a2a-exposed 0.7.7 → 0.7.9

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "a2a-exposed",
-	"version": "0.7.7",
+	"version": "0.7.9",
 	"description": "Give any AI agent a public A2A (Agent2Agent) endpoint: Cloudflare Worker inbox + wake webhook or scheduled inbox checks",
 	"type": "module",
 	"bin": {

package/worker/cloudflare.config.ts

@@ -76,6 +76,11 @@ if (hosted) {
 	envBindings.TENANT_DO = bindings.durableObject({ worker: name, exportName: "TenantStore" });
 	envBindings.TENANT_DIRECTORY = bindings.kv();
 }
+// Optional service binding to the control Worker. Unset: OpenID Connect keeps using fetch, which is
+// what a self-host deploy needs for an external issuer. Set A2A_CONTROL_SERVICE to that Worker's name
+// so a tenant on the same zone does not fetch the issuer through the public route.
+const controlService = v("A2A_CONTROL_SERVICE");
+if (controlService) envBindings.CONTROL_SERVICE = bindings.worker({ worker: controlService });
 if (backups) {
 	const region = v("DATA_REGION");
 	const bucketName = v("A2A_BACKUP_BUCKET_NAME");

package/worker/deploy.env.example

@@ -58,6 +58,9 @@ WAKE_PRESET=generic
 # APPROVAL_METHODS=password
 # Secrets (same secrets file, never here): APPROVAL_OIDC_CLIENT_SECRET, and for a hosted deploy TENANT_SECRETS_KEY.
 # Hosted approval uses the tenant's pushed approval object, not these Worker settings.
+# When that issuer is on the same zone as the tenant host, set this to the control Worker's name.
+# Discovery, token and JWKS then use the CONTROL_SERVICE binding. Unset: those calls use fetch.
+# A2A_CONTROL_SERVICE=a2a-exposed-control
 # Daily SQL snapshots to R2. Unset: no BACKUP_BUCKET binding and no extra cron. The minute wake cron stays A2A_ENABLE_CRON.
 # A2A_BACKUP_BUCKET=1
 # A2A_BACKUP_BUCKET_NAME=a2a-exposed-backups

package/worker/src/approval-oidc.ts

@@ -27,6 +27,35 @@ export function issuerBase(issuer: string): string {
 	return issuer.replace(/\/+$/, "");
 }
 
+function bareHost(host: string): string {
+	return host.trim().toLowerCase().replace(/^\.+|\.+$/g, "");
+}
+
+/** True when `host` is `zone` or a subdomain of it. `notexample.com` is not under `example.com`. */
+export function hostOnZone(host: string, zone: string): boolean {
+	const name = bareHost(host);
+	const parent = bareHost(zone);
+	if (!name || !parent) return false;
+	return name === parent || name.endsWith(`.${parent}`);
+}
+
+/**
+ * True when the two hosts are the same, or one is a subdomain of the other.
+ * `notexample.com` is not a subdomain of `example.com`.
+ */
+export function sameZoneHost(pageHost: string, targetHost: string): boolean {
+	return hostOnZone(pageHost, targetHost) || hostOnZone(targetHost, pageHost);
+}
+
+/**
+ * Use the control binding when the target is on the configured tenant domain
+ * (`control.example.com` and `northwind.example.com` share `example.com`), or when one host is under the other.
+ */
+export function reachesControl(pageHost: string, targetHost: string, tenantDomain: string): boolean {
+	if (hostOnZone(targetHost, tenantDomain)) return true;
+	return sameZoneHost(pageHost, targetHost);
+}
+
 /**
  * What the approval pages offer.
  * OIDC is on when it is fully configured and methods include oidc, or when methods were not specified.
@@ -83,8 +112,106 @@ async function readJson(res: Response, max: number): Promise<any> {
 	return JSON.parse(text);
 }
 
