mcp-google-multi 6.0.0-alpha.62 → 6.0.0-alpha.63

package/dist/mcp-token.d.ts

@@ -35,6 +35,9 @@ export interface StatePayload {
     /** alias_add only: an opaque value the minting caller chose, signed like
      * tenantId and handed back to its binder (e.g. a server-side link record). */
     nonce?: string;
+    /** owner_gate only: base64url sha256 of the browser-binding cookie the
+     * Google redirect set; /callback refuses a browser that lacks it. */
+    bind?: string;
 }
 export interface CodePayload {
     redirect_uri: string;

package/dist/mcp-token.js

@@ -20,6 +20,8 @@ function newJti() {
     return randomBytes(16).toString('base64url');
 }
 export async function signAccessToken(p) {
+    if (typeof p.sub !== 'string' || p.sub === '')
+        throw new Error('signAccessToken: sub must be a non-empty string');
     const ttl = p.ttlSec ?? ACCESS_TTL_DEFAULT;
     return new SignJWT({ scope: 'mcp:use', purpose: 'mcp_access' })
         .setProtectedHeader({ alg: 'HS256', typ: 'JWT' })
@@ -36,7 +38,9 @@ export async function verifyAccessToken(token, base, secret) {
     const { payload } = await jwtVerify(token, secret, { issuer: base, audience: `${base}/mcp` });
     if (payload.purpose !== 'mcp_access')
         throw new Error('wrong token purpose');
-    return { sub: String(payload.sub), scope: String(payload.scope ?? ''), jti: String(payload.jti ?? '') };
+    if (typeof payload.sub !== 'string' || payload.sub === '')
+        throw new Error('access token has no subject');
+    return { sub: payload.sub, scope: String(payload.scope ?? ''), jti: String(payload.jti ?? '') };
 }
 async function signArtifact(claims, purpose, base, secret, iat, ttlSec) {
     return new SignJWT({ ...claims, purpose })
@@ -129,6 +133,16 @@ export class ReplayGuard {
     }
 }
 const SPENT_CAP = 2000;
+function ownEntries(o) {
+    // An own `__proto__` key (JSON.parse makes one) would set the prototype when copied.
+    return o !== null && typeof o === 'object' && !Array.isArray(o) ? Object.entries(o).filter(([k]) => k !== '__proto__') : [];
+}
+function isLegacyRecord(r) {
+    if (r === null || typeof r !== 'object')
+        return false;
+    const x = r;
+    return typeof x.sub === 'string' && x.sub !== '' && typeof x.family === 'string' && typeof x.issuedAt === 'number' && Number.isFinite(x.issuedAt);
+}
 /**
  * Persisted (encrypted under MASTER_KEY) opaque refresh-token store. Rotates on
  * every use (a stolen token is usable at most once), and detects REUSE of a
@@ -144,15 +158,26 @@ export class RefreshStore {
         this.masterKey = masterKey;
     }
     load() {
+        const data = { active: {}, spent: {} };
         if (!existsSync(this.path))
-            return { active: {}, spent: {} };
+            return data;
+        let d;
         try {
-            const d = decryptToken(readFileSync(this.path, 'utf-8'), this.masterKey);
-            return { active: d.active ?? {}, spent: d.spent ?? {} };
+            d = decryptToken(readFileSync(this.path, 'utf-8'), this.masterKey);
         }
         catch {
-            return { active: {}, spent: {} };
+            return data;
+        }
+        // Only well-formed own entries survive, so no lookup can land on an
+        // inherited key or a record without a subject.
+        for (const [t, r] of ownEntries(d?.active)) {
+            if (isLegacyRecord(r))
+                data.active[t] = { sub: r.sub, issuedAt: r.issuedAt, family: r.family };
         }
+        for (const [t, fam] of ownEntries(d?.spent))
+            if (typeof fam === 'string')
+                data.spent[t] = fam;
+        return data;
     }
     save(data) {
         // A family with no active token has nothing left to revoke. Over the cap,
@@ -215,10 +240,10 @@ export class RefreshStore {
     rotate(oldToken, nowMs, accept) {
         return withFileLock(this.path, () => {
             const data = this.load();
-            const rec = data.active[oldToken];
+            const rec = Object.hasOwn(data.active, oldToken) ? data.active[oldToken] : undefined;
             if (!rec) {
                 // Reuse of a rotated-away token signals theft: revoke the whole family.
-                const fam = data.spent[oldToken];
+                const fam = Object.hasOwn(data.spent, oldToken) ? data.spent[oldToken] : undefined;
                 if (fam) {
                     for (const [t, r] of Object.entries(data.active))
                         if (r.family === fam)

