excalidrop 0.2.9 → 0.2.10

package/README.md

@@ -324,6 +324,16 @@ Notes:
 - OAuth discovery for clients: `https://excalidrop.wtf403.workers.dev/.well-known/oauth-authorization-server`.
 - Browser login is bounce-free: hosts outside the OAuth callback list redirect through the central login host straight to GitHub (target allowlist-checked, no confirm modal).
 
+### One-click OAuth for chat clients (DCR)
+
+The worker is its own OAuth Authorization Server (spec `2026-07-28`, RFC 7591 + PKCE):
+
+- `POST /register` mints a client (`excc_*`/`excs_*`); `GET /authorize` bounces to GitHub; `/oauth/callback` swaps the code server-side (app secret never leaves the worker); `POST /token` returns the GitHub user token as `access_token`.
+- `GET /.well-known/oauth-protected-resource` + `WWW-Authenticate` challenge on `/mcp` 401s drive automatic discovery.
+- Contract tests: `node worker/test/oauth.test.mjs` (30 checks, stubbed KV + GitHub).
+- The demo OAuth App is third-party: for full self-ownership, register your own GitHub OAuth App with callback `https://<your-worker>/oauth/callback`, then set `MCP_GITHUB_CLIENT_ID` (wrangler.toml) + `wrangler secret put MCP_GITHUB_CLIENT_SECRET` and redeploy. Until then the shared id works for login but chat-client flows stop at GitHub's "Invalid Redirect URI" page.
+- Org repos with SAML SSO: authorize the OAuth App under the org's SSO settings, or API calls 404 despite a valid token.
+
 ## Testing
 
 ### Status

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "excalidrop",
-  "version": "0.2.9",
+  "version": "0.2.10",
   "description": "Remote GitHub-backed Excalidraw canvas + MCP server — no local server, one-command setup",
   "main": "dist/mcp.js",
   "type": "module",

package/worker/src/index.js

@@ -43,22 +43,7 @@ function originAllowed(origin, allowlist) {
 
 export { RelayRoom } from './relay.js';
 import { handleMcp } from './mcp.js';
-
-// Client metadata (CIMD-style discovery) so chat clients can discover the
-// GitHub OAuth endpoints for this MCP server without Dynamic Client
-// Registration. The worker itself never mints tokens — GitHub does.
-function oauthMetadata(host) {
-  return {
-    issuer: 'https://github.com',
-    authorization_endpoint: 'https://github.com/login/oauth/authorize',
-    token_endpoint: 'https://github.com/login/oauth/access_token',
-    response_types_supported: ['code'],
-    grant_types_supported: ['authorization_code', 'refresh_token'],
-    scopes_supported: ['repo', 'read:user'],
-    mcp_endpoint: `https://${host}/mcp`,
-    mcp_protocol_version: '2026-07-28',
-  };
-}
+import { handleOAuth } from './oauth.js';
 
 export default {
   async fetch(req, env) {
@@ -85,8 +70,16 @@ export default {
     if (url.pathname === '/mcp' || url.pathname === '/mcp/') {
       return handleMcp(req, env, cors);
     }
-    if (req.method === 'GET' && url.pathname === '/.well-known/oauth-authorization-server') {
-      return json(oauthMetadata(url.host), 200, cors);
+    // OAuth Authorization Server (DCR + authorize/callback/token) and
+    // RFC 9728 resource discovery. Replaces the old GitHub-pointing metadata
+    // doc, which could never complete an automated flow (no DCR on github.com).
+    if (
+      url.pathname === '/register' || url.pathname === '/authorize' ||
+      url.pathname === '/oauth/callback' || url.pathname === '/token' ||
+      url.pathname === '/.well-known/oauth-authorization-server' ||
+      url.pathname === '/.well-known/oauth-protected-resource'
+    ) {
+      return handleOAuth(req, env, cors);
     }
     if (url.pathname === '/relay' || url.pathname.startsWith('/rpc/')) {
       if (!env.RELAY) return json({ error: 'relay not configured (missing durable object binding)' }, 500, cors);