-async function getJson(url: string): Promise<any> {
-	const res = await fetch(url, { headers: { accept: "application/json" }, redirect: "error", signal: AbortSignal.timeout(FETCH_MS) });
+type IdpOp = "discovery" | "token" | "jwks";
+
+function pageHostname(ctx: TenantContext): string {
+	try { return new URL(ctx.PUBLIC_URL).hostname; } catch { return ""; }
+}
+
+function logUnreachable(host: string, op: IdpOp, status: number, error?: unknown) {
+	const name = error instanceof Error ? error.name : "";
+	const kw: Record<string, unknown> = { ts: A.nowIso(), event: "idp_unreachable", op, status, host };
+	if (!status) kw.error = /^[A-Za-z][A-Za-z0-9_]{0,40}$/.test(name) ? name : "fetch_failed";
+	console.log(JSON.stringify(kw));
+}
+
+function startDeadline(): { signal: AbortSignal; stop: () => void } {
+	const ac = new AbortController();
+	const timer = setTimeout(() => ac.abort(), FETCH_MS);
+	return { signal: ac.signal, stop: () => clearTimeout(timer) };
+}
+
+function aborted(signal: AbortSignal): Promise<never> {
+	if (signal.aborted) return Promise.reject(new DOMException("The operation was aborted", "AbortError"));
+	return new Promise((_, reject) => {
+		signal.addEventListener("abort", () => reject(new DOMException("The operation was aborted", "AbortError")), { once: true });
+	});
+}
+
+/** An error page is cancelled and not read. Only a successful body is buffered, and only up to `max`. */
+function dropBody(res: Response): void {
+	try { void res.body?.cancel().catch(() => {}); } catch { /* already closed */ }
+}
+
+async function takeBody(res: Response, signal: AbortSignal, max: number): Promise<Response> {
+	if (!res.ok) {
+		dropBody(res);
+		return new Response(null, { status: res.status, statusText: res.statusText });
+	}
+	const len = Number(res.headers.get("content-length") || 0);
+	if (len > max) {
+		dropBody(res);
+		throw new Error("large");
+	}
+	const text = await Promise.race([res.text(), aborted(signal)]);
+	if (text.length > max) throw new Error("large");
+	const headers = new Headers(res.headers);
+	headers.delete("content-length");
+	return new Response(text, { status: res.status, statusText: res.statusText, headers });
+}
+
+/**
+ * Discovery, token and JWKS for an issuer on this tenant's zone go through CONTROL_SERVICE.
+ * A public fetch of that zone can miss the control Worker (wildcard route, 522, or the site Worker).
+ * Any other issuer, and a deploy with the binding unset, uses fetch.
+ * The binding request sets Host to the issuer host. Without that header the control Worker on the
+ * zone apex sees no Host, and the subrequest does not finish. Every call, binding or fetch, stops
+ * after FETCH_MS and the page says the provider could not be reached.
+ */
+async function idpFetch(ctx: TenantContext, url: string, init: RequestInit, op: IdpOp): Promise<Response> {
+	let host = "";
+	try { host = new URL(url).hostname; } catch { /* logged as a failed fetch */ }
+	const binding = ctx.controlService();
+	const viaBinding = !!(binding && host && reachesControl(pageHostname(ctx), host, ctx.gates.tenantDomain));
+	const { signal, stop } = startDeadline();
+	try {
+		const res = await Promise.race([
+			viaBinding ? bindingFetch(binding!, url, init, signal) : publicFetch(url, init, signal),
+			aborted(signal),
+		]);
+		const full = await Promise.race([takeBody(res, signal, 65536), aborted(signal)]);
+		if (!full.ok) logUnreachable(host, op, full.status);
+		return full;
+	} catch (error) {
+		logUnreachable(host, op, 0, error);
+		throw new Error("http");
+	} finally {
+		stop();
+	}
+}
+
+function publicFetch(url: string, init: RequestInit, signal: AbortSignal): Promise<Response> {
+	return fetch(url, { method: init.method, headers: init.headers, body: init.body, redirect: "error", signal });
+}
+
+async function bindingFetch(binding: NonNullable<ReturnType<TenantContext["controlService"]>>, url: string, init: RequestInit, signal: AbortSignal): Promise<Response> {
+	const headers = new Headers(init.headers);
+	// `new Request(url)` does not keep Host across a service binding. The apex issuer is then
+	// a request with no Host, which does not match the control Worker's route or ISSUER, and the
+	// subrequest never completes. Set Host to the URL host. `redirect` and `signal` stay off the
+	// Request (they do not cross the binding). `signal` is passed to fetch so the runtime cancels it.
+	headers.set("host", new URL(url).host);
+	const req = new Request(url, { method: init.method || "GET", headers, body: init.body });
+	try {
+		return await binding.fetch(req, { signal });
+	} catch (error) {
+		if (error instanceof TypeError && !signal.aborted) return binding.fetch(req);
+		throw error;
+	}
+}
+
+async function getJson(ctx: TenantContext, url: string, op: IdpOp): Promise<any> {
+	const res = await idpFetch(ctx, url, { headers: { accept: "application/json" } }, op);
 	if (!res.ok) throw new Error("http");
 	return readJson(res, 65536);
 }
@@ -95,8 +222,8 @@ interface Discovery {
 	jwks_uri: string;
 }
 
-async function discover(issuer: string): Promise<Discovery> {
-	const doc = await getJson(`${issuerBase(issuer)}/.well-known/openid-configuration`);
+async function discover(ctx: TenantContext, issuer: string): Promise<Discovery> {
+	const doc = await getJson(ctx, `${issuerBase(issuer)}/.well-known/openid-configuration`, "discovery");
 	if (issuerBase(String(doc?.issuer || "")) !== issuerBase(issuer)) throw new Error("issuer");
 	return {
 		authorization_endpoint: httpsEndpoint(doc.authorization_endpoint),
@@ -112,7 +239,7 @@ export async function startOidc(ctx: TenantContext, o: {
 	const gate = ctx.gates.approvalOidc;
 	if (!approvalPolicy(gate).oidc || !ctx.approvalClientSecret()) return { ok: false, error: "OpenID Connect approval is not configured.", reason: "config" };
 	let disc: Discovery;
-	try { disc = await discover(gate.issuer); }
+	try { disc = await discover(ctx, gate.issuer); }
 	catch { return { ok: false, error: UNREACHABLE, reason: "discovery" }; }
 	const { verifier, challenge } = await pkce();
 	const state = b64url(crypto.getRandomValues(new Uint8Array(32)));
@@ -217,7 +344,7 @@ export async function finishOidc(ctx: TenantContext, o: {
 	const secret = ctx.approvalClientSecret();
 	if (!approvalPolicy(gate).oidc || !secret) return { ok: false, error: "OpenID Connect approval is not configured.", reason: "config", userCode };
 	let disc: Discovery;
-	try { disc = await discover(gate.issuer); }
+	try { disc = await discover(ctx, gate.issuer); }
 	catch { return { ok: false, error: UNREACHABLE, reason: "discovery", userCode }; }
 	let idToken = "";
 	try {
@@ -225,16 +352,16 @@ export async function finishOidc(ctx: TenantContext, o: {
 			grant_type: "authorization_code", code: o.code, redirect_uri: o.redirectUri,
 			client_id: gate.clientId, client_secret: secret, code_verifier: row.verifier,
 		});
-		const res = await fetch(disc.token_endpoint, {
+		const res = await idpFetch(ctx, disc.token_endpoint, {
 			method: "POST", headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
-			body, redirect: "error", signal: AbortSignal.timeout(FETCH_MS),
-		});
+			body,
+		}, "token");
 		if (!res.ok) return { ok: false, error: UNREACHABLE, reason: "token", userCode };
 		const tok = await readJson(res, 65536);
 		idToken = typeof tok.id_token === "string" ? tok.id_token : "";
 	} catch { return { ok: false, error: UNREACHABLE, reason: "token", userCode }; }
 	let jwks: { keys?: any[] };
-	try { jwks = await getJson(disc.jwks_uri); }
+	try { jwks = await getJson(ctx, disc.jwks_uri, "jwks"); }
 	catch { return { ok: false, error: UNREACHABLE, reason: "jwks", userCode }; }
 	const verified = await verifyIdToken(idToken, jwks, { iss: gate.issuer, aud: gate.clientId, nonce: row.nonce, subjects: gate.allowedSubjects });
 	if ("reason" in verified) return { ok: false, error: FAIL, reason: verified.reason, userCode };

