@productbrain/mcp 0.0.1-beta.8248 → 0.0.1-beta.8252

package/dist/http.js

@@ -2,7 +2,7 @@ import {
   SERVER_VERSION,
   createProductBrainServer,
   initFeatureFlags
-} from "./chunk-J5R4OAP5.js";
+} from "./chunk-LV23VXXV.js";
 import {
   DEFAULT_CLOUD_URL,
   bootstrapHttp,
@@ -271,6 +271,72 @@ function recordAuthFailure(failures, ip, now) {
   }
 }
 
+// src/lib/oauthRedirectAllowlist.ts
+var DEFAULT_OAUTH_REDIRECT_HOSTS = [
+  "claude.ai",
+  "claude.com",
+  "chatgpt.com"
+];
+var LOOPBACK_HOSTS = ["localhost", "127.0.0.1", "[::1]"];
+var MAX_REDIRECT_URI_LENGTH = 2048;
+var MAX_REGISTRATION_REDIRECTS = 10;
+function parseHostAllowlist(raw) {
+  if (!raw) return [];
+  const hosts = [];
+  for (const part of raw.split(",")) {
+    const trimmed = part.trim();
+    if (!trimmed) continue;
+    try {
+      const asUrl = trimmed.includes("://") ? new URL(trimmed) : new URL(`https://${trimmed}`);
+      const host = asUrl.hostname.toLowerCase();
+      if (host) hosts.push(host);
+    } catch {
+    }
+  }
+  return hosts;
+}
+function resolveOAuthRedirectHosts(opts = {}) {
+  const hosts = new Set(DEFAULT_OAUTH_REDIRECT_HOSTS);
+  for (const h of parseHostAllowlist(opts.explicitAllowlist)) hosts.add(h);
+  return [...hosts];
+}
+function checkRedirectUri(redirectUri, allowedHosts) {
+  if (typeof redirectUri !== "string" || redirectUri.length === 0) {
+    return "redirect_uri is required";
+  }
+  if (redirectUri.length > MAX_REDIRECT_URI_LENGTH) {
+    return `redirect_uri is longer than ${MAX_REDIRECT_URI_LENGTH} characters`;
+  }
+  let url;
+  try {
+    url = new URL(redirectUri);
+  } catch {
+    return "redirect_uri is not a valid absolute URL";
+  }
+  if (url.username || url.password) return "redirect_uri must not contain credentials";
+  if (url.hash) return "redirect_uri must not contain a fragment";
+  const host = url.hostname.toLowerCase();
+  if (url.protocol === "http:") {
+    return LOOPBACK_HOSTS.includes(host) ? null : "redirect_uri must use https (http is allowed only for localhost, 127.0.0.1 or [::1])";
+  }
+  if (url.protocol === "https:") {
+    if (url.port && url.port !== "443") return "redirect_uri must use the default https port (443)";
+    return allowedHosts.includes(host) ? null : "redirect_uri host is not allowed (an operator can add it with OAUTH_REDIRECT_HOST_ALLOWLIST)";
+  }
+  return "redirect_uri scheme is not allowed (use https, or http on loopback)";
+}
+function checkRegistrationRedirects(redirectUris, allowedHosts) {
+  if (!Array.isArray(redirectUris) || redirectUris.length === 0) return "redirect_uris is required";
+  if (redirectUris.length > MAX_REGISTRATION_REDIRECTS) {
+    return `redirect_uris may hold at most ${MAX_REGISTRATION_REDIRECTS} entries`;
+  }
+  for (const uri of redirectUris) {
+    const reason = checkRedirectUri(uri, allowedHosts);
+    if (reason) return reason;
+  }
+  return null;
+}
+
 // src/http.ts
 bootstrapHttp();
 initAnalytics();
@@ -285,6 +351,7 @@ var app = express();
 app.set("trust proxy", 1);
 app.use(express.json());
 var ALLOWED_ORIGINS = (process.env.CORS_ORIGINS ?? "https://claude.ai").split(",").map((o) => o.trim()).filter(Boolean);
+var OAUTH_REDIRECT_HOSTS = resolveOAuthRedirectHosts({ explicitAllowlist: process.env.OAUTH_REDIRECT_HOST_ALLOWLIST });
 app.use((_req, res, next) => {
   const origin = _req.headers.origin;
   if (origin && ALLOWED_ORIGINS.includes(origin)) {
@@ -347,11 +414,9 @@ app.post(
       return;
     }
     const { redirect_uris, client_name } = req.body;
-    if (!Array.isArray(redirect_uris) || redirect_uris.length === 0) {
-      res.status(400).json({
-        error: "invalid_client_metadata",
-        error_description: "redirect_uris is required"
-      });
+    const refusal = checkRegistrationRedirects(redirect_uris, OAUTH_REDIRECT_HOSTS);
+    if (refusal) {
+      res.status(400).json({ error: "invalid_redirect_uri", error_description: refusal });
       return;
     }
     const clientId = `pb_client_${randomUUID2()}`;
@@ -956,6 +1021,11 @@ ${errorPanelInner(title, trustedDetailHtml, retryUrl)}
 }
 app.get("/authorize", authLimiter, (req, res) => {
   const { redirect_uri, code_challenge, code_challenge_method, state, client_id } = req.query;
+  const refusal = checkRedirectUri(redirect_uri, OAUTH_REDIRECT_HOSTS);
+  if (refusal) {
+    res.status(400).json({ error: "invalid_request", error_description: refusal });
+    return;
+  }
   const cid = String(client_id ?? "");
   const clientName = cid && registeredClients.has(cid) ? registeredClients.get(cid).client_name : void 0;
   res.type("html").send(authorizeFormPage({
@@ -997,28 +1067,22 @@ app.post(
       return;
     }
     if (!client_id) {
-      res.status(400).json({
-        error: "invalid_request",
-        error_description: "client_id is required"
-      });
+      res.status(400).json({ error: "invalid_request", error_description: "client_id is required" });
+      return;
+    }
+    const redirectRefusal = checkRedirectUri(redirect_uri, OAUTH_REDIRECT_HOSTS);
+    if (redirectRefusal) {
+      res.status(400).json({ error: "invalid_request", error_description: redirectRefusal });
       return;
     }
     if (!registeredClients.has(client_id)) {
-      if (typeof redirect_uri === "string" && redirect_uri.startsWith("https://")) {
-        registeredClients.set(client_id, {
-          client_id,
-          redirect_uris: [redirect_uri],
-          registeredAt: Date.now()
-        });
-        process.stderr.write(`[authorize] auto-re-registered stale client_id after restart
-`);
-      } else {
-        res.status(400).json({
-          error: "invalid_request",
-          error_description: "Unknown client_id and redirect_uri is not a valid https URL"
-        });
+      if (registeredClients.size >= MAX_REGISTERED_CLIENTS) {
+        res.status(503).json({ error: "server_error", error_description: "Registration limit reached. Try again later." });
         return;
       }
+      registeredClients.set(client_id, { client_id, redirect_uris: [redirect_uri], registeredAt: Date.now() });
+      process.stderr.write(`[authorize] auto-re-registered stale client_id after restart
+`);
     }
     const client = registeredClients.get(client_id);
     if (!client.redirect_uris.includes(redirect_uri)) {