create-ailk 0.29.1 → 0.30.0

package/templates/apps/web/app/[locale]/(auth)/consent/consent-form.tsx

@@ -0,0 +1,132 @@
+"use client"; // the workspace choice decides which scopes show and whether Allow is enabled
+
+/**
+ * The consent page's client island (#10357 D6): the workspace radio list, the
+ * chosen workspace's offered scopes as checkboxes — none ticked — and Allow,
+ * disabled until a workspace is chosen. Deliberate selection is the defence
+ * against a phished authorization (SEC-10357-11, -13). Strings arrive
+ * translated from the server page.
+ */
+import {
+  Button,
+  Checkbox,
+  Input,
+  Label,
+  RadioGroup,
+  RadioGroupItem,
+  Text,
+} from "@working-theory/ui/primitives";
+import type { ReactElement } from "react";
+import { useState } from "react";
+
+import { decideConsent } from "./consent.actions";
+
+export interface ConsentWorkspace {
+  id: string;
+  name: string;
+  organizationName: string;
+  /** Each offered scope with its label. */
+  offered: Array<{ scope: string; permission: string; label: string }>;
+}
+
+export interface ConsentFormText {
+  workspaceLegend: string;
+  scopesLegend: string;
+  memberReads: string;
+  noScopes: string;
+  allow: string;
+  deny: string;
+}
+
+export interface ConsentFormProps {
+  consentCode: string;
+  locale: string;
+  workspaces: ConsentWorkspace[];
+  text: ConsentFormText;
+}
+
+export function ConsentForm({ consentCode, locale, workspaces, text }: ConsentFormProps): ReactElement {
+  const [workspaceId, setWorkspaceId] = useState<string>(
+    workspaces.length === 1 ? (workspaces[0]?.id ?? "") : "",
+  );
+  const chosen = workspaces.find((w) => w.id === workspaceId);
+
+  return (
+    <form action={decideConsent} className="flex flex-col gap-6" data-testid="mcp-consent-form">
+      <Input type="hidden" name="consent_code" value={consentCode} />
+      <Input type="hidden" name="locale" value={locale} />
+      {workspaces.length > 0 ? (
+        <div className="flex flex-col gap-3">
+          <Text as="p" variant="body-sm" className="font-semibold">
+            {text.workspaceLegend}
+          </Text>
+          <RadioGroup
+            name="workspace_id"
+            value={workspaceId}
+            onValueChange={setWorkspaceId}
+            aria-label={text.workspaceLegend}
+          >
+            {workspaces.map((w) => (
+              <div key={w.id} className="flex min-h-11 items-center gap-3">
+                <RadioGroupItem
+                  id={`mcp-consent-ws-${w.id}`}
+                  value={w.id}
+                  data-testid={`mcp-consent-workspace-${w.id}`}
+                />
+                <Label htmlFor={`mcp-consent-ws-${w.id}`}>
+                  {/* i18n-allow: a separator between two data values */}
+                  {w.name} · {w.organizationName}
+                </Label>
+              </div>
+            ))}
+          </RadioGroup>
+        </div>
+      ) : null}
+      {chosen ? (
+        <div className="flex flex-col gap-3">
+          <Text as="p" variant="body-sm" className="font-semibold">
+            {text.scopesLegend}
+          </Text>
+          {chosen.offered.length === 0 ? (
+            <Text as="p" variant="body-sm" tone="muted">
+              {text.noScopes}
+            </Text>
+          ) : (
+            chosen.offered.map((o) => (
+              <div key={o.scope} className="flex min-h-11 items-center gap-3">
+                <Checkbox
+                  id={`mcp-consent-scope-${o.permission}`}
+                  name="scopes"
+                  value={o.scope}
+                  defaultChecked={false}
+                  data-testid={`mcp-consent-scope-${o.permission}`}
+                />
+                <Label htmlFor={`mcp-consent-scope-${o.permission}`}>{o.label}</Label>
+              </div>
+            ))
+          )}
+          <Text as="p" variant="body-sm" tone="muted" data-testid="mcp-consent-member-reads">
+            {text.memberReads}
+          </Text>
+        </div>
+      ) : null}
+      <div className="flex flex-wrap gap-3">
+        {workspaces.length > 0 ? (
+          <Button
+            type="submit"
+            name="decision"
+            value="allow"
+            size="big"
+            disabled={!chosen}
+            data-testid="mcp-consent-allow"
+          >
+            {text.allow}
+          </Button>
+        ) : null}
+        <Button type="submit" name="decision" value="deny" variant="secondary" size="big" data-testid="mcp-consent-deny">
+          {text.deny}
+        </Button>
+      </div>
+    </form>
+  );
+}

