a2a-exposed 0.7.9 → 0.7.10

package/lib/main.mjs

@@ -179,6 +179,8 @@ Control plane account (only when that deployment's login is on)
                                 page. Creating an agent shows the owner token once. That page is not stored.
                                 FREE_AGENT_LIMIT=2 caps a free account at 2 agents. An account's own limit overrides it.
                                 Unset, there is no limit. The database rejects another insert.
+                                SIGNUP_ALLOWLIST, when set, admits only those verified emails. Unset, sign-in stays open.
+                                A refusal returns to /app?error=invite and the page says Sign-in is invite-only for now.
                                 The control Worker logs social_sign_in_failed before the
                                 provider page, social_sign_in_timeout when that sign-in does not
                                 return, and oauth_callback_failed when the provider sends the browser

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "a2a-exposed",
-	"version": "0.7.9",
+	"version": "0.7.10",
 	"description": "Give any AI agent a public A2A (Agent2Agent) endpoint: Cloudflare Worker inbox + wake webhook or scheduled inbox checks",
 	"type": "module",
 	"bin": {

package/worker/src/approval-oidc.ts

@@ -23,6 +23,18 @@ export function issuerHost(issuer: string): string {
 	try { return new URL(issuer).host; } catch { return ""; }
 }
 
+/**
+ * Origin to list in `form-action` when OpenID Connect approval is on.
+ * Scheme, host, and port only. A path, userinfo, or a non-https issuer is not included.
+ */
+export function formActionOrigin(issuer: string): string {
+	try {
+		const u = new URL(issuer);
+		if (u.protocol !== "https:" || u.username || u.password) return "";
+		return u.origin;
+	} catch { return ""; }
+}
+
 export function issuerBase(issuer: string): string {
 	return issuer.replace(/\/+$/, "");
 }
@@ -241,6 +253,11 @@ export async function startOidc(ctx: TenantContext, o: {
 	let disc: Discovery;
 	try { disc = await discover(ctx, gate.issuer); }
 	catch { return { ok: false, error: UNREACHABLE, reason: "discovery" }; }
+	// form-action lists only the issuer origin. A sign-in address on another origin would be blocked by the browser.
+	const authOrigin = formActionOrigin(disc.authorization_endpoint);
+	if (!authOrigin || authOrigin !== formActionOrigin(gate.issuer)) {
+		return { ok: false, error: "The identity provider's sign-in address is not on the issuer origin. Nothing was approved.", reason: "endpoint_origin" };
+	}
 	const { verifier, challenge } = await pkce();
 	const state = b64url(crypto.getRandomValues(new Uint8Array(32)));
 	const nonce = b64url(crypto.getRandomValues(new Uint8Array(32)));

package/worker/src/index.ts

@@ -1325,6 +1325,16 @@ function approvalPageBits(ctx: TenantContext): { oidc?: { label: string }; passw
 	return bits;
 }
 
+/**
+ * The OpenID Connect issuer origin, when that approval method is on.
+ * A form on this host that 302s to the issuer is checked against this origin by Chrome's `form-action`.
+ */
+function oidcFormOrigins(ctx: TenantContext): string[] {
+	if (!O.approvalPolicy(ctx.gates.approvalOidc).oidc) return [];
+	const origin = O.formActionOrigin(ctx.gates.approvalOidc.issuer);
+	return origin ? [origin] : [];
+}
+
 const redirect302 = (location: string) => new Response(null, { status: 302, headers: { location, "cache-control": "no-store", pragma: "no-cache", "referrer-policy": "no-referrer" } });
 
