@softure-ai/mcp-access 0.1.7 → 0.1.9

package/src/next/oauth-routes.ts

@@ -9,6 +9,7 @@ import {
   answerOAuthPreflight,
   getAuthorizationServerMetadata,
   getProtectedResourceMetadata,
+  getRootProtectedResourceMetadata,
   handleAuthorizationDecision,
   handleClientRegistration,
   handleTokenRequest,
@@ -30,9 +31,12 @@ async function withContext(request: Request, handle: (ctx: McpAccessContext, req
   return handle(ctx, request);
 }
 
-/** `GET /.well-known/oauth-authorization-server`. */
-export function getAuthorizationServerMetadataRoute(): Response {
-  return serveDiscoveryDocument(getSoftureConfig(), getAuthorizationServerMetadata);
+/**
+ * `GET /.well-known/oauth-authorization-server`. Reads the request, so Next never renders it at
+ * build time with one origin baked in.
+ */
+export function getAuthorizationServerMetadataRoute(request: Request): Response {
+  return serveDiscoveryDocument(getSoftureConfig(), (config, origins) => getAuthorizationServerMetadata(config, origins), request);
 }
 
 /**
@@ -40,8 +44,12 @@ export function getAuthorizationServerMetadataRoute(): Response {
  * export at both paths; the request's path picks the variant.
  */
 export function getProtectedResourceMetadataRoute(request: Request): Response {
-  const variant = new URL(request.url).pathname.replace(/\/+$/, "").endsWith("/oauth-protected-resource") ? "root" : "endpoint";
-  return serveDiscoveryDocument(getSoftureConfig(), (config) => getProtectedResourceMetadata(config, variant));
+  const isRoot = new URL(request.url).pathname.replace(/\/+$/, "").endsWith("/oauth-protected-resource");
+  return serveDiscoveryDocument(
+    getSoftureConfig(),
+    isRoot ? getRootProtectedResourceMetadata : (config, origins) => getProtectedResourceMetadata(config, "endpoint", origins),
+    request,
+  );
 }
 
 /** `POST /api/oauth/register`. */

package/src/options.ts

@@ -1,6 +1,7 @@
 // The options an app passes to `mcpAccess({ ... })` in softure.config.ts, parsed at startup.
 import { LOCALES } from "@softure-ai/core";
 import { z } from "zod";
+import type { McpOriginRequest, McpOrigins } from "./origins.js";
 
 /** The name an MCP client lists the server under: no spaces, so a shell command needs no quotes. */
 export const SERVER_NAME_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/;
@@ -29,6 +30,57 @@ const toolSchema = z.strictObject({
   description: localizedTextSchema.refine((text) => text.en !== undefined, "needs at least an en text"),
 });
 
+/**
+ * Keys of the authorization server metadata the package generates. An extension cannot set them:
+ * they decide where a client sends a person and its secrets.
+ */
+export const GENERATED_AUTHORIZATION_SERVER_KEYS = [
+  "issuer",
+  "authorization_endpoint",
+  "token_endpoint",
+  "registration_endpoint",
+  "scopes_supported",
+  "response_types_supported",
+  "response_modes_supported",
+  "grant_types_supported",
+  "token_endpoint_auth_methods_supported",
+  "code_challenge_methods_supported",
+  "authorization_response_iss_parameter_supported",
+] as const;
+
+/** Keys of the protected resource metadata the package generates; `resource_name` is the app's to replace. */
+export const GENERATED_PROTECTED_RESOURCE_KEYS = ["resource", "authorization_servers", "scopes_supported", "bearer_methods_supported"] as const;
+
+/** Extra keys of a discovery document: a JSON object, or computed from the request's origins. */
+export type McpMetadataExtension = Readonly<Record<string, unknown>> | ((origins: McpOrigins) => Readonly<Record<string, unknown>>);
+
+/** The app origin of one request, or null for `appOrigin`. */
+export type McpAppOriginResolver = (request: McpOriginRequest) => string | null;
+
+function metadataExtensionSchema(generated: readonly string[]) {
+  return z.union([
+    z.custom<(origins: McpOrigins) => Readonly<Record<string, unknown>>>((value) => typeof value === "function"),
+    z.record(z.string(), z.unknown()).superRefine((record, context) => {
+      for (const key of generated) {
+        if (Object.hasOwn(record, key)) context.addIssue({ code: "custom", path: [key], message: `"${key}" is generated by the module and cannot be set` });
+      }
+    }),
+  ], { error: "must be an object of extra keys or a function (origins) => object" });
+}
+
+/** A bare http(s) origin (no path, query, fragment or credentials), reduced to its origin. */
+export function isBareOrigin(value: string): boolean {
+  if (!URL.canParse(value)) return false;
+  const url = new URL(value);
+  if (url.protocol !== "http:" && url.protocol !== "https:") return false;
+  return url.username === "" && url.password === "" && (url.pathname === "/" || url.pathname === "") && !value.includes("?") && !value.includes("#");
+}
+
+const originSchema = z
+  .string()
+  .refine((value) => isBareOrigin(value), "must be an http(s) origin such as https://example.com, without a path, query or credentials")
+  .transform((value) => new URL(value).origin);
+
 const oauthSchema = z.strictObject({
   /**
    * Makes the module an OAuth 2.1 authorization server for its endpoint: discovery metadata,
@@ -41,6 +93,22 @@ const oauthSchema = z.strictObject({
   refreshTokenLifetimeDays: z.int().min(1).max(365).default(90),
   /** How long an authorization code works; RFC 6749 §4.1.2 recommends at most ten minutes. */
   authorizationCodeLifetimeMinutes: z.int().min(1).max(10).default(10),
+  /**
+   * The largest request body the registration, token and consent decision routes read, in bytes;
+   * a larger one is answered with 413 before it fills memory. Real bodies stay under 4 KiB.
+   */
+  maxBodyBytes: z.int().min(1024).max(1_048_576).default(16_384),
+  /**
+   * Extra keys of the discovery documents (e.g. `jwks_uri`, `service_documentation`,
+   * `resource_documentation`, `agent_auth`). Generated keys win; the protected resource document
+   * takes the app's `resource_name`.
+   */
+  metadata: z
+    .strictObject({
+      authorizationServer: metadataExtensionSchema(GENERATED_AUTHORIZATION_SERVER_KEYS).optional(),
+      protectedResource: metadataExtensionSchema(GENERATED_PROTECTED_RESOURCE_KEYS).optional(),
+    })
+    .prefault({}),
 });
 
