a2a-exposed 0.7.8 → 0.7.10

package/lib/main.mjs

@@ -179,6 +179,8 @@ Control plane account (only when that deployment's login is on)
                                 page. Creating an agent shows the owner token once. That page is not stored.
                                 FREE_AGENT_LIMIT=2 caps a free account at 2 agents. An account's own limit overrides it.
                                 Unset, there is no limit. The database rejects another insert.
+                                SIGNUP_ALLOWLIST, when set, admits only those verified emails. Unset, sign-in stays open.
+                                A refusal returns to /app?error=invite and the page says Sign-in is invite-only for now.
                                 The control Worker logs social_sign_in_failed before the
                                 provider page, social_sign_in_timeout when that sign-in does not
                                 return, and oauth_callback_failed when the provider sends the browser

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "a2a-exposed",
-	"version": "0.7.8",
+	"version": "0.7.10",
 	"description": "Give any AI agent a public A2A (Agent2Agent) endpoint: Cloudflare Worker inbox + wake webhook or scheduled inbox checks",
 	"type": "module",
 	"bin": {

package/worker/src/approval-oidc.ts

@@ -23,6 +23,18 @@ export function issuerHost(issuer: string): string {
 	try { return new URL(issuer).host; } catch { return ""; }
 }
 
+/**
+ * Origin to list in `form-action` when OpenID Connect approval is on.
+ * Scheme, host, and port only. A path, userinfo, or a non-https issuer is not included.
+ */
+export function formActionOrigin(issuer: string): string {
+	try {
+		const u = new URL(issuer);
+		if (u.protocol !== "https:" || u.username || u.password) return "";
+		return u.origin;
+	} catch { return ""; }
+}
+
 export function issuerBase(issuer: string): string {
 	return issuer.replace(/\/+$/, "");
 }
@@ -125,46 +137,93 @@ function logUnreachable(host: string, op: IdpOp, status: number, error?: unknown
 	console.log(JSON.stringify(kw));
 }
 
+function startDeadline(): { signal: AbortSignal; stop: () => void } {
+	const ac = new AbortController();
+	const timer = setTimeout(() => ac.abort(), FETCH_MS);
+	return { signal: ac.signal, stop: () => clearTimeout(timer) };
+}
+
+function aborted(signal: AbortSignal): Promise<never> {
+	if (signal.aborted) return Promise.reject(new DOMException("The operation was aborted", "AbortError"));
+	return new Promise((_, reject) => {
+		signal.addEventListener("abort", () => reject(new DOMException("The operation was aborted", "AbortError")), { once: true });
+	});
+}
+
+/** An error page is cancelled and not read. Only a successful body is buffered, and only up to `max`. */
+function dropBody(res: Response): void {
+	try { void res.body?.cancel().catch(() => {}); } catch { /* already closed */ }
+}
+
+async function takeBody(res: Response, signal: AbortSignal, max: number): Promise<Response> {
+	if (!res.ok) {
+		dropBody(res);
+		return new Response(null, { status: res.status, statusText: res.statusText });
+	}
+	const len = Number(res.headers.get("content-length") || 0);
+	if (len > max) {
+		dropBody(res);
+		throw new Error("large");
+	}
+	const text = await Promise.race([res.text(), aborted(signal)]);
+	if (text.length > max) throw new Error("large");
+	const headers = new Headers(res.headers);
+	headers.delete("content-length");
+	return new Response(text, { status: res.status, statusText: res.statusText, headers });
+}
+
 /**
  * Discovery, token and JWKS for an issuer on this tenant's zone go through CONTROL_SERVICE.
  * A public fetch of that zone can miss the control Worker (wildcard route, 522, or the site Worker).
  * Any other issuer, and a deploy with the binding unset, uses fetch.
+ * The binding request sets Host to the issuer host. Without that header the control Worker on the
+ * zone apex sees no Host, and the subrequest does not finish. Every call, binding or fetch, stops
+ * after FETCH_MS and the page says the provider could not be reached.
  */
 async function idpFetch(ctx: TenantContext, url: string, init: RequestInit, op: IdpOp): Promise<Response> {
 	let host = "";
 	try { host = new URL(url).hostname; } catch { /* logged as a failed fetch */ }
 	const binding = ctx.controlService();
 	const viaBinding = !!(binding && host && reachesControl(pageHostname(ctx), host, ctx.gates.tenantDomain));
+	const { signal, stop } = startDeadline();
 	try {
-		// A service binding rejects `redirect` and `signal` on the request (they do not cross the
-		// binding). The timeout still applies here. Redirects stay an error: the binding does not follow them.
-		const res = viaBinding ? await bindingFetch(binding!, url, init) : await fetch(url, init);
-		if (!res.ok) logUnreachable(host, op, res.status);
-		return res;
+		const res = await Promise.race([
+			viaBinding ? bindingFetch(binding!, url, init, signal) : publicFetch(url, init, signal),
+			aborted(signal),
+		]);
+		const full = await Promise.race([takeBody(res, signal, 65536), aborted(signal)]);
+		if (!full.ok) logUnreachable(host, op, full.status);
+		return full;
 	} catch (error) {
 		logUnreachable(host, op, 0, error);
 		throw new Error("http");
+	} finally {
+		stop();
 	}
 }
 
