@1mcp/agent 0.10.3 → 0.12.0

package/README.md

@@ -22,19 +22,21 @@ A unified Model Context Protocol server implementation that aggregates multiple
 To enable Cursor to use existing MCP servers already configured in Claude Desktop, follow these steps:
 
 1. Run the 1MCP server with the Claude Desktop config file:
+
 ```bash
 npx -y @1mcp/agent --config ~/Library/Application\ Support/Claude/claude_desktop_config.json
 ```
 
 2. Add the 1MCP server to your Cursor config file (`~/.cursor/mcp.json`):
+
 ```json
 {
-    "mcpServers": {
-        "1mcp": {
-            "type": "http",
-            "url": "http://localhost:3050/sse"
-        }
+  "mcpServers": {
+    "1mcp": {
+      "type": "http",
+      "url": "http://localhost:3050/sse"
     }
+  }
 }
 ```
 
@@ -59,14 +61,20 @@ npx -y @1mcp/agent --help
 ```
 
 Available options:
+
 - `--transport, -t`: Choose transport type ("stdio" or "http", default: "http")
 - `--config, -c`: Use a specific config file
 - `--port, -P`: Change HTTP port (default: 3050)
 - `--host, -H`: Change HTTP host (default: localhost)
 - `--tags, -g`: Filter servers by tags (see Tags section below)
+- `--pagination, -p`: Enable pagination for client/server lists (boolean, default: false)
+- `--auth`: Enable authentication (OAuth 2.1) (boolean, default: false)
+- `--session-ttl`: Session expiry time in minutes (number, default: 1440)
+- `--session-storage-path`: Custom session storage directory path (string, default: undefined)
 - `--help, -h`: Show help
 
 Example with environment variables:
+
 ```bash
 # Using environment variables
 ONE_MCP_PORT=3051 ONE_MCP_TAGS=network,filesystem npx -y @1mcp/agent
@@ -96,6 +104,7 @@ docker run -i ghcr.io/1mcp-app/agent --transport stdio
 ```
 
 Available image tags:
+
 - `latest`: Latest stable release
 - `vX.Y.Z`: Specific version (e.g. `v1.0.0`)
 - `sha-<commit>`: Specific commit
@@ -103,13 +112,19 @@ Available image tags:
 ### Environment Variables
 
 You can configure 1MCP using environment variables prefixed with `ONE_MCP_`:
+
 - `ONE_MCP_TRANSPORT`: Transport type ("stdio" or "http", default: "http")
 - `ONE_MCP_PORT`: HTTP port (default: 3050)
 - `ONE_MCP_HOST`: HTTP host (default: "localhost")
 - `ONE_MCP_CONFIG`: Path to config file
 - `ONE_MCP_TAGS`: Comma-separated list of tags to filter servers
+- `ONE_MCP_PAGINATION`: Enable pagination for client/server lists (boolean, default: false)
+- `ONE_MCP_AUTH`: Enable authentication (OAuth 2.1) (boolean, default: false)
+- `ONE_MCP_SESSION_TTL`: Session expiry time in minutes (number, default: 1440)
+- `ONE_MCP_SESSION_STORAGE_PATH`: Custom session storage directory path (string, default: undefined)
 
 Example with environment variables:
+
 ```bash
 docker run -p 3051:3051 \
   -e ONE_MCP_PORT=3051 \
@@ -124,6 +139,7 @@ Tags help you control which MCP servers are available to different clients. Thin
 #### How to Use Tags
 
 1. **In your server config**: Add tags to each server to describe its capabilities
+
 ```json
 {
   "mcpServers": {
@@ -144,6 +160,7 @@ Tags help you control which MCP servers are available to different clients. Thin
 ```
 
 2. **When starting 1MCP in stdio mode**: You can filter servers by tags
+
 ```bash
 # Only start servers with the "network" tag
 npx -y @1mcp/agent --transport stdio --tags "network"
@@ -153,18 +170,20 @@ npx -y @1mcp/agent --transport stdio --tags "network,filesystem"
 ```
 
