@openparachute/hub 0.7.4-rc.20 → 0.7.4-rc.22

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openparachute/hub",
-  "version": "0.7.4-rc.20",
+  "version": "0.7.4-rc.22",
   "description": "parachute — the local hub for the Parachute ecosystem (discovery, ports, lifecycle, soon OAuth).",
   "license": "AGPL-3.0",
   "publishConfig": {

package/src/__tests__/admin-auth.test.ts

@@ -172,6 +172,134 @@ describe("requireScope", () => {
   });
 });
 
+describe("requireScope multi-origin issuer set (hub#516 parity)", () => {
+  // The hub answers on several legitimate origins after `parachute hub
+  // set-origin` / `expose` (loopback ∪ tunnel ∪ public). A credential minted
+  // under a still-valid prior origin must keep validating at admin-auth even
+  // when the per-request canonical issuer is now a different member of the set.
+  const LOOPBACK = "http://127.0.0.1:1939";
+  const TUNNEL = "https://brain.gitcoin.co";
+  const FOREIGN = "https://evil.example.com";
+
+  test("accepts a token whose iss is in the set but ≠ the per-request canonical", async () => {
+    const h = makeHarness();
+    try {
+      const db = openHubDb(hubDbPath(h.dir));
+      try {
+        rotateSigningKey(db);
+        // Token minted under the TUNNEL origin (e.g. before `set-origin`)…
+        const token = await mintToken(db, ["parachute:host:admin"], { issuer: TUNNEL });
+        // …presented to admin-auth where the canonical per-request issuer is now
+        // LOOPBACK, but the bound-origin set still includes TUNNEL.
+        const ctx = await requireScope(db, reqWithAuth(`Bearer ${token}`), "parachute:host:admin", [
+          LOOPBACK,
+          TUNNEL,
+        ]);
+        expect(ctx.sub).toBe("user-test");
+        expect(ctx.scopes).toContain("parachute:host:admin");
+      } finally {
+        db.close();
+      }
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("rejects 401 when iss is OUTSIDE the set", async () => {
+    const h = makeHarness();
+    try {
+      const db = openHubDb(hubDbPath(h.dir));
+      try {
+        rotateSigningKey(db);
+        const token = await mintToken(db, ["parachute:host:admin"], { issuer: FOREIGN });
+        let caught: AdminAuthError | null = null;
+        try {
+          await requireScope(db, reqWithAuth(`Bearer ${token}`), "parachute:host:admin", [
+            LOOPBACK,
+            TUNNEL,
+          ]);
+        } catch (err) {
+          caught = err as AdminAuthError;
+        }
+        expect(caught?.status).toBe(401);
+      } finally {
+        db.close();
+      }
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("rejects 401 on signature failure regardless of the set (signature-first)", async () => {
+    const h = makeHarness();
+    try {
+      const db = openHubDb(hubDbPath(h.dir));
+      try {
+        rotateSigningKey(db);
+        // A hub-signed token, then rotate keys + retire so the original kid no
+        // longer verifies — the JWKS signature gate must fire before any iss
+        // membership check, so an in-set iss can't rescue an unverifiable token.
+        let caught: AdminAuthError | null = null;
+        try {
+          await requireScope(db, reqWithAuth("Bearer not-a-real-jwt"), "parachute:host:admin", [
+            LOOPBACK,
+            TUNNEL,
+          ]);
+        } catch (err) {
+          caught = err as AdminAuthError;
+        }
+        expect(caught?.status).toBe(401);
+      } finally {
+        db.close();
+      }
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("single-string back-compat: in-set iss as a lone string still validates", async () => {
+    const h = makeHarness();
+    try {
+      const db = openHubDb(hubDbPath(h.dir));
+      try {
+        rotateSigningKey(db);
+        const token = await mintToken(db, ["parachute:host:admin"], { issuer: ISSUER });
+        // A single-element set behaves exactly like the prior single-string form.
+        const ctx = await requireScope(db, reqWithAuth(`Bearer ${token}`), "parachute:host:admin", [
+          ISSUER,
+        ]);
+        expect(ctx.sub).toBe("user-test");
+      } finally {
+        db.close();
+      }
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("single-element set rejects a non-matching iss (no accidental widening)", async () => {
+    const h = makeHarness();
+    try {
+      const db = openHubDb(hubDbPath(h.dir));
+      try {
+        rotateSigningKey(db);
+        const token = await mintToken(db, ["parachute:host:admin"], { issuer: TUNNEL });
+        let caught: AdminAuthError | null = null;
+        try {
+          await requireScope(db, reqWithAuth(`Bearer ${token}`), "parachute:host:admin", [ISSUER]);
+        } catch (err) {
+          caught = err as AdminAuthError;
+        }
+        expect(caught?.status).toBe(401);
+      } finally {
+        db.close();
+      }
+    } finally {
+      h.cleanup();
+    }
+  });
+});
+
 describe("adminAuthErrorResponse", () => {
   test("403 → insufficient_scope with WWW-Authenticate", async () => {
     const res = adminAuthErrorResponse(new AdminAuthError(403, "needs admin"));

