mcp-google-multi 6.0.0-alpha.61 → 6.0.0-alpha.63

package/dist/discovery-client.js

@@ -74,6 +74,21 @@ export function discoveryCacheDir(env = process.env) {
     return (env.DISCOVERY_CACHE_PATH ??
         path.join(env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config'), 'mcp-google-multi', 'discovery'));
 }
+// Default cache path only (an operator's DISCOVERY_CACHE_PATH may be shared,
+// even /tmp, and keeps its mode), only when this process owns it, and best
+// effort. Clears group/other bits and keeps setuid/setgid/sticky.
+function tightenOwnDir(dir) {
+    if (process.platform === 'win32')
+        return;
+    try {
+        const st = fs.statSync(dir);
+        if (st.uid === process.getuid?.() && (st.mode & 0o077) !== 0)
+            fs.chmodSync(dir, st.mode & ~0o077 & 0o7777);
+    }
+    catch {
+        // the cache still works with the directory's own mode
+    }
+}
 // A poisoned cache file could repoint baseUrl off-Google; refuse to send the
 // user's Bearer token anywhere but a googleapis.com host.
 export function isGoogleApiUrl(url) {
@@ -135,6 +150,7 @@ export async function loadMethodIndex(api, deps = {}) {
         throw new Error(`Unknown api "${api}". Known: ${Object.keys(SUPPORTED_APIS).join(', ')}`);
     }
     const fetchFn = deps.fetchFn ?? ((url) => fetch(url, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) }));
+    const defaultDir = deps.cacheDir === undefined && process.env.DISCOVERY_CACHE_PATH === undefined;
     const cacheDir = deps.cacheDir ?? discoveryCacheDir();
     const cacheFile = path.join(cacheDir, `${api}.json`);
     const readCache = () => {
@@ -172,7 +188,9 @@ export async function loadMethodIndex(api, deps = {}) {
                 if (!res.ok)
                     throw new Error(`HTTP ${res.status}`);
                 doc = (await res.json());
-                fs.mkdirSync(cacheDir, { recursive: true });
+                fs.mkdirSync(cacheDir, { recursive: true, mode: 0o700 });
+                if (defaultDir)
+                    tightenOwnDir(cacheDir);
                 fs.writeFileSync(cacheFile, JSON.stringify(doc), { mode: 0o600 });
                 break;
             }

package/dist/http-transport.js

@@ -66,6 +66,16 @@ function stopReading(socket) {
     socket.pause();
     socket.resume = () => socket;
 }
+// For a log line: the pathname only (a query can carry a code or a state),
+// and never a throw, since the caller is the catch-all.
+function pathOf(req) {
+    try {
+        return new URL(req.url ?? '/', 'http://localhost').pathname;
+    }
+    catch {
+        return '?';
+    }
+}
 export class HttpTransportHost {
     opts;
     httpServer;
@@ -140,8 +150,23 @@ export class HttpTransportHost {
             res.once('close', settle);
             // Never rejects: close() waits on it, and a catch-all that itself threw
             // must neither reject close() nor surface as an unhandled rejection.
+            // The thrown message can name server paths (a lock timeout does), so it
+            // goes only to the host's log.
             const done = this.handle(req, res)
-                .catch((e) => this.fail(res, 500, 'internal_error', e.message))
+                .catch((e) => {
+                try {
+                    this.fail(res, 500, 'internal_error', 'internal error');
+                }
+                finally {
+                    // A throwing log must not reach the destroy below: the answer is sent.
+                    try {
+                        this.log(`500 internal_error path=${pathOf(req)}: ${e instanceof Error ? e.message : 'non-Error throw'}`);
+                    }
+                    catch {
+                        // nowhere left to report it
+                    }
+                }
+            })
                 .catch(() => void res.destroy());
             this.handling.add(done);
             void done.finally(() => this.handling.delete(done));

package/dist/mcp-token.d.ts

@@ -35,6 +35,9 @@ export interface StatePayload {
     /** alias_add only: an opaque value the minting caller chose, signed like
      * tenantId and handed back to its binder (e.g. a server-side link record). */
     nonce?: string;
+    /** owner_gate only: base64url sha256 of the browser-binding cookie the
+     * Google redirect set; /callback refuses a browser that lacks it. */
+    bind?: string;
 }
 export interface CodePayload {
     redirect_uri: string;
@@ -110,8 +113,7 @@ export declare class RefreshStore {
         sub: string;
     } | null;
     /** Drop every ACTIVE record minted under `sub` (linear scan under the store
-     * lock). Spent entries carry no sub and stay: with their families gone, a
-     * reuse finds nothing to revoke — inert by construction. Returns the number
-     * of active tokens dropped. */
+     * lock); the save then drops the spent entries of every family left with no
+     * active token. Returns the number of active tokens dropped. */
     purgeTenant(sub: string): number;
 }

