a2a-exposed 0.7.6 → 0.7.8

package/lib/main.mjs

@@ -175,6 +175,10 @@ Control plane account (only when that deployment's login is on)
                                 browser can follow the redirect. Buttons say Continue with that
                                 provider. Until the check finishes they stay muted and the page says
                                 Waiting for the check…. A reused token says The check expired. Please try again.
+                                After sign-in, /app shows the account and its agents. Sign out is on that
+                                page. Creating an agent shows the owner token once. That page is not stored.
+                                FREE_AGENT_LIMIT=2 caps a free account at 2 agents. An account's own limit overrides it.
+                                Unset, there is no limit. The database rejects another insert.
                                 The control Worker logs social_sign_in_failed before the
                                 provider page, social_sign_in_timeout when that sign-in does not
                                 return, and oauth_callback_failed when the provider sends the browser

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "a2a-exposed",
-	"version": "0.7.6",
+	"version": "0.7.8",
 	"description": "Give any AI agent a public A2A (Agent2Agent) endpoint: Cloudflare Worker inbox + wake webhook or scheduled inbox checks",
 	"type": "module",
 	"bin": {

package/worker/cloudflare.config.ts

@@ -76,6 +76,11 @@ if (hosted) {
 	envBindings.TENANT_DO = bindings.durableObject({ worker: name, exportName: "TenantStore" });
 	envBindings.TENANT_DIRECTORY = bindings.kv();
 }
+// Optional service binding to the control Worker. Unset: OpenID Connect keeps using fetch, which is
+// what a self-host deploy needs for an external issuer. Set A2A_CONTROL_SERVICE to that Worker's name
+// so a tenant on the same zone does not fetch the issuer through the public route.
+const controlService = v("A2A_CONTROL_SERVICE");
+if (controlService) envBindings.CONTROL_SERVICE = bindings.worker({ worker: controlService });
 if (backups) {
 	const region = v("DATA_REGION");
 	const bucketName = v("A2A_BACKUP_BUCKET_NAME");

package/worker/deploy.env.example

@@ -58,6 +58,9 @@ WAKE_PRESET=generic
 # APPROVAL_METHODS=password
 # Secrets (same secrets file, never here): APPROVAL_OIDC_CLIENT_SECRET, and for a hosted deploy TENANT_SECRETS_KEY.
 # Hosted approval uses the tenant's pushed approval object, not these Worker settings.
+# When that issuer is on the same zone as the tenant host, set this to the control Worker's name.
+# Discovery, token and JWKS then use the CONTROL_SERVICE binding. Unset: those calls use fetch.
+# A2A_CONTROL_SERVICE=a2a-exposed-control
 # Daily SQL snapshots to R2. Unset: no BACKUP_BUCKET binding and no extra cron. The minute wake cron stays A2A_ENABLE_CRON.
 # A2A_BACKUP_BUCKET=1
 # A2A_BACKUP_BUCKET_NAME=a2a-exposed-backups

package/worker/src/approval-oidc.ts

@@ -27,6 +27,35 @@ export function issuerBase(issuer: string): string {
 	return issuer.replace(/\/+$/, "");
 }
 
+function bareHost(host: string): string {
+	return host.trim().toLowerCase().replace(/^\.+|\.+$/g, "");
+}
+
+/** True when `host` is `zone` or a subdomain of it. `notexample.com` is not under `example.com`. */
+export function hostOnZone(host: string, zone: string): boolean {
+	const name = bareHost(host);
+	const parent = bareHost(zone);
+	if (!name || !parent) return false;
+	return name === parent || name.endsWith(`.${parent}`);
+}
+
+/**
+ * True when the two hosts are the same, or one is a subdomain of the other.
+ * `notexample.com` is not a subdomain of `example.com`.
+ */
+export function sameZoneHost(pageHost: string, targetHost: string): boolean {
+	return hostOnZone(pageHost, targetHost) || hostOnZone(targetHost, pageHost);
+}
+
+/**
+ * Use the control binding when the target is on the configured tenant domain
+ * (`control.example.com` and `northwind.example.com` share `example.com`), or when one host is under the other.
+ */
+export function reachesControl(pageHost: string, targetHost: string, tenantDomain: string): boolean {
+	if (hostOnZone(targetHost, tenantDomain)) return true;
+	return sameZoneHost(pageHost, targetHost);
+}
+
 /**
  * What the approval pages offer.
  * OIDC is on when it is fully configured and methods include oidc, or when methods were not specified.
@@ -83,8 +112,59 @@ async function readJson(res: Response, max: number): Promise<any> {
 	return JSON.parse(text);
 }
 