package/worker/src/pairing.ts

@@ -194,7 +194,7 @@ export function devicePage(m: PageModel, nonce: string): string {
 	const rows = r ? [
 		["Code", formatUserCode(r.userCode)],
 		["Agent (as it calls itself)", r.clientName || r.clientId || "(no name given)"],
-		...(r.clientId && r.clientName && r.clientId !== r.clientName ? [["Client id", r.clientId]] : []),
+		...(r.clientId && r.clientName && r.clientId !== r.clientName ? [["Alias (claimed)", r.clientId]] : []),
 		["Agent card (claimed)", r.agentCardUrl ? r.agentCardUrl + (cardIsPrivate(r.agentCardUrl) ? " (private network address, e.g. a Tailnet: not publicly reachable, so this inbox can't check it; informational only)" : "") : "(none given)"],
 		["Requested from", [r.ip || "unknown address", r.country].filter(Boolean).join(", ")],
 		["Expires", `${Math.max(0, Math.round((r.expiresMs - Date.now()) / 60000))} min`],
@@ -202,7 +202,7 @@ export function devicePage(m: PageModel, nonce: string): string {
 	] : [];
 	const notice = m.notice ? `<p class="n ${m.notice.kind}">${esc(m.notice.text)}</p>` : "";
 	const details = r ? `<table>${rows.map(([k, v]) => `<tr><th>${esc(k)}</th><td>${esc(v)}</td></tr>`).join("")}</table>
-<p class="w">Approve only if you expected this request and the code matches the one you were given. The name and card URL are claimed by the requester. Approving gives it a token to send messages to this inbox; revoke it any time with <code>${esc(m.cli)} token revoke &lt;label&gt;</code>.</p>` : "";
+<p class="w">Approve only if you expected this request and the code matches the one you were given. The name, alias and card URL are claimed by the requester. Approving gives it a token to send messages to this inbox; revoke it any time with <code>${esc(m.cli)} token revoke &lt;label&gt;</code>.</p>` : "";
 	const noPassword = `<p class="n info">No approval password is set yet. Easiest: ask your agent to run <code>${esc(m.cli)} pair set-password --web</code> and send you the one-time link, then set the password on that page. Or run <code>${esc(m.cli)} pair set-password</code> yourself in a terminal on the owner's machine. Then reload this page. You can deny without a password.</p>`;
 	const denyOnly = `<form method="post" action="/device">
 <input type="hidden" name="csrf" value="${esc(m.csrf)}"><input type="hidden" name="user_code" value="${esc(r ? formatUserCode(r.userCode) : "")}">

package/worker/src/tenancy.ts

@@ -52,6 +52,11 @@ export type ConfigFields = { [K in ConfigKey]?: string };
  */
 const HOSTED_PLATFORM_DEFAULTS: readonly ConfigKey[] = ["MAX_BODY", "RATE_PER_MIN", "PBKDF2_ITERATIONS", "MCP", "PAIRING_APPROVAL"];
 
+/** Worker-to-Worker fetch. Present when the deploy sets `A2A_CONTROL_SERVICE`. */
+export interface ControlFetcher {
+	fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+}
+
 /** Bindings the Worker entry sees. Gate bindings are optional and empty by default. */
 export interface WorkerBindings extends ConfigFields {
 	DB: SqlDb;
@@ -97,6 +102,11 @@ export interface WorkerBindings extends ConfigFields {
 	APPROVAL_OIDC_ALLOWED_SUBJECTS?: string;
 	/** Comma-separated: password, oidc. Unset keeps the password and also offers OIDC once it is fully configured. */
 	APPROVAL_METHODS?: string;
+	/**
+	 * Service binding to the control Worker. Used for OpenID Connect discovery, token and JWKS
+	 * when the issuer is on this tenant's zone. Unset: those calls use `fetch` (self-host, and any other issuer).
+	 */
+	CONTROL_SERVICE?: ControlFetcher;
 }
 
 export interface KvNamespace {
@@ -348,13 +358,15 @@ export class TenantContext implements ConfigFields {
 	readonly #secretsKey?: string;
 	/** OpenID Connect client secret. Never logged and never copied onto `gates`. */
 	readonly #approvalClientSecret?: string;
+	/** Control Worker binding. Not a secret. Absent on a self-host deploy. */
+	readonly #controlService?: ControlFetcher;
 	#peerKey: Promise<CryptoKey | null> | null = null;
 
 	constructor(init: {
 		id: string; mode: TenancyMode; status: string; db: SqlDb; publicUrl: string;
 		gates: FeatureGates; limits: Record<string, unknown>; approval: Record<string, unknown>;
 		config: ConfigFields; ownerToken?: string; ownerTokenHash?: string; secretsKey?: string;
-		approvalClientSecret?: string;
+		approvalClientSecret?: string; controlService?: ControlFetcher;
 	}) {
 		this.id = init.id;
 		this.mode = init.mode;
@@ -368,6 +380,7 @@ export class TenantContext implements ConfigFields {
 		this.#ownerTokenHash = init.ownerTokenHash;
 		this.#secretsKey = init.secretsKey;
 		this.#approvalClientSecret = init.approvalClientSecret;
+		this.#controlService = init.controlService;
 		Object.assign(this, init.config);
 	}
 
