a2a-exposed 0.4.1 → 0.6.0

package/worker/test/alarms.test.ts

@@ -0,0 +1,231 @@
+// Hosted Durable Object alarms replace the minute cron flush. Self-host scheduled() still runs that flush.
+// Run: npm test
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+import { createRequire } from "node:module";
+import { fileURLToPath } from "node:url";
+import { Miniflare, convertV4MiniflareOptions } from "miniflare";
+import worker, { cronFlush, nextCronAt } from "../src/index.ts";
+import { d1 } from "./d1.ts";
+import { sha256 } from "../src/a2a.ts";
+import { resolveTenant } from "../src/tenancy.ts";
+
+const MIGRATIONS = new URL("../migrations/", import.meta.url);
+const ectx = { waitUntil(_p: Promise<unknown>) {}, passThroughOnException() {} };
+
+function ctx(over: Record<string, string> = {}) {
+	const DB = d1(MIGRATIONS);
+	const env = { DB, PUBLIC_URL: "https://agent.example.com", OWNER_TOKEN: "owner-secret", WAKE_PRESET: "generic",
+		WAKE_DEBOUNCE_SECONDS: "10", WAKE_MAX_PER_HOUR: "0", ...over };
+	return { DB, env, tenant: resolveTenant(env as never) };
+}
+
+test("nextCronAt is the earliest wake, rate row, or expiry", async () => {
+	const { DB, tenant } = ctx();
+	assert.equal(await nextCronAt(tenant, 1_700_000_000_000), null);
+	const now = 1_700_000_000_000;
+	await DB.prepare("INSERT INTO wakes (context_id, last_sent_ms, pending_json, pending_since_ms) VALUES ('c', ?, '{\"kind\":\"inbound\"}', ?)").bind(now - 5000, now).run();
+	assert.equal(await nextCronAt(tenant, now), now - 5000 + 10_000);
+	await DB.prepare("INSERT INTO rate (peer, minute, count) VALUES ('p', 1, 2)").run();
+	assert.equal(await nextCronAt(tenant, now), 7 * 60_000);
+	await DB.prepare("DELETE FROM wakes").run();
+	await DB.prepare("DELETE FROM rate").run();
+	await DB.prepare("INSERT INTO oauth_codes (code_hash, client_id, redirect_uri, code_challenge, scope, resource, created_ms, expires_ms) VALUES ('h', 'c', 'https://example.com/cb', 'ch', 's', 'https://agent.example.com/mcp', 1, ?)").bind(now + 5000).run();
+	await DB.prepare("INSERT INTO device_requests (device_hash, user_code, status, created_ms, expires_ms, interval_s) VALUES ('d', 'WDJB4827', 'pending', 1, ?, 5)").bind(now).run();
+	assert.equal(await nextCronAt(tenant, now), now + 5001);
+	await DB.prepare("DELETE FROM oauth_codes").run();
+	await DB.prepare("DELETE FROM device_requests").run();
+	await DB.prepare("INSERT INTO oidc_txns (state, nonce, verifier, kind, csrf, payload_json, expires_ms) VALUES ('s', 'n', 'v', 'device', 'c', '{}', ?)").bind(now + 800).run();
+	assert.equal(await nextCronAt(tenant, now), now + 801);
+});
+
+test("an hourly cap holds an already-due wake until the next hour", async () => {
+	const now = 1_700_000_000_000;
+	const hour = Math.floor(now / 3600000);
+	const { DB, tenant } = ctx({ WAKE_MAX_PER_HOUR: "2" });
+	await DB.prepare("INSERT INTO wake_budget (hour, count) VALUES (?, 2)").bind(hour).run();
+	await DB.prepare("INSERT INTO wakes (context_id, last_sent_ms, pending_json, pending_since_ms) VALUES ('c', ?, '{}', ?)").bind(now - 60_000, now).run();
+	assert.equal(await nextCronAt(tenant, now), (hour + 1) * 3600000);
+});
+
+test("self-host scheduled still deletes expired housekeeping rows", async () => {
+	const { DB, env, tenant } = ctx();
+	const minute = Math.floor(Date.now() / 60000);
+	await DB.prepare("INSERT INTO rate (peer, minute, count) VALUES ('old', 1, 3)").run();
+	await DB.prepare("INSERT INTO rate (peer, minute, count) VALUES ('new', ?, 1)").bind(minute).run();
+	await DB.prepare("INSERT INTO oauth_codes (code_hash, client_id, redirect_uri, code_challenge, scope, resource, created_ms, expires_ms) VALUES ('h', 'c', 'https://example.com/cb', 'ch', 's', 'https://agent.example.com/mcp', 1, 1)").run();
+	await DB.prepare("INSERT INTO oidc_txns (state, nonce, verifier, kind, csrf, payload_json, expires_ms) VALUES ('s', 'n', 'v', 'device', 'c', '{}', 1)").run();
+	await worker.scheduled({ cron: "* * * * *" } as never, env as never, ectx as never);
+	assert.equal(await DB.prepare("SELECT peer FROM rate WHERE peer = 'old'").first(), null);
+	assert.equal(await DB.prepare("SELECT state FROM oidc_txns").first(), null);
+	assert.equal((await DB.prepare("SELECT peer FROM rate WHERE peer = 'new'").first<{ peer: string }>())?.peer, "new");
