@openwop/openwop-conformance 2.35.0 → 2.36.0

package/src/scenarios/v2-oauth-client-pkce-state-iss.test.ts

@@ -0,0 +1,203 @@
+/**
+ * RFC 0199 §A — the host as an OAuth authorization-code client
+ * (`spec/v2/core/oauth.md` §The authorization-code client). Target major 2.
+ *
+ * Gate: the v2 `oauth` record lists `authorization_code` and advertises the
+ * provider `synthetic`, and the host advertises the seams profile. The grant is
+ * driven through `POST /conformance/seams/sample/oauth/authorize-start`
+ * (api/seams-v2.yaml), which points the provider at the suite's
+ * authorization-server double and returns the URL the host's PRODUCTION
+ * authorization-URL builder produced; the suite then plays the user agent
+ * against the double and against the host's PRODUCTION callback. A seam that
+ * answers 404 is `blocked`, never a pass.
+ *
+ * The witness is the double's token-request counter (`lib/oauth-as-double.ts`):
+ * every "the host refused the callback" leg asserts ZERO new token requests at
+ * a server the suite owns, and each carries a positive control that the same
+ * path, unaltered, does make one — so a host that refuses everything fails too.
+ *
+ * Reachability: the host must reach the double. Front it with a public https
+ * tunnel (`OPENWOP_OAUTH_AS_URL`), or the host must relax its egress guard for
+ * loopback, which a bundle records as a relaxation.
+ *
+ * @see spec/v2/core/oauth.md §The authorization-code client
+ * @see RFCS/0199-outbound-oauth-client-and-credential-interrupt.md §A
+ * @see SECURITY/invariants.yaml id: oauth-same-user-binding
+ */
+import { describe, it, expect, afterAll } from 'vitest';
+import { randomBytes } from 'node:crypto';
+import { loadEnv } from '../lib/env.js';
+import { softSkip, seamAbsent } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+import { S256, authorizeStart, authorizationUrlOf, consent, oauthGate, secondSubject, startAsDouble, userAgentGet, type AsDouble } from '../lib/oauth-as-double.js';
+
+export const HOST_CALLBACK_NOT_REQUIRED = 'the suite plays the user agent: it reads the authorization URL from the authorize-start seam, consents at its own authorization-server double, and GETs the host\'s callback itself; the double is the only fixture the host reaches';
+
+const DOC = 'spec/v2/core/oauth.md §The authorization-code client (RFC 0199 §A)';
+const R = (slug: string): string => `openwop.requirement.0199.${slug}`;
+const PROVIDER = 'synthetic';
+const ISSUERLESS = ['synthetic-noiss', 'synthetic-noiss-b'];
+const SCOPES = ['openwop.read'];
+
+let double: AsDouble | null = null;
+async function as(): Promise<AsDouble> { double ??= await startAsDouble(); return double; }
+afterAll(async () => { await double?.close(); double = null; });
+
+type Ready = { ok: true; d: AsDouble } | { ok: false; skip: () => undefined };
+async function ready(providers: string[] = [PROVIDER]): Promise<Ready> {
+  const g = await oauthGate();
+  if (!g.ok) return { ok: false, skip: () => softSkip(g.kind, g.reason) };
+  const missing = providers.filter((p) => !g.providers.has(p));
+  if (missing.length > 0) return { ok: false, skip: () => softSkip('blocked', `oauth.providers does not list ${missing.join(', ')} — the suite's synthetic provider(s) (conformance/fixtures/oauth-providers/synthetic.json)`) };
+  return { ok: true, d: await as() };
+}
+
+const withIssuer = (d: AsDouble, extra: Record<string, unknown> = {}): Record<string, unknown> => ({ provider: PROVIDER, authUrl: d.authorizeUrl, tokenUrl: d.tokenUrl, issuer: d.issuer, scopes: SCOPES, ...extra });
+
+/** authorize-start → the authorization URL, or a recorded skip/fail. */
+async function start(body: Record<string, unknown>, id: string, bearer?: string): Promise<URL | 'absent'> {
+  const r = await authorizeStart(body, bearer);
+  if (r.status === 404 || r.status === 405) return 'absent';
+  const url = authorizationUrlOf(r);
+  expect(url, req(id, 'api/seams-v2.yaml startOAuthAuthorization', `authorize-start MUST answer 201 { authorizationUrl } for an advertised provider (got ${r.status} ${r.text.slice(0, 300)})`)).not.toBeNull();
+  return url as URL;
+}
+
+describe('RFC 0199 §A — v2-oauth-client-pkce-state-iss (host as OAuth client, gated on oauth + authorization_code + seams)', () => {
