excalidrop 0.2.9 → 0.2.11

package/worker/src/oauth.js

@@ -0,0 +1,233 @@
+// OAuth Authorization Server for remote MCP clients (spec 2026-07-28,
+// RFC 7591 DCR + RFC 7636 PKCE). The worker fronts the GitHub OAuth App:
+// clients register with US, users log in at github.com, and /token hands
+// back the GitHub user token as the access token. The app secret never
+// leaves the worker. Viewer /exchange flow is untouched.
+//
+// State lives in the OAUTH KV binding (fail closed when missing):
+//   oauth:client:{id}   {secret, redirect_uris[], name}            90d
+//   oauth:session:{sid}  {client_id, redirect_uri, scope, challenge, client_state}  10min
+//   oauth:code:{code}    {client_id, redirect_uri, scope, github_token, challenge}  5min, single-use
+
+// App credentials for the AS flow. Prefer dedicated MCP_* vars (your own
+// GitHub OAuth App, where you register /oauth/callback); fall back to the
+// shared viewer-app vars.
+function appCreds(env) {
+  return {
+    id: env.MCP_GITHUB_CLIENT_ID || env.GITHUB_CLIENT_ID,
+    secret: env.MCP_GITHUB_CLIENT_SECRET || env.GITHUB_CLIENT_SECRET,
+  };
+}
+//   oauth:client:{id}   {secret, redirect_uris[], name}            90d
+//   oauth:session:{sid}  {client_id, redirect_uri, scope, challenge, client_state}  10min
+//   oauth:code:{code}    {client_id, redirect_uri, scope, github_token, challenge}  5min, single-use
+
+function rnd(prefix, bytes = 24) {
+  const b = new Uint8Array(bytes);
+  crypto.getRandomValues(b);
+  let bin = '';
+  for (const x of b) bin += String.fromCharCode(x);
+  return prefix + btoa(bin).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+
+async function sha256B64url(str) {
+  const d = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(str));
+  let bin = '';
+  for (const x of new Uint8Array(d)) bin += String.fromCharCode(x);
+  return btoa(bin).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+
+function err(status, error, description, cors) {
+  return new Response(JSON.stringify({ error, ...(description ? { error_description: description } : {}) }), {
+    status, headers: { 'Content-Type': 'application/json', ...cors },
+  });
+}
+
+// https anywhere; http only for loopback (RFC 8252 §7.3).
+function redirectAllowed(u) {
+  let p;
+  try { p = new URL(u); } catch { return false; }
+  if (p.protocol === 'https:') return true;
+  if (p.protocol === 'http:') return p.hostname === 'localhost' || p.hostname === '127.0.0.1' || p.hostname === '[::1]';
+  return false;
+}
+
+function clientAuth(req, params) {
+  // client_secret_basic or client_secret_post (RFC 6749 §2.3).
+  const h = req.headers.get('Authorization') || '';
+  const m = /^Basic\s+(.+)$/i.exec(h);
+  if (m) {
+    try {
+      const [id, secret] = atob(m[1]).split(':');
+      return { id: id || params.client_id, secret };
+    } catch { /* fall through */ }
+  }
+  return { id: params.client_id, secret: params.client_secret };
+}
+
+export async function handleOAuth(req, env, cors) {
+  const url = new URL(req.url);
+  const origin = url.origin;
+  const kv = env.OAUTH;
+
