@1mcp/agent 0.12.0 → 0.13.0

package/build/utils/scopeValidation.js

@@ -0,0 +1,244 @@
+import logger from '../logger/logger.js';
+/**
+ * Security constants for scope validation
+ */
+export const SCOPE_VALIDATION_CONFIG = {
+    /** Maximum allowed length for a single scope */
+    MAX_SCOPE_LENGTH: 100,
+    /** Maximum number of scopes per request */
+    MAX_SCOPES_COUNT: 50,
+    /** Valid tag name pattern: alphanumeric, underscore, hyphen only */
+    TAG_NAME_PATTERN: /^[a-zA-Z0-9_-]+$/,
+    /** Valid tag scope pattern: tag: prefix followed by valid tag name */
+    TAG_SCOPE_PATTERN: /^tag:[a-zA-Z0-9_-]+$/,
+    /** Minimum tag name length */
+    MIN_TAG_LENGTH: 1,
+    /** Maximum tag name length */
+    MAX_TAG_LENGTH: 50,
+};
+/**
+ * Validates if a string is a valid tag name
+ * @param tagName - The tag name to validate
+ * @returns True if valid, false otherwise
+ */
+export function isValidTagName(tagName) {
+    if (!tagName || typeof tagName !== 'string') {
+        return false;
+    }
+    // Check length constraints
+    if (tagName.length < SCOPE_VALIDATION_CONFIG.MIN_TAG_LENGTH ||
+        tagName.length > SCOPE_VALIDATION_CONFIG.MAX_TAG_LENGTH) {
+        return false;
+    }
+    // Check pattern
+    return SCOPE_VALIDATION_CONFIG.TAG_NAME_PATTERN.test(tagName);
+}
+/**
+ * Validates if a string is a valid tag scope
+ * @param scope - The scope to validate
+ * @returns True if valid, false otherwise
+ */
+export function isValidTagScope(scope) {
+    if (!scope || typeof scope !== 'string') {
+        return false;
+    }
+    // Check length constraints
+    if (scope.length > SCOPE_VALIDATION_CONFIG.MAX_SCOPE_LENGTH) {
+        return false;
+    }
+    // Check pattern
+    if (!SCOPE_VALIDATION_CONFIG.TAG_SCOPE_PATTERN.test(scope)) {
+        return false;
+    }
+    // Extract and validate tag name
+    const tagName = scope.slice(4); // Remove "tag:" prefix
+    return isValidTagName(tagName);
+}
+/**
+ * Safely extracts tag name from a tag scope
+ * @param scope - The scope string (e.g., "tag:web")
+ * @returns The tag name if valid, null otherwise
+ */
+export function extractTagFromScope(scope) {
+    if (!isValidTagScope(scope)) {
+        logger.warn(`Invalid tag scope format: ${scope}`);
+        return null;
+    }
+    return scope.slice(4); // Remove "tag:" prefix
+}
+/**
+ * Parses a scope string into its components
+ * @param scope - The scope string to parse
+ * @returns Parsed scope object or null if invalid
+ */
+export function parseScope(scope) {
+    if (!scope || typeof scope !== 'string') {
+        return null;
+    }
+    // Currently only supporting tag scopes
+    if (scope.startsWith('tag:')) {
+        const tagName = extractTagFromScope(scope);
+        if (!tagName) {
+            return null;
+        }
+        return { type: 'tag', value: tagName };
+    }
+    // Future: Add support for other scope types (capability:, resource:, etc.)