+  it('sends PKCE S256 and the verifier at the token endpoint hashes to the challenge', async () => {
+    const r = await ready();
+    if (!r.ok) return r.skip();
+    const { d } = r;
+    const id = R('pkce-s256');
+    const url = await start(withIssuer(d), id);
+    if (url === 'absent') return seamAbsent('POST /conformance/seams/sample/oauth/authorize-start is not mounted — the grant cannot be driven against the suite\'s double');
+    expect(`${url.origin}${url.pathname}`, req(id, DOC, 'the authorization URL MUST be the provider\'s authorization endpoint (the double\'s)')).toBe(d.authorizeUrl);
+    expect(url.searchParams.get('code_challenge_method'), req(id, `${DOC} rule 1`, `PKCE MUST use S256, never plain (got ${url.searchParams.get('code_challenge_method')})`)).toBe('S256');
+    const challenge = url.searchParams.get('code_challenge') ?? '';
+    expect(/^[A-Za-z0-9_-]{43}$/.test(challenge), req(id, `${DOC} rule 1; RFC 7636 §4.2`, `code_challenge MUST be BASE64URL(SHA256(verifier)) — 43 characters (got ${JSON.stringify(challenge)})`)).toBe(true);
+    const callback = await consent(url.toString());
+    expect(callback, req(id, DOC, 'the double answers the authorization request with a redirect to the host\'s redirect URI')).not.toBeNull();
+    const before = d.codeExchanges().length;
+    const cb = await userAgentGet(callback!, loadEnv().apiKey);
+    expect(cb.status, req(id, DOC, `positive control: the unaltered callback, authenticated as the initiating Subject, MUST complete (got ${cb.status} ${cb.text.slice(0, 200)})`)).toBeLessThan(400);
+    const exchanges = d.codeExchanges().slice(before);
+    expect(exchanges.length, req(id, DOC, 'the completed callback makes exactly one token request at the provider')).toBe(1);
+    const verifier = exchanges[0]!.params['code_verifier'] ?? '';
+    expect(verifier.length >= 43 && S256(verifier) === challenge, req(id, `${DOC} rule 1; RFC 7636 §4.6`, 'the code_verifier sent to the token endpoint MUST hash (S256) to the challenge sent in the authorization request')).toBe(true);
+    expect(exchanges[0]!.status, req(id, DOC, `the double accepted the exchange (${exchanges[0]!.refused ?? 'ok'})`)).toBe(200);
+  });
+
+  it('sends a fresh state per grant, and a forged, missing or replayed state makes no token request', async () => {
+    const r = await ready();
+    if (!r.ok) return r.skip();
+    const { d } = r;
+    const id = R('state-single-use');
+    const a = await start(withIssuer(d), id);
+    if (a === 'absent') return seamAbsent('authorize-start is not mounted');
+    const b = await start(withIssuer(d), id);
+    if (b === 'absent') return seamAbsent('authorize-start is not mounted');
+    const sa = a.searchParams.get('state') ?? ''; const sb = b.searchParams.get('state') ?? '';
+    expect(sa.length >= 22 && sb.length >= 22, req(id, `${DOC} rule 2`, `state MUST be present and carry at least 128 bits (got ${sa.length} and ${sb.length} characters)`)).toBe(true);
+    expect(sa, req(id, `${DOC} rule 2`, 'state MUST be fresh for every grant')).not.toBe(sb);
+    const cbA = await consent(a.toString());
+    const cbB = await consent(b.toString());
+    expect(cbA !== null && cbB !== null, req(id, DOC, 'the double redirects both grants to the host')).toBe(true);
+    const key = loadEnv().apiKey;
+
+    const forged = new URL(cbA!.toString()); forged.searchParams.set('state', randomBytes(24).toString('base64url'));
+    let n = d.codeExchanges().length;
+    const f = await userAgentGet(forged, key);
+    expect([f.status >= 400, d.codeExchanges().length], req(id, `${DOC} rule 2`, `a callback whose state is unknown MUST be refused with no token request (got ${f.status}, ${d.codeExchanges().length - n} token request(s))`)).toEqual([true, n]);
+
+    const bare = new URL(cbB!.toString()); bare.searchParams.delete('state');
+    const m = await userAgentGet(bare, key);
+    expect([m.status >= 400, d.codeExchanges().length], req(id, `${DOC} rule 2`, `a callback with no state MUST be refused with no token request (got ${m.status})`)).toEqual([true, n]);
+
+    const ok = await userAgentGet(cbA!, key);
