Add MCP OAuth 2.1 surface: discovery, DCR, authorize/consent, token

[koomen]

First of two PRs adding a remote MCP server so agents (Claude Code) can publish Scratchwork projects with no CLI installed. This PR is the auth surface; the follow-up (#next) adds the /mcp endpoint and tools.

What this adds

MCP-spec OAuth 2.1 on the app origin, built on the existing chokepoints:

• Discovery: RFC 9728 protected-resource metadata + RFC 8414 authorization-server metadata (root and /mcp path-inserted forms).
• Dynamic client registration (RFC 7591): public clients only (token_endpoint_auth_method: none), stored in PrimitiveDb with a 90-day TTL and a 1000-live-client cap; redirect URIs are https-or-loopback with RFC 8252 §7.3 loopback port variance.
• Authorize + consent: client/redirect validated before anything ever redirects; PKCE S256 mandatory; consent page (session cookie) with a signed, user-bound transaction token, same-origin enforcement, and frame-ancestors 'none'.
• Token endpoint: authorization_code (burn-before-verify one-time codes) and refresh_token grants with RFC 6749 error bodies.
• Four new token kinds in auth.ts — mcp-consent, mcp-code, mcp-access (1h, audience-bound to <appBase>/mcp), mcp-refresh (session TTL) — under an independent MCP_TOKEN_VERSION revocation lever, all minted/verified through the private signValue/verifySignedValue chokepoints.
• requireMcpUser resolves the future /mcp bearer principal: an mcp-access token, or an existing session bearer as a capability-neutral fallback (sessions already authorize the full /api surface); cookies are never read on that path.

Threat review (invariants 3/5)

• Code replay: mcp-code.id burns via conditional create before the possession check (shared burnOneTimeCode, also adopted by the CLI exchange) — replays and wrong-verifier races fail closed.
• PKCE downgrade: code_challenge mandatory at authorize, method literal S256, no plain path exists; verifier digests compare via timingSafeEqual.
• Open redirect: an unvalidated client_id/redirect_uri gets a 400 page, never a redirect; loopback matching varies only the port; the code pins the redirect and the token endpoint re-requires byte equality; oversized state is never echoed.
• Audience confusion: closed both directions by kind discrimination and the aud claim — mechanized in the policy matrix (an mcp-access bearer is denied on every /api route) and the token corpus (9-kind cross-pairing).
• DCR spam: 16 KB body cap, ≤10 URIs, 90-day expiry, 1000-live cap.
• Consent CSRF/clickjacking: same-origin check + user-bound signed txn + POST-only approval + framing refused.
• Origin isolation: /oauth/* and /.well-known/* canonicalize to the app origin before any cookie/issuer derivation; mcp and oauth are now reserved slugs; Access-Control-Allow-Origin: * appears only on the four cookie-free endpoints.

Accepted trade-offs

• Stateless mcp-access/mcp-refresh tokens are replayable within TTL, like sessions; levers are the allow-list (re-checked at every mint and verify) and MCP_TOKEN_VERSION. The refresh grant does not rotate refresh tokens — stateless rotation cannot revoke the predecessor, so rotation would be theater.
• DB-backed (not stateless) client registrations, so expiry/GC is enforceable and the consent page can re-read client_name.

Tests

Token corpus rows for all four kinds (bit-flip, cross-kind, boundary expiry, audience/scope confusion, future issuance, lifecycle); full-loop mcp-oauth.test.ts (discover → register → authorize → consent → token → principal) plus the negatives above; policy-matrix extensions (deny-all mcp-access row, MCP OAuth route completeness, CORS posture); redirect-URI rule units. bun run ci green.

🤖 Generated with Claude Code