-async function getJson(url: string): Promise<any> {
-	const res = await fetch(url, { headers: { accept: "application/json" }, redirect: "error", signal: AbortSignal.timeout(FETCH_MS) });
+type IdpOp = "discovery" | "token" | "jwks";
+
+function pageHostname(ctx: TenantContext): string {
+	try { return new URL(ctx.PUBLIC_URL).hostname; } catch { return ""; }
+}
+
+function logUnreachable(host: string, op: IdpOp, status: number, error?: unknown) {
+	const name = error instanceof Error ? error.name : "";
+	const kw: Record<string, unknown> = { ts: A.nowIso(), event: "idp_unreachable", op, status, host };
+	if (!status) kw.error = /^[A-Za-z][A-Za-z0-9_]{0,40}$/.test(name) ? name : "fetch_failed";
+	console.log(JSON.stringify(kw));
+}
+
+/**
+ * Discovery, token and JWKS for an issuer on this tenant's zone go through CONTROL_SERVICE.
+ * A public fetch of that zone can miss the control Worker (wildcard route, 522, or the site Worker).
+ * Any other issuer, and a deploy with the binding unset, uses fetch.
+ */
+async function idpFetch(ctx: TenantContext, url: string, init: RequestInit, op: IdpOp): Promise<Response> {
+	let host = "";
+	try { host = new URL(url).hostname; } catch { /* logged as a failed fetch */ }
+	const binding = ctx.controlService();
+	const viaBinding = !!(binding && host && reachesControl(pageHostname(ctx), host, ctx.gates.tenantDomain));
+	try {
+		// A service binding rejects `redirect` and `signal` on the request (they do not cross the
+		// binding). The timeout still applies here. Redirects stay an error: the binding does not follow them.
+		const res = viaBinding ? await bindingFetch(binding!, url, init) : await fetch(url, init);
+		if (!res.ok) logUnreachable(host, op, res.status);
+		return res;
+	} catch (error) {
+		logUnreachable(host, op, 0, error);
+		throw new Error("http");
+	}
+}
+
+async function bindingFetch(binding: NonNullable<ReturnType<TenantContext["controlService"]>>, url: string, init: RequestInit): Promise<Response> {
+	const headers = new Headers(init.headers);
+	const req = new Request(url, { method: init.method || "GET", headers, body: init.body });
+	let timer: ReturnType<typeof setTimeout> | undefined;
+	try {
+		return await Promise.race([
+			binding.fetch(req),
+			new Promise<Response>((_, reject) => {
+				timer = setTimeout(() => reject(new DOMException("The operation was aborted", "AbortError")), FETCH_MS);
+			}),
+		]);
+	} finally {
+		if (timer !== undefined) clearTimeout(timer);
+	}
+}
+
+async function getJson(ctx: TenantContext, url: string, op: IdpOp): Promise<any> {
+	const res = await idpFetch(ctx, url, { headers: { accept: "application/json" }, redirect: "error", signal: AbortSignal.timeout(FETCH_MS) }, op);
 	if (!res.ok) throw new Error("http");
 	return readJson(res, 65536);
 }
@@ -95,8 +175,8 @@ interface Discovery {
 	jwks_uri: string;
 }
 
