fix: stop pulling node:dns into client bundle via OAuth discovery

lib/oauth/discovery.ts

@@ -1,5 +1,3 @@
-import { isPublicHttpUrl } from '../security/url-guard';
-
 export interface OAuthMetadata {
   issuer: string;
   authorization_endpoint: string;
@@ -8,6 +6,17 @@ export interface OAuthMetadata {
   end_session_endpoint?: string;
 }
 
+// Validates that a discovered endpoint URL is safe to follow. Server-side
+// callers must pass this to gate against SSRF (typically isPublicHttpUrl from
+// @/lib/security/url-guard, which uses node:dns and cannot be bundled for the
+// browser). Client callers omit it: the browser handles outbound networking
+// and an SSRF check isn't meaningful there.
+export type EndpointValidator = (url: string) => Promise<boolean>;
+
+export interface DiscoverOAuthOptions {
+  validateEndpoint?: EndpointValidator;
+}
+
 const CACHE_TTL_MS = 10 * 60 * 1000;
 const CACHE_MAX_ENTRIES = 64;
 const metadataCache = new Map<string, { metadata: OAuthMetadata; expiresAt: number }>();
@@ -26,19 +35,27 @@ function rememberMetadata(serverUrl: string, metadata: OAuthMetadata): void {
 
 // Endpoints come from an attacker-controllable JSON document when callers pass
 // a user-supplied serverUrl (e.g. /api/auth/totp-token-exchange under
-// allowCustomJmapEndpoint). Without this gate, a malicious metadata document
+// allowCustomJmapEndpoint). Without a validator, a malicious metadata document
 // could point token_endpoint at 169.254.169.254 or 127.0.0.1:* and turn the
-// downstream fetch() into an SSRF with response-body reflection.
-async function endpointsArePublic(endpoints: Array<string | undefined>): Promise<boolean> {
+// downstream fetch() into an SSRF with response-body reflection. Server-side
+// callers must pass `validateEndpoint`.
+async function endpointsArePublic(
+  endpoints: Array<string | undefined>,
+  validate: EndpointValidator | undefined,
+): Promise<boolean> {
+  if (!validate) return true;
   for (const endpoint of endpoints) {
     if (endpoint === undefined) continue;
     if (typeof endpoint !== 'string') return false;
-    if (!(await isPublicHttpUrl(endpoint))) return false;
+    if (!(await validate(endpoint))) return false;
   }
   return true;
 }
 
-export async function discoverOAuth(serverUrl: string): Promise<OAuthMetadata | null> {
+export async function discoverOAuth(
+  serverUrl: string,
+  options?: DiscoverOAuthOptions,
+): Promise<OAuthMetadata | null> {
   const cached = metadataCache.get(serverUrl);
   if (cached && cached.expiresAt > Date.now()) return cached.metadata;
   if (cached) metadataCache.delete(serverUrl);
@@ -65,7 +82,7 @@ export async function discoverOAuth(serverUrl: string): Promise<OAuthMetadata |
           data.token_endpoint,
           data.revocation_endpoint,
           data.end_session_endpoint,
-        ]);
+        ], options?.validateEndpoint);
         if (!allPublic) {
           errors.push(`${url} returned non-public or invalid endpoint URL`);
           continue;

lib/oauth/token-exchange.ts

@@ -1,6 +1,7 @@
 import { logger } from '@/lib/logger';
 import { discoverOAuth } from '@/lib/oauth/discovery';
 import type { OAuthMetadata } from '@/lib/oauth/discovery';
+import { isPublicHttpUrl } from '@/lib/security/url-guard';
 import { readFileEnv } from '@/lib/read-file-env';
 import { configManager } from '@/lib/admin/config-manager';
 import { parseJmapServers, findServerById } from '@/lib/admin/jmap-servers';
@@ -46,7 +47,7 @@ function getClientSecret(serverId?: string | null): string {
 
 export async function getTokenEndpoint(serverId?: string | null): Promise<string> {
   const { discoveryUrl } = getRequiredConfig(serverId);
-  const metadata = await discoverOAuth(discoveryUrl);
+  const metadata = await discoverOAuth(discoveryUrl, { validateEndpoint: isPublicHttpUrl });
   if (!metadata?.token_endpoint) {
     throw new Error('OAuth token endpoint not found');
   }
@@ -55,7 +56,7 @@ export async function getTokenEndpoint(serverId?: string | null): Promise<string
 
 export async function getMetadata(serverId?: string | null): Promise<OAuthMetadata | null> {
   const { discoveryUrl } = getRequiredConfig(serverId);
-  return discoverOAuth(discoveryUrl);
+  return discoverOAuth(discoveryUrl, { validateEndpoint: isPublicHttpUrl });
 }
 
 export function buildOAuthParams(base: Record<string, string>, serverId?: string | null): URLSearchParams {