renor-engine 0.0.0-stage → 1.0.0

package/dist/mvp/auth.js

@@ -0,0 +1,531 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OwnerOAuthProvider = void 0;
+exports.ownerLoginRouter = ownerLoginRouter;
+const crypto_1 = __importDefault(require("crypto"));
+const express_1 = __importDefault(require("express"));
+const errors_js_1 = require("@modelcontextprotocol/sdk/server/auth/errors.js");
+const client_store_js_1 = require("./client-store.js");
+const telemetry_1 = require("./telemetry");
+const sourceName_1 = require("../memory/sourceName");
+const AUTH_CODE_TTL_MS = 10 * 60 * 1000;
+const AUTH_TICKET_TTL_MS = 10 * 60 * 1000;
+const MAX_AUTH_TICKETS = 1000; // bounded ticket store (pruned)
+const MAX_REGISTERED_CLIENTS = 100; // bounded DCR store (AUTH-H2)
+const MAX_REDIRECT_URIS_PER_CLIENT = 8;
+const REFRESH_TOKEN_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+const LOCKOUT_MAX_MS = 15 * 60 * 1000;
+const FAILURE_MEMORY_MS = 60 * 60 * 1000; // a failed login is forgotten after an hour without another
+const TOKEN_SWEEP_EVERY = 512; // sweep expired tokens every N issues
+const MAX_USED_CODES = 1000; // redeemed authorization codes remembered, to recognise a replay
+function randomToken() {
+    return crypto_1.default.randomBytes(32).toString('base64url');
+}
+function htmlEscape(s) {
+    return s.replace(/[&<>"']/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+}
+function constantTimeEqual(a, b) {
+    const ba = Buffer.from(a, 'utf8');
+    const bb = Buffer.from(b, 'utf8');
+    if (ba.length !== bb.length)
+        return false;
+    return crypto_1.default.timingSafeEqual(ba, bb);
+}
+/** Metadata-only audit line: timestamp + event + opaque identifiers/counts.
+ * NEVER credentials, tokens, headers, query strings, or private content. */
+function audit(event, fields = {}) {
+    console.log(JSON.stringify({ ts: new Date().toISOString(), event, ...fields }));
+}
+const SECURITY_HEADERS = {
+    'Content-Security-Policy': "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; frame-ancestors 'none'",
+    'X-Content-Type-Options': 'nosniff',
+    // BROWSER-LOGIN FIX: a real Chromium submitting the consent form (a
+    // same-origin POST navigation) serializes the Origin header as the literal
+    // "null" when the page's Referrer-Policy strips the referrer (verified
+    // empirically with headless Chromium: Origin: null + no Referer under
+    // no-referrer, which the cross-origin guard must keep rejecting as an
+    // opaque origin). `same-origin` keeps the guard's strict-origin check
+    // working for real browsers: same-origin requests carry a real Origin /
+    // full Referer, while cross-origin requests (including the final 302 to
+    // the client's callback) send NO referrer — nothing about this service,
+    // its paths, or the authorization code leaks to the client's origin.
+    'Referrer-Policy': 'same-origin',
+    'Cache-Control': 'no-store',
+    // frame-ancestors in the CSP is the modern control; this is the same refusal for browsers that ignore it.
+    'X-Frame-Options': 'DENY',
+};
+/** Consent-page CSP: the login form may POST only to this origin, and the
+ * post-submit redirect may land only on the exact allowlisted callback URIs.
