mcp-google-multi 6.0.0-alpha.57 → 6.0.0-alpha.58

package/dist/index.js

@@ -250,9 +250,10 @@ async function main() {
         const { jwtSecretFrom } = await import('./mcp-token.js');
         const { resolveJwtKey, resolveMasterKeyForDispatch } = await import('./master-key.js');
         const { OAuth2Client } = await import('googleapis-common');
-        const { writeToken } = await import('./token-store.js');
+        const { readToken, writeToken } = await import('./token-store.js');
         const { resolveScopesForAccount } = await import('./auth.js');
         const { ownerAuthUrlOptions } = await import('./oauth-consent.js');
+        const { scopeGrantDiff, setWizardHttpConsent } = await import('./tools/account-wizard.js');
         const { configDir } = await import('./config-file.js');
         const { getAccountSet } = await import('./accounts.js');
         const googleClient = () => new OAuth2Client(process.env.GOOGLE_CLIENT_ID, process.env.GOOGLE_CLIENT_SECRET, `${httpCfg.publicUrl}/callback`);
@@ -275,19 +276,25 @@ async function main() {
                 return { tokens: flow === 'owner_gate' ? {} : tokens, email };
             },
             writeToken: (alias, tokens) => writeToken(alias, tokens),
+            missingScopes: (alias, granted) => scopeGrantDiff(resolveScopesForAccount(alias), granted),
+            hasToken: (alias) => {
+                try {
+                    return readToken(alias) != null;
+                }
+                catch {
+                    return false; // undecryptable: nothing usable to keep
+                }
+            },
             aliasEmail: (alias) => getAccountSet().configs[alias]?.email,
             log: (l) => process.stderr.write(`[as] ${l}\n`),
         });
-        // BV-1: over HTTP, a dead/missing per-account token surfaces a clickable
-        // re-auth link into the AS's alias_reauth flow instead of a stdio CLI hint.
-        const { setHttpReauthBase } = await import('./reauth-hint.js');
-        setHttpReauthBase(httpCfg.publicUrl);
-        // Wizard consent over HTTP: hand out the clientless AS link instead of
+        // BV-1: over HTTP, a dead/missing per-account token surfaces a clickable,
+        // signed re-auth link into the AS's alias_reauth flow instead of a CLI hint.
+        const { setHttpReauthLink } = await import('./reauth-hint.js');
+        setHttpReauthLink((alias) => authServer.reauthLink(alias));
+        // Wizard consent over HTTP: hand out the same signed link instead of
         // binding a loopback listener.
-        const { setWizardHttpConsent } = await import('./tools/account-wizard.js');
-        setWizardHttpConsent({
-            mintConsentUrl: (alias) => `${httpCfg.publicUrl}/authorize?flow=alias_reauth&alias=${encodeURIComponent(alias)}`,
-        });
+        setWizardHttpConsent({ mintConsentUrl: (alias) => authServer.reauthLink(alias) });
         let httpTap;
         if (httpMetrics) {
             const { tapUsageMetrics } = await import('./metrics-tap.js');

package/dist/mcp-token.d.ts

@@ -46,6 +46,18 @@ export declare function signState(payload: StatePayload, base: string, secret: U
 export declare function verifyState(token: string, base: string, secret: Uint8Array): Promise<StatePayload & {
     jti: string;
 }>;
+/** A re-auth link is handed out in a tool error, so it has to survive until
+ * the user clicks it; an hour, not the 10-minute state TTL. */
+export declare const REAUTH_LINK_TTL_SEC = 3600;
+/** Query string of a server-issued alias_reauth link: the alias, an expiry and
+ * an HMAC over both. Synchronous, so the error hints that carry it stay so. */
+export declare function signReauthLink(base: string, secret: Uint8Array, alias: string, nowSec: number): string;
+/** The alias a link was issued for, or null when it is missing, forged or expired. */
+export declare function verifyReauthLink(base: string, secret: Uint8Array, params: {
+    alias: string;
+    exp: string;
+    sig: string;
+}, nowSec: number): string | null;
 /** A pending-authorization artifact for the DCR consent interstitial (same
  * shape as `state`, distinct purpose so the two can't be confused). */
 export declare function signPending(payload: StatePayload, base: string, secret: Uint8Array, iat: number, ttlSec?: number): Promise<string>;