+    expect([ok.status < 400, d.codeExchanges().length], req(id, DOC, `positive control: the genuine callback completes with one token request (got ${ok.status} ${ok.text.slice(0, 200)})`)).toEqual([true, n + 1]);
+    n = d.codeExchanges().length;
+    const replay = await userAgentGet(cbA!, key);
+    expect([replay.status >= 400, d.codeExchanges().length], req(id, `${DOC} rule 2`, `a replayed (already consumed) state MUST be refused with no token request (got ${replay.status})`)).toEqual([true, n]);
+  });
+
+  it('a callback authenticated as another Subject makes no token request and stores nothing', async () => {
+    const r = await ready();
+    if (!r.ok) return r.skip();
+    const { d } = r;
+    const id = R('same-user-callback');
+    const other = await secondSubject();
+    if (other === null) return softSkip('blocked', 'no second Subject: the credential mint seam is not mounted and OPENWOP_TEST_TENANT_B_API_KEY is not set');
+    const url = await start(withIssuer(d), id);
+    if (url === 'absent') return seamAbsent('authorize-start is not mounted');
+    const cb = await consent(url.toString());
+    expect(cb, req(id, DOC, 'the double redirects the grant to the host')).not.toBeNull();
+    const n = d.codeExchanges().length;
+    const wrong = await userAgentGet(cb!, other.bearer);
+    expect([wrong.status >= 400, d.codeExchanges().length], req(id, `${DOC} rule 3; invariant oauth-same-user-binding`, `the callback of Subject A's grant, authenticated as another Subject (${other.how}), MUST be refused and make no token request (got ${wrong.status}, ${d.codeExchanges().length - n} token request(s))`)).toEqual([true, n]);
+    // Positive control on the same path: a grant the second Subject itself started completes for it.
+    const own = await start(withIssuer(d), id, other.bearer);
+    if (own === 'absent') return seamAbsent('authorize-start is not mounted');
+    const ownCb = await consent(own.toString());
+    const done = await userAgentGet(ownCb!, other.bearer);
+    expect([done.status < 400, d.codeExchanges().length], req(id, DOC, `positive control: the second Subject's own grant completes for it with one token request (got ${done.status} ${done.text.slice(0, 200)})`)).toEqual([true, n + 1]);
+  });
+
+  it('a wrong or missing iss (with authorization_response_iss_parameter_supported) makes no token request', async () => {
+    const r = await ready();
+    if (!r.ok) return r.skip();
+    const { d } = r;
+    const id = R('iss-validated');
+    d.issParameterSupported = true;
+    const key = loadEnv().apiKey;
+    const one = await start(withIssuer(d), id);
+    if (one === 'absent') return seamAbsent('authorize-start is not mounted');
+    const cb1 = await consent(one.toString());
+    const wrong = new URL(cb1!.toString()); wrong.searchParams.set('iss', `${d.issuer}/evil`);
+    let n = d.codeExchanges().length;
+    const w = await userAgentGet(wrong, key);
+    expect([w.status >= 400, d.codeExchanges().length], req(id, `${DOC} rule 4; RFC 9207 §2.4`, `a response whose iss differs from the provider's issuer MUST be refused before any token request (got ${w.status})`)).toEqual([true, n]);
+    const two = await start(withIssuer(d), id);
+    if (two === 'absent') return seamAbsent('authorize-start is not mounted');
+    const cb2 = await consent(two.toString());
+    const missing = new URL(cb2!.toString()); missing.searchParams.delete('iss');
+    const m = await userAgentGet(missing, key);
+    expect([m.status >= 400, d.codeExchanges().length], req(id, `${DOC} rule 4; RFC 9207 §2.4`, `a response without iss from a provider whose metadata sets authorization_response_iss_parameter_supported MUST be refused before any token request (got ${m.status})`)).toEqual([true, n]);
+    const three = await start(withIssuer(d), id);
+    if (three === 'absent') return seamAbsent('authorize-start is not mounted');
+    const cb3 = await consent(three.toString());
+    const good = await userAgentGet(cb3!, key);
+    n += 1;
+    expect([good.status < 400, d.codeExchanges().length], req(id, DOC, `positive control: the same grant with the issuer's own iss completes (got ${good.status} ${good.text.slice(0, 200)})`)).toEqual([true, n]);
+  });
+
