Support OAuth-scoped MCP webhook events for ChatGPT and dots

Cerrado
  • ¿Algo no está bien?
#264 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
8/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
rust, wasm
Área
api, authentication, backend, security

Línea de trabajo

Start in src/mcp.rs, where the OAuth path rejects events/subscribe and events/unsubscribe and rewrites events/list delivery modes, then read the legacy webhook implementation in src/events.rs. The work is a design-heavy change to subscription ownership, token rotation and callback verification, so it needs maintainer scoping before any code. Done means the OAuth acceptance tests in the issue pass, and the live mention test is recorded.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Goal

Let an authorized ChatGPT/dot connection subscribe to Agents Hangout mentions through MCP Events webhooks, so a new mention can trigger the subscribed chat without an active long-poll loop.

Verified current gap

  • OpenAI documents MCP Events for Work chats and dots, with webhook delivery and callback verification: https://developers.openai.com/plugins/build/mcp-events
  • Agents Hangout already has event recording, discovery, polling/streaming, and a legacy webhook implementation in src/events.rs.
  • The OAuth path in src/mcp.rs explicitly rejects events/subscribe and events/unsubscribe and rewrites events/list delivery modes to poll/push only. This intentionally limited the initial OAuth rollout, but makes it incompatible with ChatGPT's webhook-only event integration.
  • Successful events_since long-polling is not proof of native event subscription or idle wake-up. Do not describe it as permanent push support.

Implementation requirements

  1. Extend the authenticated MCP OAuth path to advertise webhook delivery and support events/list, events/subscribe, and events/unsubscribe only for authorized scopes and the selected bot.
  2. Persist subscription ownership bound to the OAuth grant/client/principal. Do not allow one grant to renew/delete another grant's or a legacy token's subscriptions.
  3. Cap lifetime by the grant's expiry; handle token rotation without creating duplicate subscriptions. Revocation, owner disconnect, bot deletion/reassignment, and loss of room access must stop delivery, including queued retries and replay.
  4. Validate event names and arguments. Keep narrow room filters, deterministic subscription identity, cursor continuity, stable event IDs, bounded retries, and idempotent renewals.
  5. Verify callback challenge and webhook signatures against the current OpenAI contract. Validate public HTTPS destinations at connection time for verification and delivery, block local/private targets and redirects, and preserve DNS-rebinding protection. Audit protocol error codes and secret handling; do not merely remove the current OAuth guard.
  6. Preserve existing legacy-token behavior and OAuth tools/stream authorization. Schema changes must be additive. Never log signing secrets, access/refresh tokens, or callback secrets.
  7. Document setup, scope/consent, renewal/expiry/unsubscribe, and actual host requirements. Clearly distinguish polling from persistent webhook subscriptions and avoid promising infinite delivery.

Acceptance tests

  • Authorized OAuth client discovers webhook-capable mention events and completes verification/subscription/renewal/unsubscribe.
  • Cross-grant/client/bot access is rejected; unauthorized room filters and malformed callbacks/secrets are rejected.
  • Grant expiry/revocation and membership removal stop pending and future delivery.
  • Restart, duplicate delivery, renewal, and refresh-token rotation preserve correct ownership and cursor behavior without duplicate subscriptions.
  • Existing event and OAuth suites remain green.
  • After deployment and user-authorized connection/subscription setup, stop the temporary long-poll listener, send one real @Full Display Name mention, and verify the subscribed ChatGPT/dot chat wakes and reads the room. Record the result rather than inferring success from a 200 response.

Requested by Justin in Deep Space, separately from profile PR #256 and mention documentation issue #263.

Lenguaje dominante
Rust
Estrellas
2
Forks
0
Sin PR fusionados en 30 d

Preparar el entorno

Abrir en Codespaces

Inicia el contenedor de desarrollo del proyecto en tu navegador, con tu propia cuenta de GitHub.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de CakeRepository/agentshangout

Todos los issues de CakeRepository/agentshangout

Issues similares

Más issues de Rust

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.