 /** A pattern for tokens an app issued before adopting the module: anchored, and stateless. */
@@ -68,6 +136,18 @@ export const mcpAccessOptionsSchema = z
      * looked up by its sha256 like a token of the module's own shape; new tokens keep the prefix.
      */
     legacyTokenPattern: legacyTokenPatternSchema.optional(),
+    /**
+     * The app origin of a request, when it is not the fixed `appOrigin`: an image built once and
+     * served under another origin, or a proxy whose `request.url` does not carry the public host.
+     * `readRequestOrigin` (`/server`) reads it from `Host`. Null keeps `appOrigin`.
+     */
+    resolveAppOrigin: z.custom<McpAppOriginResolver>((value) => typeof value === "function", "must be a function (request) => string | null").optional(),
+    /**
+     * Other public hosts of the app, e.g. the apex when the product runs on `app.`: their root
+     * protected resource metadata names that host as `resource` (RFC 9728 §3.3), and the
+     * authorization and token endpoints accept it as `resource`.
+     */
+    resourceOrigins: z.array(originSchema).max(16, "takes at most 16 origins").default([]),
     /** OAuth 2.1 for MCP clients that connect without a pasted token (claude.ai, ChatGPT). */
     oauth: oauthSchema.prefault({}),
   })

package/src/origins.ts

@@ -0,0 +1,48 @@
+// The origins one request is served under: the app origin every OAuth URL is built from, and the
+// other public hosts whose root may be named as a protected resource. Pure: no config, no database.
+
+/** What the origin helpers read from a request: a Web `Request`, or Next's `headers()` with a URL. */
+export interface McpOriginRequest {
+  readonly url: string;
+  readonly headers: { get(name: string): string | null };
+}
+
+export interface McpOrigins {
+  /** The issuer, and the origin of every endpoint, of `resource_metadata` and of the consent form. */
+  readonly appOrigin: string;
+  /** Other public hosts (`resourceOrigins`), each a bare origin. */
+  readonly resourceOrigins: readonly string[];
+}
+
+function firstValue(header: string | null): string | null {
+  const value = header?.split(",")[0]?.trim().toLowerCase();
+  return value === undefined || value === "" ? null : value;
+}
+
+/** The host the request was sent to: `Host`, else the URL's host. Behind a proxy the URL names the server's own. */
+export function readRequestHost(request: McpOriginRequest): string {
+  return firstValue(request.headers.get("host")) ?? new URL(request.url).host;
+}
+
+/**
+ * The origin the request was sent to: the first `X-Forwarded-Proto` value when it is http or https
+ * (else the URL's scheme) and `Host` (else the URL's host). For `resolveAppOrigin` in an app whose
+ * proxy passes `Host` through and refuses hosts it does not serve.
+ */
+export function readRequestOrigin(request: McpOriginRequest): string {
+  const url = new URL(request.url);
+  const proto = firstValue(request.headers.get("x-forwarded-proto"));
+  const scheme = proto === "http" || proto === "https" ? proto : url.protocol.replace(/:$/, "");
+  return new URL(`${scheme}://${readRequestHost(request)}`).origin;
+}
+
+/**
+ * The resource origin the request was sent to, when its host is one of `resourceOrigins`; when two
+ * share the host, the one whose scheme `X-Forwarded-Proto` names wins, else the first. Null otherwise.
+ */
+export function findServedResourceOrigin(origins: McpOrigins, request: McpOriginRequest): string | null {
+  const host = readRequestHost(request);
+  const candidates = origins.resourceOrigins.filter((origin) => new URL(origin).host === host);
+  const proto = firstValue(request.headers.get("x-forwarded-proto"));
+  return candidates.find((origin) => new URL(origin).protocol === `${proto ?? ""}:`) ?? candidates[0] ?? null;
+}

