mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-11-10 01:50:13 +01:00
Verify original Dot OAuth authority for signed Cloud requests (#19819)
## Thinking Path > - Paperclip manages AI agents and their work. > - Dot uses a user OAuth grant to act in one company. > - Cloud must use that original grant when it resolves a selected user's identity. > - A Cloud signature alone must not create user or board authority. > - The tenant's OAuth owner must check the token and its current restrictions. > - This pull request adds a signed private HTTP boundary for that check. > - The result contains only the checked identity fields. It grants no task or board access. ## Linked Issues or Issue Description **Subsystem affected** Server external-agent identity, public MCP OAuth, Cloud control verification, and HTTP logging. **Problem or motivation** Cloud needs a private way to resolve the original Dot token for the selected user, client, company and resource. The existing generic Cloud control route creates an operator actor. That route is not the right owner for this identity check. **Proposed solution** Add `POST /mcp/runner/oauth/cloud-principal`. Require the existing Cloud signature and replay verifier. Bind the whole request to a new, closed `mcp-dot:principal` action with a maximum 60-second lifetime. Authenticate the original token once through the normal Dot OAuth owner. Check current namespace authority before and after that call. **Alternatives considered** A Cloud-created grant or a board actor would change the authority owner. Neither is used. The private route reuses the existing OAuth and Cloud identity owners. **Roadmap alignment** This is a narrow boundary for the existing MCP and Cloud areas in `ROADMAP.md`. It adds no work queue, public hosted profile, or provider enablement. Related public work: Refs #14846, #19427, #19750 and #19776. Searches for the exact private path and action found no duplicate PR. The matching private Cloud caller has merged. The current App head passed its required checks and review. ## What Changed - Add an original-token principal reader. Keep the original client, selected user, company, resource, purpose, scope, membership and feature restrictions. - Add a 16 KiB raw JSON private route. Reject compressed, invalid UTF-8, malformed and unknown-field bodies. Bind an ordered whole-body digest to the signature and existing nonce fence. - Compare the current stack, claim, instance, origin and connector identity before and after OAuth. An absent owner or namespace fails closed. - Mount the route in normal `createApp` after hostname, runtime-claim and standby checks, before session/actor work. Do not add it to generic board-control routing. - Keep private request and response logs content-free, including raw buffers, headers, query data and reflected errors. - Add controlled HTTP/privacy tests and a real normal-App OAuth/Cloud-signer integration case. Document the machine-only contract and correct the existing `assistant-connections/client-use` access entry. No new capability ID or agent API entry is added. No schema, lockfile, workflow, Runner, Muse or useful-task fixture changes belong to this PR. ## Verification - Current `70c03593`: normal module-boundary policy and all seven App compiler programs passed. The public module factory has an explicit portable Express return contract. Whole HTTP/log controls passed again: 30/30. The existing real paired OAuth/Cloud-signer/private HTTP case then passed again on a fresh PostgreSQL fixture: 1/1, zero skipped. All known child processes and five database connections closed; the final independent SQL audit was empty. - The original remote policy failure rejected an App import of a module-internal path; dependent E2E/verify gates stopped on that failure. The fix delegates through the public module API. A first local declaration run reported TS2883 for its inferred return type; the explicit public type fixed it. Original logs remain preserved. No checker, compiler option, test body or authority check was weakened. - The normal full App graph passed on the integrated source. The later fixture-only repairs each passed the complete affected owning program:405 entries, including 403 source roots. The remaining programs and own dependency outputs carried only where their source was exact. - Whole private HTTP/log files passed:30 tests, zero failures or skips. The HTTP controls use a controlled OAuth owner with real signatures. The log controls use the actual HTTP logger. - The paired Cloud source passed its normal strict build and whole 26 signer/client/namespace and credential-error controls. These are controlled caller tests, not provider tests. - One normal-App paired case passed with a dedicated PostgreSQL database. It used real DCR 201, PKCE, consent, token exchange and a persisted unpaired grant; actual signed metadata publication and a committed Cloud receipt; the real Cloud signer/client and actual App HTTP; exactly-once authentication; refresh; current namespace restrictions; and revocation. The Cloud registry/provider were the existing controlled in-memory/Fake fixtures. Recorded inbound Hosts matched, with zero metadata overflow. No grant, readiness or mirror ACK was fabricated. - The original principal helper's 21 controlled tests and two real-OAuth tests passed before the HTTP slice. Those three files remained unchanged through integration. They are separate source-scoped evidence, not an extra combined run. - Preserved failures: a helper import and test typing error were corrected before the passed checks. An earlier suite failure did not serialize its hook error and remains unexplained. Later runs captured a missing normal managed-config initialization and HTTP 404 from the loopback mapper. The fixture now calls the normal initialization owners and uses the existing Host-preserving canonical HTTP adapter. All original authority assertions and deadlines remain. - Reproduce the local files with `pnpm --filter @paperclipai/server exec vitest run src/modules/external-agents/cloud-principal-http.test.ts src/modules/external-agents/cloud-principal-log.test.ts --maxWorkers=1 --no-file-parallelism`. The real integration file is `server/src/__tests__/cloud-principal-normal-app.postgres.test.ts`; it requires its explicit dedicated test DB and an own compiled matching Cloud checkout. - The normal `node scripts/check-maps.mjs` check passed for 35 areas and 192 capability IDs. This validates map structure, not business acceptance. The later edits are documentation/map only; all executed business source and own outputs from the paired case remained exact. - Current-head remote CI passes: 59 successful checks and three intentional skips. Greptile reviewed this exact head at 5/5 with no findings or review threads. The prior Ponytail review was Ship 5/5 at the earlier head; no current-head Ponytail turn is present, which is nonblocking under the authorized review policy. The three full-repository commands were not repeated locally; the focused