+	assert.equal(await DB.prepare("SELECT code_hash FROM oauth_codes").first(), null);
+	await cronFlush(tenant, ectx as never);
+	assert.equal((await DB.prepare("SELECT peer FROM rate WHERE peer = 'new'").first<{ peer: string }>())?.peer, "new");
+});
+
+const require = createRequire(new URL("../package.json", import.meta.url));
+
+function bundleHosted(): Promise<string> {
+	const { build } = require("esbuild") as typeof import("esbuild");
+	return build({
+		entryPoints: [fileURLToPath(new URL("../src/hosted.ts", import.meta.url))],
+		bundle: true,
+		format: "esm",
+		write: false,
+		platform: "neutral",
+		external: ["cloudflare:*"],
+		target: "es2022",
+		logLevel: "silent",
+		plugins: [{
+			name: "sql-raw",
+			setup(b) {
+				b.onResolve({ filter: /\.sql\?raw$/ }, (args) => ({
+					path: path.resolve(args.resolveDir, args.path.replace(/\?raw$/, "")),
+					namespace: "sql-raw",
+				}));
+				b.onLoad({ filter: /.*/, namespace: "sql-raw" }, (args) => ({
+					contents: `export default ${JSON.stringify(fs.readFileSync(args.path, "utf8"))};`,
+					loader: "js",
+				}));
+			},
+		}],
+	}).then((built) => {
+		const file = built.outputFiles?.[0];
+		if (!file) throw new Error("hosted bundle was empty");
+		return file.text;
+	});
+}
+
+test("a hosted tenant arms an alarm for a debounced wake and the alarm flushes it", async (t) => {
+	const mf = new Miniflare(convertV4MiniflareOptions({
+		name: "a2a",
+		modules: true,
+		script: await bundleHosted(),
+		compatibilityDate: "2026-10-06",
+		d1Databases: { DB: "unused" },
+		kvNamespaces: { TENANT_DIRECTORY: "tenants" },
+		durableObjects: { TENANT_DO: { className: "TenantStore", useSQLite: true } },
+		bindings: { TENANCY: "host", TENANT_DOMAIN: "example.com", TENANT_SECRETS_KEY: "platform-secret", OWNER_TOKEN: "platform-owner" },
+	} as never));
+	t.after(() => mf.dispose());
+	await mf.ready;
+	const kv = await mf.getKVNamespace("TENANT_DIRECTORY");
+	const ns = await mf.getDurableObjectNamespace("TENANT_DO");
+	const hash = await sha256("owner-alice");
+	const stub = ns.get(ns.idFromName("id-alice")) as unknown as {
+		pushConfig(b: Record<string, unknown>): Promise<{ applied: boolean }>;
+		alarmAt(): Promise<number | null>;
+		runAlarm(): Promise<void>;
+		fetch(r: Request): Promise<Response>;
+	};
+	assert.equal(await stub.alarmAt(), null);
+	// 30s is past the 25s in-request flush. The second message only writes a pending row, so the alarm has to move off the rate-row timer in that same request.
+	await stub.pushConfig({ version: 1, tenantId: "id-alice", name: "alice", status: "active", ownerTokenHash: hash, config: { WAKE_DEBOUNCE_SECONDS: "30", WAKE_MAX_PER_HOUR: "0", AGENT_NAME: "Alice" } });
+	await kv.put("tenant:alice", JSON.stringify({ id: "id-alice", status: "active", region: "default", version: 1 }));
+	assert.equal(await stub.alarmAt(), null, "an idle tenant has nothing to flush");
+	const send = (text: string, id: string) => mf.dispatchFetch("https://alice.example.com/", {
+		method: "POST",
+		headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+		body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "message/send", params: { message: { kind: "message", role: "user", messageId: id, contextId: "ctx-a", parts: [{ kind: "text", text }] } } }),
+	});
+	const issued = await (await mf.dispatchFetch("https://alice.example.com/owner/peers", {
+		method: "POST", headers: { authorization: "Bearer owner-alice", "content-type": "application/json" }, body: JSON.stringify({ label: "ada" }),
+	})).json() as { token: string };
+	const token = issued.token;
+	assert.equal((await send("one", "m1")).status, 200);
+	const rateAlarm = await stub.alarmAt();
+	assert.ok(rateAlarm && rateAlarm > Date.now() + 4 * 60_000 && rateAlarm < Date.now() + 7 * 60_000, "the request's rate row is the next housekeeping delete");
+	assert.equal((await send("two", "m2")).status, 200);
+	const armed = await stub.alarmAt();
+	assert.ok(armed && armed > Date.now() + 20_000 && armed < Date.now() + 45_000, "the pending wake is due before the rate row");
+
+	// "0" is a real debounce of zero (the string is set). A runtime may run that alarm before this RPC returns.
