Altinity / altinity-mcp / 25869800703

77%

Build Type

push

github

Committed by BorisTyshkevich

Commit Message

oauth: normalize Google URI-form scopes + strict OIDC scope advertisement

ChatGPT renders a cosmetic "permissions not granted" warning when its requested
scope (openid email profile) doesn't byte-match the response scope. Google's
/oauth/token emits the OIDC-identity scopes in URI form
(https://www.googleapis.com/auth/userinfo.email instead of email), which our
broker echoed back verbatim. The mismatch is purely shape; the identity claims
are present and the connector works, but the warning erodes trust.

Two helpers in oauth_server.go centralise the fix:

- normalizeUpstreamScopeForClient maps the three Google OIDC URI aliases back
  to standard names (openid/email/profile). Applied at /oauth/token responses
  for the authorization-code grant and the forward-mode refresh grant.
  Upstream-stored scope (oauthIssuedCode.Scope, refresh-JWE claims) keeps
  Google's original form so subsequent upstream refresh calls hit Google with
  the same string Google returned.

- oidcScopesForAdvertisement is an explicit allowlist
  (openid/email/profile/offline_access) applied to every site where MCP
  surfaces scopes to clients: protected-resource doc, AS metadata,
  openid-configuration, the DCR registration response, and the
  WWW-Authenticate challenge. Filters out URI-form upstream scopes and
  arbitrary resource-server scopes (mcp:read, calendar.list, …) that aren't
  exercised in altinity-mcp today (RequiredScopes is empty in every helm
  values file). Auth0 deployments keep offline_access for the refresh-token
  gate; Google deployments naturally omit it (Google uses access_type=offline
  param, not a scope).

When scope-based tool authorization is added, extend the allowlist explicitly.

TestNormalizeUpstreamScopeForClient + TestOidcScopesForAdvertisement cover
URI mapping, dedup, order preservation, and the empty/passthrough/filter cases.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Coverage Stats

67 of 77 new or added lines in 1 file covered. (87.01%)

316 existing lines in 3 files now uncovered.

4733 of 5814 relevant lines covered (81.41%)

1.19 hits per line