package/src/__tests__/admin-handlers.test.ts

@@ -8,6 +8,7 @@ import {
   handleAdminLoginPost,
   handleAdminLogoutPost,
 } from "../admin-handlers.ts";
+import { _resetUnlockStateForTest, requireUnlocked, setPin } from "../admin-lock.ts";
 import { CSRF_COOKIE_NAME, CSRF_FIELD_NAME } from "../csrf.ts";
 import { hubDbPath, openHubDb } from "../hub-db.ts";
 import { __resetForTests as resetRateLimit } from "../rate-limit.ts";
@@ -169,6 +170,33 @@ describe("handleAdminLoginPost", () => {
     expect(res.headers.get("set-cookie") ?? "").toContain("parachute_hub_session=");
   });
 
+  test("Fix B: a fresh login with a PIN configured records an unlock (no immediate lock)", async () => {
+    // The admin-lock PIN guards the idle/grabbed tab — NOT the instant after a
+    // full login. The operator just proved their password; re-gating on the PIN
+    // the moment after is pure friction. A freshly-minted session must land
+    // within an unlock window so the SPA doesn't show the lock screen.
+    _resetUnlockStateForTest();
+    await createUser(harness.db, "admin", "pw", { passwordChanged: true });
+    await setPin(harness.db, "4827"); // lock feature ON
+    const { body, headers } = formBody({
+      [CSRF_FIELD_NAME]: TEST_CSRF,
+      username: "admin",
+      password: "pw",
+      next: "/admin/permissions",
+    });
+    const req = new Request("http://hub.test/admin/login", {
+      method: "POST",
+      headers: { ...headers, cookie: CSRF_COOKIE },
+      body,
+    });
+    const res = await handleAdminLoginPost(harness.db, req);
+    expect(res.status).toBe(302);
+    const sid = (res.headers.get("set-cookie") ?? "").match(/parachute_hub_session=([^;]+)/)?.[1];
+    expect(sid?.length).toBeTruthy();
+    // The just-minted session is unlocked — recordLoginUnlock ran during login.
+    expect(requireUnlocked(harness.db, sid ?? "").ok).toBe(true);
+  });
+
   test("ignores an absolute-URL next= from the form", async () => {
     await createUser(harness.db, "admin", "pw", { passwordChanged: true });
     const { body, headers } = formBody({

package/src/__tests__/admin-host-admin-token.test.ts

@@ -18,7 +18,13 @@ import { HOST_ADMIN_TOKEN_TTL_SECONDS, handleHostAdminToken } from "../admin-hos
 import { handleApiTokens } from "../api-tokens.ts";
 import { hubDbPath, openHubDb } from "../hub-db.ts";
 import { validateAccessToken } from "../jwt-sign.ts";
-import { SESSION_TTL_MS, buildSessionCookie, createSession, deleteSession } from "../sessions.ts";
+import {
+  SESSION_TTL_MS,
+  buildSessionCookie,
+  createSession,
+  deleteSession,
+  findSession,
+} from "../sessions.ts";
 import { rotateSigningKey } from "../signing-keys.ts";
 import { createUser } from "../users.ts";
 
@@ -186,6 +192,57 @@ describe("handleHostAdminToken", () => {
     expect(validated.payload.sub).toBe(adminId);
   });
 
