Converge hosted-MCP OAuth + parity tools + app SSO (v4.20.0)

migrations/4.17.0_oauth_as.sql

@@ -0,0 +1,81 @@
+-- =========================================================================
+-- Kyte v4.17.0 - OAuth 2.1 Authorization Server for the hosted MCP connector
+-- =========================================================================
+-- IMPORTANT: Backup your database before running this migration.
+--
+-- KYTE-#551 (hosted MCP: remote OAuth connector for Claude.ai / ChatGPT).
+-- Creates the two tables backing this install's OAuth authorization server:
+--
+--   KyteOAuthClient  - RFC 7591 dynamically-registered OAuth clients
+--                      (Claude / ChatGPT register as public PKCE clients
+--                      before the authorization-code flow).
+--   KyteOAuthCode    - short-lived, single-use authorization codes issued at
+--                      /oauth/authorize and redeemed once at /oauth/token for
+--                      a freshly-minted scoped KyteMCPToken (the access token).
+--
+-- The OAuth layer is a front door that mints existing `kmcp_live_` tokens;
+-- all downstream MCP enforcement (McpTokenStrategy, scopes, sessions, audit)
+-- is unchanged. See docs/design/hosted-mcp-oauth.md and the model specs in
+-- src/Mvc/Model/KyteOAuthClient.php + KyteOAuthCode.php.
+--
+-- Idempotent (CREATE TABLE IF NOT EXISTS) — safe to re-run; existing installs
+-- that already created equivalent tables are unaffected. Conventions mirror
+-- migrations/4.6.0_mcp_session_store.sql (BIGINT UNSIGNED ids, InnoDB,
+-- utf8mb4). Portable to MySQL 8.x + MariaDB 10.5+.
+-- =========================================================================
+
+CREATE TABLE IF NOT EXISTS `KyteOAuthClient` (
+    `id`                          BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
+
+    `client_id`                   VARCHAR(64)  NOT NULL COMMENT 'Public client identifier (opaque random) issued at registration',
+    `client_secret`               VARCHAR(64)  DEFAULT NULL COMMENT 'sha256 of confidential-client secret; NULL for public/PKCE clients',
+    `client_name`                 VARCHAR(255) DEFAULT NULL,
+    `redirect_uris`               TEXT         NOT NULL COMMENT 'JSON array of allowed redirect URIs (exact-matched at authorize/token)',
+    `grant_types`                 VARCHAR(255) DEFAULT NULL COMMENT 'CSV, default authorization_code',
+    `response_types`              VARCHAR(255) DEFAULT NULL COMMENT 'CSV, default code',
+    `token_endpoint_auth_method`  VARCHAR(64)  DEFAULT NULL COMMENT 'none for public PKCE clients',
+    `scope`                       VARCHAR(512) DEFAULT NULL COMMENT 'Space-separated OAuth scopes requested at registration',
+
+    `kyte_account`                BIGINT UNSIGNED DEFAULT 0 COMMENT 'Nullable/0 — clients register before any user authenticates',
+
+    `created_by`                  BIGINT UNSIGNED DEFAULT NULL,
+    `date_created`                BIGINT UNSIGNED DEFAULT NULL,
+    `modified_by`                 BIGINT UNSIGNED DEFAULT NULL,
+    `date_modified`               BIGINT UNSIGNED DEFAULT NULL,
+    `deleted_by`                  BIGINT UNSIGNED DEFAULT NULL,
+    `date_deleted`                BIGINT UNSIGNED DEFAULT NULL,
+    `deleted`                     TINYINT UNSIGNED NOT NULL DEFAULT 0,
+
+    UNIQUE KEY `idx_client_id` (`client_id`),
+    KEY        `idx_account`   (`kyte_account`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+CREATE TABLE IF NOT EXISTS `KyteOAuthCode` (
+    `id`                     BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
+
+    `code_hash`              VARCHAR(64)   NOT NULL COMMENT 'sha256 of the raw authorization code; raw code never stored',
+    `client_id`              VARCHAR(64)   NOT NULL COMMENT 'KyteOAuthClient.client_id this code was issued to',
+    `redirect_uri`           VARCHAR(1024) NOT NULL COMMENT 'Must match exactly at /oauth/token',
+    `code_challenge`         VARCHAR(255)  NOT NULL COMMENT 'PKCE code_challenge (base64url sha256(verifier))',
+    `code_challenge_method`  VARCHAR(16)   NOT NULL COMMENT 'S256 only',
+    `scope`                  VARCHAR(512)  DEFAULT NULL COMMENT 'Space-separated OAuth scopes granted at consent',
+    `kyte_scopes`            VARCHAR(255)  NOT NULL COMMENT 'CSV of kmcp scopes to mint (read/draft/commit/provision/schema)',
+    `application`            BIGINT UNSIGNED DEFAULT NULL COMMENT 'Optional app scope for the minted token',
+    `expires_at`             BIGINT UNSIGNED NOT NULL DEFAULT 0 COMMENT 'Unix epoch; codes are short-lived',
+    `consumed_at`            BIGINT UNSIGNED NOT NULL DEFAULT 0 COMMENT 'Unix epoch of redemption; 0 = unused (single-use guard)',
+
+    `kyte_account`           BIGINT UNSIGNED NOT NULL COMMENT 'Account that consented; the minted token acts on this tenant',
+
+    `created_by`             BIGINT UNSIGNED DEFAULT NULL COMMENT 'KyteUser who approved consent',
+    `date_created`           BIGINT UNSIGNED DEFAULT NULL,
+    `modified_by`            BIGINT UNSIGNED DEFAULT NULL,
+    `date_modified`          BIGINT UNSIGNED DEFAULT NULL,
+    `deleted_by`             BIGINT UNSIGNED DEFAULT NULL,
+    `date_deleted`           BIGINT UNSIGNED DEFAULT NULL,
+    `deleted`                TINYINT UNSIGNED NOT NULL DEFAULT 0,
+
+    UNIQUE KEY `idx_code_hash` (`code_hash`),
+    KEY        `idx_client`    (`client_id`),
+    KEY        `idx_expires`   (`expires_at`),
+    KEY        `idx_account`   (`kyte_account`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