+	await stub.pushConfig({ version: 2, tenantId: "id-alice", name: "alice", status: "active", ownerTokenHash: hash, config: { WAKE_DEBOUNCE_SECONDS: "0", WAKE_MAX_PER_HOUR: "0", AGENT_NAME: "Alice" } });
+	let after = await stub.alarmAt();
+	if (after && after <= Date.now() + 2000) {
+		await stub.runAlarm();
+		after = await stub.alarmAt();
+	}
+	assert.ok(after && after > Date.now() + 60_000 && after < Date.now() + 7 * 60_000, "the alarm flushed the wake; the rate row is still waiting");
+	const inbox = await (await mf.dispatchFetch("https://alice.example.com/owner/inbox?all=1", {
+		headers: { authorization: "Bearer owner-alice" },
+	})).json() as { text: string }[];
+	assert.equal(inbox.length, 2);
+
+	await stub.pushConfig({ version: 3, tenantId: "id-alice", name: "alice", status: "suspended", ownerTokenHash: hash, config: { AGENT_NAME: "Alice" } });
+	assert.equal(await stub.alarmAt(), null, "a suspended tenant has no alarm");
+});
+
+test("a 429 that arrives after the response re-arms for Retry-After", async (t) => {
+	const { createServer } = await import("node:http");
+	const hits: number[] = [];
+	// Hold the 429 until the inbox has responded, so the retry row is written after fetch returns.
+	let release: () => void = () => {};
+	const hold = new Promise<void>((resolve) => { release = resolve; });
+	const server = createServer((_req, res) => {
+		hits.push(Date.now());
+		void hold.then(() => {
+			if (res.writableEnded) return;
+			res.writeHead(429, { "retry-after": "30" });
+			res.end("slow");
+		});
+	});
+	await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", () => resolve()));
+	const port = (server.address() as { port: number }).port;
+	t.after(() => new Promise((resolve) => server.close(() => resolve(undefined))));
+	const mf = new Miniflare(convertV4MiniflareOptions({
+		name: "a2a",
+		modules: true,
+		script: await bundleHosted(),
+		compatibilityDate: "2026-10-06",
+		d1Databases: { DB: "unused" },
+		kvNamespaces: { TENANT_DIRECTORY: "tenants" },
+		durableObjects: { TENANT_DO: { className: "TenantStore", useSQLite: true } },
+		bindings: { TENANCY: "host", TENANT_DOMAIN: "example.com", TENANT_SECRETS_KEY: "platform-secret", OWNER_TOKEN: "platform-owner" },
+	} as never));
+	t.after(() => mf.dispose());
+	await mf.ready;
+	const kv = await mf.getKVNamespace("TENANT_DIRECTORY");
+	const ns = await mf.getDurableObjectNamespace("TENANT_DO");
+	const hash = await sha256("owner-alice");
+	const stub = ns.get(ns.idFromName("id-alice")) as unknown as {
+		pushConfig(b: Record<string, unknown>): Promise<{ applied: boolean }>;
+		alarmAt(): Promise<number | null>;
+	};
+	await stub.pushConfig({
+		version: 1, tenantId: "id-alice", name: "alice", status: "active", ownerTokenHash: hash,
+		config: { WAKE_DEBOUNCE_SECONDS: "45", WAKE_MAX_PER_HOUR: "0", WAKE_WEBHOOK_URL: `http://127.0.0.1:${port}/hook`, AGENT_NAME: "Alice" },
+	});
+	await kv.put("tenant:alice", JSON.stringify({ id: "id-alice", status: "active", region: "default", version: 1 }));
+	const issued = await (await mf.dispatchFetch("https://alice.example.com/owner/peers", {
+		method: "POST", headers: { authorization: "Bearer owner-alice", "content-type": "application/json" }, body: JSON.stringify({ label: "ada" }),
+	})).json() as { token: string };
+	const sentPromise = mf.dispatchFetch("https://alice.example.com/", {
+		method: "POST",
+		headers: { authorization: `Bearer ${issued.token}`, "content-type": "application/json" },
+		body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "message/send", params: { message: { kind: "message", role: "user", messageId: "m1", contextId: "ctx-a", parts: [{ kind: "text", text: "one" }] } } }),
+	});
+	const waitHit = Date.now() + 4000;
+	while (!hits.length && Date.now() < waitHit) await new Promise((r) => setTimeout(r, 20));
+	assert.equal(hits.length >= 1, true, "the webhook was called");
+	const earlyResponse = await Promise.race([
+		sentPromise.then((r) => r),
+		new Promise<null>((resolve) => setTimeout(() => resolve(null), 2000)),
+	]);
+	assert.ok(earlyResponse, "the inbox returns while the webhook is still held");
+	assert.equal(earlyResponse.status, 200);
+	const before = await stub.alarmAt();
+	assert.ok(before == null || before > Date.now() + 60_000, "the retry alarm is not set before the 429 is written");
+	release();
+	const start = Date.now();
+	let armed: number | null = null;
+	while (Date.now() - start < 4000) {
+		armed = await stub.alarmAt();
+		if (armed && armed < Date.now() + 60_000) break;
+		await new Promise((r) => setTimeout(r, 40));
+	}
+	assert.ok(armed && armed > Date.now() + 20_000 && armed < Date.now() + 40_000, "the alarm is Retry-After (30s), not that delay plus the 45s debounce");
+});

package/worker/test/approval-oidc.test.ts

@@ -0,0 +1,331 @@
+// OpenID Connect approval on /device and /oauth/authorize, against a stub issuer (discovery, token, JWKS).
