Surface vetted-connector branding to Internet Identity, bound to the authorization session

[aterga]

What

This is the imcp2 side of client branding. Internet Identity's consent screen can then show which vetted product is asking for a connect, instead of granting II accounts to an anonymous "some bridge". It complements the CIMD registration mode (#191).

Design

• Server-curated connector table in the new src/branding module. It covers ChatGPT, Claude, Cursor, Grok, Perplexity and Google Antigravity.
  • It is keyed on the session's validated redirect_uri vendor, never on the client-supplied client_name/logo_uri. Open DCR takes all callers, so client-supplied identity is attacker-controlled.
  • Anyone may register a vetted redirect, but the path-pinned allow-list delivers the code only to that vendor's callback. The redirect vendor is therefore a sound, server-determined proxy for product identity.
  • Only a redirect admitted by a compiled-in DEFAULT_ALLOWED_REDIRECTS entry is branded (redirect_uri_on_default_allow_list). An OAUTH_ALLOWED_REDIRECT_PREFIXES entry works for redirects but is never branded, even when it's on a vendor's domain, so a vendor's name only ever rests on the reviewed callback paths in this repo.
  • A test holds the curated domains equal to the compiled-in allow-list vendors.
• Session-bound metadata. GET {issuer}/branding?state=<state> → { name, logo, verified }, CORS-open. Every response, including the 404, is no-store.
  • II passes the state it already holds from the connect link.
  • The server looks up that pending, unexpired connect and derives the connector from the redirect that authorize validated.
  • Nothing in the connect-link fragment asserts branding. The fragment is craftable by any native client that drives the navigation, so a slug there would let a loopback session claim to be "verified Claude".
  • A loopback or unlisted session gets 404, as does an unknown, missing, expired or malformed state. They are indistinguishable, so the endpoint is no session oracle.
  • The lookup is read-only and cannot disturb the handshake.
• Static logo. GET {issuer}/branding/{slug}/logo → SVG with nosniff, a cache header, and a sandboxing CSP (default-src 'none'; style-src 'unsafe-inline'; sandbox). It returns 404 outside the curated set.
  • II must render it via <img> and never inline it, because an inlined SVG can run script.
  • The CSP covers the case where the logo URL is opened top-level, where it would otherwise be an SVG document on the issuer origin. A test keeps every bundled logo free of script, event handlers, embedded HTML and external references.
• One host rule. Redirect validation, the allow-list env parser, the CIMD trust match and branding all use host_key + host_is_or_under, so they cannot disagree about a vendor.
  • For example, https://claude.ai./… (accepted by validation) brands as Claude.
  • A redirect that validation would refuse never resolves to a connector.

Logos are placeholders

The bundled logo is an original, neutral "verified connector" mark. It is deliberately not a reproduction of any vendor's logo, because that is a trademark and licensing matter this repo shouldn't decide. Each vendor's licensed mark can go into its Connector::logo; the factual product names ship now.

Not yet visible: needs II's counterpart

II has to:

• fetch /branding?state= from the validated callback origin, using the one state it parsed from the link for both the lookup and the callback;
• show the verified treatment only for imcp2 issuer origins that II itself trusts.

Until that ships, the endpoints are inert.

Tests

• Unit:
  • redirect → connector resolution, including subdomains, a trailing dot and uppercase;
  • rejection of look-alike apexes, loopback, unlisted hosts, http, redirects validation refuses, and operator-added entries on a vendor's domain;
  • bundled logos are static SVG (no script, handlers, embedded HTML or external references);
  • closed slug lookup;
  • curated domains equal to allow-list domains.
• Unit, branding_is_bound_to_the_session: a vetted session → 200; native → 404; unknown or missing → 404; expired → 404; the lookup leaves the pending connect untouched.
• II link: it carries no connector param.
• Router:
  • The DCR round-trip test drives branding over HTTP: authorize → state from II's link → /branding?state= → 200 Claude + no-store for both claude.ai spellings, and 404 for the loopback session. It is folded into the one accepting-registration test so it can't race the shared store file.
  • No session → 404 with CORS and no-store; the old unbound /branding/{slug} metadata route is gone; the logo is served as SVG with nosniff and the sandboxing CSP.
• Full workspace green; no new clippy warnings in the root crate.

🤖 Generated with Claude Code

[Copilot]

Copilot review overview

🟡 Changes recommended

Branding is not bound to its authorization session, allowing an attacker-crafted fragment to claim another vetted connector.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Bind connector branding to the pending authorization · New
• Normalize trailing root dots before branding lookup · New

What changed in this PR

Adds vetted connector branding for Internet Identity consent screens.

Changes:

• Maps validated vendor redirects to curated connector branding.
• Adds branding metadata/logo endpoints.
• Passes optional connector slugs through II connect URLs with tests.

File	Description
src/​branding.rs	Defines branding catalog and endpoints.
src/​auth.rs	Resolves branding during authorization.
src/​lib.rs	Registers branding routes.
crates/​imcp2-core/​src/​iiconnect.rs	Adds connector URL parameter.
crates/​imcp2-local/​src/​login/​mod.rs	Omits branding for local login.
tests/​routers.rs	Tests branding endpoints.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

The implemented session-bound API conflicts with the documented Internet Identity integration contract.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Align protocol implementation with the documented cross-repository contract · New
• Add “that” to clarify the validation invariant · New

Resolved since last review (2)

• Bind connector branding to the pending authorization
• Normalize trailing root dots before branding lookup

[Copilot]

Copilot review overview

🟢 Approval recommended

The implementation is securely session-bound and well tested; only a minor public-rustdoc omission remains.

Review effort: Balanced
Findings: None

Resolved since last review (2)

• Align protocol implementation with the documented cross-repository contract
• Add “that” to clarify the validation invariant

Previously missed (1)

In code that hasn't changed since last review

Update mcp_router rustdoc for branding routes and fallback scope

src/​lib.rs:341

The public mcp_router rustdoc at lines 231–244 still lists only the OAuth and metadata routes and says “everything else” reaches the MCP fallback. This new public route makes that contract inaccurate; document both branding endpoints (including their CORS behavior) and qualify the fallback as applying only to unmatched paths.

[Copilot]

Copilot review overview

🟢 Approval recommended

The implementation matches the revised session-bound design and is covered by focused unit and router tests.

Review effort: Balanced
Findings: None

[Copilot]

Copilot review overview

🟢 Approval recommended

The session binding, redirect vetting, caching, routing, and SVG safeguards are coherent and well tested.

Review effort: Balanced
Findings: None

[Copilot]

Copilot review overview

🟢 Approval recommended

Branding is securely session-bound, consistently validated, and comprehensively tested.

Review effort: Balanced
Findings: None