papercliped 2.5.5 → 2.6.1

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "papercliped",
-  "version": "2.5.5",
+  "version": "2.6.1",
   "description": "Run your Paperclip from Claude: control agents, sync with them and get reports, at the access level you choose.",
   "author": {
     "name": "KpnWorld"

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## Unreleased
 
+## v2.6.1 — docs: mention the upcoming managed address
+
+- **Docs:** the "At home, with a tunnel" guide now mentions that a managed address from Papercliped Connect (for ePaperclip on Proxmox) is being built and is not available yet. Nothing to do.
+
+## v2.6.0 — verified Connect account claims and identity linking
+
+- **Account claims for Connect are verified.** The (still opt-in, off by default) Connect claim route now checks the caller's Supabase sign-in itself instead of trusting a submitted identity, and links each Papercliped account to at most one sign-in identity. Self-hosters using Connect claims: set `CONNECT_SUPABASE_PUBLISHABLE_KEY` and run the database migration. Everyone else: nothing to do.
+- **Security:** a database helper (`rls_auto_enable`) can no longer be called through the public API.
+
 ## v2.5.5 — security: update vulnerable dependencies
 
 - **Security:** updated dependencies with known vulnerabilities (the request-body parser, URI handling, IP parsing and query-string libraries). No action needed.

package/dist/accounts/supabase-session.js

@@ -0,0 +1,29 @@
+import { CONNECT_LOGIN_ISSUER } from "./connect-claim.js";
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+ * Ask the trusted Supabase Auth project who this access token belongs to. Server-side, so a forged or revoked
+ * token fails, and issuer/subject come from Supabase, never from the caller. Null on any doubt (fail closed).
+ */
+export function supabaseIdentityVerifier(publishableKey, fetchImpl = fetch) {
+    return async (accessToken) => {
+        if (!accessToken || accessToken.length > 4096 || /\s/.test(accessToken))
+            return null;
+        try {
+            const r = await fetchImpl(`${CONNECT_LOGIN_ISSUER}/user`, {
+                headers: { apikey: publishableKey, authorization: `Bearer ${accessToken}` },
+                signal: AbortSignal.timeout(5000),
+            });
+            if (!r.ok)
+                return null;
+            const u = (await r.json());
+            if (typeof u.id !== "string" || !UUID.test(u.id) || !u.email_confirmed_at || u.is_anonymous === true)
+                return null;
+            if (typeof u.banned_until === "string" && Date.parse(u.banned_until) > Date.now())
+                return null;
+            return { issuer: CONNECT_LOGIN_ISSUER, subject: u.id.toLowerCase() };
+        }
+        catch {
+            return null;
+        }
+    };
+}

package/dist/http.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { supabaseIdentityVerifier } from "./accounts/supabase-session.js";
 import { readConfig, readHttpConfig } from "./config.js";
 import { migrate } from "./migrate.js";
 import { OAuthProvider } from "./oauth/provider.js";
@@ -75,7 +76,7 @@ async function main() {
     const web = webDir ? new WebAppRoutes({ dir: webDir, hosts, forumUrl: process.env.FORUM_URL?.trim() || null }) : undefined;
     if (web)
         console.error(`website: ${webDir}${process.env.PUBLIC_HOSTS ? ` (hosts: ${process.env.PUBLIC_HOSTS})` : ""}`);
-    const manage = provider && http.oauth?.mode === "multi" ? new ManageRoutes(provider, { connectClaimSigningKey: process.env.CONNECT_CLAIM_SIGNING_KEY?.trim() || null }) : undefined;
+    const manage = provider && http.oauth?.mode === "multi" ? new ManageRoutes(provider, { connectClaimSigningKey: process.env.CONNECT_CLAIM_SIGNING_KEY?.trim() || null, verifyIdentity: process.env.CONNECT_SUPABASE_PUBLISHABLE_KEY?.trim() ? supabaseIdentityVerifier(process.env.CONNECT_SUPABASE_PUBLISHABLE_KEY.trim()) : null }) : undefined;
     const server = createHttpServer(config, http, { oauth: provider, recorder, site, manage, publicApi, web });
     server.listen(http.port, http.host, () => {
         const o = http.oauth;