package/src/server/context.ts

@@ -0,0 +1,14 @@
+// The module context (`{ db, clock, config }`) from the configuration: the process-wide database
+// handle and the wall clock. For apps that compose their own routes from `/server`; the `/next`
+// adapter builds its context with it.
+import { systemClock, type SoftureConfig } from "@softure-ai/core";
+import { getConfiguredDatabase } from "@softure-ai/db";
+import type { McpAccessContext } from "./tokens.js";
+
+export async function createMcpAccessContext(config: SoftureConfig): Promise<McpAccessContext> {
+  if (config.database === null) {
+    throw new Error("@softure-ai/mcp-access: softure.config.ts has no database; mcp-access needs one");
+  }
+  const { db } = await getConfiguredDatabase(config.database);
+  return { db, clock: systemClock, config };
+}

package/src/server/endpoint.ts

@@ -16,6 +16,7 @@ import { errorLogLabel, getModule } from "@softure-ai/core";
 import { consumeRateLimit, identifyClient } from "@softure-ai/security/server";
 import type { McpServerIdentity } from "../contract.js";
 import { getProtectedResourceMetadataUrl, isOAuthEnabled } from "./oauth-http.js";
+import { resolveMcpOrigins } from "./origins.js";
 import { MCP_READ_SCOPE, MCP_WRITE_SCOPE } from "./scopes.js";
 import { verifyAccessToken, type McpAccessContext } from "./tokens.js";
 
@@ -79,7 +80,7 @@ export function createMcpEndpoint({ createServer }: McpEndpointOptions): McpEndp
       );
     }
 
-    const authInfo = await authenticate(ctx, request.headers.get("authorization"));
+    const authInfo = await authenticate(ctx, request);
     if (authInfo instanceof Response) return authInfo;
     return handler.fetch(request, { authInfo });
   };
@@ -92,9 +93,10 @@ export function createMcpEndpoint({ createServer }: McpEndpointOptions): McpEndp
  * names the protected resource metadata (RFC 9728 §5.1): that is how claude.ai and ChatGPT find
  * the authorization server.
  */
-async function authenticate(ctx: McpAccessContext, header: string | null): Promise<AuthInfo | Response> {
+async function authenticate(ctx: McpAccessContext, request: Request): Promise<AuthInfo | Response> {
+  const header = request.headers.get("authorization");
   const challenge = isOAuthEnabled(ctx.config)
-    ? { requiredScopes: [MCP_READ_SCOPE], resourceMetadataUrl: getProtectedResourceMetadataUrl(ctx.config) }
+    ? { requiredScopes: [MCP_READ_SCOPE], resourceMetadataUrl: getProtectedResourceMetadataUrl(ctx.config, resolveMcpOrigins(ctx.config, request)) }
     : { requiredScopes: [MCP_READ_SCOPE] };
   if (header === null || !BEARER_PREFIX.test(header)) {
     return bearerAuthChallengeResponse(new OAuthError(OAuthErrorCode.InvalidToken, "Missing Bearer token"), challenge);

package/src/server/index.ts

@@ -10,6 +10,7 @@ export {
   type McpEndpointOptions,
   type McpServerFactory,
 } from "./endpoint.js";
+export { createMcpAccessContext } from "./context.js";
 export { checkAccessTokensTable } from "./health.js";
 export {
   CONSENT_CODE_PREFIX,
@@ -43,6 +44,7 @@ export {
   getOAuthIssuer,
   getProtectedResourceMetadata,
   getProtectedResourceMetadataUrl,
+  getRootProtectedResourceMetadata,
   handleAuthorizationDecision,
   handleClientRegistration,
   handleTokenRequest,
@@ -58,7 +60,11 @@ export {
   type AuthorizationOutcome,
   type AuthorizationPageError,
   type AuthorizationRequest,
+  type DiscoveryDocument,
 } from "./oauth-http.js";
+export { findServedResourceOrigin, readRequestHost, readRequestOrigin, type McpOriginRequest, type McpOrigins } from "../origins.js";
+export { resolveMcpOrigins } from "./origins.js";
+export type { OAuthClientRow, OAuthTokenEndpointAuthMethod } from "../schema.js";
 export { describeRedirectUri, isAllowedRedirectUri, MAX_CLIENT_NAME_LENGTH, parseClientRegistration, type ClientRegistrationResult, type RegistrationError } from "./oauth-validation.js";
 export { getCodeChallenge, isPkceVerifierValid, isValidCodeChallenge, PKCE_METHOD } from "./pkce.js";
 export { getMcpAccessMessages, getMcpAccessOptions, getMcpAccessRoutes, getMcpEndpointUrl, type McpAccessRoutes } from "./options.js";