package/worker/src/mcp.js

@@ -561,7 +561,14 @@ export async function handleMcp(req, env, cors) {
 
   const ip = req.headers.get('cf-connecting-ip') || 'unknown';
   const token = (req.headers.get('Authorization') || '').replace(/^Bearer\s+/i, '');
-  if (!token) return new Response(JSON.stringify(rpcError(null, -32001, 'missing Bearer token — connect with GitHub OAuth (repo scope)')), { status: 401, headers });
+  if (!token) {
+    // RFC 9728 discovery trigger: clients fetch resource_metadata → AS metadata → DCR.
+    const origin = new URL(req.url).origin;
+    return new Response(JSON.stringify(rpcError(null, -32001, 'missing Bearer token — register at POST /register, then OAuth authorize (see /.well-known/oauth-protected-resource)')), {
+      status: 401,
+      headers: { ...headers, 'WWW-Authenticate': `Bearer resource_metadata="${origin}/.well-known/oauth-protected-resource"` },
+    });
+  }
   if (!rateOk(`mcp:${hashToken(token)}`, 60, 60000) || !rateOk(`mcpip:${ip}`, 120, 60000)) {
     return new Response(JSON.stringify(rpcError(null, -32002, 'rate limited (60/min per token). Retry shortly.')), { status: 429, headers });
   }