package/dist/oauth-as.js

@@ -5,7 +5,7 @@
 // tokens (leg C, unchanged). Mounts into B12's HttpTransportHost as `routes` +
 // an `authenticate` for POST /mcp. All Google/CIMD I/O is injectable so the
 // whole surface is exercised by an offline harness.
-import { createHash, randomBytes } from 'node:crypto';
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
 import { isIPv4 } from 'node:net';
 import { signAccessToken, verifyAccessToken, signState, verifyState, signAuthzCode, verifyAuthzCode, signReauthLink, verifyReauthLink, signPending, verifyPending, ReplayGuard, RefreshStore, STATE_TTL_DEFAULT, CODE_TTL_DEFAULT, ACCESS_TTL_DEFAULT, } from './mcp-token.js';
 import { fetchCimdDocument, SsrfBlockedError } from './ssrf-guard.js';
@@ -61,8 +61,8 @@ class SubjectCheckUnavailable extends Error {
 function subjectUnavailable(res) {
     return json(res, 503, { error: 'temporarily_unavailable', message: 'the sign-in could not be checked right now; retry shortly' }, { 'Retry-After': '5' });
 }
-function redirect(res, location) {
-    res.writeHead(302, { Location: location });
+function redirect(res, location, extraHeaders = {}) {
+    res.writeHead(302, { Location: location, ...extraHeaders });
     res.end();
     return true;
 }
@@ -102,6 +102,38 @@ export function redirectAllowed(redirectUri, docRedirectUris) {
         return isLoopbackHostname(du.hostname) && du.protocol === r.protocol && du.pathname === r.pathname;
     });
 }
+// The owner_gate browser binding (docs/internals.md). One cookie per flow, so
+// two sign-ins started in one browser do not overwrite each other. __Host-
+// requires Secure, which an http base (the loopback owner) cannot rely on in
+// every browser, so an http base gets a plain host-only name instead.
+const BIND_HASH = /^[A-Za-z0-9_-]{43}$/;
+function bindCookieName(base, bind) {
+    return `${base.startsWith('https:') ? '__Host-' : ''}mgm-og-${bind.slice(0, 16)}`;
+}
+function bindCookieAttrs(base, maxAge) {
+    return `Path=/; Max-Age=${maxAge}; HttpOnly; SameSite=Lax${base.startsWith('https:') ? '; Secure' : ''}`;
+}
+function readCookie(req, name) {
+    for (const part of (req.headers.cookie ?? '').split(';')) {
+        const i = part.indexOf('=');
+        if (i > 0 && part.slice(0, i).trim() === name)
+            return part.slice(i + 1).trim();
+    }
+    return undefined;
+}
+function sha256Url(value) {
+    return createHash('sha256').update(value).digest('base64url');
+}
+function browserBinding(req, base, bind) {
+    if (typeof bind !== 'string' || !BIND_HASH.test(bind))
+        return 'missing';
+    const value = readCookie(req, bindCookieName(base, bind));
+    if (!value)
+        return 'missing';
+    const got = createHash('sha256').update(value).digest();
+    const want = Buffer.from(bind, 'base64url');
+    return got.length === want.length && timingSafeEqual(got, want) ? 'ok' : 'mismatch';
+}
 function pkceS256(verifier) {
     return createHash('sha256').update(verifier).digest('base64url');
 }
@@ -234,11 +266,20 @@ export function buildAuthServer(config, deps = {}) {
         return s.replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c]);
     }
     async function toGoogle(res, sp) {
+        // H4 F1: without this, a Google URL minted here and forwarded to someone
+        // else signs THEM in and hands their subject to the starting client.
+        const headers = {};
+        if (sp.flow === 'owner_gate') {
+            const value = randomBytes(32).toString('base64url');
+            const bind = sha256Url(value);
+            sp = { ...sp, bind };
+            headers['Set-Cookie'] = `${bindCookieName(base, bind)}=${value}; ${bindCookieAttrs(base, STATE_TTL_DEFAULT)}`;