+  if (req.method === 'GET' && url.pathname === '/.well-known/oauth-authorization-server') {
+    return new Response(JSON.stringify({
+      issuer: origin,
+      authorization_endpoint: origin + '/authorize',
+      token_endpoint: origin + '/token',
+      registration_endpoint: origin + '/register',
+      response_types_supported: ['code'],
+      grant_types_supported: ['authorization_code', 'refresh_token'],
+      response_modes_supported: ['query'],
+      scopes_supported: ['repo'],
+      token_endpoint_auth_methods_supported: ['client_secret_basic', 'client_secret_post', 'none'],
+      code_challenge_methods_supported: ['S256', 'plain'],
+    }), { headers: { 'Content-Type': 'application/json', ...cors } });
+  }
+
+  if (req.method === 'GET' && url.pathname === '/.well-known/oauth-protected-resource') {
+    return new Response(JSON.stringify({
+      resource: origin + '/mcp',
+      authorization_servers: [origin],
+      scopes_supported: ['repo'],
+      bearer_methods_supported: ['header'],
+    }), { headers: { 'Content-Type': 'application/json', ...cors } });
+  }
+
+  if (!kv) return err(500, 'server_error', 'oauth store not configured on this deployment', cors);
+
+  // ---- RFC 7591 Dynamic Client Registration
+  if (url.pathname === '/register') {
+    if (req.method !== 'POST') return err(405, 'invalid_request', 'use POST', cors);
+    let body;
+    try { body = await req.json(); } catch { return err(400, 'invalid_request', 'bad json', cors); }
+    const uris = body?.redirect_uris;
+    if (!Array.isArray(uris) || !uris.length || !uris.every((u) => typeof u === 'string' && redirectAllowed(u))) {
+      return err(400, 'invalid_redirect_uri', 'redirect_uris must be non-empty; https required (http allowed for localhost only)', cors);
+    }
+    const client_id = rnd('excc_');
+    const client_secret = rnd('excs_', 32);
+    await kv.put(`oauth:client:${client_id}`, JSON.stringify({ secret: client_secret, redirect_uris: uris, name: String(body.client_name || '').slice(0, 100), created: Date.now() }), { expirationTtl: 90 * 86400 });
+    return new Response(JSON.stringify({
+      client_id, client_secret, redirect_uris: uris,
+      grant_types: ['authorization_code', 'refresh_token'],
+      token_endpoint_auth_method: 'client_secret_post',
+    }), { status: 201, headers: { 'Content-Type': 'application/json', ...cors } });
+  }
+
+  // Where the GitHub leg of the MCP flow returns. Default is the shared
+// central viewer (the one callback URL the shared OAuth App knows); self-host
+// operators point this at their own viewer deployment.
+function viewerCallback(env) {
+  return env.OAUTH_VIEWER_CALLBACK || 'https://wtf403.github.io/excalidrop/';
+}
+
+  // ---- Authorize: validate, stash session, bounce to GitHub
+  if (url.pathname === '/authorize') {
+    if (req.method !== 'GET') return err(405, 'invalid_request', 'use GET', cors);
+    const q = url.searchParams;
+    if (q.get('response_type') !== 'code') return err(400, 'unsupported_response_type', 'only code is supported', cors);
+    const rawClient = await kv.get(`oauth:client:${q.get('client_id') || ''}`);