package/src/server/oauth-http.ts

@@ -4,7 +4,10 @@
 // handler takes a Web `Request` and returns a `Response`, so any fetch-shaped host can mount it;
 // the Next adapter only supplies the context and the session.
 import { errorLogLabel, getModule, type SoftureConfig } from "@softure-ai/core";
+import { readSmallBody, type ReadSmallBodyResult } from "@softure-ai/security";
 import { consumeRateLimit, identifyClient } from "@softure-ai/security/server";
+import type { McpMetadataExtension } from "../options.js";
+import { findServedResourceOrigin, type McpOriginRequest, type McpOrigins } from "../origins.js";
 import type { OAuthClientRow } from "../schema.js";
 import { MCP_READ_SCOPE, MCP_WRITE_SCOPE } from "./scopes.js";
 import {
@@ -18,6 +21,7 @@ import {
 } from "./oauth.js";
 import { parseClientRegistration } from "./oauth-validation.js";
 import { getMcpAccessOptions, getMcpAccessRoutes, getMcpEndpointUrl } from "./options.js";
+import { resolveMcpOrigins } from "./origins.js";
 import { isValidCodeChallenge, PKCE_METHOD } from "./pkce.js";
 import type { McpAccessContext } from "./tokens.js";
 
@@ -48,8 +52,8 @@ const CORS_HEADERS = {
 };
 /** Responses that carry credentials must not be stored (RFC 6749 §5.1). */
 const NO_STORE = { "cache-control": "no-store", pragma: "no-cache" };
-/** Discovery documents change only with a deploy. */
-const DISCOVERY_CACHE = { "cache-control": "public, max-age=300" };
+/** Discovery documents change only with a deploy, and with the host they were asked on. */
+const DISCOVERY_CACHE = { "cache-control": "public, max-age=300", vary: "host, x-forwarded-proto" };
 
 function protocolJson(body: unknown, status = 200, extra: Readonly<Record<string, string>> = {}): Response {
   return Response.json(body, { status, headers: { ...CORS_HEADERS, ...NO_STORE, ...extra } });
@@ -68,14 +72,17 @@ export function answerOAuthPreflight(): Response {
 // ---------------------------------------------------------------------------------------------
 // Discovery
 
-/** The issuer: the app's origin, without a path or a trailing slash. */
-export function getOAuthIssuer(config: SoftureConfig): string {
-  return new URL(config.appOrigin).origin;
+/**
+ * The issuer: the app's origin, without a path or a trailing slash. `origins` are the request's
+ * (`resolveMcpOrigins`); without them, the configured `appOrigin`.
+ */
+export function getOAuthIssuer(config: SoftureConfig, origins: McpOrigins = resolveMcpOrigins(config)): string {
+  return origins.appOrigin;
 }
 
 /** The URL the endpoint's `401` names in `resource_metadata` (RFC 9728 §5.1). */
-export function getProtectedResourceMetadataUrl(config: SoftureConfig): string {
-  return `${getOAuthIssuer(config)}${PROTECTED_RESOURCE_METADATA_PATH}${new URL(getMcpEndpointUrl(config)).pathname}`;
+export function getProtectedResourceMetadataUrl(config: SoftureConfig, origins: McpOrigins = resolveMcpOrigins(config)): string {
+  return `${getOAuthIssuer(config, origins)}${PROTECTED_RESOURCE_METADATA_PATH}${new URL(getMcpEndpointUrl(config, origins)).pathname}`;
 }
 
 /** Whether the app turned OAuth on; the OAuth routes answer 404 otherwise. */
@@ -83,11 +90,21 @@ export function isOAuthEnabled(config: SoftureConfig): boolean {
   return getMcpAccessOptions(config).oauth.enabled;
 }
 