package/dist/mcp-token.js

@@ -3,7 +3,7 @@
 // `state` and authorization code, the in-memory single-use replay guard, and
 // the opaque rotated refresh-token store. Keyed by the provisioned MCP_JWT_KEY
 // (B5), so tokens survive a restart as long as the key persists.
-import { randomBytes } from 'node:crypto';
+import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
 import { existsSync, readFileSync } from 'node:fs';
 import { SignJWT, jwtVerify } from 'jose';
 import { deriveKey, encryptToken, decryptToken } from './token-store.js';
@@ -59,6 +59,30 @@ export function signState(payload, base, secret, iat, ttlSec = STATE_TTL_DEFAULT
 export async function verifyState(token, base, secret) {
     return (await verifyArtifact(token, 'mcp_state', base, secret));
 }
+// --- alias_reauth link -------------------------------------------------------
+/** A re-auth link is handed out in a tool error, so it has to survive until
+ * the user clicks it; an hour, not the 10-minute state TTL. */
+export const REAUTH_LINK_TTL_SEC = 3600;
+function reauthMac(base, secret, alias, exp) {
+    // The newline-separated input can never be a JWT signing input (two
+    // base64url segments and one dot), so the shared key stays unambiguous.
+    return createHmac('sha256', secret).update(`alias_reauth\n${base}\n${alias}\n${exp}`).digest();
+}
+/** Query string of a server-issued alias_reauth link: the alias, an expiry and
+ * an HMAC over both. Synchronous, so the error hints that carry it stay so. */
+export function signReauthLink(base, secret, alias, nowSec) {
+    const exp = nowSec + REAUTH_LINK_TTL_SEC;
+    return `alias=${encodeURIComponent(alias)}&exp=${exp}&sig=${reauthMac(base, secret, alias, exp).toString('base64url')}`;
+}
+/** The alias a link was issued for, or null when it is missing, forged or expired. */
+export function verifyReauthLink(base, secret, params, nowSec) {
+    const exp = Number(params.exp);
+    if (!params.alias || !/^\d+$/.test(params.exp) || exp < nowSec)
+        return null;
+    const want = reauthMac(base, secret, params.alias, exp);
+    const got = Buffer.from(params.sig, 'base64url');
+    return got.length === want.length && timingSafeEqual(got, want) ? params.alias : null;
+}
 /** A pending-authorization artifact for the DCR consent interstitial (same
  * shape as `state`, distinct purpose so the two can't be confused). */
 export function signPending(payload, base, secret, iat, ttlSec = STATE_TTL_DEFAULT) {