-async function bindingFetch(binding: NonNullable<ReturnType<TenantContext["controlService"]>>, url: string, init: RequestInit): Promise<Response> {
+function publicFetch(url: string, init: RequestInit, signal: AbortSignal): Promise<Response> {
+	return fetch(url, { method: init.method, headers: init.headers, body: init.body, redirect: "error", signal });
+}
+
+async function bindingFetch(binding: NonNullable<ReturnType<TenantContext["controlService"]>>, url: string, init: RequestInit, signal: AbortSignal): Promise<Response> {
 	const headers = new Headers(init.headers);
+	// `new Request(url)` does not keep Host across a service binding. The apex issuer is then
+	// a request with no Host, which does not match the control Worker's route or ISSUER, and the
+	// subrequest never completes. Set Host to the URL host. `redirect` and `signal` stay off the
+	// Request (they do not cross the binding). `signal` is passed to fetch so the runtime cancels it.
+	headers.set("host", new URL(url).host);
 	const req = new Request(url, { method: init.method || "GET", headers, body: init.body });
-	let timer: ReturnType<typeof setTimeout> | undefined;
 	try {
-		return await Promise.race([
-			binding.fetch(req),
-			new Promise<Response>((_, reject) => {
-				timer = setTimeout(() => reject(new DOMException("The operation was aborted", "AbortError")), FETCH_MS);
-			}),
-		]);
-	} finally {
-		if (timer !== undefined) clearTimeout(timer);
+		return await binding.fetch(req, { signal });
+	} catch (error) {
+		if (error instanceof TypeError && !signal.aborted) return binding.fetch(req);
+		throw error;
 	}
 }
 
 async function getJson(ctx: TenantContext, url: string, op: IdpOp): Promise<any> {
-	const res = await idpFetch(ctx, url, { headers: { accept: "application/json" }, redirect: "error", signal: AbortSignal.timeout(FETCH_MS) }, op);
+	const res = await idpFetch(ctx, url, { headers: { accept: "application/json" } }, op);
 	if (!res.ok) throw new Error("http");
 	return readJson(res, 65536);
 }
@@ -194,6 +253,11 @@ export async function startOidc(ctx: TenantContext, o: {
 	let disc: Discovery;
 	try { disc = await discover(ctx, gate.issuer); }
 	catch { return { ok: false, error: UNREACHABLE, reason: "discovery" }; }
+	// form-action lists only the issuer origin. A sign-in address on another origin would be blocked by the browser.
+	const authOrigin = formActionOrigin(disc.authorization_endpoint);
+	if (!authOrigin || authOrigin !== formActionOrigin(gate.issuer)) {
+		return { ok: false, error: "The identity provider's sign-in address is not on the issuer origin. Nothing was approved.", reason: "endpoint_origin" };
+	}
 	const { verifier, challenge } = await pkce();
 	const state = b64url(crypto.getRandomValues(new Uint8Array(32)));
 	const nonce = b64url(crypto.getRandomValues(new Uint8Array(32)));
@@ -307,7 +371,7 @@ export async function finishOidc(ctx: TenantContext, o: {
 		});
 		const res = await idpFetch(ctx, disc.token_endpoint, {
 			method: "POST", headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
-			body, redirect: "error", signal: AbortSignal.timeout(FETCH_MS),
+			body,
 		}, "token");
 		if (!res.ok) return { ok: false, error: UNREACHABLE, reason: "token", userCode };
 		const tok = await readJson(res, 65536);

package/worker/src/index.ts

@@ -1325,6 +1325,16 @@ function approvalPageBits(ctx: TenantContext): { oidc?: { label: string }; passw
 	return bits;
 }
 
+/**
+ * The OpenID Connect issuer origin, when that approval method is on.
+ * A form on this host that 302s to the issuer is checked against this origin by Chrome's `form-action`.
+ */
+function oidcFormOrigins(ctx: TenantContext): string[] {
+	if (!O.approvalPolicy(ctx.gates.approvalOidc).oidc) return [];
+	const origin = O.formActionOrigin(ctx.gates.approvalOidc.issuer);
+	return origin ? [origin] : [];
+}
+
 const redirect302 = (location: string) => new Response(null, { status: 302, headers: { location, "cache-control": "no-store", pragma: "no-cache", "referrer-policy": "no-referrer" } });
 
