@zereight/mcp-gitlab 2.2.5 → 2.3.0

package/build/oauth-consent.js

@@ -0,0 +1,323 @@
+/**
+ * Callback-proxy safeguards (GITLAB_OAUTH_CALLBACK_PROXY=true).
+ *
+ * In callback-proxy mode GitLab only sees the server's fixed /callback URL,
+ * so GitLab cannot check where the proxy authorization code goes next. Any
+ * caller can register a client through DCR, so two checks run on this server
+ * before the user is sent to GitLab:
+ *
+ * 1. The client's redirect_uri must match GITLAB_OAUTH_ALLOWED_REDIRECT_URIS
+ *    (default: known MCP client callbacks plus loopback).
+ * 2. The user approves the client on a consent page that shows where the
+ *    code will be sent. Approval is remembered per client_id + redirect_uri
+ *    in a signed cookie.
+ */
+import { createHash, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { redirectUriMatches } from "@modelcontextprotocol/sdk/server/auth/handlers/authorize.js";
+import { deriveSubkey, STATELESS_PURPOSES } from "./stateless/index.js";
+// ---------------------------------------------------------------------------
+// Redirect URI allowlist
+// ---------------------------------------------------------------------------
+/**
+ * Callbacks accepted when GITLAB_OAUTH_ALLOWED_REDIRECT_URIS is unset.
+ * Loopback entries accept any port (RFC 8252 §7.3) and any path.
+ */
+export const DEFAULT_ALLOWED_REDIRECT_URIS = [
+    "https://claude.ai/api/mcp/auth_callback",
+    "https://claude.com/api/mcp/auth_callback",
+    "https://chatgpt.com/connector_platform_oauth_redirect",
+    "https://chatgpt.com/connector/oauth/*",
+    "cursor://anysphere.cursor-mcp/oauth/callback",
+    "http://localhost/*",
+    "http://127.0.0.1/*",
+    "http://[::1]/*",
+];
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
+function parseRule(entry) {
+    if (entry === "*")
+        return { kind: "any" };
+    const isPrefix = entry.endsWith("*");
+    const raw = isPrefix ? entry.slice(0, -1) : entry;
+    if (raw.includes("*")) {
+        throw new Error(`GITLAB_OAUTH_ALLOWED_REDIRECT_URIS: "${entry}" may only use * at the end`);
+    }
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new Error(`GITLAB_OAUTH_ALLOWED_REDIRECT_URIS: "${entry}" is not a valid URL`);
+    }
+    if (url.hash || url.username || url.password) {
+        throw new Error(`GITLAB_OAUTH_ALLOWED_REDIRECT_URIS: "${entry}" must not contain a fragment or credentials`);
+    }
+    if (!isPrefix)
+        return { kind: "exact", uri: entry };
+    // Require "/*" so "https://client.example/app*" cannot be read as also
+    // covering /application or /app-evil.
+    if (!raw.endsWith("/") || url.search) {
+        throw new Error(`GITLAB_OAUTH_ALLOWED_REDIRECT_URIS: "${entry}" must end with "/*", e.g. https://client.example/oauth/*`);
+    }
+    return { kind: "prefix", base: url };
+}
+function ruleMatches(rule, requested, url) {
+    switch (rule.kind) {
+        case "any":
+            return true;
+        case "exact":
+            return redirectUriMatches(requested, rule.uri);
+        case "prefix": {
+            const { base } = rule;
+            if (url.protocol !== base.protocol || url.hostname !== base.hostname)
+                return false;
+            if (!LOOPBACK_HOSTS.has(base.hostname) && url.port !== base.port)
+                return false;
+            // URL parsing already resolved "." / ".." segments.
+            return url.pathname.startsWith(base.pathname);
+        }
+    }
+}
+/**
+ * Split a GITLAB_OAUTH_ALLOWED_REDIRECT_URIS value into entries. Unset or
+ * empty means the defaults; the token "defaults" expands to them inside a
+ * list so operators can add entries without copying the built-in ones.
