fix(auth): refuse a grant whose authorization server cannot be established (#2144)

Copilot review round 15.

The issuer check still failed open for the legacy unkeyed grant. "Unkeyed"
means its authorization server is UNKNOWN, not that the cached endpoint is
proven to own it: server metadata is a single slot a later discovery
overwrites, while a pre-SEP-2352 token survives until the first issuer-stamped
save. So a clear could post an old bearer credential to an authorization server
that never minted it.

Such a grant is now cleared without being revoked, and reported as such with a
message saying re-authorizing makes future clears revocable. The cost is that
a pre-issuer-binding entry gets no revocation — which is exactly the behavior
it had before this feature existed, so nothing regresses — and it earns
revocation back on the next authorization. Not sending is the only answer that
cannot be wrong.

Every seed in the suite is now issuer-bound, which is what a real flow writes;
the two tests that were about the legacy grant now assert the refusal, since
that is the behavior worth pinning.

Also renamed the CLI test that still described the pre-round-13 ordering.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0177mPHAdECD18nLLCTwR5rh
Signed-off-by: cliffhall <cliff@futurescale.com>

clients/web/src/lib/clearServerOAuthState.test.ts

@@ -85,11 +85,17 @@ describe("clearServerOAuthState", () => {
   // metadata to build a request from), but the clear itself runs before the
   // network — so by the time the request goes out the store is already empty.
   it("clears before sending, using the snapshot it took first", async () => {
-    await storage.saveTokens(SERVER_URL, {
-      access_token: "tok",
-      token_type: "Bearer",
-      refresh_token: "refresh-tok",
-    });
+    await storage.saveTokens(
+      SERVER_URL,
+      {
+        access_token: "tok",
+        token_type: "Bearer",
+        refresh_token: "refresh-tok",
+      },
+      // Issuer-bound and matching the metadata below: an unkeyed grant records
+      // no authorization server and is deliberately refused.
+      { issuer: "https://as.example.com" },
+    );
     await storage.saveServerMetadata(SERVER_URL, {
       issuer: "https://as.example.com",
       authorization_endpoint: "https://as.example.com/authorize",

clients/web/src/test/core/auth/revocation.test.ts

@@ -395,12 +395,20 @@ describe("revokeStoredOAuthTokens (plan + execute)", () => {
     await storage.clear(SERVER_URL);
   });
 
+  const ISSUER = "https://as.example.com";
+
+  /**
+   * A revocable grant: issuer-bound, and matching the cached metadata. Unkeyed
+   * grants are deliberately NOT revocable (their authorization server is
+   * unknown), so seeding one here would make every case below assert the
+   * refusal instead of the behavior it is about.
+   */
   async function seed(over: Partial<OAuthMetadata> = {}): Promise<void> {
-    await storage.saveTokens(SERVER_URL, {
-      access_token: "a",
-      token_type: "Bearer",
-      refresh_token: "r",
-    });
+    await storage.saveTokens(
+      SERVER_URL,
+      { access_token: "a", token_type: "Bearer", refresh_token: "r" },
+      { issuer: ISSUER },
+    );
     await storage.saveServerMetadata(SERVER_URL, metadata(over));
   }
 
@@ -508,14 +516,21 @@ describe("revokeStoredOAuthTokens (plan + execute)", () => {
     const fetchFn = vi.fn<typeof fetch>(
       async () => new Response(null, { status: 200 }),
     );
-    await revokeStoredOAuthTokens({ serverUrl: SERVER_URL, storage, fetchFn });
+    const outcome = await revokeStoredOAuthTokens({
+      serverUrl: SERVER_URL,
+      storage,
+      fetchFn,
+    });
 
-    // Exactly one request — the legacy grant, read ctx-lessly and unlabelled.
-    // Never two, and never the legacy token presented as that issuer's.
-    expect(fetchFn).toHaveBeenCalledTimes(1);
-    expect(
-      new URLSearchParams(String(fetchFn.mock.calls[0]![1]!.body)).get("token"),
-    ).toBe("legacy-r");
+    // Nothing is sent: the only grant here is the legacy one, whose
+    // authorization server is unknown. The point is that it is never presented
+    // as the enumerated issuer's — one request with `legacy-r` would be exactly
+    // that mistake.
+    expect(fetchFn).not.toHaveBeenCalled();
+    expect(outcome).toMatchObject({ status: "failed" });
+    expect(outcome.status === "failed" ? outcome.detail : "").toContain(
+      "predates issuer binding",
+    );
   });
 
   // The active issuer slot can hold client information without a token, in
@@ -551,10 +566,21 @@ describe("revokeStoredOAuthTokens (plan + execute)", () => {
       async () => new Response(null, { status: 200 }),
     );
 
-    await revokeStoredOAuthTokens({ serverUrl: SERVER_URL, storage, fetchFn });
+    const outcome = await revokeStoredOAuthTokens({
+      serverUrl: SERVER_URL,
+      storage,
+      fetchFn,
+    });
 