 async function approvalPassword(ctx: TenantContext): Promise<P.PasswordRecord | null> {
@@ -1350,7 +1360,7 @@ async function devicePage(req: Request, ctx: TenantContext, url: URL): Promise<R
 	const pw = await approvalPassword(ctx);
 	const model: P.PageModel = { agentName: ctx.AGENT_NAME || "this A2A inbox", mode: pairingMode(ctx), cli: cliCommand(ctx), csrf, passwordSet: !!pw, ...approvalPageBits(ctx) };
 	const send = (status = 200) => {
-		const h: Record<string, string> = P.pageHeaders(nonce);
+		const h: Record<string, string> = P.pageHeaders(nonce, oidcFormOrigins(ctx));
 		h["set-cookie"] = `${csrfName}=${csrf}; Path=/device; Secure; HttpOnly; SameSite=Strict; Max-Age=3600`;
 		return new Response(P.devicePage(model, nonce), { status, headers: h });
 	};
@@ -1408,7 +1418,7 @@ async function devicePage(req: Request, ctx: TenantContext, url: URL): Promise<R
 		if (!started.ok) {
 			log("oidc_rejected", { kind: "device", reason: started.reason });
 			await show(form.user_code, { kind: "error", text: started.error });
-			return send(started.reason === "config" ? 400 : 502);
+			return send(started.reason === "config" || started.reason === "endpoint_origin" ? 400 : 502);
 		}
 		log("oidc_start", { kind: "device", issuer: O.issuerHost(ctx.gates.approvalOidc.issuer) });
 		return redirect302(started.location);
@@ -1455,7 +1465,7 @@ async function deviceOidcCallback(req: Request, ctx: TenantContext, url: URL): P
 	const pw = await approvalPassword(ctx);
 	const model: P.PageModel = { agentName: ctx.AGENT_NAME || "this A2A inbox", mode: pairingMode(ctx), cli: cliCommand(ctx), csrf: P.randomB64(), passwordSet: !!pw, ...approvalPageBits(ctx) };
 	const send = (status = 200) => {
-		const h: Record<string, string> = P.pageHeaders(nonce);
+		const h: Record<string, string> = P.pageHeaders(nonce, oidcFormOrigins(ctx));
 		h["set-cookie"] = `a2a_device_csrf=${model.csrf}; Path=/device; Secure; HttpOnly; SameSite=Strict; Max-Age=3600`;
 		return new Response(P.devicePage(model, nonce), { status, headers: h });
 	};
@@ -1497,7 +1507,7 @@ async function liveSetup(ctx: TenantContext, token: string): Promise<{ rec: Setu
 	return A.timingSafeEqualStr(await A.sha256(token), s.rec.hash) ? s : null;
 }
 
-/** GET/POST /device/setup: set or change the approval password from a one-time link. Same frame, CSP and CSRF as /device. */
+/** GET/POST /device/setup: set or change the approval password from a one-time link. Same frame and CSRF as /device. The form posts only to this host, so form-action stays 'self'. */
 async function setupPage(req: Request, ctx: TenantContext, url: URL): Promise<Response> {
 	const nonce = P.randomB64(), ip = clientIp(req);
 	const csrfName = "a2a_device_csrf";
@@ -1897,10 +1907,9 @@ async function authorizePage(req: Request, ctx: TenantContext, url: URL): Promis
 	const q = req.method === "GET" ? Object.fromEntries(url.searchParams) : form;
 	const c = await checkAuthorize(ctx, q, ip);
 	const pw = await approvalPassword(ctx);
-	const page = (status: number, body: string, formOrigin?: string) => {
-		const h: Record<string, string> = P.pageHeaders(nonce);
-		// the approve/deny POST answers with a redirect to the client: form-action must allow that origin too
-		if (formOrigin) h["content-security-policy"] = h["content-security-policy"].replace("form-action 'self'", `form-action 'self' ${formOrigin}`);
+	const page = (status: number, body: string, formOrigins: string[] = []) => {
+		// Approve and deny 302 to the client. OpenID Connect 302s to the issuer. Chrome checks both against form-action.
+		const h: Record<string, string> = P.pageHeaders(nonce, formOrigins);
 		h["set-cookie"] = `${csrfName}=${csrf}; Path=/oauth/authorize; Secure; HttpOnly; SameSite=Strict; Max-Age=3600`;
 		return new Response(P.pageShell("Connect an MCP client", nonce, body), { status, headers: h });
 	};
@@ -1909,7 +1918,7 @@ async function authorizePage(req: Request, ctx: TenantContext, url: URL): Promis
 	const origin = new URL(c.redirect!).origin;
 	const show = (status: number, notice?: M.ConsentModel["notice"]) => page(status, M.consentBody({ agentName: ctx.AGENT_NAME || "this A2A inbox", cli: cliCommand(ctx),
 		csrf, clientName: c.client!.client_name || "", clientIdHost: c.client!.cimd ? new URL(c.client!.client_id).host : undefined,
-		redirectUri: c.redirect!, params: c.params, passwordSet: !!pw, ...approvalPageBits(ctx), notice }), origin);
+		redirectUri: c.redirect!, params: c.params, passwordSet: !!pw, ...approvalPageBits(ctx), notice }), [origin, ...oidcFormOrigins(ctx)]);
 	if (req.method === "GET") return show(200);
 	const reqOrigin = req.headers.get("origin");
 	if ((reqOrigin && reqOrigin !== "null" && reqOrigin !== new URL(ctx.PUBLIC_URL).origin && reqOrigin !== url.origin) || fresh || !form.csrf || !A.timingSafeEqualStr(form.csrf, csrf))
@@ -1925,7 +1934,7 @@ async function authorizePage(req: Request, ctx: TenantContext, url: URL): Promis
 		});
 		if (!started.ok) {
 			log("oidc_rejected", { kind: "mcp", reason: started.reason });
-			return show(started.reason === "config" ? 400 : 502, { kind: "error", text: started.error });
+			return show(started.reason === "config" || started.reason === "endpoint_origin" ? 400 : 502, { kind: "error", text: started.error });
 		}
 		log("oidc_start", { kind: "mcp", issuer: O.issuerHost(ctx.gates.approvalOidc.issuer) });
 		return redirect302(started.location);
@@ -1963,7 +1972,10 @@ async function issueMcpCode(ctx: TenantContext, clientName: string, redirect: st
 	return { ok: true, response: redirectWith(ctx, redirect, { code, state: params.state }) };
 }
 