normal App graph and affected tests above passed, and required remote CI supplies the broad gates. No deployed, provider-capacity, cold-wake or full hosted lifecycle result is claimed. ## Risks - This is a security boundary. Signature, current namespace and original OAuth restrictions must continue to fail closed. The response gives identity only; callers still need normal operation authority. - The request carries the original token. The reserved route uses a closed log projection on both accepted and refused requests. Privacy regressions remain a material risk. - Both repositories must agree on the action and digest contract. Older code rejects the unsupported action; no fallback creates authority. - This is a prerequisite private boundary. The remaining hosted discovery, wake, capability, operation, event, retry/reactivation and revocation lifecycle work, plus Muse, remains open. No profile or capability is enabled here. - No migration is needed. Rollback removes the private boundary and paired caller; normal OAuth and Personal MCP remain with their existing owners. - The engineering documentation describes this private machine boundary and its access restriction. No operator-facing feature is enabled. Documentation for full hosted enablement remains with that later work. ## Model Used OpenAI `gpt-6.1-sol` (Sol6.1), through Codex, produced the source and tests with tool use and local compiler/test execution. A GPT-6-based Codex coordinator reviewed the work. Its exact model ID is unavailable. Context window sizes are unavailable. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge
This commit is contained in:
Dotta authored and GitHub committed
1 parent
b2af45f0f1
commit
3112e4c955
15 files changed
+1292
-5
No files matched your search
@@ -0,0 +1,109 @@
|
||||
import { createHash } from "node:crypto";
|
||||
import { z } from "zod";
|
||||
import {
|
||||
getCloudRuntimeIdentity,
|
||||
verifyCloudControlAssertion,
|
||||
} from "../../services/cloud-runtime-identity.js";
|
||||
import { paperclipCloudConnectorConfigFromEnv } from "../../services/paperclip-cloud-connector.js";
|
||||
|
||||
export const dotPrincipalControlPath = "/mcp/runner/oauth/cloud-principal";
|
||||
export const dotPrincipalControlBodySchema = z
|
||||
.object({
|
||||
accessToken: z.string().min(1).max(256),
|
||||
upstreamClientId: z.string().min(1).max(2048),
|
||||
selectingUserId: z.string().min(1).max(200),
|
||||
canonicalVerifiedResource: z.string().url().max(2048),
|
||||
expectedInstanceId: z.string().min(1).max(200),
|
||||
requestedCompanyId: z.uuid().optional(),
|
||||
})
|
||||
.strict();
|
||||
export type DotPrincipalControlBody = z.infer<
|
||||
typeof dotPrincipalControlBodySchema
|
||||
>;
|
||||
export function dotPrincipalControlDigest(body: DotPrincipalControlBody) {
|
||||
return createHash("sha256")
|
||||
.update(
|
||||
JSON.stringify([
|
||||
"paperclip-dot-original-principal-v1",
|
||||
"mcp-dot:principal",
|
||||
body.expectedInstanceId,
|
||||
body.canonicalVerifiedResource,
|
||||
body.upstreamClientId,
|
||||
body.selectingUserId,
|
||||
body.requestedCompanyId ?? null,
|
||||
body.accessToken,
|
||||
]),
|
||||
)
|
||||
.digest("hex");
|
||||
}
|
||||
export function verifyDotPrincipalControl(
|
||||
compactJws: string,
|
||||
body: DotPrincipalControlBody,
|
||||
now: Date,
|
||||
) {
|
||||
if (compactJws.length > 8192)
|
||||
throw new Error("Invalid Dot principal assertion");
|
||||
const parts = compactJws.split(".");
|
||||
if (parts.length !== 3) throw new Error("Invalid Dot principal assertion");
|
||||
const untrusted: unknown = JSON.parse(
|
||||
Buffer.from(parts[1]!, "base64url").toString("utf8"),
|
||||
);
|
||||
if (
|
||||
!untrusted ||
|
||||
typeof untrusted !== "object" ||
|
||||
Array.isArray(untrusted) ||
|
||||
!("requestId" in untrusted) ||
|
||||
typeof untrusted.requestId !== "string" ||
|
||||
!/^([a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12})\.[a-f0-9]{64}$/.test(
|
||||
untrusted.requestId,
|
||||
) ||
|
||||
untrusted.requestId.slice(37) !== dotPrincipalControlDigest(body) ||
|
||||
!("iat" in untrusted) || !("exp" in untrusted) ||
|
||||
typeof untrusted.iat !== "number" || typeof untrusted.exp !== "number" ||
|
||||
!Number.isSafeInteger(untrusted.iat) ||
|
||||
!Number.isSafeInteger(untrusted.exp) ||
|
||||
Number(untrusted.exp) <= Number(untrusted.iat) ||
|
||||
Number(untrusted.exp) - Number(untrusted.iat) > 60
|
||||
)
|
||||
throw new Error("Invalid Dot principal assertion binding");
|
||||
return verifyCloudControlAssertion({
|
||||
compactJws,
|
||||
expectedAction: "mcp-dot:principal",
|
||||
now,
|
||||
});
|
||||
}
|
||||
export function readDotPrincipalControlAuthority() {
|
||||
const identity = getCloudRuntimeIdentity(),
|
||||
connector = paperclipCloudConnectorConfigFromEnv();
|
||||
return identity && connector
|
||||
? {
|
||||
stackId: identity.stackId,
|
||||
claimId: identity.claimId,
|
||||
canonicalOrigin: identity.canonicalOrigin,
|
||||
instanceId: connector.instanceId,
|
||||
environment: connector.environment,
|
||||
baseUrl: connector.baseUrl,
|
||||
signPrivateKey: connector.signPrivateKey,
|
||||
sealPrivateKey: connector.sealPrivateKey,
|
||||
}
|
||||
: null;
|
||||
}
|
||||
export type DotPrincipalControlAuthority = NonNullable<
|
||||
ReturnType<typeof readDotPrincipalControlAuthority>
|
||||
>;
|
||||
export function sameDotPrincipalControlAuthority(
|
||||
left: DotPrincipalControlAuthority,
|
||||
right: DotPrincipalControlAuthority | null,
|
||||
) {
|
||||
return (
|
||||
right !== null &&
|
||||
left.stackId === right.stackId &&
|
||||
left.claimId === right.claimId &&
|
||||
left.canonicalOrigin === right.canonicalOrigin &&
|
||||
left.instanceId === right.instanceId &&
|
||||
left.environment === right.environment &&
|
||||
left.baseUrl === right.baseUrl &&
|
||||
left.signPrivateKey === right.signPrivateKey &&
|
||||
left.sealPrivateKey === right.sealPrivateKey
|
||||
);
|
||||
}
|
||||
@@ -0,0 +1,456 @@
|
||||
import { generateKeyPairSync, randomUUID, sign } from "node:crypto";
|
||||
import { gzipSync } from "node:zlib";
|
||||
import express from "express";
|
||||
import request from "supertest";
|
||||
import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
|
||||
import {
|
||||
CLOUD_CONTROL_AUDIENCE,
|
||||
CLOUD_CONTROL_HEADER,
|
||||
CLOUD_CONTROL_JWS_TYPE,
|
||||
CLOUD_RUNTIME_IDENTITY_ISSUER,
|
||||
resetCloudControlReplayFenceForTests,
|
||||
} from "../../services/cloud-runtime-identity.js";
|
||||
import {
|
||||
dotPrincipalControlDigest,
|
||||
dotPrincipalControlPath,
|
||||
type DotPrincipalControlBody,
|
||||
type DotPrincipalControlAuthority,
|
||||
} from "./cloud-principal-authority.js";
|
||||
import {
|
||||
McpOAuthError,
|
||||
type McpPrincipal,
|
||||
type PublicMcpOAuth,
|
||||
} from "../../services/public-mcp/oauth.js";
|
||||
import {
|
||||
dotPrincipalControlBodyParser,
|
||||
dotPrincipalControlRoutes,
|
||||
isDotPrincipalControlPost,
|
||||
} from "./cloud-principal-http.js";