package/dist/oauth-as.d.ts

@@ -16,10 +16,10 @@ export interface AuthServerConfig {
     accessTtlSec?: number;
     masterKey: string;
     refreshStorePath: string;
-    /** Default true. The clientless alias-only `flow=alias_reauth` link carries
+    /** Default true. The clientless `flow=alias_reauth` link names an alias with
      * no tenant binding, so a multi-tenant deployment sets false: with several
      * tenants an alias name alone is ambiguous and the branch becomes a
-     * cross-tenant re-auth vector. Server-minted signed flows are unaffected. */
+     * cross-tenant re-auth vector. Server-minted alias_add flows are unaffected. */
     legacyAliasReauth?: boolean;
 }
 /** What /callback hands the alias_add binder once Google returned a verified
@@ -58,6 +58,12 @@ export interface AuthServerDeps {
         bundles?: string[];
     }) => string;
     writeToken?: (alias: string, tokens: Record<string, unknown>) => void;
+    /** Scopes the alias asked for that `grantedScope` lacks, so the alias_reauth
+     * completion page can say what Google's granular consent left out. */
+    missingScopes?: (alias: string, grantedScope: string | undefined) => string[];
+    /** Whether a readable token is stored for the alias; a narrower re-auth
+     * grant keeps it rather than replace it. */
+    hasToken?: (alias: string) => boolean;
     registeredClients?: Map<string, {
         redirect_uris: string[];
     }>;
@@ -88,12 +94,17 @@ export interface AuthServer {
      * INSIDE the signed state, so nothing at /authorize or /callback trusts a
      * caller-supplied identity. Inert unless something calls it. */
     mintFlowState: (opts: {
-        flow: 'alias_add' | 'alias_reauth';
+        flow: 'alias_add';
         alias: string;
         tenantId?: string;
         bundles?: string[];
         nonce?: string;
     }) => Promise<string>;
+    /** The owner's re-auth link for `alias`: HMAC-signed, expiring, not single
+     * use (a chat client may prefetch it). /authorize refuses any alias_reauth
+     * request without a valid one, so an unauthenticated caller can neither
+     * start a re-auth nor learn which aliases exist or what they hold. */
+    reauthLink: (alias: string) => string;
 }
 /** C6: exact redirect_uri match, with RFC 8252 §7.3 port-agnostic loopback and
  *  the fixed claude.ai callback. */

