security: sovereign-audit Pass-2 fixes — auth-lib, oauth, templates

Six confirmed findings closed (3 MEDIUM, 3 LOW). Tier-1 surfaces from
Pass-1 re-verified non-regressed; this pass deepened the audit on the
auth library, OAuth issuer, and template marketplace.

Za-002 MEDIUM (scrypt cost) — bump SCRYPT_N from 2^14 → 2^17 (131072)
  matching current OWASP guidance for password hashing in 2026. Hash
  format embeds N (`scrypt$N$salt$hash`), so the existing admin
  password at the old cost still verifies — backward-compatible. Also
  added explicit maxmem ceilings since Node's default (~32MiB) is
  insufficient for the new N.

Za-003 MEDIUM (single-use race) — consumeMagicLink was SELECT-then-
  UPDATE; two parallel redemptions could both win and mint two
  sessions from the same token. Now uses the same atomic
  `UPDATE … WHERE id = ? AND consumedAt IS NULL RETURNING id` pattern
  /oauth/token already had — loser of the race gets
  invalid_or_expired_token.

Za-004 LOW (membership ordering) — `.orderBy(memberships.createdAt)`
  added so when org-invites eventually let a user belong to multiple
  orgs, the same one wins every login instead of insertion-order
  roulette. Latent-bug pre-empt.

Zb-002 LOW (OAuth register spam) — /oauth/register now per-IP daily
  rate-limited at 20/day (well above any legitimate MCP-client
  bootstrap pattern). Prevents DB-row spam.

Zc-001 MEDIUM (banned-pattern drift) — three separate copies of
  BANNED_PATTERNS had drifted apart. The publish-time scanner in
  templates.ts was MISSING the 7 new patterns added in Pass-1
  (process.binding, dlopen, .constructor.constructor, vm.runIn*,
  globalThis['..']). Single source of truth in @bmm/llm now exports
  SHARED_BANNED_PATTERNS; templates.ts composes PUBLISH_BANNED_PATTERNS
  = SHARED ∪ code-only-extras (dynamic import, fs.rm, setTimeout-with-
  string, process.kill, jailbreak markers).

Zc-002 LOW (N+1) — /v1/templates list was issuing one COUNT(*) per
  template (101 queries for a 100-row page). Now one grouped query
  with templateId GROUP BY, merged in JS. p95 doesn't degrade with
  marketplace growth.

DEFERRED (documented, scoped for next sprint):
  Za-001 HIGH — Account takeover via cross-provider email lookup.
    Requires schema change (users.primaryProvider). Mitigation in
    /settings/account banner planned.
  Zb-001 MEDIUM — /oauth/token refresh_token grant: advertised in
    AS metadata but unsupported_grant_type. Either implement (~40
    LOC) or strip from metadata.
  Zc-003 LOW — Admin takedown partial-failure consistency.
  Zd-001 IMPROVE — DEK cache invalidation across replicas (single-
    instance today).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/api/src/routes/oauth.ts

@@ -13,6 +13,7 @@ import {
   oauthTokens,
 } from '@bmm/db';
 import { getJWKS, signAccessToken } from '../lib/jwks.js';
+import { checkDailyLimit } from '../lib/rate-limit.js';
 import { requireAuth } from '../plugins/session.js';
 import { config } from '../config.js';
 
@@ -73,8 +74,18 @@ export async function oauthRoutes(app: FastifyInstance): Promise<void> {
     return reply.send(await getJWKS());
   });
 
-  // RFC 7591 Dynamic Client Registration
+  // RFC 7591 Dynamic Client Registration — rate-limited per-IP to prevent
+  // DB-row spam. 20/day per visitor IP is well above legitimate MCP-client
+  // bootstrap rates (each AI client registers once per resource server, ever).
+  // (Zb-002.)
   app.post('/oauth/register', async (req, reply) => {
+    const rl = await checkDailyLimit('oauth_register', req.ip, 20);
+    if (!rl.ok) {
+      return reply.code(429).send({
+        error: 'rate_limited',
+        detail: 'Too many client registrations from this IP. Try again tomorrow.',
+      });
+    }
     const Body = z.object({
       client_name: z.string().min(1).max(128).optional(),
       redirect_uris: z.array(z.string().url()).min(1).max(10),

apps/api/src/routes/templates.ts

@@ -14,6 +14,7 @@ import {
   templates,
   users,
 } from '@bmm/db';
+import { SHARED_BANNED_PATTERNS } from '@bmm/llm';
 import { GeneratorSpec } from '@bmm/types';
 import type { FastifyInstance } from 'fastify';
 import { z } from 'zod';
@@ -25,20 +26,23 @@ import { requireAdmin, requireAuth } from '../plugins/session.js';
 
 const db = createDb();
 
