@opengeni/api-router 0.5.2 → 0.5.3

package/dist/app.js

@@ -14,7 +14,7 @@ import {
   validateToolRefs,
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession
-} from "./chunk-YY6OAEL6.js";
+} from "./chunk-3HIA43CC.js";
 export {
   allowedCorsOrigin,
   createApp,

package/dist/{chunk-YY6OAEL6.js → chunk-3HIA43CC.js}

@@ -2423,10 +2423,22 @@ function canonicalProviderDomain(value) {
 
 // src/integrations/oauth-client.ts
 var oauthStateTtlMs = 10 * 60 * 1e3;
+var OAuthCallbackStageError = class extends Error {
+  constructor(stage2, reason, cause) {
+    super(errorMessage(cause));
+    this.stage = stage2;
+    this.reason = reason;
+    this.cause = cause;
+    this.name = "OAuthCallbackStageError";
+  }
+  stage;
+  reason;
+  cause;
+};
 async function startMcpOAuth(deps, context) {
   const { db, settings } = deps;
-  const resource = canonicalMcpResource(context.payload.mcpUrl ?? context.payload.resource);
-  const providerDomain = canonicalProviderDomain(context.payload.providerDomain ?? new URL(resource).hostname);
+  const mcpUrl = canonicalMcpResource(context.payload.mcpUrl ?? context.payload.resource);
+  const providerDomain = canonicalProviderDomain(context.payload.providerDomain ?? new URL(mcpUrl).hostname);
   const returnPath = safeReturnPath(context.payload.returnPath ?? "/integrations");
   const baseUrl = integrationBaseUrl(settings.publicBaseUrl, context.requestUrl);
   const redirectUri = `${baseUrl}/v1/integrations/oauth/callback`;
@@ -2435,7 +2447,8 @@ async function startMcpOAuth(deps, context) {
   if (context.payload.connectionId && !existing) {
     throw new HTTPException6(404, { message: "connection not found" });
   }
-  const discovery = await discoverMcpOAuth(resource, settings);
+  const discovery = await discoverMcpOAuth(mcpUrl, settings);
+  const resource = discovery.prm.resource ? canonicalOAuthResource(discovery.prm.resource) : mcpUrl;
   const client = await registerOAuthClient(db, settings, discovery.as, metadataUrl, redirectUri);
   const verifier = randomPkceVerifier();
   const authorizeScopes = chooseAuthorizeScopes(context.payload.requestedScopes, discovery.challenge.scope, discovery.prm.scopesSupported);
@@ -2445,6 +2458,7 @@ async function startMcpOAuth(deps, context) {
     workspaceId: context.workspaceId,
     subjectId: context.subjectId,
     providerDomain,
+    mcpUrl,
     resource,
     requestedScopes: uniqueStrings(context.payload.requestedScopes ?? []),
     authorizeScopes,
@@ -2474,24 +2488,33 @@ async function startMcpOAuth(deps, context) {
   });
 }
 async function completeMcpOAuthCallback(deps, input) {
-  const { db, settings } = deps;
+  const { db, settings, observability } = deps;
+  let state = null;
   if (!input.state) {
-    throw new HTTPException6(400, { message: "missing OAuth state" });
+    const error = new OAuthCallbackStageError("state_verify", "state_invalid", new Error("missing OAuth state"));
+    logOAuthCallbackFailure(observability, error, state);
+    return { redirectTo: callbackReturnPath("/integrations", "error", { reason: error.reason }) };
   }
-  const state = readOAuthState(input.state, settings);
-  if (!input.code) {
-    return { redirectTo: callbackReturnPath(state.returnPath, "error", { reason: "missing_code" }) };
-  }
-  const consumed = await consumeIntegrationOAuthStateNonce(db, {
-    accountId: state.accountId,
-    workspaceId: state.workspaceId,
-    subjectId: state.subjectId,
-    nonce: state.nonce,
-    expiresAt: new Date(state.iat * 1e3 + oauthStateTtlMs),
-    now: /* @__PURE__ */ new Date()
-  });
-  if (!consumed) {
-    throw new HTTPException6(400, { message: "OAuth state has already been used" });
+  try {
+    state = readOAuthState(input.state, settings);
+    if (!input.code) {
+      return { redirectTo: callbackReturnPath(state.returnPath, "error", { reason: "missing_code" }) };
+    }
+    const consumed = await consumeIntegrationOAuthStateNonce(db, {
+      accountId: state.accountId,
+      workspaceId: state.workspaceId,
+      subjectId: state.subjectId,
+      nonce: state.nonce,
+      expiresAt: new Date(state.iat * 1e3 + oauthStateTtlMs),
