mcp-google-multi 6.0.0-alpha.55 → 6.0.0-alpha.56

package/dist/accounts.js

@@ -3,7 +3,7 @@ import fs from 'node:fs';
 import { z } from 'zod';
 import { loadEnvFiles } from './env-load.js';
 import { ALIAS_RE, CONFIG_VERSION, configDir, configFilePath, failStartup, isReservedAlias, loadConfigFile, mutateConfigFile } from './config-file.js';
-import { BUNDLE_CATALOG, closestBundle, resolveBundleAliases } from './scope-catalog.js';
+import { closestBundle, isKnownBundle, resolveBundleAliases } from './scope-catalog.js';
 const envLoad = loadEnvFiles();
 const defaultTokenDir = path.join(configDir(), 'tokens');
 const tokenDir = process.env.TOKEN_STORE_PATH
@@ -95,7 +95,7 @@ opts = {}) {
             if (bundle === 'admin') {
                 fail('E_UNKNOWN_BUNDLE', '"admin" is not a global bundle: grant it per account via GOOGLE_ADMIN_ACCOUNTS or an "admin: true" scope profile.');
             }
-            if (!(bundle in BUNDLE_CATALOG)) {
+            if (!isKnownBundle(bundle)) {
                 const hint = closestBundle(bundle);
                 fail('E_UNKNOWN_BUNDLE', `unknown bundle "${bundle}" in GOOGLE_OPTIONAL_SCOPES${hint ? ` — did you mean "${hint}"?` : ''}`);
             }
@@ -152,7 +152,7 @@ opts = {}) {
     for (const [name, profile] of Object.entries(config?.scopeProfiles ?? {})) {
         const bundles = resolveBundleAliases(profile.bundles);
         for (const bundle of bundles) {
-            if (!(bundle in BUNDLE_CATALOG)) {
+            if (!isKnownBundle(bundle)) {
                 const hint = closestBundle(bundle);
                 fail('E_UNKNOWN_BUNDLE', `unknown bundle "${bundle}" in scope profile "${name}"${hint ? ` — did you mean "${hint}"?` : ''}`);
             }

package/dist/auth.js

@@ -1,7 +1,7 @@
 import { randomBytes } from 'node:crypto';
 import { openUrl } from './open-url.js';
 import { ACCOUNTS, getAccountSet } from './accounts.js';
-import { ADMIN_SCOPES, BUNDLE_CATALOG, closestBundle, resolveBundleAliases } from './scope-catalog.js';
+import { ADMIN_SCOPES, BUNDLE_CATALOG, closestBundle, isKnownBundle, resolveBundleAliases } from './scope-catalog.js';
 import { resolveMasterKey } from './master-key.js';
 import { writeToken } from './token-store.js';
 import { buildConsentClient, openLoopbackConsent, TESTING_MODE_WARNING } from './oauth-consent.js';
@@ -48,7 +48,7 @@ function legacyGlobalProfile() {
         if (bundle === 'admin') {
             throw new Error('E_UNKNOWN_BUNDLE: "admin" is not a global bundle: grant it per account via GOOGLE_ADMIN_ACCOUNTS or an "admin: true" scope profile.');
         }
-        if (!(bundle in BUNDLE_CATALOG)) {
+        if (!isKnownBundle(bundle)) {
             const hint = closestBundle(bundle);
             throw new Error(`E_UNKNOWN_BUNDLE: unknown bundle "${bundle}" in GOOGLE_OPTIONAL_SCOPES${hint ? ` — did you mean "${hint}"?` : ''}`);
         }

