);
+            allowFormActionTo(res, redirectUri);
+            if (details.prompt.name === 'login') {
+                res.status(200).type('html').send(renderLoginPage(details.uid, redirectUri, identity));
+                return;
+            }
+            const session = readSessionCookie(req.headers.cookie, store.cookieSecret);
+            if (!session) {
+                expired(res, 401, 'Session expired. Close this window and connect again.');
+                return;
+            }
+            res
+                .status(200)
+                .type('html')
+                .send(renderConsentPage(details.uid, csrfToken(session, store.cookieSecret), redirectUri, identity));
+        }
+        catch {
+            // interactionDetails throws for an unknown or expired uid, which is not
+            // an error worth a stack trace: the window was left open too long.
+            expired(res, 400, 'Authorization request expired. Close this window and connect again.');
+            void next;
+        }
+    });
+    router.post('/interaction/:uid/login', earlyRateLimit(15 * 60_000, 100, 500), express.urlencoded({ extended: false }), async (req, res) => {
+        const ip = req.ip ?? 'unknown';
+        const { password, request } = req.body;
+        let details;
+        try {
+            details = await provider.interactionDetails(req, res);
+        }
+        catch {
+            expired(res, 400, 'Authorization request expired. Close this window and connect again.');
+            return;
+        }
+        if (typeof request !== 'string' || request !== details.uid) {
+            expired(res, 400, 'Authorization request expired. Close this window and connect again.');
+            return;
+        }
+        if (rateLimiter.isBlocked(ip)) {
+            console.warn(`mcp-hub: login rate limit exceeded from ${logSafe(ip)}`);
+            expired(res, 429, 'Too many attempts. Try again later.');
+            return;
+        }
+        const params = details.params;
+        const redirectUri = String(params.redirect_uri ?? '');
+        if (typeof password !== 'string' || !checkPassword(password)) {
+            rateLimiter.recordFailure(ip);
+            console.warn(`mcp-hub: authentication failure from ${logSafe(ip)}`);
+            const identity = await identityOf(String(params.client_id), params.resource);
+            allowFormActionTo(res, redirectUri);
+            res.status(401).type('html').send(renderLoginPage(details.uid, redirectUri, identity, 'Wrong password'));
+            return;
+        }
+        rateLimiter.reset(ip);
+        console.log(`mcp-hub: successful login from ${logSafe(ip)}`);
+        // Typing the password is the consent for the client that triggered it.
+        const clientId = String(params.client_id);
+        const client = await provider.Client.find(clientId);
+        const clientName = client?.metadata()?.client_name;
+        store.saveApproval(clientId, redirectUri, typeof clientName === 'string' ? clientName : undefined);
+        console.log(`mcp-hub: approved OAuth client ${logSafe(clientId)} for ${logSafe(redirectUri)}`);
+        res.cookie(SESSION_COOKIE, createSessionCookie(store.cookieSecret), {
+            httpOnly: true,
+            secure,
+            sameSite: 'lax',
+            maxAge: SESSION_TTL_MS,
+            path: '/'
+        });
+        await provider.interactionFinished(req, res, { login: { accountId: HUB_ACCOUNT_ID } }, { mergeWithLastSubmission: false });
+    });
+    router.post('/interaction/:uid/consent', earlyRateLimit(15 * 60_000, 100, 500), express.urlencoded({ extended: false }), async (req, res) => {
+        const { request, csrf, action } = req.body;
+        let details;
+        try {
+            details = await provider.interactionDetails(req, res);
+        }
+        catch {
+            expired(res, 400, 'Authorization request expired. Close this window and connect again.');
+            return;
+        }
+        if (typeof request !== 'string' || request !== details.uid) {
+            expired(res, 400, 'Authorization request expired. Close this window and connect again.');
+            return;
+        }
+        const session = readSessionCookie(req.headers.cookie, store.cookieSecret);
+        if (!session) {
+            expired(res, 401, 'Session expired. Close this window and connect again.');
+            return;
+        }
+        if (!verifyCsrfToken(session, csrf, store.cookieSecret)) {
+            console.warn(`mcp-hub: consent with an invalid CSRF token from ${logSafe(req.ip ?? 'unknown')}`);
+            expired(res, 403, 'This form is no longer valid. Close this window and connect again.');
+            return;
+        }
+        if (action !== 'approve') {
+            await provider.interactionFinished(req, res, { error: 'access_denied' }, { mergeWithLastSubmission: false });
+            return;
+        }
+        const params = details.params;
+        const clientId = String(params.client_id);
+        const client = await provider.Client.find(clientId);
+        const clientName = client?.metadata()?.client_name;
+        store.saveApproval(clientId, String(params.redirect_uri ?? ''), typeof clientName === 'string' ? clientName : undefined);
+        console.log(`mcp-hub: approved OAuth client ${logSafe(clientId)} for ${logSafe(String(params.redirect_uri ?? ''))}`);
+        // The grant itself is minted by loadExistingGrant on the resumed request,
+        // which is the same code path an already-approved client takes.
