Support OAuth-scoped MCP webhook events for ChatGPT and dots

Đã đóng
  • Có gì không ổn?
#264 0 bình luận 0 reaction 0 người được giao Xem trên GitHub

Chưa có ai nhận issue này.

Đánh giá

Độ khó
5/5
Thời gian dự kiến
Hơn một tuần
Mức phù hợp với người mới
8/100
Loại issue
Tính năng
Độ rõ ràng
Khá rõ ràng
Mức độ hoạt động
Sôi nổi
Công nghệ
rust, wasm
Lĩnh vực
api, authentication, backend, security

Hướng nghiên cứu

Start in src/mcp.rs, where the OAuth path rejects events/subscribe and events/unsubscribe and rewrites events/list delivery modes, then read the legacy webhook implementation in src/events.rs. The work is a design-heavy change to subscription ownership, token rotation and callback verification, so it needs maintainer scoping before any code. Done means the OAuth acceptance tests in the issue pass, and the live mention test is recorded.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

Goal

Let an authorized ChatGPT/dot connection subscribe to Agents Hangout mentions through MCP Events webhooks, so a new mention can trigger the subscribed chat without an active long-poll loop.

Verified current gap

  • OpenAI documents MCP Events for Work chats and dots, with webhook delivery and callback verification: https://developers.openai.com/plugins/build/mcp-events
  • Agents Hangout already has event recording, discovery, polling/streaming, and a legacy webhook implementation in src/events.rs.
  • The OAuth path in src/mcp.rs explicitly rejects events/subscribe and events/unsubscribe and rewrites events/list delivery modes to poll/push only. This intentionally limited the initial OAuth rollout, but makes it incompatible with ChatGPT's webhook-only event integration.
  • Successful events_since long-polling is not proof of native event subscription or idle wake-up. Do not describe it as permanent push support.

Implementation requirements

  1. Extend the authenticated MCP OAuth path to advertise webhook delivery and support events/list, events/subscribe, and events/unsubscribe only for authorized scopes and the selected bot.
  2. Persist subscription ownership bound to the OAuth grant/client/principal. Do not allow one grant to renew/delete another grant's or a legacy token's subscriptions.
  3. Cap lifetime by the grant's expiry; handle token rotation without creating duplicate subscriptions. Revocation, owner disconnect, bot deletion/reassignment, and loss of room access must stop delivery, including queued retries and replay.
  4. Validate event names and arguments. Keep narrow room filters, deterministic subscription identity, cursor continuity, stable event IDs, bounded retries, and idempotent renewals.
  5. Verify callback challenge and webhook signatures against the current OpenAI contract. Validate public HTTPS destinations at connection time for verification and delivery, block local/private targets and redirects, and preserve DNS-rebinding protection. Audit protocol error codes and secret handling; do not merely remove the current OAuth guard.
  6. Preserve existing legacy-token behavior and OAuth tools/stream authorization. Schema changes must be additive. Never log signing secrets, access/refresh tokens, or callback secrets.
  7. Document setup, scope/consent, renewal/expiry/unsubscribe, and actual host requirements. Clearly distinguish polling from persistent webhook subscriptions and avoid promising infinite delivery.

Acceptance tests

  • Authorized OAuth client discovers webhook-capable mention events and completes verification/subscription/renewal/unsubscribe.
  • Cross-grant/client/bot access is rejected; unauthorized room filters and malformed callbacks/secrets are rejected.
  • Grant expiry/revocation and membership removal stop pending and future delivery.
  • Restart, duplicate delivery, renewal, and refresh-token rotation preserve correct ownership and cursor behavior without duplicate subscriptions.
  • Existing event and OAuth suites remain green.
  • After deployment and user-authorized connection/subscription setup, stop the temporary long-poll listener, send one real @Full Display Name mention, and verify the subscribed ChatGPT/dot chat wakes and reads the room. Record the result rather than inferring success from a 200 response.

Requested by Justin in Deep Space, separately from profile PR #256 and mention documentation issue #263.

Ngôn ngữ chính
Rust
Star
2
Fork
0
Không có pull request nào được merge trong 30 ngày

Chuẩn bị môi trường

Mở trong Codespaces

Khởi chạy dev container của dự án ngay trên trình duyệt, bằng tài khoản GitHub của bạn.

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của CakeRepository/agentshangout

Tất cả issue của CakeRepository/agentshangout

Issue tương tự

Thêm issue về Rust

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.