Jannik/PaperClipAI
1
0 Fork 0
mirror of https://github.com/paperclipai/paperclip.git synced 2026-11-12 06:10:44 +01:00
Code Issues Packages Projects Releases Wiki Activity
Files
42bc238aa5a1208cabecba76773e0500fcd33959
PaperClipAI/maps/agent-access-map/assistant-connections.md
T
Dotta 3112e4c955 Verify original Dot OAuth authority for signed Cloud requests (#19819) 
## Thinking Path

> - Paperclip manages AI agents and their work.
> - Dot uses a user OAuth grant to act in one company.
> - Cloud must use that original grant when it resolves a selected
user's identity.
> - A Cloud signature alone must not create user or board authority.
> - The tenant's OAuth owner must check the token and its current
restrictions.
> - This pull request adds a signed private HTTP boundary for that
check.
> - The result contains only the checked identity fields. It grants no
task or board access.

## Linked Issues or Issue Description

**Subsystem affected**

Server external-agent identity, public MCP OAuth, Cloud control
verification, and HTTP logging.

**Problem or motivation**

Cloud needs a private way to resolve the original Dot token for the
selected user, client, company and resource. The existing generic Cloud
control route creates an operator actor. That route is not the right
owner for this identity check.

**Proposed solution**

Add `POST /mcp/runner/oauth/cloud-principal`. Require the existing Cloud
signature and replay verifier. Bind the whole request to a new, closed
`mcp-dot:principal` action with a maximum 60-second lifetime.
Authenticate the original token once through the normal Dot OAuth owner.
Check current namespace authority before and after that call.

**Alternatives considered**

A Cloud-created grant or a board actor would change the authority owner.
Neither is used. The private route reuses the existing OAuth and Cloud
identity owners.

**Roadmap alignment**

This is a narrow boundary for the existing MCP and Cloud areas in
`ROADMAP.md`. It adds no work queue, public hosted profile, or provider
enablement.

Related public work: Refs #14846, #19427, #19750 and #19776. Searches
for the exact private path and action found no duplicate PR. The
matching private Cloud caller has merged. The current App head passed
its required checks and review.

## What Changed

- Add an original-token principal reader. Keep the original client,
selected user, company, resource, purpose, scope, membership and feature
restrictions.
- Add a 16 KiB raw JSON private route. Reject compressed, invalid UTF-8,
malformed and unknown-field bodies. Bind an ordered whole-body digest to
the signature and existing nonce fence.
- Compare the current stack, claim, instance, origin and connector
identity before and after OAuth. An absent owner or namespace fails
closed.
- Mount the route in normal `createApp` after hostname, runtime-claim
and standby checks, before session/actor work. Do not add it to generic
board-control routing.
- Keep private request and response logs content-free, including raw
buffers, headers, query data and reflected errors.
- Add controlled HTTP/privacy tests and a real normal-App
OAuth/Cloud-signer integration case. Document the machine-only contract
and correct the existing `assistant-connections/client-use` access
entry. No new capability ID or agent API entry is added. No schema,
lockfile, workflow, Runner, Muse or useful-task fixture changes belong
to this PR.

## Verification

- Current `70c03593`: normal module-boundary policy and all seven App
compiler programs passed. The public module factory has an explicit
portable Express return contract. Whole HTTP/log controls passed again:
30/30. The existing real paired OAuth/Cloud-signer/private HTTP case
then passed again on a fresh PostgreSQL fixture: 1/1, zero skipped. All
known child processes and five database connections closed; the final
independent SQL audit was empty.
- The original remote policy failure rejected an App import of a
module-internal path; dependent E2E/verify gates stopped on that
failure. The fix delegates through the public module API. A first local
declaration run reported TS2883 for its inferred return type; the
explicit public type fixed it. Original logs remain preserved. No
checker, compiler option, test body or authority check was weakened.

