fix: address review feedback on invalidation scopes and example AS policy

invalidateCredentials('discovery') now drops the cached issuer and
resource URLs so a callback cannot mint against a stale audience.
The example AS binds the issued identity and scopes to the verified
workload instead of copying them from the request, and the projected
token file is created with O_EXCL so a pre-planted symlink fails closed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: coding-bobo

examples/oauth-workload-identity/server.ts

@@ -25,7 +25,7 @@
  * API socket instead of a temp file this process wrote.
  */
 import { randomUUID } from 'node:crypto';
-import { writeFileSync } from 'node:fs';
+import { rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
 
@@ -78,7 +78,10 @@ const workloadJwt = await new jose.SignJWT({})
 // out-of-band handshake. In a pod this path is the projected-volume mount point
 // (`/var/run/secrets/tokens/...`); `WIF_WORKLOAD_TOKEN_PATH` overrides it.
 const tokenPath = process.env.WIF_WORKLOAD_TOKEN_PATH ?? path.join(tmpdir(), `mcp-wif-workload-token-${port}.jwt`);
-writeFileSync(tokenPath, workloadJwt, { mode: 0o600 });
+// `wx` (O_CREAT | O_EXCL) refuses to follow a pre-planted symlink at this
+// well-known path and fails closed if anything reappears between rm and open.
+rmSync(tokenPath, { force: true });
+writeFileSync(tokenPath, workloadJwt, { mode: 0o600, flag: 'wx' });
 
 // ---- Authorization Server (jwt-bearer only) ----
 const metadata: OAuthMetadata = {
@@ -133,12 +136,25 @@ asApp.post('/token', async (req, res) => {
         res.status(400).json({ error: 'invalid_grant' });
         return;
     }
+    // Bind the issued identity to the verified workload, not to request
+    // parameters: federation policy decides what this subject may act as. A
+    // request may omit client_id entirely (the assertion is the credential),
+    // but it must not claim a different one.
+    if (body.client_id !== undefined && body.client_id !== DEMO_CLIENT_ID) {
+        console.error(`[auth-server] client_id ${body.client_id} is not federated to ${WORKLOAD_SUBJECT}`);
+        res.status(400).json({ error: 'invalid_grant' });
+        return;
+    }
     const scopes = (body.scope ?? '').split(' ').filter(Boolean);
+    if (!scopes.every(scope => metadata.scopes_supported!.includes(scope))) {
+        res.status(400).json({ error: 'invalid_scope' });
+        return;
+    }
     const accessToken = randomUUID();
     const expiresIn = 300;
     issuedTokens.set(accessToken, {
         token: accessToken,
-        clientId: body.client_id ?? DEMO_CLIENT_ID,
+        clientId: DEMO_CLIENT_ID,
         scopes,
         expiresAt: Math.floor(Date.now() / 1000) + expiresIn,
         extra: { workloadSubject: WORKLOAD_SUBJECT }

packages/client/src/client/authExtensions.ts

@@ -904,17 +904,35 @@ export class WorkloadIdentityProvider implements OAuthClientProvider {
      * the verdict may name the most recently handed-out assertion rather than the
      * exact one the failing flow sent; that is conservative and fails closed.
      * `'all'` is a host-driven reset rather than a rejection, so it clears the
-     * memory instead of recording one. The remaining scopes name state this
-     * provider does not keep.
+     * memory instead of recording one. `'discovery'` drops the cached
+     * authorization server and resource URLs so a later flow cannot mint an
+     * assertion against a stale issuer; `auth()` repopulates them on its next
+     * discovery pass. `'client'` and `'verifier'` name state this provider does
+     * not keep.
      */
     invalidateCredentials(scope: 'all' | 'client' | 'tokens' | 'verifier' | 'discovery'): void {
-        if (scope === 'tokens') {
-            this._tokens = undefined;
-            this._rejectedAssertion = this._lastAssertion;
-        } else if (scope === 'all') {
-            this._tokens = undefined;
-            this._lastAssertion = undefined;
-            this._rejectedAssertion = undefined;
+        switch (scope) {
+            case 'tokens': {
+                this._tokens = undefined;
+                this._rejectedAssertion = this._lastAssertion;
+                break;
+            }
+            case 'discovery': {
+                this._authorizationServerUrl = undefined;
+                this._resourceUrl = undefined;
+                break;
+            }
+            case 'all': {
+                this._tokens = undefined;
+                this._lastAssertion = undefined;
+                this._rejectedAssertion = undefined;
+                this._authorizationServerUrl = undefined;
+                this._resourceUrl = undefined;
+                break;
+            }
+            default: {
+                break;
+            }
         }
     }
 

packages/client/test/client/workloadIdentity.test.ts

@@ -331,6 +331,26 @@ describe('WorkloadIdentityProvider rejection memory', () => {
 
         expect(provider.tokens()?.access_token).toBe('stored-token');
     });
+
+    it("drops cached discovery URLs on invalidateCredentials('discovery') but keeps tokens", () => {
+        const provider = makeProvider();
+        provider.saveTokens({ access_token: 'stored-token', token_type: 'Bearer' });
+
+        provider.invalidateCredentials('discovery');
+
+        expect(provider.authorizationServerUrl()).toBeUndefined();
+        expect(provider.resourceUrl?.()).toBeUndefined();
+        expect(provider.tokens()?.access_token).toBe('stored-token');
+    });
+
+    it("drops cached discovery URLs on invalidateCredentials('all')", () => {
+        const provider = makeProvider();
+
+        provider.invalidateCredentials('all');
+
+        expect(provider.authorizationServerUrl()).toBeUndefined();
+        expect(provider.resourceUrl?.()).toBeUndefined();
+    });
 });
 
 describe('WorkloadIdentityProvider (end-to-end with auth())', () => {