+ */
+export function parseAllowedRedirectUris(raw) {
+    const parts = (raw ?? "")
+        .split(",")
+        .map(part => part.trim())
+        .filter(Boolean);
+    if (parts.length === 0)
+        return [...DEFAULT_ALLOWED_REDIRECT_URIS];
+    return parts.flatMap(part => (part === "defaults" ? [...DEFAULT_ALLOWED_REDIRECT_URIS] : [part]));
+}
+export class RedirectUriPolicy {
+    _rules;
+    entries;
+    constructor(entries) {
+        this.entries = [...entries];
+        this._rules = entries.map(parseRule);
+    }
+    /** True when the operator opted out with "*". */
+    get allowsAny() {
+        return this._rules.some(rule => rule.kind === "any");
+    }
+    allows(redirectUri) {
+        let url;
+        try {
+            url = new URL(redirectUri);
+        }
+        catch {
+            return false;
+        }
+        // OAuth redirect URIs must not carry a fragment (RFC 6749 §3.1.2).
+        if (url.hash || url.username || url.password)
+            return false;
+        return this._rules.some(rule => ruleMatches(rule, redirectUri, url));
+    }
+}
+// ---------------------------------------------------------------------------
+// Consent page
+// ---------------------------------------------------------------------------
+const CSRF_COOKIE = "gitlab_mcp_oauth_csrf";
+const CONSENT_COOKIE_PREFIX = "gitlab_mcp_oauth_consent_";
+const CSRF_TTL_SECONDS = 10 * 60;
+export const CONSENT_TTL_SECONDS = 30 * 24 * 60 * 60;
+const CSRF_TOKEN_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+const MAX_CLIENT_NAME_LENGTH = 80;
+function escapeHtml(value) {
+    return value
+        .replace(/&/g, "&")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;");
+}
+function parseCookies(header) {
+    const cookies = new Map();
+    if (!header)
+        return cookies;
+    for (const part of header.split(";")) {
+        const eq = part.indexOf("=");
+        if (eq <= 0)
+            continue;
+        const name = part.slice(0, eq).trim();
+        if (!cookies.has(name))
+            cookies.set(name, part.slice(eq + 1).trim());
+    }
+    return cookies;
+}
+function bodyField(body, name) {
+    if (!body || typeof body !== "object")
+        return undefined;
+    const value = body[name];
+    return typeof value === "string" ? value : undefined;
+}
+function safeEqual(a, b) {
+    const left = Buffer.from(a);
+    const right = Buffer.from(b);
+    return left.length === right.length && timingSafeEqual(left, right);
+}
+function describeRedirect(redirectUri) {
+    const url = new URL(redirectUri);
+    if (LOOPBACK_HOSTS.has(url.hostname)) {
+        return `an app on your own computer (${url.protocol}//${url.host})`;
+    }
+    return `${url.protocol}//${url.host}`;
+}
+export class ConsentGate {
+    _resourceName;
+    _secure;
+    _rememberKey;
+    constructor(options) {
+        this._resourceName = options.resourceName;
+        this._secure = options.secureCookies;
+        // Without stateless material the key is per process: approvals are asked
+        // again after a restart, which is the safe direction.
+        this._rememberKey = options.stateless
+            ? deriveSubkey(options.stateless, "current", STATELESS_PURPOSES.OAUTH_CONSENT)
+            : randomBytes(32);
+    }
+    /**
+     * Decide whether /authorize may continue to GitLab. Shows the consent page
+     * on first use, checks the submitted form, and honours a remembered approval.