package/templates/apps/web/app/[locale]/(auth)/consent/consent.actions.ts

@@ -0,0 +1,51 @@
+"use server";
+
+/**
+ * `decideConsent` — the consent page's Allow and Deny (#10357 D6).
+ *
+ * Hands the person's choice to AILK's `POST /mcp/consent` in-process
+ * (`auth.api.mcpConsent`), which checks the session, the signed consent
+ * cookie and the role bound on every scope, and answers the client's own
+ * callback URL. Next's Server Action origin check plus that cookie match make
+ * a cross-site submit fail. A refusal returns to the page, which then renders
+ * what is still true.
+ */
+import { localeHref } from "@working-theory/ui";
+import { headers } from "next/headers";
+import { redirect } from "next/navigation";
+
+import { auth } from "../../../../auth";
+
+const LOCALE_PATTERN = /^[a-z]{2,3}(?:-[A-Za-z0-9]{2,8})*$/;
+
+export async function decideConsent(formData: FormData): Promise<void> {
+  const field = (name: string): string => {
+    const value = formData.get(name);
+    return typeof value === "string" ? value : "";
+  };
+  const consentCode = field("consent_code");
+  // The fallback redirect is built from it, so only a locale-shaped value
+  // counts: `/evil.example` would make `//evil.example/…`.
+  const locale = LOCALE_PATTERN.test(field("locale")) ? field("locale") : "en";
+  const accept = formData.get("decision") === "allow";
+  const workspaceId = formData.get("workspace_id");
+  const scopes = formData.getAll("scopes").filter((s): s is string => typeof s === "string");
+
+  let redirectURI: string | null;
+  try {
+    const answer = await auth.api.mcpConsent({
+      headers: await headers(),
+      body: {
+        consent_code: consentCode,
+        accept,
+        ...(accept && typeof workspaceId === "string" ? { workspace_id: workspaceId, scopes } : {}),
+      },
+    });
+    redirectURI = answer.redirectURI;
+  } catch {
+    redirectURI = null;
+  }
+  redirect(
+    redirectURI ?? localeHref(locale, `/consent?consent_code=${encodeURIComponent(consentCode)}`),
+  );
+}