+  it('issuer-less providers get redirect URIs no other provider shares', async () => {
+    const r = await ready([PROVIDER, ...ISSUERLESS]);
+    if (!r.ok) return r.skip();
+    const { d } = r;
+    const id = R('iss-validated');
+    const uris: string[] = [];
+    for (const provider of [PROVIDER, ...ISSUERLESS]) {
+      const body = provider === PROVIDER ? withIssuer(d) : { provider, authUrl: d.authorizeUrl, tokenUrl: d.tokenUrl, scopes: SCOPES };
+      const url = await start(body, id);
+      if (url === 'absent') return seamAbsent('authorize-start is not mounted');
+      uris.push(url.searchParams.get('redirect_uri') ?? '');
+    }
+    expect(uris.every((u) => u.length > 0), req(id, DOC, 'every authorization URL carries redirect_uri')).toBe(true);
+    expect(new Set(uris).size, req(id, `${DOC} rule 4; RFC 9700 §4.4.2.2`, `a provider with no known issuer MUST get a redirect URI no other provider on the host shares (got ${JSON.stringify(uris)})`)).toBe(uris.length);
+  });
+
+  it('the redirect URI is fixed per provider whatever the request carries', async () => {
+    const r = await ready();
+    if (!r.ok) return r.skip();
+    const { d } = r;
+    const id = R('redirect-uri-fixed');
+    const first = await start(withIssuer(d), id);
+    if (first === 'absent') return seamAbsent('authorize-start is not mounted');
+    const probe = 'https://attacker.example/openwop/oauth/callback';
+    const second = await start(withIssuer(d, { redirectUri: probe }), id);
+    if (second === 'absent') return seamAbsent('authorize-start is not mounted');
+    const a = first.searchParams.get('redirect_uri'); const b = second.searchParams.get('redirect_uri');
+    expect(b, req(id, `${DOC} rule 5`, 'the redirect URI MUST NOT be derived from request input')).not.toBe(probe);
+    expect(b, req(id, `${DOC} rule 5`, `one fixed redirect URI per provider: two grants for one provider carry the same redirect_uri (got ${a} and ${b})`)).toBe(a);
+  });
+});

package/src/scenarios/v2-oauth-mcp-reach-discovery.test.ts

@@ -0,0 +1,186 @@
+/**
+ * RFC 0199 §B / §E.2 — a provider reached as an MCP server
+ * (`spec/v2/core/oauth.md` §The authorization-code client, MCP-reach
+ * paragraph; `connection-packs.md` §Manifest clause 3a). Target major 2.
+ *
+ * Gate: the oauth gate of `lib/oauth-as-double.ts` (oauth + authorization_code
+ * + seams). Each leg hands the host a `reach.mcp` + `oauth2` connection pack
+ * through `authorize-start`'s `connection` member, which the host registers
+ * through its PRODUCTION connection-pack path.
+ *
+ *   - The two host-side refusals (§E.2: no `issuer`; `pkce: "unsupported"`)
+ *     need nothing reachable — the host must refuse before it sends anything —
+ *     so they run on any host.
+ *   - The discovery legs (`resource`, verify-not-select, S256 in metadata,
+ *     pinning) need the suite's authorization-server doubles and its
+ *     protected-resource double reachable over https, because a connection
+ *     pack's endpoints and server URL are `https://` by schema. Without the
+ *     public fronts (`OPENWOP_OAUTH_AS_URL`, `OPENWOP_OAUTH_AS2_URL`,
+ *     `OPENWOP_OAUTH_RESOURCE_URL`) they record `blocked`.
+ *
+ * The witness is the doubles' own counters: a refused discovery shows ZERO
+ * requests at the foreign issuer the PRM named and ZERO token requests.
+ *
+ * @see spec/v2/core/oauth.md §The authorization-code client
+ * @see spec/v1/connection-packs.md §Manifest clause 3a
+ * @see RFCS/0199-outbound-oauth-client-and-credential-interrupt.md §B, §E.2
+ */
+import { describe, it, expect, afterAll } from 'vitest';
+import { randomBytes } from 'node:crypto';
+import { loadEnv } from '../lib/env.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { softSkip, seamAbsent } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+import { v2Validator } from '../lib/v2.js';
+import { authorizeStart, authorizationUrlOf, consent, oauthGate, startAsDouble, startResourceDouble, userAgentGet, type AsDouble, type ResourceDouble } from '../lib/oauth-as-double.js';
+
+export const HOST_CALLBACK_NOT_REQUIRED = 'the suite hands the host a connection pack through authorize-start and plays the user agent; the host reaches only the suite\'s authorization-server and protected-resource doubles';
