fix(airtable,dropbox,microsoft-teams,openrouter): pin OAuth redirect_uri to deco domain allowlist

[0xcucumbersalad]

Summary

• Found via a repo-wide sweep for the same redirect_uri hijack vuln class already fixed in github (fix(github): pin OAuth redirect_uri to decocms.com allowlist #453) and shared/google-oauth (fix(shared): pin Google OAuth redirect_uri to decocms.com/deco.site allowlist #539): authorizationUrl()/exchangeCode() forwarded the runtime-supplied callback URL verbatim as redirect_uri (callback_url for OpenRouter) to the third-party IdP with zero host validation. The IdP delivers the auth code to that host, so an attacker-influenced origin could hijack the code/token.
• Vulnerable: airtable, dropbox, microsoft-teams, openrouter — all followed the identical pattern (dropbox's own comment even said "match the airtable/google pattern").
• Each gets its own self-contained server/lib/redirect-allowlist.ts (assertAllowedRedirectUri/isAllowedRedirectUri, same shape as github's/shared's) rather than depending on shared/, so this lands independently of fix(shared): pin Google OAuth redirect_uri to decocms.com/deco.site allowlist #539.
• Allowlist: decocms.com, deco.site (production hosting — confirmed via each MCP's app.json/wrangler.toml), and deco.host (local-dev tunnel domain, needed since some providers reject http://localhost redirect URIs). Loopback allowed over http for dev.
• Already-safe MCPs checked and left alone: shopify (own isAllowedCallback()), whatsapp (validates against MESH_URL/SELF_URL), github-repo-reports (no redirect_uri param at all).

Test plan

• bun test server/lib/redirect-allowlist.test.ts in each of the 4 MCPs — 40/40 pass total (canonical origins, subdomains, loopback dev, non-loopback http rejection, look-alike/suffix-confusion hosts, other schemes, case-insensitivity)
• bun run fmt / pre-commit lint pass
• Smoke-test an actual OAuth connect flow for one of the 4 MCPs in staging

🤖 Generated with Claude Code

---

Summary by cubic

Pins OAuth redirect/callback domains for airtable, dropbox, microsoft-teams, and openrouter to a Deco allowlist to block redirect_uri hijack. Previously we forwarded the runtime-supplied callback verbatim; now we validate hosts and throw on disallowed domains. Non‑Deco hosts fail with a clear error; loopback dev remains supported.

• Add per‑MCP server/lib/redirect-allowlist.ts with assertAllowedRedirectUri/isAllowedRedirectUri, called in authorizationUrl and exchangeCode (callback_url for openrouter).
• Allowlist: decocms.com, deco.site, deco.host over https; localhost/127.0.0.1/::1 allowed over http for dev only.
• Add tests in each package for allowed/denied cases. Update microsoft-teams tsconfig.json to include @types/bun so bun:test type checks.
• Migration: if your OAuth callback base URL uses a non‑allowed domain, move it to decocms.com, deco.site, or deco.host, or use loopback for local development.

^{Written for commit 98d228c. Summary will update on new commits.}