package/dist/manage/routes.js

@@ -75,25 +75,34 @@ export class ManageRoutes {
         // verified by Connect, and can be consumed only once there.
         if (route === "/connect-claim") {
             const key = this.options.connectClaimSigningKey;
-            if (!key || key.length < 32)
+            const verify = this.options.verifyIdentity;
+            if (!key || key.length < 32 || !verify)
                 return this.json(res, 404, { error: "Not found" });
             if (m !== "POST")
                 return this.json(res, 405, { error: "Method not allowed" }, { Allow: "POST" });
             const b = await this.body(req);
-            if (!b || typeof b.subject !== "string" || !validClaimIdentity(b.issuer, b.subject) ||
-                typeof b.username !== "string" || b.username.length > 64 ||
+            if (!b || typeof b.accessToken !== "string" || typeof b.username !== "string" || b.username.length > 64 ||
                 typeof b.secret !== "string" || b.secret.length > 100) {
                 return this.json(res, 400, { error: "Invalid account claim request" });
             }
+            // Who is signing in comes from Supabase (checked here), never from the request body.
+            const who = await verify(b.accessToken);
+            if (!who || !validClaimIdentity(who.issuer, who.subject))
+                return this.json(res, 401, { error: "Sign in again" });
             const login = await this.p.manageLogin(req, b.username, b.secret);
             if (!login.ok) {
                 return login.reason === "throttled"
                     ? this.json(res, 429, { error: "Too many attempts" })
                     : this.json(res, 401, { error: "Invalid credentials" });
             }
+            const now = this.options.now?.() ?? Date.now();
+            // One account <-> one central identity: a second sign-in cannot take over an already-linked account.
+            const linked = await this.p.store.linkIdentity(login.account.id, who.issuer, who.subject, now);
+            if (linked === "conflict")
+                return this.json(res, 409, { error: "This account or sign-in is already linked to another" });
             const claim = signConnectClaim({
-                accountId: login.account.id, issuer: b.issuer, subject: b.subject,
-                signingKey: key, nowMs: this.options.now?.() ?? Date.now(),
+                accountId: login.account.id, issuer: who.issuer, subject: who.subject,
+                signingKey: key, nowMs: now,
             });
             return this.json(res, 200, claim);
         }

package/dist/oauth/pg-store.js

@@ -181,6 +181,19 @@ export class PgStore {
     static toLink(x) {
         return { accountId: x.account_id, instanceUrl: x.instance_url, paperclipUserId: x.paperclip_user_id, sealedCredential: x.sealed_credential, credentialExpiresAt: x.credential_expires_at == null ? null : num(x.credential_expires_at), createdAt: num(x.created_at), connectedAt: num(x.connected_at), lastUsedAt: num(x.last_used_at), instanceLabel: x.instance_label ?? null };
     }
+    async linkIdentity(accountId, issuer, subject, at) {
+        try {
+            const r = await this.q("insert into bridge.account_identities (account_id, issuer, subject, linked_at) values ($1,$2,$3,$4) on conflict do nothing returning account_id", [accountId, issuer, subject, at]);
+            if (r.rowCount === 1)
+                return "linked";
+        }
+        catch (e) {
+            if (e.code !== "23505")
+                throw e;
+        }
+        const x = await this.q("select 1 from bridge.account_identities where account_id = $1 and issuer = $2 and subject = $3", [accountId, issuer, subject]);
+        return x.rowCount === 1 ? "exists" : "conflict";
+    }
     async createAccount(a) {
         try {
             const r = await this.q("insert into bridge.accounts (id, username, username_key, secret_hash, created_at, last_login_at, disabled, anonymous, alias) values ($1,$2,$3,$4,$5,$6,$7,$8,$9) on conflict (username_key) do nothing returning id", [a.id, a.username, a.usernameKey, a.secretHash, a.createdAt, a.lastLoginAt, a.disabled, !!a.anonymous, a.alias ?? null]);