|
||||
|
||||
const pair = generateKeyPairSync("ed25519"),
|
||||
foreign = generateKeyPairSync("ed25519"),
|
||||
kid = "dot-control-unit";
|
||||
const origin = "https://unit-dot.example.test",
|
||||
companyId = "11111111-1111-4111-8111-111111111111",
|
||||
grantId = "22222222-2222-4222-8222-222222222222";
|
||||
const body: DotPrincipalControlBody = {
|
||||
accessToken: "original-unit-access",
|
||||
upstreamClientId: "upstream-client",
|
||||
selectingUserId: "selecting-user",
|
||||
canonicalVerifiedResource: origin + "/mcp/runner",
|
||||
expectedInstanceId: "instance",
|
||||
};
|
||||
const encode = (value: unknown) =>
|
||||
Buffer.from(JSON.stringify(value)).toString("base64url");
|
||||
function fixture(ownerPresent = true) {
|
||||
let now = Date.now(),
|
||||
authority: DotPrincipalControlAuthority | null = {
|
||||
stackId: "stack",
|
||||
claimId: "claim",
|
||||
canonicalOrigin: origin,
|
||||
instanceId: "instance",
|
||||
environment: "test",
|
||||
baseUrl: "https://cloud.example.test",
|
||||
signPrivateKey: "private-unit-namespace-a",
|
||||
sealPrivateKey: "private-unit-namespace-b",
|
||||
};
|
||||
const principal: McpPrincipal = {
|
||||
grant: {
|
||||
id: grantId,
|
||||
companyId,
|
||||
userId: body.selectingUserId,
|
||||
clientId: body.upstreamClientId,
|
||||
resource: body.canonicalVerifiedResource,
|
||||
purpose: "agent",
|
||||
agentId: null,
|
||||
scopes: ["paperclip:agent"],
|
||||
revokedAt: null,
|
||||
revocationRevision: 0,
|
||||
revocationIndexReceipt: null,
|
||||
createdAt: new Date(0),
|
||||
},
|
||||
actor: { type: "none", source: "mcp_oauth", companyId },
|
||||
company: {
|
||||
id: companyId,
|
||||
name: "Unit",
|
||||
issuePrefix: "UNIT",
|
||||
status: "active",
|
||||
},
|
||||
};
|
||||
const authenticate = vi.fn(async (_token: string) => principal),
|
||||
readAuthority = vi.fn(() => authority);
|
||||
const oauth: Pick<PublicMcpOAuth, "mode" | "config" | "authenticate"> = {
|
||||
mode: "openai_dot_agent",
|
||||
config: { origin, resource: body.canonicalVerifiedResource },
|
||||
authenticate,
|
||||
};
|
||||
let downstreamActorCalls = 0;
|
||||
const actors: unknown[] = [],
|
||||
app = express();
|
||||
app.use((req, res, next) => {
|
||||
req.actor = { type: "none", source: "none" };
|
||||
res.on("finish", () => actors.push(req.actor.type));
|
||||
next();
|
||||
});
|
||||
app.use(dotPrincipalControlBodyParser());
|
||||
const json = express.json();
|
||||
app.use((req, res, next) =>
|
||||
isDotPrincipalControlPost(req) ? next() : json(req, res, next),
|
||||
);
|
||||
app.use(
|
||||
dotPrincipalControlRoutes(() => (ownerPresent ? oauth : null), {
|
||||
readAuthority,
|
||||
now: () => new Date(now),
|
||||
}),
|
||||
);
|
||||
app.use((_req, res) => {
|
||||
downstreamActorCalls++;
|
||||
res.status(599).end();
|
||||
});
|
||||
function assertion(
|
||||
value = body,
|
||||
changes: Record<string, unknown> = {},
|
||||
key = pair.privateKey,
|
||||
) {
|
||||
const header = encode({ alg: "EdDSA", typ: CLOUD_CONTROL_JWS_TYPE, kid }),
|
||||
iat = Math.floor(now / 1000),
|
||||
payload = encode({
|
||||
v: 1,
|
||||
iss: CLOUD_RUNTIME_IDENTITY_ISSUER,
|
||||
aud: CLOUD_CONTROL_AUDIENCE,
|
||||
sub: "stack",
|
||||
action: "mcp-dot:principal",
|
||||
requestId: randomUUID() + "." + dotPrincipalControlDigest(value),
|
||||
iat,
|
||||
exp: iat + 60,
|
||||
...changes,
|
||||
});
|
||||
return `${header}.${payload}.${sign(null, Buffer.from(header + "." + payload), key).toString("base64url")}`;
|
||||
}
|
||||
return {
|
||||
app,
|
||||
actors,
|
||||
authenticate,
|
||||
readAuthority,
|
||||
principal,
|
||||
assertion,
|
||||
downstream: () => downstreamActorCalls,
|
||||
change: (value: Partial<DotPrincipalControlAuthority>) => {
|
||||
authority = { ...authority!, ...value };
|
||||
},
|
||||
expire: () => {
|
||||
now += 61_000;
|
||||
},
|
||||
remove: () => {
|
||||
authority = null;
|
||||
},
|
||||
};
|
||||
}
|
||||
beforeEach(() => {
|
||||
resetCloudControlReplayFenceForTests();
|
||||
vi.stubEnv("PAPERCLIP_CLOUD_STACK_ID", "stack");
|
||||
vi.stubEnv(
|
||||
"PAPERCLIP_CLOUD_RUNTIME_IDENTITY_JWKS",
|
||||
JSON.stringify({
|
||||
keys: [
|
||||
{
|
||||
...pair.publicKey.export({ format: "jwk" }),
|
||||
kid,
|
||||
alg: "EdDSA",
|
||||
use: "sig",
|
||||
},
|
||||
],
|
||||
}),
|
||||
);
|
||||
});
|
||||
afterEach(() => {
|
||||
vi.unstubAllEnvs();
|
||||
resetCloudControlReplayFenceForTests();
|
||||
});
|
||||
describe("Dot private principal HTTP+real crypto UNIT; controlled OAuth/identity owners, no real PG", () => {
|
||||
it("reserves the actual HTTP path without an OAuth owner and never enters downstream actor work", async () => {
|
||||
const f = fixture(false);
|
||||
expect((await request(f.app).get(dotPrincipalControlPath)).status).toBe(
|
||||
405,
|
||||
);
|
||||
expect(
|
||||
(await request(f.app).post(dotPrincipalControlPath).send(body)).status,
|
||||
).toBe(401);
|
||||
expect(
|
||||
(
|
||||
await request(f.app)
|
||||
.post(dotPrincipalControlPath)
|
||||
.set("Content-Type", "text/plain")
|
||||
.send("private")
|
||||
).status,
|
||||
).toBe(415);
|
||||
expect(
|
||||
(
|
||||
await request(f.app)
|
||||
.post(dotPrincipalControlPath)
|
||||
.set(CLOUD_CONTROL_HEADER, f.assertion())
|
||||
.set("Content-Type", "application/json")
|
||||
.send("{")
|
||||
).status,
|
||||
).toBe(400);
|
||||
expect(
|
||||
(
|
||||
await request(f.app)
|
||||
.post(dotPrincipalControlPath.toUpperCase() + "/")
|
||||
.set(CLOUD_CONTROL_HEADER, f.assertion())
|
||||
.send(body)
|
||||
).status,
|
||||
).toBe(503);
|
||||
expect(
|
||||
(
|
||||
await request(f.app)
|
||||
.post(dotPrincipalControlPath)
|
||||
.set(CLOUD_CONTROL_HEADER, f.assertion())
|
||||
.send({ ...body, unknown: true })
|
||||
).status,
|
||||
).toBe(400);
|
||||
expect(f.downstream()).toBe(0);
|
||||
expect(f.authenticate).not.toHaveBeenCalled();
|
||||
expect(f.readAuthority).not.toHaveBeenCalled();
|
||||
});
|
||||
it("keeps the closed request tuple digest stable", () => {
|
||||
expect(dotPrincipalControlDigest(body)).toBe(
|
||||
"2c5172a91664f7df7d35b734cf8f355c51d2dde70eddcf15f4225673af3b88f5",
|
||||
);
|
||||
});
|
||||
it("returns minimal unpaired projection once, with unchanged none actor and no bearer echo", async () => {
|
||||
const f = fixture(),
|
||||
response = await request(f.app)
|
||||
.post(dotPrincipalControlPath + "/")
|
||||
.set(CLOUD_CONTROL_HEADER, f.assertion())
|
||||
.send(body);
|
||||
expect(response.status).toBe(200);
|
||||
expect(response.body).toMatchObject({
|
||||
version: 1,
|
||||
stackId: "stack",
|
||||
instanceId: "instance",
|
||||
canonicalOrigin: origin,
|
||||
principal: {
|
||||
userId: body.selectingUserId,
|
||||
companyId,
|
||||
grantId,
|
||||
clientId: body.upstreamClientId,
|
||||
resource: body.canonicalVerifiedResource,
|
||||
purpose: "agent",
|
||||
},
|
||||
});
|
||||
expect(JSON.stringify(response.body)).not.toContain(body.accessToken);
|
||||