+  // Sliding session renewal (Fix A) — a successful mint pushes the session's
+  // expiry forward and re-issues the cookie, so an active operator (the SPA
+  // re-mints ~every 10 min) isn't hard-logged-out at the 24h mark. The cookie
+  // must keep the EXACT attributes creation uses — not broadened.
+  test("200 renews the session cookie (HttpOnly/Secure/SameSite/host-only) and slides expiry", async () => {
+    const user = await createUser(harness.db, "operator", "hunter2");
+    // Create the session 12h in the past so the forward slide is observable.
+    const twelveHoursAgo = new Date(Date.now() - 12 * 60 * 60 * 1000);
+    const session = createSession(harness.db, { userId: user.id, now: () => twelveHoursAgo });
+    const originalExpiry = new Date(session.expiresAt).getTime();
+    const cookie = buildSessionCookie(session.id, Math.floor(SESSION_TTL_MS / 1000));
+    rotateSigningKey(harness.db);
+
+    const res = await handleHostAdminToken(
+      new Request(`${ISSUER}/admin/host-admin-token`, { headers: { cookie } }),
+      { db: harness.db, issuer: ISSUER },
+    );
+    expect(res.status).toBe(200);
+
+    const setCookie = res.headers.get("set-cookie") ?? "";
+    expect(setCookie).toContain("parachute_hub_session=");
+    expect(setCookie).toContain("HttpOnly");
+    expect(setCookie).toContain("Secure"); // ISSUER is https → Secure kept
+    expect(setCookie).toContain("SameSite=Lax");
+    expect(setCookie).toContain("Path=/");
+    expect(setCookie).not.toContain("Path=/oauth");
+    // Host-only: the renewed cookie must NOT add a Domain (no broadening).
+    expect(setCookie.toLowerCase()).not.toContain("domain=");
+
+    // The session's expiry slid forward (touchSession ran on the success path).
+    const found = findSession(harness.db, session.id);
+    expect(new Date(found?.expiresAt ?? 0).getTime()).toBeGreaterThan(originalExpiry);
+  });
+
+  test("renewed cookie omits Secure over plain HTTP (protocol-correct, not broadened)", async () => {
+    const { cookie } = await withSession();
+    rotateSigningKey(harness.db);
+    // HTTP origin → isHttpsRequest false → no Secure, so the browser keeps the
+    // cookie on http://localhost:1939 — mirrors how the session cookie is minted.
+    const res = await handleHostAdminToken(
+      new Request("http://hub.test/admin/host-admin-token", { headers: { cookie } }),
+      { db: harness.db, issuer: ISSUER },
+    );
+    expect(res.status).toBe(200);
+    const setCookie = res.headers.get("set-cookie") ?? "";
+    expect(setCookie).toContain("parachute_hub_session=");
+    expect(setCookie).not.toContain("Secure");
+    expect(setCookie).toContain("HttpOnly");
+    expect(setCookie).toContain("SameSite=Lax");
+  });
+
   // Regression for the end-to-end bug that motivated adding `:host:auth`
   // here: the SPA's session-bearer was rejected by `/api/auth/tokens` (and
   // its peers) because it carried `:host:admin` only. This test mints

package/src/__tests__/admin-lock.test.ts

@@ -30,6 +30,7 @@ import {
   getIdleSeconds,
   isLockConfigured,
   isSessionUnlocked,
+  recordLoginUnlock,
   recordUnlock,
   refreshActivity,
   requireUnlocked,
@@ -212,6 +213,31 @@ describe("requireUnlocked gate", () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// recordLoginUnlock (Fix B) — unlock at the auth boundary so a fresh login
+// doesn't immediately hit the PIN lock screen.
+// ---------------------------------------------------------------------------
+
+describe("recordLoginUnlock", () => {
+  test("opens an unlock window when a PIN is configured", async () => {
+    await setPin(harness.db, "4827");
+    // A fresh session with a PIN set but no unlock is locked.
+    expect(requireUnlocked(harness.db, "sid-login").ok).toBe(false);
+    recordLoginUnlock(harness.db, "sid-login");
+    // After login → the freshly-authenticated session is unlocked.
+    expect(requireUnlocked(harness.db, "sid-login").ok).toBe(true);
+    expect(isSessionUnlocked("sid-login")).toBe(true);
+  });
+
+  test("no-op when the lock feature is OFF (no PIN) — records nothing", () => {
+    // Feature off → requireUnlocked is always ok anyway; the helper must not
+    // record a spurious window (meaningless, and would grow the map).
+    recordLoginUnlock(harness.db, "sid-no-pin");
+    expect(isSessionUnlocked("sid-no-pin")).toBe(false);
+    expect(requireUnlocked(harness.db, "sid-no-pin").ok).toBe(true);
+  });
+});
+
 // ---------------------------------------------------------------------------
 // The cascade: a locked session refuses ALL four admin-token mints.
 // ---------------------------------------------------------------------------