package/templates/apps/web/app/[locale]/(auth)/consent/page.tsx

@@ -0,0 +1,144 @@
+/**
+ * `/[locale]/consent` — the MCP consent step (#10357 D6).
+ *
+ * The `mcp` plugin sends every authorization here (AILK's before-hook forces
+ * `prompt=consent`, D2) with a `consent_code` and a signed cookie. The page
+ * reads ONLY `consent_code` from its query — never `client_id` or `scope`,
+ * which the client controls — and asks AILK's `GET /mcp/consent-details`
+ * in-process. That endpoint checks the session, the cookie and that the code
+ * was issued to this person, and answers the client's self-claimed name,
+ * where the code will go, and each workspace with the scopes the person's
+ * role there may approve. Any refusal, or no session, renders the
+ * `unavailable` line and no form.
+ *
+ * It names who is signed in (with a sign-out back to this page), names the
+ * client as the client names itself — an unchecked claim — and its redirect
+ * origin, then hands the workspaces to the `ConsentForm` island. `noindex`,
+ * `referrer: same-origin` (the `account/connect` precedent). Framed by
+ * `AuthShell` like sign-in: `"consent"` is an `AUTH_SEGMENTS` entry.
+ */
+import { localeHref } from "@working-theory/ui";
+import { Button, Heading, Text } from "@working-theory/ui/primitives";
+import { SCOPE_GRANT_MAP, type McpScope } from "@working-theory/validation";
+import type { Metadata } from "next";
+import { headers } from "next/headers";
+import { getTranslations } from "next-intl/server";
+import type { ReactElement } from "react";
+
+import { auth } from "../../../../auth";
+import { SignOutTrigger } from "../../../../components/sign-out-trigger";
+
+import { ConsentForm, type ConsentWorkspace } from "./consent-form";
+
+interface Props {
+  params: Promise<{ locale: string }>;
+  searchParams: Promise<{ consent_code?: string | string[] }>;
+}
+
+interface ConsentDetails {
+  client: { name: string; redirectOrigin: string };
+  workspaces: Array<{ id: string; name: string; organizationName: string; offered: McpScope[] }>;
+}
+
+export async function generateMetadata({ params }: Props): Promise<Metadata> {
+  const { locale } = await params;
+  const t = await getTranslations({ locale, namespace: "mcpConsent" });
+  return {
+    title: t("metaTitle"),
+    robots: { index: false, follow: false },
+    referrer: "same-origin",
+  };
+}
+
+/** The details and the signed-in email, or `null` on any refusal. */
+async function readDetails(consentCode: string): Promise<{ details: ConsentDetails; email: string } | null> {
+  try {
+    const requestHeaders = await headers();
+    const session = await auth.api.getSession({ headers: requestHeaders });
+    if (!session) return null;
+    const details = (await auth.api.mcpConsentDetails({
+      headers: requestHeaders,
+      query: { consent_code: consentCode },
+    })) as ConsentDetails;
+    return { details, email: session.user.email };
+  } catch {
+    return null;
+  }
+}
+
+export default async function ConsentPage({ params, searchParams }: Props): Promise<ReactElement> {
+  const { locale } = await params;
+  const { consent_code: raw } = await searchParams;
+  const t = await getTranslations({ locale, namespace: "mcpConsent" });
+  const consentCode = typeof raw === "string" ? raw : "";
+  const read = consentCode ? await readDetails(consentCode) : null;
+
+  if (!read) {
+    return (
+      <div className="flex flex-col gap-4" data-testid="mcp-consent-unavailable">
+        <Heading level={1} visual={3}>
+          {t("heading")}
+        </Heading>
+        <Text as="p" variant="body-sm" tone="muted">
+          {t("unavailable")}
+        </Text>
+      </div>
+    );
+  }
+
+  const { details, email } = read;
+  const here = localeHref(locale, `/consent?consent_code=${encodeURIComponent(consentCode)}`);
+  const workspaces: ConsentWorkspace[] = details.workspaces.map((w) => ({
+    id: w.id,
+    name: w.name,
+    organizationName: w.organizationName,
+    offered: w.offered.map((scope) => {
+      const permission = SCOPE_GRANT_MAP[scope];
+      return { scope, permission, label: t(`scopes.${permission}`) };
+    }),
+  }));
+
+  return (
+    <div className="flex flex-col gap-6" data-testid="mcp-consent">
+      <div className="flex flex-col gap-2">
+        <Heading level={1} visual={3}>
+          {t("heading")}
+        </Heading>
+        <Text as="p" variant="body-sm" data-testid="mcp-consent-signed-in">
+          {t("signedInAs", { email })}
+        </Text>
+        <SignOutTrigger homeHref={here}>
+          <Button type="button" variant="link" data-testid="mcp-consent-sign-out">
+            {t("signOut")}
+          </Button>
+        </SignOutTrigger>
+      </div>
+      <div className="flex flex-col gap-2">
+        <Text as="p" variant="body-sm" data-testid="mcp-consent-client">
+          {t("clientClaim", { name: details.client.name })}
+        </Text>
+        <Text as="p" variant="body-sm" tone="muted" data-testid="mcp-consent-redirect-origin">
+          {t("returnsTo", { origin: details.client.redirectOrigin })}
+        </Text>
+      </div>
+      {workspaces.length === 0 ? (
+        <Text as="p" variant="body-sm" tone="muted" data-testid="mcp-consent-no-workspace">
+          {t("noWorkspace")}
+        </Text>
+      ) : null}
+      <ConsentForm
+        consentCode={consentCode}
+        locale={locale}
+        workspaces={workspaces}
+        text={{
+          workspaceLegend: t("workspaceLegend"),
+          scopesLegend: t("scopesLegend"),
+          memberReads: t("memberReads"),
+          noScopes: t("noScopes"),
+          allow: t("allow"),
+          deny: t("deny"),
+        }}
+      />
+    </div>
+  );
+}

package/templates/apps/web/app/[locale]/about/__tests__/about-routes.test.tsx

@@ -329,7 +329,7 @@ describe("the sitemap and llms.txt advertise /about/<slug>, never a bare /<slug>
 