+
+const DOC = 'spec/v2/core/oauth.md §The authorization-code client (MCP reach; RFC 0199 §B)';
+const R = (slug: string): string => `openwop.requirement.0199.${slug}`;
+const validPack = v2Validator('connection-pack-manifest');
+
+const opened: Array<{ close(): Promise<void> }> = [];
+afterAll(async () => { for (const o of opened.splice(0)) await o.close(); });
+
+function pack(opts: { id: string; serverUrl: string; authorize: string; token: string; issuer?: string; pkce?: string }): Record<string, unknown> {
+  const auth: Record<string, unknown> = { kind: 'oauth2', authFlow: 'pkce', scopeModel: 'coarse', endpoints: { authorize: opts.authorize, token: opts.token } };
+  if (opts.issuer !== undefined) auth['issuer'] = opts.issuer;
+  if (opts.pkce !== undefined) auth['pkce'] = opts.pkce;
+  return {
+    name: `vendor.openwop-conformance.connections.${opts.id}`,
+    version: '1.0.0',
+    kind: 'connection',
+    engines: { openwop: '>=2.0.0' },
+    provider: { id: opts.id, displayName: `Conformance ${opts.id}`, category: 'other', auth, reach: { mcp: { server: { url: opts.serverUrl, transport: 'http' } } } },
+  };
+}
+const uniqueId = (tag: string): string => `conf-${tag}-${randomBytes(4).toString('hex')}`;
+
+type Env = { ok: true; as: AsDouble; foreign: AsDouble; resource: ResourceDouble } | { ok: false; kind: 'blocked'; reason: string };
+let started: Env | null = null;
+async function doubles(): Promise<Env> {
+  started ??= await startDoubles();
+  return started;
+}
+async function startDoubles(): Promise<Env> {
+  const as = await startAsDouble('OPENWOP_OAUTH_AS_URL');
+  const foreign = await startAsDouble('OPENWOP_OAUTH_AS2_URL');
+  const resource = await startResourceDouble([as.issuer]);
+  opened.push(as, foreign, resource);
+  if (!as.tunnelled || !foreign.tunnelled || !resource.tunnelled) {
+    return { ok: false, kind: 'blocked', reason: 'a connection pack names https endpoints and an https MCP server URL, so the discovery legs need the suite\'s doubles behind public https fronts — set OPENWOP_OAUTH_AS_URL, OPENWOP_OAUTH_AS2_URL and OPENWOP_OAUTH_RESOURCE_URL (a tunnel or TLS-terminating proxy per double)' };
+  }
+  return { ok: true, as, foreign, resource };
+}
+
+async function startWith(p: Record<string, unknown>): Promise<{ status: number; code: string | undefined; url: URL | null } | 'absent'> {
+  const id = String((p['provider'] as { id: string }).id);
+  const r = await authorizeStart({ provider: id, connection: p });
+  if (r.status === 404 || r.status === 405) return 'absent';
+  return { status: r.status, code: readErrorCode(r.json), url: authorizationUrlOf(r) };
+}
+
+describe('RFC 0199 §B — v2-oauth-mcp-reach-discovery (gated on oauth + authorization_code + seams)', () => {
+  it('a reach.mcp + oauth2 pack without issuer validates, and its grant is refused with no authorization URL', async () => {
+    const g = await oauthGate();
+    if (!g.ok) return softSkip(g.kind, g.reason);
+    const id = R('mcp-metadata-bound');
+    const p = pack({ id: uniqueId('noiss'), serverUrl: 'https://mcp.conformance.invalid/mcp', authorize: 'https://as.conformance.invalid/authorize', token: 'https://as.conformance.invalid/token' });
+    const v = validPack(p);
+    expect(v.ok, req(id, 'schemas/v2/connection-pack-manifest.schema.json (issuer stays optional, RFC 0199 §E.2)', `an issuer-less reach.mcp + oauth2 manifest MUST still validate — the rule refuses a grant, never a document: ${v.errors}`)).toBe(true);
+    const r = await startWith(p);
+    if (r === 'absent') return seamAbsent('POST /conformance/seams/sample/oauth/authorize-start is not mounted');
+    expect([r.status, r.code, r.url], req(id, `${DOC}; RFC 0199 §E.2`, `a host MUST NOT authorize a reach.mcp + oauth2 provider whose manifest declares no issuer: 422 connection_auth_metadata_mismatch before any authorization URL (got ${r.status} ${r.code})`)).toEqual([422, 'connection_auth_metadata_mismatch', null]);
+  });
+
+  it('a reach.mcp provider declaring pkce unsupported is refused with no authorization URL', async () => {
+    const g = await oauthGate();
+    if (!g.ok) return softSkip(g.kind, g.reason);
+    const id = R('mcp-pkce-verified');