package/src/__tests__/api-mint-token.test.ts

@@ -172,6 +172,81 @@ describe("POST /api/auth/mint-token (hub#212 Phase 1)", () => {
     }
   });
 
+  // hub#516 parity — the live "mint refused" after `parachute hub set-origin`.
+  // An operator/agent credential minted under a PRIOR origin (still a member of
+  // the hub's bound-origin set) must keep minting after the canonical issuer
+  // switches; the minted token still carries the new canonical issuer.
+  describe("multi-origin issuer set (set-origin parity)", () => {
+    const TUNNEL = "https://brain.gitcoin.co";
+
+    test("mints when the bearer's iss is in knownIssuers but ≠ the canonical issuer", async () => {
+      const h = makeHarness();
+      try {
+        const { db, userId } = await bootstrap(h.dir);
+        try {
+          // Operator token minted under the TUNNEL origin (pre-`set-origin`).
+          const op = await mintOperatorToken(db, userId, { issuer: TUNNEL });
+          const resp = await handleApiMintToken(
+            jsonRequest(
+              { scope: "scribe:transcribe", expires_in: 3600 },
+              { authorization: `Bearer ${op.token}` },
+            ),
+            // Canonical issuer is now ISSUER (loopback), but the bound set still
+            // includes TUNNEL — the still-valid prior origin.
+            { db, issuer: ISSUER, knownIssuers: [ISSUER, TUNNEL] },
+          );
+          expect(resp.status).toBe(200);
+          const body = (await resp.json()) as { token: string };
+          // The MINTED token carries the canonical issuer, not the bearer's.
+          const validated = await validateAccessToken(db, body.token, ISSUER);
+          expect(validated.payload.iss).toBe(ISSUER);
+        } finally {
+          db.close();
+        }
+      } finally {
+        h.cleanup();
+      }
+    });
+
+    test("rejects 401 when the bearer's iss is OUTSIDE knownIssuers", async () => {
+      const h = makeHarness();
+      try {
+        const { db, userId } = await bootstrap(h.dir);
+        try {
+          const op = await mintOperatorToken(db, userId, { issuer: "https://evil.example.com" });
+          const resp = await handleApiMintToken(
+            jsonRequest({ scope: "scribe:transcribe" }, { authorization: `Bearer ${op.token}` }),
+            { db, issuer: ISSUER, knownIssuers: [ISSUER, TUNNEL] },
+          );
+          expect(resp.status).toBe(401);
+        } finally {
+          db.close();
+        }
+      } finally {
+        h.cleanup();
+      }
+    });
+
+    test("back-compat: without knownIssuers, a non-canonical iss is still rejected", async () => {
+      const h = makeHarness();
+      try {
+        const { db, userId } = await bootstrap(h.dir);
+        try {
+          const op = await mintOperatorToken(db, userId, { issuer: TUNNEL });
+          const resp = await handleApiMintToken(
+            jsonRequest({ scope: "scribe:transcribe" }, { authorization: `Bearer ${op.token}` }),
+            { db, issuer: ISSUER }, // no knownIssuers → falls back to [ISSUER]
+          );
+          expect(resp.status).toBe(401);
+        } finally {
+          db.close();
+        }
+      } finally {
+        h.cleanup();
+      }
+    });
+  });
+
   test("happy path: --scope-set=auth narrow operator token also passes the scope gate", async () => {
     const h = makeHarness();
     try {

package/src/__tests__/jwt-sign.test.ts

@@ -370,6 +370,33 @@ describe("validateAccessToken", () => {
     }
   });
 