migrations/4.18.0_application_status.sql

@@ -0,0 +1,28 @@
+-- =========================================================================
+-- Kyte v4.18.0 - Application lifecycle status (async app teardown, KYTE-#559)
+-- =========================================================================
+-- IMPORTANT: Backup your database before running this migration.
+--
+-- Adds Application.status ('active' | 'deleting' | 'deleted'). When an app is
+-- deleted it is marked 'deleting' (not dropped synchronously); the
+-- SiteProvisioningWorker tears down each site's AWS infra (S3 + CloudFront +
+-- ACM) then finalizes the app — drops the tenant DB + its user and sets
+-- deleted=1/status='deleted'. This stops app deletion from orphaning site
+-- infrastructure.
+--
+-- Portable + idempotent: MySQL has no `ADD COLUMN IF NOT EXISTS`, so guard with
+-- an information_schema check + a prepared statement (works on MySQL 8.x +
+-- MariaDB 10.5+). Existing rows default to 'active'.
+-- =========================================================================
+
+SET @col_exists := (
+    SELECT COUNT(*) FROM information_schema.COLUMNS
+    WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = 'Application' AND COLUMN_NAME = 'status'
+);
+SET @ddl := IF(@col_exists = 0,
+    'ALTER TABLE `Application` ADD COLUMN `status` VARCHAR(20) NOT NULL DEFAULT ''active''',
+    'DO 0'
+);
+PREPARE stmt FROM @ddl;
+EXECUTE stmt;
+DEALLOCATE PREPARE stmt;