-async function discover(issuer: string): Promise<Discovery> {
-	const doc = await getJson(`${issuerBase(issuer)}/.well-known/openid-configuration`);
+async function discover(ctx: TenantContext, issuer: string): Promise<Discovery> {
+	const doc = await getJson(ctx, `${issuerBase(issuer)}/.well-known/openid-configuration`, "discovery");
 	if (issuerBase(String(doc?.issuer || "")) !== issuerBase(issuer)) throw new Error("issuer");
 	return {
 		authorization_endpoint: httpsEndpoint(doc.authorization_endpoint),
@@ -112,7 +192,7 @@ export async function startOidc(ctx: TenantContext, o: {
 	const gate = ctx.gates.approvalOidc;
 	if (!approvalPolicy(gate).oidc || !ctx.approvalClientSecret()) return { ok: false, error: "OpenID Connect approval is not configured.", reason: "config" };
 	let disc: Discovery;
-	try { disc = await discover(gate.issuer); }
+	try { disc = await discover(ctx, gate.issuer); }
 	catch { return { ok: false, error: UNREACHABLE, reason: "discovery" }; }
 	const { verifier, challenge } = await pkce();
 	const state = b64url(crypto.getRandomValues(new Uint8Array(32)));
@@ -217,7 +297,7 @@ export async function finishOidc(ctx: TenantContext, o: {
 	const secret = ctx.approvalClientSecret();
 	if (!approvalPolicy(gate).oidc || !secret) return { ok: false, error: "OpenID Connect approval is not configured.", reason: "config", userCode };
 	let disc: Discovery;
-	try { disc = await discover(gate.issuer); }
+	try { disc = await discover(ctx, gate.issuer); }
 	catch { return { ok: false, error: UNREACHABLE, reason: "discovery", userCode }; }
 	let idToken = "";
 	try {
@@ -225,16 +305,16 @@ export async function finishOidc(ctx: TenantContext, o: {
 			grant_type: "authorization_code", code: o.code, redirect_uri: o.redirectUri,
 			client_id: gate.clientId, client_secret: secret, code_verifier: row.verifier,
 		});
-		const res = await fetch(disc.token_endpoint, {
+		const res = await idpFetch(ctx, disc.token_endpoint, {
 			method: "POST", headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
 			body, redirect: "error", signal: AbortSignal.timeout(FETCH_MS),
-		});
+		}, "token");
 		if (!res.ok) return { ok: false, error: UNREACHABLE, reason: "token", userCode };
 		const tok = await readJson(res, 65536);
 		idToken = typeof tok.id_token === "string" ? tok.id_token : "";
 	} catch { return { ok: false, error: UNREACHABLE, reason: "token", userCode }; }
 	let jwks: { keys?: any[] };
-	try { jwks = await getJson(disc.jwks_uri); }
+	try { jwks = await getJson(ctx, disc.jwks_uri, "jwks"); }
 	catch { return { ok: false, error: UNREACHABLE, reason: "jwks", userCode }; }
 	const verified = await verifyIdToken(idToken, jwks, { iss: gate.issuer, aud: gate.clientId, nonce: row.nonce, subjects: gate.allowedSubjects });
 	if ("reason" in verified) return { ok: false, error: FAIL, reason: verified.reason, userCode };

package/worker/src/tenancy.ts

@@ -52,6 +52,11 @@ export type ConfigFields = { [K in ConfigKey]?: string };
  */
 const HOSTED_PLATFORM_DEFAULTS: readonly ConfigKey[] = ["MAX_BODY", "RATE_PER_MIN", "PBKDF2_ITERATIONS", "MCP", "PAIRING_APPROVAL"];
 