   it("sitemap.xml: one <loc> ending in /about/sam-henry, none ending in a bare /sam-henry", async () => {
     const stubAdapter = makeStubAdapter();
-    const GET = createSitemapHandler({ getContentAdapter: () => stubAdapter, getDocsPages: () => [] });
+    const GET = createSitemapHandler({ getContentAdapter: () => stubAdapter, getDocsPages: () => [], discoverable: async () => true });
     const response = await GET();
     const text = await response.text();
     const locs = Array.from(text.matchAll(/<loc>([^<]*)<\/loc>/g)).map(
@@ -341,7 +341,7 @@ describe("the sitemap and llms.txt advertise /about/<slug>, never a bare /<slug>
 
   it("llms.txt: names a URL ending in /about/sam-henry", async () => {
     const stubAdapter = makeStubAdapter();
-    const GET = createLlmsHandler({ getContentAdapter: () => stubAdapter, getDocsPages: () => [] });
+    const GET = createLlmsHandler({ getContentAdapter: () => stubAdapter, getDocsPages: () => [], discoverable: async () => true });
     const response = await GET();
     const text = await response.text();
     expect(text).toContain("URL: https://site.example/about/sam-henry");

package/templates/apps/web/app/api/auth/hub/continuation.ts

@@ -30,7 +30,10 @@ export const CONTINUATION_REF_MAX = 4096;
  */
 export const CONTINUATION_TTL_SECONDS = 600;
 
-/** A fixed name: a value sealed for a cookie never opens here, nor the reverse. */
+/**
+ * A fixed name: a value sealed for a cookie never opens here, nor the reverse.
+ * The MCP sign-in leg seals under its own name (`../mcp/continuation.ts`).
+ */
 const AAD = "hub-continue";
 
 const BASE64URL = /^[A-Za-z0-9_-]+$/;
@@ -40,12 +43,13 @@ export function mintContinuation(
   search: string,
   secret: string,
   now: number = Date.now(),
+  name: string = AAD,
 ): string {
   return seal(
     { v: 1, q: search, exp: now + CONTINUATION_TTL_SECONDS * 1000 },
     secret,
     "continue",
-    AAD,
+    name,
   );
 }
 
@@ -62,9 +66,10 @@ export function openContinuation(
   ref: string,
   secret: string,
   now: number = Date.now(),
+  name: string = AAD,
 ): string | null {
   if (ref.length > CONTINUATION_REF_MAX || !BASE64URL.test(ref)) return null;
-  const value = unseal(ref, secret, "continue", AAD);
+  const value = unseal(ref, secret, "continue", name);
   if (typeof value !== "object" || value === null) return null;
   const { v, q, exp } = value as Record<string, unknown>;
   if (v !== 1 || typeof q !== "string" || q === "") return null;