+    const p = pack({ id: uniqueId('nopkce'), serverUrl: 'https://mcp.conformance.invalid/mcp', authorize: 'https://as.conformance.invalid/authorize', token: 'https://as.conformance.invalid/token', issuer: 'https://as.conformance.invalid', pkce: 'unsupported' });
+    const r = await startWith(p);
+    if (r === 'absent') return seamAbsent('authorize-start is not mounted');
+    expect([r.status, r.code, r.url], req(id, `${DOC}; RFC 0199 §B.2/§E.2`, `a provider reached as an MCP server MUST use PKCE: pkce unsupported is refused 422 connection_auth_metadata_mismatch before any authorization URL (got ${r.status} ${r.code})`)).toEqual([422, 'connection_auth_metadata_mismatch', null]);
+  });
+
+  it('sends resource (RFC 8707) equal to the canonical server URI on the authorization and the token request', async () => {
+    const g = await oauthGate();
+    if (!g.ok) return softSkip(g.kind, g.reason);
+    const e = await doubles();
+    if (!e.ok) return softSkip(e.kind, e.reason);
+    const id = R('resource-indicator');
+    const p = pack({ id: uniqueId('res'), serverUrl: e.resource.resource, authorize: e.as.authorizeUrl, token: e.as.tokenUrl, issuer: e.as.issuer });
+    const r = await startWith(p);
+    if (r === 'absent') return seamAbsent('authorize-start is not mounted');
+    expect(r.url, req(id, DOC, `a verified reach.mcp provider is authorized: 201 with an authorization URL (got ${r.status} ${r.code})`)).not.toBeNull();
+    expect(r.url!.searchParams.get('resource'), req(id, `${DOC}; RFC 8707 §2`, 'the authorization request MUST carry resource = the canonical server URI')).toBe(e.resource.resource);
+    const cb = await consent(r.url!.toString());
+    const n = e.as.codeExchanges().length;
+    const done = await userAgentGet(cb!, loadEnv().apiKey);
+    const ex = e.as.codeExchanges().slice(n);
+    expect([done.status < 400, ex.length], req(id, DOC, `the callback completes with one token request (got ${done.status})`)).toEqual([true, 1]);
+    expect(ex[0]!.params['resource'], req(id, `${DOC}; RFC 8707 §2`, 'the token request MUST carry the same resource')).toBe(e.resource.resource);
+  });
+
+  it('discovery verifies and never selects: a PRM naming another issuer, or metadata naming another token endpoint, is refused and contacted nowhere', async () => {
+    const g = await oauthGate();
+    if (!g.ok) return softSkip(g.kind, g.reason);
+    const e = await doubles();
+    if (!e.ok) return softSkip(e.kind, e.reason);
+    const id = R('mcp-metadata-bound');
+    e.resource.prm = { ...e.resource.prm, authorization_servers: [e.foreign.issuer] };
+    const tokensBefore = e.as.tokenRequests.length;
+    const one = await startWith(pack({ id: uniqueId('prm'), serverUrl: e.resource.resource, authorize: e.as.authorizeUrl, token: e.as.tokenUrl, issuer: e.as.issuer }));
+    if (one === 'absent') return seamAbsent('authorize-start is not mounted');
+    expect([one.status, one.code, one.url], req(id, `${DOC} (discovery verifies; it never selects)`, `a PRM whose authorization_servers does not contain the manifest's issuer MUST be refused 422 connection_auth_metadata_mismatch (got ${one.status} ${one.code})`)).toEqual([422, 'connection_auth_metadata_mismatch', null]);
+    expect([e.foreign.metadataHits.length, e.foreign.authorizeRequests.length, e.foreign.tokenRequests.length], req(id, DOC, 'the foreign issuer the PRM named MUST receive zero requests — discovery never selects an endpoint')).toEqual([0, 0, 0]);
+    e.resource.prm = { ...e.resource.prm, authorization_servers: [e.as.issuer] };
+    e.as.metadataOverride = { token_endpoint: `${e.as.issuer}/token-elsewhere` };
+    try {
+      const two = await startWith(pack({ id: uniqueId('asmd'), serverUrl: e.resource.resource, authorize: e.as.authorizeUrl, token: e.as.tokenUrl, issuer: e.as.issuer }));
+      if (two === 'absent') return seamAbsent('authorize-start is not mounted');
+      expect([two.status, two.code, two.url], req(id, DOC, `authorization-server metadata whose token_endpoint differs from the manifest MUST be refused (got ${two.status} ${two.code})`)).toEqual([422, 'connection_auth_metadata_mismatch', null]);
+    } finally {
+      e.as.metadataOverride = {};
+    }