+    if (!rawClient) return err(400, 'invalid_request', 'unknown client_id (register at POST /register first)', cors);
+    const client = JSON.parse(rawClient);
+    const redirect_uri = q.get('redirect_uri') || '';
+    if (!client.redirect_uris.includes(redirect_uri)) return err(400, 'invalid_request', 'redirect_uri mismatch (must exactly match a registered URI)', cors);
+    const app = appCreds(env);
+    if (!app.id || !app.secret) return err(500, 'server_error', 'github app not configured', cors);
+    const method = q.get('code_challenge_method') || 'plain';
+    if (q.get('code_challenge') && method !== 'S256' && method !== 'plain') return err(400, 'invalid_request', 'code_challenge_method must be S256 or plain', cors);
+    const sid = rnd('excsess_');
+    // GitHub must return the code to a URL registered on the OAuth App. The
+    // worker's own /oauth/callback is only registered on apps whose owner
+    // added it — otherwise bounce through the registered viewer host, whose
+    // bundle forwards ?code&state=excsess_* straight back to /oauth/callback.
+    // The exact URI used here is stored and echoed at exchange time.
+    const gh_redirect = viewerCallback(env);
+    await kv.put(`oauth:session:${sid}`, JSON.stringify({
+      client_id: q.get('client_id'), redirect_uri,
+      scope: String(q.get('scope') || 'repo').slice(0, 200),
+      challenge: q.get('code_challenge') || null, challenge_method: method,
+      client_state: q.get('state') || '', gh_redirect,
+    }), { expirationTtl: 600 });
+    const gh = new URL('https://github.com/login/oauth/authorize');
+    gh.searchParams.set('client_id', app.id);
+    gh.searchParams.set('redirect_uri', gh_redirect);
+    gh.searchParams.set('scope', 'repo');
+    gh.searchParams.set('state', sid);
+    return new Response(null, { status: 302, headers: { Location: gh.toString(), ...cors } });
+  }
+
+  // ---- Callback from GitHub: swap code, mint our code, return to client
+  if (url.pathname === '/oauth/callback') {
+    if (req.method !== 'GET') return err(405, 'invalid_request', 'use GET', cors);
+    const q = url.searchParams;
+    const rawSess = q.get('state') ? await kv.get(`oauth:session:${q.get('state')}`) : null;
+    if (!rawSess || !q.get('code')) return err(400, 'invalid_request', 'unknown or expired session (restart login)', cors);
+    const sess = JSON.parse(rawSess);
+    // redirect_uri must exactly match the authorize leg (stored per session).
+    const gh_redirect = sess.gh_redirect || (origin + '/oauth/callback');
+    const r = await fetch('https://github.com/login/oauth/access_token', {
+      method: 'POST',
+      headers: { Accept: 'application/json', 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        client_id: appCreds(env).id, client_secret: appCreds(env).secret,
+        code: q.get('code'), redirect_uri: gh_redirect,
+      }),
+    }).catch(() => null);
+    const j = await r?.json().catch(() => null);
+    if (!r || !r.ok || !j?.access_token) {
+      return err(400, 'access_denied', j?.error_description || j?.error || 'github exchange failed', cors);