+        await provider.interactionFinished(req, res, { consent: {} }, { mergeWithLastSubmission: true });
+    });
+    return router;
+}
+//# sourceMappingURL=interactions.js.map

package/dist/auth/oidc/interactions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interactions.js","sourceRoot":"","sources":["../../../src/auth/oidc/interactions.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,MAAM,MAAM,UAAU,CAAC;AAC9B,OAAO,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAI1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEnI,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAW/C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,2BAA2B,CAAC,OAA+B;IACzE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,WAAW,GAAG,IAAI,gBAAgB,EAAE,CAAC;IAE3C,8EAA8E;IAC9E,2EAA2E;IAC3E,8EAA8E;IAC9E,uDAAuD;IACvD,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAElE,MAAM,aAAa,GAAG,CAAC,QAAgB,EAAW,EAAE;QAClD,IAAI,OAAO,CAAC,YAAY;YAAE,OAAO,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QACpF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpC,OAAO,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACrF,CAAC,CAAC;IAEF,6EAA6E;IAC7E,MAAM,UAAU,GAAG,KAAK,EAAE,QAAgB,EAAE,QAAiB,EAAE,EAAE;QAC/D,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,EAAyC,CAAC;QAC3E,OAAO;YACL,UAAU,EAAE,OAAO,QAAQ,EAAE,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;YACxF,QAAQ;YACR,yEAAyE;YACzE,4DAA4D;YAC5D,QAAQ,EAAE,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;YAChF,YAAY,EAAE,cAAc,CAAC,QAAQ,EAAE,aAAqC,CAAC;SAC9E,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,CAAC,GAAqB,EAAE,MAAc,EAAE,OAAe,EAAQ,EAAE;QAC/E,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,OAAO,MAAM,CAAC,CAAC;IAC5D,CAAC,CAAC;IAEF,yEAAyE;IACzE,4EAA4E;IAC5E,wEAAwE;IACxE,4EAA4E;IAC5E,2EAA2E;IAC3E,oDAAoD;IACpD,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC9F,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,MAA0E,CAAC;YAClG,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;YACtD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC7E,iBAAiB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAEpC,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;gBACvF,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;YAC1E,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,uDAAuD,CAAC,CAAC;gBAC3E,OAAO;YACT,CAAC;YACD,GAAG;iBACA,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,MAAM,CAAC;iBACZ,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzG,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;YACxE,mEAAmE;YACnE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,qEAAqE,CAAC,CAAC;YACzF,KAAK,IAAI,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CACT,yBAAyB,EACzB,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,EACrC,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EACvC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACjB,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC;QAC/B,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,IAA+C,CAAC;QAClF,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,qEAAqE,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;YAC3D,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,qEAAqE,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,IAAI,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC,2CAA2C,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACvE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,qCAAqC,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAA0E,CAAC;QAClG,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QACtD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7D,WAAW,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC,wCAAwC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACpE,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC7E,iBAAiB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC;YACzG,OAAO;QACT,CAAC;QAED,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,kCAAkC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7D,uEAAuE;QACvE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpD,MAAM,UAAU,GAAI,MAAM,EAAE,QAAQ,EAA0C,EAAE,WAAW,CAAC;QAC5F,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACnG,OAAO,CAAC,GAAG,CAAC,kCAAkC,OAAO,CAAC,QAAQ,CAAC,QAAQ,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAE/F,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,mBAAmB,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE;YAClE,QAAQ,EAAE,IAAI;YACd,MAAM;YACN,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,cAAc;YACtB,IAAI,EAAE,GAAG;SACV,CAAC,CAAC;QACH,MAAM,QAAQ,CAAC,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7H,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,2BAA2B,EAC3B,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,EACrC,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EACvC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACjB,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAA4D,CAAC;QACnG,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,qEAAqE,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;YAC3D,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,qEAAqE,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QAC1E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,uDAAuD,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YACxD,OAAO,CAAC,IAAI,CAAC,oDAAoD,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC;YACjG,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,oEAAoE,CAAC,CAAC;YACxF,OAAO;QACT,CAAC;QAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,QAAQ,CAAC,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7G,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAuD,CAAC;QAC/E,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpD,MAAM,UAAU,GAAI,MAAM,EAAE,QAAQ,EAA0C,EAAE,WAAW,CAAC;QAC5F,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACzH,OAAO,CAAC,GAAG,CAAC,kCAAkC,OAAO,CAAC,QAAQ,CAAC,QAAQ,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QACrH,0EAA0E;QAC1E,gEAAgE;QAChE,MAAM,QAAQ,CAAC,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;IACnG,CAAC,CACF,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/auth/oidc/mount.js

@@ -0,0 +1,144 @@
+import { earlyRateLimit } from '../rate-limit.js';
+import { defaultScope, stripPhantomSecret } from './quirks.js';
+/**
+ * Every path the provider answers on, given the `routes` reconfiguration in
+ * provider.ts.