-/** Authorization server metadata (RFC 8414 §2). Tokens are opaque: no `jwks_uri`, no OpenID. */
-export function getAuthorizationServerMetadata(config: SoftureConfig) {
-  const issuer = getOAuthIssuer(config);
+/** The app's extra keys under the generated ones (`oauth.metadata`). */
+function readExtension(extension: McpMetadataExtension | undefined, origins: McpOrigins): Readonly<Record<string, unknown>> {
+  if (extension === undefined) return {};
+  return typeof extension === "function" ? extension(origins) : extension;
+}
+
+/**
+ * Authorization server metadata (RFC 8414 §2), with the app's `oauth.metadata.authorizationServer`
+ * keys added; generated keys win. Tokens are opaque: no OpenID.
+ */
+export function getAuthorizationServerMetadata(config: SoftureConfig, origins: McpOrigins = resolveMcpOrigins(config)) {
+  const issuer = getOAuthIssuer(config, origins);
   const routes = getMcpAccessRoutes(config);
   return {
+    ...readExtension(getMcpAccessOptions(config).oauth.metadata.authorizationServer, origins),
     issuer,
     authorization_endpoint: `${issuer}${routes.oauthConsent}`,
     token_endpoint: `${issuer}${routes.oauthToken}`,
@@ -104,35 +121,50 @@ export function getAuthorizationServerMetadata(config: SoftureConfig) {
 }
 
 /**
- * Protected resource metadata (RFC 9728 §2). At the endpoint's own path the resource is the
- * endpoint URL; at the root it is the origin, because RFC 9728 §3.3 ties `resource` to the URL the
- * metadata URL was built from.
+ * Protected resource metadata (RFC 9728 §2), with the app's `oauth.metadata.protectedResource`
+ * keys added; generated keys win, except the app's `resource_name`. At the endpoint's own path the
+ * resource is the endpoint URL; at the root it is the origin the document was asked on
+ * (`servedOrigin`, one of `resourceOrigins`) or else the app origin, because RFC 9728 §3.3 ties
+ * `resource` to the URL the metadata URL was built from.
  */
-export function getProtectedResourceMetadata(config: SoftureConfig, variant: "endpoint" | "root") {
+export function getProtectedResourceMetadata(
+  config: SoftureConfig,
+  variant: "endpoint" | "root",
+  origins: McpOrigins = resolveMcpOrigins(config),
+  servedOrigin: string | null = null,
+) {
+  const issuer = getOAuthIssuer(config, origins);
   return {
-    resource: variant === "endpoint" ? getMcpEndpointUrl(config) : getOAuthIssuer(config),
-    authorization_servers: [getOAuthIssuer(config)],
+    resource_name: getMcpAccessOptions(config).serverName,
+    ...readExtension(getMcpAccessOptions(config).oauth.metadata.protectedResource, origins),
+    resource: variant === "endpoint" ? getMcpEndpointUrl(config, origins) : (servedOrigin ?? issuer),
+    authorization_servers: [issuer],
     scopes_supported: [...OAUTH_SCOPES],
     bearer_methods_supported: ["header"],
-    resource_name: getMcpAccessOptions(config).serverName,
   };
 }
 
-/** `GET` of a discovery document; 404 while OAuth is off. */
-export function serveDiscoveryDocument(config: SoftureConfig, document: (config: SoftureConfig) => unknown): Response {
+/** Builds a discovery document for the request's origins; the request is null outside a route. */
+export type DiscoveryDocument = (config: SoftureConfig, origins: McpOrigins, request: McpOriginRequest | null) => unknown;
+
+/** `GET` of a discovery document for `request` (its origins); 404 while OAuth is off. */
+export function serveDiscoveryDocument(config: SoftureConfig, document: DiscoveryDocument, request: McpOriginRequest | null = null): Response {
   if (!isOAuthEnabled(config)) return Response.json({ error: "not_found" }, { status: 404, headers: CORS_HEADERS });
-  return Response.json(document(config), { headers: { ...CORS_HEADERS, ...DISCOVERY_CACHE } });
+  return Response.json(document(config, resolveMcpOrigins(config, request), request), { headers: { ...CORS_HEADERS, ...DISCOVERY_CACHE } });
 }
 
+/** `serveDiscoveryDocument`'s builder for the root protected resource metadata, on the host it was asked on. */
+export const getRootProtectedResourceMetadata: DiscoveryDocument = (config, origins, request) =>
+  getProtectedResourceMetadata(config, "root", origins, request === null ? null : findServedResourceOrigin(origins, request));
+
 /**
  * Whether `resource` (RFC 8707) names this server: absent (clients from before RFC 8707), the
- * endpoint URL or the origin, each with or without a trailing slash.
+ * endpoint URL, the app origin or one of `resourceOrigins`, each with or without a trailing slash.
  */
-export function isAcceptableResource(config: SoftureConfig, resource: string | null): boolean {
+export function isAcceptableResource(config: SoftureConfig, resource: string | null, origins: McpOrigins = resolveMcpOrigins(config)): boolean {
   if (resource === null || resource === "") return true;
-  const endpoint = getMcpEndpointUrl(config).replace(/\/+$/, "");
-  const origin = getOAuthIssuer(config);
-  return [endpoint, `${endpoint}/`, origin, `${origin}/`].includes(resource);
+  const endpoint = getMcpEndpointUrl(config, origins).replace(/\/+$/, "");
+  return [endpoint, getOAuthIssuer(config, origins), ...origins.resourceOrigins].some((accepted) => resource === accepted || resource === `${accepted}/`);
 }
 