+     */
+    check(client, params, res) {
+        const req = res.req;
+        const cookies = parseCookies(req?.headers?.cookie);
+        const action = req?.method === "POST" ? bodyField(req.body, "consent_action") : undefined;
+        if (action !== undefined) {
+            const submitted = bodyField(req.body, "consent_csrf");
+            const expected = cookies.get(this._cookieName(CSRF_COOKIE));
+            if (!submitted || !expected || !safeEqual(submitted, expected)) {
+                this._sendPage(res, 403, "Approval expired", "<p>This approval form expired or was not sent from this server. Start the sign-in again from your MCP client.</p>");
+                return "handled";
+            }
+            if (action !== "approve") {
+                const target = new URL(params.redirectUri);
+                target.searchParams.set("error", "access_denied");
+                target.searchParams.set("error_description", "The user denied the request");
+                if (params.state)
+                    target.searchParams.set("state", params.state);
+                res.redirect(302, target.toString());
+                return "handled";
+            }
+            this._rememberApproval(res, client.client_id, params.redirectUri);
+            return "proceed";
+        }
+        if (this._isRemembered(cookies, client.client_id, params.redirectUri))
+            return "proceed";
+        this._renderConsent(res, cookies, client, params);
+        return "handled";
+    }
+    _cookieName(base) {
+        // __Host- cookies cannot be set or overwritten by sibling subdomains.
+        return this._secure ? `__Host-${base}` : base;
+    }
+    _cookieAttributes(maxAgeSeconds) {
+        return `Path=/; Max-Age=${maxAgeSeconds}; HttpOnly; SameSite=Lax${this._secure ? "; Secure" : ""}`;
+    }
+    _approvalCookieName(clientId, redirectUri) {
+        const digest = createHash("sha256").update(`${clientId}\n${redirectUri}`).digest("hex");
+        return this._cookieName(`${CONSENT_COOKIE_PREFIX}${digest.slice(0, 16)}`);
+    }
+    _approvalSignature(clientId, redirectUri, expiresAt) {
+        return createHmac("sha256", this._rememberKey)
+            .update(`v1\n${clientId}\n${redirectUri}\n${expiresAt}`)
+            .digest("base64url");
+    }
+    _isRemembered(cookies, clientId, redirectUri) {
+        const value = cookies.get(this._approvalCookieName(clientId, redirectUri));
+        if (!value)
+            return false;
+        const [expiresRaw, signature] = value.split(".");
+        const expiresAt = Number(expiresRaw);
+        if (!signature || !Number.isInteger(expiresAt) || expiresAt <= Math.floor(Date.now() / 1000)) {
+            return false;
+        }
+        return safeEqual(signature, this._approvalSignature(clientId, redirectUri, expiresAt));
+    }
+    _rememberApproval(res, clientId, redirectUri) {
+        const expiresAt = Math.floor(Date.now() / 1000) + CONSENT_TTL_SECONDS;
+        const value = `${expiresAt}.${this._approvalSignature(clientId, redirectUri, expiresAt)}`;
+        res.setHeader("Set-Cookie", [
+            `${this._approvalCookieName(clientId, redirectUri)}=${value}; ${this._cookieAttributes(CONSENT_TTL_SECONDS)}`,
+            `${this._cookieName(CSRF_COOKIE)}=; ${this._cookieAttributes(0)}`,
+        ]);
+    }
+    _renderConsent(res, cookies, client, params) {
+        // Reuse a live token so two open sign-in tabs do not invalidate each other.