+ * BROWSER-LOGIN FIX #2: Chromium enforces `form-action` across the redirect
+ * chain of a form submission (w3c/webappsec-csp#8; Nextcloud #29317,
+ * dotnet/aspnetcore #55491 hit the same OAuth wall). A static
+ * `form-action 'self'` therefore blocks the OAuth 302 from /mvp-login to the
+ * client's callback, breaking every legitimate browser login. Allowing the
+ * same exact URIs the DCR allowlist already governs keeps this strict: the
+ * form still cannot POST anywhere but this service, and redirects still
+ * cannot land anywhere but an owner-approved callback. */
+function consentPageCsp(allowedCallbackUris) {
+    const sources = ["'self'"];
+    for (const uri of allowedCallbackUris) {
+        try {
+            const u = new URL(uri);
+            sources.push(u.origin + (u.pathname === '/' ? '' : u.pathname));
+        }
+        catch {
+            // config validation already rejects invalid allowlist entries
+        }
+    }
+    return `default-src 'none'; style-src 'unsafe-inline'; form-action ${sources.join(' ')}; frame-ancestors 'none'`;
+}
+class OwnerOAuthProvider {
+    // CLIENT-PERSISTENCE: registered OAuth client metadata survives service
+    // restarts in the private owner-only store; anything else about the store
+    // being unreadable/corrupt FAILS CLOSED here (startup error), never a
+    // silent reset to empty. Authorization tickets, codes, and tokens are
+    // deliberately NOT persisted: they stay short-lived and single-use.
+    clients;
+    authorizationCodes = new Map();
+    accessTokens = new Map();
+    refreshTokens = new Map();
+    authTickets = new Map();
+    usedCodes = new Map();
+    config;
+    // Global single-owner login limiter (AUTH-B3): one owner secret => one
+    // global failure counter; peer/client identifiers are not rate-limit keys
+    // (they are unauthenticated input and spoofable).
+    loginFailures = 0;
+    loginLockedUntil = 0;
+    lastFailureAt = 0;
+    issuedSinceSweep = 0;
+    constructor(config) {
+        this.config = config;
+        this.clients = new client_store_js_1.ClientRegistry(config.authStatePath);
+    }
+    /** Header-form hive name for this OAuth client. A legacy duplicate spelling resolves to no name. */
+    hiveConnectionName(clientId) {
+        return this.clients.hiveConnectionName(clientId);
+    }
+    get clientsStore() {
+        return {
+            getClient: (clientId) => this.clients.get(clientId),
+            // DCR policy (AUTH-B1): DENY BY DEFAULT. A registration is accepted
+            // only when the owner configured an exact-callback-URI allowlist
+            // (MVP_ALLOWED_CALLBACK_URIS) and EVERY proposed redirect_uri matches
+            // one allowlisted entry exactly. No wildcards, no guessed domains,
+            // no http(s) heuristic substitution — the owner names the callbacks.
+            registerClient: (client) => {
+                const allow = this.config.allowedCallbackUris;
+                const uris = client.redirect_uris ?? [];
+                if (!Array.isArray(uris) || uris.length === 0) {
+                    audit('dcr_denied', { reason: 'no-redirect-uris' });
+                    throw new errors_js_1.InvalidClientMetadataError('DCR denied: registration must propose at least one redirect_uri');
+                }
+                if (uris.length > MAX_REDIRECT_URIS_PER_CLIENT) {
+                    audit('dcr_denied', { reason: 'too-many-redirect-uris' });
+                    throw new errors_js_1.InvalidClientMetadataError(`DCR denied: at most ${MAX_REDIRECT_URIS_PER_CLIENT} redirect_uris per client`);
+                }
+                if (allow.length === 0) {
+                    audit('dcr_denied', { reason: 'deny-by-default-no-allowlist' });
+                    throw new errors_js_1.InvalidClientMetadataError('DCR denied by default: the owner has not configured an exact callback-URI allowlist '
+                        + '(MVP_ALLOWED_CALLBACK_URIS). No client may register until the owner explicitly allows its callback URIs.');
+                }
+                for (const uri of uris) {
+                    if (typeof uri !== 'string' || !allow.includes(uri)) {
+                        audit('dcr_denied', { reason: 'redirect-uri-not-allowlisted' });
+                        throw new errors_js_1.InvalidClientMetadataError('DCR denied: redirect_uri is not in the owner allowlist '
+                            + '(MVP_ALLOWED_CALLBACK_URIS allows only exact configured callback URIs)');
+                    }
+                }
+                if (this.clients.size >= MAX_REGISTERED_CLIENTS) {
+                    audit('dcr_denied', { reason: 'client-store-bound' });
+                    throw new errors_js_1.InvalidClientMetadataError(`DCR denied: client store bound reached (${MAX_REGISTERED_CLIENTS} clients)`);
+                }
+                const client_id = randomToken();
+                const full = {
+                    ...client,
+                    client_id,
+                    client_id_issued_at: Math.floor(Date.now() / 1000),
+                };
+                // CLIENT-PERSISTENCE: the registration is durably written (atomic
+                // fsync + rename) BEFORE it is acknowledged. If the write fails the
+                // client must NOT exist — not even in memory — so a restart can
+                // never break a client that was promised to its owner. Mutations
+                // are synchronous, serializing all concurrent registrations in
+                // this single process.