+        }
         const state = await signState(sp, base, secret, nowSec());
         const authUrl = deps.buildGoogleAuthUrl
             ? deps.buildGoogleAuthUrl({ flow: sp.flow, alias: sp.alias, state, bundles: sp.bundles })
             : `https://accounts.google.com/o/oauth2/v2/auth?state=${encodeURIComponent(state)}`;
-        return redirect(res, authUrl);
+        return redirect(res, authUrl, headers);
     }
     // GET /authorize (validate + interstitial for DCR clients); POST /authorize
     // (a DCR consent approval — verify the signed pending token, then proceed).
@@ -355,7 +396,7 @@ export function buildAuthServer(config, deps = {}) {
         // cannot forge, so there is nothing to spoof.
         if (client.dcr) {
             const pendingToken = await signPending(statePayload, base, secret, nowSec());
-            res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store' });
+            res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store', 'Content-Security-Policy': "frame-ancestors 'none'", 'X-Frame-Options': 'DENY' });
             res.end(`<!doctype html><meta charset=utf-8><title>Authorize access</title>` +
                 `<body style="font-family:system-ui,sans-serif;max-width:36em;margin:3em auto;line-height:1.5">` +
                 `<h2>Authorize access?</h2>` +
@@ -382,6 +423,16 @@ export function buildAuthServer(config, deps = {}) {
         if (!replay.consume(st.jti, STATE_TTL_DEFAULT * 1000, now())) {
             return errorPage(res, 400, 'E_STATE_INVALID', 'state has already been used (replay)');
         }
+        // After the spend, so a refused callback URL cannot be replayed from the
+        // browser that holds the cookie; before the exchange and resolveSubject.
+        if (st.flow === 'owner_gate') {
+            const binding = browserBinding(req, base, st.bind);
+            if (binding !== 'ok') {
+                log(`callback refused flow=owner_gate: browser binding ${binding}`);
+                return errorPage(res, 400, 'E_BROWSER_MISMATCH', 'finish the sign-in in the browser that started it; start again from your app');
+            }
+            res.setHeader('Set-Cookie', `${bindCookieName(base, st.bind ?? '')}=; ${bindCookieAttrs(base, 0)}`);
+        }
         if (!code)
             return errorPage(res, 400, 'invalid_request', 'missing code');
         let exchanged;
@@ -389,7 +440,10 @@ export function buildAuthServer(config, deps = {}) {
             exchanged = deps.exchangeCode ? await deps.exchangeCode(code, st.flow) : { tokens: {} };
         }
         catch (e) {
-            return errorPage(res, 400, 'invalid_grant', `Google code exchange failed: ${e.message}`);
+            // The detail can name proxies and hosts; it goes to the log, not the browser.
+            const detail = e instanceof Error ? e.message : typeof e === 'string' ? e : 'non-Error rejection';
+            log(`callback exchange failed flow=${st.flow}: ${detail.replace(/[\r\n]+/g, ' ')}`);
+            return errorPage(res, 400, 'invalid_grant', 'Google could not complete the sign-in; start again from your app');
         }
         if (st.flow === 'alias_add') {
             if (!st.alias || !st.tenantId)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-google-multi",
-  "version": "6.0.0-alpha.62",
+  "version": "6.0.0-alpha.63",
   "mcpName": "io.github.bakissation/mcp-google-multi",
   "description": "Local MCP server for Google Workspace (Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console, +Forms/Chat/Admin) across multiple accounts — OAuth-only, encrypted token storage, deny-by-default writes.",
   "type": "module",