 3. **When using SSE transport**: Clients can request servers with specific tags
+
 ```json
 {
-    "mcpServers": {
-        "1mcp": {
-            "type": "http",
-            "url": "http://localhost:3050/sse?tags=network"  // Only connect to network-capable servers
-        }
+  "mcpServers": {
+    "1mcp": {
+      "type": "http",
+      "url": "http://localhost:3050/sse?tags=network" // Only connect to network-capable servers
     }
+  }
 }
 ```
 
 Example tags:
+
 - `network`: For servers that make web requests
 - `filesystem`: For servers that handle file operations
 - `memory`: For servers that provide memory/storage
@@ -187,17 +206,12 @@ The server automatically manages configuration in a global location:
   "mcpServers": {
     "mcp-server-fetch": {
       "command": "uvx",
-      "args": [
-        "mcp-server-fetch"
-      ],
+      "args": ["mcp-server-fetch"],
       "disabled": false
     },
     "server-memory": {
       "command": "npx",
-      "args": [
-        "-y",
-        "@modelcontextprotocol/server-memory"
-      ],
+      "args": ["-y", "@modelcontextprotocol/server-memory"],
       "disabled": false
     }
   }
@@ -263,21 +277,25 @@ sequenceDiagram
 ## Development
 
 Install dependencies:
+
 ```bash
 pnpm install
 ```
 
 Build the server:
+
 ```bash
 pnpm build
 ```
 
 For development with auto-rebuild:
+
 ```bash
 pnpm watch
 ```
 
 Run the server:
+
 ```bash
 pnpm dev
 ```
@@ -291,3 +309,9 @@ pnpm inspector
 ```
 
 The Inspector will provide a URL to access debugging tools in your browser.
+
+## Debugging & Source Maps
+
+This project uses [source-map-support](https://www.npmjs.com/package/source-map-support) to enhance stack traces. When you run the server, stack traces will reference the original TypeScript source files instead of the compiled JavaScript. This makes debugging much easier, as error locations and line numbers will match your source code.
+
+No extra setup is required—this is enabled by default. If you see a stack trace, it will point to `.ts` files and the correct line numbers. 🗺️

package/build/auth/authManager.d.ts

@@ -0,0 +1,109 @@
+import { SessionData } from './sessionManager.js';
+/**
+ * AuthManager handles OAuth 2.1 authentication flow and token validation.
+ *
+ * This class orchestrates the OAuth 2.1 authorization code grant flow,
+ * manages access token validation, and provides session information.
+ * It integrates with SessionManager for persistent storage and
+ * ServerConfigManager for configuration settings.
+ *
+ * Features:
+ * - OAuth 2.1 authorization code grant flow
+ * - Access token validation with prefix support
+ * - Session information retrieval
+ * - Configurable authentication settings
+ *
+ * @example
+ * ```typescript
+ * const authManager = new AuthManager('/custom/sessions');
+ * const token = authManager.exchangeCodeForToken('code-123', 'client-456');
+ * const session = authManager.validateAccessToken('tk-sess-789');
+ * ```
+ */
+export declare class AuthManager {
+    private sessionManager;
+    private configManager;
+    /**
+     * Creates a new AuthManager instance.
+     *
+     * Initializes the session manager with optional custom storage path
+     * and retrieves the server configuration manager instance.
+     *
+     * @param sessionStoragePath - Optional custom path for session storage
+     */
+    constructor(sessionStoragePath?: string);
+    /**
+     * Checks if authentication is currently enabled.
+     *
+     * @returns True if OAuth 2.1 authentication is enabled, false otherwise
+     */
+    isAuthEnabled(): boolean;
+    /**
+     * Validates an access token and returns session data.
+     *
+     * If authentication is disabled, returns null (always valid).
+     * For enabled authentication, strips the token prefix if present
+     * and validates the underlying session.
+     *
+     * @param token - The access token to validate (with or without prefix)
+     * @returns Session data if token is valid, null otherwise
+     */
+    validateAccessToken(token: string): SessionData | null;
+    /**
+     * Creates an authorization code for OAuth 2.1 flow.
+     *
+     * Delegates to the session manager to create a prefixed authorization