+// Run: npm test
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import crypto from "node:crypto";
+import worker, { dispatch } from "../src/index.ts";
+import * as M from "../src/mcp.ts";
+import { approvalPolicy } from "../src/approval-oidc.ts";
+import { hostedTenantContext, parseGates, type WorkerBindings } from "../src/tenancy.ts";
+import { d1 } from "./d1.ts";
+
+const BASE = "https://agent.example.com";
+const ISSUER = "https://idp.example";
+const CLIENT = "client-1";
+const SECRET = "oidc-client-secret";
+const GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+
+const { publicKey, privateKey } = crypto.generateKeyPairSync("rsa", { modulusLength: 2048 });
+const jwk = publicKey.export({ format: "jwk" }) as { n: string; e: string; kty: string };
+Object.assign(jwk, { kid: "k1", alg: "RS256", use: "sig" });
+
+function signJwt(payload: Record<string, unknown>, header: Record<string, unknown> = { alg: "RS256", kid: "k1", typ: "JWT" }): string {
+	const h = Buffer.from(JSON.stringify(header)).toString("base64url");
+	const b = Buffer.from(JSON.stringify(payload)).toString("base64url");
+	const data = `${h}.${b}`;
+	if (header.alg === "none") return `${data}.`;
+	const sig = crypto.createSign("RSA-SHA256").update(data).sign(privateKey).toString("base64url");
+	return `${data}.${sig}`;
+}
+
+function claims(over: Record<string, unknown> = {}): Record<string, unknown> {
+	const now = Math.floor(Date.now() / 1000);
+	return { iss: ISSUER, aud: [CLIENT, "other"], azp: CLIENT, sub: "owner-1", exp: now + 300, iat: now, ...over };
+}
+
+function setup(over: Record<string, string> = {}) {
+	const DB = d1(new URL("../migrations/", import.meta.url));
+	const env: any = { DB, PUBLIC_URL: BASE, OWNER_TOKEN: "owner-secret", AGENT_NAME: "Test Inbox", ...over };
+	const tokenBodies: Record<string, string>[] = [];
+	let next: () => Record<string, unknown> = () => claims();
+	const logs: string[] = [];
+	const origLog = console.log;
+	console.log = (line: string) => { logs.push(String(line)); };
+	const origFetch = globalThis.fetch;
+	globalThis.fetch = (async (url: any, init: any = {}) => {
+		const u = new URL(String(url));
+		if (u.origin === ISSUER && u.pathname === "/.well-known/openid-configuration")
+			return Response.json({ issuer: ISSUER, authorization_endpoint: `${ISSUER}/authorize`, token_endpoint: `${ISSUER}/token`, jwks_uri: `${ISSUER}/jwks` });
+		if (u.origin === ISSUER && u.pathname === "/jwks") return Response.json({ keys: [jwk] });
+		if (u.origin === ISSUER && u.pathname === "/token") {
+			tokenBodies.push(Object.fromEntries(new URLSearchParams(String(init.body || ""))));
+			return Response.json({ id_token: signJwt(next()) });
+		}
+		return new Response("ok");
+	}) as any;
+	const call = async (method: string, path: string, o: { form?: Record<string, string>; json?: any; headers?: Record<string, string>; cookie?: string } = {}) => {
+		const headers: Record<string, string> = { "cf-connecting-ip": "198.51.100.7", ...(o.headers || {}) };
+		let body: string | undefined;
+		if (o.form) { headers["content-type"] = "application/x-www-form-urlencoded"; body = new URLSearchParams(o.form).toString(); }
+		if (o.json !== undefined) { headers["content-type"] = "application/json"; body = JSON.stringify(o.json); }
+		if (o.cookie) headers.cookie = o.cookie;
+		const res = await worker.fetch(new Request(BASE + path, { method, headers, body }) as any, env, { waitUntil() {}, passThroughOnException() {} } as any);
+		const text = await res.text();
+		let data: any = text;
+		try { data = JSON.parse(text); } catch { /* html */ }
+		return { status: res.status, headers: res.headers, data, text };
+	};
+	const csrfOf = (text: string, setCookie: string | null) => /name="csrf" value="([^"]+)"/.exec(text)?.[1] || (setCookie || "").split(";")[0].split("=")[1] || "";
+	const start = () => call("POST", "/oauth/device_authorization", { form: { client_name: "Barry Bot", client_id: "barry" } });
+	const page = async (userCode: string) => {
+		const g = await call("GET", `/device?user_code=${userCode}`);
+		const cookie = (g.headers.get("set-cookie") || "").split(";")[0];
+		return { ...g, cookie, csrf: csrfOf(g.text, g.headers.get("set-cookie")) };
+	};
+	const postOidc = async (userCode: string) => {
