papercliped 2.5.4 → 2.6.0

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "papercliped",
-  "version": "2.5.4",
+  "version": "2.6.0",
   "description": "Run your Paperclip from Claude: control agents, sync with them and get reports, at the access level you choose.",
   "author": {
     "name": "KpnWorld"

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## Unreleased
 
+## v2.6.0 — verified Connect account claims and identity linking
+
+- **Account claims for Connect are verified.** The (still opt-in, off by default) Connect claim route now checks the caller's Supabase sign-in itself instead of trusting a submitted identity, and links each Papercliped account to at most one sign-in identity. Self-hosters using Connect claims: set `CONNECT_SUPABASE_PUBLISHABLE_KEY` and run the database migration. Everyone else: nothing to do.
+- **Security:** a database helper (`rls_auto_enable`) can no longer be called through the public API.
+
+## v2.5.5 — security: update vulnerable dependencies
+
+- **Security:** updated dependencies with known vulnerabilities (the request-body parser, URI handling, IP parsing and query-string libraries). No action needed.
+
 ## v2.5.4 — fix the website build after dependency updates
 
 - **Fixed:** the website build failed after the latest dependency updates (React and its type definitions were left on different major versions). They now match, so the site builds and deploys again. Nothing to do.

package/dist/accounts/connect-claim.js

@@ -0,0 +1,43 @@
+import { createHash, createHmac, randomBytes } from "node:crypto";
+/**
+ * This service-only assertion proves ownership of one EXISTING Papercliped
+ * account for a particular (already verified on Connect) OIDC identity.
+ * Disabled unless CONNECT_CLAIM_SIGNING_KEY is configured explicitly.
+ * It is NOT a login session, MCP grant, or Proxmox permission.
+ */
+export const CLAIM_TTL_SECONDS = 60;
+const ASSERTION_ISSUER = "https://papercliped.co";
+const CLAIM_AUDIENCE = "papercliped-connect";
+const ACCOUNT_ID = /^[A-Za-z0-9_-]{3,128}$/;
+/** Only the trusted Supabase Auth project may be used for Connect account claims.
+ * The OIDC issuer includes /auth/v1 (it is not an origin-only URL).
+ */
+export const CONNECT_LOGIN_ISSUER = "https://ixwbkbkdxvfmfyiyturx.supabase.co/auth/v1";
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+export function validClaimIdentity(issuer, subject) {
+    return issuer === CONNECT_LOGIN_ISSUER && typeof subject === "string" && UUID.test(subject);
+}
+/** Bind an assertion to an exact trusted issuer + subject without including PII. */
+export function claimIdentityBinding(issuer, subject) {
+    if (!validClaimIdentity(issuer, subject))
+        throw new Error("Invalid verified identity");
+    return createHash("sha256").update(JSON.stringify([issuer, subject]), "utf8").digest("base64url");
+}
+export function signConnectClaim({ accountId, issuer, subject, signingKey, nowMs = Date.now(), }) {
+    if (!ACCOUNT_ID.test(accountId) || !validClaimIdentity(issuer, subject))
+        throw new Error("Invalid claim subject");
+    if (typeof signingKey !== "string" || Buffer.byteLength(signingKey, "utf8") < 32)
+        throw new Error("Signing key not configured");
+    if (!Number.isSafeInteger(nowMs) || nowMs < 0)
+        throw new Error("Invalid time");
+    const iat = Math.floor(nowMs / 1000);
+    const header = Buffer.from(JSON.stringify({ alg: "HS256", typ: "PCD-ACCOUNT-ASSERTION", v: 1 })).toString("base64url");
+    const payload = Buffer.from(JSON.stringify({
+        iss: ASSERTION_ISSUER, aud: CLAIM_AUDIENCE, sub: accountId,
+        jti: randomBytes(24).toString("base64url"), iat, exp: iat + CLAIM_TTL_SECONDS,
+        binding: claimIdentityBinding(issuer, subject),
+    })).toString("base64url");
+    const signed = header + "." + payload;
+    const mac = createHmac("sha256", signingKey).update(signed).digest("base64url");
+    return { assertion: signed + "." + mac, expiresIn: CLAIM_TTL_SECONDS };
+}