package/dist/mcp-token.js

@@ -20,6 +20,8 @@ function newJti() {
     return randomBytes(16).toString('base64url');
 }
 export async function signAccessToken(p) {
+    if (typeof p.sub !== 'string' || p.sub === '')
+        throw new Error('signAccessToken: sub must be a non-empty string');
     const ttl = p.ttlSec ?? ACCESS_TTL_DEFAULT;
     return new SignJWT({ scope: 'mcp:use', purpose: 'mcp_access' })
         .setProtectedHeader({ alg: 'HS256', typ: 'JWT' })
@@ -36,7 +38,9 @@ export async function verifyAccessToken(token, base, secret) {
     const { payload } = await jwtVerify(token, secret, { issuer: base, audience: `${base}/mcp` });
     if (payload.purpose !== 'mcp_access')
         throw new Error('wrong token purpose');
-    return { sub: String(payload.sub), scope: String(payload.scope ?? ''), jti: String(payload.jti ?? '') };
+    if (typeof payload.sub !== 'string' || payload.sub === '')
+        throw new Error('access token has no subject');
+    return { sub: payload.sub, scope: String(payload.scope ?? ''), jti: String(payload.jti ?? '') };
 }
 async function signArtifact(claims, purpose, base, secret, iat, ttlSec) {
     return new SignJWT({ ...claims, purpose })
@@ -129,6 +133,16 @@ export class ReplayGuard {
     }
 }
 const SPENT_CAP = 2000;
+function ownEntries(o) {
+    // An own `__proto__` key (JSON.parse makes one) would set the prototype when copied.
+    return o !== null && typeof o === 'object' && !Array.isArray(o) ? Object.entries(o).filter(([k]) => k !== '__proto__') : [];
+}
+function isLegacyRecord(r) {
+    if (r === null || typeof r !== 'object')
+        return false;
+    const x = r;
+    return typeof x.sub === 'string' && x.sub !== '' && typeof x.family === 'string' && typeof x.issuedAt === 'number' && Number.isFinite(x.issuedAt);
+}
 /**
  * Persisted (encrypted under MASTER_KEY) opaque refresh-token store. Rotates on
  * every use (a stolen token is usable at most once), and detects REUSE of a
@@ -144,22 +158,64 @@ export class RefreshStore {
         this.masterKey = masterKey;
     }
     load() {
+        const data = { active: {}, spent: {} };
         if (!existsSync(this.path))
-            return { active: {}, spent: {} };
+            return data;
+        let d;
         try {
-            const d = decryptToken(readFileSync(this.path, 'utf-8'), this.masterKey);
-            return { active: d.active ?? {}, spent: d.spent ?? {} };
+            d = decryptToken(readFileSync(this.path, 'utf-8'), this.masterKey);
         }
         catch {
-            return { active: {}, spent: {} };
+            return data;
         }
+        // Only well-formed own entries survive, so no lookup can land on an
+        // inherited key or a record without a subject.
+        for (const [t, r] of ownEntries(d?.active)) {
+            if (isLegacyRecord(r))
+                data.active[t] = { sub: r.sub, issuedAt: r.issuedAt, family: r.family };
+        }
+        for (const [t, fam] of ownEntries(d?.spent))
+            if (typeof fam === 'string')
+                data.spent[t] = fam;
+        return data;
     }
     save(data) {
-        // bound the spent set (drop oldest-inserted) so it can't grow forever.
-        const keys = Object.keys(data.spent);
-        if (keys.length > SPENT_CAP) {
-            for (const k of keys.slice(0, keys.length - SPENT_CAP))
-                delete data.spent[k];
+        // A family with no active token has nothing left to revoke. Over the cap,
+        // the subject holding the most spent tokens loses its oldest (ties: the
+        // oldest entry), so a subject's rotations, across all its families, only
+        // push out its own history (docs/internals.md). Insertion order = rotation
+        // order.
+        const owner = new Map();
+        for (const r of Object.values(data.active))
+            owner.set(r.family, r.sub);
+        const order = Object.keys(data.spent);
+        const held = new Map();
+        let total = 0;
+        order.forEach((t, i) => {
+            const sub = owner.get(data.spent[t]);
+            if (sub === undefined) {
+                delete data.spent[t];
+                return;
+            }
+            const h = held.get(sub);
+            if (h)
+                h.at.push(i);
+            else
+                held.set(sub, { at: [i], head: 0 });
+            total += 1;
+        });
+        while (total > SPENT_CAP) {
+            let most = { at: [], head: 0 };
+            let mostN = 0;
+            for (const h of held.values()) {
+                const n = h.at.length - h.head;
+                if (n > mostN || (n === mostN && n > 0 && h.at[h.head] < most.at[most.head])) {
+                    most = h;
+                    mostN = n;
+                }
+            }
+            delete data.spent[order[most.at[most.head++]]];
+            total -= 1;
         }
         atomicWriteFileSync(this.path, encryptToken(data, this.masterKey), 0o600);
     }
@@ -184,10 +240,10 @@ export class RefreshStore {
     rotate(oldToken, nowMs, accept) {
         return withFileLock(this.path, () => {
             const data = this.load();
-            const rec = data.active[oldToken];
+            const rec = Object.hasOwn(data.active, oldToken) ? data.active[oldToken] : undefined;
             if (!rec) {
                 // Reuse of a rotated-away token signals theft: revoke the whole family.
-                const fam = data.spent[oldToken];
+                const fam = Object.hasOwn(data.spent, oldToken) ? data.spent[oldToken] : undefined;
                 if (fam) {
                     for (const [t, r] of Object.entries(data.active))
                         if (r.family === fam)
@@ -212,9 +268,8 @@ export class RefreshStore {
         });
     }
     /** Drop every ACTIVE record minted under `sub` (linear scan under the store
-     * lock). Spent entries carry no sub and stay: with their families gone, a
-     * reuse finds nothing to revoke — inert by construction. Returns the number
-     * of active tokens dropped. */
+     * lock); the save then drops the spent entries of every family left with no
+     * active token. Returns the number of active tokens dropped. */
     purgeTenant(sub) {
         return withFileLock(this.path, () => {
             const data = this.load();

