src/dcr.ts

Functions

Imports

It imports src/env.ts, src/http.ts, src/log.ts, src/rate-limit.ts, src/signed-requests.ts. Imported by src/index.ts.

Source

1import type { Env } from "./env";
2import { readBoundedText } from "./signed-requests";
3import { callerIp, checkRate, type RateLimitPolicy } from "./rate-limit";
4import { logEvent } from "./log";
5import { jsonResponse } from "./http";
6
7// Tightened Dynamic Client Registration.
8// Claude, Claude Code and ChatGPT sign in by Client ID Metadata Document. Grok and
9// Gemini still need DCR as of 2026-10-09, so POST /register is back, tightened:
10//
11//   - every redirect URI a registration names is on the allowlist, matched exactly;
12//   - registration grants nothing: it writes a client record and no grant or token. The
13//     client still meets the per-client consent page on its first /authorize (the
14//     approval is bound to the client id and its redirect set, src/approval.ts) and the
15//     Access sign-in that admits ADMIN_EMAIL and CO_OWNER_EMAILS only;
16//   - registration is rate limited per caller, and fails closed when the limit cannot
17//     be read.
18//
19// REMOVAL CONDITION: delete this module, its gate in src/index.ts and the provider's
20// clientRegistrationEndpoint when Grok and Gemini both sign in by CIMD, and at the
21// latest when the MCP specification removes DCR (after summer 2027).
22//
23// It runs in the Worker's fetch before the OAuth provider, because the provider's
24// registration callback is not handed env, and the allowlist's per-connector part and
25// the rate limit's KV live there. This gate is the one place a registration is judged.
26
27export const REGISTER_PATH = "/register";
28
29// The callbacks that are the same for every user, matched exactly.
30//   Grok: its custom connector callback.
31//   ChatGPT: the connector platform's legacy callback, which OpenAI still honours.
32export const FIXED_REDIRECTS: readonly string[] = [
33  "https://grok.com/connectors/oauth/callback",
34  "https://chatgpt.com/connector_platform_oauth_redirect",
35];
36
37// Google's (Gemini's) callback and ChatGPT's current one carry an id per connector, so
38// they cannot be written down here. The seat lists the exact URIs, comma separated, in
39// the DCR_REDIRECT_URIS var. Each must have one of these shapes, so a typo or a
40// stray host in the var cannot widen the list; a listed URI of any other shape is
41// ignored and logged. A pattern is never matched against a registration: only the
42// exact listed strings are.
43const PER_CONNECTOR_SHAPES: readonly RegExp[] = [
44  /^https:\/\/oauth-redirect\.googleusercontent\.com\/r\/user_bound_custom-mcp-[A-Za-z0-9._-]+$/,
45  /^https:\/\/chatgpt\.com\/connector\/oauth\/[A-Za-z0-9_-]+$/,
46];
47
48export function allowedRedirects(env: Pick<Env, "DCR_REDIRECT_URIS">): Set<string> {
49  const allowed = new Set(FIXED_REDIRECTS);
50  for (const raw of (env.DCR_REDIRECT_URIS ?? "").split(",")) {
51    const uri = raw.trim();
52    if (!uri) continue;
53    if (PER_CONNECTOR_SHAPES.some((shape) => shape.test(uri))) allowed.add(uri);
54    else logEvent("error", "DCR_REDIRECT_IGNORED", { message: `DCR_REDIRECT_URIS names ${uri}, which is not a Google or ChatGPT connector callback; it is not allowed` });
55  }
56  return allowed;
57}
58
59// A real registration is a few hundred bytes of JSON.
60const REGISTER_MAX_BYTES = 16_384;
61
62// Ten an hour and thirty a day from one address. A client registers once per
63// connection, so a person connecting four clients never comes near it.
64export const DCR_LIMIT: RateLimitPolicy = {
65  prefix: "dcr:rate:",
66  perHour: 10,
67  perDay: 30,
68  label: "DCR",
69  // Fail closed: an unmeasured limit is no limit on an unauthenticated write.
70  onUnavailable: "refuse",
71};
72
73// Never cached, like every other answer (src/http.ts): a registration refusal was the one without no-store.
74function refusal(status: number, error: string, description: string, headers: Record<string, string> = {}): Response {
75  return jsonResponse({ error, error_description: description }, status, headers);
76}
77
78// What the provider should see: the same request with the body this gate read, or the
79// refusal. Only POST /register reaches here (src/index.ts).
80export async function gateRegistration(request: Request, env: Env, now: Date): Promise<{ forward: Request } | { refuse: Response }> {
81  const rate = await checkRate(env.APP_KV, callerIp(request), now, DCR_LIMIT);
82  if (!rate.allowed) {
83    if (rate.window === "unavailable") {
84      return { refuse: refusal(503, "temporarily_unavailable", "client registration is refused while its rate limit cannot be read", { "Retry-After": "60" }) };
85    }
86    return {
87      refuse: refusal(429, "slow_down", `too many registrations: ${rate.count} in the last ${rate.window}, limit ${rate.limit}`, {
88        "Retry-After": rate.window === "hour" ? "3600" : "86400",
89      }),
90    };
91  }
92
93  const bounded = await readBoundedText(request, REGISTER_MAX_BYTES);
94  if (!bounded.ok) return { refuse: refusal(413, "invalid_client_metadata", `the registration body is over ${REGISTER_MAX_BYTES} bytes`) };
95  let metadata: unknown;
96  try {
97    metadata = JSON.parse(bounded.text);
98  } catch {
99    return { refuse: refusal(400, "invalid_client_metadata", "the registration body is not JSON") };
100  }
101  const redirects = (metadata as { redirect_uris?: unknown } | null)?.redirect_uris;
102  if (!Array.isArray(redirects) || redirects.length === 0 || !redirects.every((u) => typeof u === "string")) {
103    return { refuse: refusal(400, "invalid_redirect_uri", "redirect_uris must be a non-empty array of strings") };
104  }
105  const allowed = allowedRedirects(env);
106  const unlisted = (redirects as string[]).filter((u) => !allowed.has(u));
107  if (unlisted.length > 0) {
108    logEvent("error", "DCR_REDIRECT_REFUSED", { message: `DCR_REDIRECT_REFUSED ${unlisted.join(" ")}` });
109    return {
110      refuse: refusal(
111        400,
112        "invalid_redirect_uri",
113        `not an allowed redirect URI: ${unlisted.join(", ")}. This server registers only the Grok, Gemini and ChatGPT connector callbacks it lists; other clients sign in by Client ID Metadata Document.`
114      ),
115    };
116  }
117  return { forward: new Request(request, { body: bounded.text }) };
118}