+                try {
+                    this.clients.add(full);
+                }
+                catch (err) {
+                    audit('dcr_denied', { reason: 'persist-failed' });
+                    throw new errors_js_1.ServerError(`DCR failed: ${err.message} — no client was registered; `
+                        + 'the client store must be writable and healthy before registration succeeds');
+                }
+                audit('dcr_ok', { client_id: client_id.slice(0, 8) });
+                return full;
+            },
+        };
+    }
+    pruneTickets() {
+        const now = Date.now();
+        if (this.authTickets.size < MAX_AUTH_TICKETS)
+            return;
+        for (const [id, ticket] of this.authTickets) {
+            if (ticket.expiresAt < now || ticket.used)
+                this.authTickets.delete(id);
+        }
+        if (this.authTickets.size >= MAX_AUTH_TICKETS) {
+            // still full: drop the oldest entries (bounded store, fail closed)
+            const excess = this.authTickets.size - MAX_AUTH_TICKETS + 1;
+            const ids = Array.from(this.authTickets.keys()).slice(0, excess);
+            for (const id of ids)
+                this.authTickets.delete(id);
+        }
+    }
+    /**
+     * Owner consent + login. Called by the SDK's /authorize AFTER it validated
+     * the client and the redirect_uri against the client's registered list.
+     * Mints a one-time authorization-request ticket bound to the EXACT request
+     * parameters and renders the consent page. The login POST must present the
+     * ticket; all OAuth parameters are taken from the ticket server-side.
+     */
+    async authorize(client, params, res) {
+        // Restart-policy enforcement (CLIENT-PERSISTENCE): a client persisted in
+        // a previous run may only authorize while its EXACT callback URI is in
+        // the owner's CURRENT allowlist. Removing a URI from
+        // MVP_ALLOWED_CALLBACK_URIS and restarting therefore revokes fresh
+        // authorizations for persisted clients without deleting their records.
+        if (!this.config.allowedCallbackUris.includes(params.redirectUri)) {
+            audit('authorize_denied', { reason: 'callback-not-allowlisted' });
+            for (const [key, value] of Object.entries(SECURITY_HEADERS))
+                res.setHeader(key, value);
+            res.status(403).send('Authorization denied: this callback URI is no longer allowlisted by the owner.').end();
+            return;
+        }
+        const scopes = params.scopes?.length ? params.scopes : ['memory'];
+        this.pruneTickets();
+        const ticket = randomToken();
+        this.authTickets.set(ticket, {
+            clientId: client.client_id,
+            redirectUri: params.redirectUri,
+            challenge: params.codeChallenge,
+            scopes,
+            resource: params.resource,
+            state: params.state,
+            expiresAt: Date.now() + AUTH_TICKET_TTL_MS,
+            used: false,
+        });
+        // Visible, honest consent (AUTH-B1): escaped client name, the EXACT
+        // redirect destination (origin + full callback URI), the scope, an
+        // explicit unreviewed-client warning, and an explicit approval checkbox.
