23c4e63a68
An independent model reviewed the MCP and OAuth surfaces. All five findings were verified against the code before changing anything; none were false positives. audit.md is kept as the record of what was reviewed. F1 (High) - refresh reuse detection forgot the token family. Only the current hash and one predecessor lived on the grant, and each rotation overwrote the predecessor. A thief who rotated a stolen token twice made the victim's original unrecognisable: replaying it returned "unknown token" instead of revoking the family, and the thief kept working. Refresh tokens are now rows in OAuthRefreshToken, one per generation, retained for the life of the family and consumed by a guarded update on usedAt - which also means two concurrent uses of the same token can no longer both succeed. This corrects a claim I made when the OAuth server shipped: reuse detection covered one generation, not the family. F2 (Medium) - issueAccessToken wrote scopes back onto the grant, so redeeming a stale authorization code redefined standing consent. Token issuance is not consent; the consent endpoint is now the only writer. Codes are additionally bound to a grant id and epoch, with a coversScopes check behind that. F3 (Medium) - revocation was reversible. Reconnecting a disconnected app cleared revokedAt and left credentials that had raced the revoke usable again. Every approval now starts a clean epoch: the counter advances and prior access tokens, refresh tokens and unconsumed codes are destroyed. Token writes are conditional on the epoch they validated, so a revoke that wins a race aborts them. Refresh also now requires offline_access to still be granted. F4 (Medium) - loopback redirect matching compared only scheme, host and path, silently accepting a differing query, fragment or userinfo. RFC 9700 2.1 wants exact matching apart from the RFC 8252 port exception; that is what it does now. F5 (Low) - get_collection_stats returned bar and recipe counts under drinks:read. Gated on the caller actually holding bar:read. Verified with regression tests for each: the two-rotation attack now revokes the family, concurrent refresh yields exactly one winner, a pre-narrowing code is refused, disconnect-reconnect leaves old credentials dead, and Claude Code's ephemeral-port callback still works while query/userinfo/fragment variants are rejected. Existing protections re-checked - code replay, PKCE mismatch, deny, confidential-client rejection, and the MCP tools themselves. Note for deploy: OAuthAuthCode gains a required grantId, so existing rows must be cleared first. They are 60-second ephemeral codes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01W1Ee4Mc1X1SX8HgYa52zu7
20 KiB
20 KiB