@tumbaland/backend-core 1.37.0 → 1.38.0

package/src/oauth/service.ts

@@ -1,6 +1,11 @@
 import { createHash, randomBytes, timingSafeEqual } from 'crypto';
 import { AuthorizationCode, IAuthorizationCode, OAuthClient, RefreshToken } from './models';
-import type { ApiKeyScope } from '../apiKeys/types';
+import {
+  readTenants,
+  type ApiKeyScope,
+  type ApiKeyTenant,
+  type Tenant
+} from '../apiKeys/types';
 
 /** How long a user has between approving and the client exchanging the code. */
 const CODE_TTL_MS = 60 * 1000;
@@ -84,7 +89,9 @@ export interface IssueCodeInput {
   userName: string;
   redirectUri: string;
   scopes: ApiKeyScope[];
-  groupId: string | null;
+  tenants: Tenant[];
+  defaultTenant: Tenant;
+  tenantNames: Record<Tenant, string>;
   resource: string;
   codeChallenge: string;
 }
@@ -166,7 +173,9 @@ export const issueRefreshToken = async (input: {
   clientId: string;
   userId: string;
   scopes: ApiKeyScope[];
-  groupId: string | null;
+  tenants: Tenant[];
+  defaultTenant: Tenant;
+  tenantNames: Record<Tenant, string>;
   resource: string;
 }): Promise<IssuedRefreshToken> => {
   await RefreshToken.updateMany(
@@ -185,7 +194,8 @@ export interface RefreshRedemption {
   reused?: boolean;
   userId?: string;
   scopes?: ApiKeyScope[];
-  groupId?: string | null;
+  tenants?: ApiKeyTenant;
+  tenantNames?: Record<Tenant, string>;
   resource?: string;
   /** the replacement the client must store; the presented one is now dead */
   rotatedToken?: string;
@@ -233,7 +243,11 @@ export const redeemRefreshToken = async (
     clientId,
     userId: record.userId,
     scopes: record.scopes,
-    groupId: record.groupId ?? null,
+    // Carried, not reset: rotation reissues the same grant, and re-deriving the
+    // tenants would quietly narrow a connection every time it refreshed.
+    tenants: record.tenants,
+    defaultTenant: record.defaultTenant,
+    tenantNames: record.tenantNames,
     resource: record.resource,
     // Carried, not reset: this is still the grant the user approved.
     grantedAt: record.grantedAt ?? record.createdAt
@@ -243,7 +257,8 @@ export const redeemRefreshToken = async (
     ok: true,
     userId: record.userId,
     scopes: record.scopes as ApiKeyScope[],
-    groupId: record.groupId ?? null,
+    tenants: readTenants(record),
+    tenantNames: record.tenantNames ?? {},
     resource: record.resource,
     rotatedToken: rotated
   };
@@ -271,7 +286,10 @@ export const listConnections = async (userId: string) => {
     clientId: token.clientId,
     clientName: nameById.get(token.clientId) ?? 'Unknown app',
     scopes: token.scopes,
-    groupId: token.groupId ?? null,
+    ...(({ allowed, default: fallback }) => ({ tenants: allowed, defaultTenant: fallback }))(
+      readTenants(token)
+    ),
+    tenantNames: token.tenantNames ?? {},
     createdAt: (token.grantedAt ?? token.createdAt).toISOString(),
     // Set when the refresh token is exchanged, not when a tool runs — access
     // tokens are validated statelessly, so the server never sees ordinary use.

package/src/oauth/tokens.test.ts

@@ -1,6 +1,7 @@
 const ORIGINAL_ENV = process.env;
 
 import jwt from 'jsonwebtoken';
+import { PERSONAL_TENANT } from '../apiKeys/types';
 import { mintAccessToken, verifyAccessToken, parseScopes } from './tokens';
 
 const RESOURCE = 'https://mcp.tumbaland.eu';
@@ -14,7 +15,9 @@ const mint = (over: Partial<Parameters<typeof mintAccessToken>[0]> = {}) =>
     resource: RESOURCE,
     issuer: ISSUER,
     scopes: ['relationship:read', 'relationship:write'],
-    groupId: null,
+    tenants: [PERSONAL_TENANT],
+    defaultTenant: PERSONAL_TENANT,
+    tenantNames: { [PERSONAL_TENANT]: 'My own data' },
     ...over
   });
 
@@ -38,9 +41,21 @@ describe('mintAccessToken', () => {
     expect(expiresIn).toBe(3600);
   });
 