+        let redirectOrigin = '(unknown origin)';
+        try {
+            redirectOrigin = new URL(params.redirectUri).origin;
+        }
+        catch {
+            // keep the placeholder; the ticket still binds the exact string
+        }
+        for (const [key, value] of Object.entries(SECURITY_HEADERS))
+            res.setHeader(key, value);
+        res.setHeader('Content-Security-Policy', consentPageCsp(this.config.allowedCallbackUris));
+        res.setHeader('Content-Type', 'text/html; charset=utf-8').send(`<!doctype html>
+<html><head><title>Memory Company — owner authorization</title></head>
+<body style="font-family: sans-serif; max-width: 32rem; margin: 4rem auto;">
+<h2>Memory Company (single-owner MVP)</h2>
+<p>Application <b>${htmlEscape(client.client_name ?? client.client_id)}</b> is requesting <b>${htmlEscape(scopes.join(' '))}</b> access to your memory service.</p>
+<p><b>Redirect destination:</b> the authorization code will be sent to<br>
+<b>${htmlEscape(redirectOrigin)}</b><br>
+<code>${htmlEscape(params.redirectUri)}</code></p>
+<p><b style="color:#b00">Warning:</b> this client is <b>unreviewed</b>. Anyone can attempt to register a client. Authorizing grants full read/write access to your private memory (facts and history). Only approve clients you trust and whose callback destination above you recognize.</p>
+<form method="post" action="/mvp-login">
+  <input type="hidden" name="ticket" value="${htmlEscape(ticket)}">
+  <p><label><input type="checkbox" name="approve" value="on" required> I approve this application and the redirect destination shown above</label></p>
+  <p><label>Email<br><input type="email" name="email" autocomplete="username" required style="width:100%"></label></p>
+  <p><label>Secret<br><input type="password" name="password" autocomplete="current-password" required style="width:100%"></label></p>
+  <p><button type="submit">Authorize</button></p>
+</form>
+</body></html>`);
+    }
+    /**
+     * Called by the server's /mvp-login route after the owner submits the
+     * consent form. The one-time ticket supplies every OAuth parameter; the
+     * POST body may only add credentials and the explicit approval.
+     */
+    handleOwnerLogin(ticketId, email, password, approved) {
+        // Global single-owner limiter first (AUTH-B3): while locked out, even
+        // correct credentials are refused; the response stays metadata-only.
+        const now = Date.now();
+        if (now < this.loginLockedUntil) {
+            audit('login_locked', { retry_after_ms: this.loginLockedUntil - now });
+            return { ok: false, error: 'Too many failed login attempts. Try again later.', status: 429, retryAfterSeconds: Math.ceil((this.loginLockedUntil - now) / 1000) };
+        }
+        const ticket = ticketId ? this.authTickets.get(ticketId) : undefined;
+        // Consume the ticket on FIRST use attempt (single-use, anti-replay):
+        // an unknown/expired/used ticket can never mint a code.
+        if (ticket)
+            this.authTickets.delete(ticketId);
+        if (!ticket || ticket.used || ticket.expiresAt < now) {
+            audit('login_ticket_rejected', { reason: !ticket ? 'unknown' : ticket.used ? 'replayed' : 'expired' });
+            return { ok: false, error: 'Invalid or expired authorization request. Restart the authorization from the application.', status: 403 };
+        }
+        if (!approved) {
+            audit('login_rejected', { reason: 'not-approved' });
+            return { ok: false, error: 'Authorization was not approved.', status: 403 };
+        }
+        // Defense in depth: re-validate the client and the redirect membership
+        // from the SERVER-SIDE ticket against the registered client record.