@@ -376,6 +389,11 @@ export class TenantContext implements ConfigFields {
 		return this.#approvalClientSecret || "";
 	}
 
+	/** Control Worker binding, or undefined when this deploy has none. */
+	controlService(): ControlFetcher | undefined {
+		return this.#controlService;
+	}
+
 	/**
 	 * Owner bearer check.
 	 * Self-host: hash both the presented token and OWNER_TOKEN, then compare (unchanged).
@@ -422,6 +440,7 @@ export function resolveTenant(env: WorkerBindings, req?: Request): TenantContext
 		limits: {}, approval: {}, config: pickConfig(env, CONFIG_KEYS),
 		ownerToken: env.OWNER_TOKEN, secretsKey: undefined,
 		approvalClientSecret: (env.APPROVAL_OIDC_CLIENT_SECRET || "").trim(),
+		controlService: env.CONTROL_SERVICE,
 	});
 }
 
@@ -446,5 +465,6 @@ export function hostedTenantContext(env: WorkerBindings, overlay: HostedOverlay)
 		limits: overlay.limits || {}, approval: approval.publicRecord,
 		config, ownerTokenHash: hash || undefined, secretsKey: parsed.secretsKey,
 		approvalClientSecret: approval.clientSecret,
+		controlService: env.CONTROL_SERVICE,
 	});
 }

package/worker/test/approval-oidc.test.ts

@@ -5,7 +5,7 @@ import assert from "node:assert/strict";
 import crypto from "node:crypto";
 import worker, { dispatch } from "../src/index.ts";
 import * as M from "../src/mcp.ts";
-import { approvalPolicy } from "../src/approval-oidc.ts";
+import { approvalPolicy, hostOnZone, reachesControl, sameZoneHost } from "../src/approval-oidc.ts";
 import { hostedTenantContext, parseGates, type WorkerBindings } from "../src/tenancy.ts";
 import { d1 } from "./d1.ts";
 
@@ -117,6 +117,9 @@ test("unset /device has no OpenID Connect button", async (t) => {
 