 /** Whether the client asks to write. Unknown scopes are ignored (RFC 6749 §3.3); every grant reads. */
@@ -174,6 +206,18 @@ async function limitProtocolRequest(ctx: McpAccessContext, request: Request, cli
   }
 }
 
+// ---------------------------------------------------------------------------------------------
+// Request bodies
+
+/** The body as text, read up to `oauth.maxBodyBytes`: registration and token are public, so the cap comes before any parsing. */
+function readCappedBody(config: SoftureConfig, request: Request): Promise<ReadSmallBodyResult> {
+  return readSmallBody(request, { maxBytes: getMcpAccessOptions(config).oauth.maxBodyBytes });
+}
+
+function bodyTooLarge(config: SoftureConfig): Response {
+  return protocolError("invalid_request", `The request body is larger than ${String(getMcpAccessOptions(config).oauth.maxBodyBytes)} bytes.`, 413);
+}
+
 // ---------------------------------------------------------------------------------------------
 // Registration
 
@@ -186,11 +230,14 @@ export async function handleClientRegistration(ctx: McpAccessContext, request: R
   const limited = await limitProtocolRequest(ctx, request);
   if (limited !== null) return limited;
 
+  const notJson = () => protocolError("invalid_client_metadata", "The request body must be a JSON object.");
+  const text = await readCappedBody(ctx.config, request);
+  if (!text.ok) return text.error === "security.body_too_large" ? bodyTooLarge(ctx.config) : notJson();
   let body: unknown;
   try {
-    body = await request.json();
+    body = JSON.parse(text.value);
   } catch {
-    return protocolError("invalid_client_metadata", "The request body must be a JSON object.");
+    return notJson();
   }
   const parsed = parseClientRegistration(body);
   if (!parsed.ok) return protocolError(parsed.error.error, parsed.error.description);
@@ -263,7 +310,14 @@ const INVALID_GRANT = "The code or refresh token is invalid, expired, used or is
  */
 export async function handleTokenRequest(ctx: McpAccessContext, request: Request): Promise<Response> {
   if (!isOAuthEnabled(ctx.config)) return protocolError("not_found", "OAuth is not enabled.", 404);
-  const form = new URLSearchParams(await request.text().catch(() => ""));
+  const origins = resolveMcpOrigins(ctx.config, request);
+  const text = await readCappedBody(ctx.config, request);
+  if (!text.ok && text.error === "security.body_too_large") {
+    // Counted by address alone: the client id inside an oversized body is never read.
+    return (await limitProtocolRequest(ctx, request)) ?? bodyTooLarge(ctx.config);
+  }
+  // An unreadable body is an empty form, which the client check refuses.
+  const form = new URLSearchParams(text.ok ? text.value : "");
   const credentials = readClientCredentials(request, form);
   const limited = await limitProtocolRequest(ctx, request, credentials.clientId);
   if (limited !== null) return limited;
@@ -273,15 +327,21 @@ export async function handleTokenRequest(ctx: McpAccessContext, request: Request
     if (client === null || !isClientSecretValid(client, credentials.clientSecret === "" ? null : credentials.clientSecret)) {
       return protocolError("invalid_client", "Unknown client or wrong client credentials.", 401, credentials.isBasic ? { "www-authenticate": 'Basic realm="mcp"' } : {});
     }
-    return await answerGrant(ctx, form, client);
+    return await answerGrant(ctx, { form, client, origins });
   } catch (error) {
     console.error(`@softure-ai/mcp-access: the OAuth token endpoint failed: ${errorLogLabel(error)}`);
     return protocolError("server_error", "The token could not be issued.", 500);
   }
 }
 