+        const existing = cookies.get(this._cookieName(CSRF_COOKIE));
+        const csrf = existing && CSRF_TOKEN_PATTERN.test(existing)
+            ? existing
+            : randomBytes(32).toString("base64url");
+        res.setHeader("Set-Cookie", `${this._cookieName(CSRF_COOKIE)}=${csrf}; ${this._cookieAttributes(CSRF_TTL_SECONDS)}`);
+        const rawName = client.client_name?.trim() || "Unnamed client";
+        const clientName = rawName.length > MAX_CLIENT_NAME_LENGTH
+            ? `${rawName.slice(0, MAX_CLIENT_NAME_LENGTH)}…`
+            : rawName;
+        const fields = {
+            client_id: client.client_id,
+            redirect_uri: params.redirectUri,
+            response_type: "code",
+            code_challenge: params.codeChallenge,
+            code_challenge_method: "S256",
+            scope: params.scopes && params.scopes.length > 0 ? params.scopes.join(" ") : undefined,
+            state: params.state,
+            resource: params.resource?.href,
+            consent_csrf: csrf,
+        };
+        const hidden = Object.entries(fields)
+            .filter((entry) => entry[1] !== undefined)
+            .map(([name, value]) => `<input type="hidden" name="${name}" value="${escapeHtml(value)}">`)
+            .join("\n      ");
+        const scopes = params.scopes && params.scopes.length > 0 ? params.scopes.join(", ") : "default";
+        this._sendPage(res, 200, "Approve MCP client", `<p>An MCP client wants to use ${escapeHtml(this._resourceName)} with your GitLab account.</p>
+    <p class="label">After you sign in to GitLab, access is sent to</p>
+    <p class="target">${escapeHtml(describeRedirect(params.redirectUri))}</p>
+    <p class="uri">${escapeHtml(params.redirectUri)}</p>
+    <p class="label">Client name (chosen by the client, not verified)</p>
+    <p>${escapeHtml(clientName)}</p>
+    <p class="label">Requested scopes</p>
+    <p>${escapeHtml(scopes)}</p>
+    <p class="warn">Approve only if you started this sign-in from your own MCP client and you recognize the address above.</p>
+    <form method="post">
+      ${hidden}
+      <button type="submit" name="consent_action" value="approve">Approve</button>
+      <button type="submit" name="consent_action" value="deny">Deny</button>
+    </form>`);
+    }
+    _sendPage(res, status, title, body) {
+        // No form-action directive: browsers apply it to the redirects that follow
+        // the POST (GitLab, then the client callback).
+        res.setHeader("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'; base-uri 'none'");
+        res.setHeader("X-Frame-Options", "DENY");
+        res.setHeader("X-Content-Type-Options", "nosniff");
+        res.setHeader("Referrer-Policy", "no-referrer");
+        res.setHeader("Cache-Control", "no-store");
+        res.setHeader("Content-Type", "text/html; charset=utf-8");
+        res.status(status).send(`<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>${escapeHtml(title)}</title>
+  <style>
+    body { font-family: system-ui, sans-serif; max-width: 34rem; margin: 3rem auto; padding: 0 1rem; color: #1f1f1f; }
+    .label { margin-bottom: 0.2rem; color: #555; font-size: 0.9rem; }
+    .label + p { margin-top: 0; }
+    .target { font-size: 1.25rem; font-weight: 600; }
+    .uri { word-break: break-all; color: #555; font-family: ui-monospace, monospace; font-size: 0.85rem; }
+    .warn { margin: 1.5rem 0; }
+    button { font-size: 1rem; padding: 0.5rem 1.25rem; margin-right: 0.5rem; }
+  </style>
+</head>
+<body>
+  <main>
+    <h1>${escapeHtml(title)}</h1>
+    ${body}
+  </main>
+</body>
+</html>`);
+    }
+}

package/build/oauth-proxy.js

@@ -44,12 +44,13 @@
  *
  * Activated when GITLAB_MCP_OAUTH=true. All other auth modes are unaffected.
  */
-import { InvalidTokenError, ServerError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
+import { CustomOAuthError, InsufficientScopeError, InvalidGrantError, InvalidTokenError, ServerError, } from "@modelcontextprotocol/sdk/server/auth/errors.js";
 import { OAuthTokensSchema } from "@modelcontextprotocol/sdk/shared/auth.js";
 import { randomUUID, randomBytes, createHash } from "node:crypto";
 import { looksLikeStatelessClientId, mintClientId, openClientId, } from "./stateless/client-id.js";
 import { looksLikeStatelessState, mintPendingAuthState, openPendingAuthState, } from "./stateless/pending-auth.js";
 import { looksLikeStatelessStoredTokensCode, mintStoredTokensCode, openStoredTokensCode, ConsumedProxyCodeCache, PROXY_CODE_CACHE_FULL, } from "./stateless/index.js";
+import { ConsentGate, DEFAULT_ALLOWED_REDIRECT_URIS, RedirectUriPolicy } from "./oauth-consent.js";
 import { createLogger } from "./utils/logger.js";
 import { redactUrlSecretsInText } from "./utils/redact-url.js";
 const logger = createLogger("gitlab-mcp-oauth-proxy");
@@ -68,6 +69,9 @@ const REQUIRED_GITLAB_SCOPES_RO = ["read_api"];
 const PENDING_AUTH_MAX_SIZE = 1000;
 const PENDING_AUTH_TTL_MS = 10 * 60 * 1000; // 10 minutes
 const CLIENT_CACHE_MAX_SIZE = 1000;
+const GROUP_MEMBERSHIP_CACHE_MAX_SIZE = 1000;
+const GROUP_MEMBERSHIP_CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes
+const GROUP_ACCESS_DENIED_MESSAGE = "Access denied: user is not a member of an allowed group";
 function singleQueryParam(value) {
     return typeof value === "string" ? value : undefined;
 }
@@ -143,9 +147,15 @@ class GitLabOAuthServerProvider {
     _stateless;
     // Group allowlist (optional). When set, tokens are rejected unless the
     // authenticated user is a direct or inherited member of at least one group.