-/** GET /oauth/authorize/oidc/callback. Same state binding as the pairing callback; then the existing code redirect. */
+/** GET /oauth/authorize/oidc/callback. Same state binding as the pairing callback; then the existing code redirect.
+ * The identity provider navigates here with a GET. The code redirect is that navigation's 302, not a form post, so form-action does not apply to the client origin.
+ * The error page has no form.
+ */
 async function mcpOidcCallback(req: Request, ctx: TenantContext, url: URL): Promise<Response> {
 	const nonce = P.randomB64();
 	const fail = (status: number, text: string) => new Response(P.pageShell("Connect an MCP client", nonce, `<p class="n error">${P.esc(text)}</p>`), { status, headers: P.pageHeaders(nonce) });

package/worker/src/pairing.ts

@@ -194,7 +194,7 @@ export function devicePage(m: PageModel, nonce: string): string {
 	const rows = r ? [
 		["Code", formatUserCode(r.userCode)],
 		["Agent (as it calls itself)", r.clientName || r.clientId || "(no name given)"],
-		...(r.clientId && r.clientName && r.clientId !== r.clientName ? [["Client id", r.clientId]] : []),
+		...(r.clientId && r.clientName && r.clientId !== r.clientName ? [["Alias (claimed)", r.clientId]] : []),
 		["Agent card (claimed)", r.agentCardUrl ? r.agentCardUrl + (cardIsPrivate(r.agentCardUrl) ? " (private network address, e.g. a Tailnet: not publicly reachable, so this inbox can't check it; informational only)" : "") : "(none given)"],
 		["Requested from", [r.ip || "unknown address", r.country].filter(Boolean).join(", ")],
 		["Expires", `${Math.max(0, Math.round((r.expiresMs - Date.now()) / 60000))} min`],
@@ -202,7 +202,7 @@ export function devicePage(m: PageModel, nonce: string): string {
 	] : [];
 	const notice = m.notice ? `<p class="n ${m.notice.kind}">${esc(m.notice.text)}</p>` : "";
 	const details = r ? `<table>${rows.map(([k, v]) => `<tr><th>${esc(k)}</th><td>${esc(v)}</td></tr>`).join("")}</table>
-<p class="w">Approve only if you expected this request and the code matches the one you were given. The name and card URL are claimed by the requester. Approving gives it a token to send messages to this inbox; revoke it any time with <code>${esc(m.cli)} token revoke &lt;label&gt;</code>.</p>` : "";
+<p class="w">Approve only if you expected this request and the code matches the one you were given. The name, alias and card URL are claimed by the requester. Approving gives it a token to send messages to this inbox; revoke it any time with <code>${esc(m.cli)} token revoke &lt;label&gt;</code>.</p>` : "";
 	const noPassword = `<p class="n info">No approval password is set yet. Easiest: ask your agent to run <code>${esc(m.cli)} pair set-password --web</code> and send you the one-time link, then set the password on that page. Or run <code>${esc(m.cli)} pair set-password</code> yourself in a terminal on the owner's machine. Then reload this page. You can deny without a password.</p>`;
 	const denyOnly = `<form method="post" action="/device">
 <input type="hidden" name="csrf" value="${esc(m.csrf)}"><input type="hidden" name="user_code" value="${esc(r ? formatUserCode(r.userCode) : "")}">
@@ -308,11 +308,31 @@ export function setupPage(m: SetupModel, nonce: string): string {
 </form>`);
 }
 
