Drop the token-host fallback from the DCR reuse lookup

dcrCandidatesForIssuer previously matched a null-origin_issuer row by comparing
registrable token hosts. Now a candidate matches only via dcrIssuerMatches on a
non-null, canonicalized stored issuer. The GC migration backfills origin_issuer
on every surviving DCR row, so post-migration the token-host fallback is dead
code; in the brief deploy->migration window a missed lookup just mints one
duplicate that the migration immediately GCs, which is safer than reusing on a
fuzzy token-host guess. Drops the now-unused tokenUrl parameter and the
registrableHostOfUrl import.

register-dynamic tests: the old null-issuer-token-host reuse test becomes two
cases: a null-issuer legacy row is NOT reused (mints fresh), and a backfilled
row (origin_issuer set) IS reused with no duplicate.

Author: RhysSullivan

packages/core/sdk/src/oauth-gc.ts

@@ -104,10 +104,12 @@ export interface OAuthClientGcRow {
  * is a DCR client. This was validated against the production database: of the
  * 394 rows that carry an explicit origin_kind stamp, `grant =
  * 'authorization_code' AND resource IS NOT NULL` matches all 329 stamped DCR
- * rows and zero stamped-manual rows (100% recall, no false positives). The
- * earlier slug/resource `…mcp…` regex heuristic had bad recall (it missed
- * legacy rows whose slug was a bare provider name like `linear` / `notion` /
- * `cloudflare`), so it is gone; the resource presence check subsumes it.
+ * rows (100% recall). It also matches a handful of stamped-manual BYO rows
+ * that point at MCP servers, but those never reach this arm: an explicit
+ * stamp always wins. The earlier slug/resource `…mcp…` regex heuristic had
+ * bad recall (it missed legacy rows whose slug was a bare provider name like
+ * `linear` / `notion` / `cloudflare`), so it is gone; the resource presence
+ * check subsumes it.
  *
  * Explicit stamps always win (arm 1): a stamped `manual` BYO row keeps its
  * classification even when it carries a resource, and a stamped DCR row is DCR

packages/core/sdk/src/oauth-register-dynamic.test.ts

@@ -252,9 +252,14 @@ describe("oauth.registerDynamicClient", () => {
     ),
   );
 
-  it.effect("reuses legacy DCR-looking rows with no stored issuer by token host", () =>
+  it.effect("does NOT reuse a legacy DCR row with no stored issuer (mints fresh)", () =>
     Effect.scoped(
       Effect.gen(function* () {
+        // Post-migration, the reuse lookup keys strictly on a non-null
+        // origin_issuer: the fuzzy token-host fallback is gone. A legacy row that
+        // has not yet been backfilled (null origin_issuer) is therefore NOT
+        // reused, so a fresh DCR registration happens. The GC migration then
+        // backfills/GCs any duplicate this transient window mints.
         const server = yield* serveOAuthTestServer({ scopes: ["read"] });
         const { config, executor } = yield* makeTestWorkspaceHarness({ plugins });
         yield* executor.acme.seed();
@@ -279,6 +284,64 @@ describe("oauth.registerDynamicClient", () => {
         );
         yield* server.clearRequests;
 