 async function approvalPassword(ctx: TenantContext): Promise<P.PasswordRecord | null> {
@@ -1350,7 +1360,7 @@ async function devicePage(req: Request, ctx: TenantContext, url: URL): Promise<R
 	const pw = await approvalPassword(ctx);
 	const model: P.PageModel = { agentName: ctx.AGENT_NAME || "this A2A inbox", mode: pairingMode(ctx), cli: cliCommand(ctx), csrf, passwordSet: !!pw, ...approvalPageBits(ctx) };
 	const send = (status = 200) => {
-		const h: Record<string, string> = P.pageHeaders(nonce);
+		const h: Record<string, string> = P.pageHeaders(nonce, oidcFormOrigins(ctx));
 		h["set-cookie"] = `${csrfName}=${csrf}; Path=/device; Secure; HttpOnly; SameSite=Strict; Max-Age=3600`;
 		return new Response(P.devicePage(model, nonce), { status, headers: h });
 	};
@@ -1408,7 +1418,7 @@ async function devicePage(req: Request, ctx: TenantContext, url: URL): Promise<R
 		if (!started.ok) {
 			log("oidc_rejected", { kind: "device", reason: started.reason });
 			await show(form.user_code, { kind: "error", text: started.error });
-			return send(started.reason === "config" ? 400 : 502);
+			return send(started.reason === "config" || started.reason === "endpoint_origin" ? 400 : 502);
 		}
 		log("oidc_start", { kind: "device", issuer: O.issuerHost(ctx.gates.approvalOidc.issuer) });
 		return redirect302(started.location);
@@ -1455,7 +1465,7 @@ async function deviceOidcCallback(req: Request, ctx: TenantContext, url: URL): P
 	const pw = await approvalPassword(ctx);
 	const model: P.PageModel = { agentName: ctx.AGENT_NAME || "this A2A inbox", mode: pairingMode(ctx), cli: cliCommand(ctx), csrf: P.randomB64(), passwordSet: !!pw, ...approvalPageBits(ctx) };
 	const send = (status = 200) => {
-		const h: Record<string, string> = P.pageHeaders(nonce);
+		const h: Record<string, string> = P.pageHeaders(nonce, oidcFormOrigins(ctx));
 		h["set-cookie"] = `a2a_device_csrf=${model.csrf}; Path=/device; Secure; HttpOnly; SameSite=Strict; Max-Age=3600`;
 		return new Response(P.devicePage(model, nonce), { status, headers: h });
 	};
@@ -1497,7 +1507,7 @@ async function liveSetup(ctx: TenantContext, token: string): Promise<{ rec: Setu
 	return A.timingSafeEqualStr(await A.sha256(token), s.rec.hash) ? s : null;
 }
 
-/** GET/POST /device/setup: set or change the approval password from a one-time link. Same frame, CSP and CSRF as /device. */
+/** GET/POST /device/setup: set or change the approval password from a one-time link. Same frame and CSRF as /device. The form posts only to this host, so form-action stays 'self'. */
 async function setupPage(req: Request, ctx: TenantContext, url: URL): Promise<Response> {
 	const nonce = P.randomB64(), ip = clientIp(req);
 	const csrfName = "a2a_device_csrf";
@@ -1897,10 +1907,9 @@ async function authorizePage(req: Request, ctx: TenantContext, url: URL): Promis
 	const q = req.method === "GET" ? Object.fromEntries(url.searchParams) : form;
 	const c = await checkAuthorize(ctx, q, ip);
 	const pw = await approvalPassword(ctx);
-	const page = (status: number, body: string, formOrigin?: string) => {
-		const h: Record<string, string> = P.pageHeaders(nonce);
-		// the approve/deny POST answers with a redirect to the client: form-action must allow that origin too
-		if (formOrigin) h["content-security-policy"] = h["content-security-policy"].replace("form-action 'self'", `form-action 'self' ${formOrigin}`);
+	const page = (status: number, body: string, formOrigins: string[] = []) => {
+		// Approve and deny 302 to the client. OpenID Connect 302s to the issuer. Chrome checks both against form-action.
+		const h: Record<string, string> = P.pageHeaders(nonce, formOrigins);
 		h["set-cookie"] = `${csrfName}=${csrf}; Path=/oauth/authorize; Secure; HttpOnly; SameSite=Strict; Max-Age=3600`;
 		return new Response(P.pageShell("Connect an MCP client", nonce, body), { status, headers: h });
 	};
@@ -1909,7 +1918,7 @@ async function authorizePage(req: Request, ctx: TenantContext, url: URL): Promis
 	const origin = new URL(c.redirect!).origin;
 	const show = (status: number, notice?: M.ConsentModel["notice"]) => page(status, M.consentBody({ agentName: ctx.AGENT_NAME || "this A2A inbox", cli: cliCommand(ctx),
 		csrf, clientName: c.client!.client_name || "", clientIdHost: c.client!.cimd ? new URL(c.client!.client_id).host : undefined,
-		redirectUri: c.redirect!, params: c.params, passwordSet: !!pw, ...approvalPageBits(ctx), notice }), origin);
+		redirectUri: c.redirect!, params: c.params, passwordSet: !!pw, ...approvalPageBits(ctx), notice }), [origin, ...oidcFormOrigins(ctx)]);
 	if (req.method === "GET") return show(200);
 	const reqOrigin = req.headers.get("origin");
 	if ((reqOrigin && reqOrigin !== "null" && reqOrigin !== new URL(ctx.PUBLIC_URL).origin && reqOrigin !== url.origin) || fresh || !form.csrf || !A.timingSafeEqualStr(form.csrf, csrf))
@@ -1925,7 +1934,7 @@ async function authorizePage(req: Request, ctx: TenantContext, url: URL): Promis
 		});
 		if (!started.ok) {
 			log("oidc_rejected", { kind: "mcp", reason: started.reason });
-			return show(started.reason === "config" ? 400 : 502, { kind: "error", text: started.error });
+			return show(started.reason === "config" || started.reason === "endpoint_origin" ? 400 : 502, { kind: "error", text: started.error });
 		}
 		log("oidc_start", { kind: "mcp", issuer: O.issuerHost(ctx.gates.approvalOidc.issuer) });
 		return redirect302(started.location);
@@ -1963,7 +1972,10 @@ async function issueMcpCode(ctx: TenantContext, clientName: string, redirect: st
 	return { ok: true, response: redirectWith(ctx, redirect, { code, state: params.state }) };
 }
 