package/dist/oauth-as.js

@@ -5,7 +5,7 @@
 // tokens (leg C, unchanged). Mounts into B12's HttpTransportHost as `routes` +
 // an `authenticate` for POST /mcp. All Google/CIMD I/O is injectable so the
 // whole surface is exercised by an offline harness.
-import { createHash, randomBytes } from 'node:crypto';
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
 import { isIPv4 } from 'node:net';
 import { signAccessToken, verifyAccessToken, signState, verifyState, signAuthzCode, verifyAuthzCode, signReauthLink, verifyReauthLink, signPending, verifyPending, ReplayGuard, RefreshStore, STATE_TTL_DEFAULT, CODE_TTL_DEFAULT, ACCESS_TTL_DEFAULT, } from './mcp-token.js';
 import { fetchCimdDocument, SsrfBlockedError } from './ssrf-guard.js';
@@ -61,8 +61,8 @@ class SubjectCheckUnavailable extends Error {
 function subjectUnavailable(res) {
     return json(res, 503, { error: 'temporarily_unavailable', message: 'the sign-in could not be checked right now; retry shortly' }, { 'Retry-After': '5' });
 }
-function redirect(res, location) {
-    res.writeHead(302, { Location: location });
+function redirect(res, location, extraHeaders = {}) {
+    res.writeHead(302, { Location: location, ...extraHeaders });
     res.end();
     return true;
 }
@@ -102,6 +102,38 @@ export function redirectAllowed(redirectUri, docRedirectUris) {
         return isLoopbackHostname(du.hostname) && du.protocol === r.protocol && du.pathname === r.pathname;
     });
 }
+// The owner_gate browser binding (docs/internals.md). One cookie per flow, so
+// two sign-ins started in one browser do not overwrite each other. __Host-
+// requires Secure, which an http base (the loopback owner) cannot rely on in
+// every browser, so an http base gets a plain host-only name instead.
+const BIND_HASH = /^[A-Za-z0-9_-]{43}$/;
+function bindCookieName(base, bind) {
+    return `${base.startsWith('https:') ? '__Host-' : ''}mgm-og-${bind.slice(0, 16)}`;
+}
+function bindCookieAttrs(base, maxAge) {
+    return `Path=/; Max-Age=${maxAge}; HttpOnly; SameSite=Lax${base.startsWith('https:') ? '; Secure' : ''}`;
+}
+function readCookie(req, name) {
+    for (const part of (req.headers.cookie ?? '').split(';')) {
+        const i = part.indexOf('=');
+        if (i > 0 && part.slice(0, i).trim() === name)
+            return part.slice(i + 1).trim();
+    }
+    return undefined;
+}
+function sha256Url(value) {
+    return createHash('sha256').update(value).digest('base64url');
+}
+function browserBinding(req, base, bind) {
+    if (typeof bind !== 'string' || !BIND_HASH.test(bind))
+        return 'missing';
+    const value = readCookie(req, bindCookieName(base, bind));
+    if (!value)
+        return 'missing';
+    const got = createHash('sha256').update(value).digest();
+    const want = Buffer.from(bind, 'base64url');
+    return got.length === want.length && timingSafeEqual(got, want) ? 'ok' : 'mismatch';
+}
 function pkceS256(verifier) {
     return createHash('sha256').update(verifier).digest('base64url');
 }
@@ -234,11 +266,20 @@ export function buildAuthServer(config, deps = {}) {
         return s.replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c]);
     }
     async function toGoogle(res, sp) {
+        // H4 F1: without this, a Google URL minted here and forwarded to someone
+        // else signs THEM in and hands their subject to the starting client.
+        const headers = {};
+        if (sp.flow === 'owner_gate') {
+            const value = randomBytes(32).toString('base64url');
+            const bind = sha256Url(value);
+            sp = { ...sp, bind };
+            headers['Set-Cookie'] = `${bindCookieName(base, bind)}=${value}; ${bindCookieAttrs(base, STATE_TTL_DEFAULT)}`;