expect(f.authenticate).toHaveBeenCalledExactlyOnceWith(body.accessToken);
|
||||
expect(f.readAuthority).toHaveBeenCalledTimes(2);
|
||||
expect(f.actors).toEqual(["none"]);
|
||||
});
|
||||
it("altered body cannot burn a valid request, and authentic replay is rejected", async () => {
|
||||
const f = fixture(),
|
||||
jws = f.assertion();
|
||||
expect(
|
||||
(
|
||||
await request(f.app)
|
||||
.post(dotPrincipalControlPath)
|
||||
.set(CLOUD_CONTROL_HEADER, jws)
|
||||
.send({ ...body, accessToken: "altered" })
|
||||
).status,
|
||||
).toBe(401);
|
||||
expect(f.authenticate).not.toHaveBeenCalled();
|
||||
expect(f.readAuthority).not.toHaveBeenCalled();
|
||||
expect(
|
||||
(
|
||||
await request(f.app)
|
||||
.post(dotPrincipalControlPath)
|
||||
.set(CLOUD_CONTROL_HEADER, jws)
|
||||
.send(body)
|
||||
).status,
|
||||
).toBe(200);
|
||||
expect(
|
||||
(
|
||||
await request(f.app)
|
||||
.post(dotPrincipalControlPath)
|
||||
.set(CLOUD_CONTROL_HEADER, jws)
|
||||
.send(body)
|
||||
).status,
|
||||
).toBe(401);
|
||||
expect(f.authenticate).toHaveBeenCalledTimes(1);
|
||||
});
|
||||
it.each([
|
||||
{ action: "mcp-device:mint" },
|
||||
{ aud: "other" },
|
||||
{ sub: "foreign" },
|
||||
{ exp: 0 },
|
||||
])(
|
||||
"rejects signed claim mismatch without OAuth or authority reads: %j",
|
||||
async (changes) => {
|
||||
const f = fixture();
|
||||
expect(
|
||||
(
|
||||
await request(f.app)
|
||||
.post(dotPrincipalControlPath)
|
||||
.set(CLOUD_CONTROL_HEADER, f.assertion(body, changes))
|
||||
.send(body)
|
||||
).status,
|
||||
).toBe(401);
|
||||
expect(f.authenticate).not.toHaveBeenCalled();
|
||||
expect(f.readAuthority).not.toHaveBeenCalled();
|
||||
},
|
||||
);
|
||||
it("rejects action lifetime over sixty seconds without consuming authority", async () => {
|
||||
const f = fixture(),
|
||||
iat = Math.floor(Date.now() / 1000);
|
||||
expect(
|
||||
(
|
||||
await request(f.app)
|
||||
.post(dotPrincipalControlPath)
|
||||
.set(CLOUD_CONTROL_HEADER, f.assertion(body, { iat, exp: iat + 120 }))
|
||||
.send(body)
|
||||
).status,
|
||||
).toBe(401);
|
||||
expect(f.authenticate).not.toHaveBeenCalled();
|
||||
expect(f.readAuthority).not.toHaveBeenCalled();
|
||||
});
|
||||
it("retains requested-company restriction and does not grant other HTTP methods", async () => {
|
||||
const f = fixture(),
|
||||
restricted = {
|
||||
...body,
|
||||
requestedCompanyId: "33333333-3333-4333-8333-333333333333",
|
||||
};
|
||||
const result = await request(f.app)
|
||||
.post(dotPrincipalControlPath)
|
||||
.set(CLOUD_CONTROL_HEADER, f.assertion(restricted))
|
||||
.send(restricted);
|
||||
expect(result.status).toBe(400);
|
||||
expect(result.body).toEqual({ error: "invalid_grant" });
|
||||
const methods = fixture();
|
||||
expect(
|
||||
(
|
||||
await request(methods.app)
|
||||
.get(dotPrincipalControlPath)
|
||||
.set(CLOUD_CONTROL_HEADER, methods.assertion())
|
||||
).status,
|
||||
).toBe(405);
|
||||
expect(methods.authenticate).not.toHaveBeenCalled();
|
||||
expect(methods.readAuthority).not.toHaveBeenCalled();
|
||||
});
|
||||
it("rejects absent/foreign signatures before identity/OAuth", async () => {
|
||||
const f = fixture();
|
||||
for (const jws of [
|
||||
undefined,
|
||||
"invalid",
|
||||
f.assertion(body, {}, foreign.privateKey),
|
||||
]) {
|
||||
let sent = request(f.app).post(dotPrincipalControlPath);
|
||||
if (jws) sent = sent.set(CLOUD_CONTROL_HEADER, jws);
|
||||
expect((await sent.send(body)).status).toBe(401);
|
||||
}
|
||||
expect(f.authenticate).not.toHaveBeenCalled();
|
||||
expect(f.readAuthority).not.toHaveBeenCalled();
|
||||
});
|
||||
it("enforces raw wire/type/strict-body bounds before owner calls", async () => {
|
||||
const f = fixture(),
|
||||
jws = f.assertion();
|
||||
for (const value of [
|
||||
{ ...body, unknown: true },
|
||||
"{",
|
||||
{ ...body, accessToken: "x".repeat(17_000) },
|
||||
]) {
|
||||
const response = await request(f.app)
|
||||
.post(dotPrincipalControlPath)
|
||||
.set(CLOUD_CONTROL_HEADER, jws)
|
||||
.set("Content-Type", "application/json")
|
||||
.send(typeof value === "string" ? value : JSON.stringify(value));
|
||||
expect([400, 413]).toContain(response.status);
|
||||
}
|
||||
expect(
|
||||
(
|
||||
await request(f.app)
|
||||
.post(dotPrincipalControlPath)
|
||||
.set(CLOUD_CONTROL_HEADER, jws)
|
||||
.set("Content-Type", "text/plain")
|
||||
.send("body")
|
||||
).status,
|
||||
).toBe(415);
|
||||
expect((await request(f.app).post(dotPrincipalControlPath)
|
||||
.set(CLOUD_CONTROL_HEADER, jws).set("Content-Type", "application/json")
|
||||
.send(Buffer.from([0xff]))).status).toBe(400);
|
||||
expect((await request(f.app).post(dotPrincipalControlPath)
|
||||
.set(CLOUD_CONTROL_HEADER, jws).set("Content-Type", "application/json")
|
||||
.set("Content-Encoding", "gzip").send(gzipSync(JSON.stringify(body)))).status).toBe(400);
|
||||
expect(f.authenticate).not.toHaveBeenCalled();
|
||||
expect(f.readAuthority).not.toHaveBeenCalled();
|
||||
});
|
||||
it.each([
|
||||
{ instanceId: "foreign" },
|
||||
{ canonicalOrigin: "https://foreign.example.test" },
|
||||
])("rejects current namespace mismatch before OAuth: %j", async (value) => {
|
||||
const f = fixture();
|
||||
f.change(value);
|
||||
expect(
|
||||
(
|
||||
await request(f.app)
|
||||
.post(dotPrincipalControlPath)
|
||||
.set(CLOUD_CONTROL_HEADER, f.assertion())
|
||||
.send(body)
|
||||
).status,
|
||||
).toBe(503);
|
||||
expect(f.authenticate).not.toHaveBeenCalled();
|
||||
});
|
||||
it.each(["clientId", "userId", "companyId"] as const)(
|
||||
"preserves current OAuth principal %s restriction",
|
||||
async (field) => {
|
||||
const f = fixture();
|
||||
f.principal.grant[field] = "foreign";
|
||||
const response = await request(f.app)
|
||||
.post(dotPrincipalControlPath)
|
||||
.set(CLOUD_CONTROL_HEADER, f.assertion())
|
||||
.send(body);
|
||||
expect(response.status).toBe(400);
|
||||
expect(response.body).toEqual({ error: "invalid_grant" });
|
||||
expect(f.authenticate).toHaveBeenCalledTimes(1);
|
||||
},
|
||||
);
|
||||
it.each(["claimId", "instanceId", "signPrivateKey"] as const)(
|
||||
"fences %s rotation during actual helper await",
|
||||
async (field) => {
|
||||
const f = fixture();
|
||||
f.authenticate.mockImplementationOnce(async () => {
|
||||
f.change({ [field]: "replacement" });
|
||||
return f.principal;
|
||||
});
|
||||
expect(
|
||||
(
|
||||
await request(f.app)
|
||||
.post(dotPrincipalControlPath)
|
||||
.set(CLOUD_CONTROL_HEADER, f.assertion())
|
||||
.send(body)
|
||||
).status,
|
||||
).toBe(503);
|
||||
expect(f.authenticate).toHaveBeenCalledTimes(1);
|
||||
},
|
||||
);
|
||||
it("fences expiry after OAuth and preserves original owner rejection safely", async () => {
|
||||
const f = fixture();
|
||||
f.authenticate.mockImplementationOnce(async () => {
|
||||
f.expire();
|
||||
return f.principal;
|
||||
});
|
||||
expect(
|
||||
(
|
||||
await request(f.app)
|
||||
.post(dotPrincipalControlPath)
|
||||
.set(CLOUD_CONTROL_HEADER, f.assertion())
|