package/dist/accounts/supabase-session.js

@@ -0,0 +1,29 @@
+import { CONNECT_LOGIN_ISSUER } from "./connect-claim.js";
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+ * Ask the trusted Supabase Auth project who this access token belongs to. Server-side, so a forged or revoked
+ * token fails, and issuer/subject come from Supabase, never from the caller. Null on any doubt (fail closed).
+ */
+export function supabaseIdentityVerifier(publishableKey, fetchImpl = fetch) {
+    return async (accessToken) => {
+        if (!accessToken || accessToken.length > 4096 || /\s/.test(accessToken))
+            return null;
+        try {
+            const r = await fetchImpl(`${CONNECT_LOGIN_ISSUER}/user`, {
+                headers: { apikey: publishableKey, authorization: `Bearer ${accessToken}` },
+                signal: AbortSignal.timeout(5000),
+            });
+            if (!r.ok)
+                return null;
+            const u = (await r.json());
+            if (typeof u.id !== "string" || !UUID.test(u.id) || !u.email_confirmed_at || u.is_anonymous === true)
+                return null;
+            if (typeof u.banned_until === "string" && Date.parse(u.banned_until) > Date.now())
+                return null;
+            return { issuer: CONNECT_LOGIN_ISSUER, subject: u.id.toLowerCase() };
+        }
+        catch {
+            return null;
+        }
+    };
+}

package/dist/http.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { supabaseIdentityVerifier } from "./accounts/supabase-session.js";
 import { readConfig, readHttpConfig } from "./config.js";
 import { migrate } from "./migrate.js";
 import { OAuthProvider } from "./oauth/provider.js";
@@ -75,7 +76,7 @@ async function main() {
     const web = webDir ? new WebAppRoutes({ dir: webDir, hosts, forumUrl: process.env.FORUM_URL?.trim() || null }) : undefined;
     if (web)
         console.error(`website: ${webDir}${process.env.PUBLIC_HOSTS ? ` (hosts: ${process.env.PUBLIC_HOSTS})` : ""}`);
-    const manage = provider && http.oauth?.mode === "multi" ? new ManageRoutes(provider) : undefined;
+    const manage = provider && http.oauth?.mode === "multi" ? new ManageRoutes(provider, { connectClaimSigningKey: process.env.CONNECT_CLAIM_SIGNING_KEY?.trim() || null, verifyIdentity: process.env.CONNECT_SUPABASE_PUBLISHABLE_KEY?.trim() ? supabaseIdentityVerifier(process.env.CONNECT_SUPABASE_PUBLISHABLE_KEY.trim()) : null }) : undefined;
     const server = createHttpServer(config, http, { oauth: provider, recorder, site, manage, publicApi, web });
     server.listen(http.port, http.host, () => {
         const o = http.oauth;

package/dist/manage/routes.js

@@ -1,4 +1,5 @@
 import { PolicyInputError } from "../access/policy.js";
+import { signConnectClaim, validClaimIdentity } from "../accounts/connect-claim.js";
 import { displayName } from "../accounts/alias.js";
 const HEADERS = { "Cache-Control": "no-store", "X-Content-Type-Options": "nosniff", "Referrer-Policy": "no-referrer" };
 /** A DNS name or IPv4 literal, optionally with a port; undefined when it is anything else. */
@@ -29,8 +30,10 @@ const cleanUid = (v) => (v == null ? null : typeof v === "string" && v.length <=
  */
 export class ManageRoutes {
     p;
-    constructor(p, _o = {}) {
+    options;
+    constructor(p, options = {}) {
         this.p = p;
+        this.options = options;
     }
     json(res, status, body, extra = {}) {
         res.writeHead(status, { "Content-Type": "application/json", ...HEADERS, ...extra });
@@ -66,6 +69,43 @@ export class ManageRoutes {
         if (!path.startsWith("/api/manage"))
             return false;
         const route = path.slice("/api/manage".length) || "/";
+        // Opt-in service claim issuance for Connect. No cookies, CORS, or general
+        // login session. Existing secret-key verification supplies normal rate limits.
+        // The returned 60-second token is bound to the browser identity separately
+        // verified by Connect, and can be consumed only once there.
+        if (route === "/connect-claim") {
+            const key = this.options.connectClaimSigningKey;
+            const verify = this.options.verifyIdentity;
+            if (!key || key.length < 32 || !verify)
+                return this.json(res, 404, { error: "Not found" });
+            if (m !== "POST")
+                return this.json(res, 405, { error: "Method not allowed" }, { Allow: "POST" });
+            const b = await this.body(req);
+            if (!b || typeof b.accessToken !== "string" || typeof b.username !== "string" || b.username.length > 64 ||
+                typeof b.secret !== "string" || b.secret.length > 100) {
+                return this.json(res, 400, { error: "Invalid account claim request" });
+            }
+            // Who is signing in comes from Supabase (checked here), never from the request body.
+            const who = await verify(b.accessToken);
+            if (!who || !validClaimIdentity(who.issuer, who.subject))
+                return this.json(res, 401, { error: "Sign in again" });
+            const login = await this.p.manageLogin(req, b.username, b.secret);
+            if (!login.ok) {
+                return login.reason === "throttled"
+                    ? this.json(res, 429, { error: "Too many attempts" })
+                    : this.json(res, 401, { error: "Invalid credentials" });
+            }
+            const now = this.options.now?.() ?? Date.now();
+            // One account <-> one central identity: a second sign-in cannot take over an already-linked account.
+            const linked = await this.p.store.linkIdentity(login.account.id, who.issuer, who.subject, now);
+            if (linked === "conflict")
+                return this.json(res, 409, { error: "This account or sign-in is already linked to another" });
+            const claim = signConnectClaim({
+                accountId: login.account.id, issuer: who.issuer, subject: who.subject,
+                signingKey: key, nowMs: now,
+            });
+            return this.json(res, 200, claim);
+        }
         // The plugin proves the secret key once and gets its token. Throttled exactly like the sign-in page.
         if (m === "POST" && route === "/plugin-link/sign-in") {
             const b = await this.body(req);