-/** Security headers for the /device page: strict CSP (no scripts; only this page's own style), no framing, no caching. */
-export function pageHeaders(nonce: string): Record<string, string> {
+/** An http(s) origin (scheme, host, and port) with no userinfo. Anything else, including a path, is dropped. */
+export function cspFormOrigin(raw: string): string {
+	try {
+		const u = new URL(raw);
+		if ((u.protocol !== "https:" && u.protocol !== "http:") || u.username || u.password) return "";
+		if (u.origin !== raw) return "";
+		return u.origin;
+	} catch { return ""; }
+}
+
+/**
+ * Security headers for the /device page: strict CSP (no scripts; only this page's own style), no framing, no caching.
+ * `formOrigins` are extra `form-action` origins. Chrome applies `form-action` to a form POST's redirect target,
+ * so a page whose POST answers 302 to another origin must list that origin here. With none, the directive stays `form-action 'self'`.
+ */
+export function pageHeaders(nonce: string, formOrigins: readonly string[] = []): Record<string, string> {
+	const extra: string[] = [];
+	for (const raw of formOrigins) {
+		const origin = cspFormOrigin(raw);
+		if (origin && !extra.includes(origin)) extra.push(origin);
+	}
+	const form = ["'self'", ...extra].join(" ");
 	return {
 		"content-type": "text/html; charset=utf-8",
-		"content-security-policy": `default-src 'none'; style-src 'nonce-${nonce}'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'`,
+		"content-security-policy": `default-src 'none'; style-src 'nonce-${nonce}'; form-action ${form}; frame-ancestors 'none'; base-uri 'none'`,
 		"x-frame-options": "DENY", "x-content-type-options": "nosniff", "referrer-policy": "no-referrer",
 		"cache-control": "no-store", "cross-origin-opener-policy": "same-origin",
 	};

package/worker/test/approval-oidc.test.ts

@@ -5,7 +5,7 @@ import assert from "node:assert/strict";
 import crypto from "node:crypto";
 import worker, { dispatch } from "../src/index.ts";
 import * as M from "../src/mcp.ts";
-import { approvalPolicy, hostOnZone, reachesControl, sameZoneHost } from "../src/approval-oidc.ts";
+import { approvalPolicy, formActionOrigin, hostOnZone, reachesControl, sameZoneHost } from "../src/approval-oidc.ts";
 import { hostedTenantContext, parseGates, type WorkerBindings } from "../src/tenancy.ts";
 import { d1 } from "./d1.ts";
 
@@ -156,6 +156,70 @@ test("configured /device redirects to the issuer with PKCE and approves on a val
 	assert.equal(list.data.oidcIssuer, "idp.example");
 });
 