||||
.send(body)
|
||||
).status,
|
||||
).toBe(503);
|
||||
const other = fixture();
|
||||
other.authenticate.mockRejectedValueOnce(
|
||||
new McpOAuthError("invalid_grant", "private-detail"),
|
||||
);
|
||||
const response = await request(other.app)
|
||||
.post(dotPrincipalControlPath)
|
||||
.set(CLOUD_CONTROL_HEADER, other.assertion())
|
||||
.send(body);
|
||||
expect(response.body).toEqual({ error: "invalid_grant" });
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,135 @@
|
||||
import express, { Router, type RequestHandler } from "express";
|
||||
import { CLOUD_CONTROL_HEADER } from "../../services/cloud-runtime-identity.js";
|
||||
import {
|
||||
McpOAuthError,
|
||||
type PublicMcpOAuth,
|
||||
} from "../../services/public-mcp/oauth.js";
|
||||
import { readDotOriginalTokenPrincipal } from "./original-token-principal.js";
|
||||
import {
|
||||
dotPrincipalControlBodySchema,
|
||||
dotPrincipalControlPath,
|
||||
readDotPrincipalControlAuthority,
|
||||
sameDotPrincipalControlAuthority,
|
||||
verifyDotPrincipalControl,
|
||||
} from "./cloud-principal-authority.js";
|
||||
|
||||
const normalized = (path: string) =>
|
||||
(path.endsWith("/") ? path.slice(0, -1) : path).toLowerCase();
|
||||
export function isDotPrincipalControlPost(req: {
|
||||
method: string;
|
||||
path: string;
|
||||
}) {
|
||||
return (
|
||||
req.method === "POST" && normalized(req.path) === dotPrincipalControlPath
|
||||
);
|
||||
}
|
||||
export function dotPrincipalControlBodyParser(): RequestHandler {
|
||||
const raw = express.raw({
|
||||
type: "application/json",
|
||||
limit: "16kb",
|
||||
inflate: false,
|
||||
});
|
||||
return (req, res, next) => {
|
||||
if (!isDotPrincipalControlPost(req)) return next();
|
||||
if (!req.is("application/json")) {
|
||||
res.status(415).json({ error: "invalid_request" });
|
||||
return;
|
||||
}
|
||||
raw(req, res, (error) => {
|
||||
if (error) {
|
||||
res
|
||||
.status(error && typeof error === "object" && "status" in error && error.status === 413 ? 413 : 400)
|
||||
.json({ error: "invalid_request" });
|
||||
return;
|
||||
}
|
||||
next();
|
||||
});
|
||||
};
|
||||
}
|
||||
type DotPrincipalOAuth = Pick<
|
||||
PublicMcpOAuth,
|
||||
"mode" | "config" | "authenticate"
|
||||
>;
|
||||
export function dotPrincipalControlRoutes(
|
||||
oauth: DotPrincipalOAuth | null | (() => DotPrincipalOAuth | null),
|
||||
options: {
|
||||
readAuthority?: typeof readDotPrincipalControlAuthority;
|
||||
now?: () => Date;
|
||||
} = {},
|
||||
) {
|
||||
const router = Router(),
|
||||
readAuthority = options.readAuthority ?? readDotPrincipalControlAuthority,
|
||||
now = options.now ?? (() => new Date());
|
||||
router.use(async (req, res, next) => {
|
||||
if (normalized(req.path) !== dotPrincipalControlPath) return next();
|
||||
res.set("Cache-Control", "no-store");
|
||||
res.set("Referrer-Policy", "no-referrer");
|
||||
if (req.method !== "POST") {
|
||||
res
|
||||
.set("Allow", "POST")
|
||||
.status(405)
|
||||
.json({ error: "method_not_allowed" });
|
||||
return;
|
||||
}
|
||||
const compact = req.get(CLOUD_CONTROL_HEADER)?.trim();
|
||||
if (!compact) {
|
||||
res.status(401).json({ error: "invalid_cloud_control_assertion" });
|
||||
return;
|
||||
}
|
||||
let body: ReturnType<typeof dotPrincipalControlBodySchema.parse>;
|
||||
try {
|
||||
if (!Buffer.isBuffer(req.body) || req.body.length > 16_384)
|
||||
throw new Error();
|
||||
body = dotPrincipalControlBodySchema.parse(
|
||||
JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(req.body)),
|
||||
);
|
||||
} catch {
|
||||
res.status(400).json({ error: "invalid_request" });
|
||||
return;
|
||||
}
|
||||
let claims: ReturnType<typeof verifyDotPrincipalControl>;
|
||||
try {
|
||||
claims = verifyDotPrincipalControl(compact, body, now());
|
||||
} catch {
|
||||
res.status(401).json({ error: "invalid_cloud_control_assertion" });
|
||||
return;
|
||||
}
|
||||
const owner = typeof oauth === "function" ? oauth() : oauth;
|
||||
if (!owner) {
|
||||
res.status(503).json({ error: "temporarily_unavailable" });
|
||||
return;
|
||||
}
|
||||
try {
|
||||
const before = readAuthority();
|
||||
if (
|
||||
!before ||
|
||||
before.stackId !== claims.sub ||
|
||||
before.instanceId !== body.expectedInstanceId ||
|
||||
body.canonicalVerifiedResource !==
|
||||
before.canonicalOrigin + "/mcp/runner"
|
||||
)
|
||||
throw new Error();
|
||||
const principal = await readDotOriginalTokenPrincipal(owner, body);
|
||||
if (
|
||||
!sameDotPrincipalControlAuthority(before, readAuthority()) ||
|
||||
claims.exp * 1000 <= now().getTime()
|
||||
)
|
||||
throw new Error();
|
||||
res.json({
|
||||
version: 1,
|
||||
requestId: claims.requestId,
|
||||
stackId: before.stackId,
|
||||
instanceId: before.instanceId,
|
||||
canonicalOrigin: before.canonicalOrigin,
|
||||
principal,
|
||||
});
|
||||
} catch (error) {
|
||||
if (error instanceof McpOAuthError) {
|
||||
res.status(error.status).json({ error: error.code });
|
||||
return;
|
||||
}
|
||||
res.status(503).json({ error: "temporarily_unavailable" });
|
||||
}
|
||||
});
|
||||
return router;
|
||||
}
|
||||
@@ -0,0 +1,200 @@
|
||||
import { createServer, request as httpRequest } from "node:http";
|
||||
import { Writable } from "node:stream";
|
||||
import express from "express";
|
||||
import pino from "pino";
|
||||
import request from "supertest";
|
||||
import { describe, expect, it } from "vitest";
|
||||
import { createHttpLogger } from "../../middleware/logger.js";
|
||||
import { HTTP_LOG_REDACT_PATHS } from "../../middleware/http-log-redaction.js";
|
||||
import { isPrivateDotPrincipalHttpRequest } from "../../middleware/http-log-policy.js";
|
||||
|
||||
const bearer = "pcmcp_at_private_dot_log_canary";
|
||||
const assertion = "private-dot-jws-log-canary";
|
||||
const wire = Buffer.from(
|
||||
JSON.stringify({ accessToken: bearer, unexpected: assertion }),
|
||||
);
|
||||
|
||||
function hasByteCopy(value: unknown): boolean {
|
||||
if (!value || typeof value !== "object") return false;
|
||||
if (Array.isArray(value)) {
|
||||
return (
|
||||
(value.length > 0 && value.every((item) => typeof item === "number")) ||
|
||||
value.some(hasByteCopy)
|
||||
);
|
||||
}
|
||||
const object = value as Record<string, unknown>;
|
||||
return (
|
||||
object.type === "Buffer" ||
|
||||
Object.keys(object).some((key) => /^\d+$/.test(key)) ||
|
||||
Object.values(object).some(hasByteCopy)
|
||||
);
|
||||
}
|
||||
|
||||
const cases = [
|
||||
{ method: "POST", path: "/mcp/runner/oauth/cloud-principal", status: 200, mode: "plain" },
|
||||
{
|
||||
method: "POST",
|
||||
path: "/mcp/runner/oauth/cloud-principal",
|
||||
status: 401,
|
||||
mode: "plain",
|
||||
},
|
||||
{
|
||||
method: "POST",
|
||||
path: "/mcp/runner/oauth/cloud-principal/",
|
||||
status: 400,
|
||||
mode: "context",
|
||||
},
|
||||
{
|
||||
method: "GET",
|
||||
path: "/MCP/RUNNER/OAUTH/CLOUD-PRINCIPAL",
|
||||
status: 503,
|
||||
mode: "sdk",
|
||||
},
|
||||
{
|
||||
method: "DELETE",