+/** Worker-to-Worker fetch. Present when the deploy sets `A2A_CONTROL_SERVICE`. */
+export interface ControlFetcher {
+	fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+}
+
 /** Bindings the Worker entry sees. Gate bindings are optional and empty by default. */
 export interface WorkerBindings extends ConfigFields {
 	DB: SqlDb;
@@ -97,6 +102,11 @@ export interface WorkerBindings extends ConfigFields {
 	APPROVAL_OIDC_ALLOWED_SUBJECTS?: string;
 	/** Comma-separated: password, oidc. Unset keeps the password and also offers OIDC once it is fully configured. */
 	APPROVAL_METHODS?: string;
+	/**
+	 * Service binding to the control Worker. Used for OpenID Connect discovery, token and JWKS
+	 * when the issuer is on this tenant's zone. Unset: those calls use `fetch` (self-host, and any other issuer).
+	 */
+	CONTROL_SERVICE?: ControlFetcher;
 }
 
 export interface KvNamespace {
@@ -348,13 +358,15 @@ export class TenantContext implements ConfigFields {
 	readonly #secretsKey?: string;
 	/** OpenID Connect client secret. Never logged and never copied onto `gates`. */
 	readonly #approvalClientSecret?: string;
+	/** Control Worker binding. Not a secret. Absent on a self-host deploy. */
+	readonly #controlService?: ControlFetcher;
 	#peerKey: Promise<CryptoKey | null> | null = null;
 
 	constructor(init: {
 		id: string; mode: TenancyMode; status: string; db: SqlDb; publicUrl: string;
 		gates: FeatureGates; limits: Record<string, unknown>; approval: Record<string, unknown>;
 		config: ConfigFields; ownerToken?: string; ownerTokenHash?: string; secretsKey?: string;
-		approvalClientSecret?: string;
+		approvalClientSecret?: string; controlService?: ControlFetcher;
 	}) {
 		this.id = init.id;
 		this.mode = init.mode;
@@ -368,6 +380,7 @@ export class TenantContext implements ConfigFields {
 		this.#ownerTokenHash = init.ownerTokenHash;
 		this.#secretsKey = init.secretsKey;
 		this.#approvalClientSecret = init.approvalClientSecret;
+		this.#controlService = init.controlService;
 		Object.assign(this, init.config);
 	}
 
@@ -376,6 +389,11 @@ export class TenantContext implements ConfigFields {
 		return this.#approvalClientSecret || "";
 	}
 
+	/** Control Worker binding, or undefined when this deploy has none. */
+	controlService(): ControlFetcher | undefined {
+		return this.#controlService;
+	}
+
 	/**
 	 * Owner bearer check.
 	 * Self-host: hash both the presented token and OWNER_TOKEN, then compare (unchanged).
@@ -422,6 +440,7 @@ export function resolveTenant(env: WorkerBindings, req?: Request): TenantContext
 		limits: {}, approval: {}, config: pickConfig(env, CONFIG_KEYS),
 		ownerToken: env.OWNER_TOKEN, secretsKey: undefined,
 		approvalClientSecret: (env.APPROVAL_OIDC_CLIENT_SECRET || "").trim(),
+		controlService: env.CONTROL_SERVICE,
 	});
 }
 
@@ -446,5 +465,6 @@ export function hostedTenantContext(env: WorkerBindings, overlay: HostedOverlay)
 		limits: overlay.limits || {}, approval: approval.publicRecord,
 		config, ownerTokenHash: hash || undefined, secretsKey: parsed.secretsKey,
 		approvalClientSecret: approval.clientSecret,
+		controlService: env.CONTROL_SERVICE,
 	});
 }

package/worker/test/approval-oidc.test.ts

@@ -5,7 +5,7 @@ import assert from "node:assert/strict";
 import crypto from "node:crypto";
 import worker, { dispatch } from "../src/index.ts";
 import * as M from "../src/mcp.ts";
-import { approvalPolicy } from "../src/approval-oidc.ts";
+import { approvalPolicy, hostOnZone, reachesControl, sameZoneHost } from "../src/approval-oidc.ts";
 import { hostedTenantContext, parseGates, type WorkerBindings } from "../src/tenancy.ts";
 import { d1 } from "./d1.ts";
 
