Bind MCP grants to stable account identity - #840
Merged
Merged
Conversation
📝 WalkthroughWalkthroughEmail verification and MCP authentication now use deterministic ChangesStable identity authentication
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant GrantProps
participant MCPContext
participant APP_DB
participant PermissionsDB
GrantProps->>MCPContext: Provide stable user ID
MCPContext->>APP_DB: Load user by stable_user_id
APP_DB-->>MCPContext: Return profile row
MCPContext->>PermissionsDB: Load roles and permissions
PermissionsDB-->>MCPContext: Return authorization data
MCPContext-->>GrantProps: Return enriched user context
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
cursor
Bot
force-pushed
the
cursor/legacy-purge-b-data-migrations-f449
branch
from
July 22, 2026 01:27
e79f794 to
f960a9b
Compare
cursor
Bot
force-pushed
the
cursor/legacy-purge-b-data-migrations-f449
branch
from
July 22, 2026 01:33
f960a9b to
c3ee1c9
Compare
kody-bot
marked this pull request as ready for review
July 22, 2026 01:35
Contributor
|
🔎 Preview deployed: https://kody-pr-840.kody-a99.workers.dev Worker: Mocks:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
packages/worker/src/mcp-auth-user-context.ts (1)
27-28: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueFallback email isn't normalized like the DB-refreshed path.
buildBaseUserFromGrantonly trimsgrantProps.email, while the successful lookup path lowercases it (row.email.trim().toLowerCase(), line 80). Low risk since the fallback carries no roles, but worth aligning for consistency.♻️ Normalize email casing in the fallback path
const email = - typeof grantProps.email === 'string' ? grantProps.email.trim() : '' + typeof grantProps.email === 'string' + ? grantProps.email.trim().toLowerCase() + : ''🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/worker/src/mcp-auth-user-context.ts` around lines 27 - 28, Update buildBaseUserFromGrant’s fallback email normalization to trim and lowercase grantProps.email, matching the row.email normalization used by the successful lookup path while preserving the existing empty-string fallback.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@packages/worker/src/mcp-auth-user-context.ts`:
- Around line 27-28: Update buildBaseUserFromGrant’s fallback email
normalization to trim and lowercase grantProps.email, matching the row.email
normalization used by the successful lookup path while preserving the existing
empty-string fallback.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 28e04bcc-efc9-4109-9fce-8f4b46b53fca
📒 Files selected for processing (10)
packages/worker/src/app/email-verification.node.test.tspackages/worker/src/app/email-verification.tspackages/worker/src/email/inbound.workers.test.tspackages/worker/src/email/outbound.workers.test.tspackages/worker/src/entitlements/test-schema.tspackages/worker/src/mcp-auth-user-context.node.test.tspackages/worker/src/mcp-auth-user-context.tspackages/worker/src/mcp-auth.workers.test.tspackages/worker/src/mcp/capabilities/email/email-usage-get.workers.test.tspackages/worker/src/oauth-handlers.workers.test.ts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
users.stable_user_id, not potentially stale grant emailWhy
After an account email change, an old grant email can later belong to another account. Email-only verification or role lookup could then combine one account's stable data identity with another account's verification/RBAC state.
Validation
npm run validate: passed on final rebased headSystem recap — extends existing primitives (medium risk)
Mode: recap · Base:
main@0b824ebc· Head:c3ee1c9bClassification: extends — tightens identity binding across MCP auth, email verification, and RBAC.
Primitives touched
app-sessionsemailentitlementsapp-uiSystem map
OAuth grant authentication resolves stable identity in D1 before attaching current account metadata or RBAC; verification checks bind both identity attributes.
Legend: green = composes (wiring only) · amber = extended by this PR · red = new primitive · gray = context (unchanged, included only when an edge crosses it).
Invariants
userIdremains the authoritative per-user data scope.Summary by CodeRabbit
Bug Fixes
Tests