package/dist/oauth/store.js

@@ -241,6 +241,17 @@ export class MemoryStore {
         this.save();
         return true;
     }
+    async linkIdentity(accountId, issuer, subject, _at) {
+        const ids = (this.d.identities ??= {});
+        const key = `${issuer}|${subject}`;
+        if (ids[key] === accountId)
+            return "exists";
+        if (ids[key] || Object.values(ids).includes(accountId))
+            return "conflict";
+        ids[key] = accountId;
+        this.save();
+        return "linked";
+    }
     async setAccountBeta(id, beta) {
         const a = this.accts[id];
         if (a) {

package/docs/connect-account-claim.md

@@ -4,9 +4,9 @@ This bridge provides the EXISTING Papercliped account identity; Connect adds a p
 
 The new `POST /api/manage/connect-claim` route is **disabled unless** the server has `CONNECT_CLAIM_SIGNING_KEY` (at least 32 bytes). Use a freshly generated signing key specifically for Connect; **never reuse** `BRIDGE_SECRET`, OAuth secrets, or Paperclip credentials.
 
-The route verifies the owner's existing username + secret key via the current throttled `manageLogin` function, then returns a 60-second HMAC-SHA256 assertion with `iss=https://papercliped.co`, `aud=papercliped-connect`, canonical account `sub`, unique `jti`, and an SHA256 binding to the claimed OIDC issuer + subject. Connect must independently verify the authenticated OIDC principal, check exact binding and atomically consume the `jti` in `connect.account_assertion_replays`.
+The route also needs `CONNECT_SUPABASE_PUBLISHABLE_KEY` (the Paperclipped project's public key; without it the route stays 404). The caller sends `{username, secret, accessToken}`: the bridge asks Supabase Auth who the `accessToken` belongs to (confirmed email, not anonymous, not banned), so issuer and subject are never taken from the request. It then verifies the owner's existing username + secret key via the throttled `manageLogin` function, binds the identity to the account in `bridge.account_identities` (409 if the account or the identity is already bound to another), and returns a 60-second HMAC-SHA256 assertion with `iss=https://papercliped.co`, `aud=papercliped-connect`, canonical account `sub`, unique `jti`, and an SHA256 binding to the claimed OIDC issuer + subject. Connect must independently verify the authenticated OIDC principal, check exact binding and atomically consume the `jti` in `connect.account_assertion_replays`.
 
-**Security boundaries:** This is **not** an OIDC provider, browser session, Connect entitlement, MCP grant, or Proxmox access. The issuer does not itself verify third-party OIDC identities. Never accept the issuer/subject from an unverified browser session on the Connect side. Do not enable this route until a proper account-claiming UX, CSRF defenses, secret rotation and privacy handling are reviewed. No code is deployed from this branch.
+**Security boundaries:** This is **not** an OIDC provider, browser session, Connect entitlement, MCP grant, or Proxmox access. The issuer does not itself verify third-party OIDC identities. The bridge now verifies the Supabase session itself; Connect must still verify binding and consume the `jti`. Do not enable this route until a proper account-claiming UX, CSRF defenses, secret rotation and privacy handling are reviewed. No code is deployed from this branch.
 
 This route does not modify stored accounts or grants. It never stores or returns the user's secret key. Existing plugin sign-in and MCP OAuth behavior are unchanged.
 

package/docs/supabase-schema.sql

@@ -302,6 +302,27 @@ update bridge.grants set credential_expires_at = created_at + 2592000000
 create index if not exists account_links_expiry_idx on bridge.account_links (credential_expires_at) where sealed_credential is not null;
 create index if not exists grants_expiry_idx on bridge.grants (credential_expires_at) where sealed_credential is not null and not revoked;
 