+    }
+    const code = rnd('excode_');
+    await kv.put(`oauth:code:${code}`, JSON.stringify({
+      client_id: sess.client_id, redirect_uri: sess.redirect_uri, scope: 'repo',
+      github_token: j.access_token, challenge: sess.challenge, challenge_method: sess.challenge_method,
+    }), { expirationTtl: 300 });
+    await kv.delete(`oauth:session:${q.get('state')}`);
+    const back = new URL(sess.redirect_uri);
+    back.searchParams.set('code', code);
+    if (sess.client_state) back.searchParams.set('state', sess.client_state);
+    return new Response(null, { status: 302, headers: { Location: back.toString(), ...cors } });
+  }
+
+  // ---- Token endpoint
+  if (url.pathname === '/token') {
+    if (req.method !== 'POST') return err(405, 'invalid_request', 'use POST', cors);
+    const ct = req.headers.get('Content-Type') || '';
+    let params = {};
+    try {
+      if (ct.includes('application/json')) params = await req.json();
+      else params = Object.fromEntries(new URLSearchParams(await req.text()));
+    } catch { return err(400, 'invalid_request', 'bad body', cors); }
+    if (params.grant_type === 'refresh_token') {
+      return err(400, 'unsupported_grant_type', 'tokens do not expire; re-authorize if needed', cors);
+    }
+    if (params.grant_type !== 'authorization_code') return err(400, 'unsupported_grant_type', 'only authorization_code is supported', cors);
+    const rawCode = params.code ? await kv.get(`oauth:code:${params.code}`) : null;
+    if (!rawCode) return err(400, 'invalid_grant', 'unknown or expired code', cors);
+    const rec = JSON.parse(rawCode);
+    const { id, secret } = clientAuth(req, params);
+    if (!id || id !== rec.client_id) return err(401, 'invalid_client', 'client mismatch', cors);
+    if (params.redirect_uri && params.redirect_uri !== rec.redirect_uri) return err(400, 'invalid_grant', 'redirect_uri mismatch', cors);
+    const rawClient = await kv.get(`oauth:client:${id}`);
+    const client = rawClient ? JSON.parse(rawClient) : null;
+    if (!client) return err(401, 'invalid_client', 'unknown client', cors);
+    if (secret !== undefined && secret !== null && secret !== '') {
+      if (secret !== client.secret) return err(401, 'invalid_client', 'bad client_secret', cors);
+    } else if (rec.challenge) {
+      const verifier = params.code_verifier || '';
+      const ok = rec.challenge_method === 'plain'
+        ? verifier === rec.challenge
+        : verifier && (await sha256B64url(verifier)) === rec.challenge;
+      if (!ok) return err(400, 'invalid_grant', 'PKCE verification failed', cors);
+    } else {
+      return err(401, 'invalid_client', 'client authentication required (secret or PKCE)', cors);
+    }
+    await kv.delete(`oauth:code:${params.code}`);
+    return new Response(JSON.stringify({
+      access_token: rec.github_token, token_type: 'Bearer', scope: 'repo',
+    }), { headers: { 'Content-Type': 'application/json', 'Cache-Control': 'no-store', Pragma: 'no-cache', ...cors } });
+  }
+
+  return err(404, 'not_found', 'unknown oauth route', cors);
+}