-  it('carries the tenant pin, so a token cannot wander between groups', () => {
-    const claims = jwt.decode(mint({ groupId: 'g1' }).accessToken) as Record<string, unknown>;
-    expect(claims.groupId).toBe('g1');
+  it('carries the granted tenants, so a token cannot wander outside them', () => {
+    const claims = jwt.decode(
+      mint({ tenants: [PERSONAL_TENANT, 'g1'], defaultTenant: 'g1' }).accessToken
+    ) as Record<string, unknown>;
+
+    expect(claims.tenants).toEqual([PERSONAL_TENANT, 'g1']);
+    expect(claims.defaultTenant).toBe('g1');
+  });
+
+  it('carries what each tenant is called, since nothing downstream can look it up', () => {
+    const claims = jwt.decode(
+      mint({ tenants: ['g1'], defaultTenant: 'g1', tenantNames: { g1: 'Irja & Tom' } }).accessToken
+    ) as Record<string, unknown>;
+
+    expect(claims.tenantNames).toEqual({ g1: 'Irja & Tom' });
   });
 
   it('gives every token a distinct id', () => {
@@ -59,7 +74,7 @@ describe('verifyAccessToken', () => {
       userId: 'u1',
       email: 'u1@example.com',
       scopes: ['relationship:read', 'relationship:write'],
-      groupId: null
+      tenants: { allowed: [PERSONAL_TENANT], default: PERSONAL_TENANT }
     });
   });
 

package/src/oauth/tokens.ts

@@ -1,7 +1,13 @@
 import { randomUUID } from 'crypto';
 import jwt from 'jsonwebtoken';
 import { requireEnv } from '../config/env';
-import { isApiKeyScope, type ApiKeyScope } from '../apiKeys/types';
+import {
+  isApiKeyScope,
+  readTenants,
+  type ApiKeyScope,
+  type ApiKeyTenant,
+  type Tenant
+} from '../apiKeys/types';
 
 /**
  * Access tokens for the OAuth flow that lets an assistant connect to Tumbaland.
@@ -27,8 +33,22 @@ export interface AccessTokenClaims {
   aud: string;
   iss: string;
   scope: string;
-  /** the tenant the token is pinned to; null means the user's personal data */
-  groupId: string | null;
+  /** every tenant this token may act in */
+  tenants: Tenant[];
+  /** the one it acts in when a call names none */
+  defaultTenant: Tenant;
+  /**
+   * What each tenant is called, for a client that has to offer the choice.
+   *
+   * Carried on the token because the only place these names are known is the
+   * consent screen that rendered them, and the MCP server — which has to name
+   * the choice to a model — cannot reach group-service. A snapshot: a group
+   * renamed after the connection was made shows its old name until reconnect,
+   * which is the same trade the owner's name on an API key already makes.
+   */
+  tenantNames: Record<Tenant, string>;
+  /** the single tenant an older token was pinned to; read by `readTenants` */
+  groupId?: string | null;
   email: string;
   name: string;
   typ: typeof ACCESS_TOKEN_TYPE;
@@ -45,7 +65,9 @@ export interface MintAccessTokenInput {
   resource: string;
   issuer: string;
   scopes: ApiKeyScope[];
-  groupId: string | null;
+  tenants: Tenant[];
+  defaultTenant: Tenant;
+  tenantNames: Record<Tenant, string>;
 }
 
 export interface MintedAccessToken {
@@ -63,7 +85,9 @@ export const mintAccessToken = (input: MintAccessTokenInput): MintedAccessToken
       aud: input.resource,
       iss: input.issuer,
       scope,
-      groupId: input.groupId,
+      tenants: input.tenants,
+      defaultTenant: input.defaultTenant,
+      tenantNames: input.tenantNames,
       email: input.email,
       name: input.name,
       typ: ACCESS_TOKEN_TYPE,
@@ -83,7 +107,8 @@ export interface AccessTokenVerification {
   email?: string;
   name?: string;
   scopes?: ApiKeyScope[];
-  groupId?: string | null;
+  tenants?: ApiKeyTenant;
+  tenantNames?: Record<Tenant, string>;
 }
 
 /**
@@ -118,7 +143,8 @@ export const verifyAccessToken = (
     email: claims.email ?? '',
     name: claims.name ?? '',
     scopes: (claims.scope ?? '').split(' ').filter(isApiKeyScope),
-    groupId: claims.groupId ?? null
+    tenants: readTenants(claims),
+    tenantNames: claims.tenantNames ?? {}
   };
 };