 test("configured /device redirects to the issuer with PKCE and approves on a valid id token", async (t) => {
 	const s = setup(oidcEnv); t.after(s.restore);
+	// Different zone from the tenant domain: the control binding must not see this issuer.
+	s.env.TENANT_DOMAIN = "example.com";
+	s.env.CONTROL_SERVICE = { fetch() { throw new Error("external issuer must use fetch"); } };
 	const d = await s.start();
 	const code = d.data.user_code as string;
 	const { page, post } = await s.postOidc(code);
@@ -329,3 +332,182 @@ test("MCP consent offers Continue with the issuer and the callback issues the au
 	assert.equal(tok.status, 200, tok.text);
 	assert.ok(String(tok.data.access_token).startsWith("a2amcp_"));
 });
+
+test("sameZoneHost matches a parent zone and not a lookalike label", () => {
+	assert.equal(sameZoneHost("northwind.example.com", "example.com"), true);
+	assert.equal(sameZoneHost("example.com", "northwind.example.com"), true);
+	assert.equal(sameZoneHost("example.com", "example.com"), true);
+	assert.equal(sameZoneHost("agent.example.com", "idp.example"), false);
+	assert.equal(sameZoneHost("northwind.example.com", "control.example.com"), false);
+	assert.equal(sameZoneHost("notexample.com", "example.com"), false);
+	assert.equal(sameZoneHost("example.com.evil.example", "example.com"), false);
+	assert.equal(sameZoneHost("", "example.com"), false);
+	assert.equal(hostOnZone("control.example.com", "example.com"), true);
+	assert.equal(hostOnZone("notexample.com", "example.com"), false);
+	assert.equal(reachesControl("northwind.example.com", "control.example.com", "example.com"), true);
+	assert.equal(reachesControl("northwind.example.com", "control.example.com", ""), false);
+	assert.equal(reachesControl("agent.example.com", "idp.example", "example.com"), false);
+});
+
+const ZONE = "https://example.com";
+
+test("a same-zone issuer is reached through CONTROL_SERVICE, not a public fetch", async (t) => {
+	const s = setup({ ...oidcEnv, APPROVAL_OIDC_ISSUER: ZONE }); t.after(s.restore);
+	const urls: string[] = [];
+	let publicCalls = 0;
+	let next = () => claims({ iss: ZONE });
+	s.env.CONTROL_SERVICE = {
+		async fetch(input: RequestInfo | URL, init?: RequestInit) {
+			const req = input instanceof Request ? input : new Request(input, init);
+			urls.push(new URL(req.url).pathname);
+			const u = new URL(req.url);
+			if (u.origin === ZONE && u.pathname === "/.well-known/openid-configuration")
+				return Response.json({ issuer: ZONE, authorization_endpoint: `${ZONE}/authorize`, token_endpoint: `${ZONE}/token`, jwks_uri: `${ZONE}/jwks` });
+			if (u.origin === ZONE && u.pathname === "/jwks") return Response.json({ keys: [jwk] });
+			if (u.origin === ZONE && u.pathname === "/token") {
+				s.tokenBodies.push(Object.fromEntries(new URLSearchParams(await req.text())));
+				return Response.json({ id_token: signJwt(next()) });
+			}
+			return new Response("missing", { status: 404 });
+		},
+	};
+	globalThis.fetch = (async () => { publicCalls++; return new Response("unreachable", { status: 522 }); }) as typeof fetch;
+	const d = await s.start();
+	const code = d.data.user_code as string;
+	const { post } = await s.postOidc(code);
+	assert.equal(post.status, 302, post.text);
+	const loc = new URL(post.headers.get("location")!);
+	assert.equal(loc.origin + loc.pathname, `${ZONE}/authorize`);
+	assert.equal(publicCalls, 0, "the public fetch of the same zone was not used");
+	assert.deepEqual(urls, ["/.well-known/openid-configuration"]);
+	next = () => claims({ iss: ZONE, nonce: loc.searchParams.get("nonce")! });
+	const back = await s.call("GET", `/device/oidc/callback?code=auth-code&state=${loc.searchParams.get("state")}`);
+	assert.equal(back.status, 200, back.text);
+	assert.match(back.text, /Approved/);
+	assert.deepEqual(urls, ["/.well-known/openid-configuration", "/.well-known/openid-configuration", "/token", "/jwks"]);
+	assert.equal(s.tokenBodies[0].client_secret, SECRET);
+	assert.equal(publicCalls, 0);
+	const joined = s.logs.join("\n");
+	assert.equal(joined.includes("idp_unreachable"), false);
+	assert.equal(joined.includes(SECRET), false);
+	assert.equal(joined.includes("auth-code"), false);
+});
+
+test("a sibling control host on the tenant domain uses CONTROL_SERVICE", async (t) => {
+	const issuer = "https://control.example.com";
+	const s = setup({
+		...oidcEnv, APPROVAL_OIDC_ISSUER: issuer, PUBLIC_URL: "https://northwind.example.com", TENANT_DOMAIN: "example.com",
+	});
+	t.after(s.restore);
+	const urls: string[] = [];
+	s.env.CONTROL_SERVICE = {
+		async fetch(input: RequestInfo | URL, init?: RequestInit) {
+			const req = input instanceof Request ? input : new Request(input, init);
+			urls.push(new URL(req.url).pathname);
+			return Response.json({
+				issuer, authorization_endpoint: `${issuer}/authorize`, token_endpoint: `${issuer}/token`, jwks_uri: `${issuer}/jwks`,
+			});
+		},
+	};
+	globalThis.fetch = (async () => new Response("unreachable", { status: 522 })) as typeof fetch;