-async function answerGrant(ctx: McpAccessContext, form: URLSearchParams, client: OAuthClientRow): Promise<Response> {
-  if (!isAcceptableResource(ctx.config, form.get("resource"))) {
+interface GrantRequest {
+  readonly form: URLSearchParams;
+  readonly client: OAuthClientRow;
+  readonly origins: McpOrigins;
+}
+
+async function answerGrant(ctx: McpAccessContext, { form, client, origins }: GrantRequest): Promise<Response> {
+  if (!isAcceptableResource(ctx.config, form.get("resource"), origins)) {
     return protocolError("invalid_target", "The resource parameter does not name this MCP server.");
   }
   const grantType = form.get("grant_type");
@@ -328,9 +388,14 @@ export type AuthorizationOutcome =
  * The client's redirect URI with parameters added, keeping the query it registered (RFC 6749
  * §3.1.2), and always `iss` (RFC 9207), so the client knows the answer came from this server.
  */
-export function buildClientRedirect(config: SoftureConfig, redirectUri: string, params: Readonly<Record<string, string | null>>): string {
+export function buildClientRedirect(
+  config: SoftureConfig,
+  redirectUri: string,
+  params: Readonly<Record<string, string | null>>,
+  origins: McpOrigins = resolveMcpOrigins(config),
+): string {
   const url = new URL(redirectUri);
-  for (const [key, value] of Object.entries({ ...params, iss: getOAuthIssuer(config) })) {
+  for (const [key, value] of Object.entries({ ...params, iss: getOAuthIssuer(config, origins) })) {
     if (value !== null) url.searchParams.set(key, value);
   }
   return url.toString();
@@ -350,9 +415,14 @@ export function readAuthorizationParams(source: { get(name: string): unknown }):
  * Validates an authorization request (RFC 6749 §4.1.1), for the consent page and the decision.
  * Order is a security rule (RFC 6749 §4.1.2.1): until the client and its redirect URI are
  * confirmed, an error is shown to the person, never redirected, or the server would redirect
- * anyone anywhere. Only then do errors go back to the client.
+ * anyone anywhere. Only then do errors go back to the client. `origins` are the request's
+ * (the consent page's and the decision's must agree); without them, the configured ones.
  */
-export async function validateAuthorizationRequest(ctx: McpAccessContext, params: URLSearchParams): Promise<AuthorizationOutcome> {
+export async function validateAuthorizationRequest(
+  ctx: McpAccessContext,
+  params: URLSearchParams,
+  origins: McpOrigins = resolveMcpOrigins(ctx.config),
+): Promise<AuthorizationOutcome> {
   const clientId = params.get("client_id");
   const client = clientId === null ? null : await findOAuthClient(ctx, clientId);
   if (client === null) return { kind: "show-error", reason: "unknown_client" };
@@ -364,14 +434,14 @@ export async function validateAuthorizationRequest(ctx: McpAccessContext, params
   const back = (error: string, description: string): AuthorizationOutcome => ({
     kind: "redirect-error",
     redirectUri,
-    location: buildClientRedirect(ctx.config, redirectUri, { error, error_description: description, state }),
+    location: buildClientRedirect(ctx.config, redirectUri, { error, error_description: description, state }, origins),
   });
   if (params.get("response_type") !== "code") return back("unsupported_response_type", "Only response_type=code is supported.");
   const codeChallenge = params.get("code_challenge");
   if (codeChallenge === null || !isValidCodeChallenge(codeChallenge) || params.get("code_challenge_method") !== PKCE_METHOD) {
     return back("invalid_request", "PKCE is required: code_challenge with code_challenge_method S256.");
   }
-  if (!isAcceptableResource(ctx.config, params.get("resource"))) return back("invalid_target", "The resource parameter does not name this MCP server.");
+  if (!isAcceptableResource(ctx.config, params.get("resource"), origins)) return back("invalid_target", "The resource parameter does not name this MCP server.");
   return { kind: "valid", request: { client, redirectUri, state, codeChallenge, isWriteRequested: isWriteScopeRequested(params.get("scope")) } };
 }
 
@@ -384,10 +454,22 @@ function seeOther(location: string): Response {
   return new Response(null, { status: 303, headers: { location, "cache-control": "no-store" } });
 }
 
-/** Whether the form was posted from this app: `Origin` must be the app's origin. */
-function isSameOrigin(config: SoftureConfig, request: Request): boolean {
+/** Whether the form was posted from this app: `Origin` must be the request's app origin. */
+function isSameOrigin(request: Request, origins: McpOrigins): boolean {
   const origin = request.headers.get("origin");
-  return origin !== null && origin === getOAuthIssuer(config);
+  return origin !== null && origin === origins.appOrigin;
+}
+
+/**
+ * The consent form, read up to `oauth.maxBodyBytes`, or the answer to a body that is too large
+ * (413) or unreadable (400). Parsed by the platform, so urlencoded and multipart forms both work.
+ */
+async function readDecisionForm(config: SoftureConfig, request: Request): Promise<FormData | Response> {
+  const refuse = (status: number) => new Response(null, { status, headers: { "cache-control": "no-store" } });
+  const text = await readCappedBody(config, request);
+  if (!text.ok) return refuse(text.error === "security.body_too_large" ? 413 : 400);
+  const parsed = new Response(text.value, { headers: { "content-type": request.headers.get("content-type") ?? "" } });
+  return (await parsed.formData().catch(() => null)) ?? refuse(400);
 }
 