+ *
+ * Two of these are not endpoints and are easy to miss:
+ *
+ *   - `/authorize/:uid` is the RESUME route (initialize_app.js registers it at
+ *     `${routes.authorization}/:uid`). Without it the redirect back from the
+ *     login page lands in the hub's 404 handler and the authorization flow
+ *     dead-ends silently, with a plausible-looking error.
+ *   - `/register/:id` is RFC 7592 registration management.
+ *
+ * Both `.well-known` paths are served by the provider with an identical body,
+ * which is exactly the alias the hub used to build by hand for ChatGPT.
+ */
+export const OIDC_PATHS = [
+    '/authorize',
+    '/authorize/:uid',
+    '/token',
+    '/revoke',
+    '/register',
+    '/register/:id',
+    '/jwks',
+    '/.well-known/oauth-authorization-server',
+    '/.well-known/openid-configuration'
+];
+/**
+ * Makes EXTERNAL_URL authoritative for every URL the provider publishes.
+ *
+ * oidc-provider builds endpoint URLs from the REQUEST (`urlFor` resolves against
+ * `ctx.href`), not from the issuer. Two consequences the hub cannot accept:
+ *
+ *   - behind a reverse proxy the document would advertise the internal host, and
+ *   - a request carrying `Host: evil.example` would be answered with a discovery
+ *     document pointing at evil.example.
+ *
+ * The hub already treats EXTERNAL_URL as the single source of truth and compares
+ * it byte for byte, so overwriting the request's idea of its own origin is the
+ * faithful translation rather than a workaround.
+ *
+ * It also closes the `provider.proxy` gap. That flag is a boolean — it trusts
+ * any `X-Forwarded-*` — whereas Express was configured with a CIDR list. Because
+ * all three headers are overwritten here, the client cannot influence them, and
+ * `X-Forwarded-For` is replaced with the address Express already resolved
+ * against TRUSTED_PROXIES.
+ */
+export function forceExternalOrigin(externalUrl) {
+    const url = new URL(externalUrl);
+    const proto = url.protocol.replace(':', '');
+    return (req, _res, next) => {
+        req.headers.host = url.host;
+        req.headers['x-forwarded-host'] = url.host;
+        req.headers['x-forwarded-proto'] = proto;
+        if (req.ip)
+            req.headers['x-forwarded-for'] = req.ip;
+        else
+            delete req.headers['x-forwarded-for'];
+        next();
+    };
+}
+/**
+ * The same budgets the hub applied before, per path.
+ *
+ * They belong here rather than at the call site because the mounted Koa app is
+ * never entered by the Express router: a limit that is not put in front of the
+ * mount simply does not exist, and nothing about the resulting configuration
+ * looks wrong. `/register` is the tightest — registration is open — and it also
+ * has to cover `/register/:id`, whose own budget is more generous because
+ * routine management would otherwise use up a client's ability to register.
+ */
+export function defaultRateLimits() {
+    return {
+        '/register': [earlyRateLimit(60 * 60_000, 20, 200)],
+        '/register/:id': [earlyRateLimit(60 * 60_000, 60, 600)],
+        '/authorize': [earlyRateLimit(15 * 60_000, 100, 1_000)],
+        '/authorize/:uid': [earlyRateLimit(15 * 60_000, 100, 1_000)],
+        '/token': [earlyRateLimit(15 * 60_000, 50, 500)]
+    };
+}
+/**
+ * Mounts the authorization server into the hub's Express app.
+ *
+ * `app.all(path, ...)` and NOT `app.use(path, ...)`: `use` strips the prefix
+ * from `req.url`, while oidc-provider derives its own mount path from the
+ * issuer (provider.js `#mountPath = new URL(issuer).pathname`). The hub's
+ * issuer is the origin root, so stripping would leave the router looking at
+ * paths the published URLs do not match.