+        const client = this.clients.get(ticket.clientId);
+        if (!client) {
+            audit('login_rejected', { reason: 'unknown-client' });
+            return { ok: false, error: 'Unknown client.', status: 403 };
+        }
+        if (!(client.redirect_uris ?? []).includes(ticket.redirectUri)) {
+            audit('login_rejected', { reason: 'redirect-uri-not-registered' });
+            return { ok: false, error: 'Redirect destination is not registered for this client.', status: 403 };
+        }
+        const emailOk = constantTimeEqual(email.trim().toLowerCase(), this.config.ownerEmail);
+        const passwordOk = constantTimeEqual(password, this.config.ownerPassword);
+        if (!emailOk || !passwordOk) {
+            if (now - this.lastFailureAt > FAILURE_MEMORY_MS)
+                this.loginFailures = 0;
+            this.lastFailureAt = now;
+            this.loginFailures += 1;
+            const max = this.config.loginMaxFailures;
+            if (this.loginFailures >= max) {
+                const exponent = Math.min(this.loginFailures - max, 8);
+                this.loginLockedUntil = now + Math.min(this.config.loginLockoutMs * Math.pow(2, exponent), LOCKOUT_MAX_MS);
+                (0, telemetry_1.emitTelemetry)({ event: 'auth', kind: 'login_fail' });
+                audit('login_failed', { failures: this.loginFailures, locked: true });
+                return { ok: false, error: 'Owner credentials rejected. Too many failed attempts; login is temporarily locked.', status: 429, retryAfterSeconds: Math.ceil((this.loginLockedUntil - now) / 1000) };
+            }
+            (0, telemetry_1.emitTelemetry)({ event: 'auth', kind: 'login_fail' });
+            audit('login_failed', { failures: this.loginFailures });
+            return { ok: false, error: 'Owner credentials rejected. Only the configured owner can authorize this service.', status: 403 };
+        }
+        // Approval claims the client's hive name, so it is refused while an approved client holds that name, and it is
+        // recorded before the code is minted: a write that fails mints nothing.
+        const identity = (0, sourceName_1.hiveIdentity)(client.client_name);
+        if (identity && this.clients.holdsApprovedHiveIdentity(identity, client.client_id)) {
+            audit('login_rejected', { reason: 'identity-held' });
+            return {
+                ok: false,
+                error: `Another approved client already uses the name ${identity}. Give this client a different client_name, or reconnect the client that holds that name.`,
+                status: 409,
+            };
+        }
+        try {
+            this.clients.approve(client.client_id);
+        }
+        catch {
+            audit('login_rejected', { reason: 'approval-persist-failed' });
+            return { ok: false, error: 'Could not record the approval; nothing was authorized. Retry once the client store is writable.', status: 500 };
+        }
+        // Success resets the limiter and mints a code bound to the ticket values.
+        this.loginFailures = 0;
+        this.loginLockedUntil = 0;
+        const code = randomToken();
+        this.authorizationCodes.set(code, {
+            clientId: ticket.clientId,
+            redirectUri: ticket.redirectUri,
+            challenge: ticket.challenge,
+            scopes: ticket.scopes,
+            resource: ticket.resource,
+            expiresAt: now + AUTH_CODE_TTL_MS,
+        });
+        const redirect = new URL(ticket.redirectUri);
+        redirect.searchParams.set('code', code);
+        (0, telemetry_1.emitTelemetry)({ event: 'auth', kind: 'login_ok' });
+        audit('login_ok', { client_id: ticket.clientId.slice(0, 8) });
+        return { ok: true, redirect, state: ticket.state };
+    }
+    async challengeForAuthorizationCode(client, authorizationCode) {
+        const stored = this.authorizationCodes.get(authorizationCode);
+        if (!stored)
+            return this.refuseUnknownCode(client, authorizationCode);
+        if (stored.clientId !== client.client_id)