+     * code with the configured time-to-live.
+     *
+     * @param clientId - The client identifier
+     * @param redirectUri - The redirect URI for this code
+     * @param resource - The resource this code grants access to
+     * @returns The generated authorization code with prefix
+     */
+    createAuthCode(clientId: string, redirectUri: string, resource: string): string;
+    /**
+     * Exchanges an authorization code for an access token.
+     *
+     * Validates the authorization code, checks client ID and redirect URI
+     * matches, then creates a new access token with the configured TTL.
+     * The authorization code is deleted after successful exchange.
+     *
+     * @param code - The authorization code to exchange
+     * @param clientId - The client identifier
+     * @param redirectUri - Optional redirect URI for validation
+     * @param resource - Optional resource for validation
+     * @returns Access token with prefix if exchange successful, null otherwise
+     */
+    exchangeCodeForToken(code: string, clientId: string, redirectUri?: string, resource?: string): string | null;
+    /**
+     * Gets information about an access token.
+     *
+     * Retrieves session data for the token and returns formatted
+     * information including client ID, resource, and time until expiration.
+     *
+     * @param token - The access token to get information for
+     * @returns Token information if valid, null otherwise
+     */
+    getTokenInfo(token: string): {
+        clientId: string;
+        resource: string;
+        expiresIn: number;
+    } | null;
+    /**
+     * Revokes an access token.
+     *
+     * Removes the session associated with the token from storage.
+     *
+     * @param token - The access token to revoke
+     * @returns True if token was revoked, false if it didn't exist
+     */
+    revokeToken(token: string): boolean;
+    /**
+     * Performs graceful shutdown of the AuthManager.
+     *
+     * Delegates shutdown to the session manager to ensure proper
+     * cleanup of resources and timers.
+     */
+    shutdown(): void;
+}
+//# sourceMappingURL=authManager.d.ts.map

package/build/auth/authManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authManager.d.ts","sourceRoot":"","sources":["../../src/auth/authManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAkB,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAKlE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,aAAa,CAAsB;IAE3C;;;;;;;OAOG;gBACS,kBAAkB,CAAC,EAAE,MAAM;IAKvC;;;;OAIG;IACI,aAAa,IAAI,OAAO;IAI/B;;;;;;;;;OASG;IACI,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI;IAmB7D;;;;;;;;;;OAUG;IACI,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAKtF;;;;;;;;;;;;OAYG;IACI,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAoCnH;;;;;;;;OAQG;IACI,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAapG;;;;;;;OAOG;IACI,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAI1C;;;;;OAKG;IACI,QAAQ,IAAI,IAAI;CAGxB"}

package/build/auth/authManager.js

@@ -0,0 +1,173 @@
+import logger from '../logger/logger.js';
+import { SessionManager } from './sessionManager.js';
+import { ServerConfigManager } from '../core/server/serverConfig.js';
+import { AUTH_CONFIG } from '../constants.js';
+import { v4 as uuidv4 } from 'uuid';
+/**
+ * AuthManager handles OAuth 2.1 authentication flow and token validation.
+ *
+ * This class orchestrates the OAuth 2.1 authorization code grant flow,
+ * manages access token validation, and provides session information.
+ * It integrates with SessionManager for persistent storage and
+ * ServerConfigManager for configuration settings.
+ *
+ * Features:
+ * - OAuth 2.1 authorization code grant flow
+ * - Access token validation with prefix support
+ * - Session information retrieval
+ * - Configurable authentication settings
+ *
+ * @example
+ * ```typescript
+ * const authManager = new AuthManager('/custom/sessions');
+ * const token = authManager.exchangeCodeForToken('code-123', 'client-456');
+ * const session = authManager.validateAccessToken('tk-sess-789');
+ * ```
+ */
+export class AuthManager {
+    sessionManager;
+    configManager;
+    /**
+     * Creates a new AuthManager instance.
+     *