package/dist/index.js

@@ -246,7 +246,7 @@ async function main() {
         registry.installListHandler();
         registerSetupPrompt(httpServer);
         // B13: mount the OAuth 2.1 AS (legs A + B) + the Bearer authenticator.
-        const { buildAuthServer } = await import('./oauth-as.js');
+        const { buildAuthServer, verifiedEmailFromIdToken } = await import('./oauth-as.js');
         const { jwtSecretFrom } = await import('./mcp-token.js');
         const { resolveJwtKey, resolveMasterKeyForDispatch } = await import('./master-key.js');
         const { OAuth2Client } = await import('googleapis-common');
@@ -255,20 +255,6 @@ async function main() {
         const { configDir } = await import('./config-file.js');
         const { getAccountSet } = await import('./accounts.js');
         const googleClient = () => new OAuth2Client(process.env.GOOGLE_CLIENT_ID, process.env.GOOGLE_CLIENT_SECRET, `${httpCfg.publicUrl}/callback`);
-        // Only trust the id_token email when Google marks it verified (#8).
-        const verifiedEmailFromIdToken = (idToken) => {
-            if (!idToken)
-                return undefined;
-            try {
-                const [, payload] = idToken.split('.');
-                const claims = JSON.parse(Buffer.from(payload, 'base64url').toString('utf-8'));
-                const verified = claims.email_verified === true || claims.email_verified === 'true';
-                return verified ? claims.email : undefined;
-            }
-            catch {
-                return undefined;
-            }
-        };
         const authServer = buildAuthServer({
             base: httpCfg.publicUrl,
             resourceUri: httpCfg.resourceUri,
@@ -309,8 +295,7 @@ async function main() {
         const { setHttpReauthBase } = await import('./reauth-hint.js');
         setHttpReauthBase(httpCfg.publicUrl);
         // Wizard consent over HTTP: hand out the clientless AS link instead of
-        // binding a loopback listener (single-owner flow; a tenancy host installs
-        // its own signed-mint context here).
+        // binding a loopback listener.
         const { setWizardHttpConsent } = await import('./tools/account-wizard.js');
         setWizardHttpConsent({
             mintConsentUrl: (alias) => `${httpCfg.publicUrl}/authorize?flow=alias_reauth&alias=${encodeURIComponent(alias)}`,

package/dist/mcp-token.d.ts

@@ -32,6 +32,9 @@ export interface StatePayload {
     tenantId?: string;
     /** alias_add only: scope bundles chosen when the link was minted. */
     bundles?: string[];
+    /** alias_add only: an opaque value the minting caller chose, signed like
+     * tenantId and handed back to its binder (e.g. a server-side link record). */
+    nonce?: string;
 }
 export interface CodePayload {
     redirect_uri: string;

package/dist/migrate-config.js

@@ -1,5 +1,5 @@
 import { CONFIG_VERSION, configFilePath, loadConfigFile, mutateConfigFile } from './config-file.js';
-import { BUNDLE_CATALOG, closestBundle, resolveBundleAliases } from './scope-catalog.js';
+import { closestBundle, isKnownBundle, resolveBundleAliases } from './scope-catalog.js';
 function parseCsv(value) {
     return (value ?? '').split(',').map((s) => s.trim()).filter(Boolean);
 }
@@ -47,7 +47,7 @@ export function runMigrateConfig(env = process.env) {
                 process.exitCode = 1;
                 return;
             }
-            if (!(bundle in BUNDLE_CATALOG)) {
+            if (!isKnownBundle(bundle)) {
                 const hint = closestBundle(bundle);
                 console.error(`E_UNKNOWN_BUNDLE: unknown bundle "${bundle}" in GOOGLE_OPTIONAL_SCOPES${hint ? ` — did you mean "${hint}"?` : ''}. Nothing written.`);
                 process.exitCode = 1;