|
||||
path:
|
||||
"http://upstream.invalid/mcp/runner/oauth/cloud-principal?token=" +
|
||||
bearer,
|
||||
status: 401,
|
||||
mode: "plain",
|
||||
},
|
||||
{
|
||||
method: "PUT",
|
||||
path: "/mcp/runner/oauth/cloud-principal%XX",
|
||||
status: 400,
|
||||
mode: "sdk",
|
||||
},
|
||||
{
|
||||
method: "PATCH",
|
||||
path: "/mcp/runner/oauth/%63loud-principal/",
|
||||
status: 503,
|
||||
mode: "context",
|
||||
},
|
||||
] as const;
|
||||
|
||||
describe("Dot private principal actual HTTP logger boundary", () => {
|
||||
it.each(cases)(
|
||||
"keeps $method $path $mode status$status content-free",
|
||||
async (entry) => {
|
||||
expect(isPrivateDotPrincipalHttpRequest(entry.path)).toBe(true);
|
||||
const chunks: string[] = [];
|
||||
const stream = new Writable({
|
||||
write(chunk, _encoding, callback) {
|
||||
chunks.push(chunk.toString());
|
||||
callback();
|
||||
},
|
||||
});
|
||||
const app = express();
|
||||
app.use(express.raw({ type: "*/*" }));
|
||||
app.use(
|
||||
createHttpLogger(pino({ redact: [...HTTP_LOG_REDACT_PATHS] }, stream)),
|
||||
);
|
||||
app.use((req, res) => {
|
||||
const sdkError = Object.assign(new Error(`${bearer} ${assertion}`), {
|
||||
name: assertion,
|
||||
request: { body: req.body, headers: { assertion } },
|
||||
response: { data: bearer },
|
||||
});
|
||||
if (entry.mode === "context") {
|
||||
Object.assign(res, {
|
||||
__errorContext: {
|
||||
error: sdkError,
|
||||
reqBody: req.body,
|
||||
reqParams: { private: bearer },
|
||||
},
|
||||
});
|
||||
}
|
||||
if (entry.mode !== "plain") Object.assign(res, { err: sdkError });
|
||||
res.setHeader("x-sdk-private", assertion);
|
||||
res.status(entry.status).end();
|
||||
});
|
||||
const server = createServer(app);
|
||||
await new Promise<void>((resolve) =>
|
||||
server.listen(0, "127.0.0.1", resolve),
|
||||
);
|
||||
try {
|
||||
const address = server.address();
|
||||
if (!address || typeof address === "string")
|
||||
throw new Error("Missing owned logger listener");
|
||||
await new Promise<void>((resolve, reject) => {
|
||||
const client = httpRequest(
|
||||
{
|
||||
hostname: "127.0.0.1",
|
||||
port: address.port,
|
||||
method: entry.method,
|
||||
path: entry.path,
|
||||
headers: {
|
||||
"content-type": "application/json",
|
||||
"content-length": String(wire.length),
|
||||
"x-paperclip-cloud-control": assertion,
|
||||
"x-sdk-private": bearer,
|
||||
},
|
||||
},
|
||||
(response) => {
|
||||
expect(response.statusCode).toBe(entry.status);
|
||||
response.resume();
|
||||
response.on("end", resolve);
|
||||
response.on("error", reject);
|
||||
},
|
||||
);
|
||||
client.on("error", reject);
|
||||
client.end(wire);
|
||||
});
|
||||
} finally {
|
||||
await new Promise<void>((resolve, reject) =>
|
||||
server.close((error) => (error ? reject(error) : resolve())),
|
||||
);
|
||||
}
|
||||
const output = chunks.join("");
|
||||
expect(output).not.toContain(bearer);
|
||||
expect(output).not.toContain(assertion);
|
||||
const logs = output
|
||||
.trim()
|
||||
.split("\n")
|
||||
.filter(Boolean)
|
||||
.map((line) => JSON.parse(line));
|
||||
expect(logs).toHaveLength(1);
|
||||
const log = logs[0];
|
||||
if (entry.status >= 400) expect(log.reqBody).toBe("[REDACTED]");
|
||||
else expect(log.reqBody).toBeUndefined();
|
||||
expect(log.req.url).toBe("/mcp/runner/oauth/cloud-principal");
|
||||
expect(log.req.body).toBeUndefined();
|
||||
expect(log.req.headers).toBeUndefined();
|
||||
expect(log.req.params).toBeUndefined();
|
||||
expect(log.req.query).toBeUndefined();
|
||||
expect(log.res.headers).toBeUndefined();
|
||||
expect(hasByteCopy(log)).toBe(false);
|
||||
if (entry.mode !== "plain") {
|
||||
expect(log.err.message).toBe("Dot principal request failed");
|
||||
expect(log.err.request).toBeUndefined();
|
||||
}
|
||||
},
|
||||
);
|
||||
|
||||
it.each(["/mcp/oauth/token", "/mcp/paperclip"])(
|
||||
"preserves existing MCP raw failure redaction at %s",
|
||||
async (path) => {
|
||||
const chunks: string[] = [];
|
||||
const stream = new Writable({
|
||||
write(chunk, _encoding, callback) {
|
||||
chunks.push(chunk.toString());
|
||||
callback();
|
||||
},
|
||||
});
|
||||
const app = express();
|
||||
app.use(express.raw({ type: "*/*" }));
|
||||
app.use(
|
||||
createHttpLogger(pino({ redact: [...HTTP_LOG_REDACT_PATHS] }, stream)),
|
||||
);
|
||||
app.use((_req, res) => res.status(400).end());
|
||||
await request(app)
|
||||
.post(path)
|
||||
.set("Content-Type", "application/json")
|
||||
.send(wire);
|
||||
const output = chunks.join("");
|
||||
expect(output).not.toContain(bearer);
|
||||
expect(JSON.parse(output.trim()).reqBody).toBe("[REDACTED]");
|
||||
expect(hasByteCopy(JSON.parse(output.trim()))).toBe(false);
|
||||
},
|
||||
);
|
||||
});
|
||||
@@ -1,3 +1,6 @@
|
||||
import type { RequestHandler, Router } from "express";
|
||||
import { dotPrincipalControlBodyParser, dotPrincipalControlRoutes, isDotPrincipalControlPost } from "./cloud-principal-http.js";
|
||||
|
||||
export { museExternalAgents } from "./muse.js";
|
||||
export { withExternalAdmissionGuard, withExternalExecutionAdmission, assertNoExternalOverlap, type ExternalAdmissionTransaction } from "./admission.js";
|
||||
|
||||
@@ -8,3 +11,11 @@ export { notifyExternalAgentSettlement, pendingMuseTerminalBindings, type Extern
|
||||
export { idleExternalAgentHistoryChecks } from "./idle-history-proof.js";
|
||||
|
||||
export { idleExternalAgentIncomingWorkQuery } from "./idle-incoming-proof.js";
|
||||
|
||||
export function createDotPrincipalHttp(oauth: Parameters<typeof dotPrincipalControlRoutes>[0]): {
|
||||
bodyParser: RequestHandler;
|
||||
matchesPost: (request: { method: string; path: string }) => boolean;
|
||||
router: Router;
|
||||
} {
|
||||
return { bodyParser: dotPrincipalControlBodyParser(), matchesPost: isDotPrincipalControlPost, router: dotPrincipalControlRoutes(oauth) };
|
||||
}
|
||||
@@ -0,0 +1,78 @@
|
||||
import { createHash, randomBytes, randomUUID } from "node:crypto";
|
||||
import express from "express";
|
||||
import request from "supertest";
|
||||
import { and, eq } from "drizzle-orm";
|
||||
import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
|
||||
import { applyPendingMigrations, createDb, closeRegisteredClients, companies, authUsers, mcpOauthGrants } from "@paperclipai/db";
|
||||
import { resolveExternalTestDatabaseUrl } from "../../lib/dedicated-test-database-url.js";
|
||||
import { accessService } from "../../services/access.js";
|
||||
import { instanceSettingsService } from "../../services/instance-settings.js";
|
||||
import { createMcpApiDispatch, createPublicMcpExecutor } from "../../services/public-mcp/capabilities.js";
|
||||
import { createPublicMcpOAuth } from "../../services/public-mcp/oauth.js";
|
||||
import { publicMcpIngressRoutes, publicMcpManagementRoutes } from "../../routes/public-mcp.js";
|
||||
import { errorHandler } from "../../middleware/error-handler.js";
|
||||
import { readDotOriginalTokenPrincipal } from "./original-token-principal.js";