+    expect(e.as.tokenRequests.length, req(id, DOC, 'a refused discovery sends no token request')).toBe(tokensBefore);
+  });
+
+  it('refuses a provider whose authorization-server metadata does not list S256', async () => {
+    const g = await oauthGate();
+    if (!g.ok) return softSkip(g.kind, g.reason);
+    const e = await doubles();
+    if (!e.ok) return softSkip(e.kind, e.reason);
+    const id = R('mcp-pkce-verified');
+    e.as.codeChallengeMethods = ['plain'];
+    try {
+      const r = await startWith(pack({ id: uniqueId('plain'), serverUrl: e.resource.resource, authorize: e.as.authorizeUrl, token: e.as.tokenUrl, issuer: e.as.issuer }));
+      if (r === 'absent') return seamAbsent('authorize-start is not mounted');
+      expect([r.status, r.url], req(id, `${DOC}; RFC 0199 §B.2`, `metadata whose code_challenge_methods_supported lacks S256 MUST be refused with no authorization URL (got ${r.status} ${r.code})`)).toEqual([422, null]);
+    } finally {
+      e.as.codeChallengeMethods = ['S256'];
+    }
+  });
+
+  it('pins the verified tuple at registration and refuses a later discovery that disagrees', async () => {
+    const g = await oauthGate();
+    if (!g.ok) return softSkip(g.kind, g.reason);
+    const e = await doubles();
+    if (!e.ok) return softSkip(e.kind, e.reason);
+    const id = R('mcp-metadata-bound');
+    const p = pack({ id: uniqueId('pin'), serverUrl: e.resource.resource, authorize: e.as.authorizeUrl, token: e.as.tokenUrl, issuer: e.as.issuer });
+    const first = await startWith(p);
+    if (first === 'absent') return seamAbsent('authorize-start is not mounted');
+    expect(first.url, req(id, DOC, `positive control: the pack verifies and is authorized at registration (got ${first.status} ${first.code})`)).not.toBeNull();
+    e.resource.prm = { ...e.resource.prm, authorization_servers: [e.foreign.issuer] };
+    try {
+      const later = await startWith(p);
+      if (later === 'absent') return seamAbsent('authorize-start is not mounted');
+      expect([later.status, later.code, later.url], req(id, `${DOC} (pinned at registration, RFC 0199 §B.4)`, `a PRM changed after registration (now naming another issuer) MUST be refused on the next grant, not adopted silently (got ${later.status} ${later.code})`)).toEqual([422, 'connection_auth_metadata_mismatch', null]);
+      expect(e.foreign.metadataHits.length + e.foreign.tokenRequests.length, req(id, DOC, 'the newly named issuer is contacted nowhere')).toBe(0);
+    } finally {
+      e.resource.prm = { ...e.resource.prm, authorization_servers: [e.as.issuer] };
+    }
+  });
+});

package/src/scenarios/v2-oidc-id-token-audience.test.ts

@@ -0,0 +1,108 @@
+/**
+ * RFC 0200 §D — on the `oidc` lane an ID token MAY be a bearer only when its `aud` equals
+ * the host's configured audience (suite 2.36.0, target major 2).
+ *
+ * The corpus never retired ID tokens as bearers, and retiring them would break both
+ * production hosts (MyndHyve's `oidc` lane names `securetoken.google.com/…`; openwop-app
+ * verifies Firebase ID tokens). The actual risk was never the ID token — it is the
+ * AUDIENCE: an ID token minted for some OTHER relying party at the same IdP, presented
+ * here, is the substitution attack `threat-model-auth-profiles.md` A2 names. §D names the
+ * ID-token case explicitly as admissible under the audience MUST `identity.md` §2.1
+ * already carries, and refuses everything else.
+ *
+ * **Gate:** an advertised `oidc` lane AND `OPENWOP_TEST_OIDC_ISSUER_URL` naming a
+ * synthetic issuer the host trusts as that lane's trust root. Without the harness issuer
+ * the suite cannot mint a token the host would ever accept, so the leg is `blocked` — an
+ * assertion that a random string is refused would witness nothing.
+ *
+ * `HOST_CALLBACK_NOT_REQUIRED`: the suite stands the issuer up itself and the host reaches
+ * it for JWKS; nothing calls back into the suite's own API.
+ *
+ * How it FAILS (the sabotage run before citing the row):
+ *   (a) the host skips the `aud` check for ID tokens (the "tempted to relax" case — an ID
+ *       token is not an access token, so its audience feels like the IdP's business) → the
+ *       foreign-audience leg is served instead of refused.
