feat(auth): Universal Multi-Provider JIT Dynamic Discovery Bridge (CIMD / Auth0 / Okta / Zitadel / Keycloak)

[hemantj-cloud]

Description

This PR implements the Universal Multi-Provider Just-in-Time (JIT) Dynamic Discovery Bridge (JitBridge) in @nitrostack/core per the OAuth Client ID Metadata Document (draft-ietf-oauth-client-id-metadata-document) specification.

This bridge enables dynamic AI agents (ChatGPT, Claude Desktop, Cursor, Claude Code, custom agents) with dynamic CIMD client URLs (e.g. https://chatgpt.com/oauth/<id>/client.json) and dynamic desktop loopback ports (http://127.0.0.1:<port>) to authenticate seamlessly with enterprise Identity Providers (Auth0, Okta, Zitadel, Keycloak, Ory Hydra, Stytch) with zero manual pre-registration or DCR onboarding bottlenecks.

---

Key Architecture & Features

1. Multi-Provider JIT Bridge (src/auth/jit/)

• JitBridge Controller (jit-bridge.ts):
  • Request controller managing dynamic client resolution, on-the-fly provisioning, and authorization proxying.
  • Authorization Gateway (GET /oauth/v2/authorize): Intercepts authorization requests with CIMD URL client_id, auto-provisions or resolves the client in the upstream IdP, maps RFC 8707 resource to IdP audience, and issues a 302 Redirect to the IdP login screen.
  • Token Exchange Proxy (POST /oauth/v2/token): Proxies authorization code and refresh token exchanges, translating dynamic CIMD identifiers to upstream IdP credentials across JSON, application/x-www-form-urlencoded, and Authorization: Basic <base64> formats.
• Provider Adapters (src/auth/jit/adapters/):
  • Auth0JitAdapter: Manages Auth0 Management API M2M client provisioning, dynamic SPA/Public PKCE client configuration, API scope grant attachments (cgr_*), and ephemeral desktop loopback callback merging.
  • OktaJitAdapter: Dynamic Client Registration (DCR) and Apps API integration for Okta authorization servers.
  • GenericDcrJitAdapter: Universal RFC 7591 Dynamic Client Registration adapter for Zitadel, Keycloak, and Ory Hydra.
  • PassthroughJitAdapter: Native CIMD passthrough for providers with built-in CIMD support (Stytch).

2. CIMD Resolvers & SSRF Security (src/auth/cimd.ts)

• SSRF Defense: RFC 6890 / RFC 1918 private IP validation blocking (127.0.0.1, 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, cloud metadata 169.254.169.254).
• Bounded Response Guard: Strict 5 KiB response size limit and 3-second timeout protection.
• CIMD Resolver Cache: In-memory cache with positive/negative TTL and deduplicated in-flight fetches.
• Callback Validator: Strict validateRedirectUriWithCimd() matching against authorized redirect_uris.

3. Server-Side Discovery Gateway & Transports (src/core/oauth-module.ts, transports/)

• Gateway Advertisement: Advertises the MCP server origin as the authorization_server in /.well-known/oauth-protected-resource and path-scoped /.well-known/oauth-protected-resource/mcp.
• Dynamic Metadata: Advertises /oauth/v2/authorize and /oauth/v2/token in /.well-known/oauth-authorization-server and /.well-known/openid-configuration.
• Form URL-Encoded Support: Mounted express.urlencoded({ extended: true }) in HttpServerTransport and StreamableHttpTransport for RFC 6749 form-encoded token exchanges.

---

Verification & Testing

• JIT Bridge Unit Tests: src/auth/jit/__tests__/jit-bridge.test.ts (12/12 tests passing).
• CIMD Unit Tests: src/auth/__tests__/cimd-jit.test.ts (14/14 tests passing).
• Full Test Suite: All 62 test suites (736 tests) passing across @nitrostack/core.
• Live Integration Testing: Verified against live Auth0 tenant with dynamic ChatGPT CIMD resolution, PKCE authorization code exchange, and token issuance.