package/templates/apps/web/app/api/auth/mcp/__tests__/continuation.test.ts

@@ -0,0 +1,92 @@
+/**
+ * @jest-environment node
+ */
+
+/**
+ * The MCP sign-in leg's continuation (#10479): the hub's sealed ref, under a
+ * name of its own. Pure functions over `seal.ts`; no mocks.
+ */
+import { mintContinuation } from "../../hub/continuation";
+import {
+  MCP_CONTINUE_PATH,
+  mintMcpContinuation,
+  openMcpContinuation,
+  sealMcpCallbacks,
+} from "../continuation";
+
+const SECRET = "k".repeat(43);
+const T = 1_790_000_000_000;
+
+const Q = new URLSearchParams({
+  response_type: "code",
+  client_id: "mcp-client",
+  redirect_uri: "http://127.0.0.1:53682/callback",
+  state: "s".repeat(43),
+  code_challenge: "c".repeat(43),
+  code_challenge_method: "S256",
+}).toString();
+
+it("pins the continue path", () => {
+  expect(MCP_CONTINUE_PATH).toBe("/api/auth/mcp/continue");
+});
+
+it("round-trips the authorize query, scheme-bearing redirect_uri included", () => {
+  expect(openMcpContinuation(mintMcpContinuation(Q, SECRET, T), SECRET, T + 1_000)).toBe(Q);
+});
+
+it("mints a ref no decode can change: base64url only, so no ':', '%', '?', '&' or '='", () => {
+  expect(mintMcpContinuation(Q, SECRET, T)).toMatch(/^[A-Za-z0-9_-]+$/);
+});
+
+it("expires at 600 s", () => {
+  expect(openMcpContinuation(mintMcpContinuation(Q, SECRET, T), SECRET, T + 600_000)).toBeNull();
+});
+
+it("never opens a hub ref, nor under another secret", () => {
+  expect(openMcpContinuation(mintContinuation(Q, SECRET, T), SECRET, T)).toBeNull();
+  expect(openMcpContinuation(mintMcpContinuation(Q, SECRET, T), "x".repeat(43), T)).toBeNull();
+});
+
+describe("sealMcpCallbacks — the sign-in body's MCP resume, sealed", () => {
+  const next = `/api/auth/mcp/authorize?${Q}`;
+  const refOf = (path: string | undefined) =>
+    /^\/api\/auth\/mcp\/continue\/([A-Za-z0-9_-]+)$/.exec(path ?? "")?.[1] ?? "";
+
+  it("seals callbackURL and the next inside the sign-in page's errorCallbackURL; both open to the query", () => {
+    const sealed = sealMcpCallbacks(
+      { callbackURL: next, errorCallbackURL: `/de/sign-in?next=${encodeURIComponent(next)}` },
+      SECRET,
+    );
+    expect(openMcpContinuation(refOf(sealed?.callbackURL), SECRET)).toBe(Q);
+    const error = new URL(sealed?.errorCallbackURL ?? "", "http://x.invalid");
+    expect(error.pathname).toBe("/de/sign-in");
+    expect(openMcpContinuation(refOf(error.searchParams.get("next") ?? ""), SECRET)).toBe(Q);
+    // No decode of either value can produce a ':'.
+    expect(decodeURIComponent(decodeURIComponent(sealed?.errorCallbackURL ?? ""))).not.toContain(":");
+  });
+
+  it.each([
+    ["no callbacks", {}],
+    ["an ordinary next", { callbackURL: "/account", errorCallbackURL: "/sign-in?next=%2Faccount" }],
+    ["the hub's own authorize path", { callbackURL: `/api/auth/hub/authorize?${Q}` }],
+    ["a foreign errorCallbackURL", { errorCallbackURL: `https://evil.example/?next=${encodeURIComponent(next)}` }],
+    ["a non-string callbackURL", { callbackURL: [next] }],
+    // Security review: URL's dot-segment collapse would emit //evil.example.
+    ["a dot-segment errorCallbackURL", { errorCallbackURL: `/.//evil.example?next=${encodeURIComponent(next)}` }],
+    ["an errorCallbackURL on another page", { errorCallbackURL: `/account?next=${encodeURIComponent(next)}` }],
+    ["an errorCallbackURL with a second key", { errorCallbackURL: `/sign-in?next=${encodeURIComponent(next)}&x=1` }],
+    ["a next holding CR/LF", { callbackURL: `${next}%0D%0A`.replace("%0D%0A", "\r\n") }],
+    ["an undecodable next", { errorCallbackURL: "/sign-in?next=%E0%A4%A" }],
+  ])("leaves %s alone (null)", (_name, body) => {
+    expect(sealMcpCallbacks(body, SECRET)).toBeNull();
+  });
+
+  it("seals the sign-up page's errorCallbackURL the same way", () => {
+    const sealed = sealMcpCallbacks({ errorCallbackURL: `/sign-up?next=${encodeURIComponent(next)}` }, SECRET);
+    expect(sealed?.errorCallbackURL).toMatch(/^\/sign-up\?next=%2Fapi%2Fauth%2Fmcp%2Fcontinue%2F[A-Za-z0-9_-]+$/);
+  });
+
+  it("leaves a query too long to seal under the continue route's cap as it was", () => {
+    expect(sealMcpCallbacks({ callbackURL: `${next}&state=${"s".repeat(4096)}` }, SECRET)).toBeNull();
+  });
+});