+function formAction(headers: Headers): string {
+	return /form-action ([^;]+)/.exec(headers.get("content-security-policy") || "")?.[1] || "";
+}
+
+test("form-action lists only the OpenID Connect issuer origin, and only when that approval is on", async (t) => {
+	assert.equal(formActionOrigin(ISSUER), ISSUER);
+	assert.equal(formActionOrigin(`${ISSUER}/realms/app`), ISSUER);
+	assert.equal(formActionOrigin("https://idp.example:8443/realms/app"), "https://idp.example:8443");
+	assert.equal(formActionOrigin("https://user:secret@idp.example"), "");
+	assert.equal(formActionOrigin("http://idp.example"), "");
+
+	const s = setup(oidcEnv); t.after(s.restore);
+	const d = await s.start();
+	const g = await s.page(d.data.user_code);
+	assert.equal(formAction(g.headers), `'self' ${ISSUER}`);
+	assert.equal(g.headers.get("content-security-policy")!.includes(`${ISSUER}/`), false);
+
+	const downFetch = globalThis.fetch;
+	globalThis.fetch = (async () => { throw new Error("down"); }) as typeof fetch;
+	const failed = await s.postOidc(d.data.user_code);
+	globalThis.fetch = downFetch;
+	assert.equal(failed.post.status, 502, failed.post.text);
+	assert.match(failed.post.text, /Approve with idp\.example/);
+	assert.equal(formAction(failed.post.headers), `'self' ${ISSUER}`);
+
+	const back = await s.call("GET", "/device/oidc/callback?error=access_denied");
+	assert.equal(back.status, 400);
+	assert.equal(formAction(back.headers), `'self' ${ISSUER}`);
+
+	const setupPage = await s.call("GET", "/device/setup");
+	assert.equal(formAction(setupPage.headers), "'self'");
+	const land = await s.call("GET", "/", { headers: { accept: "text/html" } });
+	assert.match(land.headers.get("content-security-policy") || "", /form-action 'none'/);
+
+	const pw = setup({ ...oidcEnv, APPROVAL_METHODS: "password" }); t.after(pw.restore);
+	const d2 = await pw.start();
+	const g2 = await pw.page(d2.data.user_code);
+	assert.equal(g2.text.includes("Approve with"), false);
+	assert.equal(formAction(g2.headers), "'self'");
+});
+
+test("an authorization endpoint on another origin is not started", async (t) => {
+	const s = setup(oidcEnv); t.after(s.restore);
+	const inner = globalThis.fetch;
+	globalThis.fetch = (async (url: any, init: any) => {
+		const u = new URL(String(url));
+		if (u.origin === ISSUER && u.pathname === "/.well-known/openid-configuration") {
+			return Response.json({
+				issuer: ISSUER, authorization_endpoint: "https://login.example/authorize",
+				token_endpoint: `${ISSUER}/token`, jwks_uri: `${ISSUER}/jwks`,
+			});
+		}
+		return inner(url, init);
+	}) as typeof fetch;
+	const d = await s.start();
+	const { post } = await s.postOidc(d.data.user_code as string);
+	assert.equal(post.status, 400, post.text);
+	assert.match(post.text, /not on the issuer origin/);
+	assert.equal(post.headers.get("location"), null);
+	const tok = await s.call("POST", "/oauth/token", { form: { grant_type: GRANT, device_code: d.data.device_code } });
+	assert.equal(tok.data.error, "authorization_pending");
+	assert.equal(s.logs.join("\n").includes("login.example"), false);
+});
+
 test("wrong sub, wrong nonce and expired exp do not approve", async (t) => {
 	const s = setup(oidcEnv); t.after(s.restore);
 	const bad = async (over: Record<string, unknown>) => {
@@ -314,6 +378,7 @@ test("MCP consent offers Continue with the issuer and the callback issues the au
 	const g = await s.call("GET", `/oauth/authorize?${new URLSearchParams(q)}`);
 	assert.match(g.text, /Continue with idp\.example/);
 	assert.match(g.text, /No approval password is set yet/);
+	assert.equal(/form-action ([^;]+)/.exec(g.headers.get("content-security-policy") || "")?.[1], `'self' https://claude.ai ${ISSUER}`);
 	const cookie = (g.headers.get("set-cookie") || "").split(";")[0];
 	const csrf = /name="csrf" value="([^"]+)"/.exec(g.text)![1];
 	const post = await s.call("POST", "/oauth/authorize", { form: { ...q, csrf, decision: "oidc" }, cookie, headers: { origin: BASE } });