@@ -117,6 +117,9 @@ test("unset /device has no OpenID Connect button", async (t) => {
 
 test("configured /device redirects to the issuer with PKCE and approves on a valid id token", async (t) => {
 	const s = setup(oidcEnv); t.after(s.restore);
+	// Different zone from the tenant domain: the control binding must not see this issuer.
+	s.env.TENANT_DOMAIN = "example.com";
+	s.env.CONTROL_SERVICE = { fetch() { throw new Error("external issuer must use fetch"); } };
 	const d = await s.start();
 	const code = d.data.user_code as string;
 	const { page, post } = await s.postOidc(code);
@@ -329,3 +332,118 @@ test("MCP consent offers Continue with the issuer and the callback issues the au
 	assert.equal(tok.status, 200, tok.text);
 	assert.ok(String(tok.data.access_token).startsWith("a2amcp_"));
 });
+
+test("sameZoneHost matches a parent zone and not a lookalike label", () => {
+	assert.equal(sameZoneHost("northwind.example.com", "example.com"), true);
+	assert.equal(sameZoneHost("example.com", "northwind.example.com"), true);
+	assert.equal(sameZoneHost("example.com", "example.com"), true);
+	assert.equal(sameZoneHost("agent.example.com", "idp.example"), false);
+	assert.equal(sameZoneHost("northwind.example.com", "control.example.com"), false);
+	assert.equal(sameZoneHost("notexample.com", "example.com"), false);
+	assert.equal(sameZoneHost("example.com.evil.example", "example.com"), false);
+	assert.equal(sameZoneHost("", "example.com"), false);
+	assert.equal(hostOnZone("control.example.com", "example.com"), true);
+	assert.equal(hostOnZone("notexample.com", "example.com"), false);
+	assert.equal(reachesControl("northwind.example.com", "control.example.com", "example.com"), true);
+	assert.equal(reachesControl("northwind.example.com", "control.example.com", ""), false);
+	assert.equal(reachesControl("agent.example.com", "idp.example", "example.com"), false);
+});
+
+const ZONE = "https://example.com";
+
+test("a same-zone issuer is reached through CONTROL_SERVICE, not a public fetch", async (t) => {
+	const s = setup({ ...oidcEnv, APPROVAL_OIDC_ISSUER: ZONE }); t.after(s.restore);
+	const urls: string[] = [];
+	let publicCalls = 0;
+	let next = () => claims({ iss: ZONE });
+	s.env.CONTROL_SERVICE = {
+		async fetch(input: RequestInfo | URL, init?: RequestInit) {
+			const req = input instanceof Request ? input : new Request(input, init);
+			urls.push(new URL(req.url).pathname);
+			const u = new URL(req.url);
+			if (u.origin === ZONE && u.pathname === "/.well-known/openid-configuration")
+				return Response.json({ issuer: ZONE, authorization_endpoint: `${ZONE}/authorize`, token_endpoint: `${ZONE}/token`, jwks_uri: `${ZONE}/jwks` });
+			if (u.origin === ZONE && u.pathname === "/jwks") return Response.json({ keys: [jwk] });
+			if (u.origin === ZONE && u.pathname === "/token") {
+				s.tokenBodies.push(Object.fromEntries(new URLSearchParams(await req.text())));
+				return Response.json({ id_token: signJwt(next()) });
+			}
+			return new Response("missing", { status: 404 });
+		},
+	};
+	globalThis.fetch = (async () => { publicCalls++; return new Response("unreachable", { status: 522 }); }) as typeof fetch;
+	const d = await s.start();
+	const code = d.data.user_code as string;
+	const { post } = await s.postOidc(code);
+	assert.equal(post.status, 302, post.text);
+	const loc = new URL(post.headers.get("location")!);
+	assert.equal(loc.origin + loc.pathname, `${ZONE}/authorize`);
+	assert.equal(publicCalls, 0, "the public fetch of the same zone was not used");
+	assert.deepEqual(urls, ["/.well-known/openid-configuration"]);