package/worker/test/oauth.test.mjs

@@ -0,0 +1,178 @@
+// OAuth Authorization Server contract tests (worker HTTP seam).
+// Run: node worker/test/oauth.test.mjs  (fails until src/oauth.js exists)
+import { createHash } from 'node:crypto';
+
+const failures = [];
+function check(cond, msg) {
+  if (cond) console.log('  ok:', msg);
+  else { failures.push(msg); console.log('  FAIL:', msg); }
+}
+
+// --- stub env: in-memory KV with TTL, stubbed github fetch
+function makeKv() {
+  const m = new Map();
+  return {
+    async get(k) { const e = m.get(k); if (!e || e.exp < Date.now()) return null; return e.v; },
+    async put(k, v, opts = {}) { m.set(k, { v, exp: Date.now() + (opts.expirationTtl || 3600) * 1000 }); },
+    async delete(k) { m.delete(k); },
+  };
+}
+const GITHUB_CODE = 'gh_code_abc';
+const GITHUB_TOKEN = 'ghu_test123';
+// Records the last exchange body so tests can assert which redirect_uri the
+// worker used for the GitHub leg (must match the authorize leg exactly).
+let lastExchange = null;
+let acceptedSecret = 'TEST_SECRET';
+globalThis.fetch = async (url, init = {}) => {
+  const u = String(url);
+  if (u === 'https://github.com/login/oauth/access_token') {
+    const body = JSON.parse(init.body);
+    lastExchange = body;
+    if (body.code === GITHUB_CODE && body.client_secret === acceptedSecret) {
+      return Response.json({ access_token: GITHUB_TOKEN, scope: 'repo', token_type: 'bearer' });
+    }
+    return Response.json({ error: 'bad_verification_code' }, { status: 200 });
+  }
+  throw new Error('unexpected fetch: ' + u);
+};
+const env = { OAUTH: makeKv(), GITHUB_CLIENT_ID: 'TEST_APP_ID', GITHUB_CLIENT_SECRET: 'TEST_SECRET' };
+const HOST = 'https://relay.example.test';
+
+const { handleOAuth } = await import('../src/oauth.js');
+const call = (path, opts = {}) => handleOAuth(new Request(HOST + path, opts), env, {});
+
+// RFC7636 example pair (independent of implementation)
+const VERIFIER = 'dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk';
+const CHALLENGE = createHash('sha256').update(VERIFIER).digest('base64url');
+
+// 1. AS metadata points at US, advertises DCR + PKCE
+{
+  const r = await call('/.well-known/oauth-authorization-server');
+  const j = await r.json();
+  check(r.status === 200, 'metadata 200');
+  check(j.issuer === HOST, 'metadata issuer is worker origin');
+  check(j.authorization_endpoint === HOST + '/authorize', 'metadata authorize endpoint');
+  check(j.token_endpoint === HOST + '/token', 'metadata token endpoint');
+  check(j.registration_endpoint === HOST + '/register', 'metadata registration endpoint (DCR)');
+  check((j.code_challenge_methods_supported || []).includes('S256'), 'metadata advertises S256');
+}
+// 2. protected-resource doc
+{
+  const r = await call('/.well-known/oauth-protected-resource');
+  const j = await r.json();
+  check(r.status === 200, 'protected-resource 200');
+  check(j.resource === HOST + '/mcp', 'protected resource is /mcp');
+  check((j.authorization_servers || []).includes(HOST), 'protected resource lists our AS');
+}
+// 3. register validation
+{
+  const bad = await call('/register', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ redirect_uris: ['http://evil.com/cb'] }) });
+  check(bad.status === 400, 'register rejects non-https redirect');
+  const ok = await call('/register', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ redirect_uris: ['https://app.example/cb'], client_name: 't' }) });
+  const j = await ok.json();
+  check(ok.status === 201 && !!j.client_id && !!j.client_secret, 'register returns client_id + client_secret');
+  var CLIENT = j;
+  const local = await call('/register', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ redirect_uris: ['http://localhost:8787/cb'] }) });
+  check(local.status === 201, 'register allows http localhost');
+}
+// 4. authorize validation + github redirect
+{
+  const unknown = await call(`/authorize?response_type=code&client_id=nope&redirect_uri=${encodeURIComponent('https://app.example/cb')}`);
+  check(unknown.status === 400, 'authorize rejects unknown client');
