feat(auth): directory-review support — env-gated reviewer login + submission prep#144
Merged
Conversation
…mission prep Everything the Claude Directory / OpenAI Apps reviews need from this repo, ahead of listing the remote MCP endpoint. - POST /api/auth/review-login + /auth/review-login page: password login for directory reviewers (OpenAI rejects OAuth/MFA/email-confirmation test accounts). Exists ONLY when NUXT_REVIEW_ACCOUNT_EMAIL + NUXT_REVIEW_ACCOUNT_PASSWORD (>=16 chars, boot-validated) are set on the managed pair; accepts exactly that one address; timing-safe digest comparison; per-IP rate limit; 404 otherwise - /.well-known/openai-apps-challenge: domain-verification token from NUXT_OPENAI_APPS_CHALLENGE (unset = route does not exist) - docs/REMOTE_MCP_SUBMISSION.md: operator runbook — org prerequisites, review-account setup, 9-step manual test matrix, Claude + OpenAI portal walkthroughs, post-listing invariants, and the upstream @contentrain/mcp checklist (openWorldHint missing on all 19 tools; server instructions + sessionFingerprint land with 1.9.0) - tests: review-login gating matrix (env opt-in shapes, wrong creds, rate limit, session cookie), challenge route, middleware public-path pin for /api/auth/review-login
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
PR4 of the remote-MCP program (PR1: #141, PR2: #142, PR3: #143) — the in-repo half of directory-submission prep.
Reviewer login (the OpenAI hard requirement)
OpenAI rejects test accounts that need OAuth, MFA, SMS or email confirmation; Studio's login is OAuth + magic link only. Solution (user-approved): an env-gated password login.
POST /api/auth/review-login+/auth/review-loginpage.NUXT_REVIEW_ACCOUNT_EMAIL+NUXT_REVIEW_ACCOUNT_PASSWORDare both set on the managed pair — otherwise a plain 404, indistinguishable from a nonexistent route. Default everywhere (including prod until a review window opens) is unset.timingSafeEqualcomparison; 5/min per-IP rate limit; password <16 chars fails boot validation (it gates a real login).OpenAI domain verification
/.well-known/openai-apps-challengeserves the portal-issued token fromNUXT_OPENAI_APPS_CHALLENGEastext/plain; unset → 404.Runbook
docs/REMOTE_MCP_SUBMISSION.md— operator playbook: org prerequisites (Claude Team org + directory access, OpenAI org verification + global residency), review-account setup/rotation, 9-step manual test matrix (Inspector / Claude / Claude Code / ChatGPT / Codex / step-up / refresh / revoke / write path), both portal walkthroughs, post-listing invariants (origin is contractual; PRMresourcenever changes), and the upstream@contentrain/mcpchecklist from auditing the installed 1.8.1:title+ correctreadOnlyHint/destructiveHint, names ≤64openWorldHintmissing on all 19 tools (OpenAI requires it) → upstream, rides 1.9.0instructionsunsupported in 1.8.1 → lands with 1.9.0 (sessionFingerprintintegration noted alongside)Tests
Review-login gating matrix (env opt-in shapes ×4, wrong creds, case-insensitive email, rate limit, session cookie set), challenge route (token / 404), middleware public-path pin.
pnpm lint✓ ·pnpm typecheck✓ · unit+integration+nuxt 1007 ✓