+	const d = await s.start();
+	const { post } = await s.postOidc(d.data.user_code);
+	assert.equal(post.status, 302, post.text);
+	assert.equal(new URL(post.headers.get("location")!).origin, issuer);
+	assert.deepEqual(urls, ["/.well-known/openid-configuration"]);
+});
+
+test("a failed same-zone fetch logs idp_unreachable with status and host", async (t) => {
+	const s = setup({ ...oidcEnv, APPROVAL_OIDC_ISSUER: ZONE }); t.after(s.restore);
+	s.env.CONTROL_SERVICE = { async fetch() { return new Response("origin is unreachable", { status: 522 }); } };
+	globalThis.fetch = (async () => { throw new Error("public fetch must not run"); }) as typeof fetch;
+	const d = await s.start();
+	const code = d.data.user_code as string;
+	const { post } = await s.postOidc(code);
+	assert.equal(post.status, 502, post.text);
+	assert.match(post.text, /The identity provider could not be reached/);
+	const line = s.logs.map((entry) => { try { return JSON.parse(entry); } catch { return null; } }).find((entry) => entry?.event === "idp_unreachable");
+	assert.ok(line, s.logs.join("\n"));
+	assert.equal(line.op, "discovery");
+	assert.equal(line.status, 522);
+	assert.equal(line.host, "example.com");
+	assert.equal(JSON.stringify(line).includes(SECRET), false);
+	assert.equal(JSON.stringify(line).includes(code), false);
+	assert.equal(JSON.stringify(line).includes("origin is unreachable"), false);
+
+	delete s.env.CONTROL_SERVICE;
+	globalThis.fetch = (async () => { const err = new TypeError("connect failed"); throw err; }) as typeof fetch;
+	const again = await s.postOidc((await s.start()).data.user_code);
+	assert.equal(again.post.status, 502);
+	const thrown = s.logs.map((entry) => { try { return JSON.parse(entry); } catch { return null; } }).filter((entry) => entry?.event === "idp_unreachable");
+	const last = thrown.at(-1);
+	assert.equal(last.status, 0);
+	assert.equal(last.host, "example.com");
+	assert.equal(last.error, "TypeError");
+	assert.equal(JSON.stringify(last).includes("connect failed"), false);
+	assert.equal(JSON.stringify(last).includes(SECRET), false);
+});
+
+test("an identity-provider error page is cancelled and not buffered", async (t) => {
+	const s = setup({ ...oidcEnv, APPROVAL_OIDC_ISSUER: ZONE }); t.after(s.restore);
+	let pulls = 0;
+	let cancelled = false;
+	s.env.CONTROL_SERVICE = {
+		async fetch() {
+			return new Response(new ReadableStream({
+				pull(controller) {
+					pulls++;
+					controller.enqueue(new Uint8Array(64 * 1024));
+				},
+				cancel() { cancelled = true; },
+			}), { status: 522 });
+		},
+	};
+	globalThis.fetch = (async () => { throw new Error("public fetch must not run"); }) as typeof fetch;
+	const d = await s.start();
+	const started = Date.now();
+	const { post } = await s.postOidc(d.data.user_code);
+	assert.ok(Date.now() - started < 1000, "error headers should return without reading the body");
+	assert.equal(post.status, 502);
+	assert.match(post.text, /The identity provider could not be reached/);
+	assert.equal(cancelled, true);
+	assert.ok(pulls < 3, `buffered ${pulls} chunks`);
+	const line = s.logs.map((entry) => { try { return JSON.parse(entry); } catch { return null; } }).find((entry) => entry?.event === "idp_unreachable");
+	assert.equal(line?.status, 522);
+	assert.equal(line?.op, "discovery");
+});
+
+test("a same-zone issuer that does not answer is given up, and the binding request carries the issuer host", async (t) => {
+	const issuer = "https://example.com";
+	const s = setup({
+		...oidcEnv, APPROVAL_OIDC_ISSUER: issuer, PUBLIC_URL: "https://northwind.example.com", TENANT_DOMAIN: "example.com",
+	});
+	t.after(s.restore);
+	let host = "";
+	s.env.CONTROL_SERVICE = {
+		async fetch(input: RequestInfo | URL) {
+			const req = input instanceof Request ? input : new Request(input);
+			host = req.headers.get("host") || "";
+			assert.equal(new URL(req.url).origin, issuer);
+			await new Promise((resolve) => setTimeout(resolve, 8000));
+			return Response.json({
+				issuer, authorization_endpoint: `${issuer}/authorize`, token_endpoint: `${issuer}/token`, jwks_uri: `${issuer}/jwks`,
+			});
+		},
+	};
+	globalThis.fetch = (async () => { throw new Error("public fetch must not run"); }) as typeof fetch;
+	const d = await s.start();
+	const started = Date.now();
+	const { post } = await s.postOidc(d.data.user_code);
+	const waited = Date.now() - started;
+	assert.equal(host, "example.com");
+	assert.ok(waited < 7000, `waited ${waited}ms`);
+	assert.equal(post.status, 502, post.text);
+	assert.match(post.text, /The identity provider could not be reached/);
+	const line = s.logs.map((entry) => { try { return JSON.parse(entry); } catch { return null; } }).find((entry) => entry?.event === "idp_unreachable");
+	assert.equal(line?.op, "discovery");
+	assert.equal(line?.status, 0);
+	assert.equal(line?.host, "example.com");
+	assert.equal(line?.error, "AbortError");
+	assert.equal(JSON.stringify(line).includes("The operation was aborted"), false);
+});