- The normal full App graph passed on the integrated source. The later
fixture-only repairs each passed the complete affected owning
program:405 entries, including 403 source roots. The remaining programs
and own dependency outputs carried only where their source was exact.
- Whole private HTTP/log files passed:30 tests, zero failures or skips.
The HTTP controls use a controlled OAuth owner with real signatures. The
log controls use the actual HTTP logger.
- The paired Cloud source passed its normal strict build and whole 26
signer/client/namespace and credential-error controls. These are
controlled caller tests, not provider tests.
- One normal-App paired case passed with a dedicated PostgreSQL
database. It used real DCR 201, PKCE, consent, token exchange and a
persisted unpaired grant; actual signed metadata publication and a
committed Cloud receipt; the real Cloud signer/client and actual App
HTTP; exactly-once authentication; refresh; current namespace
restrictions; and revocation. The Cloud registry/provider were the
existing controlled in-memory/Fake fixtures. Recorded inbound Hosts
matched, with zero metadata overflow. No grant, readiness or mirror ACK
was fabricated.
- The original principal helper's 21 controlled tests and two real-OAuth
tests passed before the HTTP slice. Those three files remained unchanged
through integration. They are separate source-scoped evidence, not an
extra combined run.
- Preserved failures: a helper import and test typing error were
corrected before the passed checks. An earlier suite failure did not
serialize its hook error and remains unexplained. Later runs captured a
missing normal managed-config initialization and HTTP 404 from the
loopback mapper. The fixture now calls the normal initialization owners
and uses the existing Host-preserving canonical HTTP adapter. All
original authority assertions and deadlines remain.
- Reproduce the local files with `pnpm --filter @paperclipai/server exec
vitest run src/modules/external-agents/cloud-principal-http.test.ts
src/modules/external-agents/cloud-principal-log.test.ts --maxWorkers=1
--no-file-parallelism`. The real integration file is
`server/src/__tests__/cloud-principal-normal-app.postgres.test.ts`; it
requires its explicit dedicated test DB and an own compiled matching
Cloud checkout.
- The normal `node scripts/check-maps.mjs` check passed for 35 areas and
192 capability IDs. This validates map structure, not business
acceptance. The later edits are documentation/map only; all executed
business source and own outputs from the paired case remained exact.
- Current-head remote CI passes: 59 successful checks and three
intentional skips. Greptile reviewed this exact head at 5/5 with no
findings or review threads. The prior Ponytail review was Ship 5/5 at
the earlier head; no current-head Ponytail turn is present, which is
nonblocking under the authorized review policy. The three
full-repository commands were not repeated locally; the focused normal
App graph and affected tests above passed, and required remote CI
supplies the broad gates. No deployed, provider-capacity, cold-wake or
full hosted lifecycle result is claimed.

## Risks

- This is a security boundary. Signature, current namespace and original
OAuth restrictions must continue to fail closed. The response gives
identity only; callers still need normal operation authority.
- The request carries the original token. The reserved route uses a
closed log projection on both accepted and refused requests. Privacy
regressions remain a material risk.
- Both repositories must agree on the action and digest contract. Older
code rejects the unsupported action; no fallback creates authority.
- This is a prerequisite private boundary. The remaining hosted
discovery, wake, capability, operation, event, retry/reactivation and
revocation lifecycle work, plus Muse, remains open. No profile or
capability is enabled here.
- No migration is needed. Rollback removes the private boundary and
paired caller; normal OAuth and Personal MCP remain with their existing
owners.
- The engineering documentation describes this private machine boundary
and its access restriction. No operator-facing feature is enabled.
Documentation for full hosted enablement remains with that later work.

## Model Used

OpenAI `gpt-6.1-sol` (Sol6.1), through Codex, produced the source and
tests with tool use and local compiler/test execution. A GPT-6-based
Codex coordinator reviewed the work. Its exact model ID is unavailable.
Context window sizes are unavailable.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
2026-11-07 08:02:42 -06:00

