fix: clarify narrowed OAuth consent and verify Codex scope grants

apps/api/package.json

@@ -13,7 +13,8 @@
     "test:performance": "tsx scripts/performance.ts after",
     "test:mcp": "tsx --test --test-concurrency=1 test/mcp.test.ts",
     "mcp:probe": "tsx scripts/mcp-probe.ts",
-    "icons:seed": "node scripts/seed-icons.cjs"
+    "icons:seed": "node scripts/seed-icons.cjs",
+    "test:mcp:codex": "tsx --test --test-concurrency=1 test/codex-oauth.test.ts"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "1.31.0",

apps/api/test/codex-oauth.test.ts

@@ -0,0 +1,210 @@
+import 'dotenv/config';
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { randomUUID, randomBytes } from 'node:crypto';
+import { mkdtemp, writeFile, readdir, readFile, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join, resolve, basename, sep } from 'node:path';
+import { spawn, type ChildProcessWithoutNullStreams } from 'node:child_process';
+import { PrismaClient } from '@prisma/client';
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import { today } from '../src/validation';
+
+// Optional real installed-client check; never uses the user's Codex credentials.
+for (const useDefaultScopes of [false, true])
+  test(
+    'Codex OAuth ' +
+      (useDefaultScopes ? 'default metadata scopes' : 'explicit scopes') +
+      ' are narrowed to draft without hidden access or direct posting',
+    async () => {
+      const resource = process.env.MCP_PUBLIC_URL || 'http://localhost:3100/mcp';
+      const root = process.env.TEST_API_URL?.replace(/\/api$/, '') || 'http://127.0.0.1:3100';
+      const origin =
+        process.env.WEB_ORIGIN && process.env.WEB_ORIGIN !== '*'
+          ? process.env.WEB_ORIGIN
+          : 'http://localhost:5173';
+      const db = new PrismaClient();
+      const home = await mkdtemp(join(tmpdir(), 'worthpath-codex-scope-'));
+      const username = 'codex_scope_' + randomUUID().slice(0, 12),
+        password = randomBytes(20).toString('hex');
+      let userId = '',
+        clientId = '',
+        cli: ChildProcessWithoutNullStreams | undefined;
+      const client = new Client({ name: 'Codex OAuth grant verification', version: '1.31.0' });
+      async function web(path: string, body: unknown, cookie = '') {
+        const r = await fetch(root + '/api' + path, {
+          method: 'POST',
+          headers: {
+            Origin: origin,
+            'Content-Type': 'application/json',
+            ...(cookie ? { Cookie: cookie } : {}),
+          },
+          body: JSON.stringify(body),
+        });
+        assert.equal(r.status, 201, 'Web request failed: ' + path);
+        return {
+          data: await r.json(),
+          cookie: r.headers.get('set-cookie')?.split(';')[0] || cookie,
+        };
+      }
+      async function deadline<T>(promise: Promise<T>, label: string) {
+        let timer: ReturnType<typeof setTimeout> | undefined;
+        try {
+          return await Promise.race([
+            promise,
+            new Promise<T>((_, reject) => {
+              timer = setTimeout(() => reject(Error(label + ' timed out')), 30000);
+            }),
+          ]);
+        } finally {
+          if (timer) clearTimeout(timer);
+        }
+      }
+      try {
+        const fixture = await web('/auth/register', { username, password });
+        userId = (await db.user.findUniqueOrThrow({ where: { username } })).id;
+        await writeFile(
+          join(home, 'config.toml'),
+          'mcp_oauth_credentials_store = "file"\n[mcp_servers.worthpath]\nurl = ' +
+            JSON.stringify(resource) +
+            '\n',
+        );
+        cli = spawn(
+          process.env.CODEX_CLI || 'codex',
+          [
+            'mcp',
+            'login',
+            'worthpath',
+            '--no-browser',
+            ...(useDefaultScopes ? [] : ['--scopes', 'read,draft']),
+            '--oauth-client-registration',
+            'dcr',
+          ],
+          {
+            env: { ...process.env, CODEX_HOME: home },
+            windowsHide: true,
+            stdio: ['pipe', 'pipe', 'pipe'],
+          },
+        );
+        const processExit = new Promise<number | null>((resolve, reject) => {
+          cli!.on('exit', resolve);
+          cli!.on('error', reject);
+        });
+        // Observe the exit from the start so spawn errors never become unhandled promises.
+        void processExit.catch(() => {});
+        const authorization = await deadline(
+          new Promise<string>((resolve, reject) => {
+            let output = '';
+            const receive = (chunk: Buffer) => {
+              output += chunk.toString();