+		const g = await page(userCode);
+		return { page: g, post: await call("POST", "/device", { form: { csrf: g.csrf, user_code: userCode, decision: "oidc" }, cookie: g.cookie, headers: { origin: BASE } }) };
+	};
+	return {
+		env, DB, tokenBodies, logs, call, start, page, postOidc,
+		setClaims(fn: () => Record<string, unknown>) { next = fn; },
+		restore: () => { globalThis.fetch = origFetch; console.log = origLog; },
+	};
+}
+
+const oidcEnv = {
+	APPROVAL_OIDC_ISSUER: ISSUER, APPROVAL_OIDC_CLIENT_ID: CLIENT, APPROVAL_OIDC_CLIENT_SECRET: SECRET,
+	APPROVAL_OIDC_ALLOWED_SUBJECTS: "owner-1",
+};
+
+test("approval policy: unset is password only; incomplete oidc does not disable the password", () => {
+	const off = parseGates({ DB: {} } as WorkerBindings).gates.approvalOidc;
+	assert.deepEqual(approvalPolicy(off), { oidc: false, password: true, label: "" });
+	const partial = parseGates({ DB: {}, APPROVAL_OIDC_ISSUER: ISSUER, APPROVAL_OIDC_CLIENT_ID: CLIENT, APPROVAL_METHODS: "oidc" } as WorkerBindings).gates.approvalOidc;
+	assert.equal(approvalPolicy(partial).oidc, false);
+	assert.equal(approvalPolicy(partial).password, true, "oidc-only with a missing secret keeps the password");
+	const both = parseGates({ DB: {}, ...oidcEnv } as WorkerBindings).gates.approvalOidc;
+	assert.equal(approvalPolicy(both).oidc, true);
+	assert.equal(approvalPolicy(both).password, true);
+	assert.equal(approvalPolicy(both).label, "idp.example");
+	const explicit = parseGates({ DB: {}, ...oidcEnv, APPROVAL_METHODS: "password" } as WorkerBindings).gates.approvalOidc;
+	assert.equal(approvalPolicy(explicit).oidc, false);
+	assert.equal(approvalPolicy(explicit).password, true);
+	const only = parseGates({ DB: {}, ...oidcEnv, APPROVAL_METHODS: "oidc" } as WorkerBindings).gates.approvalOidc;
+	assert.equal(approvalPolicy(only).password, false);
+});
+
+test("unset /device has no OpenID Connect button", async (t) => {
+	const s = setup(); t.after(s.restore);
+	const d = await s.start();
+	const g = await s.page(d.data.user_code);
+	assert.equal(g.status, 200);
+	assert.equal(g.text.includes("Approve with"), false);
+	assert.equal(g.text.includes("Continue with"), false);
+	assert.match(g.text, /No approval password is set yet/);
+});
+
+test("configured /device redirects to the issuer with PKCE and approves on a valid id token", async (t) => {
+	const s = setup(oidcEnv); t.after(s.restore);
+	const d = await s.start();
+	const code = d.data.user_code as string;
+	const { page, post } = await s.postOidc(code);
+	assert.match(page.text, /Approve with idp\.example/);
+	assert.match(page.text, /No approval password is set yet/);
+	assert.equal(post.status, 302, post.text);
+	const loc = new URL(post.headers.get("location")!);
+	assert.equal(loc.origin + loc.pathname, `${ISSUER}/authorize`);
+	assert.equal(loc.searchParams.get("code_challenge_method"), "S256");
+	assert.equal(loc.searchParams.get("scope"), "openid email");
+	assert.equal(loc.searchParams.get("redirect_uri"), `${BASE}/device/oidc/callback`);
+	assert.ok(loc.searchParams.get("state"));
+	assert.ok(loc.searchParams.get("nonce"));
+	assert.equal(loc.search.includes(code.replace("-", "")), false);
+	assert.equal(loc.search.includes(SECRET), false);
+	const nonce = loc.searchParams.get("nonce")!;
+	s.setClaims(() => claims({ nonce }));
+	const back = await s.call("GET", `/device/oidc/callback?code=auth-code&state=${loc.searchParams.get("state")}`);
+	assert.equal(back.status, 200, back.text);
+	assert.match(back.text, /Approved/);
+	assert.equal(s.tokenBodies.length, 1);
+	assert.equal(s.tokenBodies[0].client_secret, SECRET);
+	assert.equal(s.tokenBodies[0].redirect_uri, `${BASE}/device/oidc/callback`);
+	assert.equal(loc.searchParams.get("code_challenge"), await M.s256(s.tokenBodies[0].code_verifier));
+	const again = await s.call("GET", `/device/oidc/callback?code=auth-code&state=${loc.searchParams.get("state")}`);
+	assert.equal(again.status, 400);
+	assert.match(again.text, /already used/);
+	const tok = await s.call("POST", "/oauth/token", { form: { grant_type: GRANT, device_code: d.data.device_code } });
+	assert.equal(tok.status, 200, tok.text);
+	assert.ok(String(tok.data.access_token).startsWith("a2aow_"));