|
||||
|
||||
const url=resolveExternalTestDatabaseUrl("PAPERCLIP_DOT_PRINCIPAL_LEAF_TEST_DATABASE_URL");
|
||||
const origin="https://dot-principal-leaf.example.test",resource=origin+"/mcp/runner";
|
||||
describe.skipIf(!url)("actual OAuth producer and original-token principal leaf; no Cloud transport",()=>{
|
||||
let db:ReturnType<typeof createDb>,app:express.Express,oauth:ReturnType<typeof createPublicMcpOAuth>;
|
||||
let companyId:string,otherCompanyId:string,userId:string,number=0,calls=0;
|
||||
beforeAll(async()=>{vi.stubEnv("PAPERCLIP_SECRETS_MASTER_KEY",randomBytes(32).toString("base64"));await applyPendingMigrations(url!);},90_000);
|
||||
afterAll(()=>{vi.unstubAllEnvs();});
|
||||
beforeEach(async()=>{
|
||||
db=createDb(url!,{maxConnections:2,applicationName:"dot-principal-current-leaf"});
|
||||
companyId=randomUUID();otherCompanyId=randomUUID();userId=randomUUID();number++;calls=0;
|
||||
await db.insert(companies).values([{id:companyId,name:"Dot principal leaf",issuePrefix:`DPL${number}`},{id:otherCompanyId,name:"Other principal leaf",issuePrefix:`DPO${number}`}]);
|
||||
await db.insert(authUsers).values({id:userId,name:"Selected user",email:userId+"@example.test",createdAt:new Date(),updatedAt:new Date()});
|
||||
await accessService(db).ensureMembership(companyId,"user",userId,"owner","active");
|
||||
await instanceSettingsService(db).updateExperimental({enablePublicMcp:true,enableOpenAiDot:true});
|
||||
oauth=createPublicMcpOAuth(db,{origin,resource});
|
||||
app=express();app.use(express.json());
|
||||
app.use((req,_res,next)=>{req.actor={type:"none",source:"none"};next();});
|
||||
const personal=createPublicMcpOAuth(db,{origin,resource:origin+"/mcp/paperclip"}),dispatch=createMcpApiDispatch(express.Router());
|
||||
app.use(publicMcpIngressRoutes(oauth,createPublicMcpExecutor(db,oauth,dispatch)));
|
||||
app.use((req,_res,next)=>{if(req.get("x-selected-operator")===userId)req.actor={type:"board",source:"session",userId,companyIds:[companyId],memberships:[{companyId,membershipRole:"owner",status:"active"}]};next();});
|
||||
app.use("/api",publicMcpManagementRoutes(personal,oauth));app.use(errorHandler);
|
||||
});
|
||||
afterEach(async()=>{if(db)await db.$client.end({timeout:1});if(url)await closeRegisteredClients(url,{scope:"database"});});
|
||||
async function issue(){
|
||||
const redirect="https://chatgpt.com/connector_platform/oauth/callback";
|
||||
const registration=await request(app).post("/mcp/runner/oauth/register").send({client_name:"Actual principal leaf",redirect_uris:[redirect],grant_types:["authorization_code","refresh_token"],response_types:["code"],token_endpoint_auth_method:"none"});
|
||||
expect(registration.status,JSON.stringify(registration.body)).toBe(201);
|
||||
const clientId=registration.body.client_id,verifier=randomBytes(48).toString("base64url");
|
||||
const start=await request(app).get("/mcp/runner/oauth/authorize").query({client_id:clientId,redirect_uri:redirect,response_type:"code",resource,scope:"paperclip:agent offline_access",code_challenge:createHash("sha256").update(verifier).digest("base64url"),code_challenge_method:"S256"});
|
||||
expect(start.status,JSON.stringify(start.body)).toBe(303);
|
||||
const id=new URL(start.headers.location,origin).pathname.split("/").at(-1)!;
|
||||
const consent=await request(app).post(`/api/mcp/requests/${id}/consent`).set("Origin",origin).set("x-selected-operator",userId).send({decision:"approve",companyId,allowWrites:false});
|
||||
expect(consent.status,JSON.stringify(consent.body)).toBe(200);
|
||||
const tokens=await request(app).post("/mcp/runner/oauth/token").send({grant_type:"authorization_code",client_id:clientId,redirect_uri:redirect,resource,code:new URL(consent.body.redirectUrl).searchParams.get("code"),code_verifier:verifier});
|
||||
expect(tokens.status,JSON.stringify(tokens.body)).toBe(200);
|
||||
const [grant]=await db.select().from(mcpOauthGrants).where(and(eq(mcpOauthGrants.companyId,companyId),eq(mcpOauthGrants.userId,userId),eq(mcpOauthGrants.clientId,clientId)));
|
||||
expect(grant).toMatchObject({companyId,userId,clientId,purpose:"agent",resource,agentId:null,revokedAt:null});expect(grant.scopes).toContain("paperclip:agent");
|
||||
return{clientId,token:tokens.body.access_token,refresh:tokens.body.refresh_token,grant};
|
||||
}
|
||||
function project(input:Parameters<typeof readDotOriginalTokenPrincipal>[1]){
|
||||
return readDotOriginalTokenPrincipal({mode:oauth.mode,config:oauth.config,authenticate:token=>{calls++;return oauth.authenticate(token);}},input);
|
||||
}
|
||||
it("projects a real unpaired grant once, refreshes it and rejects normal revocation",async()=>{
|
||||
const issued=await issue(),input={accessToken:issued.token,upstreamClientId:issued.clientId,selectingUserId:userId,canonicalVerifiedResource:resource,requestedCompanyId:companyId};
|
||||
expect(await project(input)).toEqual({userId,companyId,grantId:issued.grant.id,clientId:issued.clientId,resource,purpose:"agent"});expect(calls).toBe(1);
|
||||
const refresh=await request(app).post("/mcp/runner/oauth/token").send({grant_type:"refresh_token",client_id:issued.clientId,resource,refresh_token:issued.refresh});expect(refresh.status,JSON.stringify(refresh.body)).toBe(200);
|
||||
expect((await project({...input,accessToken:refresh.body.access_token})).grantId).toBe(issued.grant.id);expect(calls).toBe(2);
|
||||
const revoked=await request(app).post("/mcp/runner/oauth/revoke").send({client_id:issued.clientId,resource,token:refresh.body.refresh_token,token_type_hint:"refresh_token"});expect(revoked.status,JSON.stringify(revoked.body)).toBe(200);
|
||||
await expect(project({...input,accessToken:refresh.body.access_token})).rejects.toThrow();expect(calls).toBe(3);
|
||||
expect((await db.select().from(mcpOauthGrants).where(eq(mcpOauthGrants.id,issued.grant.id)))[0].revokedAt).not.toBeNull();
|
||||
},30_000);
|
||||
it("retains client, selecting-user, company, current membership and feature authority",async()=>{
|
||||
const issued=await issue(),input={accessToken:issued.token,upstreamClientId:issued.clientId,selectingUserId:userId,canonicalVerifiedResource:resource};
|
||||
for(const change of [{upstreamClientId:"foreign-client"},{selectingUserId:"foreign-user"},{requestedCompanyId:otherCompanyId}]){
|
||||
const before=calls;await expect(project({...input,...change})).rejects.toMatchObject({code:"invalid_grant"});expect(calls).toBe(before+1);
|
||||
}
|
||||
const before=calls;await expect(project({...input,canonicalVerifiedResource:origin+"/mcp/paperclip"})).rejects.toThrow();expect(calls).toBe(before);
|
||||
await accessService(db).ensureMembership(companyId,"user",userId,"owner","suspended");await expect(project(input)).rejects.toThrow();
|
||||
await accessService(db).ensureMembership(companyId,"user",userId,"owner","active");expect((await project(input)).grantId).toBe(issued.grant.id);
|
||||
await instanceSettingsService(db).updateExperimental({enableOpenAiDot:false});await expect(project(input)).rejects.toThrow();