package/templates/apps/web/app/api/auth/mcp/continuation.ts

@@ -0,0 +1,89 @@
+/**
+ * The MCP sign-in leg's continuation (#10479).
+ *
+ * The plugin's `loginPage` (`lib/mcp-oauth.ts`, `/mcp/sign-in`) hands
+ * `/sign-in` a `next` of `/api/auth/mcp/authorize?<query>`, and the page sends
+ * it on as the sign-in's `callbackURL`. An MCP client's query carries a
+ * scheme-bearing `redirect_uri` (`http://127.0.0.1:PORT/callback`, any
+ * `https://` callback), and Better Auth's magic-link verify decodes
+ * `callbackURL` and checks it as a relative path whose query admits no `:` —
+ * so the emailed link answered 403 INVALID_CALLBACK_URL and the person never
+ * reached `/consent`.
+ *
+ * `auth.ts` therefore rewrites such a callback, as a sign-in request arrives,
+ * to the same-origin path `/api/auth/mcp/continue/<ref>` — the hub's sealed
+ * ref (`../hub/continuation.ts`), under a name of its own so a ref minted for
+ * one leg never opens at the other — and the continue route returns the
+ * person to `/mcp/authorize`, which forces consent again.
+ */
+import { CONTINUATION_REF_MAX, mintContinuation, openContinuation } from "../hub/continuation";
+
+/** The same-origin path a ref is appended to. */
+export const MCP_CONTINUE_PATH = "/api/auth/mcp/continue";
+
+/** The resume target the plugin's `loginPage` puts in `next`. */
+const AUTHORIZE_PREFIX = "/api/auth/mcp/authorize?";
+
+const NAME = "mcp-continue";
+
+const PRINTABLE = /^[\x21-\x7e]+$/;
+
+/**
+ * The exact `errorCallbackURL` the sign-in and sign-up pages send:
+ * `[/<locale>]/sign-in?next=<encoded>` (or `/sign-up`). Matched on the raw
+ * string and rebuilt from its own path bytes — never through `URL`, whose
+ * dot-segment collapse would turn an accepted `/.//host` into a
+ * protocol-relative `//host` after Better Auth's origin check has run.
+ */
+const SIGN_IN_ERROR_CALLBACK = /^(\/(?:[a-z]{2}(?:-[A-Za-z]{2,4})?\/)?sign-(?:in|up))\?next=([^&#]*)$/;
+
+/** `search` (the authorize query, no leading `?`) as a sealed ref. */
+export function mintMcpContinuation(search: string, secret: string, now: number = Date.now()): string {
+  return mintContinuation(search, secret, now, NAME);
+}
+
+/** The authorize query a ref holds, or `null` (see `openContinuation`). */
+export function openMcpContinuation(ref: string, secret: string, now: number = Date.now()): string | null {
+  return openContinuation(ref, secret, now, NAME);
+}
+
+/** `path` as a continue path when it resumes an MCP authorization, else unchanged. */
+function sealed(path: string, secret: string): string {
+  // Printable ASCII only, as the origin check admits: nothing sealed may hold
+  // a control or non-Latin-1 character the continue route's Location refuses.
+  if (!path.startsWith(AUTHORIZE_PREFIX) || !PRINTABLE.test(path)) return path;
+  const ref = mintMcpContinuation(path.slice(AUTHORIZE_PREFIX.length), secret);
+  // Past the cap the continue route would not open it: leave the path as it was.
+  return ref.length > CONTINUATION_REF_MAX ? path : `${MCP_CONTINUE_PATH}/${ref}`;
+}
+
+/**
+ * The sign-in body's callbacks with every MCP resume sealed, or `null` when
+ * none is: `callbackURL` itself, and the `next` the sign-in page puts inside
+ * `errorCallbackURL` (`SIGN_IN_ERROR_CALLBACK`), whose decoded form holds the
+ * same query. Every other value — any other shape included — passes through
+ * unchanged, so this hook can only ever write a same-origin continue path.
+ */
+export function sealMcpCallbacks(
+  body: { callbackURL?: unknown; errorCallbackURL?: unknown },
+  secret: string,
+): { callbackURL?: string; errorCallbackURL?: string } | null {
+  const out: { callbackURL?: string; errorCallbackURL?: string } = {};
+  if (typeof body.callbackURL === "string") {
+    const callbackURL = sealed(body.callbackURL, secret);
+    if (callbackURL !== body.callbackURL) out.callbackURL = callbackURL;
+  }
+  const match = typeof body.errorCallbackURL === "string" ? SIGN_IN_ERROR_CALLBACK.exec(body.errorCallbackURL) : null;
+  if (match) {
+    const [, page, encoded = ""] = match;
+    let next: string;
+    try {
+      next = decodeURIComponent(encoded);
+    } catch {
+      next = "";
+    }
+    const continued = sealed(next, secret);
+    if (continued !== next) out.errorCallbackURL = `${page}?next=${encodeURIComponent(continued)}`;
+  }
+  return Object.keys(out).length > 0 ? out : null;
+}

package/templates/apps/web/app/api/auth/mcp/continue/[ref]/__tests__/route.test.ts