package/worker/test/hosted.test.ts

@@ -219,3 +219,265 @@ test("per-tenant SQLite: directory, config push, and isolation", async (t) => {
 	await alice.stub.pushConfig({ version: 4, tenantId: "id-alice", name: "alice", status: "suspended", ownerTokenHash: hashA, config: { AGENT_NAME: "Alice 3" } });
 	assert.equal((await mf.dispatchFetch("https://alice.example.com/health")).status, 403, "the object enforces a newer status than the directory cache");
 });
+
+test("hosted approval reaches a same-zone issuer through CONTROL_SERVICE", async (t) => {
+	const issuer = "https://control.example.com";
+	const tenant = "https://northwind.example.com";
+	const bindingUrls: string[] = [];
+	const publicHosts: string[] = [];
+	const mf = await start({
+		bindings: {
+			TENANCY: "host",
+			TENANT_DOMAIN: "example.com",
+			TENANT_SECRETS_KEY: "platform-secret",
+		},
+		kvNamespaces: { TENANT_DIRECTORY: "tenants-oidc" },
+		durableObjects: { TENANT_DO: { className: "TenantStore", useSQLite: true } },
+		serviceBindings: {
+			CONTROL_SERVICE: async (request: Request) => {
+				const url = new URL(request.url);
+				bindingUrls.push(`${url.origin}${url.pathname}`);
+				if (url.origin === issuer && url.pathname === "/.well-known/openid-configuration") {
+					return Response.json({
+						issuer,
+						authorization_endpoint: `${issuer}/api/oidc/authorize`,
+						token_endpoint: `${issuer}/api/oidc/token`,
+						jwks_uri: `${issuer}/api/auth/jwks`,
+					});
+				}
+				return new Response("missing", { status: 404 });
+			},
+		},
+		// A public fetch of another host on this zone does not reach the control Worker. If it is attempted, answer 522.
+		outboundService: async (request: Request) => {
+			publicHosts.push(new URL(request.url).hostname);
+			return new Response("origin is unreachable", { status: 522 });
+		},
+	});
+	t.after(() => mf.dispose());
+	await mf.ready;
+	const kv = await mf.getKVNamespace("TENANT_DIRECTORY");
+	const ns = await mf.getDurableObjectNamespace("TENANT_DO");
+	const hash = await sha256("owner-north");
+	const stub = ns.get(ns.idFromName("id-north")) as unknown as { pushConfig(body: Record<string, unknown>): Promise<{ applied: boolean }> };
+	const pushed = await stub.pushConfig({
+		version: 1, tenantId: "id-north", name: "northwind", status: "active", ownerTokenHash: hash,
+		approval: {
+			issuer, clientId: "client-1", clientSecret: "tenant-secret-value",
+			allowedSubjects: ["owner-1"], label: "Example",
+		},
+	});
+	assert.equal(pushed.applied, true, JSON.stringify(pushed));
+	await kv.put("tenant:northwind", JSON.stringify({ id: "id-north", status: "active", region: "default", version: 1 }));
+
+	const started = await mf.dispatchFetch(`${tenant}/oauth/device_authorization`, {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded", "cf-connecting-ip": "198.51.100.8" },
+		body: "client_name=Barry+Bot&client_id=barry",
+	});
+	const device = await started.json() as { user_code?: string };
+	assert.equal(started.status, 200, JSON.stringify(device));
+	assert.ok(device.user_code);
+	const page = await mf.dispatchFetch(`${tenant}/device?user_code=${device.user_code}`, {
+		headers: { "cf-connecting-ip": "198.51.100.8" },
+	});
+	const html = await page.text();
+	assert.match(html, /Approve with Example/);
+	const csrf = /name="csrf" value="([^"]+)"/.exec(html)?.[1] ?? "";
+	const cookie = (page.headers.get("set-cookie") || "").split(";")[0];
+	const post = await mf.dispatchFetch(`${tenant}/device`, {
+		method: "POST",
+		redirect: "manual",
+		headers: {
+			"content-type": "application/x-www-form-urlencoded",
+			origin: tenant,
+			cookie,
+			"cf-connecting-ip": "198.51.100.8",
+		},
+		body: new URLSearchParams({ csrf, user_code: device.user_code, decision: "oidc" }).toString(),
+	});
+	assert.equal(post.status, 302, await post.text());
+	assert.equal(new URL(post.headers.get("location") || "").origin + new URL(post.headers.get("location") || "").pathname, `${issuer}/api/oidc/authorize`);
+	assert.deepEqual(bindingUrls, [`${issuer}/.well-known/openid-configuration`]);
+	assert.equal(publicHosts.includes("control.example.com"), false, `public fetch hit ${publicHosts.join(",")}`);
+
+	const missed = await start({
+		bindings: { TENANCY: "host", TENANT_DOMAIN: "example.com", TENANT_SECRETS_KEY: "platform-secret" },
+		kvNamespaces: { TENANT_DIRECTORY: "tenants-oidc-miss" },
+		durableObjects: { TENANT_DO: { className: "TenantStore", useSQLite: true } },
+		outboundService: async () => new Response("origin is unreachable", { status: 522 }),
+	});
+	t.after(() => missed.dispose());
+	await missed.ready;
+	const missedKv = await missed.getKVNamespace("TENANT_DIRECTORY");
+	const missedNs = await missed.getDurableObjectNamespace("TENANT_DO");
+	const missedStub = missedNs.get(missedNs.idFromName("id-north")) as unknown as { pushConfig(body: Record<string, unknown>): Promise<{ applied: boolean }> };
+	await missedStub.pushConfig({
+		version: 1, tenantId: "id-north", name: "northwind", status: "active", ownerTokenHash: hash,
+		approval: { issuer, clientId: "client-1", clientSecret: "tenant-secret-value", allowedSubjects: ["owner-1"], label: "Example" },
+	});
+	await missedKv.put("tenant:northwind", JSON.stringify({ id: "id-north", status: "active", region: "default", version: 1 }));
+	const missedStart = await missed.dispatchFetch(`${tenant}/oauth/device_authorization`, {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded", "cf-connecting-ip": "198.51.100.9" },
+		body: "client_name=Barry+Bot&client_id=barry",
+	});
+	const missedDevice = await missedStart.json() as { user_code: string };
+	const missedPage = await missed.dispatchFetch(`${tenant}/device?user_code=${missedDevice.user_code}`, {
+		headers: { "cf-connecting-ip": "198.51.100.9" },
+	});
+	const missedHtml = await missedPage.text();
+	const missedCsrf = /name="csrf" value="([^"]+)"/.exec(missedHtml)?.[1] ?? "";
+	const missedCookie = (missedPage.headers.get("set-cookie") || "").split(";")[0];
+	const missedPost = await missed.dispatchFetch(`${tenant}/device`, {
+		method: "POST",
+		redirect: "manual",
+		headers: {
+			"content-type": "application/x-www-form-urlencoded",
+			origin: tenant,
+			cookie: missedCookie,
+			"cf-connecting-ip": "198.51.100.9",
+		},
+		body: new URLSearchParams({ csrf: missedCsrf, user_code: missedDevice.user_code, decision: "oidc" }).toString(),
+	});
+	assert.equal(missedPost.status, 502);
+	assert.match(await missedPost.text(), /The identity provider could not be reached/);
