Fix MCP Apps marker refresh and relay JWT expiry

Author: cursoragent

src/app/managed-auth-proxy/auth/connections/[...path]/route.test.ts

@@ -15,6 +15,11 @@ const scopedToken = jwt({
   managed_auth_session_id: "session_1",
   exp: 4102444800,
 });
+const expiredScopedToken = jwt({
+  iss: "kernel-api",
+  managed_auth_session_id: "session_1",
+  exp: 1,
+});
 
 function request(
   path: string,
@@ -70,6 +75,15 @@ describe("managed-auth relay", () => {
     );
     expect(apiKey.status).toBe(401);
     expectCors(apiKey);
+
+    const expired = await proxyManagedAuthRequest(
+      request("/managed-auth-proxy/auth/connections/c_1", {
+        headers: { authorization: `Bearer ${expiredScopedToken}` },
+      }),
+      ["c_1"],
+    );
+    expect(expired.status).toBe(401);
+    expectCors(expired);
   });
 
   test("allows unauthenticated exchange and strips cookies and arbitrary headers", async () => {

src/app/managed-auth-proxy/auth/connections/[...path]/route.ts

@@ -53,11 +53,14 @@ function managedAuthAuthorization(request: Request): string | null {
   const match = authorization?.match(/^Bearer\s+([^\s]+)$/i);
   if (!match) return null;
   const claims = decodeJwtPayload(match[1]);
+  const nowSeconds = Math.floor(Date.now() / 1000);
   if (
     claims?.iss !== "kernel-api" ||
     typeof claims.managed_auth_session_id !== "string" ||
     !claims.managed_auth_session_id ||
-    typeof claims.exp !== "number"
+    typeof claims.exp !== "number" ||
+    !Number.isFinite(claims.exp) ||
+    claims.exp <= nowSeconds
   ) {
     return null;
   }

src/lib/redis.ts

@@ -152,8 +152,9 @@ export { client as redisClient };
 // (one McpServer per request), so a client's declared
 // `io.modelcontextprotocol/ui` capability from initialize is not visible to
 // later tool calls on the same connection. The route layer records it here,
-// keyed by the bearer token, so app-only tools can fail closed on hosts that
-// never declared MCP Apps support.
+// keyed by the bearer token plus JWT session claim when available, so
+// refreshed access tokens from the same OAuth session keep the marker alive
+// while app-only tools still fail closed on hosts that never declared support.
 const MCP_APPS_KEY_PREFIX = "mcp-apps:";
 
 function hashBearerToken(token: string): string {
@@ -164,6 +165,33 @@ function hashBearerToken(token: string): string {
   return createHmac("sha256", secretKey).update(token).digest("hex");
 }
 
+function decodeJwtPayload(token: string): Record<string, unknown> | null {
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
+  try {
+    return JSON.parse(
+      Buffer.from(parts[1], "base64url").toString("utf8"),
+    ) as Record<string, unknown>;
+  } catch {
+    return null;
+  }
+}
+
+function mcpAppsMarkerKeys(token: string): string[] {
+  const keys = [`${MCP_APPS_KEY_PREFIX}${hashBearerToken(token)}`];
+  const claims = decodeJwtPayload(token);
+  const sessionId =
+    typeof claims?.sid === "string" && claims.sid
+      ? claims.sid
+      : typeof claims?.session_id === "string" && claims.session_id
+        ? claims.session_id
+        : null;
+  if (sessionId) {
+    keys.push(`${MCP_APPS_KEY_PREFIX}session:${hashOpaqueToken(sessionId)}`);
+  }
+  return keys;
+}
+
 export async function markMcpAppsClient({
   token,
   ttlSeconds,
@@ -172,10 +200,10 @@ export async function markMcpAppsClient({
   ttlSeconds: number;
 }): Promise<void> {
   await ensureConnected();
-  const key = `${MCP_APPS_KEY_PREFIX}${hashBearerToken(token)}`;
-  await withReconnect(() =>
-    client.setEx(key, Math.max(60, Math.floor(ttlSeconds)), "1"),
-  );
+  const ttl = Math.max(60, Math.floor(ttlSeconds));
+  for (const key of mcpAppsMarkerKeys(token)) {
+    await withReconnect(() => client.setEx(key, ttl, "1"));
+  }
 }
 
 /**
@@ -190,12 +218,13 @@ export async function hasMcpAppsClient({
   ttlSeconds: number;
 }): Promise<boolean> {
   await ensureConnected();
-  const key = `${MCP_APPS_KEY_PREFIX}${hashBearerToken(token)}`;
-  const value = await withReconnect(() => client.get(key));
-  if (value === null) return false;
-  await withReconnect(() =>
-    client.expire(key, Math.max(60, Math.floor(ttlSeconds))),
-  );
+  const ttl = Math.max(60, Math.floor(ttlSeconds));
+  const keys = mcpAppsMarkerKeys(token);
+  const values = await withReconnect(() => client.mGet(keys));
+  if (!values.some((value) => value !== null)) return false;
+  for (const key of keys) {
+    await withReconnect(() => client.expire(key, ttl));
+  }
   return true;
 }