package/dist/oauth-as.d.ts

@@ -22,6 +22,27 @@ export interface AuthServerConfig {
      * cross-tenant re-auth vector. Server-minted signed flows are unaffected. */
     legacyAliasReauth?: boolean;
 }
+/** What /callback hands the alias_add binder once Google returned a verified
+ * identity for a server-minted link. */
+export interface TenantAliasBind {
+    tenantId: string;
+    alias: string;
+    email: string;
+    bundles?: string[];
+    nonce?: string;
+    tokens: Record<string, unknown>;
+}
+/** A binder's deliberate refusal (policy, not failure): /callback answers 403
+ * with this slug and message. The message reaches an unauthenticated browser. */
+export interface AliasBindRefusal {
+    refused: {
+        slug: string;
+        message: string;
+    };
+}
+/** Only trust the id_token email when Google marks it verified (#8). The token
+ * comes straight from Google's token endpoint, so its claims are read unsigned. */
+export declare function verifiedEmailFromIdToken(idToken?: string | null): string | undefined;
 export interface AuthServerDeps {
     fetchCimd?: (clientId: string) => Promise<Record<string, unknown>>;
     /** Exchange a Google auth code at `${base}/callback` for tokens (+ owner email). */
@@ -34,6 +55,7 @@ export interface AuthServerDeps {
         flow: StatePayload['flow'];
         alias?: string;
         state: string;
+        bundles?: string[];
     }) => string;
     writeToken?: (alias: string, tokens: Record<string, unknown>) => void;
     registeredClients?: Map<string, {
@@ -52,16 +74,11 @@ export interface AuthServerDeps {
     resolveSubject?: (email: string) => {
         sub: string;
     } | null;
-    /** alias_add completion: persist the config row AND the tokens for the new
-     * alias under its tenant in ONE call, atomically — /callback invokes it only
-     * after a successful Google exchange, so no pre-write orphan can exist. */
-    bindTenantAlias?: (bind: {
-        tenantId: string;
-        alias: string;
-        email: string;
-        bundles?: string[];
-        tokens: Record<string, unknown>;
-    }) => void;
+    /** alias_add completion: persist the new alias's config row and tokens under
+     * its tenant. /callback awaits it only after a successful Google exchange.
+     * A returned refusal answers 403 with its slug; a throw or rejection answers
+     * 500 E_ALIAS_ADD_FAILED. */
+    bindTenantAlias?: (bind: TenantAliasBind) => void | AliasBindRefusal | Promise<void | AliasBindRefusal>;
 }
 export interface AuthServer {
     routes: Record<string, RouteHandler>;
@@ -69,12 +86,13 @@ export interface AuthServer {
     /** Mint a signed, single-use, TTL-bound clientless flow URL
      * (`${base}/authorize?flow=...&state=<signed>`). The tenantId/bundles ride
      * INSIDE the signed state, so nothing at /authorize or /callback trusts a
-     * caller-supplied identity. Inert unless something calls it (EE wizard). */
+     * caller-supplied identity. Inert unless something calls it. */
     mintFlowState: (opts: {
         flow: 'alias_add' | 'alias_reauth';
         alias: string;
         tenantId?: string;
         bundles?: string[];
+        nonce?: string;
     }) => Promise<string>;
 }
 /** C6: exact redirect_uri match, with RFC 8252 §7.3 port-agnostic loopback and