+      now: /* @__PURE__ */ new Date()
+    });
+    if (!consumed) {
+      throw new HTTPException6(400, { message: "OAuth state has already been used" });
+    }
+  } catch (error) {
+    const staged = new OAuthCallbackStageError("state_verify", "state_invalid", error);
+    logOAuthCallbackFailure(observability, staged, state);
+    return { redirectTo: callbackReturnPath(state?.returnPath ?? "/integrations", "error", { reason: staged.reason }) };
   }
   try {
     const baseUrl = integrationBaseUrl(settings.publicBaseUrl, input.requestUrl);
@@ -2499,28 +2522,30 @@ async function completeMcpOAuthCallback(deps, input) {
     const key = requireEnvironmentEncryption2(settings);
     const verifier = decryptEnvironmentValue(key, state.encryptedPkceVerifier);
     const client = await clientForState(db, settings, state);
-    const token = await exchangeAuthorizationCode(settings, {
+    const token = await stage("token_exchange", "token_exchange_failed", () => exchangeAuthorizationCode(settings, {
       code: input.code,
       verifier,
       redirectUri,
       resource: state.resource,
       tokenEndpoint: state.tokenEndpoint,
       client
-    });
-    const tools = await verifyMcpToolsList(settings, state.resource, token);
+    }));
+    const verification = await verifyMcpToolsListNonFatal(observability, settings, state, token);
     const scopes = grantedScopes(token.scopeText, state.authorizeScopes);
     const credential = credentialBundle(token, state, client);
     const metadata = {
       resource: state.resource,
+      mcpUrl: state.mcpUrl,
       authorizationServer: state.authorizationServer,
       authorizationServerIssuer: state.issuer,
       tokenEndpoint: state.tokenEndpoint,
       clientId: client.clientId,
       clientRegistrationMethod: state.clientRegistrationMethod,
-      mcpTools: tools
+      mcpToolsVerification: verification.metadata,
+      ...verification.tools ? { mcpTools: verification.tools } : {}
     };
     const credentialEncrypted = encryptEnvironmentValue3(key, JSON.stringify(credential));
-    const connection = state.connectionId ? await updateConnection(db, {
+    const connection = await stage("persist", "persist_failed", () => state.connectionId ? updateConnection(db, {
       workspaceId: state.workspaceId,
       connectionId: state.connectionId,
       visibleToSubjectId: state.subjectId,
@@ -2533,7 +2558,7 @@ async function completeMcpOAuthCallback(deps, input) {
       expiresAt: token.expiresAt,
       metadata,
       updatedBySubjectId: state.subjectId
-    }) : await createConnection(db, {
+    }) : createConnection(db, {
       accountId: state.accountId,
       workspaceId: state.workspaceId,
       subjectId: null,
@@ -2544,16 +2569,21 @@ async function completeMcpOAuthCallback(deps, input) {
       expiresAt: token.expiresAt,
       metadata,
       createdBySubjectId: state.subjectId
-    });
+    }));
     if (!connection) {
       throw new HTTPException6(409, { message: "connection changed during OAuth reconnect; start again" });
     }
-    return { redirectTo: callbackReturnPath(state.returnPath, "success", { connectionId: connection.id, providerDomain: connection.providerDomain }) };
+    return {
+      redirectTo: callbackReturnPath(state.returnPath, "success", {
+        connectionId: connection.id,
+        providerDomain: connection.providerDomain,
+        ...verification.metadata.status === "failed" ? { verification: "failed" } : {}
+      })
+    };
   } catch (error) {
-    if (error instanceof HTTPException6 && error.status >= 400 && error.status < 500) {
-      throw error;
-    }
-    return { redirectTo: callbackReturnPath(state.returnPath, "error", { reason: "oauth_callback_failed" }) };
+    const staged = error instanceof OAuthCallbackStageError ? error : new OAuthCallbackStageError("persist", "persist_failed", error);
+    logOAuthCallbackFailure(observability, staged, state);
+    return { redirectTo: callbackReturnPath(state.returnPath, "error", { reason: staged.reason }) };
   }
 }
 function integrationBaseUrl(publicBaseUrl, requestUrl) {