@@ -0,0 +1,59 @@
+/**
+ * @jest-environment node
+ */
+
+/**
+ * The MCP sign-in leg's continue step (#10479): a ref returns the person to
+ * `/api/auth/mcp/authorize` with the original query, and nowhere else.
+ */
+import { mintContinuation } from "../../../../hub/continuation";
+import { mintMcpContinuation } from "../../../continuation";
+import { GET } from "../route";
+
+const SITE = "https://site.example.com";
+const SECRET = "flow-secret-0123456789abcdef0123456789abcdef";
+const ORIGINAL_ENV = process.env;
+
+const QUERY = new URLSearchParams({
+  response_type: "code",
+  client_id: "mcp-client",
+  redirect_uri: "http://127.0.0.1:53682/callback",
+  state: "s".repeat(43),
+  code_challenge: "c".repeat(43),
+  code_challenge_method: "S256",
+}).toString();
+
+function continueTo(ref: string): Promise<Response> {
+  return GET(new Request(`${SITE}/api/auth/mcp/continue/${ref}`), {
+    params: Promise.resolve({ ref }),
+  });
+}
+
+beforeEach(() => {
+  process.env = { ...ORIGINAL_ENV, BETTER_AUTH_SECRET: SECRET };
+});
+
+afterAll(() => {
+  process.env = ORIGINAL_ENV;
+});
+
+it("answers a valid ref with 303 to /api/auth/mcp/authorize and the same query", async () => {
+  const res = await continueTo(mintMcpContinuation(QUERY, SECRET));
+
+  expect(res.status).toBe(303);
+  expect(res.headers.get("location")).toBe(`/api/auth/mcp/authorize?${QUERY}`);
+  expect(res.headers.get("cache-control")).toBe("no-store");
+  expect(res.headers.get("referrer-policy")).toBe("no-referrer");
+});
+
+it.each([
+  ["a forged ref", "not-a-ref"],
+  ["a hub ref", mintContinuation(QUERY, SECRET)],
+  ["an expired ref", mintMcpContinuation(QUERY, SECRET, Date.now() - 601_000)],
+  ["a ref sealed under another secret", mintMcpContinuation(QUERY, "x".repeat(43))],
+])("sends %s to /account, never to a URL it carries", async (_name, ref) => {
+  const res = await continueTo(ref);
+
+  expect(res.status).toBe(303);
+  expect(res.headers.get("location")).toBe("/account");
+});

package/templates/apps/web/app/api/auth/mcp/continue/[ref]/route.ts

@@ -0,0 +1,41 @@
+/**
+ * The MCP sign-in leg's continue step (#10479).
+ *
+ *   GET /api/auth/mcp/continue/<ref>
+ *
+ * After sign-in — by the emailed link, the password or a social provider —
+ * the person lands here, and this route returns them to the authorize step:
+ *
+ *   - a valid, unexpired ref: 303 to `/api/auth/mcp/authorize?<the query>`;
+ *   - any other ref (forged, a hub ref, expired, unreadable): 303 to
+ *     `/account`.
+ *
+ * Both targets are fixed relative paths: this route redirects nowhere else,
+ * and never to a URL carried in the ref. It reads no session — the authorize
+ * step does, and forces consent. It logs nothing.
+ */
+import { resolveSecret } from "../../../../../../lib/auth-secret";
+import { openMcpContinuation } from "../../continuation";
+
+const AUTHORIZE_PATH = "/api/auth/mcp/authorize";
+
+/** Where an unreadable ref goes: the site's own signed-in destination. */
+const FALLBACK_PATH = "/account";
+
+// platform-decisions-waiver: api-versioning — sign-in redirect step, not a versioned API contract (#10479)
+export async function GET(
+  _request: Request,
+  { params }: { params: Promise<{ ref: string }> },
+): Promise<Response> {
+  const { ref } = await params;
+  const query = openMcpContinuation(ref, resolveSecret());
+  return new Response(null, {
+    status: 303,
+    headers: {
+      Location: query === null ? FALLBACK_PATH : `${AUTHORIZE_PATH}?${query}`,
+      "Cache-Control": "no-store",
+      // The authorize query rides this URL; no page may leak it through a Referer.
+      "Referrer-Policy": "no-referrer",
+    },
+  });
+}