+              const found = output.match(/https?:\/\/[^\s]+\/authorize\?[^\s]+/);
+              if (found) resolve(found[0]);
+            };
+            cli!.stdout.on('data', receive);
+            cli!.stderr.on('data', receive);
+            cli!.on('error', reject);
+            cli!.on('exit', () => reject(Error('CLI exited before authorization URL')));
+          }),
+          'CLI authorization URL',
+        );
+        const request = new URL(authorization);
+        assert.equal(request.origin, new URL(resource).origin);
+        const requested = (request.searchParams.get('scope') || '').split(' ').filter(Boolean);
+        assert.deepEqual(
+          requested,
+          useDefaultScopes
+            ? ['read', 'draft', 'write', 'hidden_read', 'hidden_write']
+            : ['read', 'draft'],
+        );
+        clientId = request.searchParams.get('client_id')!;
+        const redirect = await fetch(request, { redirect: 'manual' });
+        assert.equal(redirect.status, 302);
+        const id = new URL(redirect.headers.get('location')!).searchParams.get(
+          'agent_authorization',
+        );
+        assert.ok(id);
+        // Isolated disposable fixture only. Real users complete consent in the website.
+        const consent = await web(
+          '/agent/authorizations/' + id,
+          { approve: true, scopes: ['read', 'draft'] },
+          fixture.cookie,
+        );
+        cli.stdin.write(consent.data.redirect + '\n');
+        cli.stdin.end();
+        assert.equal(await deadline(processExit, 'CLI callback'), 0);
+        let access = '';
+        const find = (value: unknown) => {
+          if (value && typeof value === 'object') {
+            const row = value as Record<string, unknown>;
+            if (typeof row.access_token === 'string') access = row.access_token;
+            Object.values(row).forEach(find);
+          }
+        };
+        for (const file of (await readdir(home)).filter((n) => n.endsWith('.json')))
+          find(JSON.parse(await readFile(join(home, file), 'utf8')));
+        assert.ok(access, 'CLI did not save an OAuth token in its isolated credentials store');
+        const grant = await db.agentGrant.findFirstOrThrow({ where: { userId, clientId } });
+        assert.deepEqual(grant.scopes, ['read', 'draft']);
+        await client.connect(
+          new StreamableHTTPClientTransport(new URL(resource), {
+            requestInit: { headers: { Authorization: 'Bearer ' + access } },
+          }),
+        );
+        assert.equal((await client.listTools()).tools.length, 39);
+        async function call(name: string, args: Record<string, unknown> = {}) {
+          const result = await client.callTool({ name, arguments: args });
+          assert.ok(!result.isError, 'Tool failed: ' + name);
+          return (result.structuredContent as { data: any }).data;
+        }
+        const info = await call('connection_info');
+        assert.deepEqual(info.scopes, ['read', 'draft']);
+        assert.equal(info.permission, 'draft');
+        assert.equal(info.readHidden, false);
+        assert.equal(info.writeHidden, false);
+        const state = (await call('state_get')).state;
+        const operation = await call('position_create', {
+          kind: 'account',
+          side: 'asset',
+          name: 'Must remain draft',
+          category: 'cash',
+          currency: 'CNY',
+          amount: '25.50',
+          date: today(),
+          notes: '',
+          expectedState: state,
+          idempotencyKey: randomUUID(),
+        });
+        assert.equal(operation.status, 'pending');
+        assert.equal(
+          await db.position.count({ where: { userId } }),
+          0,
+          'Draft unexpectedly posted financial data',
+        );
+        console.log(
+          JSON.stringify({
+            requestedScopes: requested,
+            grantedScopes: info.scopes,
+            readHidden: info.readHidden,
+            writeHidden: info.writeHidden,
+            ordinaryWrite: operation.status,
+            tools: 39,
+          }),
+        );
+      } finally {
+        cli?.kill();
+        await client.close().catch(() => {});
+        if (userId) await db.user.deleteMany({ where: { id: userId } });
+        if (clientId) {
+          await db.agentAuthorization.deleteMany({ where: { clientId } });
+          await db.agentClient.deleteMany({ where: { id: clientId } });
+        }
+        await db.$disconnect();
+        assert.ok(
+          resolve(home).startsWith(resolve(tmpdir()) + sep) &&
+            basename(home).startsWith('worthpath-codex-scope-'),
+        );
+        await rm(home, { recursive: true, force: true });
+      }
+    },
+  );