+	next = () => claims({ iss: ZONE, nonce: loc.searchParams.get("nonce")! });
+	const back = await s.call("GET", `/device/oidc/callback?code=auth-code&state=${loc.searchParams.get("state")}`);
+	assert.equal(back.status, 200, back.text);
+	assert.match(back.text, /Approved/);
+	assert.deepEqual(urls, ["/.well-known/openid-configuration", "/.well-known/openid-configuration", "/token", "/jwks"]);
+	assert.equal(s.tokenBodies[0].client_secret, SECRET);
+	assert.equal(publicCalls, 0);
+	const joined = s.logs.join("\n");
+	assert.equal(joined.includes("idp_unreachable"), false);
+	assert.equal(joined.includes(SECRET), false);
+	assert.equal(joined.includes("auth-code"), false);
+});
+
+test("a sibling control host on the tenant domain uses CONTROL_SERVICE", async (t) => {
+	const issuer = "https://control.example.com";
+	const s = setup({
+		...oidcEnv, APPROVAL_OIDC_ISSUER: issuer, PUBLIC_URL: "https://northwind.example.com", TENANT_DOMAIN: "example.com",
+	});
+	t.after(s.restore);
+	const urls: string[] = [];
+	s.env.CONTROL_SERVICE = {
+		async fetch(input: RequestInfo | URL, init?: RequestInit) {
+			const req = input instanceof Request ? input : new Request(input, init);
+			urls.push(new URL(req.url).pathname);
+			return Response.json({
+				issuer, authorization_endpoint: `${issuer}/authorize`, token_endpoint: `${issuer}/token`, jwks_uri: `${issuer}/jwks`,
+			});
+		},
+	};
+	globalThis.fetch = (async () => new Response("unreachable", { status: 522 })) as typeof fetch;
+	const d = await s.start();
+	const { post } = await s.postOidc(d.data.user_code);
+	assert.equal(post.status, 302, post.text);
+	assert.equal(new URL(post.headers.get("location")!).origin, issuer);
+	assert.deepEqual(urls, ["/.well-known/openid-configuration"]);
+});
+
+test("a failed same-zone fetch logs idp_unreachable with status and host", async (t) => {
+	const s = setup({ ...oidcEnv, APPROVAL_OIDC_ISSUER: ZONE }); t.after(s.restore);
+	s.env.CONTROL_SERVICE = { async fetch() { return new Response("origin is unreachable", { status: 522 }); } };
+	globalThis.fetch = (async () => { throw new Error("public fetch must not run"); }) as typeof fetch;
+	const d = await s.start();
+	const code = d.data.user_code as string;
+	const { post } = await s.postOidc(code);
+	assert.equal(post.status, 502, post.text);
+	assert.match(post.text, /The identity provider could not be reached/);
+	const line = s.logs.map((entry) => { try { return JSON.parse(entry); } catch { return null; } }).find((entry) => entry?.event === "idp_unreachable");
+	assert.ok(line, s.logs.join("\n"));
+	assert.equal(line.op, "discovery");
+	assert.equal(line.status, 522);
+	assert.equal(line.host, "example.com");
+	assert.equal(JSON.stringify(line).includes(SECRET), false);
+	assert.equal(JSON.stringify(line).includes(code), false);
+	assert.equal(JSON.stringify(line).includes("origin is unreachable"), false);
+
+	delete s.env.CONTROL_SERVICE;
+	globalThis.fetch = (async () => { const err = new TypeError("connect failed"); throw err; }) as typeof fetch;
+	const again = await s.postOidc((await s.start()).data.user_code);
+	assert.equal(again.post.status, 502);
+	const thrown = s.logs.map((entry) => { try { return JSON.parse(entry); } catch { return null; } }).filter((entry) => entry?.event === "idp_unreachable");
+	const last = thrown.at(-1);
+	assert.equal(last.status, 0);
+	assert.equal(last.host, "example.com");
+	assert.equal(last.error, "TypeError");
+	assert.equal(JSON.stringify(last).includes("connect failed"), false);
+	assert.equal(JSON.stringify(last).includes(SECRET), false);
+});

