mcp-google-multi 6.0.0-alpha.59 → 6.0.0-alpha.60

package/dist/mcp-token.d.ts

@@ -99,8 +99,13 @@ export declare class RefreshStore {
     /** Rotate a presented refresh token; null if unknown OR if the presented
      * token was already rotated away (reuse => the family is revoked). The
      * record's sub is copied forward and returned so the caller can mint the
-     * matching access token without trusting anything client-supplied. */
-    rotate(oldToken: string, nowMs: number): {
+     * matching access token without trusting anything client-supplied.
+     *
+     * `accept` (optional) is called inside the store lock, before any mutation,
+     * with the record's sub. false: every active record of that sub is dropped
+     * and null returned. A throw: nothing is mutated and the error propagates,
+     * so the presented token stays valid. Absent: unchanged. */
+    rotate(oldToken: string, nowMs: number, accept?: (sub: string) => boolean): {
         token: string;
         sub: string;
     } | null;

package/dist/mcp-token.js

@@ -175,8 +175,13 @@ export class RefreshStore {
     /** Rotate a presented refresh token; null if unknown OR if the presented
      * token was already rotated away (reuse => the family is revoked). The
      * record's sub is copied forward and returned so the caller can mint the
-     * matching access token without trusting anything client-supplied. */
-    rotate(oldToken, nowMs) {
+     * matching access token without trusting anything client-supplied.
+     *
+     * `accept` (optional) is called inside the store lock, before any mutation,
+     * with the record's sub. false: every active record of that sub is dropped
+     * and null returned. A throw: nothing is mutated and the error propagates,
+     * so the presented token stays valid. Absent: unchanged. */
+    rotate(oldToken, nowMs, accept) {
         return withFileLock(this.path, () => {
             const data = this.load();
             const rec = data.active[oldToken];
@@ -191,6 +196,13 @@ export class RefreshStore {
                 }
                 return null;
             }
+            if (accept && !accept(rec.sub)) {
+                for (const [t, r] of Object.entries(data.active))
+                    if (r.sub === rec.sub)
+                        delete data.active[t];
+                this.save(data);
+                return null;
+            }
             delete data.active[oldToken];
             data.spent[oldToken] = rec.family;
             const next = randomBytes(32).toString('base64url');

package/dist/oauth-as.d.ts

@@ -103,6 +103,12 @@ export interface AuthServerDeps {
      * A returned refusal answers 403 with its slug; a throw or rejection answers
      * 500 E_ALIAS_ADD_FAILED. */
     bindTenantAlias?: (bind: TenantAliasBind) => void | AliasBindRefusal | Promise<void | AliasBindRefusal>;
+    /** False for a subject this host no longer serves (a multi-tenant host that
+     * removed or suspended it): /token then issues and rotates nothing for it
+     * (400 invalid_grant; a rotated sub's refresh tokens are dropped). A throw
+     * means the answer is unknown right now: 503 temporarily_unavailable, and
+     * the presented refresh token is not spent. Absent: every subject is active. */
+    subjectActive?: (sub: string) => boolean;
 }
 export interface AuthServer {
     routes: Record<string, RouteHandler>;

package/dist/oauth-as.js

@@ -56,6 +56,11 @@ function errorPage(res, status, slug, message) {
     res.end(`${slug}: ${message}`);
     return true;
 }
+class SubjectCheckUnavailable extends Error {
+}
+function subjectUnavailable(res) {
+    return json(res, 503, { error: 'temporarily_unavailable', message: 'the sign-in could not be checked right now; retry shortly' }, { 'Retry-After': '5' });
+}
 function redirect(res, location) {
     res.writeHead(302, { Location: location });
     res.end();
@@ -508,12 +513,50 @@ export function buildAuthServer(config, deps = {}) {
                 return json(res, 400, { error: 'invalid_grant', message: 'PKCE verification failed' });
             }
             const access = await signAccessToken({ base, secret, iat: nowSec(), ttlSec: accessTtl, sub: code.sub });
+            if (deps.subjectActive) {
+                let active;
+                try {
+                    active = deps.subjectActive(code.sub);
+                }
+                catch (e) {
+                    log(`token deferred grant=authorization_code: subject check failed: ${e instanceof Error ? e.message : 'non-Error throw'}`);
+                    return subjectUnavailable(res);
+                }
+                if (!active) {
+                    log('token refused grant=authorization_code: subject inactive');
+                    return json(res, 400, { error: 'invalid_grant', message: 'the subject is no longer provisioned' });
+                }
+            }
             const refreshToken = refresh.issue(now(), code.sub);
             log('token issued grant=authorization_code');
             return json(res, 200, { access_token: access, token_type: 'Bearer', expires_in: accessTtl, refresh_token: refreshToken, scope: 'mcp:use' });
         }
         if (grant === 'refresh_token') {
-            const next = refresh.rotate(form.refresh_token ?? '', now());
+            const subjectActive = deps.subjectActive;
+            const accept = subjectActive
+                ? (sub) => {
+                    let active;
+                    try {
+                        active = subjectActive(sub);
+                    }
+                    catch (e) {
+                        throw new SubjectCheckUnavailable('subject check failed', { cause: e });
+                    }
+                    if (!active)
+                        log('token refused grant=refresh_token: subject inactive');
+                    return active;
+                }
+                : undefined;
+            let next;
+            try {
+                next = refresh.rotate(form.refresh_token ?? '', now(), accept);
+            }
+            catch (e) {
+                if (!(e instanceof SubjectCheckUnavailable))
+                    throw e;
+                log(`token deferred grant=refresh_token: subject check failed: ${e.cause instanceof Error ? e.cause.message : 'non-Error throw'}`);
+                return subjectUnavailable(res);
+            }
             if (!next)
                 return json(res, 400, { error: 'invalid_grant', message: 'unknown or rotated refresh token' });
             const access = await signAccessToken({ base, secret, iat: nowSec(), ttlSec: accessTtl, sub: next.sub });

package/dist/usage-metrics.js

@@ -44,7 +44,7 @@ export const KNOWN_ERROR_SLUGS = new Set([
     'insufficient_scope', 'internal', 'invalid_client', 'invalid_client_metadata',
     'invalid_grant', 'invalid_params', 'invalid_query', 'invalid_request',
     'invalid_scope', 'network_error', 'not_found', 'rate_limited',
-    'reauth_required', 'recipient_not_allowed', 'tenant_not_found', 'too_large', 'toolset_disabled', 'unknown_api',
+    'reauth_required', 'recipient_not_allowed', 'temporarily_unavailable', 'tenant_not_found', 'too_large', 'toolset_disabled', 'unknown_api',
     'unknown_argument', 'unknown_method', 'unsupported_grant_type', 'unsupported_type',
     'untrusted_host', 'upstream_error', 'validation_error', 'write_disabled',
 ]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-google-multi",
-  "version": "6.0.0-alpha.59",
+  "version": "6.0.0-alpha.60",
   "mcpName": "io.github.bakissation/mcp-google-multi",
   "description": "Local MCP server for Google Workspace (Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console, +Forms/Chat/Admin) across multiple accounts — OAuth-only, encrypted token storage, deny-by-default writes.",
   "type": "module",