-    // Checked once at token issuance (exchangeAuthorizationCode), not per request.
+    // Checked at token issuance, on refresh and on every verified request; the
+    // result is cached per token (keyed by SHA-256) for GROUP_MEMBERSHIP_CACHE_TTL_MS.
     _allowedGroups;
-    constructor(gitlabBaseUrl, gitlabAppId, resourceName, readOnly, customScopes, allowedGroups, callbackProxyEnabled = false, callbackUrl = "", stateless = null) {
+    _groupMembershipCache = new BoundedLRUMap(GROUP_MEMBERSHIP_CACHE_MAX_SIZE);
+    // Callback proxy safeguards (see oauth-consent.ts). Null in passthrough
+    // mode, where GitLab checks redirect_uri against the app registration.
+    _redirectPolicy = null;
+    _consent = null;
+    constructor(gitlabBaseUrl, gitlabAppId, resourceName, readOnly, customScopes, allowedGroups, callbackProxyEnabled = false, callbackUrl = "", stateless = null, allowedRedirectUris = DEFAULT_ALLOWED_REDIRECT_URIS) {
         this._gitlabBaseUrl = gitlabBaseUrl;
         this._gitlabAppId = gitlabAppId;
         this._resourceName = resourceName;
@@ -163,7 +173,17 @@ class GitLabOAuthServerProvider {
             throw new Error("callbackUrl is required when callbackProxyEnabled is true");
         }
         if (callbackProxyEnabled) {
+            this._redirectPolicy = new RedirectUriPolicy(allowedRedirectUris);
+            this._consent = new ConsentGate({
+                resourceName,
+                secureCookies: callbackUrl.startsWith("https:"),
+                stateless: stateless?.material ?? null,
+            });
             logger.info(`Callback proxy mode enabled — fixed callback URL: ${redactUrlSecretsInText(callbackUrl)}`);
+            if (this._redirectPolicy.allowsAny) {
+                logger.warn("GITLAB_OAUTH_ALLOWED_REDIRECT_URIS contains \"*\": any registered client may receive " +
+                    "authorization codes; only the consent page stands between a phishing link and a user's GitLab token");
+            }
         }
         if (stateless) {
             logger.info(`Stateless mode enabled (client_id TTL: ${stateless.clientTtlSeconds}s, ` +
@@ -176,6 +196,7 @@ class GitLabOAuthServerProvider {
         const cache = this._clientCache;
         const resourceName = this._resourceName;
         const stateless = this._stateless;
+        const redirectPolicy = this._redirectPolicy;
         return {
             getClient: async (clientId) => {
                 // Stateless path: a signed client_id carries the registration.
@@ -212,6 +233,18 @@ class GitLabOAuthServerProvider {
             registerClient: async (client) => {
                 const grantTypes = client.grant_types ?? ["authorization_code"];
                 const redirectUris = client.redirect_uris ?? [];
+                // Callback proxy mode: GitLab never sees the client's redirect_uri, so
+                // this server is the only place it can be checked.