+ *
+ * The mounted app is also a dead end — Koa's `handleRequest` always responds,
+ * so anything that reaches it never returns to Express. Mounting per path
+ * rather than at the root is what keeps `/livez`, `/health` and every MCP route
+ * reachable.
+ */
+export function mountOidcProvider(app, provider, store, options) {
+    const callback = provider.callback();
+    // Safe only in combination with forceExternalOrigin, which overwrites every
+    // forwarded header the client could otherwise set.
+    provider.proxy = true;
+    /**
+     * Errors do not cross the boundary. A throw inside the Koa app is caught by
+     * `ctx.onerror` and never reaches the hub's four-argument Express error
+     * handler, so without this an authorization-server fault would be invisible
+     * in the hub's logs.
+     */
+    provider.on('server_error', (_ctx, error) => {
+        console.error(`mcp-hub: authorization server failed: ${error.message}`);
+    });
+    /**
+     * RFC 8414 also defines a path-insertion form, and clients probing a specific
+     * resource look up `/.well-known/oauth-authorization-server/<name>/mcp` before
+     * falling back to the root document. oidc-provider registers only the exact
+     * paths, so without this the suffix form 404s — which the hub answered before.
+     * One authorization server covers every resource, so the answer is the same
+     * document.
+     */
+    for (const base of ['/.well-known/oauth-authorization-server', '/.well-known/openid-configuration']) {
+        app.get(`${base}/{*splat}`, ...(options.common ?? []), forceExternalOrigin(options.externalUrl), (req, res) => {
+            req.url = base;
+            callback(req, res);
+        });
+    }
+    // Built once: each entry holds a counter, and rebuilding per path would give
+    // every route a fresh, empty limiter on every iteration.
+    const before = options.before ?? defaultRateLimits();
+    for (const path of OIDC_PATHS) {
+        const handlers = [
+            ...(options.common ?? []),
+            ...(before[path] ?? []),
+            forceExternalOrigin(options.externalUrl)
+        ];
+        if (path === '/authorize')
+            handlers.push(defaultScope);
+        // Reads the body, so it has to BE the terminal handler rather than sit in
+        // front of one: the request stream can only be consumed once.
+        if (path === '/token')
+            handlers.push(stripPhantomSecret(store, callback));
+        else
+            handlers.push((req, res) => callback(req, res));
+        app.all(path, ...handlers);
+    }
+}
+//# sourceMappingURL=mount.js.map

package/dist/auth/oidc/mount.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mount.js","sourceRoot":"","sources":["../../../src/auth/oidc/mount.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAE/D;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,YAAY;IACZ,iBAAiB;IACjB,QAAQ;IACR,SAAS;IACT,WAAW;IACX,eAAe;IACf,OAAO;IACP,yCAAyC;IACzC,mCAAmC;CAC3B,CAAC;AAEX;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAmB;IACrD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QACzB,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QAC5B,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC;QAC3C,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,GAAG,KAAK,CAAC;QACzC,IAAI,GAAG,CAAC,EAAE;YAAE,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;;YAC/C,OAAO,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC3C,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO;QACL,WAAW,EAAE,CAAC,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACnD,eAAe,EAAE,CAAC,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,YAAY,EAAE,CAAC,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACvD,iBAAiB,EAAE,CAAC,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5D,QAAQ,EAAE,CAAC,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;KACjD,CAAC;AACJ,CAAC;AAYD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAY,EAAE,QAAkB,EAAE,KAAgB,EAAE,OAAqB;IACzG,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,EAAsD,CAAC;IACzF,4EAA4E;IAC5E,mDAAmD;IACnD,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC;IAEtB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,CAAC,cAAc,EAAE,CAAC,IAAI,EAAE,KAAY,EAAE,EAAE;QACjD,OAAO,CAAC,KAAK,CAAC,yCAAyC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH;;;;;;;OAOG;IACH,KAAK,MAAM,IAAI,IAAI,CAAC,yCAAyC,EAAE,mCAAmC,CAAC,EAAE,CAAC;QACpG,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,mBAAmB,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5G,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC;YACf,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,yDAAyD;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,iBAAiB,EAAE,CAAC;IAErD,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAqB;YACjC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;YACzB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACvB,mBAAmB,CAAC,OAAO,CAAC,WAAW,CAAC;SACzC,CAAC;QACF,IAAI,IAAI,KAAK,YAAY;YAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACvD,0EAA0E;QAC1E,8DAA8D;QAC9D,IAAI,IAAI,KAAK,QAAQ;YAAE,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;;YACrE,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QACrD,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC"}