+  const mismatch = await call(`/authorize?response_type=code&client_id=${CLIENT.client_id}&redirect_uri=${encodeURIComponent('https://evil.com/cb')}&state=s1`);
+  check(mismatch.status === 400, 'authorize rejects redirect mismatch');
+  const ok = await call(`/authorize?response_type=code&client_id=${CLIENT.client_id}&redirect_uri=${encodeURIComponent('https://app.example/cb')}&scope=repo&state=s1&code_challenge=${CHALLENGE}&code_challenge_method=S256`);
+  check(ok.status === 302, 'authorize 302s to github');
+  const loc = new URL(ok.headers.get('location'));
+  check(loc.hostname === 'github.com' && loc.pathname === '/login/oauth/authorize', 'authorize target is github');
+  check(loc.searchParams.get('client_id') === 'TEST_APP_ID', 'authorize uses app client_id (secret stays server-side)');
+  check(loc.searchParams.get('redirect_uri') === 'https://wtf403.github.io/excalidrop/', 'authorize callback is the registered viewer host (forwarder)');
+  check(loc.searchParams.get('scope') === 'repo', 'authorize requests repo scope');
+  check(!!loc.searchParams.get('state'), 'authorize carries session state');
+  var SESSION = loc.searchParams.get('state');
+}
+// 5. callback: bad state, then happy path
+{
+  const bad = await call(`/oauth/callback?code=${GITHUB_CODE}&state=bogus`);
+  check(bad.status === 400, 'callback rejects unknown session');
+  const ok = await call(`/oauth/callback?code=${GITHUB_CODE}&state=${SESSION}`);
+  check(ok.status === 302, 'callback 302s back to client');
+  const loc = new URL(ok.headers.get('location'));
+  check(loc.origin === 'https://app.example' && loc.pathname === '/cb', 'callback returns to registered redirect');
+  check(!!loc.searchParams.get('code') && loc.searchParams.get('state') === 's1', 'callback carries code + client state');
+  var CODE = loc.searchParams.get('code');
+}
+// 6. token: bad code, happy path with secret, single-use
+{
+  const bad = await call('/token', { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams({ grant_type: 'authorization_code', code: 'bogus', redirect_uri: 'https://app.example/cb', client_id: CLIENT.client_id, client_secret: CLIENT.client_secret }) });
+  check(bad.status === 400 && (await bad.json()).error === 'invalid_grant', 'token rejects bad code');
+  const ok = await call('/token', { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams({ grant_type: 'authorization_code', code: CODE, redirect_uri: 'https://app.example/cb', client_id: CLIENT.client_id, client_secret: CLIENT.client_secret }) });
+  const j = await ok.json();
+  check(ok.status === 200 && j.access_token === GITHUB_TOKEN && j.token_type === 'Bearer', 'token returns github user token as access_token');
+  const reuse = await call('/token', { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams({ grant_type: 'authorization_code', code: CODE, redirect_uri: 'https://app.example/cb', client_id: CLIENT.client_id, client_secret: CLIENT.client_secret }) });
+  check(reuse.status === 400, 'code is single-use');
+}
+// 7. PKCE-only public client (no secret presented)
+{
+  const ok = await call(`/authorize?response_type=code&client_id=${CLIENT.client_id}&redirect_uri=${encodeURIComponent('https://app.example/cb')}&state=s2&code_challenge=${CHALLENGE}&code_challenge_method=S256`);
+  const sid = new URL(ok.headers.get('location')).searchParams.get('state');
+  const cb = await call(`/oauth/callback?code=${GITHUB_CODE}&state=${sid}`);
+  const code = new URL(cb.headers.get('location')).searchParams.get('code');
+  const good = await call('/token', { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams({ grant_type: 'authorization_code', code, redirect_uri: 'https://app.example/cb', client_id: CLIENT.client_id, code_verifier: VERIFIER }) });
+  check(good.status === 200, 'PKCE verifier without secret succeeds');
+  const ok2 = await call(`/authorize?response_type=code&client_id=${CLIENT.client_id}&redirect_uri=${encodeURIComponent('https://app.example/cb')}&state=s3&code_challenge=${CHALLENGE}&code_challenge_method=S256`);
+  const sid2 = new URL(ok2.headers.get('location')).searchParams.get('state');