-/** GET /oauth/authorize/oidc/callback. Same state binding as the pairing callback; then the existing code redirect. */
+/** GET /oauth/authorize/oidc/callback. Same state binding as the pairing callback; then the existing code redirect.
+ * The identity provider navigates here with a GET. The code redirect is that navigation's 302, not a form post, so form-action does not apply to the client origin.
+ * The error page has no form.
+ */
 async function mcpOidcCallback(req: Request, ctx: TenantContext, url: URL): Promise<Response> {
 	const nonce = P.randomB64();
 	const fail = (status: number, text: string) => new Response(P.pageShell("Connect an MCP client", nonce, `<p class="n error">${P.esc(text)}</p>`), { status, headers: P.pageHeaders(nonce) });

package/worker/src/pairing.ts

@@ -308,11 +308,31 @@ export function setupPage(m: SetupModel, nonce: string): string {
 </form>`);
 }
 
-/** Security headers for the /device page: strict CSP (no scripts; only this page's own style), no framing, no caching. */
-export function pageHeaders(nonce: string): Record<string, string> {
+/** An http(s) origin (scheme, host, and port) with no userinfo. Anything else, including a path, is dropped. */
+export function cspFormOrigin(raw: string): string {
+	try {
+		const u = new URL(raw);
+		if ((u.protocol !== "https:" && u.protocol !== "http:") || u.username || u.password) return "";
+		if (u.origin !== raw) return "";
+		return u.origin;
+	} catch { return ""; }
+}
+
+/**
+ * Security headers for the /device page: strict CSP (no scripts; only this page's own style), no framing, no caching.
+ * `formOrigins` are extra `form-action` origins. Chrome applies `form-action` to a form POST's redirect target,
+ * so a page whose POST answers 302 to another origin must list that origin here. With none, the directive stays `form-action 'self'`.
+ */
+export function pageHeaders(nonce: string, formOrigins: readonly string[] = []): Record<string, string> {
+	const extra: string[] = [];
+	for (const raw of formOrigins) {
+		const origin = cspFormOrigin(raw);
+		if (origin && !extra.includes(origin)) extra.push(origin);
+	}
+	const form = ["'self'", ...extra].join(" ");
 	return {
 		"content-type": "text/html; charset=utf-8",
-		"content-security-policy": `default-src 'none'; style-src 'nonce-${nonce}'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'`,
+		"content-security-policy": `default-src 'none'; style-src 'nonce-${nonce}'; form-action ${form}; frame-ancestors 'none'; base-uri 'none'`,
 		"x-frame-options": "DENY", "x-content-type-options": "nosniff", "referrer-policy": "no-referrer",
 		"cache-control": "no-store", "cross-origin-opener-policy": "same-origin",
 	};

package/worker/test/approval-oidc.test.ts

@@ -5,7 +5,7 @@ import assert from "node:assert/strict";
 import crypto from "node:crypto";
 import worker, { dispatch } from "../src/index.ts";
 import * as M from "../src/mcp.ts";
-import { approvalPolicy, hostOnZone, reachesControl, sameZoneHost } from "../src/approval-oidc.ts";
+import { approvalPolicy, formActionOrigin, hostOnZone, reachesControl, sameZoneHost } from "../src/approval-oidc.ts";
 import { hostedTenantContext, parseGates, type WorkerBindings } from "../src/tenancy.ts";
 import { d1 } from "./d1.ts";
 
@@ -156,6 +156,70 @@ test("configured /device redirects to the issuer with PKCE and approves on a val
 	assert.equal(list.data.oidcIssuer, "idp.example");
 });
 
