@truefoundry/trueforge 0.1.2 → 0.1.3

package/dist/main.js

@@ -380,14 +380,14 @@ function toStoredOAuthPendingAuthorizationData(pending) {
   return {
     mcp_server_url: pending.mcpServerUrl,
     code_verifier: pending.codeVerifier,
-    redirect_url: pending.redirectUrl
+    return_to: pending.returnTo
   };
 }
 function fromStoredOAuthPendingAuthorizationData(stored) {
   return {
     mcpServerUrl: stored.mcp_server_url,
     codeVerifier: stored.code_verifier,
-    redirectUrl: stored.redirect_url
+    returnTo: stored.return_to
   };
 }
 var McpServerNameConflictError, PENDING_AUTHORIZATION_TTL_MS;
@@ -4511,19 +4511,6 @@ function isOAuthAccessTokenUsable(expiresAtIso, nowMs) {
   const expiresAtMs = Date.parse(expiresAtIso);
   return !Number.isNaN(expiresAtMs) && expiresAtMs > nowMs;
 }
-function validateRedirectUris({ redirectUris }) {
-  for (const redirectUri of redirectUris) {
-    let parsed;
-    try {
-      parsed = new URL(redirectUri);
-    } catch (error) {
-      throw new McpConnectionError(`Invalid redirect URI: ${redirectUri}. Must be a valid URL.`, 400, { cause: error });
-    }
-    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-      throw new McpConnectionError(`Invalid redirect URI: ${redirectUri}. Must be a valid URL.`, 400);
-    }
-  }
-}
 
 // src/mcp/auth/mcpDcr.ts
 var MCP_OAUTH_HTTP_TIMEOUT_MS = 15e3;
@@ -4674,7 +4661,7 @@ async function buildMcpAuthorizationUrl(params) {
     userRef: params.userRef,
     mcpServerUrl: params.mcpServerUrl,
     codeVerifier: started.codeVerifier,
-    redirectUrl: params.redirectUrl ?? null
+    returnTo: params.returnTo ?? null
   });
   return started.authorizationUrl;
 }
@@ -4717,7 +4704,7 @@ async function resolveMcpAuth(params) {
     userRef: params.userRef,
     mcpServerUrl: params.mcpServerUrl,
     mcpServerName: params.mcpServerName,
-    ...params.redirectUrl !== void 0 ? { redirectUrl: params.redirectUrl } : {}
+    ...params.returnTo !== void 0 ? { returnTo: params.returnTo } : {}
   });
   return { authUrl };
 }
@@ -5104,9 +5091,7 @@ function buildTurnSandbox(input) {
     blockDestructiveToolsInCodeMode: true,
     mcpRequestTimeoutMs: config_default.MCP_REQUEST_TIMEOUT_MS,
     mcpConnectTimeoutMs: config_default.MCP_CONNECT_TIMEOUT_MS,
-    // Sandbox reads its tenant from TFY_TENANT_NAME for the ownership check
-    // against provider-created sandbox ids (`<tenant>.<uuid>`).
-    execExtraEnv: { TFY_TENANT_NAME: input.tenantName },
+    tenantName: input.tenantName,
     ...skillMounter ? { skillMounter } : {},
     tracing: input.tracing,
     logger: input.logger
@@ -6044,6 +6029,18 @@ function buildAuthorizationRequestParams(config) {
   };
 }
 