+                const rejected = redirectPolicy
+                    ? redirectUris.filter((uri) => !redirectPolicy.allows(uri))
+                    : [];
+                if (rejected.length > 0) {
+                    logger.warn(`DCR: rejected redirect_uris not allowed by GITLAB_OAUTH_ALLOWED_REDIRECT_URIS: ${rejected
+                        .map((uri) => JSON.stringify(redactUrlSecretsInText(uri)))
+                        .join(", ")}`);
+                    throw new CustomOAuthError("invalid_redirect_uri", `redirect_uri ${rejected[0]} is not allowed by this server. ` +
+                        "The server operator can add it to GITLAB_OAUTH_ALLOWED_REDIRECT_URIS.");
+                }
                 const clientName = client.client_name
                     ? `${client.client_name} via ${resourceName}`
                     : resourceName;
@@ -262,6 +295,24 @@ class GitLabOAuthServerProvider {
         const targetUrl = new URL(`${this._gitlabBaseUrl}/oauth/authorize`);
         if (this._callbackProxyEnabled) {
             // --- Callback proxy mode ---
+            // Re-check the policy here too: signed client_ids minted before an
+            // upgrade or allowlist change still carry their old redirect_uris.
+            // Answer directly; redirecting the error would send the browser to
+            // the URI we just refused.
+            if (this._redirectPolicy && !this._redirectPolicy.allows(params.redirectUri)) {
+                logger.warn(`authorize (callback proxy): refused redirect_uri ${JSON.stringify(redactUrlSecretsInText(params.redirectUri))} (not in GITLAB_OAUTH_ALLOWED_REDIRECT_URIS)`);
+                res.status(400).json({
+                    error: "invalid_request",
+                    error_description: "redirect_uri is not allowed by this server",
+                });
+                return;
+            }
+            // Ask the user before sending them to GitLab. Without this, any link
+            // to /authorize gets the operator's GitLab app consent screen and the
+            // resulting code goes to whichever client registered the link.
+            if (this._consent && this._consent.check(client, params, res) === "handled") {
+                return;
+            }
             // Generate a proxy PKCE pair (MCP server ↔ GitLab)
             const proxyCodeVerifier = randomBytes(32).toString("base64url");
             const proxyCodeChallenge = createHash("sha256")
@@ -453,12 +504,9 @@ class GitLabOAuthServerProvider {
                 const data = await response.json();
                 tokens = OAuthTokensSchema.parse(data);
             }
-            if (this._allowedGroups) {
-                const isMember = await this._checkGroupMembership(tokens.access_token);
-                if (!isMember) {
-                    logger.warn({ allowedGroups: this._allowedGroups }, "Token issuance denied: user is not a member of any allowed group");
-                    throw new ServerError("Access denied: user is not a member of an allowed group");
-                }
+            if (!(await this.isAllowedGroupMember(tokens.access_token))) {
+                logger.warn({ allowedGroups: this._allowedGroups }, "Token issuance denied: user is not a member of any allowed group");
+                throw new ServerError(GROUP_ACCESS_DENIED_MESSAGE);
             }
             // All checks passed — permanently consume the proxy code.
             legacyRestorable = null;
@@ -478,12 +526,33 @@ class GitLabOAuthServerProvider {
             throw err;
         }
     }
+    /**
+     * Returns true when no allowed groups are configured, or when the token
+     * owner belongs to one of them (see _checkGroupMembership). Results are
+     * cached per token for GROUP_MEMBERSHIP_CACHE_TTL_MS; failed lookups are not.
+     */
+    async isAllowedGroupMember(token) {
+        if (!this._allowedGroups)
+            return true;
+        const key = createHash("sha256").update(token).digest("hex");
+        const cached = this._groupMembershipCache.get(key);
+        if (cached && cached.expiresAt > Date.now())
+            return cached.isMember;
+        const isMember = await this._checkGroupMembership(token);
+        this._groupMembershipCache.set(key, {
+            isMember,
+            expiresAt: Date.now() + GROUP_MEMBERSHIP_CACHE_TTL_MS,
+        });
+        return isMember;
+    }
     /**
      * Returns true if the token owner belongs to at least one group whose
      * full_path equals or is a sub-path of any configured allowed group.