package/worker/test/hosted.test.ts

@@ -219,3 +219,127 @@ test("per-tenant SQLite: directory, config push, and isolation", async (t) => {
 	await alice.stub.pushConfig({ version: 4, tenantId: "id-alice", name: "alice", status: "suspended", ownerTokenHash: hashA, config: { AGENT_NAME: "Alice 3" } });
 	assert.equal((await mf.dispatchFetch("https://alice.example.com/health")).status, 403, "the object enforces a newer status than the directory cache");
 });
+
+test("hosted approval reaches a same-zone issuer through CONTROL_SERVICE", async (t) => {
+	const issuer = "https://control.example.com";
+	const tenant = "https://northwind.example.com";
+	const bindingUrls: string[] = [];
+	const publicHosts: string[] = [];
+	const mf = await start({
+		bindings: {
+			TENANCY: "host",
+			TENANT_DOMAIN: "example.com",
+			TENANT_SECRETS_KEY: "platform-secret",
+		},
+		kvNamespaces: { TENANT_DIRECTORY: "tenants-oidc" },
+		durableObjects: { TENANT_DO: { className: "TenantStore", useSQLite: true } },
+		serviceBindings: {
+			CONTROL_SERVICE: async (request: Request) => {
+				const url = new URL(request.url);
+				bindingUrls.push(`${url.origin}${url.pathname}`);
+				if (url.origin === issuer && url.pathname === "/.well-known/openid-configuration") {
+					return Response.json({
+						issuer,
+						authorization_endpoint: `${issuer}/api/oidc/authorize`,
+						token_endpoint: `${issuer}/api/oidc/token`,
+						jwks_uri: `${issuer}/api/auth/jwks`,
+					});
+				}
+				return new Response("missing", { status: 404 });
+			},
+		},
+		// A public fetch of another host on this zone does not reach the control Worker. If it is attempted, answer 522.
+		outboundService: async (request: Request) => {
+			publicHosts.push(new URL(request.url).hostname);
+			return new Response("origin is unreachable", { status: 522 });
+		},
+	});
+	t.after(() => mf.dispose());
+	await mf.ready;
+	const kv = await mf.getKVNamespace("TENANT_DIRECTORY");
+	const ns = await mf.getDurableObjectNamespace("TENANT_DO");
+	const hash = await sha256("owner-north");
+	const stub = ns.get(ns.idFromName("id-north")) as unknown as { pushConfig(body: Record<string, unknown>): Promise<{ applied: boolean }> };
+	const pushed = await stub.pushConfig({
+		version: 1, tenantId: "id-north", name: "northwind", status: "active", ownerTokenHash: hash,
+		approval: {
+			issuer, clientId: "client-1", clientSecret: "tenant-secret-value",
+			allowedSubjects: ["owner-1"], label: "Example",
+		},
+	});
+	assert.equal(pushed.applied, true, JSON.stringify(pushed));
+	await kv.put("tenant:northwind", JSON.stringify({ id: "id-north", status: "active", region: "default", version: 1 }));
+
+	const started = await mf.dispatchFetch(`${tenant}/oauth/device_authorization`, {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded", "cf-connecting-ip": "198.51.100.8" },
+		body: "client_name=Barry+Bot&client_id=barry",
+	});
+	const device = await started.json() as { user_code?: string };
+	assert.equal(started.status, 200, JSON.stringify(device));
+	assert.ok(device.user_code);
+	const page = await mf.dispatchFetch(`${tenant}/device?user_code=${device.user_code}`, {
+		headers: { "cf-connecting-ip": "198.51.100.8" },
+	});
+	const html = await page.text();