+// src/auth/safeReturnTo.ts
+var SAFE_RETURN_TO = /^\/(?!\/|api(?:\/|$)).*/;
+function isSafeReturnTo(value) {
+  return SAFE_RETURN_TO.test(value);
+}
+function safeReturnTo(value) {
+  if (value && isSafeReturnTo(value)) {
+    return value;
+  }
+  return "/";
+}
+
 // src/auth/oidc.ts
 var CALLBACK_PATH = "/api/v1/auth/callback";
 var OAUTH_STATE_MAX_AGE_SECONDS = 10 * 60;
@@ -6080,13 +6077,6 @@ function authCallbackUrl() {
   const publicBaseUrl = getPublicBaseUrl();
   return `${publicBaseUrl}${CALLBACK_PATH}`;
 }
-var SAFE_RETURN_TO = /^\/(?!\/|api(?:\/|$)).*/;
-function safeReturnTo(value) {
-  if (value && SAFE_RETURN_TO.test(value)) {
-    return value;
-  }
-  return "/";
-}
 async function buildLoginAuthorization(params) {
   const oidcConfig = getOidcVerify()?.oidcConfig;
   if (!oidcConfig) {
@@ -6253,7 +6243,7 @@ var OAuthCallbackQuerySchema = z13.object({
   error_description: z13.string().optional().describe("Human-readable error detail from the identity provider when `error` is set.")
 });
 var OAuthCallbackSuccessSchema = z13.object({
-  success: z13.literal(true).describe("Present when the OAuth callback completed without a redirect_url.")
+  success: z13.literal(true).describe("Present when the OAuth callback completed without a return_to.")
 });
 var MeResponseSchema = z13.object({
   type: z13.enum(["default", "oidc-connected"]).describe(
@@ -6838,7 +6828,7 @@ var mcpOAuthCallbackRoute = createRoute6({
   path: "/callback",
   tags: [MCP_OAUTH_TAG],
   summary: "OAuth callback for MCP authorization",
-  description: "Browser redirect target for MCP server OAuth. The authorization server redirects here with `code`/`state` (or `error`). Exchanges the code for tokens, then either returns JSON or redirects to the `redirect_url` supplied at authorize time. Not called by the SDK \u2014 browsers hit this URL directly.",
+  description: "Browser redirect target for MCP server OAuth. The authorization server redirects here with `code`/`state` (or `error`). Exchanges the code for tokens, then either returns JSON or redirects to the `return_to` path supplied at authorize time. Not called by the SDK \u2014 browsers hit this URL directly.",
   // Browser-redirect target hit directly by the authorization server, never called by SDK.
   "x-fern-ignore": true,
   request: {
@@ -6847,10 +6837,10 @@ var mcpOAuthCallbackRoute = createRoute6({
   responses: {
     200: {
       content: { "application/json": { schema: OAuthCallbackSuccessSchema } },
-      description: "Token exchanged successfully and no `redirect_url` was given at authorize time."
+      description: "Token exchanged successfully and no `return_to` was given at authorize time."
     },
     302: {
-      description: "Redirect to the `redirect_url` given at authorize time, with `isSuccess` (and `reason` when it failed) appended to its existing query params."
+      description: "Redirect to the `return_to` path given at authorize time, with `isSuccess` (and `reason` when it failed) appended to its existing query params."
     },
     400: {
       content: { "application/json": { schema: RequestErrorResponseSchema } },
@@ -6864,25 +6854,28 @@ var mcpOAuthCallbackRoute = createRoute6({
 });
 
 // src/apis/mcpOAuth.ts
-function callbackLandingUrl(params) {
-  const url = new URL(params.redirectUrl);
+function callbackLandingPath(params) {
+  const url = new URL(params.returnTo, params.c.req.url);
   url.searchParams.set("isSuccess", String(params.isSuccess));
   if (params.reason) {
     url.searchParams.set("reason", params.reason);
   }
-  return url.href;
+  return `${url.pathname}${url.search}`;
 }
 function callbackSuccess(params) {
-  const redirectUrl = params.pending.redirectUrl;
-  if (redirectUrl) {
-    return params.c.redirect(callbackLandingUrl({ redirectUrl, isSuccess: true }), 302);
+  const returnTo = params.pending.returnTo;
+  if (returnTo) {
+    return params.c.redirect(callbackLandingPath({ c: params.c, returnTo, isSuccess: true }), 302);
   }
   return params.c.json({ success: true }, 200);
 }
 function callbackFailure(params) {
-  const redirectUrl = params.pending?.redirectUrl;
-  if (redirectUrl) {
-    return params.c.redirect(callbackLandingUrl({ redirectUrl, isSuccess: false, reason: params.message }), 302);
+  const returnTo = params.pending?.returnTo;
+  if (returnTo) {
+    return params.c.redirect(
+      callbackLandingPath({ c: params.c, returnTo, isSuccess: false, reason: params.message }),
+      302
+    );
   }
   return params.c.json({ error: { message: params.message } }, params.jsonStatus ?? 400);
 }
@@ -6924,10 +6917,10 @@ function createMcpOAuthRouter(deps) {
 }
 
 // src/apis/mcpServers.ts
-init_config();
-init_mcpServerStore();
 import { OpenAPIHono as OpenAPIHono7 } from "@hono/zod-openapi";
 import { extractErrorLogFields as extractErrorLogFields5, isAuthRequired, McpConnectionError as McpConnectionError4, RemoteMCP } from "@truefoundry/trueforge-core/core";
+init_config();
+init_mcpServerStore();
 