package/dist/oauth-as.js

@@ -17,6 +17,21 @@ const CLAUDE_AI_FIXED_CALLBACK = 'https://claude.ai/api/mcp/auth_callback';
 export const DCR_MAX_CLIENTS = 1000;
 export const DCR_MAX_REDIRECT_URIS = 10;
 const DCR_MAX_URI_LEN = 2048;
+/** Only trust the id_token email when Google marks it verified (#8). The token
+ * comes straight from Google's token endpoint, so its claims are read unsigned. */
+export function verifiedEmailFromIdToken(idToken) {
+    if (!idToken)
+        return undefined;
+    try {
+        const [, payload] = idToken.split('.');
+        const claims = JSON.parse(Buffer.from(payload, 'base64url').toString('utf-8'));
+        const verified = claims.email_verified === true || claims.email_verified === 'true';
+        return verified ? claims.email : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 // --- helpers ----------------------------------------------------------------
 function json(res, status, body, extraHeaders = {}) {
     res.writeHead(status, { 'Content-Type': 'application/json', ...extraHeaders });
@@ -203,7 +218,7 @@ export function buildAuthServer(config, deps = {}) {
     async function toGoogle(res, sp) {
         const state = await signState(sp, base, secret, nowSec());
         const authUrl = deps.buildGoogleAuthUrl
-            ? deps.buildGoogleAuthUrl({ flow: sp.flow, alias: sp.alias, state })
+            ? deps.buildGoogleAuthUrl({ flow: sp.flow, alias: sp.alias, state, bundles: sp.bundles })
             : `https://accounts.google.com/o/oauth2/v2/auth?state=${encodeURIComponent(state)}`;
         return redirect(res, authUrl);
     }
@@ -356,16 +371,26 @@ export function buildAuthServer(config, deps = {}) {
             const boundEmail = (exchanged.email ?? '').toLowerCase();
             if (!boundEmail)
                 return errorPage(res, 403, 'access_denied', 'Google did not return an email for the signed-in account');
+            let refusal;
             try {
-                deps.bindTenantAlias({ tenantId: st.tenantId, alias: st.alias, email: boundEmail, bundles: st.bundles, tokens: exchanged.tokens });
+                const out = await deps.bindTenantAlias({ tenantId: st.tenantId, alias: st.alias, email: boundEmail, bundles: st.bundles, nonce: st.nonce, tokens: exchanged.tokens });
+                refusal = out?.refused;
             }
             catch (e) {
-                log(`alias_add bind failed for "${st.alias}": ${e.message}`);
+                // Any rejection reason, even none, must still reach this answer.
+                log(`alias_add bind failed for "${st.alias}": ${e instanceof Error ? e.message : typeof e === 'string' ? e : 'non-Error rejection'}`);
                 return errorPage(res, 500, 'E_ALIAS_ADD_FAILED', 'the account could not be saved; try the link again or ask for a fresh one');
             }
+            if (refusal) {
+                // The slug lands in a text/plain body; keep it a bare identifier.
+                const slug = typeof refusal.slug === 'string' && /^[A-Za-z0-9_]+$/.test(refusal.slug) ? refusal.slug : 'access_denied';
+                const message = typeof refusal.message === 'string' && refusal.message ? refusal.message : 'the account could not be linked';
+                log(`alias_add refused for "${st.alias}": ${slug}`);
+                return errorPage(res, 403, slug, message);
+            }
             log(`callback ok flow=alias_add alias=${st.alias}`);
             res.writeHead(200, { 'Content-Type': 'text/html' });
-            res.end(`<!doctype html><meta charset=utf-8><p>Connected "${st.alias}". You can close this window and retry your request.</p>`);
+            res.end(`<!doctype html><meta charset=utf-8><p>Connected "${escapeHtml(st.alias)}". You can close this window and retry your request.</p>`);
             return true;
         }
         if (st.flow === 'alias_reauth') {
@@ -385,7 +410,7 @@ export function buildAuthServer(config, deps = {}) {
             deps.writeToken?.(st.alias, exchanged.tokens);
             log(`callback ok flow=alias_reauth alias=${st.alias}`);
             res.writeHead(200, { 'Content-Type': 'text/html' });
-            res.end(`<!doctype html><meta charset=utf-8><p>Re-authenticated "${st.alias}". You can close this window.</p>`);
+            res.end(`<!doctype html><meta charset=utf-8><p>Re-authenticated "${escapeHtml(st.alias)}". You can close this window.</p>`);
             return true;
         }
         // owner_gate: resolve the verified email to its subject (default = the
@@ -503,8 +528,8 @@ export function buildAuthServer(config, deps = {}) {
             return { ok: false, status: 401, headers: { 'WWW-Authenticate': wwwAuth }, body: JSON.stringify({ error: 'E_MCP_TOKEN_INVALID', message: 'invalid or expired token' }) };
         }
     };
-    const mintFlowState = async ({ flow, alias, tenantId, bundles }) => {
-        const state = await signState({ flow, client_id: '', redirect_uri: '', code_challenge: '', resource, alias, tenantId, bundles }, base, secret, nowSec());
+    const mintFlowState = async ({ flow, alias, tenantId, bundles, nonce }) => {
+        const state = await signState({ flow, client_id: '', redirect_uri: '', code_challenge: '', resource, alias, tenantId, bundles, nonce }, base, secret, nowSec());
         return `${base}/authorize?flow=${flow}&state=${encodeURIComponent(state)}`;
     };
     return { routes, authenticate, mintFlowState };