@@ -323,6 +388,10 @@ test("MCP consent offers Continue with the issuer and the callback issues the au
 	s.setClaims(() => claims({ nonce: loc.searchParams.get("nonce")! }));
 	const back = await s.call("GET", `/oauth/authorize/oidc/callback?code=auth-code&state=${loc.searchParams.get("state")}`);
 	assert.equal(back.status, 302, back.text);
+	const callbackError = await s.call("GET", "/oauth/authorize/oidc/callback?error=access_denied");
+	assert.equal(callbackError.status, 400);
+	assert.equal(callbackError.text.includes("<form"), false);
+	assert.equal(/form-action ([^;]+)/.exec(callbackError.headers.get("content-security-policy") || "")?.[1], "'self'");
 	const client = new URL(back.headers.get("location")!);
 	assert.equal(client.origin, "https://claude.ai");
 	assert.equal(client.searchParams.get("state"), "st-1");
@@ -447,3 +516,67 @@ test("a failed same-zone fetch logs idp_unreachable with status and host", async
 	assert.equal(JSON.stringify(last).includes("connect failed"), false);
 	assert.equal(JSON.stringify(last).includes(SECRET), false);
 });
+
+test("an identity-provider error page is cancelled and not buffered", async (t) => {
+	const s = setup({ ...oidcEnv, APPROVAL_OIDC_ISSUER: ZONE }); t.after(s.restore);
+	let pulls = 0;
+	let cancelled = false;
+	s.env.CONTROL_SERVICE = {
+		async fetch() {
+			return new Response(new ReadableStream({
+				pull(controller) {
+					pulls++;
+					controller.enqueue(new Uint8Array(64 * 1024));
+				},
+				cancel() { cancelled = true; },
+			}), { status: 522 });
+		},
+	};
+	globalThis.fetch = (async () => { throw new Error("public fetch must not run"); }) as typeof fetch;
+	const d = await s.start();
+	const started = Date.now();
+	const { post } = await s.postOidc(d.data.user_code);
+	assert.ok(Date.now() - started < 1000, "error headers should return without reading the body");
+	assert.equal(post.status, 502);
+	assert.match(post.text, /The identity provider could not be reached/);
+	assert.equal(cancelled, true);
+	assert.ok(pulls < 3, `buffered ${pulls} chunks`);
+	const line = s.logs.map((entry) => { try { return JSON.parse(entry); } catch { return null; } }).find((entry) => entry?.event === "idp_unreachable");
+	assert.equal(line?.status, 522);
+	assert.equal(line?.op, "discovery");
+});
+
+test("a same-zone issuer that does not answer is given up, and the binding request carries the issuer host", async (t) => {
+	const issuer = "https://example.com";
+	const s = setup({
+		...oidcEnv, APPROVAL_OIDC_ISSUER: issuer, PUBLIC_URL: "https://northwind.example.com", TENANT_DOMAIN: "example.com",
+	});
+	t.after(s.restore);
+	let host = "";
+	s.env.CONTROL_SERVICE = {
+		async fetch(input: RequestInfo | URL) {
+			const req = input instanceof Request ? input : new Request(input);
+			host = req.headers.get("host") || "";
+			assert.equal(new URL(req.url).origin, issuer);
+			await new Promise((resolve) => setTimeout(resolve, 8000));
+			return Response.json({
+				issuer, authorization_endpoint: `${issuer}/authorize`, token_endpoint: `${issuer}/token`, jwks_uri: `${issuer}/jwks`,
+			});
+		},
+	};
+	globalThis.fetch = (async () => { throw new Error("public fetch must not run"); }) as typeof fetch;
+	const d = await s.start();
+	const started = Date.now();
+	const { post } = await s.postOidc(d.data.user_code);
+	const waited = Date.now() - started;
+	assert.equal(host, "example.com");
+	assert.ok(waited < 7000, `waited ${waited}ms`);
+	assert.equal(post.status, 502, post.text);
+	assert.match(post.text, /The identity provider could not be reached/);
+	const line = s.logs.map((entry) => { try { return JSON.parse(entry); } catch { return null; } }).find((entry) => entry?.event === "idp_unreachable");
+	assert.equal(line?.op, "discovery");
+	assert.equal(line?.status, 0);
+	assert.equal(line?.host, "example.com");
+	assert.equal(line?.error, "AbortError");
+	assert.equal(JSON.stringify(line).includes("The operation was aborted"), false);
+});