+  test("expectedIssuer accepts a SET — iss in the set validates, outside rejects", async () => {
+    const { db, cleanup } = makeDb();
+    try {
+      const { token } = await signAccessToken(db, {
+        sub: "u",
+        scopes: ["s"],
+        audience: "operator",
+        clientId: "c",
+        issuer: "https://tunnel.example",
+      });
+      // In-set (≠ first element) validates — additive membership on iss.
+      const { payload } = await validateAccessToken(db, token, [
+        "http://127.0.0.1:1939",
+        "https://tunnel.example",
+      ]);
+      expect(payload.iss).toBe("https://tunnel.example");
+      // Outside the set rejects.
+      await expect(
+        validateAccessToken(db, token, ["http://127.0.0.1:1939", "https://other.example"]),
+      ).rejects.toThrow();
+      // A single-element set that doesn't match also rejects (no widening).
+      await expect(validateAccessToken(db, token, ["http://127.0.0.1:1939"])).rejects.toThrow();
+    } finally {
+      cleanup();
+    }
+  });
+
   test("verifies a token signed by a recently-retired key (rotation tolerance)", async () => {
     const { db, cleanup } = makeDb();
     try {

package/src/__tests__/oauth-handlers.test.ts

@@ -119,7 +119,9 @@ describe("authorizationServerMetadata", () => {
     expect(scopesSupported).toContain("vault:read");
     expect(scopesSupported).toContain("vault:admin");
     expect(scopesSupported).toContain("scribe:transcribe"); // scribe is in the fixture manifest
-    expect(scopesSupported).toContain("hub:admin");
+    // hub:admin + scribe:admin are operator-only (non-requestable) — never advertised (2026-06-30)
+    expect(scopesSupported).not.toContain("hub:admin");
+    expect(scopesSupported).not.toContain("scribe:admin");
     // agent isn't in the fixture manifest → its scopes aren't advertised
     // (hub#…: optional-module scopes only surface when the module is installed).
     expect(scopesSupported).not.toContain("agent:send");
@@ -169,9 +171,10 @@ describe("authorizationServerMetadata", () => {
     // First-party still advertised — no regression
     expect(scopesSupported).toContain("vault:read");
     expect(scopesSupported).toContain("vault:admin");
-    expect(scopesSupported).toContain("hub:admin");
-    // NON_REQUESTABLE filter still applies even when the scope is declared
+    // NON_REQUESTABLE filter applies even when the scope is declared:
+    // host-* AND the service-admin scopes (hub:admin/scribe:admin) are filtered.
     expect(scopesSupported).not.toContain("parachute:host:admin");
+    expect(scopesSupported).not.toContain("hub:admin");
   });
 
   test("advertises an optional module's scopes only when it's installed", async () => {
@@ -209,7 +212,8 @@ describe("authorizationServerMetadata", () => {
     // core scopes survive
     expect(scopes).toContain("vault:read");
     expect(scopes).toContain("vault:admin");
-    expect(scopes).toContain("hub:admin");
+    // hub:admin is operator-only (non-requestable) — never advertised
+    expect(scopes).not.toContain("hub:admin");
     // uninstalled optional-module scopes are dropped
     expect(scopes).not.toContain("scribe:transcribe");
     expect(scopes).not.toContain("scribe:admin");
@@ -241,6 +245,10 @@ describe("authorizationServerMetadata", () => {
     });
     const scopes2 = ((await res2.json()) as Record<string, unknown>).scopes_supported as string[];
     expect(scopes2).toContain("scribe:transcribe");
+    // scribe:admin stays dropped EVEN WITH scribe installed — proving it's the
+    // requestability gate (non-requestable, 2026-06-30) doing the work here, not
+    // the optional-module-not-installed gate that drops scribe:transcribe above.
+    expect(scopes2).not.toContain("scribe:admin");
     expect(scopes2).not.toContain("agent:send"); // agent still not installed
   });
 });
@@ -7366,12 +7374,12 @@ describe("DCR same-hub auto-trust (hub#312)", () => {
     }
   });
 