migrations/4.19.0_app_sso.sql

@@ -0,0 +1,131 @@
+-- =========================================================================
+-- Kyte v4.19.0 - App-level SSO (OIDC) tables (KYTE-#560)
+-- =========================================================================
+-- IMPORTANT: Backup your database before running this migration.
+--
+-- App-level Microsoft/OIDC SSO: an app's end users sign in with their identity
+-- provider; Kyte (the relying party) validates the id_token and issues a Kyte
+-- JWT session for the app's user_model.
+--
+--   KyteAppIdentityProvider - per-app OIDC config (Shipyard-managed; carries a
+--                             libsodium-encrypted client_secret; never via MCP).
+--   KyteSsoState            - short-lived in-flight state/nonce/PKCE per login,
+--                             plus a browser-binding correlator (login-CSRF).
+--   KyteSsoCode             - single-use hand-off code delivering the session to
+--                             the app front-end (no tokens at rest).
+--   KyteSsoIdentity         - subject->app-user link (the authoritative SSO join
+--                             key; email is never the identity key).
+--
+-- Idempotent (CREATE TABLE IF NOT EXISTS). Conventions mirror
+-- migrations/4.6.0_mcp_session_store.sql. Portable MySQL 8.x / MariaDB 10.5+.
+-- =========================================================================
+
+CREATE TABLE IF NOT EXISTS `KyteAppIdentityProvider` (
+    `id`                   BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
+    `application`          BIGINT UNSIGNED NOT NULL,
+    `provider`             VARCHAR(32)  NOT NULL,
+    `enabled`              TINYINT UNSIGNED NOT NULL DEFAULT 0,
+    `issuer`               VARCHAR(512) DEFAULT NULL,
+    `discovery_url`        VARCHAR(512) DEFAULT NULL,
+    `tenant`               VARCHAR(128) DEFAULT NULL,
+    `client_id`            VARCHAR(255) DEFAULT NULL,
+    `client_secret`        TEXT         DEFAULT NULL COMMENT 'libsodium secretbox, base64(nonce+ciphertext)',
+    `scopes`               VARCHAR(512) DEFAULT 'openid profile email',
+    `redirect_uri`         VARCHAR(1024) DEFAULT NULL,
+    `user_email_claim`     VARCHAR(64)  DEFAULT 'email',
+    `jit_enabled`          TINYINT UNSIGNED NOT NULL DEFAULT 1,
+    `restrict_to_existing` TINYINT UNSIGNED NOT NULL DEFAULT 0,
+    `kyte_account`         BIGINT UNSIGNED NOT NULL,
+    `created_by`           BIGINT UNSIGNED DEFAULT NULL,
+    `date_created`         BIGINT UNSIGNED DEFAULT NULL,
+    `modified_by`          BIGINT UNSIGNED DEFAULT NULL,
+    `date_modified`        BIGINT UNSIGNED DEFAULT NULL,
+    `deleted_by`           BIGINT UNSIGNED DEFAULT NULL,
+    `date_deleted`         BIGINT UNSIGNED DEFAULT NULL,
+    `deleted`              TINYINT UNSIGNED NOT NULL DEFAULT 0,
+    KEY `idx_app_provider` (`application`, `provider`),
+    KEY `idx_account`      (`kyte_account`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+CREATE TABLE IF NOT EXISTS `KyteSsoState` (
+    `id`             BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
+    `state`          VARCHAR(64)  NOT NULL,
+    `nonce`          VARCHAR(64)  NOT NULL,
+    `code_verifier`  VARCHAR(128) NOT NULL,
+    `application`    BIGINT UNSIGNED NOT NULL,
+    `provider`       VARCHAR(32)  DEFAULT NULL,
+    `return_url`     VARCHAR(1024) DEFAULT NULL,
+    `redirect_uri`   VARCHAR(1024) DEFAULT NULL,
+    `browser_hash`   VARCHAR(64)  DEFAULT NULL,
+    `expires_at`     BIGINT UNSIGNED NOT NULL DEFAULT 0,
+    `consumed_at`    BIGINT UNSIGNED NOT NULL DEFAULT 0,