+            throw new errors_js_1.InvalidGrantError('Authorization code was issued to a different client');
+        return stored.challenge;
+    }
+    async exchangeAuthorizationCode(client, authorizationCode, _codeVerifier, redirectUri, resource) {
+        const stored = this.authorizationCodes.get(authorizationCode);
+        if (!stored)
+            return this.refuseUnknownCode(client, authorizationCode);
+        if (stored.expiresAt < Date.now()) {
+            throw new errors_js_1.InvalidGrantError('Authorization code not found or expired');
+        }
+        if (stored.clientId !== client.client_id) {
+            throw new errors_js_1.InvalidGrantError('Authorization code was issued to a different client');
+        }
+        if (redirectUri && stored.redirectUri !== redirectUri) {
+            throw new errors_js_1.InvalidGrantError('redirect_uri does not match the authorization request');
+        }
+        this.authorizationCodes.delete(authorizationCode);
+        const { tokens, family } = this.issue(client.client_id, stored.scopes, resource ?? stored.resource);
+        this.usedCodes.set(authorizationCode, family);
+        if (this.usedCodes.size > MAX_USED_CODES)
+            this.usedCodes.delete(this.usedCodes.keys().next().value);
+        return tokens;
+    }
+    /** A code that is not on file: if it was already redeemed, whoever redeemed it first holds tokens that must not
+     *  survive the replay (RFC 6749 4.1.2). Always `invalid_grant` (400), never a 500 the client would retry. */
+    refuseUnknownCode(client, authorizationCode) {
+        const family = this.usedCodes.get(authorizationCode);
+        if (family && family.clientId === client.client_id)
+            this.killFamily(family);
+        throw new errors_js_1.InvalidGrantError('Authorization code not found or expired');
+    }
+    async exchangeRefreshToken(client, refreshToken, _scopes, resource) {
+        const stored = this.refreshTokens.get(refreshToken);
+        if (!stored || stored.clientId !== client.client_id) {
+            throw new errors_js_1.InvalidGrantError('Refresh token not found or was issued to a different client');
+        }
+        // AUTH-H1: refresh tokens expire — a stolen refresh token dies with the
+        // bound lifetime, not with the process.
+        if (stored.refreshExpiresAt < Date.now()) {
+            this.refreshTokens.delete(refreshToken);
+            throw new errors_js_1.InvalidGrantError('Refresh token expired');
+        }
+        // Rotate: single-use refresh tokens, and the access token minted beside the old one dies with it.
+        this.refreshTokens.delete(refreshToken);
+        this.accessTokens.delete(stored.family.access);
+        return this.issue(client.client_id, stored.scopes, resource, stored.family).tokens;
+    }
+    async verifyAccessToken(token) {
+        const stored = this.accessTokens.get(token);
+        if (!stored)
+            throw new Error('Token invalid or revoked');
+        if (stored.expiresAt < Date.now()) {
+            this.accessTokens.delete(token);
+            throw new Error('Token expired');
+        }
+        return {
+            token,
+            clientId: stored.clientId,
+            scopes: stored.scopes,
+            expiresAt: Math.floor(stored.expiresAt / 1000),
+            resource: undefined,
+        };
+    }
+    async revokeToken(client, request) {
+        // Invalid or already-revoked tokens: do nothing, per interface contract. Only the client a token was issued
+        // to may revoke it, and revoking either half ends the pair (RFC 7009 2.1).
+        const stored = this.accessTokens.get(request.token) ?? this.refreshTokens.get(request.token);
+        if (stored && stored.clientId === client.client_id)
+            this.killFamily(stored.family);
+    }
+    killFamily(family) {
+        this.accessTokens.delete(family.access);
+        this.refreshTokens.delete(family.refresh);
+    }
+    /**
+     * Mint a short-lived access token for the trusted universal gateway.
+     * Disabled unless gatewaySecret is configured.