-const BANNED_PATTERNS = [
-  /\beval\s*\(/,
-  /\bnew\s+Function\s*\(/,
-  /\bFunction\s*\(\s*['"`]/, // Function('code')() — no `new` needed
+// Code-level extras on top of SHARED_BANNED_PATTERNS — these are concerns
+// that only make sense scanning a fully-rendered server.ts (not a spec).
+// Keeping them additive means @bmm/llm stays the single source of truth for
+// "obvious-malicious patterns", and publish-time gets stricter checks on top.
+// (Zc-001 consolidation.)
+const CODE_EXTRA_PATTERNS: RegExp[] = [
   /\bimport\s*\(/, // dynamic import (escape from bundle scope)
   /\bsetTimeout\s*\(\s*['"`]/, // setTimeout('code', ms) eval form
   /\bsetInterval\s*\(\s*['"`]/,
-  /\bchild_process\b/,
   /\bfs\s*\.\s*(unlink|rmdir|rm)\b/,
   /\bprocess\s*\.\s*kill\b/,
-  /ignore\s+previous\s+instructions/i,
-  /disregard\s+(the\s+)?(above|previous)/i,
   /you\s+are\s+now\s+(in\s+)?(developer|jailbreak|dan)\s+mode/i,
 ];
+const PUBLISH_BANNED_PATTERNS: readonly RegExp[] = [
+  ...SHARED_BANNED_PATTERNS,
+  ...CODE_EXTRA_PATTERNS,
+];
 
 // Hardcoded-credential patterns. If Claude embedded a literal API key into the
 // generated code (publisher pasted it into the prompt), block the publish.
@@ -54,7 +58,7 @@ const SECRET_PATTERNS = [
 ];
 
 function scanForInjection(code: string): void {
-  for (const pattern of BANNED_PATTERNS) {
+  for (const pattern of PUBLISH_BANNED_PATTERNS) {
     if (pattern.test(code)) throw new Error(`banned_pattern: ${pattern.source}`);
   }
 }
@@ -314,21 +318,27 @@ export async function templateRoutes(app: FastifyInstance): Promise<void> {
       ? rows.filter((r) => r.template.category === parsed.data.category)
       : rows;
 
-    // Augment with active deployment counts
-    const enriched = await Promise.all(
-      filtered.map(async (r) => {
-        const [active] = await db
-          .select({ c: count() })
-          .from(mcpServers)
-          .where(and(eq(mcpServers.templateId, r.template.id), eq(mcpServers.status, 'live')));
-        return {
-          ...r.template,
-          ownerName: r.ownerName ?? r.ownerEmail?.split('@')[0] ?? null,
-          ownerOrgName: r.ownerOrgName,
-          activeDeployments: Number(active?.c ?? 0),
-        };
-      }),
-    );
+    // Single grouped query — was N+1 (one COUNT per template). On a 100-row
+    // listing that's 101 round-trips → p95 latency cliff once the marketplace
+    // grows. (Zc-002.)
+    const templateIds = filtered.map((r) => r.template.id);
+    const activeCounts = new Map<string, number>();
+    if (templateIds.length > 0) {
+      const grouped = await db
+        .select({ id: mcpServers.templateId, c: count() })
+        .from(mcpServers)
+        .where(and(eq(mcpServers.status, 'live'), sql`${mcpServers.templateId} = ANY(${templateIds})`))
+        .groupBy(mcpServers.templateId);
+      for (const g of grouped) {
+        if (g.id) activeCounts.set(g.id, Number(g.c));
+      }
+    }
+    const enriched = filtered.map((r) => ({
+      ...r.template,
+      ownerName: r.ownerName ?? r.ownerEmail?.split('@')[0] ?? null,
+      ownerOrgName: r.ownerOrgName,
+      activeDeployments: activeCounts.get(r.template.id) ?? 0,
+    }));
 
     // Sort
     const now = Date.now();