+function formAction(headers: Headers): string {
+	return /form-action ([^;]+)/.exec(headers.get("content-security-policy") || "")?.[1] || "";
+}
+
+test("form-action lists only the OpenID Connect issuer origin, and only when that approval is on", async (t) => {
+	assert.equal(formActionOrigin(ISSUER), ISSUER);
+	assert.equal(formActionOrigin(`${ISSUER}/realms/app`), ISSUER);
+	assert.equal(formActionOrigin("https://idp.example:8443/realms/app"), "https://idp.example:8443");
+	assert.equal(formActionOrigin("https://user:secret@idp.example"), "");
+	assert.equal(formActionOrigin("http://idp.example"), "");
+
+	const s = setup(oidcEnv); t.after(s.restore);
+	const d = await s.start();
+	const g = await s.page(d.data.user_code);
+	assert.equal(formAction(g.headers), `'self' ${ISSUER}`);
+	assert.equal(g.headers.get("content-security-policy")!.includes(`${ISSUER}/`), false);
+
+	const downFetch = globalThis.fetch;
+	globalThis.fetch = (async () => { throw new Error("down"); }) as typeof fetch;
+	const failed = await s.postOidc(d.data.user_code);
+	globalThis.fetch = downFetch;
+	assert.equal(failed.post.status, 502, failed.post.text);
+	assert.match(failed.post.text, /Approve with idp\.example/);
+	assert.equal(formAction(failed.post.headers), `'self' ${ISSUER}`);
+
+	const back = await s.call("GET", "/device/oidc/callback?error=access_denied");
+	assert.equal(back.status, 400);
+	assert.equal(formAction(back.headers), `'self' ${ISSUER}`);
+
+	const setupPage = await s.call("GET", "/device/setup");
+	assert.equal(formAction(setupPage.headers), "'self'");
+	const land = await s.call("GET", "/", { headers: { accept: "text/html" } });
+	assert.match(land.headers.get("content-security-policy") || "", /form-action 'none'/);
+
+	const pw = setup({ ...oidcEnv, APPROVAL_METHODS: "password" }); t.after(pw.restore);
+	const d2 = await pw.start();
+	const g2 = await pw.page(d2.data.user_code);
+	assert.equal(g2.text.includes("Approve with"), false);
+	assert.equal(formAction(g2.headers), "'self'");
+});
+
+test("an authorization endpoint on another origin is not started", async (t) => {
+	const s = setup(oidcEnv); t.after(s.restore);
+	const inner = globalThis.fetch;
+	globalThis.fetch = (async (url: any, init: any) => {
+		const u = new URL(String(url));
+		if (u.origin === ISSUER && u.pathname === "/.well-known/openid-configuration") {
+			return Response.json({
+				issuer: ISSUER, authorization_endpoint: "https://login.example/authorize",
+				token_endpoint: `${ISSUER}/token`, jwks_uri: `${ISSUER}/jwks`,
+			});
+		}
+		return inner(url, init);
+	}) as typeof fetch;
+	const d = await s.start();
+	const { post } = await s.postOidc(d.data.user_code as string);
+	assert.equal(post.status, 400, post.text);
+	assert.match(post.text, /not on the issuer origin/);
+	assert.equal(post.headers.get("location"), null);
+	const tok = await s.call("POST", "/oauth/token", { form: { grant_type: GRANT, device_code: d.data.device_code } });
+	assert.equal(tok.data.error, "authorization_pending");
+	assert.equal(s.logs.join("\n").includes("login.example"), false);
+});
+
 test("wrong sub, wrong nonce and expired exp do not approve", async (t) => {
 	const s = setup(oidcEnv); t.after(s.restore);
 	const bad = async (over: Record<string, unknown>) => {
@@ -314,6 +378,7 @@ test("MCP consent offers Continue with the issuer and the callback issues the au
 	const g = await s.call("GET", `/oauth/authorize?${new URLSearchParams(q)}`);
 	assert.match(g.text, /Continue with idp\.example/);
 	assert.match(g.text, /No approval password is set yet/);
+	assert.equal(/form-action ([^;]+)/.exec(g.headers.get("content-security-policy") || "")?.[1], `'self' https://claude.ai ${ISSUER}`);
 	const cookie = (g.headers.get("set-cookie") || "").split(";")[0];
 	const csrf = /name="csrf" value="([^"]+)"/.exec(g.text)![1];
 	const post = await s.call("POST", "/oauth/authorize", { form: { ...q, csrf, decision: "oidc" }, cookie, headers: { origin: BASE } });
@@ -323,6 +388,10 @@ test("MCP consent offers Continue with the issuer and the callback issues the au
 	s.setClaims(() => claims({ nonce: loc.searchParams.get("nonce")! }));
 	const back = await s.call("GET", `/oauth/authorize/oidc/callback?code=auth-code&state=${loc.searchParams.get("state")}`);
 	assert.equal(back.status, 302, back.text);
+	const callbackError = await s.call("GET", "/oauth/authorize/oidc/callback?error=access_denied");
+	assert.equal(callbackError.status, 400);
+	assert.equal(callbackError.text.includes("<form"), false);
+	assert.equal(/form-action ([^;]+)/.exec(callbackError.headers.get("content-security-policy") || "")?.[1], "'self'");
 	const client = new URL(back.headers.get("location")!);
 	assert.equal(client.origin, "https://claude.ai");
 	assert.equal(client.searchParams.get("state"), "st-1");