+  const cb2 = await call(`/oauth/callback?code=${GITHUB_CODE}&state=${sid2}`);
+  const code2 = new URL(cb2.headers.get('location')).searchParams.get('code');
+  const wrong = await call('/token', { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams({ grant_type: 'authorization_code', code: code2, redirect_uri: 'https://app.example/cb', client_id: CLIENT.client_id, code_verifier: 'wrong' }) });
+  check(wrong.status === 400, 'wrong PKCE verifier rejected');
+}
+// 8. wrong secret rejected
+{
+  const ok = await call(`/authorize?response_type=code&client_id=${CLIENT.client_id}&redirect_uri=${encodeURIComponent('https://app.example/cb')}&state=s4&code_challenge=${CHALLENGE}&code_challenge_method=S256`);
+  const sid = new URL(ok.headers.get('location')).searchParams.get('state');
+  const cb = await call(`/oauth/callback?code=${GITHUB_CODE}&state=${sid}`);
+  const code = new URL(cb.headers.get('location')).searchParams.get('code');
+  const bad = await call('/token', { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams({ grant_type: 'authorization_code', code, redirect_uri: 'https://app.example/cb', client_id: CLIENT.client_id, client_secret: 'wrong' }) });
+  check(bad.status === 401, 'wrong client_secret rejected');
+}
+
+// 9. dedicated MCP app credentials override the shared viewer-app ones
+{
+  const env2 = { ...env, OAUTH: makeKv(), MCP_GITHUB_CLIENT_ID: 'OWN_APP', MCP_GITHUB_CLIENT_SECRET: 'OWN_SECRET' };
+  const reg = await handleOAuth(new Request(HOST + '/register', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ redirect_uris: ['https://app.example/cb'] }) }), env2, {});
+  const cid = (await reg.json()).client_id;
+  const auth = await handleOAuth(new Request(HOST + `/authorize?response_type=code&client_id=${cid}&redirect_uri=${encodeURIComponent('https://app.example/cb')}`), env2, {});
+  const loc = new URL(auth.headers.get('location'));
+  check(loc.searchParams.get('client_id') === 'OWN_APP', 'authorize prefers MCP_GITHUB_CLIENT_ID over shared id');
+}
+
+// 10. central-forwarder: GitHub leg uses the registered viewer callback, and
+// the exchange echoes the same redirect_uri (GitHub requires exact match).
+const VIEWER_CB = 'https://viewer.example.test/';
+{
+  const env3 = { ...env, OAUTH: makeKv(), OAUTH_VIEWER_CALLBACK: VIEWER_CB };
+  const call3 = (path, opts = {}) => handleOAuth(new Request(HOST + path, opts), env3, {});
+  const reg = await call3('/register', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ redirect_uris: ['https://app.example/cb'] }) });
+  const cid = (await reg.json()).client_id;
+  const auth = await call3(`/authorize?response_type=code&client_id=${cid}&redirect_uri=${encodeURIComponent('https://app.example/cb')}&state=c1`);
+  const loc = new URL(auth.headers.get('location'));
+  check(loc.searchParams.get('redirect_uri') === VIEWER_CB, 'authorize points GitHub at the viewer callback, not the worker');
+  const sid = loc.searchParams.get('state');
+  lastExchange = null;
+  const cb = await call3(`/oauth/callback?code=${GITHUB_CODE}&state=${sid}`);
+  check(cb.status === 302, 'viewer-callback flow completes');
+  check(lastExchange && lastExchange.redirect_uri === VIEWER_CB, 'exchange uses the same viewer redirect_uri (exact match)');
+  const back = new URL(cb.headers.get('location'));
+  check(back.origin === 'https://app.example' && !!back.searchParams.get('code'), 'client still gets its code at its own redirect');
+}
+// 11. default (no OAUTH_VIEWER_CALLBACK): GitHub leg is the shared central
+// viewer (the callback URL the shared app actually has registered).
+{
+  const auth = await call(`/authorize?response_type=code&client_id=${CLIENT.client_id}&redirect_uri=${encodeURIComponent('https://app.example/cb')}&state=d1`);
+  const loc = new URL(auth.headers.get('location'));
+  check(loc.searchParams.get('redirect_uri') === 'https://wtf403.github.io/excalidrop/', 'default GitHub leg is the registered central viewer');
+}
+
+console.log(failures.length ? `\n${failures.length} FAILURES` : '\nALL GREEN');
+process.exit(failures.length ? 1 : 0);