|
||||
await instanceSettingsService(db).updateExperimental({enableOpenAiDot:true});expect((await project(input)).grantId).toBe(issued.grant.id);
|
||||
},30_000);
|
||||
});
|
||||
@@ -0,0 +1,38 @@
|
||||
import { describe, expect, it, vi } from "vitest";
|
||||
import { McpOAuthError, type McpPrincipal, type PublicMcpOAuth } from "../../services/public-mcp/oauth.js";
|
||||
import { readDotOriginalTokenPrincipal } from "./original-token-principal.js";
|
||||
|
||||
const origin="https://dot-principal.example.test",resource=origin+"/mcp/runner",token="original-access-boundary-input";
|
||||
const expected={accessToken:token,upstreamClientId:"actual-upstream-client",selectingUserId:"actual-user",canonicalVerifiedResource:resource};
|
||||
function boundary(){
|
||||
const principal:McpPrincipal={grant:{id:"actual-grant",companyId:"actual-company",userId:"actual-user",clientId:"actual-upstream-client",resource,purpose:"agent",agentId:null,scopes:["paperclip:agent","offline_access"],revokedAt:null,revocationRevision:0,revocationIndexReceipt:null,createdAt:new Date(0)},actor:{type:"none",source:"mcp_oauth",companyId:"actual-company"},company:{id:"actual-company",name:"Actual authenticated company",issuePrefix:"DOT",status:"active"}};
|
||||
const authenticate=vi.fn(async(_token:string)=>principal);
|
||||
const oauth:Pick<PublicMcpOAuth,"mode"|"config"|"authenticate">={mode:"openai_dot_agent",config:{origin,resource},authenticate};
|
||||
return{principal,oauth,authenticate};
|
||||
}
|
||||
describe("Dot original-token principal UNIT boundary; controlled authenticate, no real OAuth or PG",()=>{
|
||||
it("authenticates original access once and projects actual unpaired identity without execution or binding authority",async()=>{
|
||||
const f=boundary();expect(await readDotOriginalTokenPrincipal(f.oauth,expected)).toEqual({userId:"actual-user",companyId:"actual-company",grantId:"actual-grant",clientId:"actual-upstream-client",resource,purpose:"agent"});
|
||||
expect(f.authenticate).toHaveBeenCalledExactlyOnceWith(token);expect(f.principal.actor.type).toBe("none");expect(f.principal.grant.agentId).toBeNull();
|
||||
});
|
||||
it("requested company is optional restriction against actual grant company, not a replacement",async()=>{
|
||||
const f=boundary();await expect(readDotOriginalTokenPrincipal(f.oauth,{...expected,requestedCompanyId:"actual-company"})).resolves.toMatchObject({companyId:"actual-company"});expect(f.authenticate).toHaveBeenCalledExactlyOnceWith(token);
|
||||
const mismatch=boundary();await expect(readDotOriginalTokenPrincipal(mismatch.oauth,{...expected,requestedCompanyId:"stack-primary-company"})).rejects.toMatchObject({code:"invalid_grant"});expect(mismatch.authenticate).toHaveBeenCalledExactlyOnceWith(token);
|
||||
});
|
||||
it.each(["personal","muse_agent"] as const)("rejects %s owner mode before credential authentication",async mode=>{
|
||||
const f=boundary();await expect(readDotOriginalTokenPrincipal({...f.oauth,mode},expected)).rejects.toMatchObject({code:"invalid_grant"});expect(f.authenticate).not.toHaveBeenCalled();
|
||||
});
|
||||
it.each(["https://foreign.example.test/mcp/runner",origin+"/mcp/paperclip",resource+"?resource=other","not-an-origin"])("rejects nonmatching current canonical resource %s",async canonicalVerifiedResource=>{
|
||||
const f=boundary();await expect(readDotOriginalTokenPrincipal(f.oauth,{...expected,canonicalVerifiedResource})).rejects.toMatchObject({code:"invalid_grant"});expect(f.authenticate).not.toHaveBeenCalled();
|
||||
});
|
||||
it.each(["origin","resource"] as const)("rejects configured %s mismatch before authenticating",async field=>{
|
||||
const f=boundary();await expect(readDotOriginalTokenPrincipal({...f.oauth,config:{...f.oauth.config,[field]:"https://foreign.example.test"}},expected)).rejects.toMatchObject({code:"invalid_grant"});expect(f.authenticate).not.toHaveBeenCalled();
|
||||
});
|
||||
it.each(["clientId","userId","companyId","resource","purpose","scope"] as const)("rejects authenticated %s mismatch after exactly one owner call",async field=>{
|
||||
const f=boundary();if(field==="purpose")f.principal.grant.purpose="personal";else if(field==="scope")f.principal.grant.scopes=["paperclip:read"];else f.principal.grant[field]="foreign";
|
||||
await expect(readDotOriginalTokenPrincipal(f.oauth,expected)).rejects.toMatchObject({code:"invalid_grant"});expect(f.authenticate).toHaveBeenCalledExactlyOnceWith(token);
|
||||
});
|
||||
it.each(["feature-disabled","expired-access","revoked-grant","removed-membership","operator-denied"])("propagates actual owner rejection unchanged: %s (controlled unit, not real lifecycle proof)",async reason=>{
|
||||
const f=boundary(),failure=new McpOAuthError("invalid_grant",reason);f.authenticate.mockRejectedValueOnce(failure);await expect(readDotOriginalTokenPrincipal(f.oauth,expected)).rejects.toBe(failure);expect(f.authenticate).toHaveBeenCalledExactlyOnceWith(token);
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,32 @@
|
||||
import { McpOAuthError, type PublicMcpOAuth } from "../../services/public-mcp/oauth.js";
|
||||
|
||||
type DotOAuthPrincipalOwner = Pick<PublicMcpOAuth, "mode" | "config" | "authenticate">;
|
||||
export interface DotOriginalTokenPrincipal {
|
||||
userId: string;
|
||||
companyId: string;
|
||||
grantId: string;
|
||||
clientId: string;
|
||||
resource: string;
|
||||
purpose: "agent";
|
||||
}
|
||||
export async function readDotOriginalTokenPrincipal(oauth: DotOAuthPrincipalOwner, input: {
|
||||
accessToken: string;
|
||||
upstreamClientId: string;
|
||||
selectingUserId: string;
|
||||
canonicalVerifiedResource: string;
|
||||
requestedCompanyId?: string;
|
||||
}): Promise<DotOriginalTokenPrincipal> {
|
||||
const deny = () => new McpOAuthError("invalid_grant", "Dot connection authority does not match the selected request.");
|
||||
let origin: string;
|
||||
try { origin = new URL(input.canonicalVerifiedResource).origin; } catch { throw deny(); }
|
||||
if (oauth.mode !== "openai_dot_agent" || input.canonicalVerifiedResource !== origin + "/mcp/runner"
|
||||
|| oauth.config.origin !== origin || oauth.config.resource !== input.canonicalVerifiedResource) throw deny();
|
||||
const { grant, company } = await oauth.authenticate(input.accessToken);
|
||||
if (grant.purpose !== "agent" || !grant.scopes.includes("paperclip:agent")
|
||||
|| !grant.id || !grant.companyId || company.id !== grant.companyId
|
||||
|| !input.upstreamClientId || grant.clientId !== input.upstreamClientId
|
||||
|| !input.selectingUserId || grant.userId !== input.selectingUserId
|
||||
|| grant.resource !== input.canonicalVerifiedResource
|
||||
|| input.requestedCompanyId !== undefined && grant.companyId !== input.requestedCompanyId) throw deny();
|
||||
return { userId: grant.userId, companyId: grant.companyId, grantId: grant.id, clientId: grant.clientId, resource: grant.resource, purpose: "agent" };
|
||||
}
|
||||
Reference in new issue
Block a user