apps/web/src/AgentConnections.tsx

@@ -119,7 +119,10 @@ function codexSetupPrompt(url: string, level: string) {
     '执行 codex mcp login worthpath --scopes ' +
       selected +
       ' --oauth-client-registration dcr 发起网页登录。我会自行登录并确认权限。等待回调时保留登录进程；需要等待我完成网页步骤时，明确告诉我当前状态。',
-    '授权后检查连接配置与真实工具可用性。能调用时先 tools/list，再 connection_info 核对权限；若当前会话不会重新加载工具，请告诉我重启客户端或新建本机会话后继续验证。只有配置、OAuth 成功和工具调用成功都验证后才能说已可用，不把 codex mcp list 或网页登录成功当作工具调用成功。',
+    '实测 Codex CLI 0.160.0 显式执行 --scopes read,draft 时只请求这两项；默认登录会使用 scopes_supported，授权链接列出 read,draft,write,hidden_read,hidden_write。如果实际请求范围较宽，这是客户端请求的候选范围，不是最终授权。WorthPath 网页支持收窄：选择本次指定的权限等级，两个隐藏账户选项保持关闭，页面会明确显示最终授予权限；服务端仅按网页选择发行令牌。不要仅因请求包含全部候选权限就终止登录或让我自行检查页面。你可以打开正确 WorthPath 资源的授权页面供我审阅，最终选择和确认仍由我完成。',
+    '授权后检查连接配置与真实工具可用性。能调用时先 tools/list，再 connection_info；最终 scopes 必须仅为本次指定的 ' +
+      selected +
+      '，且 readHidden/writeHidden 均为 false。若结果不符，停止使用该连接并报告差异，不修改账目。若当前会话不会重新加载工具，请告诉我重启客户端或新建本机会话后继续验证。只有配置、OAuth 成功和工具调用成功都验证后才能说已可用，不把 codex mcp list 或网页登录成功当作工具调用成功。',
     '配置期间不要创建、修改或删除我的账目。后续资产查询、转账和还款优先使用 WorthPath MCP；工具或权限不可用时如实说明。',
     ...instructions(url).split('\n\n').slice(3),
   ].join('\n\n');
@@ -657,7 +660,10 @@ export function AgentConnections() {
         <div className="agent-confirm">
           <h3>审核 OAuth 连接</h3>
           <p>{consent.name}</p>
-          <p>权限：{consent.scopes.join(', ')}</p>
+          <p>客户端请求的候选权限：{consent.scopes.join(', ')}</p>
+          <p className="muted">
+            候选范围不代表已授权。最终仅授予下方选择的权限，隐藏账户权限默认关闭。
+          </p>
           <p>资源：{consent.resource}</p>
           <p>回调地址：{consent.redirectUri}</p>
           <p className="muted">只批准你正在连接的客户端；请核对回调地址。</p>
@@ -678,7 +684,7 @@ export function AgentConnections() {
             </select>
           </label>
           {consent.scopes.includes('hidden_read') && (
-            <label>
+            <label className="check-line">
               <input
                 type="checkbox"
                 checked={consentHiddenRead}
@@ -691,7 +697,7 @@ export function AgentConnections() {
             </label>
           )}
           {consent.scopes.includes('hidden_write') && (
-            <label>
+            <label className="check-line">
               <input
                 type="checkbox"
                 disabled={!consentHiddenRead || consentLevel === 'read'}
@@ -701,6 +707,18 @@ export function AgentConnections() {
               允许修改隐藏账户
             </label>
           )}
+          <p role="status">
+            最终将授予：
+            {consent.scopes
+              .filter(
+                (scope) =>
+                  scope === 'read' ||
+                  scope === consentLevel ||
+                  (scope === 'hidden_read' && consentHiddenRead) ||
+                  (scope === 'hidden_write' && consentHiddenWrite),
+              )
+              .join(', ')}
+          </p>
           {[true, false].map((approve) => (
             <button
               className="secondary"

apps/web/src/style.css

@@ -1859,6 +1859,13 @@ textarea,
   padding: 1rem;
   margin: 1rem 0;
 }
+.agent-confirm .check-line input[type='checkbox'] {
+  width: 18px;
+  height: 18px;
+  min-height: 18px;
+  padding: 0;
+  flex: 0 0 18px;
+}
 .agent-confirm pre {
   white-space: pre-wrap;
   overflow-wrap: anywhere;