package/worker/src/oauth.js

@@ -0,0 +1,218 @@
+// OAuth Authorization Server for remote MCP clients (spec 2026-07-28,
+// RFC 7591 DCR + RFC 7636 PKCE). The worker fronts the GitHub OAuth App:
+// clients register with US, users log in at github.com, and /token hands
+// back the GitHub user token as the access token. The app secret never
+// leaves the worker. Viewer /exchange flow is untouched.
+//
+// State lives in the OAUTH KV binding (fail closed when missing):
+//   oauth:client:{id}   {secret, redirect_uris[], name}            90d
+//   oauth:session:{sid}  {client_id, redirect_uri, scope, challenge, client_state}  10min
+//   oauth:code:{code}    {client_id, redirect_uri, scope, github_token, challenge}  5min, single-use
+
+// App credentials for the AS flow. Prefer dedicated MCP_* vars (your own
+// GitHub OAuth App, where you register /oauth/callback); fall back to the
+// shared viewer-app vars.
+function appCreds(env) {
+  return {
+    id: env.MCP_GITHUB_CLIENT_ID || env.GITHUB_CLIENT_ID,
+    secret: env.MCP_GITHUB_CLIENT_SECRET || env.GITHUB_CLIENT_SECRET,
+  };
+}
+//   oauth:client:{id}   {secret, redirect_uris[], name}            90d
+//   oauth:session:{sid}  {client_id, redirect_uri, scope, challenge, client_state}  10min
+//   oauth:code:{code}    {client_id, redirect_uri, scope, github_token, challenge}  5min, single-use
+
+function rnd(prefix, bytes = 24) {
+  const b = new Uint8Array(bytes);
+  crypto.getRandomValues(b);
+  let bin = '';
+  for (const x of b) bin += String.fromCharCode(x);
+  return prefix + btoa(bin).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+
+async function sha256B64url(str) {
+  const d = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(str));
+  let bin = '';
+  for (const x of new Uint8Array(d)) bin += String.fromCharCode(x);
+  return btoa(bin).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+
+function err(status, error, description, cors) {
+  return new Response(JSON.stringify({ error, ...(description ? { error_description: description } : {}) }), {
+    status, headers: { 'Content-Type': 'application/json', ...cors },
+  });
+}
+
+// https anywhere; http only for loopback (RFC 8252 §7.3).
+function redirectAllowed(u) {
+  let p;
+  try { p = new URL(u); } catch { return false; }
+  if (p.protocol === 'https:') return true;
+  if (p.protocol === 'http:') return p.hostname === 'localhost' || p.hostname === '127.0.0.1' || p.hostname === '[::1]';
+  return false;
+}
+
+function clientAuth(req, params) {
+  // client_secret_basic or client_secret_post (RFC 6749 §2.3).
+  const h = req.headers.get('Authorization') || '';
+  const m = /^Basic\s+(.+)$/i.exec(h);
+  if (m) {
+    try {
+      const [id, secret] = atob(m[1]).split(':');
+      return { id: id || params.client_id, secret };
+    } catch { /* fall through */ }
+  }
+  return { id: params.client_id, secret: params.client_secret };
+}
+
+export async function handleOAuth(req, env, cors) {
+  const url = new URL(req.url);
+  const origin = url.origin;
+  const kv = env.OAUTH;
+
+  if (req.method === 'GET' && url.pathname === '/.well-known/oauth-authorization-server') {
+    return new Response(JSON.stringify({
+      issuer: origin,
+      authorization_endpoint: origin + '/authorize',
+      token_endpoint: origin + '/token',
+      registration_endpoint: origin + '/register',
+      response_types_supported: ['code'],
+      grant_types_supported: ['authorization_code', 'refresh_token'],
+      response_modes_supported: ['query'],
+      scopes_supported: ['repo'],
+      token_endpoint_auth_methods_supported: ['client_secret_basic', 'client_secret_post', 'none'],
+      code_challenge_methods_supported: ['S256', 'plain'],
+    }), { headers: { 'Content-Type': 'application/json', ...cors } });
+  }
+