package/dist/scope-catalog.d.ts

@@ -14,6 +14,9 @@ export declare const BUNDLE_CATALOG: Record<string, BundleCatalogEntry>;
 /** One-way soft-rename map (UD5): empty at 6.0.0; the mechanism ships now so a
  * future rename is a deprecation warning, never a breaking config change. */
 export declare const BUNDLE_ALIASES: Record<string, string>;
+/** Bundle names are user input: an Object.prototype member ("constructor",
+ * "toString") passes a plain `in` or index lookup, so membership is own-key only. */
+export declare function isKnownBundle(name: string): boolean;
 export declare function resolveBundleAliases(bundles: string[]): string[];
 /** Closest catalog key for E_UNKNOWN_BUNDLE remediation (edit distance <= 2). */
 export declare function closestBundle(name: string): string | undefined;

package/dist/scope-catalog.js

@@ -160,9 +160,14 @@ export const BUNDLE_CATALOG = {
  * future rename is a deprecation warning, never a breaking config change. */
 export const BUNDLE_ALIASES = {};
 const warnedAliases = new Set();
+/** Bundle names are user input: an Object.prototype member ("constructor",
+ * "toString") passes a plain `in` or index lookup, so membership is own-key only. */
+export function isKnownBundle(name) {
+    return Object.hasOwn(BUNDLE_CATALOG, name);
+}
 export function resolveBundleAliases(bundles) {
     return bundles.map((name) => {
-        const target = BUNDLE_ALIASES[name];
+        const target = Object.hasOwn(BUNDLE_ALIASES, name) ? BUNDLE_ALIASES[name] : undefined;
         if (!target)
             return name;
         if (!warnedAliases.has(name)) {

package/dist/tools/account-wizard.d.ts

@@ -57,7 +57,7 @@ export declare function scopeGrantDiff(requested: string[], grantedScope: string
  * present, runConsent NEVER binds a server-side loopback listener — the
  * user's browser cannot reach the daemon's loopback — and instead hands out
  * a clientless AS consent URL. The injector decides the flow (single-owner =
- * the legacy alias_reauth link; a tenancy host mints a signed alias_add URL). */
+ * the legacy alias_reauth link). */
 export interface WizardHttpConsent {
     mintConsentUrl: (alias: string) => Promise<string> | string;
 }

package/dist/tools/account-wizard.js

@@ -3,7 +3,7 @@ import { getAccountSet, invalidateAccountSet } from '../accounts.js';
 import { ALIAS_RE, mutateConfigFile } from '../config-file.js';
 import { writeToken } from '../token-store.js';
 import { resolveScopesForAccount } from '../auth.js';
-import { BUNDLE_CATALOG, closestBundle, resolveBundleAliases } from '../scope-catalog.js';
+import { BUNDLE_CATALOG, closestBundle, isKnownBundle, resolveBundleAliases } from '../scope-catalog.js';
 import { openUrl } from '../open-url.js';
 import { coerceBoolean } from './_coerce.js';
 import { safeMessage, stringifyEnvelope } from './_errors.js';
@@ -58,7 +58,7 @@ export function validateAddForm(input, existingAliases) {
         if (b === 'admin') {
             return { ok: false, slug: 'E_UNKNOWN_BUNDLE', message: '"admin" is not a scope bundle.', hint: 'Use the admin checkbox instead, or pass "admin": true.', alias };
         }
-        if (!(b in BUNDLE_CATALOG)) {
+        if (!isKnownBundle(b)) {
             const closest = closestBundle(b);
             const known = Object.keys(BUNDLE_CATALOG).filter((n) => n !== 'admin').join(', ');
             return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-google-multi",
-  "version": "6.0.0-alpha.55",
+  "version": "6.0.0-alpha.56",
   "mcpName": "io.github.bakissation/mcp-google-multi",
   "description": "Local MCP server for Google Workspace (Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console, +Forms/Chat/Admin) across multiple accounts — OAuth-only, encrypted token storage, deny-by-default writes.",
   "type": "module",
@@ -28,6 +28,8 @@
     "./tenant-purge": "./dist/tenant-purge.js",
     "./doctor": "./dist/doctor.js",
     "./write-control": "./dist/write-control.js",
+    "./scope-catalog": "./dist/scope-catalog.js",
+    "./auth": "./dist/auth.js",
     "./package.json": "./package.json"
   },
   "files": [