package/dist/oauth/pg-store.js

@@ -181,6 +181,19 @@ export class PgStore {
     static toLink(x) {
         return { accountId: x.account_id, instanceUrl: x.instance_url, paperclipUserId: x.paperclip_user_id, sealedCredential: x.sealed_credential, credentialExpiresAt: x.credential_expires_at == null ? null : num(x.credential_expires_at), createdAt: num(x.created_at), connectedAt: num(x.connected_at), lastUsedAt: num(x.last_used_at), instanceLabel: x.instance_label ?? null };
     }
+    async linkIdentity(accountId, issuer, subject, at) {
+        try {
+            const r = await this.q("insert into bridge.account_identities (account_id, issuer, subject, linked_at) values ($1,$2,$3,$4) on conflict do nothing returning account_id", [accountId, issuer, subject, at]);
+            if (r.rowCount === 1)
+                return "linked";
+        }
+        catch (e) {
+            if (e.code !== "23505")
+                throw e;
+        }
+        const x = await this.q("select 1 from bridge.account_identities where account_id = $1 and issuer = $2 and subject = $3", [accountId, issuer, subject]);
+        return x.rowCount === 1 ? "exists" : "conflict";
+    }
     async createAccount(a) {
         try {
             const r = await this.q("insert into bridge.accounts (id, username, username_key, secret_hash, created_at, last_login_at, disabled, anonymous, alias) values ($1,$2,$3,$4,$5,$6,$7,$8,$9) on conflict (username_key) do nothing returning id", [a.id, a.username, a.usernameKey, a.secretHash, a.createdAt, a.lastLoginAt, a.disabled, !!a.anonymous, a.alias ?? null]);

package/dist/oauth/store.js

@@ -241,6 +241,17 @@ export class MemoryStore {
         this.save();
         return true;
     }
+    async linkIdentity(accountId, issuer, subject, _at) {
+        const ids = (this.d.identities ??= {});
+        const key = `${issuer}|${subject}`;
+        if (ids[key] === accountId)
+            return "exists";
+        if (ids[key] || Object.values(ids).includes(accountId))
+            return "conflict";
+        ids[key] = accountId;
+        this.save();
+        return "linked";
+    }
     async setAccountBeta(id, beta) {
         const a = this.accts[id];
         if (a) {

package/docs/connect-account-claim.md

@@ -0,0 +1,20 @@
+# Connect account claim issuer (disabled by default)
+
+This bridge provides the EXISTING Papercliped account identity; Connect adds a profile in the same Supabase database.
+
+The new `POST /api/manage/connect-claim` route is **disabled unless** the server has `CONNECT_CLAIM_SIGNING_KEY` (at least 32 bytes). Use a freshly generated signing key specifically for Connect; **never reuse** `BRIDGE_SECRET`, OAuth secrets, or Paperclip credentials.
+
+The route also needs `CONNECT_SUPABASE_PUBLISHABLE_KEY` (the Paperclipped project's public key; without it the route stays 404). The caller sends `{username, secret, accessToken}`: the bridge asks Supabase Auth who the `accessToken` belongs to (confirmed email, not anonymous, not banned), so issuer and subject are never taken from the request. It then verifies the owner's existing username + secret key via the throttled `manageLogin` function, binds the identity to the account in `bridge.account_identities` (409 if the account or the identity is already bound to another), and returns a 60-second HMAC-SHA256 assertion with `iss=https://papercliped.co`, `aud=papercliped-connect`, canonical account `sub`, unique `jti`, and an SHA256 binding to the claimed OIDC issuer + subject. Connect must independently verify the authenticated OIDC principal, check exact binding and atomically consume the `jti` in `connect.account_assertion_replays`.
+
+**Security boundaries:** This is **not** an OIDC provider, browser session, Connect entitlement, MCP grant, or Proxmox access. The issuer does not itself verify third-party OIDC identities. The bridge now verifies the Supabase session itself; Connect must still verify binding and consume the `jti`. Do not enable this route until a proper account-claiming UX, CSRF defenses, secret rotation and privacy handling are reviewed. No code is deployed from this branch.
+
+This route does not modify stored accounts or grants. It never stores or returns the user's secret key. Existing plugin sign-in and MCP OAuth behavior are unchanged.
+
+The bridge and Connect service must share the dedicated secret over their trusted server environments only. The client browser must never receive it.
+
+
+## Central Auth decision (November 5, 2026)
+
+The sole trusted login identity issuer is Supabase Auth in the **existing shared Paperclipped project**: `https://ixwbkbkdxvfmfyiyturx.supabase.co/auth/v1`. The subject is its verified `auth.users.id` UUID. Email OTP and passkeys authenticate to the *same Supabase identity*, which is mapped only after an explicit one-time claim to the existing `bridge.accounts.id`.
+
+The bridge claim contract rejects arbitrary third-party issuers and non-UUID subjects. Note that `issuer` is the entire OIDC issuer URL, including `/auth/v1`. Central `auth.papercliped.co` is the proposed sign-in UI, not the JWT issuer. The current flag stays OFF; no hosted configuration has been changed.