+  if (req.method === 'GET' && url.pathname === '/.well-known/oauth-protected-resource') {
+    return new Response(JSON.stringify({
+      resource: origin + '/mcp',
+      authorization_servers: [origin],
+      scopes_supported: ['repo'],
+      bearer_methods_supported: ['header'],
+    }), { headers: { 'Content-Type': 'application/json', ...cors } });
+  }
+
+  if (!kv) return err(500, 'server_error', 'oauth store not configured on this deployment', cors);
+
+  // ---- RFC 7591 Dynamic Client Registration
+  if (url.pathname === '/register') {
+    if (req.method !== 'POST') return err(405, 'invalid_request', 'use POST', cors);
+    let body;
+    try { body = await req.json(); } catch { return err(400, 'invalid_request', 'bad json', cors); }
+    const uris = body?.redirect_uris;
+    if (!Array.isArray(uris) || !uris.length || !uris.every((u) => typeof u === 'string' && redirectAllowed(u))) {
+      return err(400, 'invalid_redirect_uri', 'redirect_uris must be non-empty; https required (http allowed for localhost only)', cors);
+    }
+    const client_id = rnd('excc_');
+    const client_secret = rnd('excs_', 32);
+    await kv.put(`oauth:client:${client_id}`, JSON.stringify({ secret: client_secret, redirect_uris: uris, name: String(body.client_name || '').slice(0, 100), created: Date.now() }), { expirationTtl: 90 * 86400 });
+    return new Response(JSON.stringify({
+      client_id, client_secret, redirect_uris: uris,
+      grant_types: ['authorization_code', 'refresh_token'],
+      token_endpoint_auth_method: 'client_secret_post',
+    }), { status: 201, headers: { 'Content-Type': 'application/json', ...cors } });
+  }
+
+  // ---- Authorize: validate, stash session, bounce to GitHub
+  if (url.pathname === '/authorize') {
+    if (req.method !== 'GET') return err(405, 'invalid_request', 'use GET', cors);
+    const q = url.searchParams;
+    if (q.get('response_type') !== 'code') return err(400, 'unsupported_response_type', 'only code is supported', cors);
+    const rawClient = await kv.get(`oauth:client:${q.get('client_id') || ''}`);
+    if (!rawClient) return err(400, 'invalid_request', 'unknown client_id (register at POST /register first)', cors);
+    const client = JSON.parse(rawClient);
+    const redirect_uri = q.get('redirect_uri') || '';
+    if (!client.redirect_uris.includes(redirect_uri)) return err(400, 'invalid_request', 'redirect_uri mismatch (must exactly match a registered URI)', cors);
+    const app = appCreds(env);
+    if (!app.id || !app.secret) return err(500, 'server_error', 'github app not configured', cors);
+    const method = q.get('code_challenge_method') || 'plain';
+    if (q.get('code_challenge') && method !== 'S256' && method !== 'plain') return err(400, 'invalid_request', 'code_challenge_method must be S256 or plain', cors);
+    const sid = rnd('excsess_');
+    await kv.put(`oauth:session:${sid}`, JSON.stringify({
+      client_id: q.get('client_id'), redirect_uri,
+      scope: String(q.get('scope') || 'repo').slice(0, 200),
+      challenge: q.get('code_challenge') || null, challenge_method: method,
+      client_state: q.get('state') || '',
+    }), { expirationTtl: 600 });
+    const gh = new URL('https://github.com/login/oauth/authorize');
+    gh.searchParams.set('client_id', app.id);
+    gh.searchParams.set('redirect_uri', origin + '/oauth/callback');
+    gh.searchParams.set('scope', 'repo');
+    gh.searchParams.set('state', sid);
+    return new Response(null, { status: 302, headers: { Location: gh.toString(), ...cors } });
+  }
+
+  // ---- Callback from GitHub: swap code, mint our code, return to client
+  if (url.pathname === '/oauth/callback') {
+    if (req.method !== 'GET') return err(405, 'invalid_request', 'use GET', cors);
+    const q = url.searchParams;
+    const rawSess = q.get('state') ? await kv.get(`oauth:session:${q.get('state')}`) : null;