+     */
+    issueGatewayAccessToken(presentedSecret) {
+        const expected = this.config.gatewaySecret;
+        if (!expected || !presentedSecret || !constantTimeEqual(expected, presentedSecret)) {
+            throw new Error('gateway unauthorized');
+        }
+        return this.issue('renor-gateway', ['mcp'], undefined).tokens;
+    }
+    /** Expired tokens used to leave only when presented; sweep them so a long-running process does not grow without bound. */
+    sweepTokens() {
+        const now = Date.now();
+        for (const [t, s] of this.accessTokens)
+            if (s.expiresAt < now)
+                this.accessTokens.delete(t);
+        for (const [t, s] of this.refreshTokens)
+            if (s.refreshExpiresAt < now)
+                this.refreshTokens.delete(t);
+    }
+    issue(clientId, scopes, resource, chain) {
+        if (++this.issuedSinceSweep >= TOKEN_SWEEP_EVERY) {
+            this.issuedSinceSweep = 0;
+            this.sweepTokens();
+        }
+        const accessToken = randomToken();
+        const refreshToken = randomToken();
+        const expiresAt = Date.now() + this.config.accessTokenTtlSeconds * 1000;
+        const family = chain ?? { clientId, access: accessToken, refresh: refreshToken };
+        family.access = accessToken;
+        family.refresh = refreshToken;
+        const stored = {
+            family,
+            clientId,
+            scopes,
+            expiresAt,
+            refreshExpiresAt: Date.now() + REFRESH_TOKEN_TTL_MS,
+        };
+        this.accessTokens.set(accessToken, stored);
+        this.refreshTokens.set(refreshToken, stored);
+        const tokens = {
+            access_token: accessToken,
+            token_type: 'Bearer',
+            expires_in: this.config.accessTokenTtlSeconds,
+            refresh_token: refreshToken,
+            scope: scopes.join(' ') || 'memory',
+            resource: resource?.href,
+        };
+        return { tokens, family };
+    }
+    /** Test/operations helper: limiter is bounded and recoverable by design. */
+    limiterState() {
+        return { failures: this.loginFailures, lockedUntil: this.loginLockedUntil };
+    }
+}
+exports.OwnerOAuthProvider = OwnerOAuthProvider;
+/** Express router for the owner consent+login form submit (mounted at /mvp-login). */
+function ownerLoginRouter(provider, config) {
+    const router = express_1.default.Router();
+    router.post('/', express_1.default.urlencoded({ extended: false }), (req, res) => {
+        const { ticket, email, password, approve } = (req.body ?? {});
+        // Security headers apply to EVERY outcome of this handler (including
+        // the 403/400/429 rejections below), so no response from the login
+        // endpoint ever renders with looser referrer/CSP/frame semantics than
+        // the consent page that linked to it.
+        for (const [key, value] of Object.entries(SECURITY_HEADERS))
+            res.setHeader(key, value);
+        // Cross-origin POST protection (AUTH-B1): when a browser supplies
+        // Origin or Referer, it must be this service's own origin. Spoofable
+        // forwarding headers (X-Forwarded-*) are deliberately NOT trusted.
+        const origin = req.headers.origin ?? req.headers.referer;
+        if (origin) {
+            let allowed = false;
+            try {
+                const supplied = new URL(origin);
+                allowed = supplied.origin === config.baseUrl.origin;
+            }
+            catch {
+                allowed = false;
+            }
+            if (!allowed) {
+                audit('login_rejected', { reason: 'cross-origin-post' });
+                res.status(403).send('Cross-origin login requests are not accepted.').end();
+                return;
+            }
+        }
+        // A repeated field (email=a&email=b) parses to an array: refuse it before the ticket is spent.
+        if ([ticket, email, password, approve].some(v => v !== undefined && typeof v !== 'string')) {
+            res.status(400).send('Invalid authorization request.').end();
+            return;
+        }
+        if (!ticket) {
+            res.status(400).send('Invalid authorization request: missing one-time ticket. Restart the authorization from the application.').end();
+            return;
+        }
+        const result = provider.handleOwnerLogin(ticket, email ?? '', password ?? '', approve === 'on');
+        if (!result.ok) {
+            // Privacy-safe: no detail beyond the rejection, no code, no redirect.
+            if (result.status === 429)
+                res.setHeader('Retry-After', String(result.retryAfterSeconds ?? 1));
+            res.status(result.status).send(htmlEscape(result.error)).end();
+            return;
+        }
+        if (result.state)
+            result.redirect.searchParams.set('state', result.state);
+        res.redirect(302, result.redirect.href);
+    });
+    return router;
+}

package/dist/mvp/cli.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+// FIRST, and for its side effect: enabling this workspace's Node compile cache
+// before anything heavy is resolved. With every workspace asleep after its idle
+// period, the gateway's wake pays the whole module-load phase again, and the
+// compile cache is what keeps that phase off the critical path. It must come
+// before ./server, which transitively pulls the o200k_base table (~300 ms of a
+// ~930 ms module-load phase, measured on Node 22 against an empty workspace).