+        }
         const state = await signState(sp, base, secret, nowSec());
         const authUrl = deps.buildGoogleAuthUrl
             ? deps.buildGoogleAuthUrl({ flow: sp.flow, alias: sp.alias, state, bundles: sp.bundles })
             : `https://accounts.google.com/o/oauth2/v2/auth?state=${encodeURIComponent(state)}`;
-        return redirect(res, authUrl);
+        return redirect(res, authUrl, headers);
     }
     // GET /authorize (validate + interstitial for DCR clients); POST /authorize
     // (a DCR consent approval — verify the signed pending token, then proceed).
@@ -355,7 +396,7 @@ export function buildAuthServer(config, deps = {}) {
         // cannot forge, so there is nothing to spoof.
         if (client.dcr) {
             const pendingToken = await signPending(statePayload, base, secret, nowSec());
-            res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store' });
+            res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store', 'Content-Security-Policy': "frame-ancestors 'none'", 'X-Frame-Options': 'DENY' });
             res.end(`<!doctype html><meta charset=utf-8><title>Authorize access</title>` +
                 `<body style="font-family:system-ui,sans-serif;max-width:36em;margin:3em auto;line-height:1.5">` +
                 `<h2>Authorize access?</h2>` +
@@ -382,6 +423,16 @@ export function buildAuthServer(config, deps = {}) {
         if (!replay.consume(st.jti, STATE_TTL_DEFAULT * 1000, now())) {
             return errorPage(res, 400, 'E_STATE_INVALID', 'state has already been used (replay)');
         }
+        // After the spend, so a refused callback URL cannot be replayed from the
+        // browser that holds the cookie; before the exchange and resolveSubject.
+        if (st.flow === 'owner_gate') {
+            const binding = browserBinding(req, base, st.bind);
+            if (binding !== 'ok') {
+                log(`callback refused flow=owner_gate: browser binding ${binding}`);
+                return errorPage(res, 400, 'E_BROWSER_MISMATCH', 'finish the sign-in in the browser that started it; start again from your app');
+            }
+            res.setHeader('Set-Cookie', `${bindCookieName(base, st.bind ?? '')}=; ${bindCookieAttrs(base, 0)}`);
+        }
         if (!code)
             return errorPage(res, 400, 'invalid_request', 'missing code');
         let exchanged;
@@ -389,7 +440,10 @@ export function buildAuthServer(config, deps = {}) {
             exchanged = deps.exchangeCode ? await deps.exchangeCode(code, st.flow) : { tokens: {} };
         }
         catch (e) {
-            return errorPage(res, 400, 'invalid_grant', `Google code exchange failed: ${e.message}`);
+            // The detail can name proxies and hosts; it goes to the log, not the browser.
+            const detail = e instanceof Error ? e.message : typeof e === 'string' ? e : 'non-Error rejection';
+            log(`callback exchange failed flow=${st.flow}: ${detail.replace(/[\r\n]+/g, ' ')}`);
+            return errorPage(res, 400, 'invalid_grant', 'Google could not complete the sign-in; start again from your app');
         }
         if (st.flow === 'alias_add') {
             if (!st.alias || !st.tenantId)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-google-multi",
-  "version": "6.0.0-alpha.61",
+  "version": "6.0.0-alpha.63",
   "mcpName": "io.github.bakissation/mcp-google-multi",
   "description": "Local MCP server for Google Workspace (Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console, +Forms/Chat/Admin) across multiple accounts — OAuth-only, encrypted token storage, deny-by-default writes.",
   "type": "module",