+    if (!rawSess || !q.get('code')) return err(400, 'invalid_request', 'unknown or expired session (restart login)', cors);
+    const sess = JSON.parse(rawSess);
+    const r = await fetch('https://github.com/login/oauth/access_token', {
+      method: 'POST',
+      headers: { Accept: 'application/json', 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        client_id: appCreds(env).id, client_secret: appCreds(env).secret,
+        code: q.get('code'), redirect_uri: origin + '/oauth/callback',
+      }),
+    }).catch(() => null);
+    const j = await r?.json().catch(() => null);
+    if (!r || !r.ok || !j?.access_token) {
+      return err(400, 'access_denied', j?.error_description || j?.error || 'github exchange failed', cors);
+    }
+    const code = rnd('excode_');
+    await kv.put(`oauth:code:${code}`, JSON.stringify({
+      client_id: sess.client_id, redirect_uri: sess.redirect_uri, scope: 'repo',
+      github_token: j.access_token, challenge: sess.challenge, challenge_method: sess.challenge_method,
+    }), { expirationTtl: 300 });
+    await kv.delete(`oauth:session:${q.get('state')}`);
+    const back = new URL(sess.redirect_uri);
+    back.searchParams.set('code', code);
+    if (sess.client_state) back.searchParams.set('state', sess.client_state);
+    return new Response(null, { status: 302, headers: { Location: back.toString(), ...cors } });
+  }
+
+  // ---- Token endpoint
+  if (url.pathname === '/token') {
+    if (req.method !== 'POST') return err(405, 'invalid_request', 'use POST', cors);
+    const ct = req.headers.get('Content-Type') || '';
+    let params = {};
+    try {
+      if (ct.includes('application/json')) params = await req.json();
+      else params = Object.fromEntries(new URLSearchParams(await req.text()));
+    } catch { return err(400, 'invalid_request', 'bad body', cors); }
+    if (params.grant_type === 'refresh_token') {
+      return err(400, 'unsupported_grant_type', 'tokens do not expire; re-authorize if needed', cors);
+    }
+    if (params.grant_type !== 'authorization_code') return err(400, 'unsupported_grant_type', 'only authorization_code is supported', cors);
+    const rawCode = params.code ? await kv.get(`oauth:code:${params.code}`) : null;
+    if (!rawCode) return err(400, 'invalid_grant', 'unknown or expired code', cors);
+    const rec = JSON.parse(rawCode);
+    const { id, secret } = clientAuth(req, params);
+    if (!id || id !== rec.client_id) return err(401, 'invalid_client', 'client mismatch', cors);
+    if (params.redirect_uri && params.redirect_uri !== rec.redirect_uri) return err(400, 'invalid_grant', 'redirect_uri mismatch', cors);
+    const rawClient = await kv.get(`oauth:client:${id}`);
+    const client = rawClient ? JSON.parse(rawClient) : null;
+    if (!client) return err(401, 'invalid_client', 'unknown client', cors);
+    if (secret !== undefined && secret !== null && secret !== '') {
+      if (secret !== client.secret) return err(401, 'invalid_client', 'bad client_secret', cors);
+    } else if (rec.challenge) {
+      const verifier = params.code_verifier || '';
+      const ok = rec.challenge_method === 'plain'
+        ? verifier === rec.challenge
+        : verifier && (await sha256B64url(verifier)) === rec.challenge;
+      if (!ok) return err(400, 'invalid_grant', 'PKCE verification failed', cors);
+    } else {
+      return err(401, 'invalid_client', 'client authentication required (secret or PKCE)', cors);
+    }
+    await kv.delete(`oauth:code:${params.code}`);
+    return new Response(JSON.stringify({
+      access_token: rec.github_token, token_type: 'Bearer', scope: 'repo',
+    }), { headers: { 'Content-Type': 'application/json', 'Cache-Control': 'no-store', Pragma: 'no-cache', ...cors } });
+  }
+
+  return err(404, 'not_found', 'unknown oauth route', cors);
+}