-  test("authorize: same_hub=true + admin scope → consent screen (high-power sanity gate)", async () => {
-    // hub:admin is requestable via DCR (only `parachute:host:admin` and
-    // per-vault `vault:*:admin` are non-requestable). For same-hub
-    // clients we DO still show consent on admin scopes — the operator
-    // who registered the client may not want to grant their own session
-    // hub-wide admin access without an explicit click.
+  test("authorize: same_hub=true + hub:admin → invalid_scope (operator-only, even for same-hub) (2026-06-30)", async () => {
+    // hub:admin is now non-requestable via /oauth/authorize (a vault MCP
+    // connector pointed at the hub-level AS would otherwise be offered
+    // hub-wide admin). Even a trusted same-hub client with an owner session
+    // is rejected with invalid_scope — fails closed before consent. The
+    // legit hub-admin paths are operator-bearer/session, not authorize-flow.
     const { db, cleanup } = await makeDb();
     try {
       const user = await createUser(db, "owner", "pw");
@@ -7390,24 +7398,24 @@ describe("DCR same-hub auto-trust (hub#312)", () => {
           scope: "hub:admin",
           code_challenge: challenge,
           code_challenge_method: "S256",
+          state: "abc",
         }),
         { headers: { cookie: buildSessionCookie(session.id, SESSION_COOKIE_TTL_S) } },
       );
       const res = handleAuthorizeGet(db, req, { issuer: ISSUER });
-      // Consent rendered, not silent-approve.
-      expect(res.status).toBe(200);
-      expect(res.headers.get("content-type")).toContain("text/html");
-      const html = await res.text();
-      expect(html).toContain("hub:admin");
+      expect(res.status).toBe(302);
+      const loc = new URL(res.headers.get("location") ?? "");
+      expect(loc.searchParams.get("error")).toBe("invalid_scope");
+      expect(loc.searchParams.get("error_description")).toContain("hub:admin");
     } finally {
       cleanup();
     }
   });
 
-  test("authorize: same_hub=true + mixed admin+non-admin → consent screen (any admin scope shows consent)", async () => {
-    // Defensive: a request asking for `vault:default:read hub:admin` must
-    // NOT silent-approve on the strength of the non-admin scope. Any
-    // admin scope present forces consent.
+  test("authorize: same_hub=true + mixed vault + hub:admin → invalid_scope (a non-requestable scope rejects the whole request) (2026-06-30)", async () => {
+    // A request mixing a requestable scope with hub:admin must NOT slip the
+    // non-requestable scope through on the strength of the others — the whole
+    // request is rejected with invalid_scope (same as parachute:host:admin).
     const { db, cleanup } = await makeDb();
     try {
       const user = await createUser(db, "owner", "pw");
@@ -7426,12 +7434,52 @@ describe("DCR same-hub auto-trust (hub#312)", () => {
           scope: "vault:default:read hub:admin",
           code_challenge: challenge,
           code_challenge_method: "S256",
+          state: "abc",
         }),
         { headers: { cookie: buildSessionCookie(session.id, SESSION_COOKIE_TTL_S) } },
       );
       const res = handleAuthorizeGet(db, req, { issuer: ISSUER });
-      expect(res.status).toBe(200);
-      expect(res.headers.get("content-type")).toContain("text/html");
+      expect(res.status).toBe(302);
+      const loc = new URL(res.headers.get("location") ?? "");
+      expect(loc.searchParams.get("error")).toBe("invalid_scope");
+      expect(loc.searchParams.get("error_description")).toContain("hub:admin");
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("authorize: explicit scribe:admin → invalid_scope (service-admin, operator-only) (2026-06-30)", async () => {
+    // Symmetry with hub:admin: the other service-admin scope is non-requestable
+    // too. Scribe's admin UI gets scribe:admin via the cookie-gated
+    // /admin/module-token/scribe path, never /oauth/authorize — so rejecting it
+    // here breaks no first-party path.
+    const { db, cleanup } = await makeDb();
+    try {
+      const user = await createUser(db, "owner", "pw");
+      const session = createSession(db, { userId: user.id });
+      const reg = registerClient(db, {
+        redirectUris: ["https://app.example/cb"],
+        status: "approved",
+        sameHub: true,
+      });
+      const { challenge } = makePkce();
+      const req = new Request(
+        authorizeUrl({
+          client_id: reg.client.clientId,
+          redirect_uri: "https://app.example/cb",
+          response_type: "code",
+          scope: "scribe:admin",
+          code_challenge: challenge,
+          code_challenge_method: "S256",
+          state: "abc",
+        }),
+        { headers: { cookie: buildSessionCookie(session.id, SESSION_COOKIE_TTL_S) } },
+      );
+      const res = handleAuthorizeGet(db, req, { issuer: ISSUER });
+      expect(res.status).toBe(302);
+      const loc = new URL(res.headers.get("location") ?? "");
+      expect(loc.searchParams.get("error")).toBe("invalid_scope");
+      expect(loc.searchParams.get("error_description")).toContain("scribe:admin");
     } finally {
       cleanup();
     }