package/docs/supabase-schema.sql

@@ -302,6 +302,27 @@ update bridge.grants set credential_expires_at = created_at + 2592000000
 create index if not exists account_links_expiry_idx on bridge.account_links (credential_expires_at) where sealed_credential is not null;
 create index if not exists grants_expiry_idx on bridge.grants (credential_expires_at) where sealed_credential is not null and not revoked;
 
+-- ───── 009_account_identities.sql ─────
+-- Links one Papercliped account to one verified central-login identity (Supabase Auth issuer + subject).
+-- Written by the Connect claim route only after the bridge itself verified the Supabase session; a second
+-- subject can never be bound to an already-linked account, and a subject can never own two accounts.
+create table if not exists bridge.account_identities (
+  account_id text   primary key references bridge.accounts (id) on delete cascade,
+  issuer     text   not null,
+  subject    text   not null,
+  linked_at  bigint not null
+);
+create unique index if not exists account_identities_identity_idx on bridge.account_identities (issuer, subject);
+alter table bridge.account_identities enable row level security;
+revoke all on bridge.account_identities from public;
+
+-- Supabase advisor: this SECURITY DEFINER event-trigger helper must not be callable through the API.
+do $$ begin
+  if to_regprocedure('public.rls_auto_enable()') is not null then
+    revoke execute on function public.rls_auto_enable() from public, anon, authenticated;
+  end if;
+end $$;
+
 -- ───── migration bookkeeping ─────
 create table if not exists bridge.schema_migrations (version text primary key, applied_at timestamptz not null default now());
 alter table bridge.schema_migrations enable row level security;
@@ -311,6 +332,6 @@ do $$ declare r text; begin
     if exists (select 1 from pg_roles where rolname = r) then execute format('revoke all on bridge.schema_migrations from %I', r); end if;
   end loop;
 end $$;
-insert into bridge.schema_migrations (version) values ('001_init.sql'), ('002_audit.sql'), ('003_accounts.sql'), ('004_privacy_panel.sql'), ('005_beta.sql'), ('006_two_levels.sql'), ('007_control_room.sql'), ('008_key_rotation.sql') on conflict (version) do nothing;
+insert into bridge.schema_migrations (version) values ('001_init.sql'), ('002_audit.sql'), ('003_accounts.sql'), ('004_privacy_panel.sql'), ('005_beta.sql'), ('006_two_levels.sql'), ('007_control_room.sql'), ('008_key_rotation.sql'), ('009_account_identities.sql') on conflict (version) do nothing;
 
 commit;

package/migrations/009_account_identities.sql

@@ -0,0 +1,19 @@
+-- Links one Papercliped account to one verified central-login identity (Supabase Auth issuer + subject).
+-- Written by the Connect claim route only after the bridge itself verified the Supabase session; a second
+-- subject can never be bound to an already-linked account, and a subject can never own two accounts.
+create table if not exists bridge.account_identities (
+  account_id text   primary key references bridge.accounts (id) on delete cascade,
+  issuer     text   not null,
+  subject    text   not null,
+  linked_at  bigint not null
+);
+create unique index if not exists account_identities_identity_idx on bridge.account_identities (issuer, subject);
+alter table bridge.account_identities enable row level security;
+revoke all on bridge.account_identities from public;
+
+-- Supabase advisor: this SECURITY DEFINER event-trigger helper must not be callable through the API.
+do $$ begin
+  if to_regprocedure('public.rls_auto_enable()') is not null then
+    revoke execute on function public.rls_auto_enable() from public, anon, authenticated;
+  end if;
+end $$;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "papercliped",
-  "version": "2.5.4",
+  "version": "2.6.0",
   "description": "Papercliped — connect Claude, ChatGPT and any MCP app to your Paperclip: control agents, sync, report. MCP server + hosted multi-tenant OAuth bridge + public stats API.",
   "license": "MIT",
   "type": "module",