package/worker/test/oauth.test.mjs

@@ -0,0 +1,146 @@
+// OAuth Authorization Server contract tests (worker HTTP seam).
+// Run: node worker/test/oauth.test.mjs  (fails until src/oauth.js exists)
+import { createHash } from 'node:crypto';
+
+const failures = [];
+function check(cond, msg) {
+  if (cond) console.log('  ok:', msg);
+  else { failures.push(msg); console.log('  FAIL:', msg); }
+}
+
+// --- stub env: in-memory KV with TTL, stubbed github fetch
+function makeKv() {
+  const m = new Map();
+  return {
+    async get(k) { const e = m.get(k); if (!e || e.exp < Date.now()) return null; return e.v; },
+    async put(k, v, opts = {}) { m.set(k, { v, exp: Date.now() + (opts.expirationTtl || 3600) * 1000 }); },
+    async delete(k) { m.delete(k); },
+  };
+}
+const GITHUB_CODE = 'gh_code_abc';
+const GITHUB_TOKEN = 'ghu_test123';
+globalThis.fetch = async (url, init = {}) => {
+  const u = String(url);
+  if (u === 'https://github.com/login/oauth/access_token') {
+    const body = JSON.parse(init.body);
+    if (body.code === GITHUB_CODE && body.client_secret === 'TEST_SECRET') {
+      return Response.json({ access_token: GITHUB_TOKEN, scope: 'repo', token_type: 'bearer' });
+    }
+    return Response.json({ error: 'bad_verification_code' }, { status: 200 });
+  }
+  throw new Error('unexpected fetch: ' + u);
+};
+const env = { OAUTH: makeKv(), GITHUB_CLIENT_ID: 'TEST_APP_ID', GITHUB_CLIENT_SECRET: 'TEST_SECRET' };
+const HOST = 'https://relay.example.test';
+
+const { handleOAuth } = await import('../src/oauth.js');
+const call = (path, opts = {}) => handleOAuth(new Request(HOST + path, opts), env, {});
+
+// RFC7636 example pair (independent of implementation)
+const VERIFIER = 'dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk';
+const CHALLENGE = createHash('sha256').update(VERIFIER).digest('base64url');
+
+// 1. AS metadata points at US, advertises DCR + PKCE
+{
+  const r = await call('/.well-known/oauth-authorization-server');
+  const j = await r.json();
+  check(r.status === 200, 'metadata 200');
+  check(j.issuer === HOST, 'metadata issuer is worker origin');
+  check(j.authorization_endpoint === HOST + '/authorize', 'metadata authorize endpoint');
+  check(j.token_endpoint === HOST + '/token', 'metadata token endpoint');
+  check(j.registration_endpoint === HOST + '/register', 'metadata registration endpoint (DCR)');
+  check((j.code_challenge_methods_supported || []).includes('S256'), 'metadata advertises S256');
+}
+// 2. protected-resource doc
+{
+  const r = await call('/.well-known/oauth-protected-resource');
+  const j = await r.json();
+  check(r.status === 200, 'protected-resource 200');
+  check(j.resource === HOST + '/mcp', 'protected resource is /mcp');
+  check((j.authorization_servers || []).includes(HOST), 'protected resource lists our AS');
+}
+// 3. register validation
+{
+  const bad = await call('/register', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ redirect_uris: ['http://evil.com/cb'] }) });
+  check(bad.status === 400, 'register rejects non-https redirect');
+  const ok = await call('/register', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ redirect_uris: ['https://app.example/cb'], client_name: 't' }) });
+  const j = await ok.json();
+  check(ok.status === 201 && !!j.client_id && !!j.client_secret, 'register returns client_id + client_secret');
+  var CLIENT = j;
+  const local = await call('/register', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ redirect_uris: ['http://localhost:8787/cb'] }) });
+  check(local.status === 201, 'register allows http localhost');
+}
+// 4. authorize validation + github redirect
+{
+  const unknown = await call(`/authorize?response_type=code&client_id=nope&redirect_uri=${encodeURIComponent('https://app.example/cb')}`);
+  check(unknown.status === 400, 'authorize rejects unknown client');
+  const mismatch = await call(`/authorize?response_type=code&client_id=${CLIENT.client_id}&redirect_uri=${encodeURIComponent('https://evil.com/cb')}&state=s1`);
+  check(mismatch.status === 400, 'authorize rejects redirect mismatch');
+  const ok = await call(`/authorize?response_type=code&client_id=${CLIENT.client_id}&redirect_uri=${encodeURIComponent('https://app.example/cb')}&scope=repo&state=s1&code_challenge=${CHALLENGE}&code_challenge_method=S256`);
+  check(ok.status === 302, 'authorize 302s to github');
+  const loc = new URL(ok.headers.get('location'));
+  check(loc.hostname === 'github.com' && loc.pathname === '/login/oauth/authorize', 'authorize target is github');
+  check(loc.searchParams.get('client_id') === 'TEST_APP_ID', 'authorize uses app client_id (secret stays server-side)');
+  check(loc.searchParams.get('redirect_uri') === HOST + '/oauth/callback', 'authorize callback is worker endpoint');
+  check(loc.searchParams.get('scope') === 'repo', 'authorize requests repo scope');
+  check(!!loc.searchParams.get('state'), 'authorize carries session state');
+  var SESSION = loc.searchParams.get('state');
+}
+// 5. callback: bad state, then happy path
+{
+  const bad = await call(`/oauth/callback?code=${GITHUB_CODE}&state=bogus`);
+  check(bad.status === 400, 'callback rejects unknown session');
+  const ok = await call(`/oauth/callback?code=${GITHUB_CODE}&state=${SESSION}`);