+});
+
+test("an apex issuer is fetched with that Host, and a control worker that does not answer still returns", async (t) => {
+	const issuer = "https://example.com";
+	const tenant = "https://northwind.example.com";
+	const control = `
+		export default {
+			fetch(request) {
+				const url = new URL(request.url);
+				const host = request.headers.get("host");
+				if (url.origin !== ${JSON.stringify(issuer)} || host !== "example.com") return new Promise(() => {});
+				if (url.pathname !== "/.well-known/openid-configuration") return new Response("missing", { status: 404 });
+				return Response.json({
+					issuer: ${JSON.stringify(issuer)},
+					authorization_endpoint: ${JSON.stringify(issuer + "/api/oidc/authorize")},
+					token_endpoint: ${JSON.stringify(issuer + "/api/oidc/token")},
+					jwks_uri: ${JSON.stringify(issuer + "/api/auth/jwks")},
+				});
+			},
+		}
+	`;
+	const mf = new Miniflare(convertV4MiniflareOptions({
+		workers: [
+			{
+				name: "inbox",
+				modules: true,
+				script: await SCRIPT,
+				compatibilityDate: "2026-10-06",
+				routes: ["*://*.example.com/*"],
+				d1Databases: { DB: "inbox-apex" },
+				kvNamespaces: { TENANT_DIRECTORY: "tenants-apex" },
+				durableObjects: { TENANT_DO: { className: "TenantStore", useSQLite: true } },
+				bindings: { TENANCY: "host", TENANT_DOMAIN: "example.com", TENANT_SECRETS_KEY: "platform-secret" },
+				serviceBindings: { CONTROL_SERVICE: "control" },
+			},
+			{
+				name: "control",
+				modules: true,
+				script: control,
+				compatibilityDate: "2026-10-06",
+				routes: ["*://example.com/*"],
+			},
+		],
+	} as never));
+	t.after(() => mf.dispose());
+	await mf.ready;
+	const kv = await mf.getKVNamespace("TENANT_DIRECTORY", "inbox");
+	const ns = await mf.getDurableObjectNamespace("TENANT_DO", "inbox");
+	const hash = await sha256("owner-apex");
+	const stub = ns.get(ns.idFromName("id-apex")) as unknown as { pushConfig(body: Record<string, unknown>): Promise<{ applied: boolean }> };
+	assert.equal((await stub.pushConfig({
+		version: 1, tenantId: "id-apex", name: "northwind", status: "active", ownerTokenHash: hash,
+		approval: { issuer, clientId: "client-1", clientSecret: "tenant-secret-value", allowedSubjects: ["owner-1"], label: "Example" },
+	})).applied, true);
+	await kv.put("tenant:northwind", JSON.stringify({ id: "id-apex", status: "active", region: "default", version: 1 }));
+	const started = await mf.dispatchFetch(`${tenant}/oauth/device_authorization`, {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded", "cf-connecting-ip": "198.51.100.20" },
+		body: "client_name=Barry+Bot&client_id=barry",
+	});
+	const device = await started.json() as { user_code?: string };
+	assert.equal(started.status, 200, JSON.stringify(device));
+	const page = await mf.dispatchFetch(`${tenant}/device?user_code=${device.user_code}`, {
+		headers: { "cf-connecting-ip": "198.51.100.20" },
+	});
+	const html = await page.text();
+	assert.match(html, /Alias \(claimed\)/);
+	assert.match(html, />barry</);
+	assert.equal(html.includes("Client id"), false);
+	const csrf = /name="csrf" value="([^"]+)"/.exec(html)?.[1] ?? "";
+	const cookie = (page.headers.get("set-cookie") || "").split(";")[0];
+	const t0 = Date.now();
+	const post = await mf.dispatchFetch(`${tenant}/device`, {
+		method: "POST",
+		redirect: "manual",
+		headers: {
+			"content-type": "application/x-www-form-urlencoded",
+			origin: tenant,
+			cookie,
+			"cf-connecting-ip": "198.51.100.20",
+		},
+		body: new URLSearchParams({ csrf, user_code: device.user_code || "", decision: "oidc" }).toString(),
+	});
+	assert.ok(Date.now() - t0 < 3000, "a matching Host must not wait out the deadline");
+	assert.equal(post.status, 302, await post.text());
+	assert.equal(new URL(post.headers.get("location") || "").origin, issuer);
+
+	const stalled = await start({
+		bindings: { TENANCY: "host", TENANT_DOMAIN: "example.com", TENANT_SECRETS_KEY: "platform-secret" },
+		kvNamespaces: { TENANT_DIRECTORY: "tenants-apex-stall" },
+		durableObjects: { TENANT_DO: { className: "TenantStore", useSQLite: true } },
+		serviceBindings: {
+			CONTROL_SERVICE: async () => {
+				await new Promise((resolve) => setTimeout(resolve, 8000));
+				return Response.json({ issuer });
+			},
+		},
+	});
+	t.after(() => stalled.dispose());
+	await stalled.ready;
+	const stalledKv = await stalled.getKVNamespace("TENANT_DIRECTORY");
+	const stalledNs = await stalled.getDurableObjectNamespace("TENANT_DO");
+	const stalledStub = stalledNs.get(stalledNs.idFromName("id-apex")) as unknown as { pushConfig(body: Record<string, unknown>): Promise<{ applied: boolean }> };
+	await stalledStub.pushConfig({
+		version: 1, tenantId: "id-apex", name: "northwind", status: "active", ownerTokenHash: hash,
+		approval: { issuer, clientId: "client-1", clientSecret: "tenant-secret-value", allowedSubjects: ["owner-1"], label: "Example" },
+	});
+	await stalledKv.put("tenant:northwind", JSON.stringify({ id: "id-apex", status: "active", region: "default", version: 1 }));
+	const stalledStart = await stalled.dispatchFetch(`${tenant}/oauth/device_authorization`, {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded", "cf-connecting-ip": "198.51.100.21" },
+		body: "client_name=Barry+Bot&client_id=barry",
+	});
+	const stalledDevice = await stalledStart.json() as { user_code: string };
+	const stalledPage = await stalled.dispatchFetch(`${tenant}/device?user_code=${stalledDevice.user_code}`, {
+		headers: { "cf-connecting-ip": "198.51.100.21" },
+	});
+	const stalledHtml = await stalledPage.text();
+	const stalledCsrf = /name="csrf" value="([^"]+)"/.exec(stalledHtml)?.[1] ?? "";
+	const stalledCookie = (stalledPage.headers.get("set-cookie") || "").split(";")[0];
+	const stallBegan = Date.now();
+	const stalledPost = await Promise.race([
+		stalled.dispatchFetch(`${tenant}/device`, {
+			method: "POST",
+			redirect: "manual",
+			headers: {
+				"content-type": "application/x-www-form-urlencoded",
+				origin: tenant,
+				cookie: stalledCookie,
+				"cf-connecting-ip": "198.51.100.21",
+			},
+			body: new URLSearchParams({ csrf: stalledCsrf, user_code: stalledDevice.user_code, decision: "oidc" }).toString(),
+		}),
+		new Promise<Response>((_, reject) => setTimeout(() => reject(new Error("device post hung")), 7000)),
+	]);
+	assert.ok(Date.now() - stallBegan < 7000);
+	assert.equal(stalledPost.status, 502);
+	assert.match(await stalledPost.text(), /The identity provider could not be reached/);
+});