+const compileCache_1 = require("./compileCache");
+(0, compileCache_1.enableWorkspaceCompileCache)();
+const config_1 = require("./config");
+const server_1 = require("./server");
+const telemetry_1 = require("./telemetry");
+const posthogMcp_1 = require("./posthogMcp");
+/**
+ * CLI entry for the single-user ChatGPT MVP service.
+ *
+ * Required environment:
+ *   MVP_MEMORY_DIR   dedicated owner memory directory (create a NEW folder)
+ *   MVP_BASE_URL     externally reachable base URL (http://localhost:<port> for
+ *                    local protocol tests; your public https URL for ChatGPT)
+ *   MVP_OWNER_EMAIL  the single owner login email
+ *   MVP_OWNER_PASSWORD  owner login secret (env-only, never in Git)
+ * Optional:
+ *   MVP_PORT (default 3471), MVP_LEDGER_REL, MVP_ACCESS_TOKEN_TTL_SECONDS
+ */
+async function main() {
+    const config = (0, config_1.loadMvpConfig)();
+    const mvp = await (0, server_1.startMvpService)(config);
+    console.log(`[mvp] Renor single-owner memory service`);
+    console.log(`[mvp] Memory directory : ${config.memoryDir}`);
+    console.log(`[mvp] Ledger (source)  : ${config.ledgerRelPath}`);
+    console.log(`[mvp] Derived index     : ${config.dbPath} (rebuildable from the ledger)`);
+    console.log(`[mvp] Listening         : http://127.0.0.1:${config.port}`);
+    console.log(`[mvp] MCP endpoint      : ${new URL(server_1.MVP_MCP_PATH, config.baseUrl).href}`);
+    console.log(`[mvp] OAuth discovery   : ${new URL('/.well-known/oauth-authorization-server', config.baseUrl).href}`);
+    console.log(`[mvp] Owner             : ${config.ownerEmail} (the only identity that can authorize)`);
+    if (config.historyDir) {
+        console.log(`[mvp] History directory : ${config.historyDir} (search_history: promoted ChatGPT history, manifest-verified)`);
+    }
+    else {
+        console.log(`[mvp] History directory : not configured (search_history returns a bounded unconfigured result; set MVP_HISTORY_DIR to enable)`);
+    }
+    console.log(`[mvp] Local proof       : run the MCP client tests in tests/mvp/`);
+    console.log(`[mvp] DCR allowlist     : ${config.allowedCallbackUris.length} exact callback URI(s)${config.allowedCallbackUris.length ? '' : ' — DENY BY DEFAULT: no client may register until MVP_ALLOWED_CALLBACK_URIS names exact callbacks'}`);
+    console.log(`[mvp] Exposure boundary : loopback-bound; any public use REQUIRES TLS termination in front (no public mode is shipped).`);
+    console.log(`[mvp] Embeddings         : ${config.embeddingProvider}${config.embeddingDims ? ` (${config.embeddingDims}-d)` : ''}`);
+    const shutdown = async () => {
+        try {
+            await mvp.close();
+        }
+        finally {
+            await Promise.allSettled([(0, telemetry_1.flushTelemetry)(), (0, posthogMcp_1.shutdownPosthogMcp)()]);
+        }
+        process.exit(0);
+    };
+    process.on('SIGINT', shutdown);
+    process.on('SIGTERM', shutdown);
+    if (mvp.idleExit) {
+        console.log(`[mvp] On-demand         : exits after ${config.idleExitMs / 1000}s with no work in flight (RENOR_ON_DEMAND); the gateway starts it again`);
+        void mvp.idleExit.then(() => {
+            console.log('[mvp] idle: no work in flight for the idle period; exiting cleanly');
+            // Exit 0 is what leaves the unit stopped (Restart=on-failure). Nothing is in
+            // flight, so a telemetry flush that hangs must not keep the engine resident.
+            setTimeout(() => process.exit(0), 15_000).unref();
+            return shutdown();
+        });
+    }
+}
+main().catch((err) => {
+    console.error('[mvp] startup failed:', err instanceof Error ? err.message : err);
+    process.exit(1);
+});