+     * Initializes the session manager with optional custom storage path
+     * and retrieves the server configuration manager instance.
+     *
+     * @param sessionStoragePath - Optional custom path for session storage
+     */
+    constructor(sessionStoragePath) {
+        this.sessionManager = new SessionManager(sessionStoragePath);
+        this.configManager = ServerConfigManager.getInstance();
+    }
+    /**
+     * Checks if authentication is currently enabled.
+     *
+     * @returns True if OAuth 2.1 authentication is enabled, false otherwise
+     */
+    isAuthEnabled() {
+        return this.configManager.isAuthEnabled();
+    }
+    /**
+     * Validates an access token and returns session data.
+     *
+     * If authentication is disabled, returns null (always valid).
+     * For enabled authentication, strips the token prefix if present
+     * and validates the underlying session.
+     *
+     * @param token - The access token to validate (with or without prefix)
+     * @returns Session data if token is valid, null otherwise
+     */
+    validateAccessToken(token) {
+        if (!this.isAuthEnabled()) {
+            return null; // Auth disabled, always valid
+        }
+        if (!token) {
+            return null;
+        }
+        // Strip token prefix if present
+        const tokenId = token.startsWith(AUTH_CONFIG.PREFIXES.ACCESS_TOKEN)
+            ? token.slice(AUTH_CONFIG.PREFIXES.ACCESS_TOKEN.length)
+            : token;
+        // Session is stored with 'sess-' + tokenId
+        const sessionId = AUTH_CONFIG.PREFIXES.SESSION_ID + tokenId;
+        return this.sessionManager.getSession(sessionId);
+    }
+    /**
+     * Creates an authorization code for OAuth 2.1 flow.
+     *
+     * Delegates to the session manager to create a prefixed authorization
+     * code with the configured time-to-live.
+     *
+     * @param clientId - The client identifier
+     * @param redirectUri - The redirect URI for this code
+     * @param resource - The resource this code grants access to
+     * @returns The generated authorization code with prefix
+     */
+    createAuthCode(clientId, redirectUri, resource) {
+        const ttlMs = this.configManager.getOAuthCodeTtlMs();
+        return this.sessionManager.createAuthCode(clientId, redirectUri, resource, ttlMs);
+    }
+    /**
+     * Exchanges an authorization code for an access token.
+     *
+     * Validates the authorization code, checks client ID and redirect URI
+     * matches, then creates a new access token with the configured TTL.
+     * The authorization code is deleted after successful exchange.
+     *
+     * @param code - The authorization code to exchange
+     * @param clientId - The client identifier
+     * @param redirectUri - Optional redirect URI for validation
+     * @param resource - Optional resource for validation
+     * @returns Access token with prefix if exchange successful, null otherwise
+     */
+    exchangeCodeForToken(code, clientId, redirectUri, resource) {
+        const codeData = this.sessionManager.getAuthCode(code);
+        if (!codeData) {
+            logger.warn(`Invalid or expired auth code: ${code}`);
+            return null;
+        }
+        if (codeData.clientId !== clientId) {
+            logger.warn(`Client ID mismatch for code ${code}: expected ${codeData.clientId}, got ${clientId}`);
+            return null;
+        }
+        if (redirectUri && codeData.redirectUri !== redirectUri) {
+            logger.warn(`Redirect URI mismatch for code ${code}: expected ${codeData.redirectUri}, got ${redirectUri}`);
+            return null;
+        }
+        if (resource && codeData.resource && codeData.resource !== resource) {
+            logger.warn(`Resource mismatch for code ${code}: expected ${codeData.resource}, got ${resource}`);
+            return null;
+        }
+        // Delete the auth code after successful exchange
+        this.sessionManager.deleteAuthCode(code);
+        // Create access token with prefix and a new UUID
+        const rawTokenId = uuidv4();
+        const accessToken = AUTH_CONFIG.PREFIXES.ACCESS_TOKEN + rawTokenId;
+        const ttlMs = this.configManager.getOAuthTokenTtlMs();
+        // Store the session using the rawTokenId (not prefixed)