+	assert.equal(s.logs.join("\n").includes(SECRET), false);
+	const list = await s.call("GET", "/owner/pairing", { headers: { authorization: "Bearer owner-secret" } });
+	assert.deepEqual(list.data.approvalMethods, ["password", "oidc"]);
+	assert.equal(list.data.oidcIssuer, "idp.example");
+});
+
+test("wrong sub, wrong nonce and expired exp do not approve", async (t) => {
+	const s = setup(oidcEnv); t.after(s.restore);
+	const bad = async (over: Record<string, unknown>) => {
+		const d = await s.start();
+		const { post } = await s.postOidc(d.data.user_code);
+		const loc = new URL(post.headers.get("location")!);
+		const nonce = loc.searchParams.get("nonce")!;
+		s.setClaims(() => claims({ nonce, ...over }));
+		const back = await s.call("GET", `/device/oidc/callback?code=auth-code&state=${loc.searchParams.get("state")}`);
+		assert.equal(back.status, 400, back.text);
+		const tok = await s.call("POST", "/oauth/token", { form: { grant_type: GRANT, device_code: d.data.device_code } });
+		assert.equal(tok.data.error, "authorization_pending");
+	};
+	await bad({ sub: "someone-else" });
+	await bad({ nonce: "not-the-nonce" });
+	await bad({ exp: Math.floor(Date.now() / 1000) - 120 });
+	s.setClaims(() => claims());
+	const d = await s.start();
+	const { post } = await s.postOidc(d.data.user_code);
+	const loc = new URL(post.headers.get("location")!);
+	const none = signJwt(claims({ nonce: loc.searchParams.get("nonce") }), { alg: "none", typ: "JWT" });
+	const orig = globalThis.fetch;
+	globalThis.fetch = (async (url: any, init: any = {}) => {
+		const u = new URL(String(url));
+		if (u.pathname === "/token") return Response.json({ id_token: none });
+		return orig(url, init);
+	}) as any;
+	const back = await s.call("GET", `/device/oidc/callback?code=auth-code&state=${loc.searchParams.get("state")}`);
+	globalThis.fetch = orig;
+	assert.equal(back.status, 400, back.text);
+	const tok = await s.call("POST", "/oauth/token", { form: { grant_type: GRANT, device_code: d.data.device_code } });
+	assert.equal(tok.data.error, "authorization_pending");
+});
+
+test("APPROVAL_METHODS=oidc hides the password; APPROVAL_METHODS=password hides OpenID Connect", async (t) => {
+	const only = setup({ ...oidcEnv, APPROVAL_METHODS: "oidc" }); t.after(only.restore);
+	const d = await only.start();
+	const g = await only.page(d.data.user_code);
+	assert.equal(g.text.includes('name="password"'), false);
+	assert.equal(g.text.includes("No approval password is set yet"), false);
+	assert.match(g.text, /Approve with idp\.example/);
+	assert.match(g.text, /Deny/);
+	const posted = await only.call("POST", "/device", { form: { csrf: g.csrf, user_code: d.data.user_code, decision: "approve", password: "correct horse battery staple" }, cookie: g.cookie, headers: { origin: BASE } });
+	assert.equal(posted.status, 400, posted.text);
+	const still = await only.call("POST", "/oauth/token", { form: { grant_type: GRANT, device_code: d.data.device_code } });
+	assert.equal(still.data.error, "authorization_pending");
+
+	const pw = setup({ ...oidcEnv, APPROVAL_METHODS: "password" }); t.after(pw.restore);
+	const d2 = await pw.start();
+	const g2 = await pw.page(d2.data.user_code);
+	assert.equal(g2.text.includes("Approve with"), false);
+	assert.match(g2.text, /No approval password is set yet/);
+});
+
+test("an unverified email does not approve; sub does; multi-audience tokens need azp", async (t) => {
+	const s = setup({ ...oidcEnv, APPROVAL_OIDC_ALLOWED_SUBJECTS: "human@example.com" }); t.after(s.restore);
+	const reject = async (over: Record<string, unknown>, dropAzp = false) => {
+		const d = await s.start();
+		const { post } = await s.postOidc(d.data.user_code);
+		const loc = new URL(post.headers.get("location")!);
+		const nonce = loc.searchParams.get("nonce")!;
+		const body = claims({ nonce, sub: "other", email: "human@example.com", ...over });
+		if (dropAzp) delete body.azp;
+		s.setClaims(() => body);
+		const back = await s.call("GET", `/device/oidc/callback?code=auth-code&state=${loc.searchParams.get("state")}`);
+		assert.equal(back.status, 400, back.text);
+		const tok = await s.call("POST", "/oauth/token", { form: { grant_type: GRANT, device_code: d.data.device_code } });
+		assert.equal(tok.data.error, "authorization_pending");