+	assert.match(html, /Approve with Example/);
+	const csrf = /name="csrf" value="([^"]+)"/.exec(html)?.[1] ?? "";
+	const cookie = (page.headers.get("set-cookie") || "").split(";")[0];
+	const post = await mf.dispatchFetch(`${tenant}/device`, {
+		method: "POST",
+		redirect: "manual",
+		headers: {
+			"content-type": "application/x-www-form-urlencoded",
+			origin: tenant,
+			cookie,
+			"cf-connecting-ip": "198.51.100.8",
+		},
+		body: new URLSearchParams({ csrf, user_code: device.user_code, decision: "oidc" }).toString(),
+	});
+	assert.equal(post.status, 302, await post.text());
+	assert.equal(new URL(post.headers.get("location") || "").origin + new URL(post.headers.get("location") || "").pathname, `${issuer}/api/oidc/authorize`);
+	assert.deepEqual(bindingUrls, [`${issuer}/.well-known/openid-configuration`]);
+	assert.equal(publicHosts.includes("control.example.com"), false, `public fetch hit ${publicHosts.join(",")}`);
+
+	const missed = await start({
+		bindings: { TENANCY: "host", TENANT_DOMAIN: "example.com", TENANT_SECRETS_KEY: "platform-secret" },
+		kvNamespaces: { TENANT_DIRECTORY: "tenants-oidc-miss" },
+		durableObjects: { TENANT_DO: { className: "TenantStore", useSQLite: true } },
+		outboundService: async () => new Response("origin is unreachable", { status: 522 }),
+	});
+	t.after(() => missed.dispose());
+	await missed.ready;
+	const missedKv = await missed.getKVNamespace("TENANT_DIRECTORY");
+	const missedNs = await missed.getDurableObjectNamespace("TENANT_DO");
+	const missedStub = missedNs.get(missedNs.idFromName("id-north")) as unknown as { pushConfig(body: Record<string, unknown>): Promise<{ applied: boolean }> };
+	await missedStub.pushConfig({
+		version: 1, tenantId: "id-north", name: "northwind", status: "active", ownerTokenHash: hash,
+		approval: { issuer, clientId: "client-1", clientSecret: "tenant-secret-value", allowedSubjects: ["owner-1"], label: "Example" },
+	});
+	await missedKv.put("tenant:northwind", JSON.stringify({ id: "id-north", status: "active", region: "default", version: 1 }));
+	const missedStart = await missed.dispatchFetch(`${tenant}/oauth/device_authorization`, {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded", "cf-connecting-ip": "198.51.100.9" },
+		body: "client_name=Barry+Bot&client_id=barry",
+	});
+	const missedDevice = await missedStart.json() as { user_code: string };
+	const missedPage = await missed.dispatchFetch(`${tenant}/device?user_code=${missedDevice.user_code}`, {
+		headers: { "cf-connecting-ip": "198.51.100.9" },
+	});
+	const missedHtml = await missedPage.text();
+	const missedCsrf = /name="csrf" value="([^"]+)"/.exec(missedHtml)?.[1] ?? "";
+	const missedCookie = (missedPage.headers.get("set-cookie") || "").split(";")[0];
+	const missedPost = await missed.dispatchFetch(`${tenant}/device`, {
+		method: "POST",
+		redirect: "manual",
+		headers: {
+			"content-type": "application/x-www-form-urlencoded",
+			origin: tenant,
+			cookie: missedCookie,
+			"cf-connecting-ip": "198.51.100.9",
+		},
+		body: new URLSearchParams({ csrf: missedCsrf, user_code: missedDevice.user_code, decision: "oidc" }).toString(),
+	});
+	assert.equal(missedPost.status, 502);
+	assert.match(await missedPost.text(), /The identity provider could not be reached/);
+});