+  check(ok.status === 302, 'callback 302s back to client');
+  const loc = new URL(ok.headers.get('location'));
+  check(loc.origin === 'https://app.example' && loc.pathname === '/cb', 'callback returns to registered redirect');
+  check(!!loc.searchParams.get('code') && loc.searchParams.get('state') === 's1', 'callback carries code + client state');
+  var CODE = loc.searchParams.get('code');
+}
+// 6. token: bad code, happy path with secret, single-use
+{
+  const bad = await call('/token', { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams({ grant_type: 'authorization_code', code: 'bogus', redirect_uri: 'https://app.example/cb', client_id: CLIENT.client_id, client_secret: CLIENT.client_secret }) });
+  check(bad.status === 400 && (await bad.json()).error === 'invalid_grant', 'token rejects bad code');
+  const ok = await call('/token', { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams({ grant_type: 'authorization_code', code: CODE, redirect_uri: 'https://app.example/cb', client_id: CLIENT.client_id, client_secret: CLIENT.client_secret }) });
+  const j = await ok.json();
+  check(ok.status === 200 && j.access_token === GITHUB_TOKEN && j.token_type === 'Bearer', 'token returns github user token as access_token');
+  const reuse = await call('/token', { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams({ grant_type: 'authorization_code', code: CODE, redirect_uri: 'https://app.example/cb', client_id: CLIENT.client_id, client_secret: CLIENT.client_secret }) });
+  check(reuse.status === 400, 'code is single-use');
+}
+// 7. PKCE-only public client (no secret presented)
+{
+  const ok = await call(`/authorize?response_type=code&client_id=${CLIENT.client_id}&redirect_uri=${encodeURIComponent('https://app.example/cb')}&state=s2&code_challenge=${CHALLENGE}&code_challenge_method=S256`);
+  const sid = new URL(ok.headers.get('location')).searchParams.get('state');
+  const cb = await call(`/oauth/callback?code=${GITHUB_CODE}&state=${sid}`);
+  const code = new URL(cb.headers.get('location')).searchParams.get('code');
+  const good = await call('/token', { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams({ grant_type: 'authorization_code', code, redirect_uri: 'https://app.example/cb', client_id: CLIENT.client_id, code_verifier: VERIFIER }) });
+  check(good.status === 200, 'PKCE verifier without secret succeeds');
+  const ok2 = await call(`/authorize?response_type=code&client_id=${CLIENT.client_id}&redirect_uri=${encodeURIComponent('https://app.example/cb')}&state=s3&code_challenge=${CHALLENGE}&code_challenge_method=S256`);
+  const sid2 = new URL(ok2.headers.get('location')).searchParams.get('state');
+  const cb2 = await call(`/oauth/callback?code=${GITHUB_CODE}&state=${sid2}`);
+  const code2 = new URL(cb2.headers.get('location')).searchParams.get('code');
+  const wrong = await call('/token', { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams({ grant_type: 'authorization_code', code: code2, redirect_uri: 'https://app.example/cb', client_id: CLIENT.client_id, code_verifier: 'wrong' }) });
+  check(wrong.status === 400, 'wrong PKCE verifier rejected');
+}
+// 8. wrong secret rejected
+{
+  const ok = await call(`/authorize?response_type=code&client_id=${CLIENT.client_id}&redirect_uri=${encodeURIComponent('https://app.example/cb')}&state=s4&code_challenge=${CHALLENGE}&code_challenge_method=S256`);
+  const sid = new URL(ok.headers.get('location')).searchParams.get('state');
+  const cb = await call(`/oauth/callback?code=${GITHUB_CODE}&state=${sid}`);
+  const code = new URL(cb.headers.get('location')).searchParams.get('code');
+  const bad = await call('/token', { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams({ grant_type: 'authorization_code', code, redirect_uri: 'https://app.example/cb', client_id: CLIENT.client_id, client_secret: 'wrong' }) });
+  check(bad.status === 401, 'wrong client_secret rejected');
+}
+
+// 9. dedicated MCP app credentials override the shared viewer-app ones
+{
+  const env2 = { ...env, OAUTH: makeKv(), MCP_GITHUB_CLIENT_ID: 'OWN_APP', MCP_GITHUB_CLIENT_SECRET: 'OWN_SECRET' };
+  const reg = await handleOAuth(new Request(HOST + '/register', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ redirect_uris: ['https://app.example/cb'] }) }), env2, {});
+  const cid = (await reg.json()).client_id;
+  const auth = await handleOAuth(new Request(HOST + `/authorize?response_type=code&client_id=${cid}&redirect_uri=${encodeURIComponent('https://app.example/cb')}`), env2, {});
+  const loc = new URL(auth.headers.get('location'));
+  check(loc.searchParams.get('client_id') === 'OWN_APP', 'authorize prefers MCP_GITHUB_CLIENT_ID over shared id');
+}
+
+console.log(failures.length ? `\n${failures.length} FAILURES` : '\nALL GREEN');
+process.exit(failures.length ? 1 : 0);

package/worker/wrangler.toml

@@ -15,6 +15,13 @@ ALLOWED_REDIRECT_ORIGINS = "*.github.io,*.pages.dev"
 name = "RELAY"
 class_name = "RelayRoom"
 
+# OAuth Authorization Server store (DCR clients, login sessions, one-time
+# codes — all short-TTL). Absent on self-host deploys → oauth routes 500,
+# relay + /mcp with static tokens keep working.
+[[kv_namespaces]]
+binding = "OAUTH"
+id = "f956647497954a68a84d1c275d3b9343"
+
 [[migrations]]
 tag = "v1"
 new_sqlite_classes = ["RelayRoom"]