-    // Two grants, two requests — the issuer-bound one and the legacy one.
-    expect(fetchFn).toHaveBeenCalledTimes(2);
+    // Still two GRANTS — that is what this is about. The issuer-bound one is
+    // revoked; the legacy one is refused (unknown authorization server) and
+    // reported, rather than being silently collapsed into the other by a
+    // token-value dedup.
+    expect(fetchFn).toHaveBeenCalledTimes(1);
+    expect(outcome).toMatchObject({ status: "failed" });
+    expect(outcome.status === "failed" ? outcome.detail : "").toContain(
+      "predates issuer binding",
+    );
   });
 
   // Absence establishes nothing: a metadata document with no `issuer` cannot
@@ -586,26 +612,35 @@ describe("revokeStoredOAuthTokens (plan + execute)", () => {
     );
   });
 
-  // A legacy unkeyed grant is not bound to any authorization server, so there
-  // is nothing to contradict — it proceeds without the comparison.
-  it("still revokes a legacy grant when the metadata names no issuer", async () => {
+  // "Unkeyed" means the authorization server is UNKNOWN, not that the cached
+  // endpoint is proven to own the grant — server metadata is a single slot a
+  // later discovery overwrites, while a legacy token survives until the first
+  // issuer-stamped save. Refusing costs such an entry its revocation, which is
+  // the behavior it had before this feature existed, and it earns it back on
+  // the next authorization.
+  it("refuses a legacy grant, whose authorization server is unknown", async () => {
     await storage.saveServerMetadata(
       SERVER_URL,
-      metadata({ issuer: undefined }),
+      metadata({ issuer: "https://as.example.com" }),
     );
     await storage.saveTokens(SERVER_URL, {
       access_token: "a",
       token_type: "Bearer",
       refresh_token: "r",
     });
-    const fetchFn = vi.fn<typeof fetch>(
-      async () => new Response(null, { status: 200 }),
-    );
+    const fetchFn = vi.fn<typeof fetch>();
 
-    await expect(
-      revokeStoredOAuthTokens({ serverUrl: SERVER_URL, storage, fetchFn }),
-    ).resolves.toMatchObject({ status: "revoked" });
-    expect(fetchFn).toHaveBeenCalledTimes(1);
+    const outcome = await revokeStoredOAuthTokens({
+      serverUrl: SERVER_URL,
+      storage,
+      fetchFn,
+    });
+
+    expect(fetchFn).not.toHaveBeenCalled();
+    expect(outcome).toMatchObject({ status: "failed" });
+    expect(outcome.status === "failed" ? outcome.detail : "").toContain(
+      "re-authorize",
+    );
   });
 
   // If `listIssuers` fails there is no enumerated slot behind the stamp, so

clients/web/src/test/core/mcp/oauthManager.test.ts

@@ -207,7 +207,12 @@ describe("OAuthManager", () => {
     it("clears local state before waiting on the revocation request", async () => {
       const params = createMockParams();
       const storage = params.initialConfig.storage!;
-      vi.mocked(storage.getTokens).mockResolvedValue({
+      // Issuer-bound and matching the metadata: an unkeyed grant records no
+      // authorization server and is deliberately refused.
+      vi.mocked(storage.listIssuers).mockResolvedValue([
+        "https://as.example.com",
+      ]);
+      vi.mocked(storage.getIssuerTokens).mockResolvedValue({
         access_token: "a",
         token_type: "Bearer",
         refresh_token: "r",
@@ -242,7 +247,10 @@ describe("OAuthManager", () => {
     it("clears local state even when the revocation request fails", async () => {
       const params = createMockParams();
       const storage = params.initialConfig.storage!;
-      vi.mocked(storage.getTokens).mockResolvedValue({
+      vi.mocked(storage.listIssuers).mockResolvedValue([
+        "https://as.example.com",
+      ]);
+      vi.mocked(storage.getIssuerTokens).mockResolvedValue({
         access_token: "a",
         token_type: "Bearer",
       });

clients/web/src/test/integration/auth/revocation-e2e.test.ts

@@ -138,7 +138,13 @@ describe("OAuth token revocation (RFC 7009)", () => {
   }): Promise<BrowserOAuthStorage> {
     const storage = new BrowserOAuthStorage();
     await storage.clear(serverUrl);
-    await storage.saveTokens(serverUrl, { token_type: "Bearer", ...tokens });
+    // Issuer-bound and matching the discovered metadata: an unkeyed grant
+    // records no authorization server and is deliberately refused.
+    await storage.saveTokens(
+      serverUrl,
+      { token_type: "Bearer", ...tokens },
+      { issuer: metadata.issuer },
+    );
     await storage.saveServerMetadata(serverUrl, metadata);
     // Preconfigured, so it goes in the preregistered slot — the same one a
     // server with `oauth.clientId` uses. That is the slot the revocation path