+	};
+	await reject({});
+	await reject({ email_verified: false });
+	await reject({ email_verified: "true" });
+	await reject({ email_verified: true }, true);
+
+	const asSub = setup({ ...oidcEnv, APPROVAL_OIDC_ALLOWED_SUBJECTS: "human@example.com" }); t.after(asSub.restore);
+	const dSub = await asSub.start();
+	const started = await asSub.postOidc(dSub.data.user_code);
+	const locSub = new URL(started.post.headers.get("location")!);
+	asSub.setClaims(() => claims({ nonce: locSub.searchParams.get("nonce")!, sub: "human@example.com", email: "other@example.com", email_verified: false }));
+	const viaSub = await asSub.call("GET", `/device/oidc/callback?code=auth-code&state=${locSub.searchParams.get("state")}`);
+	assert.equal(viaSub.status, 200, viaSub.text);
+
+	const single = setup(oidcEnv); t.after(single.restore);
+	const d1 = await single.start();
+	const p1 = await single.postOidc(d1.data.user_code);
+	const loc1 = new URL(p1.post.headers.get("location")!);
+	single.setClaims(() => {
+		const body = claims({ nonce: loc1.searchParams.get("nonce")!, aud: CLIENT });
+		delete body.azp;
+		return body;
+	});
+	const okSingle = await single.call("GET", `/device/oidc/callback?code=auth-code&state=${loc1.searchParams.get("state")}`);
+	assert.equal(okSingle.status, 200, okSingle.text);
+
+	const wrong = setup(oidcEnv); t.after(wrong.restore);
+	const d2 = await wrong.start();
+	const p2 = await wrong.postOidc(d2.data.user_code);
+	const loc2 = new URL(p2.post.headers.get("location")!);
+	wrong.setClaims(() => {
+		const body = claims({ nonce: loc2.searchParams.get("nonce")!, aud: CLIENT, azp: "someone-else" });
+		return body;
+	});
+	const badAzp = await wrong.call("GET", `/device/oidc/callback?code=auth-code&state=${loc2.searchParams.get("state")}`);
+	assert.equal(badAzp.status, 400, badAzp.text);
+});
+
+test("email allowlist matches and a hosted tenant uses its own approval, not the Worker secret", async (t) => {
+	const s = setup({ ...oidcEnv, APPROVAL_OIDC_ALLOWED_SUBJECTS: "human@example.com" }); t.after(s.restore);
+	const d = await s.start();
+	const { post } = await s.postOidc(d.data.user_code);
+	const loc = new URL(post.headers.get("location")!);
+	s.setClaims(() => claims({ nonce: loc.searchParams.get("nonce")!, sub: "other", email: "human@example.com", email_verified: true }));
+	const back = await s.call("GET", `/device/oidc/callback?code=auth-code&state=${loc.searchParams.get("state")}`);
+	assert.equal(back.status, 200, back.text);
+	assert.match(back.text, /Approved/);
+
+	const DB = d1(new URL("../migrations/", import.meta.url));
+	const platform: any = { DB, PUBLIC_URL: BASE, OWNER_TOKEN: "owner-secret", ...oidcEnv, APPROVAL_OIDC_CLIENT_SECRET: "platform-secret", APPROVAL_METHODS: "oidc" };
+	const ctx = hostedTenantContext(platform, {
+		id: "ten_a", db: DB, publicUrl: BASE,
+		approval: { issuer: ISSUER, clientId: CLIENT, clientSecret: "tenant-secret", allowedSubjects: ["owner-1"], label: "Example IdP" },
+	});
+	const ectx = { waitUntil() {}, passThroughOnException() {} } as any;
+	const call = async (method: string, path: string, o: { form?: Record<string, string>; headers?: Record<string, string>; cookie?: string } = {}) => {
+		const headers: Record<string, string> = { "cf-connecting-ip": "198.51.100.7", ...(o.headers || {}) };
+		let body: string | undefined;
+		if (o.form) { headers["content-type"] = "application/x-www-form-urlencoded"; body = new URLSearchParams(o.form).toString(); }
+		if (o.cookie) headers.cookie = o.cookie;
+		const res = await dispatch(new Request(BASE + path, { method, headers, body }), ctx, ectx);
+		const text = await res.text();
+		let data: any = text;
+		try { data = JSON.parse(text); } catch { /* html */ }
+		return { status: res.status, headers: res.headers, text, data };
+	};
+	const started = await call("POST", "/oauth/device_authorization", { form: { client_name: "Barry", client_id: "barry" } });
+	const g = await call("GET", `/device?user_code=${started.data.user_code}`);
+	assert.match(g.text, /Approve with Example IdP/);
+	assert.equal(g.text.includes("platform"), false);
+	const cookie = (g.headers.get("set-cookie") || "").split(";")[0];
+	const csrf = /name="csrf" value="([^"]+)"/.exec(g.text)![1];