      *
      * Example: allowedGroups=["my-org"] allows members of "my-org",
      * "my-org/team-a", "my-org/team-a/squad-1", etc.
+     *
+     * Throws when GitLab is unavailable (5xx / 429) so the result is not cached.
      */
     async _checkGroupMembership(token) {
         const allowedPaths = this._allowedGroups.map((g) => g.toLowerCase());
@@ -492,6 +561,10 @@ class GitLabOAuthServerProvider {
             const res = await fetch(`${this._gitlabBaseUrl}/api/v4/groups?min_access_level=10&per_page=100&page=${page}`, {
                 headers: { Authorization: `Bearer ${token}` }
             });
+            if (res.status >= 500 || res.status === 429) {
+                await res.body?.cancel();
+                throw new ServerError(`Group membership lookup failed: ${res.status}`);
+            }
             if (!res.ok)
                 break;
             const groups = (await res.json());
@@ -532,7 +605,12 @@ class GitLabOAuthServerProvider {
             throw new ServerError(`Token refresh failed: ${response.status}`);
         }
         const data = await response.json();
-        return OAuthTokensSchema.parse(data);
+        const tokens = OAuthTokensSchema.parse(data);
+        if (!(await this.isAllowedGroupMember(tokens.access_token))) {
+            logger.warn({ allowedGroups: this._allowedGroups }, "Token refresh denied: user is not a member of any allowed group");
+            throw new InvalidGrantError(GROUP_ACCESS_DENIED_MESSAGE);
+        }
+        return tokens;
     }
     // ---- Verify access token -----------------------------------------------
     async verifyAccessToken(token) {
@@ -552,6 +630,11 @@ class GitLabOAuthServerProvider {
             throw new InvalidTokenError("Invalid or expired GitLab OAuth token");
         }
         const info = (await res.json());
+        // 403 rather than 401: the token itself is valid, so asking the client to
+        // re-authenticate as the same user would not help.
+        if (!(await this.isAllowedGroupMember(token))) {
+            throw new InsufficientScopeError(GROUP_ACCESS_DENIED_MESSAGE);
+        }
         return {
             token,
             clientId: info.application?.uid ?? "dynamic",
@@ -559,6 +642,8 @@ class GitLabOAuthServerProvider {
             expiresAt: info.expires_in_seconds != null
                 ? Math.floor(Date.now() / 1000) + info.expires_in_seconds
                 : undefined,
+            // GitLab user id; stateful /mcp sessions are bound to it.
+            extra: { resourceOwnerId: info.resource_owner_id },
         };
     }
     // ---- Callback handler (callback proxy mode) ----------------------------
@@ -724,7 +809,9 @@ class GitLabOAuthServerProvider {
  * @param stateless      Optional stateless-mode options. When set, DCR and later
  *                        callback-proxy state is encoded into opaque OAuth values
  *                        instead of an in-memory cache, enabling multi-pod deploys.
+ * @param allowedRedirectUris  Callback proxy mode only: client redirect URIs that
+ *                        may register and receive codes (see oauth-consent.ts).
  */
-export function createGitLabOAuthProvider(gitlabBaseUrl, gitlabAppId, resourceName = "GitLab MCP Server", readOnly = false, customScopes, allowedGroups, callbackProxyEnabled = false, callbackUrl = "", stateless = null) {
-    return new GitLabOAuthServerProvider(gitlabBaseUrl, gitlabAppId, resourceName, readOnly, customScopes, allowedGroups, callbackProxyEnabled, callbackUrl, stateless);
+export function createGitLabOAuthProvider(gitlabBaseUrl, gitlabAppId, resourceName = "GitLab MCP Server", readOnly = false, customScopes, allowedGroups, callbackProxyEnabled = false, callbackUrl = "", stateless = null, allowedRedirectUris = DEFAULT_ALLOWED_REDIRECT_URIS) {
+    return new GitLabOAuthServerProvider(gitlabBaseUrl, gitlabAppId, resourceName, readOnly, customScopes, allowedGroups, callbackProxyEnabled, callbackUrl, stateless, allowedRedirectUris);
 }