package/worker/test/hosted.test.ts

@@ -343,3 +343,141 @@ test("hosted approval reaches a same-zone issuer through CONTROL_SERVICE", async
 	assert.equal(missedPost.status, 502);
 	assert.match(await missedPost.text(), /The identity provider could not be reached/);
 });
+
+test("an apex issuer is fetched with that Host, and a control worker that does not answer still returns", async (t) => {
+	const issuer = "https://example.com";
+	const tenant = "https://northwind.example.com";
+	const control = `
+		export default {
+			fetch(request) {
+				const url = new URL(request.url);
+				const host = request.headers.get("host");
+				if (url.origin !== ${JSON.stringify(issuer)} || host !== "example.com") return new Promise(() => {});
+				if (url.pathname !== "/.well-known/openid-configuration") return new Response("missing", { status: 404 });
+				return Response.json({
+					issuer: ${JSON.stringify(issuer)},
+					authorization_endpoint: ${JSON.stringify(issuer + "/api/oidc/authorize")},
+					token_endpoint: ${JSON.stringify(issuer + "/api/oidc/token")},
+					jwks_uri: ${JSON.stringify(issuer + "/api/auth/jwks")},
+				});
+			},
+		}
+	`;
+	const mf = new Miniflare(convertV4MiniflareOptions({
+		workers: [
+			{
+				name: "inbox",
+				modules: true,
+				script: await SCRIPT,
+				compatibilityDate: "2026-10-06",
+				routes: ["*://*.example.com/*"],
+				d1Databases: { DB: "inbox-apex" },
+				kvNamespaces: { TENANT_DIRECTORY: "tenants-apex" },
+				durableObjects: { TENANT_DO: { className: "TenantStore", useSQLite: true } },
+				bindings: { TENANCY: "host", TENANT_DOMAIN: "example.com", TENANT_SECRETS_KEY: "platform-secret" },
+				serviceBindings: { CONTROL_SERVICE: "control" },
+			},
+			{
+				name: "control",
+				modules: true,
+				script: control,
+				compatibilityDate: "2026-10-06",
+				routes: ["*://example.com/*"],
+			},
+		],
+	} as never));
+	t.after(() => mf.dispose());
+	await mf.ready;
+	const kv = await mf.getKVNamespace("TENANT_DIRECTORY", "inbox");
+	const ns = await mf.getDurableObjectNamespace("TENANT_DO", "inbox");
+	const hash = await sha256("owner-apex");
+	const stub = ns.get(ns.idFromName("id-apex")) as unknown as { pushConfig(body: Record<string, unknown>): Promise<{ applied: boolean }> };
+	assert.equal((await stub.pushConfig({
+		version: 1, tenantId: "id-apex", name: "northwind", status: "active", ownerTokenHash: hash,
+		approval: { issuer, clientId: "client-1", clientSecret: "tenant-secret-value", allowedSubjects: ["owner-1"], label: "Example" },
+	})).applied, true);
+	await kv.put("tenant:northwind", JSON.stringify({ id: "id-apex", status: "active", region: "default", version: 1 }));
+	const started = await mf.dispatchFetch(`${tenant}/oauth/device_authorization`, {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded", "cf-connecting-ip": "198.51.100.20" },
+		body: "client_name=Barry+Bot&client_id=barry",
+	});
+	const device = await started.json() as { user_code?: string };
+	assert.equal(started.status, 200, JSON.stringify(device));
+	const page = await mf.dispatchFetch(`${tenant}/device?user_code=${device.user_code}`, {
+		headers: { "cf-connecting-ip": "198.51.100.20" },
+	});
+	const html = await page.text();
+	assert.match(html, /Alias \(claimed\)/);
+	assert.match(html, />barry</);
+	assert.equal(html.includes("Client id"), false);
+	const csrf = /name="csrf" value="([^"]+)"/.exec(html)?.[1] ?? "";
+	const cookie = (page.headers.get("set-cookie") || "").split(";")[0];
+	const t0 = Date.now();
+	const post = await mf.dispatchFetch(`${tenant}/device`, {
+		method: "POST",
+		redirect: "manual",
+		headers: {
+			"content-type": "application/x-www-form-urlencoded",
+			origin: tenant,
+			cookie,
+			"cf-connecting-ip": "198.51.100.20",
+		},
+		body: new URLSearchParams({ csrf, user_code: device.user_code || "", decision: "oidc" }).toString(),
+	});
+	assert.ok(Date.now() - t0 < 3000, "a matching Host must not wait out the deadline");
+	assert.equal(post.status, 302, await post.text());
+	assert.equal(new URL(post.headers.get("location") || "").origin, issuer);
+
+	const stalled = await start({
+		bindings: { TENANCY: "host", TENANT_DOMAIN: "example.com", TENANT_SECRETS_KEY: "platform-secret" },
+		kvNamespaces: { TENANT_DIRECTORY: "tenants-apex-stall" },
+		durableObjects: { TENANT_DO: { className: "TenantStore", useSQLite: true } },
+		serviceBindings: {
+			CONTROL_SERVICE: async () => {
+				await new Promise((resolve) => setTimeout(resolve, 8000));
+				return Response.json({ issuer });
+			},
+		},
+	});
+	t.after(() => stalled.dispose());
+	await stalled.ready;
+	const stalledKv = await stalled.getKVNamespace("TENANT_DIRECTORY");
+	const stalledNs = await stalled.getDurableObjectNamespace("TENANT_DO");
+	const stalledStub = stalledNs.get(stalledNs.idFromName("id-apex")) as unknown as { pushConfig(body: Record<string, unknown>): Promise<{ applied: boolean }> };
+	await stalledStub.pushConfig({
+		version: 1, tenantId: "id-apex", name: "northwind", status: "active", ownerTokenHash: hash,
+		approval: { issuer, clientId: "client-1", clientSecret: "tenant-secret-value", allowedSubjects: ["owner-1"], label: "Example" },
+	});
+	await stalledKv.put("tenant:northwind", JSON.stringify({ id: "id-apex", status: "active", region: "default", version: 1 }));
+	const stalledStart = await stalled.dispatchFetch(`${tenant}/oauth/device_authorization`, {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded", "cf-connecting-ip": "198.51.100.21" },
+		body: "client_name=Barry+Bot&client_id=barry",
+	});
+	const stalledDevice = await stalledStart.json() as { user_code: string };
+	const stalledPage = await stalled.dispatchFetch(`${tenant}/device?user_code=${stalledDevice.user_code}`, {
+		headers: { "cf-connecting-ip": "198.51.100.21" },
+	});
+	const stalledHtml = await stalledPage.text();
+	const stalledCsrf = /name="csrf" value="([^"]+)"/.exec(stalledHtml)?.[1] ?? "";
+	const stalledCookie = (stalledPage.headers.get("set-cookie") || "").split(";")[0];
+	const stallBegan = Date.now();
+	const stalledPost = await Promise.race([
+		stalled.dispatchFetch(`${tenant}/device`, {
+			method: "POST",
+			redirect: "manual",
+			headers: {
+				"content-type": "application/x-www-form-urlencoded",
+				origin: tenant,
+				cookie: stalledCookie,
+				"cf-connecting-ip": "198.51.100.21",
+			},
+			body: new URLSearchParams({ csrf: stalledCsrf, user_code: stalledDevice.user_code, decision: "oidc" }).toString(),
+		}),
+		new Promise<Response>((_, reject) => setTimeout(() => reject(new Error("device post hung")), 7000)),
+	]);
+	assert.ok(Date.now() - stallBegan < 7000);
+	assert.equal(stalledPost.status, 502);
+	assert.match(await stalledPost.text(), /The identity provider could not be reached/);
+});