+    return null;
+}
+/**
+ * Validates an array of scopes for format and security
+ * @param scopes - Array of scope strings to validate
+ * @returns Validation result with details
+ */
+export function validateScopes(scopes) {
+    const result = {
+        isValid: true,
+        errors: [],
+        validScopes: [],
+        invalidScopes: [],
+    };
+    // Check for null/undefined input
+    if (!scopes || !Array.isArray(scopes)) {
+        result.isValid = false;
+        result.errors.push('Scopes must be an array');
+        return result;
+    }
+    // Check count limits
+    if (scopes.length > SCOPE_VALIDATION_CONFIG.MAX_SCOPES_COUNT) {
+        result.isValid = false;
+        result.errors.push(`Too many scopes: ${scopes.length} > ${SCOPE_VALIDATION_CONFIG.MAX_SCOPES_COUNT}`);
+        return result;
+    }
+    // Validate each scope
+    const seenScopes = new Set();
+    for (const scope of scopes) {
+        // Check for duplicates
+        if (seenScopes.has(scope)) {
+            result.errors.push(`Duplicate scope: ${scope}`);
+            result.invalidScopes.push(scope);
+            continue;
+        }
+        seenScopes.add(scope);
+        // Validate scope format
+        if (isValidTagScope(scope)) {
+            result.validScopes.push(scope);
+        }
+        else {
+            result.errors.push(`Invalid scope format: ${scope}`);
+            result.invalidScopes.push(scope);
+        }
+    }
+    // Set overall validity
+    result.isValid = result.errors.length === 0;
+    return result;
+}
+/**
+ * Validates that requested scopes are available (allowlist approach)
+ * @param requestedScopes - Scopes requested by client
+ * @param availableTags - Tags available on the server
+ * @returns Validation result
+ */
+export function validateScopesAgainstAvailableTags(requestedScopes, availableTags) {
+    const result = {
+        isValid: true,
+        errors: [],
+        validScopes: [],
+        invalidScopes: [],
+    };
+    // First validate scope formats
+    const formatValidation = validateScopes(requestedScopes);
+    if (!formatValidation.isValid) {
+        return formatValidation;
+    }
+    // Create set of available tags for fast lookup
+    const availableTagSet = new Set(availableTags);
+    // Check each scope against available tags
+    for (const scope of requestedScopes) {
+        const tagName = extractTagFromScope(scope);
+        if (!tagName) {
+            result.errors.push(`Invalid scope format: ${scope}`);
+            result.invalidScopes.push(scope);
+            continue;
+        }
+        if (availableTagSet.has(tagName)) {
+            result.validScopes.push(scope);
+        }
+        else {
+            result.errors.push(`Scope not available: ${scope} (tag: ${tagName})`);
+            result.invalidScopes.push(scope);
+        }
+    }
+    result.isValid = result.errors.length === 0;
+    return result;
+}
+/**
+ * Checks if granted scopes satisfy the requirements for requested tags
+ * @param grantedScopes - Scopes granted during OAuth flow
+ * @param requestedTags - Tags requested for current operation
+ * @returns True if all requested tags are covered by granted scopes
+ */
+export function hasRequiredScopes(grantedScopes, requestedTags) {
+    // Fail-secure: deny if inputs are invalid
+    if (!grantedScopes || !Array.isArray(grantedScopes) || !requestedTags || !Array.isArray(requestedTags)) {
+        logger.warn('Invalid input to hasRequiredScopes', { grantedScopes, requestedTags });
+        return false;
+    }
+    // No tags requested means access is allowed
+    if (requestedTags.length === 0) {
+        return true;
+    }
+    // Extract tags from granted scopes
+    const grantedTags = grantedScopes
+        .map((scope) => extractTagFromScope(scope))
+        .filter((tag) => tag !== null);
+    // Check if all requested tags are in granted tags
+    const hasAllTags = requestedTags.every((tag) => grantedTags.includes(tag));
+    if (!hasAllTags) {
+        logger.warn('Insufficient scopes for requested tags', {
+            grantedTags,
+            requestedTags,
+            missing: requestedTags.filter((tag) => !grantedTags.includes(tag)),
+        });