+        this.sessionManager.createSessionWithId(rawTokenId, clientId, codeData.resource, ttlMs);
+        logger.info(`Exchanged code ${code} for token ${accessToken} for client ${clientId}`);
+        return accessToken;
+    }
+    /**
+     * Gets information about an access token.
+     *
+     * Retrieves session data for the token and returns formatted
+     * information including client ID, resource, and time until expiration.
+     *
+     * @param token - The access token to get information for
+     * @returns Token information if valid, null otherwise
+     */
+    getTokenInfo(token) {
+        const session = this.sessionManager.getSession(token);
+        if (!session) {
+            return null;
+        }
+        return {
+            clientId: session.clientId,
+            resource: session.resource,
+            expiresIn: Math.max(0, Math.floor((session.expires - Date.now()) / 1000)),
+        };
+    }
+    /**
+     * Revokes an access token.
+     *
+     * Removes the session associated with the token from storage.
+     *
+     * @param token - The access token to revoke
+     * @returns True if token was revoked, false if it didn't exist
+     */
+    revokeToken(token) {
+        return this.sessionManager.deleteSession(token);
+    }
+    /**
+     * Performs graceful shutdown of the AuthManager.
+     *
+     * Delegates shutdown to the session manager to ensure proper
+     * cleanup of resources and timers.
+     */
+    shutdown() {
+        this.sessionManager.shutdown();
+    }
+}
+//# sourceMappingURL=authManager.js.map

package/build/auth/authManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authManager.js","sourceRoot":"","sources":["../../src/auth/authManager.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,qBAAqB,CAAC;AACzC,OAAO,EAAE,cAAc,EAAe,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,WAAW;IACd,cAAc,CAAiB;IAC/B,aAAa,CAAsB;IAE3C;;;;;;;OAOG;IACH,YAAY,kBAA2B;QACrC,IAAI,CAAC,cAAc,GAAG,IAAI,cAAc,CAAC,kBAAkB,CAAC,CAAC;QAC7D,IAAI,CAAC,aAAa,GAAG,mBAAmB,CAAC,WAAW,EAAE,CAAC;IACzD,CAAC;IAED;;;;OAIG;IACI,aAAa;QAClB,OAAO,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC;IAC5C,CAAC;IAED;;;;;;;;;OASG;IACI,mBAAmB,CAAC,KAAa;QACtC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,CAAC,8BAA8B;QAC7C,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QAED,gCAAgC;QAChC,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC;YACjE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC;YACvD,CAAC,CAAC,KAAK,CAAC;QAEV,2CAA2C;QAC3C,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,CAAC,UAAU,GAAG,OAAO,CAAC;QAC5D,OAAO,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;;;;OAUG;IACI,cAAc,CAAC,QAAgB,EAAE,WAAmB,EAAE,QAAgB;QAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,iBAAiB,EAAE,CAAC;QACrD,OAAO,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACpF,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,oBAAoB,CAAC,IAAY,EAAE,QAAgB,EAAE,WAAoB,EAAE,QAAiB;QACjG,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAC;YACrD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,+BAA+B,IAAI,cAAc,QAAQ,CAAC,QAAQ,SAAS,QAAQ,EAAE,CAAC,CAAC;YACnG,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,WAAW,IAAI,QAAQ,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,kCAAkC,IAAI,cAAc,QAAQ,CAAC,WAAW,SAAS,WAAW,EAAE,CAAC,CAAC;YAC5G,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,QAAQ,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACpE,MAAM,CAAC,IAAI,CAAC,8BAA8B,IAAI,cAAc,QAAQ,CAAC,QAAQ,SAAS,QAAQ,EAAE,CAAC,CAAC;YAClG,OAAO,IAAI,CAAC;QACd,CAAC;QAED,iDAAiD;QACjD,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAEzC,iDAAiD;QACjD,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC;QAC5B,MAAM,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC,YAAY,GAAG,UAAU,CAAC;QACnE,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,kBAAkB,EAAE,CAAC;QACtD,wDAAwD;QACxD,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAExF,MAAM,CAAC,IAAI,CAAC,kBAAkB,IAAI,cAAc,WAAW,eAAe,QAAQ,EAAE,CAAC,CAAC;QACtF,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;;;;;;OAQG;IACI,YAAY,CAAC,KAAa;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;SAC1E,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACI,WAAW,CAAC,KAAa;QAC9B,OAAO,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC;IAED;;;;;OAKG;IACI,QAAQ;QACb,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC;IACjC,CAAC;CACF"}

