@opengeni/api-router 0.12.12 → 0.14.4

package/src/integrations/oauth-client.ts

@@ -2,7 +2,11 @@ import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import type { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
 import { parseIntegrationsOauthClientsJson, type Settings } from "@opengeni/config";
-import { OAuthStartResponse, type OAuthStartRequest } from "@opengeni/contracts";
+import {
+  OPENGENI_PERSONAL_SLACK_MCP_URL,
+  OAuthStartResponse,
+  type OAuthStartRequest,
+} from "@opengeni/contracts";
 import { hasPermission, requireEnvironmentEncryption } from "@opengeni/core";
 import type { Observability } from "@opengeni/observability";
 import {
@@ -34,8 +38,9 @@ import { HTTPException } from "hono/http-exception";
 import { canonicalProviderDomain } from "./provider-domain";
 
 export const oauthStateTtlMs = 10 * 60 * 1000;
-export const OFFICIAL_SLACK_MCP_URL = "https://mcp.slack.com/mcp";
+export const OFFICIAL_SLACK_MCP_URL = OPENGENI_PERSONAL_SLACK_MCP_URL;
 const SLACK_OAUTH_ORIGIN = "https://slack.com";
+const SLACK_MCP_ORIGIN = "https://mcp.slack.com";
 export { OAUTH_MAX_RESPONSE_BYTES } from "@opengeni/network";
 
 type OAuthClientDeps = {
@@ -410,8 +415,14 @@ function assertPersonalSlackOAuthStart(
 }
 
 export function assertSlackAuthorizationServer(as: AuthorizationServerMetadata): void {
-  const urls = [as.issuer, as.authorizationServer, as.authorizationEndpoint, as.tokenEndpoint];
-  if (urls.some((value) => new URL(value).origin !== SLACK_OAUTH_ORIGIN)) {
+  const issuerOrigins = [as.issuer, as.authorizationServer].map((value) => new URL(value).origin);
+  const endpointOrigins = [as.authorizationEndpoint, as.tokenEndpoint].map(
+    (value) => new URL(value).origin,
+  );
+  if (
+    issuerOrigins.some((origin) => origin !== SLACK_OAUTH_ORIGIN && origin !== SLACK_MCP_ORIGIN) ||
+    endpointOrigins.some((origin) => origin !== SLACK_OAUTH_ORIGIN)
+  ) {
     throw new HTTPException(422, {
       message: "Slack MCP authorization metadata did not remain bound to slack.com",
     });
@@ -508,9 +519,14 @@ async function discoverAuthorizationServerMetadata(
     "OAuth authorization server",
   ).replace(/\/+$/, "");
   const candidates = uniqueStrings([
-    safeAuthorizationServer,
+    // Prefer the RFC metadata locations before probing the issuer itself. Some
+    // providers (including Linear) redirect their issuer root to a human docs
+    // page; following that redirect can leave discovery waiting on an unrelated
+    // streaming response even though the well-known metadata is immediately
+    // available.
     ...wellKnownCandidates(safeAuthorizationServer, "oauth-authorization-server"),
     ...wellKnownCandidates(safeAuthorizationServer, "openid-configuration"),
+    safeAuthorizationServer,
   ]);
   for (const candidate of candidates) {
     const payload = await fetchJsonObject(candidate, settings).catch((error) => {
@@ -572,6 +588,12 @@ async function registerOAuthClient(
   if (operator) {
     return operator;
   }
+  // Linear currently advertises CIMD but rejects its client metadata URL at
+  // the authorization endpoint. Its documented interactive setup uses DCR,
+  // so prefer the simultaneously advertised registration endpoint.
+  if (prefersDynamicClientRegistration(as)) {
+    return await getOrCreateDynamicClientRegistration(db, settings, as, redirectUri, scopes);
+  }
   if (as.clientIdMetadataDocumentSupported) {
     return {
       method: "cimd",
@@ -597,6 +619,12 @@ async function registerOAuthClient(
   return await getOrCreateDynamicClientRegistration(db, settings, as, redirectUri, scopes);
 }
 
+function prefersDynamicClientRegistration(as: AuthorizationServerMetadata): boolean {
+  return Boolean(
+    as.registrationEndpoint && normalizedIssuerKey(as.issuer) === "https://mcp.linear.app",
+  );
+}
+
 async function getOrCreateDynamicClientRegistration(
   db: Database,
   settings: Settings,
@@ -720,7 +748,14 @@ function operatorClientEntryFor(
 ): ReturnType<typeof parseIntegrationsOauthClientsJson>[string] | null {
   const normalizedCandidates = new Set(candidates.map(normalizedIssuerKey));
   if (
-    normalizedCandidates.has(SLACK_OAUTH_ORIGIN) &&
+    candidates.some((candidate) => {
+      try {
+        const origin = new URL(candidate).origin;
+        return origin === SLACK_OAUTH_ORIGIN || origin === SLACK_MCP_ORIGIN;
+      } catch {
+        return false;
+      }
+    }) &&
     settings.slackClientId?.trim() &&
     settings.slackClientSecret?.trim()
   ) {