@@ -2805,12 +2835,14 @@ function readOAuthState(state, settings) {
   if (iat === void 0 || nowSeconds - iat > oauthStateTtlMs / 1e3 || nowSeconds < iat) {
     throw new HTTPException6(400, { message: "invalid or expired OAuth state" });
   }
+  const resource = requiredString(payload.resource, "state.resource");
   const parsed = {
     accountId: requiredString(payload.accountId, "state.accountId"),
     workspaceId: requiredString(payload.workspaceId, "state.workspaceId"),
     subjectId: requiredString(payload.subjectId, "state.subjectId"),
     providerDomain: requiredString(payload.providerDomain, "state.providerDomain"),
-    resource: requiredString(payload.resource, "state.resource"),
+    mcpUrl: stringValue(payload.mcpUrl) ?? resource,
+    resource,
     requestedScopes: stringArray(payload.requestedScopes),
     authorizeScopes: stringArray(payload.authorizeScopes),
     encryptedPkceVerifier: requiredString(payload.encryptedPkceVerifier, "state.encryptedPkceVerifier"),
@@ -2886,7 +2918,8 @@ async function exchangeAuthorizationCode(settings, input) {
   }
   const response = await fetchOAuth(input.tokenEndpoint, settings, { method: "POST", headers, body });
   if (!response.ok) {
-    throw new Error(`OAuth token endpoint returned HTTP ${response.status}`);
+    const oauthError = await oauthErrorFromResponse(response);
+    throw new OAuthCallbackStageError("token_exchange", oauthError ?? "token_exchange_failed", new Error(`OAuth token endpoint returned HTTP ${response.status}`));
   }
   const payload = await response.json();
   const accessToken = stringValue(payload.access_token);
@@ -2902,6 +2935,72 @@ async function exchangeAuthorizationCode(settings, input) {
     ...stringValue(payload.scope) ? { scopeText: stringValue(payload.scope) } : {}
   };
 }
+async function stage(stage2, fallbackReason, fn) {
+  try {
+    return await fn();
+  } catch (error) {
+    if (error instanceof OAuthCallbackStageError) {
+      throw error;
+    }
+    throw new OAuthCallbackStageError(stage2, fallbackReason, error);
+  }
+}
+function logOAuthCallbackFailure(observability, error, state) {
+  observability?.error("MCP OAuth callback failed", {
+    "opengeni.oauth.stage": error.stage,
+    "opengeni.oauth.reason": error.reason,
+    "opengeni.oauth.provider_domain": state?.providerDomain,
+    "opengeni.oauth.resource_host": state ? safeHost(state.resource) : void 0,
+    "opengeni.oauth.authorization_server": state?.authorizationServer,
+    "opengeni.oauth.issuer": state?.issuer,
+    "opengeni.oauth.client_registration_method": state?.clientRegistrationMethod,
+    error: sanitizedError(error.cause)
+  });
+}
+function logOAuthVerificationWarning(observability, error, state) {
+  observability?.warn("MCP OAuth tools/list verification failed after token exchange", {
+    "opengeni.oauth.stage": error.stage,
+    "opengeni.oauth.reason": error.reason,
+    "opengeni.oauth.provider_domain": state.providerDomain,
+    "opengeni.oauth.resource_host": safeHost(state.resource),
+    "opengeni.oauth.mcp_host": safeHost(state.mcpUrl),
+    "opengeni.oauth.authorization_server": state.authorizationServer,
+    "opengeni.oauth.issuer": state.issuer,
+    "opengeni.oauth.client_registration_method": state.clientRegistrationMethod,
+    error: sanitizedError(error.cause)
+  });
+}
+function sanitizedError(error) {
+  if (error instanceof HTTPException6) {
+    return `HTTPException ${error.status}: ${error.message}`;
+  }
+  if (error instanceof Error) {
+    return `${error.name}: ${error.message}`;
+  }
+  return String(error);
+}
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function safeHost(rawUrl) {
+  try {
+    return new URL(rawUrl).host;
+  } catch {
+    return void 0;
+  }
+}
+async function oauthErrorFromResponse(response) {
+  const contentType = response.headers.get("content-type") ?? "";
+  if (!contentType.toLowerCase().includes("application/json")) {
+    return null;
+  }
+  const payload = await response.clone().json().catch(() => null);
+  const error = stringValue(payload?.error);
+  if (!error || !/^[a-zA-Z0-9_.-]{1,80}$/.test(error)) {