+	const startedPost = await call("POST", "/device", { form: { csrf, user_code: started.data.user_code, decision: "oidc" }, cookie, headers: { origin: BASE } });
+	assert.equal(startedPost.status, 302, startedPost.text);
+	const loc2 = new URL(startedPost.headers.get("location")!);
+	s.setClaims(() => claims({ nonce: loc2.searchParams.get("nonce")! }));
+	const done = await call("GET", `/device/oidc/callback?code=auth-code&state=${loc2.searchParams.get("state")}`);
+	assert.match(done.text, /Approved/);
+	assert.equal(s.tokenBodies.at(-1)!.client_secret, "tenant-secret");
+});
+
+test("MCP consent offers Continue with the issuer and the callback issues the authorization code", async (t) => {
+	const s = setup(oidcEnv); t.after(s.restore);
+	const reg = await s.call("POST", "/oauth/register", { json: { client_name: "Claude", redirect_uris: ["https://claude.ai/api/mcp/auth_callback"] } });
+	const verifier = Buffer.from(crypto.randomBytes(32)).toString("base64url");
+	const q: Record<string, string> = { response_type: "code", client_id: reg.data.client_id, redirect_uri: "https://claude.ai/api/mcp/auth_callback",
+		state: "st-1", code_challenge: await M.s256(verifier), code_challenge_method: "S256", scope: "inbox", resource: `${BASE}/mcp` };
+	const g = await s.call("GET", `/oauth/authorize?${new URLSearchParams(q)}`);
+	assert.match(g.text, /Continue with idp\.example/);
+	assert.match(g.text, /No approval password is set yet/);
+	const cookie = (g.headers.get("set-cookie") || "").split(";")[0];
+	const csrf = /name="csrf" value="([^"]+)"/.exec(g.text)![1];
+	const post = await s.call("POST", "/oauth/authorize", { form: { ...q, csrf, decision: "oidc" }, cookie, headers: { origin: BASE } });
+	assert.equal(post.status, 302, post.text);
+	const loc = new URL(post.headers.get("location")!);
+	assert.equal(loc.search.includes("st-1"), false, "the MCP state is not the identity provider's state");
+	s.setClaims(() => claims({ nonce: loc.searchParams.get("nonce")! }));
+	const back = await s.call("GET", `/oauth/authorize/oidc/callback?code=auth-code&state=${loc.searchParams.get("state")}`);
+	assert.equal(back.status, 302, back.text);
+	const client = new URL(back.headers.get("location")!);
+	assert.equal(client.origin, "https://claude.ai");
+	assert.equal(client.searchParams.get("state"), "st-1");
+	assert.ok(client.searchParams.get("code"));
+	const tok = await s.call("POST", "/oauth/token", { form: { grant_type: "authorization_code", code: client.searchParams.get("code")!, client_id: reg.data.client_id,
+		redirect_uri: q.redirect_uri, code_verifier: verifier, resource: `${BASE}/mcp` } });
+	assert.equal(tok.status, 200, tok.text);
+	assert.ok(String(tok.data.access_token).startsWith("a2amcp_"));
+});

package/worker/test/bridge-thread.mjs

@@ -0,0 +1,40 @@
+// Worker thread that owns one Miniflare and answers storage ops for the synchronous test shim in d1.ts.
+import { workerData, parentPort } from "node:worker_threads";
+import { Miniflare, convertV4MiniflareOptions } from "miniflare";
+
+const { port, flag, script, pool } = workerData;
+const d1Databases = Object.fromEntries(Array.from({ length: pool }, (_, i) => [`DB${i}`, `db-${i}-${process.pid}`]));
+const i32 = new Int32Array(flag);
+
+try {
+	const mf = new Miniflare(convertV4MiniflareOptions({
+		name: "a2a-storage",
+		modules: true,
+		script,
+		compatibilityDate: "2026-10-06",
+		d1Databases,
+		durableObjects: { STORE: { className: "Store", useSQLite: true } },
+	}));
+	await mf.ready;
+	port.on("message", async ({ path, body }) => {
+		let msg;
+		try {
+			const r = await mf.dispatchFetch("http://h" + path, { method: "POST", body: JSON.stringify(body) });
+			msg = await r.json();
+		} catch (e) {
+			msg = { ok: false, error: "bridge: " + (e instanceof Error ? e.message : String(e)) };
+		}
+		port.postMessage(msg);
+		Atomics.store(i32, 0, 1);
+		Atomics.notify(i32, 0);
+	});
+	port.postMessage({ ready: true });
+	Atomics.store(i32, 0, 1);
+	Atomics.notify(i32, 0);
+} catch (e) {
+	const error = "bridge start: " + (e instanceof Error ? e.stack || e.message : String(e));
+	parentPort?.postMessage({ error });
+	port.postMessage({ ready: false, error });
+	Atomics.store(i32, 0, 1);
+	Atomics.notify(i32, 0);
+}