 /**
@@ -399,21 +481,22 @@ function isSameOrigin(config: SoftureConfig, request: Request): boolean {
  */
 export async function handleAuthorizationDecision(ctx: McpAccessContext, request: Request, userId: string | null): Promise<Response> {
   if (!isOAuthEnabled(ctx.config)) return new Response(null, { status: 404 });
-  if (!isSameOrigin(ctx.config, request)) return new Response(null, { status: 403, headers: { "cache-control": "no-store" } });
-  const form = await request.formData().catch(() => null);
-  if (form === null) return new Response(null, { status: 400, headers: { "cache-control": "no-store" } });
+  const origins = resolveMcpOrigins(ctx.config, request);
+  if (!isSameOrigin(request, origins)) return new Response(null, { status: 403, headers: { "cache-control": "no-store" } });
+  const form = await readDecisionForm(ctx.config, request);
+  if (form instanceof Response) return form;
 
   const params = readAuthorizationParams(form);
   const consent = getConsentPath(ctx.config, params);
   if (userId === null) return seeOther(consent);
   try {
-    const outcome = await validateAuthorizationRequest(ctx, params);
+    const outcome = await validateAuthorizationRequest(ctx, params, origins);
     if (outcome.kind === "show-error") return seeOther(consent);
     if (outcome.kind === "redirect-error") return seeOther(outcome.location);
 
     const { client, redirectUri, state, codeChallenge, isWriteRequested } = outcome.request;
     if (form.get("decision") !== "allow") {
-      return seeOther(buildClientRedirect(ctx.config, redirectUri, { error: "access_denied", error_description: "The person denied access.", state }));
+      return seeOther(buildClientRedirect(ctx.config, redirectUri, { error: "access_denied", error_description: "The person denied access.", state }, origins));
     }
     const code = await createAuthorizationCode(ctx, {
       clientRowId: client.id,
@@ -423,7 +506,7 @@ export async function handleAuthorizationDecision(ctx: McpAccessContext, request
       // Writes need the client's request, the app's allowWrites and the person's tick.
       canWrite: isWriteRequested && getMcpAccessOptions(ctx.config).allowWrites && form.get("canWrite") !== null,
     });
-    return seeOther(buildClientRedirect(ctx.config, redirectUri, { code, state }));
+    return seeOther(buildClientRedirect(ctx.config, redirectUri, { code, state }, origins));
   } catch (error) {
     console.error(`@softure-ai/mcp-access: recording an OAuth decision failed: ${errorLogLabel(error)}`);
     return new Response(null, { status: 500, headers: { "cache-control": "no-store" } });

package/src/server/options.ts

@@ -2,6 +2,7 @@
 import { getModule, type Locale, type SoftureConfig } from "@softure-ai/core";
 import type { McpAccessMessages } from "../messages/index.js";
 import type { McpAccessOptions } from "../options.js";
+import type { McpOrigins } from "../origins.js";
 
 const MODULE_ID = "mcp-access";
 
@@ -52,9 +53,9 @@ export function getMcpAccessRoutes(config: SoftureConfig): McpAccessRoutes {
   };
 }
 
-/** The absolute URL MCP clients call: the app's origin and the endpoint route. */
-export function getMcpEndpointUrl(config: SoftureConfig): string {
-  return new URL(getMcpAccessRoutes(config).endpoint, config.appOrigin).toString();
+/** The absolute URL MCP clients call: the app's origin (the request's, when given) and the endpoint route. */
+export function getMcpEndpointUrl(config: SoftureConfig, origins?: McpOrigins): string {
+  return new URL(getMcpAccessRoutes(config).endpoint, origins?.appOrigin ?? config.appOrigin).toString();
 }
 
 /** The module's copy in the app's locale, with the app's overrides applied. */

package/src/server/origins.ts

@@ -0,0 +1,19 @@
+// The origins of one request, from the app's options: `resolveAppOrigin` when it answers, else the
+// configured `appOrigin`, plus `resourceOrigins`.
+import type { SoftureConfig } from "@softure-ai/core";
+import { isBareOrigin } from "../options.js";
+import type { McpOriginRequest, McpOrigins } from "../origins.js";
+import { getMcpAccessOptions } from "./options.js";
+
+/**
+ * The origins for `request`, or the configured ones without a request. A resolver that returns
+ * something other than a bare http(s) origin is a setup bug: thrown by name, never served.
+ */
+export function resolveMcpOrigins(config: SoftureConfig, request?: McpOriginRequest | null): McpOrigins {
+  const options = getMcpAccessOptions(config);
+  const resolved = request === undefined || request === null || options.resolveAppOrigin === undefined ? null : options.resolveAppOrigin(request);
+  if (resolved !== null && !isBareOrigin(resolved)) {
+    throw new Error(`@softure-ai/mcp-access: resolveAppOrigin returned "${resolved.slice(0, 100)}", which is not an http(s) origin without a path`);
+  }
+  return { appOrigin: new URL(resolved ?? config.appOrigin).origin, resourceOrigins: options.resourceOrigins };
+}