+    `kyte_account`   BIGINT UNSIGNED DEFAULT 0,
+    `created_by`     BIGINT UNSIGNED DEFAULT NULL,
+    `date_created`   BIGINT UNSIGNED DEFAULT NULL,
+    `modified_by`    BIGINT UNSIGNED DEFAULT NULL,
+    `date_modified`  BIGINT UNSIGNED DEFAULT NULL,
+    `deleted_by`     BIGINT UNSIGNED DEFAULT NULL,
+    `date_deleted`   BIGINT UNSIGNED DEFAULT NULL,
+    `deleted`        TINYINT UNSIGNED NOT NULL DEFAULT 0,
+    UNIQUE KEY `idx_state` (`state`),
+    KEY `idx_expires` (`expires_at`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+CREATE TABLE IF NOT EXISTS `KyteSsoCode` (
+    `id`            BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
+    `code_hash`     VARCHAR(64) NOT NULL,
+    `application`   BIGINT UNSIGNED NOT NULL,
+    `sso_user_id`   BIGINT UNSIGNED NOT NULL,
+    `expires_at`    BIGINT UNSIGNED NOT NULL DEFAULT 0,
+    `consumed_at`   BIGINT UNSIGNED NOT NULL DEFAULT 0,
+    `kyte_account`  BIGINT UNSIGNED DEFAULT 0,
+    `created_by`    BIGINT UNSIGNED DEFAULT NULL,
+    `date_created`  BIGINT UNSIGNED DEFAULT NULL,
+    `modified_by`   BIGINT UNSIGNED DEFAULT NULL,
+    `date_modified` BIGINT UNSIGNED DEFAULT NULL,
+    `deleted_by`    BIGINT UNSIGNED DEFAULT NULL,
+    `date_deleted`  BIGINT UNSIGNED DEFAULT NULL,
+    `deleted`       TINYINT UNSIGNED NOT NULL DEFAULT 0,
+    UNIQUE KEY `idx_code_hash` (`code_hash`),
+    KEY `idx_expires` (`expires_at`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+-- KyteSsoIdentity: the federated-identity link binding an external IdP subject
+-- to a local app user. This is the AUTHORITATIVE join key for SSO logins (the
+-- immutable `sub` + tenant), NOT the mutable/unverified email claim — closing
+-- the account-takeover vector where a token bearing another user's email would
+-- otherwise be mapped onto that user's account.
+CREATE TABLE IF NOT EXISTS `KyteSsoIdentity` (
+    `id`            BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
+    `application`   BIGINT UNSIGNED NOT NULL,
+    `provider`      VARCHAR(32)  NOT NULL,
+    `subject`       VARCHAR(255) NOT NULL,
+    `tenant_id`     VARCHAR(128) DEFAULT NULL,
+    `sso_user_id`   BIGINT UNSIGNED NOT NULL,
+    `email`         VARCHAR(320) DEFAULT NULL,
+    `kyte_account`  BIGINT UNSIGNED DEFAULT 0,
+    `created_by`    BIGINT UNSIGNED DEFAULT NULL,
+    `date_created`  BIGINT UNSIGNED DEFAULT NULL,
+    `modified_by`   BIGINT UNSIGNED DEFAULT NULL,
+    `date_modified` BIGINT UNSIGNED DEFAULT NULL,
+    `deleted_by`    BIGINT UNSIGNED DEFAULT NULL,
+    `date_deleted`  BIGINT UNSIGNED DEFAULT NULL,
+    `deleted`       TINYINT UNSIGNED NOT NULL DEFAULT 0,
+    UNIQUE KEY `idx_app_provider_subject` (`application`, `provider`, `subject`),
+    KEY `idx_sso_user` (`application`, `sso_user_id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+-- ---------------------------------------------------------------------------
+-- Idempotent ALTERs for installs that created the tables from an earlier cut
+-- of this migration (before browser_hash / the identity table existed).
+-- ---------------------------------------------------------------------------
+
+-- KyteSsoState.browser_hash — login-CSRF browser-binding correlator.
+SET @add_browser_hash := (
+    SELECT IF(COUNT(*) = 0,
+        'ALTER TABLE `KyteSsoState` ADD COLUMN `browser_hash` VARCHAR(64) DEFAULT NULL AFTER `redirect_uri`',
+        'SELECT 1')
+    FROM information_schema.COLUMNS
+    WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = 'KyteSsoState' AND COLUMN_NAME = 'browser_hash'
+);
+PREPARE stmt FROM @add_browser_hash; EXECUTE stmt; DEALLOCATE PREPARE stmt;