+        const registered = yield* executor.oauth.registerDynamicClient({
+          owner: "org",
+          slug: OAuthClientSlug.make("new-attempt"),
+          issuer: probe.issuer,
+          registrationEndpoint: probe.registrationEndpoint!,
+          authorizationUrl: probe.authorizationUrl,
+          tokenUrl: probe.tokenUrl,
+          resource: server.mcpResourceUrl,
+          scopes: ["read"],
+          tokenEndpointAuthMethodsSupported: probe.tokenEndpointAuthMethodsSupported,
+          clientName: "Acme DCR",
+          redirectUri: FLOW_REDIRECT_URI,
+          originIntegration: INTEG,
+        });
+
+        // A fresh client is registered, not the null-issuer legacy row.
+        expect(registered).not.toBe(legacySlug);
+        const requests = yield* server.requests;
+        expect(registerRequestCount(requests)).toBe(1);
+      }),
+    ),
+  );
+
+  it.effect("reuses a legacy DCR row once its origin_issuer is backfilled", () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        // The post-backfill counterpart: after the GC migration stamps a legacy
+        // row's origin_issuer, the reuse lookup keys on it and mints no
+        // duplicate. This is the steady state the migration establishes.
+        const server = yield* serveOAuthTestServer({ scopes: ["read"] });
+        const { config, executor } = yield* makeTestWorkspaceHarness({ plugins });
+        yield* executor.acme.seed();
+        const probe = yield* executor.oauth.probe({ url: server.mcpResourceUrl });
+        const legacySlug = OAuthClientSlug.make("cloudflare-mcp");
+
+        yield* executor.oauth.createClient({
+          owner: "org",
+          slug: legacySlug,
+          authorizationUrl: probe.authorizationUrl,
+          tokenUrl: probe.tokenUrl,
+          resource: server.mcpResourceUrl,
+          grant: "authorization_code",
+          clientId: "legacy-dcr-client",
+          clientSecret: "",
+        });
+        // Simulate the migration's backfill: legacy DCR stamp + issuer set.
+        yield* Effect.promise(() =>
+          config.db.updateMany("oauth_client", {
+            where: (b) => b("slug", "=", String(legacySlug)),
+            set: {
+              origin_kind: "dynamic_client_registration",
+              origin_integration: null,
+              origin_issuer: probe.issuer,
+            },
+          }),
+        );
+        yield* server.clearRequests;
+
         const reused = yield* executor.oauth.registerDynamicClient({
           owner: "org",
           slug: OAuthClientSlug.make("new-attempt"),

packages/core/sdk/src/oauth-service.ts

@@ -70,13 +70,7 @@ import {
   type OAuthEndpointUrlPolicy,
 } from "./oauth-helpers";
 import { OAUTH2_SESSION_TTL_MS, encodeOAuthCallbackState } from "./oauth";
-import {
-  canonicalIssuerUrl,
-  hostOfUrl,
-  isDcrClassifiedRow,
-  parseUrl,
-  registrableHostOfUrl,
-} from "./oauth-gc";
+import { canonicalIssuerUrl, hostOfUrl, isDcrClassifiedRow, parseUrl } from "./oauth-gc";
 
 /** Connection-minting input for the OAuth flow — extends a connection create
  *  with the OAuth lifecycle fields (client slug, refresh material, expiry,
@@ -677,7 +671,6 @@ export const makeOAuthService = (deps: OAuthServiceDeps): OAuthService => {
   const dcrCandidatesForIssuer = (
     owner: Owner,
     issuer: string | null,
-    tokenUrl: string,
   ): Effect.Effect<readonly DcrReuseCandidate[], StorageFailure> =>
     deps.fuma
       .use("oauth_client.findMany", (db) =>
@@ -687,17 +680,18 @@ export const makeOAuthService = (deps: OAuthServiceDeps): OAuthService => {
       )
       .pipe(
         Effect.map((rows) => {
-          const inputTokenHost = registrableHostOfUrl(tokenUrl);
           const matches = rows.flatMap(
             (row): readonly (DcrReuseCandidate & { readonly createdAt: number })[] => {
               if (parseOAuthClientOrigin(row).kind !== "dynamic_client_registration") return [];
+              // A candidate matches only via a non-null, canonicalized stored
+              // issuer. The GC migration backfills origin_issuer on every
+              // surviving DCR row, so post-migration a null-issuer row is a
+              // transient (unmigrated) row; skipping it just mints one duplicate
+              // the migration then GCs, rather than reusing on a fuzzy token-host
+              // guess.
               const rowIssuer =
                 row.origin_issuer == null ? null : canonicalIssuerUrl(String(row.origin_issuer));
-              const issuerMatches =
-                rowIssuer !== null
-                  ? dcrIssuerMatches(rowIssuer, issuer)
-                  : inputTokenHost !== null &&
-                    registrableHostOfUrl(String(row.token_url)) === inputTokenHost;
+              const issuerMatches = rowIssuer !== null && dcrIssuerMatches(rowIssuer, issuer);
               if (!issuerMatches) return [];
               return [
                 {
@@ -733,7 +727,7 @@ export const makeOAuthService = (deps: OAuthServiceDeps): OAuthService => {
     StorageFailure
   > =>
     Effect.gen(function* () {
-      const candidates = yield* dcrCandidatesForIssuer(input.owner, issuer, input.tokenUrl);
+      const candidates = yield* dcrCandidatesForIssuer(input.owner, issuer);
       const resource = input.resource ?? null;
       if (resource !== null) {
         const matchingResource = candidates.find((client) => client.resource === resource);