package/dist/oauth-as.js

@@ -7,7 +7,7 @@
 // whole surface is exercised by an offline harness.
 import { createHash, randomBytes } from 'node:crypto';
 import { isIPv4 } from 'node:net';
-import { signAccessToken, verifyAccessToken, signState, verifyState, signAuthzCode, verifyAuthzCode, signPending, verifyPending, ReplayGuard, RefreshStore, STATE_TTL_DEFAULT, CODE_TTL_DEFAULT, ACCESS_TTL_DEFAULT, } from './mcp-token.js';
+import { signAccessToken, verifyAccessToken, signState, verifyState, signAuthzCode, verifyAuthzCode, signReauthLink, verifyReauthLink, signPending, verifyPending, ReplayGuard, RefreshStore, STATE_TTL_DEFAULT, CODE_TTL_DEFAULT, ACCESS_TTL_DEFAULT, } from './mcp-token.js';
 import { fetchCimdDocument, SsrfBlockedError } from './ssrf-guard.js';
 const CLAUDE_AI_FIXED_CALLBACK = 'https://claude.ai/api/mcp/auth_callback';
 // DCR (/register) is public + unauthenticated, so its in-memory store must be
@@ -240,6 +240,11 @@ export function buildAuthServer(config, deps = {}) {
             catch {
                 return errorPage(res, 400, 'E_STATE_INVALID', 'the approval is invalid or expired');
             }
+            // Only the client leg signs pendings, and it is always the owner sign-in;
+            // a pending signed before that rule (flow=alias_reauth) is refused here.
+            if (pending.flow !== 'owner_gate') {
+                return errorPage(res, 400, 'E_STATE_INVALID', 'the approval is invalid or expired');
+            }
             if (!replay.consume(pending.jti, STATE_TTL_DEFAULT * 1000, now())) {
                 return errorPage(res, 400, 'E_STATE_INVALID', 'this approval was already used');
             }
@@ -280,17 +285,20 @@ export function buildAuthServer(config, deps = {}) {
         // In-call re-auth (BV-1): a user-clicked `flow=alias_reauth` link has NO
         // client leg — no code is delivered to any client, the refreshed token is
         // written server-side for the alias — so it skips the client_id/redirect/
-        // PKCE requirements. Safe because /callback binds the completing Google
-        // identity to the alias's configured email before writing anything.
-        if (q.get('flow') === 'alias_reauth' && aliasParam && !clientId) {
+        // PKCE requirements. The link must be one this server signed (reauthLink),
+        // and /callback still binds the completing identity to the alias's email.
+        if (q.get('flow') === 'alias_reauth' && !clientId) {
             if (config.legacyAliasReauth === false) {
                 // Alias-only, tenant-ambiguous: disabled on multi-tenant deployments.
                 return errorPage(res, 403, 'E_LEGACY_REAUTH_DISABLED', 'alias re-auth links are disabled on this deployment; ask the server for a fresh account link');
             }
-            if (!deps.aliasEmail?.(aliasParam)) {
-                return errorPage(res, 400, 'invalid_request', `unknown account "${aliasParam}"`);
+            const alias = verifyReauthLink(base, secret, { alias: aliasParam ?? '', exp: q.get('exp') ?? '', sig: q.get('sig') ?? '' }, nowSec());
+            // One answer for an unsigned, forged, expired or stale link, so a
+            // request the server did not issue learns nothing about its aliases.
+            if (!alias || !deps.aliasEmail?.(alias)) {
+                return errorPage(res, 400, 'E_STATE_INVALID', 'this re-auth link is invalid or expired; ask the server for a fresh one');
             }
-            return toGoogle(res, { flow: 'alias_reauth', client_id: '', redirect_uri: '', code_challenge: '', resource, alias: aliasParam });
+            return toGoogle(res, { flow: 'alias_reauth', client_id: '', redirect_uri: '', code_challenge: '', resource, alias });
         }
         if (!clientId)
             return json(res, 400, { error: 'invalid_request', message: 'client_id required', iss: base }, issHeader);
@@ -310,14 +318,16 @@ export function buildAuthServer(config, deps = {}) {
             return json(res, 400, { error: 'invalid_request', message: `resource must be ${resource}`, iss: base }, issHeader);
         }
         // (5) only after full validation do we build the request artifact.
+        // A client leg is always the owner sign-in. Re-auth has its own signed
+        // link: accepting flow=alias_reauth here let any client (a self-registered
+        // one, or a public CIMD client_id) start it and read the alias's scopes.
         const statePayload = {
-            flow: q.get('flow') === 'alias_reauth' ? 'alias_reauth' : 'owner_gate',
+            flow: 'owner_gate',
             client_id: clientId,
             redirect_uri: redirectUri,
             code_challenge: codeChallenge,
             client_state: clientState,
             resource,
-            alias: q.get('alias') ?? undefined,
         };
         // Confused-deputy defense (#3): a self-registered DCR client can pick an
         // arbitrary redirect_uri, so before we send the owner to Google (whose
@@ -415,10 +425,26 @@ export function buildAuthServer(config, deps = {}) {
                 log(`alias_reauth for "${st.alias}" returned no refresh token; stored token kept`);
                 return errorPage(res, 400, 'E_REAUTH_INCOMPLETE', 'Google did not return a long-lived token, so the stored one was kept. Open the re-auth link again and approve access.');
             }
+            const granted = typeof exchanged.tokens.scope === 'string' ? exchanged.tokens.scope : undefined;
+            const missing = deps.missingScopes?.(st.alias, granted) ?? [];
+            const listed = missing.map((m) => `<code>${escapeHtml(m)}</code>`).join(', ');
+            // A narrower grant replaces nothing that works. The link can be reused
+            // for an hour and the Google URL's scope is not signed, so a narrower
+            // grant is not necessarily the account holder's choice.
+            if (missing.length > 0 && deps.hasToken?.(st.alias)) {
+                log(`alias_reauth for "${st.alias}" granted ${missing.length} fewer scope(s); stored token kept`);
+                res.writeHead(400, { 'Content-Type': 'text/html' });
+                res.end(`<!doctype html><meta charset=utf-8><p>E_SCOPE_NOT_GRANTED: Google did not grant ${missing.length} requested scope(s): ${listed}, so the stored access for "${escapeHtml(st.alias)}" was kept. Ask for a fresh re-auth link and leave every box ticked.</p>`);
+                return true;
+            }
             deps.writeToken?.(st.alias, exchanged.tokens);
             log(`callback ok flow=alias_reauth alias=${st.alias}`);
+            // With no stored token a partial grant still beats none; say what is missing.
+            const gap = missing.length
+                ? `<p>Google did not grant ${missing.length} requested scope(s): ${listed}. Ask for a fresh re-auth link and leave every box ticked to restore them.</p>`
+                : '';
             res.writeHead(200, { 'Content-Type': 'text/html' });
-            res.end(`<!doctype html><meta charset=utf-8><p>Re-authenticated "${escapeHtml(st.alias)}". You can close this window.</p>`);
+            res.end(`<!doctype html><meta charset=utf-8><p>Re-authenticated "${escapeHtml(st.alias)}". You can close this window.</p>${gap}`);
             return true;
         }
         // owner_gate: resolve the verified email to its subject (default = the
@@ -537,8 +563,13 @@ export function buildAuthServer(config, deps = {}) {
         }
     };
     const mintFlowState = async ({ flow, alias, tenantId, bundles, nonce }) => {
+        // /authorize has a signed branch for alias_add only; anything else minted
+        // here would be a state no route verifies the way its flow needs.
+        if (flow !== 'alias_add')
+            throw new Error(`mintFlowState supports alias_add only, not ${String(flow)}`);
         const state = await signState({ flow, client_id: '', redirect_uri: '', code_challenge: '', resource, alias, tenantId, bundles, nonce }, base, secret, nowSec());
         return `${base}/authorize?flow=${flow}&state=${encodeURIComponent(state)}`;
     };
-    return { routes, authenticate, mintFlowState };
+    const reauthLink = (alias) => `${base}/authorize?flow=alias_reauth&${signReauthLink(base, secret, alias, nowSec())}`;
+    return { routes, authenticate, mintFlowState, reauthLink };
 }