102 lines
10 KiB
Markdown
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
# Assistant connections (MCP) — agent access
Product map: [Assistant connections (MCP)](../feature-map/assistant-connections.md).
Feature ID: `assistant-connections`.
This is a source-reviewed baseline of the public assistant connection boundary.
The records distinguish a personal assistant acting as its consenting human from
an ordinary Paperclip agent. Review and execute each listed operation before
qualifying the complete capability. No live client, consent, or authorization
proof is claimed. Follow the [map contract](../README.md).
## `setup`
Capability ID: `assistant-connections/setup`.
Review: `baseline`.
API: `present` — GET /api/mcp/setup for authenticated setup metadata; GET /mcp/setup and GET /mcp/setup.md for enabled public instructions.
Agent access: `restricted` — an external assistant can read enabled public setup instructions, but authenticated setup management requires a signed-in human session/cloud_tenant source. A Paperclip agent, personal MCP bearer, local implicit board, or human board bearer does not supply that browser identity.
Policy: The instance enablePublicMcp gate and configured MCP/authorization origin govern public setup and transport. Authenticated management requires an actual board user from session or cloud_tenant. The copied company hint does not grant membership, scopes, or execution authority. HTTPS is required apart from the defined loopback development exception.
Evidence: `source-only` — reviewed at `9ef434fe79c57d976b8b03b14c5242db270b8320`. [Apps setup](../../ui/src/pages/apps/AssistantConnection.tsx), [public MCP routes](../../server/src/routes/public-mcp.ts), and [origin/gate policy](../../server/src/services/public-mcp/oauth.ts).
Verification: `not-run` — Inspect the invitation/resource/company from a permitted browser, then exercise a remote authorized client call only after separate consent. Reject unsupported management identities and check disabled/unconfigured setup without exposing secrets. Do not count copied instructions as a completed connection.
Gaps: No ordinary-agent self-consent or management path is established. Published plugin distribution, each client’s installation, and hosted interoperability require their own qualification.
## `consent`
Capability ID: `assistant-connections/consent`.
Review: `baseline`.
API: `present` — POST /mcp/oauth/register; GET /mcp/oauth/authorize; GET /api/mcp/requests/{id}; POST /api/mcp/requests/{id}/consent; POST /mcp/oauth/token with authorization-code exchange.
Agent access: `restricted` — a public client can initiate registration/authorization, but the approval belongs to the real signed-in human. Ordinary agent REST/native call_api cannot manufacture a human session or browser origin to approve itself.
Policy: Public-client authorization uses S256 PKCE, exact callback/resource binding, configured origin, and the live experimental gate. Browser consent requires the authenticated session/cloud_tenant human and a matching configured Origin/Referer. Approval requires active membership in the selected unarchived company; a company hint pins selection. A viewer may approve read only. Granted scopes must be requested and explicitly accepted, and subsequent domain operations retain the person’s current permissions.
Evidence: `source-only` — reviewed at `9ef434fe79c57d976b8b03b14c5242db270b8320`. [Public MCP routes](../../server/src/routes/public-mcp.ts), [OAuth policy](../../server/src/services/public-mcp/oauth.ts), and [consent/device UI](../../ui/src/pages/McpConnect.tsx).
Verification: `not-run` — Complete an actual client/browser authorization-code exchange and verify exact person/company/scopes by a remote tool call. Decline or expire another request; reject wrong company/origin/callback/resource/PKCE and scope escalation. A board request without the real consent identity is not acceptance evidence.
Gaps: Source fixtures establish the protocol boundary, not compatibility of every assistant/client callback or hosted signup path. Actual denied/expired browser and client states remain not run.
## `device-login`
Capability ID: `assistant-connections/device-login`.
Review: `baseline`.
API: `present` — POST /mcp/oauth/device_authorization; GET /api/mcp/device with user_code; POST /api/mcp/device/consent; POST /mcp/oauth/token with the device grant.
Agent access: `restricted` — the device flow lets a configured client wait for human authorization. Its CLI transport does not let a Paperclip agent approve the browser decision or reuse another person’s saved credential.
Policy: Human consent retains the same company membership, viewer/read-only, requested scope, browser-origin, resource, and gate constraints as browser consent. Codes expire and are single-use; polling backoff is persisted. The CLI validates issuer/resource and requires the verification URI at the issuer’s /mcp-device, so its current journey needs matching MCP and authorization origins. It calls paperclip_connection to confirm the approved company before accepting working credentials.