+-- ───── 009_account_identities.sql ─────
+-- Links one Papercliped account to one verified central-login identity (Supabase Auth issuer + subject).
+-- Written by the Connect claim route only after the bridge itself verified the Supabase session; a second
+-- subject can never be bound to an already-linked account, and a subject can never own two accounts.
+create table if not exists bridge.account_identities (
+  account_id text   primary key references bridge.accounts (id) on delete cascade,
+  issuer     text   not null,
+  subject    text   not null,
+  linked_at  bigint not null
+);
+create unique index if not exists account_identities_identity_idx on bridge.account_identities (issuer, subject);
+alter table bridge.account_identities enable row level security;
+revoke all on bridge.account_identities from public;
+
+-- Supabase advisor: this SECURITY DEFINER event-trigger helper must not be callable through the API.
+do $$ begin
+  if to_regprocedure('public.rls_auto_enable()') is not null then
+    revoke execute on function public.rls_auto_enable() from public, anon, authenticated;
+  end if;
+end $$;
+
 -- ───── migration bookkeeping ─────
 create table if not exists bridge.schema_migrations (version text primary key, applied_at timestamptz not null default now());
 alter table bridge.schema_migrations enable row level security;
@@ -311,6 +332,6 @@ do $$ declare r text; begin
     if exists (select 1 from pg_roles where rolname = r) then execute format('revoke all on bridge.schema_migrations from %I', r); end if;
   end loop;
 end $$;
-insert into bridge.schema_migrations (version) values ('001_init.sql'), ('002_audit.sql'), ('003_accounts.sql'), ('004_privacy_panel.sql'), ('005_beta.sql'), ('006_two_levels.sql'), ('007_control_room.sql'), ('008_key_rotation.sql') on conflict (version) do nothing;
+insert into bridge.schema_migrations (version) values ('001_init.sql'), ('002_audit.sql'), ('003_accounts.sql'), ('004_privacy_panel.sql'), ('005_beta.sql'), ('006_two_levels.sql'), ('007_control_room.sql'), ('008_key_rotation.sql'), ('009_account_identities.sql') on conflict (version) do nothing;
 
 commit;

package/migrations/009_account_identities.sql

@@ -0,0 +1,19 @@
+-- Links one Papercliped account to one verified central-login identity (Supabase Auth issuer + subject).
+-- Written by the Connect claim route only after the bridge itself verified the Supabase session; a second
+-- subject can never be bound to an already-linked account, and a subject can never own two accounts.
+create table if not exists bridge.account_identities (
+  account_id text   primary key references bridge.accounts (id) on delete cascade,
+  issuer     text   not null,
+  subject    text   not null,
+  linked_at  bigint not null
+);
+create unique index if not exists account_identities_identity_idx on bridge.account_identities (issuer, subject);
+alter table bridge.account_identities enable row level security;
+revoke all on bridge.account_identities from public;
+
+-- Supabase advisor: this SECURITY DEFINER event-trigger helper must not be callable through the API.
+do $$ begin
+  if to_regprocedure('public.rls_auto_enable()') is not null then
+    revoke execute on function public.rls_auto_enable() from public, anon, authenticated;
+  end if;
+end $$;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "papercliped",
-  "version": "2.5.5",
+  "version": "2.6.1",
   "description": "Papercliped — connect Claude, ChatGPT and any MCP app to your Paperclip: control agents, sync, report. MCP server + hosted multi-tenant OAuth bridge + public stats API.",
   "license": "MIT",
   "type": "module",

package/site/docs/connect-your-paperclip.md

@@ -15,6 +15,8 @@ Run Paperclip on your own computer and give it a public `https://` address with
 | **ngrok** | one free `*.ngrok-free.app` address | Yes | A free ngrok account | Daily use without a domain |
 | **Cloudflare quick tunnel** | random `*.trycloudflare.com` | **No, changes every restart** | Nothing | Trying it for an afternoon |
 
+**Running ePaperclip on Proxmox?** A managed address from Papercliped Connect (a per-device tunnel and a `*.connect.papercliped.co` address, no domain or Cloudflare account needed) is being built as a paid option. It is **not available yet**: billing is not enabled and nothing here depends on it. The tunnels above remain the way to get a public address today.
+
 Pick one and **work out your address first**: Paperclip needs to know it during setup (step 2). The tunnel sections below show how to get it.
 
 ## 2. Install Paperclip in public mode