src/Core/Api.php

@@ -701,6 +701,25 @@ public function route() {
 				return;
 			}
 
+			// /oauth/* (authorization server) and /.well-known/oauth-*
+			// (RFC 8414 / RFC 9728 discovery) are served by OAuthEndpoint — the
+			// OAuth 2.1 front door that lets Claude.ai / ChatGPT add /mcp as a
+			// hosted connector (KYTE-#551). Runs before the MVC pipeline, same
+			// rationale as /mcp and /jwt (own response shapes, pre-auth flow).
+			if (strcasecmp($firstSegment, 'oauth') === 0
+				|| stripos($path, '.well-known/oauth-') === 0) {
+				\Kyte\Core\Auth\OAuthEndpoint::handle($this);
+				return;
+			}
+
+			// /sso/* — app-level OIDC SSO. An app's end users sign in via their
+			// identity provider (Microsoft/Entra first) and get a Kyte JWT
+			// session (KYTE-#560). Runs before the MVC pipeline like /jwt, /mcp.
+			if (strcasecmp($firstSegment, 'sso') === 0) {
+				\Kyte\Core\Auth\SsoEndpoint::handle($this);
+				return;
+			}
+
 			if (isset($_SERVER['HTTP_X_KYTE_APPID'])) {
 				$this->appId = $_SERVER['HTTP_X_KYTE_APPID'];
 			}

src/Core/Auth/JwtEndpoint.php

@@ -483,6 +483,45 @@ private static function passwordUpdate(array $body): array
      *   email user email (if available)
      *   app   application identifier when app-scoped, omitted otherwise
      */
+    /**
+     * Issue a full Kyte session (access JWT + refresh token) for an already-
+     * authenticated user. Shared by /jwt/login and app-level SSO (KYTE-#560) so
+     * both hand back the identical session shape. `$app` is the resolved
+     * Application ModelObject (or null for platform/KyteUser).
+     *
+     * @return array<string,mixed>
+     */
+    public static function issueSession(ModelObject $user, ModelObject $account, ?ModelObject $app, string $ip): array
+    {
+        $appIdentifier = $app !== null ? (string)$app->identifier : null;
+        $appId = $app !== null ? (int)$app->id : null;
+
+        $accessToken = self::mintAccessJwt($user, $account, $appIdentifier);
+        $refresh = RefreshTokenStore::issue((int)$user->id, (int)$account->id, $appId, $ip);
+
+        if (isset($user->kyte_model['struct']['lastLogin'])) {
+            try {
+                $user->save(['lastLogin' => time()]);
+            } catch (\Throwable $e) {
+                error_log('JwtEndpoint::issueSession lastLogin update failed - ' . $e->getMessage());
+            }
+        }
+
+        $userData = self::userToArray($user);
+        $useSessionMap = defined('USE_SESSION_MAP') && USE_SESSION_MAP;
+
+        return [
+            'access_token'       => $accessToken,
+            'token_type'         => 'Bearer',
+            'expires_in'         => self::accessTtl(),
+            'refresh_token'      => $refresh['raw'],
+            'refresh_expires_at' => $refresh['expires_at'],
+            'uid'                => (int)$user->id,
+            'account_id'         => (int)$account->id,
+            'data'               => $useSessionMap ? $userData : [$userData],
+        ];
+    }
+
     private static function mintAccessJwt(ModelObject $user, ModelObject $account, ?string $appIdentifier): string
     {
         if (!defined('KYTE_JWT_SECRET') || KYTE_JWT_SECRET === '') {
@@ -516,7 +555,7 @@ private static function mintAccessJwt(ModelObject $user, ModelObject $account, ?
      *
      * @return array{user_model: array, username_field: string, password_field: string, app: ?ModelObject}
      */
-    private static function resolveAuthContext(?string $appIdentifier): array
+    public static function resolveAuthContext(?string $appIdentifier): array
     {
         $defaultUserField = defined('USERNAME_FIELD') ? USERNAME_FIELD : 'email';
         $defaultPassField = defined('PASSWORD_FIELD') ? PASSWORD_FIELD : 'password';