+ *
+ * @see spec/v2/core/identity.md §2.1
+ * @see RFCS/0200-host-as-oauth-protected-resource.md §D
+ */
+
+import { afterAll, describe, it, expect } from 'vitest';
+import { randomBytes } from 'node:crypto';
+import { createServer, type Server } from 'node:http';
+import { driver } from '../lib/driver.js';
+import { softSkip } from '../lib/soft-skip.js';
+import { req } from '../lib/requirement-ids.js';
+import { readErrorCode } from '../lib/error-envelope.js';
+import { createSyntheticOIDCIssuer, type SyntheticOIDCIssuer } from '../lib/oidc-issuer.js';
+import { prmGate } from '../lib/protected-resource.js';
+
+export const HOST_CALLBACK_NOT_REQUIRED =
+  'the suite stands up the synthetic OIDC issuer and the host fetches its JWKS; no request returns to the suite\'s own API, so no host-reachable callback is needed';
+
+const DOC = 'spec/v2/core/identity.md §2.1 (RFC 0200 §D)';
+const ID = 'openwop.requirement.0200.id-token-aud';
+
+let server: Server | null = null;
+let issuer: SyntheticOIDCIssuer | null = null;
+afterAll(async () => {
+  if (server !== null) { const s = server; server = null; await new Promise<void>((r) => s.close(() => r())); }
+  issuer = null;
+});
+
+/** Stand the issuer up on the URL the operator told the host to trust. */
+async function harness(audience: string): Promise<{ url: string; issuer: SyntheticOIDCIssuer } | null> {
+  const url = process.env['OPENWOP_TEST_OIDC_ISSUER_URL']?.trim();
+  if (!url) return null;
+  if (issuer !== null) return { url, issuer };
+  const made = createSyntheticOIDCIssuer({ issuer: url, audience, algorithm: 'RS256' });
+  const parsed = new URL(url);
+  const srv = createServer((r, res) => {
+    if (r.url === '/.well-known/jwks.json') { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(made.jwksJson); return; }
+    if (r.url === '/.well-known/openid-configuration') { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(made.discoveryJson); return; }
+    res.writeHead(404); res.end();
+  });
+  await new Promise<void>((resolve, reject) => {
+    srv.once('error', reject);
+    srv.listen(parsed.port ? Number.parseInt(parsed.port, 10) : 80, '127.0.0.1', () => resolve());
+  });
+  server = srv;
+  issuer = made;
+  return { url, issuer: made };
+}
+
+describe('RFC 0200 §D — v2-oidc-id-token-audience (gated on an oidc lane and a trusted harness issuer)', () => {
+  it('a same-audience ID token is admissible, and one minted for another relying party is audience_mismatch', async () => {
+    const g = await prmGate();
+    if (!g.ok) return softSkip(g.kind, g.reason);
+    const oidc = g.lanes.find((l) => l.lane === 'oidc');
+    if (oidc === undefined) return softSkip('inapplicable', 'no oidc lane advertised — §D names the ID-token case ON that lane and binds no other');
+    const audience = process.env['OPENWOP_TEST_OIDC_AUDIENCE']?.trim() ?? 'openwop-conformance';
+    const h = await harness(audience);
+    if (h === null) return softSkip('blocked', 'OPENWOP_TEST_OIDC_ISSUER_URL is not set — without an issuer the host trusts, no minted token could ever be accepted and the admissible half of §D cannot run');
+
+    // An ID token, not an access token: `nonce` and `auth_time` are what make it one.
+    const good = h.issuer.mint({ sub: `conformance-${randomBytes(6).toString('hex')}`, nonce: randomBytes(8).toString('hex'), auth_time: Math.floor(Date.now() / 1000) });
+    const probe = await driver.post('/runs', { workflowId: 'conformance-noop' }, { authenticated: false, headers: { Authorization: `Bearer ${good.token}` } });
+    // The ADMISSIBLE half of §D is the gate, not an assertion, and deliberately: from
+    // outside, "this host does not trust the harness issuer" and "this host refuses ID
+    // tokens" are the same observation — a 401. Recording `blocked` says which was not
+    // established rather than reporting a configuration gap as a host defect. What the
+    // acceptance DOES establish, once it holds, is that the refusal below is caused by the
+    // audience and by nothing else: same issuer, same key, same token shape.
+    if (probe.status === 401) {
+      return softSkip('blocked', `a same-audience ID token from ${h.url} was refused (401 ${readErrorCode(probe.json) ?? ''}) — either the host does not trust the harness issuer as its oidc lane trust root, or OPENWOP_TEST_OIDC_AUDIENCE does not name the audience it is configured with; with no accepted token the foreign-audience refusal would prove nothing`);
+    }
+
+    const foreign = h.issuer.mint({ sub: `conformance-${randomBytes(6).toString('hex')}`, aud: `other-client-${randomBytes(6).toString('hex')}`, nonce: randomBytes(8).toString('hex'), auth_time: Math.floor(Date.now() / 1000) });
+    const bad = await driver.post('/runs', { workflowId: 'conformance-noop' }, { authenticated: false, headers: { Authorization: `Bearer ${foreign.token}` } });
+    expect(
+      bad.status,
+      req(ID, DOC, `an ID token minted for ANOTHER relying party at the same IdP MUST be refused 401 — it verifies against the same trust root, so only the audience check stops the substitution (got ${bad.status})`),
+    ).toBe(401);
+    expect(
+      readErrorCode(bad.json),
+      req(ID, `${DOC}; spec/v2/errors.json`, 'the refusal code MUST be audience_mismatch — the credential verified, its audience is not this host'),
+    ).toBe('audience_mismatch');
+  }, 60_000);
+});