package/src/__tests__/scope-explanations.test.ts

@@ -129,11 +129,15 @@ describe("NON_REQUESTABLE_SCOPES (#96)", () => {
     expect(NON_REQUESTABLE_SCOPES.has("parachute:host:admin")).toBe(true);
   });
 
-  test("does NOT contain hub:admin (intentional asymmetry)", () => {
-    // hub:admin is service management an operator may legitimately delegate
-    // to a tooling app. parachute:host:admin is cross-vault data sovereignty
-    // and stays operator-only-mintable.
-    expect(NON_REQUESTABLE_SCOPES.has("hub:admin")).toBe(false);
+  test("contains the service-admin scopes hub:admin and scribe:admin (2026-06-30 over-permissioning fix)", () => {
+    // A vault MCP connector (e.g. Claude) is pointed at the hub-level AS by the
+    // vault's protected-resource metadata, so hub:admin/scribe:admin would be
+    // advertised on its consent screen + minted if approved — wildly
+    // over-privileged for a vault reader. Every legit use is operator-bearer /
+    // session (operator token, DCR self-registration, admin SPA), never
+    // /oauth/authorize — so these fail closed without breaking operator paths.
+    expect(NON_REQUESTABLE_SCOPES.has("hub:admin")).toBe(true);
+    expect(NON_REQUESTABLE_SCOPES.has("scribe:admin")).toBe(true);
   });
 
   test("every non-requestable scope is a known first-party scope", () => {
@@ -148,11 +152,16 @@ describe("isRequestableScope", () => {
     expect(isRequestableScope("parachute:host:admin")).toBe(false);
   });
 
-  test("true for hub:admin and other first-party scopes", () => {
-    expect(isRequestableScope("hub:admin")).toBe(true);
+  test("false for service-admin scopes hub:admin and scribe:admin (operator-only, 2026-06-30)", () => {
+    expect(isRequestableScope("hub:admin")).toBe(false);
+    expect(isRequestableScope("scribe:admin")).toBe(false);
+  });
+
+  test("true for non-admin first-party scopes", () => {
     expect(isRequestableScope("vault:read")).toBe(true);
     expect(isRequestableScope("vault:admin")).toBe(true);
     expect(isRequestableScope("agent:send")).toBe(true);
+    expect(isRequestableScope("scribe:transcribe")).toBe(true);
   });
 
   test("true for unknown scopes (third-party module scopes pass through)", () => {
@@ -194,8 +203,10 @@ describe("isRequestableScope", () => {
     expect(isNonRequestableScope("parachute:Host:Install")).toBe(true);
     // Canonical lowercase still works unchanged.
     expect(isNonRequestableScope("parachute:host:auth")).toBe(true);
-    // A non-host scope (even uppercased) stays requestable.
-    expect(isNonRequestableScope("HUB:ADMIN")).toBe(false);
+    // Service-admin scopes are non-requestable too, case-insensitively (2026-06-30).
+    expect(isNonRequestableScope("HUB:ADMIN")).toBe(true);
+    // A genuinely requestable scope (even uppercased) stays requestable.
+    expect(isNonRequestableScope("VAULT:READ")).toBe(false);
   });
 });