 // src/routes/mcpServerRoutes.ts
 import { createRoute as createRoute7, z as z21 } from "@hono/zod-openapi";
@@ -7100,7 +7093,9 @@ var listMcpServerToolsRoute = createRoute7({
   }
 });
 var McpAuthorizeQuerySchema = z21.object({
-  redirect_url: z21.url().optional().describe("Optional FE landing URL the OAuth callback redirects to, with `isSuccess`/`reason` appended.")
+  return_to: z21.string().optional().describe(
+    "Optional path to return to after OAuth. Must be a same-origin relative path; the OAuth callback redirects here with `isSuccess`/`reason` appended."
+  )
 });
 var authorizeMcpServerRoute = createRoute7({
   method: "get",
@@ -7109,7 +7104,7 @@ var authorizeMcpServerRoute = createRoute7({
   summary: "Start (or short-circuit) the auth flow for an MCP server",
   "x-fern-sdk-group-name": ["mcpServers"],
   "x-fern-sdk-method-name": "authorize",
-  description: "For servers without auth returns not_required, and for header credentials returns authenticated (no browser flow). For auth.type dcr, returns authenticated when a usable (or refreshable) token exists; otherwise runs DCR if needed and returns auth_required with an authorization URL. Optional redirect_url is where the OAuth callback then redirects the browser; without it the callback returns JSON.",
+  description: "For servers without auth returns not_required, and for header credentials returns authenticated (no browser flow). For auth.type dcr, returns authenticated when a usable (or refreshable) token exists; otherwise runs DCR if needed and returns auth_required with an authorization URL. Optional return_to is where the OAuth callback then redirects the browser; without it the callback returns JSON.",
   request: {
     params: McpServerNameParamsSchema,
     query: McpAuthorizeQuerySchema
@@ -7121,7 +7116,7 @@ var authorizeMcpServerRoute = createRoute7({
     },
     400: {
       content: { "application/json": { schema: RequestErrorResponseSchema } },
-      description: "Invalid redirect_url."
+      description: "Invalid return_to."
     },
     404: {
       content: { "application/json": { schema: RequestErrorResponseSchema } },
@@ -7141,13 +7136,13 @@ var authorizeMcpServerRoute = createRoute7({
     }
   }
 });
-var deleteAuthorizeMcpServerRoute = createRoute7({
+var deleteAuthorizationMcpServerRoute = createRoute7({
   method: "delete",
   path: "/{name}/authorize",
   tags: [MCP_SERVERS_TAG],
   summary: "Disconnect OAuth for an MCP server",
   "x-fern-sdk-group-name": ["mcpServers"],
-  "x-fern-sdk-method-name": "delete_authorize",
+  "x-fern-sdk-method-name": "delete_authorization",
   description: "For auth.type dcr, deletes the stored OAuth token and returns the server with auth_status auth_required, keeping the dynamically registered OAuth client so the next authorize can reuse it. No-op for header or no-auth servers (returns the server unchanged).",
   request: {
     params: McpServerNameParamsSchema
@@ -7460,7 +7455,7 @@ function createSettingsMcpServersRouter(deps) {
 function createMcpServersRouter(deps) {
   const authorizeHandler = async (c) => {
     const { name } = c.req.valid("param");
-    const { redirect_url: redirectUrl } = c.req.valid("query");
+    const { return_to: returnTo } = c.req.valid("query");
     const userRef = deps.resolveUserContext(c).userRef;
     const record = await deps.mcpServerStore.getServer({ tenant_id: TENANT_ID, name });
     if (!record) {
@@ -7469,10 +7464,10 @@ function createMcpServersRouter(deps) {
     if (record.manifest.auth?.type !== "dcr") {
       return c.json(resolveMcpAuthStatus({ manifest: record.manifest }), 200);
     }
+    if (returnTo && safeReturnTo(returnTo) !== returnTo) {
+      return c.json({ error: { message: "Invalid return_to: must be a same-origin relative path" } }, 400);
+    }
     try {
-      if (redirectUrl) {
-        validateRedirectUris({ redirectUris: [redirectUrl] });
-      }
       const result = await resolveMcpAuth({
         tokenStore: deps.tokenStore,
         mcpServerStore: deps.mcpServerStore,
@@ -7481,7 +7476,7 @@ function createMcpServersRouter(deps) {
         mcpServerUrl: record.manifest.url,
         mcpServerName: record.name,
         clientName: config_default.MCP_DCR_OAUTH_CLIENT_NAME,
-        ...redirectUrl !== void 0 ? { redirectUrl } : {}
+        ...returnTo !== void 0 ? { returnTo } : {}
       });
       const authStatus = isMcpAuthRequired(result) ? { status: "auth_required", authorization_url: result.authUrl.href } : { status: "authenticated" };
       return c.json(authStatus, 200);
@@ -7503,7 +7498,7 @@ function createMcpServersRouter(deps) {
       return c.json({ error: { message: "Internal server error" } }, 500);
     }
   };
-  const deleteAuthorizeHandler = async (c) => {
+  const deleteAuthorizationHandler = async (c) => {
     const { name } = c.req.valid("param");
     const userRef = deps.resolveUserContext(c).userRef;
     const record = await deps.mcpServerStore.getServer({ tenant_id: TENANT_ID, name });
@@ -7529,7 +7524,7 @@ function createMcpServersRouter(deps) {
     );
   });
   router.openapi(authorizeMcpServerRoute, authorizeHandler);
-  router.openapi(deleteAuthorizeMcpServerRoute, deleteAuthorizeHandler);
+  router.openapi(deleteAuthorizationMcpServerRoute, deleteAuthorizationHandler);
   return router;
 }