package/worker/wrangler.toml

@@ -6,6 +6,11 @@ compatibility_date = "2024-01-01"
 #   wrangler secret put GITHUB_CLIENT_SECRET
 [vars]
 GITHUB_CLIENT_ID = "Iv23liuS2fx3QOEIoDmx"
+# Viewer host the MCP OAuth flow bounces through. Must be registered as an
+# Authorization callback URL on the GitHub OAuth App (default: the shared
+# central viewer). Self-host operators serving their own viewer set this to
+# their viewer origin (trailing slash) instead of registering the worker.
+OAUTH_VIEWER_CALLBACK = "https://wtf403.github.io/excalidrop/"
 # Comma-separated allowed canvas origins: exact ("https://wtf403.github.io")
 # or "*.github.io"-style suffixes so one deployment serves every publisher.
 # Add "*.pages.dev" + your custom domain when hosting private viewers on Cloudflare.
@@ -15,6 +20,13 @@ ALLOWED_REDIRECT_ORIGINS = "*.github.io,*.pages.dev"
 name = "RELAY"
 class_name = "RelayRoom"
 
+# OAuth Authorization Server store (DCR clients, login sessions, one-time
+# codes — all short-TTL). Absent on self-host deploys → oauth routes 500,
+# relay + /mcp with static tokens keep working.
+[[kv_namespaces]]
+binding = "OAUTH"
+id = "f956647497954a68a84d1c275d3b9343"
+
 [[migrations]]
 tag = "v1"
 new_sqlite_classes = ["RelayRoom"]

package/dist/frontend/assets/channel-BiBGrGc2.js

@@ -1 +0,0 @@
-import{U as a,E as n}from"./index-BQuFwudZ.js";const t=(r,o)=>a.lang.round(n.parse(r)[o]);export{t as c};

package/dist/frontend/assets/clone-DP5GGGqv.js

@@ -1 +0,0 @@
-import{b as r}from"./union-BNBs5eWq.js";var e=4;function a(o){return r(o,e)}export{a as c};

package/dist/frontend/assets/flowDiagram-v2-96b9c2cf-DL-IsgmS.js

@@ -1 +0,0 @@
-import{f as o,p as e}from"./flowDb-956e92f1-CGqQ4oJb.js";import{f as a,a as t}from"./styles-c10674c1-CoYU8Hxx.js";import{t as i}from"./index-1WYcrLVJ.js";import"./index-BQuFwudZ.js";import"./graph-D0R7rXy3.js";import"./layout-DTqY_XPF.js";import"./index-3862675e-B37xIMNY.js";import"./union-BNBs5eWq.js";import"./clone-DP5GGGqv.js";import"./zipObject-BENW7yI5.js";import"./edges-e0da2a9e-CdBHUaUf.js";import"./createText-2e5e7dd3-B9buhJhz.js";import"./index-DGmpr33w.js";import"./line-CyQqGgtO.js";import"./array-BKyUJesY.js";import"./path-CbwjOpE9.js";import"./channel-BiBGrGc2.js";import"./selectAll-3cbo0gSx.js";const x={parser:e,db:o,renderer:t,styles:a,init:r=>{r.flowchart||(r.flowchart={}),r.flowchart.arrowMarkerAbsolute=r.arrowMarkerAbsolute,i({flowchart:{arrowMarkerAbsolute:r.arrowMarkerAbsolute}}),t.setConf(r.flowchart),o.clear(),o.setGen("gen-2")}};export{x as diagram};

package/dist/frontend/assets/flowDiagram-v2-ffc7f31a-cm0Es-T3.js

@@ -1 +0,0 @@
-import{f as o,p as e}from"./flowDb-7c981674-D-Lz-ucy.js";import{f as a,a as t}from"./styles-2ab5d517-DegF9FpK.js";import{K as i}from"./index-BQuFwudZ.js";import"./graph-Cld5o79d.js";import"./layout-Bg902Usv.js";import"./index-6079d271-MI3jF-v5.js";import"./union-BNBs5eWq.js";import"./clone-DP5GGGqv.js";import"./zipObject-BENW7yI5.js";import"./edges-332bd1c7-B1wvBqMI.js";import"./createText-d213de94-Dl7cGRq1.js";import"./index-DGmpr33w.js";import"./line-CyQqGgtO.js";import"./array-BKyUJesY.js";import"./path-CbwjOpE9.js";import"./channel-BiBGrGc2.js";import"./selectAll-3cbo0gSx.js";const C={parser:e,db:o,renderer:t,styles:a,init:r=>{r.flowchart||(r.flowchart={}),r.flowchart.arrowMarkerAbsolute=r.arrowMarkerAbsolute,i({flowchart:{arrowMarkerAbsolute:r.arrowMarkerAbsolute}}),t.setConf(r.flowchart),o.clear(),o.setGen("gen-2")}};export{C as diagram};