package/dist/reauth-hint.d.ts

@@ -1,2 +1,2 @@
-export declare function setHttpReauthBase(base: string | null): void;
+export declare function setHttpReauthLink(linker: ((alias: string) => string) | null): void;
 export declare function reauthHint(account: string): string;

package/dist/reauth-hint.js

@@ -1,15 +1,15 @@
 // B13 in-call re-auth (BV-1): a dead/missing per-account Google token is a
 // leg-C failure. Over stdio the fix is the `auth --account` CLI; over HTTP the
-// user cannot run a CLI, so the hint becomes a clickable link into the AS's
-// clientless alias_reauth flow (${BASE}/authorize?flow=alias_reauth&alias=…).
-// The HTTP bootstrap sets the base when the AS starts; stdio never does.
-let httpReauthBase = null;
-export function setHttpReauthBase(base) {
-    httpReauthBase = base;
+// user cannot run a CLI, so the hint becomes a clickable, server-signed link
+// into the AS's clientless alias_reauth flow (AuthServer.reauthLink). The HTTP
+// bootstrap installs the linker when the AS starts; stdio never does.
+let httpReauthLink = null;
+export function setHttpReauthLink(linker) {
+    httpReauthLink = linker;
 }
 export function reauthHint(account) {
-    if (httpReauthBase) {
-        return `Re-authenticate "${account}" in your browser, then retry: ${httpReauthBase}/authorize?flow=alias_reauth&alias=${encodeURIComponent(account)}`;
+    if (httpReauthLink) {
+        return `Re-authenticate "${account}" in your browser, then retry: ${httpReauthLink(account)}`;
     }
     return `Run: npx mcp-google-multi auth --account ${account}`;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-google-multi",
-  "version": "6.0.0-alpha.57",
+  "version": "6.0.0-alpha.58",
   "mcpName": "io.github.bakissation/mcp-google-multi",
   "description": "Local MCP server for Google Workspace (Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console, +Forms/Chat/Admin) across multiple accounts — OAuth-only, encrypted token storage, deny-by-default writes.",
   "type": "module",