Evidence: `source-only` — reviewed at `9ef434fe79c57d976b8b03b14c5242db270b8320`. [Public MCP routes](../../server/src/routes/public-mcp.ts), [OAuth policy](../../server/src/services/public-mcp/oauth.ts), and [consent/device UI](../../ui/src/pages/McpConnect.tsx). [MCP commands](../../cli/src/commands/mcp.ts) and [device/credential client](../../cli/src/client/mcp-auth.ts).
Verification: `not-run` — Complete one real terminal/browser request with explicit company, inspect the approved remote identity, and reuse the saved credential for a bounded read. Reject mistyped/denied/expired/replayed codes, wrong issuer/resource/company, and excess polling without saving an unauthorized credential.
Gaps: Separate authorization-origin support for the CLI is unqualified; the server can return a verification URI that the current CLI rejects. No live CLI device/stdio journey was executed. A credential-transport unit test or local proxy initialization is not proof that the waiting client was authorized.
## `client-use`
Capability ID: `assistant-connections/client-use`.
Review: `baseline`.
API: `present` — POST /mcp/paperclip for MCP tools/list and tools/call. Supported modern request transport also includes server/discover and events/list, events/subscribe, and events/unsubscribe; these are protocol operations, not arbitrary REST endpoints. The private POST /mcp/runner/oauth/cloud-principal identity check is machine-only Cloud control, not an agent entry point.
Agent access: `available` — a configured external MCP client or the supported CLI proxy acts through the authorizing human’s grant. Each Paperclip native/remote run still needs its own actual admitted client/binding; a personal assistant connection is not automatically an agent tool or credential.
Policy: Every remote call rechecks the experimental gate, resource/client/grant/token status, expiration/revocation, human/company/membership status, scopes, and underlying domain permissions for exactly one company. The public paperclip_call_api tool permits only enumerated capabilities. An MCP bearer cannot authenticate as an ordinary REST board user or agent, and the grant confers no instance-administrator authority. The proxy does not automatically retry writes. The private original-token check requires the existing signed Cloud action, current namespace and the original Dot OAuth restrictions; it creates no board actor or operation permission. See the [private authority contract](../../doc/public-mcp.md#private-dot-original-token-authority).
Evidence: `source-only` — reviewed at `9ef434fe79c57d976b8b03b14c5242db270b8320`. [MCP capabilities](../../server/src/services/public-mcp/capabilities.ts), [per-call authorization](../../server/src/services/public-mcp/oauth.ts), [public MCP routes](../../server/src/routes/public-mcp.ts), and [stdio proxy](../../cli/src/commands/mcp.ts).
Verification: `not-run` — Prove remote identity, a permitted read and separately authorized additive write with persisted attribution. Assert private/foreign resources, missing write scope, arbitrary call_api operations, disabled gate, membership loss, and misuse of the MCP bearer at ordinary REST. Check actual client discovery rather than a declared scenario tool.
Gaps: Modern event/discovery interoperability, each external client, and all allowlisted capabilities need their own live proof. Local initialize/ping results are not evidence of remote authorization or execution.
## `revocation`
Capability ID: `assistant-connections/revocation`.
Review: `baseline`.
API: `present` — GET /api/mcp/connections; DELETE /api/mcp/connections/{id}; POST /mcp/oauth/revoke for client/token/resource-bound OAuth revocation.
Agent access: `restricted` — browser management lists/revokes the real signed-in person’s grants. Ordinary agent/local-implicit/MCP bearer identities cannot use that human-management API; a client can revoke only a correctly bound OAuth token.
Policy: Management requires the session/cloud_tenant board user; mutations require the configured browser origin. List/delete are restricted to the current person. Another person’s ID can be a silent no-op. OAuth revocation binds token, client, and resource. Human list/revoke management remains available while enablePublicMcp is off, though remote tool calls do not. Already-delegated work retains its ordinary task lifecycle.
Evidence: `source-only` — reviewed at `9ef434fe79c57d976b8b03b14c5242db270b8320`. [Connection management](../../ui/src/pages/McpConnect.tsx), [Apps management](../../ui/src/pages/apps/AssistantConnection.tsx), [management routes](../../server/src/routes/public-mcp.ts), and [grant ownership/revocation](../../server/src/services/public-mcp/oauth.ts).
Verification: `not-run` — Make a remote read succeed, revoke as the grant owner, and reject the same credential afterward. Check persisted list state, another person’s untouched grant, membership loss, disabled transport with reachable management, and OAuth token/client/resource binding. Verify task cancellation separately if required.
Gaps: Revocation is not remote-provider termination or task cancellation. The account-wide management page lacks the component coverage named by the current-company recipe. No ordinary-agent delegated human-management path or live client revocation proof is claimed.
Reference in new issue View Git Blame Copy Permalink