package/build/auth/authMiddleware.d.ts

@@ -0,0 +1,16 @@
+import express from 'express';
+import { AuthManager } from './authManager.js';
+export declare function createAuthMiddleware(authManager: AuthManager): (req: express.Request, res: express.Response, next: express.NextFunction) => void;
+declare global {
+    namespace Express {
+        interface Request {
+            sessionData?: {
+                clientId: string;
+                resource: string;
+                expires: number;
+                createdAt: number;
+            };
+        }
+    }
+}
+//# sourceMappingURL=authMiddleware.d.ts.map

package/build/auth/authMiddleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authMiddleware.d.ts","sourceRoot":"","sources":["../../src/auth/authMiddleware.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,WAAW,IACnD,KAAK,OAAO,CAAC,OAAO,EAAE,KAAK,OAAO,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,YAAY,UA8ChF;AAGD,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,WAAW,CAAC,EAAE;gBACZ,QAAQ,EAAE,MAAM,CAAC;gBACjB,QAAQ,EAAE,MAAM,CAAC;gBACjB,OAAO,EAAE,MAAM,CAAC;gBAChB,SAAS,EAAE,MAAM,CAAC;aACnB,CAAC;SACH;KACF;CACF"}

package/build/auth/authMiddleware.js

@@ -0,0 +1,45 @@
+import logger from '../logger/logger.js';
+export function createAuthMiddleware(authManager) {
+    return (req, res, next) => {
+        // Skip auth if disabled
+        if (!authManager.isAuthEnabled()) {
+            return next();
+        }
+        const auth = req.headers['authorization'];
+        if (!auth || !auth.startsWith('Bearer ')) {
+            logger.warn('Missing Bearer token in request', {
+                url: req.url,
+                method: req.method,
+                headers: req.headers,
+            });
+            res.status(401).json({
+                error: 'invalid_token',
+                error_description: 'Missing Bearer token',
+            });
+            return;
+        }
+        const token = auth.slice('Bearer '.length);
+        const sessionData = authManager.validateAccessToken(token);
+        if (!sessionData) {
+            logger.warn('Invalid or expired token', {
+                url: req.url,
+                method: req.method,
+                token: token.substring(0, 8) + '...',
+            });
+            res.status(401).json({
+                error: 'invalid_token',
+                error_description: 'Invalid or expired token',
+            });
+            return;
+        }
+        // Add session data to request for downstream use
+        req.sessionData = sessionData;
+        logger.debug('Valid token for request', {
+            url: req.url,
+            method: req.method,
+            clientId: sessionData.clientId,
+        });
+        next();
+    };
+}
+//# sourceMappingURL=authMiddleware.js.map

package/build/auth/authMiddleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authMiddleware.js","sourceRoot":"","sources":["../../src/auth/authMiddleware.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,qBAAqB,CAAC;AAGzC,MAAM,UAAU,oBAAoB,CAAC,WAAwB;IAC3D,OAAO,CAAC,GAAoB,EAAE,GAAqB,EAAE,IAA0B,EAAE,EAAE;QACjF,wBAAwB;QACxB,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,EAAE,CAAC;YACjC,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE;gBAC7C,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,OAAO,EAAE,GAAG,CAAC,OAAO;aACrB,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EAAE,sBAAsB;aAC1C,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAG,WAAW,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAE3D,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE;gBACtC,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK;aACrC,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EAAE,0BAA0B;aAC9C,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,iDAAiD;QACjD,GAAG,CAAC,WAAW,GAAG,WAAW,CAAC;QAC9B,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE;YACtC,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,WAAW,CAAC,QAAQ;SAC/B,CAAC,CAAC;QAEH,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}