+    return null;
+  }
+  return error;
+}
 async function verifyMcpToolsList(settings, resource, token) {
   await assertOAuthFetchAllowed(resource, settings);
   const client = new Client2({ name: "opengeni-integration-verify", version: "0.1.0" }, { capabilities: {} });
@@ -2922,6 +3021,29 @@ async function verifyMcpToolsList(settings, resource, token) {
     await client.close().catch(() => void 0);
   }
 }
+async function verifyMcpToolsListNonFatal(observability, settings, state, token) {
+  try {
+    const tools = await stage("tools_list", "tools_list_failed", () => verifyMcpToolsList(settings, state.mcpUrl, token));
+    return {
+      metadata: {
+        status: "ok",
+        checkedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        toolCount: tools.length
+      },
+      tools
+    };
+  } catch (error) {
+    const staged = error instanceof OAuthCallbackStageError ? error : new OAuthCallbackStageError("tools_list", "tools_list_failed", error);
+    logOAuthVerificationWarning(observability, staged, state);
+    return {
+      metadata: {
+        status: "failed",
+        checkedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        reason: staged.reason
+      }
+    };
+  }
+}
 function credentialBundle(token, state, client) {
   return {
     access_token: token.accessToken,
@@ -2929,6 +3051,7 @@ function credentialBundle(token, state, client) {
     token_type: token.tokenType,
     ...token.expiresAt ? { expires_at: token.expiresAt.toISOString() } : {},
     resource: state.resource,
+    mcp_url: state.mcpUrl,
     ...token.scopeText ? { scope: token.scopeText } : state.authorizeScopes.length ? { scope: state.authorizeScopes.join(" ") } : {},
     token_endpoint: state.tokenEndpoint,
     client_id: client.clientId,
@@ -2956,6 +3079,22 @@ function canonicalMcpResource(value) {
   url.hash = "";
   return url.toString();
 }
+function canonicalOAuthResource(value) {
+  const trimmed = value.trim();
+  if (!trimmed) {
+    throw new HTTPException6(422, { message: "MCP protected resource metadata advertised an invalid resource" });
+  }
+  try {
+    const url = new URL(trimmed);
+    if (url.protocol === "http:" || url.protocol === "https:") {
+      url.hash = "";
+      return url.toString();
+    }
+    return trimmed;
+  } catch {
+    throw new HTTPException6(422, { message: "MCP protected resource metadata advertised an invalid resource" });
+  }
+}
 function safeReturnPath(value) {
   if (!value.startsWith("/") || value.startsWith("//")) {
     throw new HTTPException6(400, { message: "OAuth returnPath must be a relative path" });
@@ -3117,7 +3256,7 @@ function requiredString(value, field) {
 
 // src/routes/connections.ts
 function registerConnectionRoutes(app, deps) {
-  const { db, settings } = deps;
+  const { db, settings, observability } = deps;
   function assertIntegrationsEnabled() {
     if (!settings.integrationsEnabled) {
       throw new HTTPException7(404, { message: "integrations are not enabled for this deployment" });
@@ -3210,7 +3349,7 @@ function registerConnectionRoutes(app, deps) {
       throw new HTTPException7(400, { message: parsed.error.issues[0]?.message ?? "invalid OAuth start request" });
     }
     const payload = parsed.data;
-    const result = await startMcpOAuth({ db, settings }, {
+    const result = await startMcpOAuth({ db, settings, observability }, {
       accountId: grant.accountId,
       workspaceId,
       subjectId: grant.subjectId,
@@ -3221,7 +3360,7 @@ function registerConnectionRoutes(app, deps) {
   });
   app.get("/v1/integrations/oauth/callback", async (c) => {
     assertIntegrationsEnabled();
-    const result = await completeMcpOAuthCallback({ db, settings }, {
+    const result = await completeMcpOAuthCallback({ db, settings, observability }, {
       code: c.req.query("code"),
       state: c.req.query("state"),
       requestUrl: c.req.url
@@ -8096,4 +8235,4 @@ export {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession3 as workflowIdForSession
 };
-//# sourceMappingURL=chunk-YY6OAEL6.js.map
+//# sourceMappingURL=chunk-3HIA43CC.js.map