+    }
+    return hasAllTags;
+}
+/**
+ * Converts tags to their corresponding scopes
+ * @param tags - Array of tag names
+ * @returns Array of tag scopes
+ */
+export function tagsToScopes(tags) {
+    if (!tags || !Array.isArray(tags)) {
+        return [];
+    }
+    return tags.filter((tag) => isValidTagName(tag)).map((tag) => `tag:${tag}`);
+}
+/**
+ * Converts scopes to their corresponding tags
+ * @param scopes - Array of scope strings
+ * @returns Array of tag names
+ */
+export function scopesToTags(scopes) {
+    if (!scopes || !Array.isArray(scopes)) {
+        return [];
+    }
+    return scopes.map((scope) => extractTagFromScope(scope)).filter((tag) => tag !== null);
+}
+/**
+ * Security utility to audit scope operations
+ * @param operation - The operation being performed
+ * @param context - Additional context for logging
+ */
+export function auditScopeOperation(operation, context) {
+    logger.info(`Scope operation: ${operation}`, {
+        operation,
+        clientId: context.clientId,
+        requestedScopes: context.requestedScopes,
+        grantedScopes: context.grantedScopes,
+        success: context.success,
+        error: context.error,
+        timestamp: new Date().toISOString(),
+    });
+}
+//# sourceMappingURL=scopeValidation.js.map

package/build/utils/scopeValidation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopeValidation.js","sourceRoot":"","sources":["../../src/utils/scopeValidation.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,qBAAqB,CAAC;AAEzC;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,gDAAgD;IAChD,gBAAgB,EAAE,GAAG;IACrB,2CAA2C;IAC3C,gBAAgB,EAAE,EAAE;IACpB,oEAAoE;IACpE,gBAAgB,EAAE,kBAAkB;IACpC,sEAAsE;IACtE,iBAAiB,EAAE,sBAAsB;IACzC,8BAA8B;IAC9B,cAAc,EAAE,CAAC;IACjB,8BAA8B;IAC9B,cAAc,EAAE,EAAE;CACV,CAAC;AAoBX;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,2BAA2B;IAC3B,IACE,OAAO,CAAC,MAAM,GAAG,uBAAuB,CAAC,cAAc;QACvD,OAAO,CAAC,MAAM,GAAG,uBAAuB,CAAC,cAAc,EACvD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,gBAAgB;IAChB,OAAO,uBAAuB,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,2BAA2B;IAC3B,IAAI,KAAK,CAAC,MAAM,GAAG,uBAAuB,CAAC,gBAAgB,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,gBAAgB;IAChB,IAAI,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,gCAAgC;IAChC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,uBAAuB;IACvD,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,6BAA6B,KAAK,EAAE,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,uBAAuB;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,uCAAuC;IACvC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACzC,CAAC;IAED,2EAA2E;IAC3E,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,MAAgB;IAC7C,MAAM,MAAM,GAA0B;QACpC,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,EAAE;QACV,WAAW,EAAE,EAAE;QACf,aAAa,EAAE,EAAE;KAClB,CAAC;IAEF,iCAAiC;IACjC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QAC9C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,qBAAqB;IACrB,IAAI,MAAM,CAAC,MAAM,GAAG,uBAAuB,CAAC,gBAAgB,EAAE,CAAC;QAC7D,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,MAAM,CAAC,MAAM,MAAM,uBAAuB,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACtG,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,sBAAsB;IACtB,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,uBAAuB;QACvB,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,KAAK,EAAE,CAAC,CAAC;YAChD,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjC,SAAS;QACX,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAEtB,wBAAwB;QACxB,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,KAAK,EAAE,CAAC,CAAC;YACrD,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;IAE5C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kCAAkC,CAChD,eAAyB,EACzB,aAAuB;IAEvB,MAAM,MAAM,GAA0B;QACpC,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,EAAE;QACV,WAAW,EAAE,EAAE;QACf,aAAa,EAAE,EAAE;KAClB,CAAC;IAEF,+BAA+B;IAC/B,MAAM,gBAAgB,GAAG,cAAc,CAAC,eAAe,CAAC,CAAC;IACzD,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;QAC9B,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,+CAA+C;IAC/C,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IAE/C,0CAA0C;IAC1C,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,KAAK,EAAE,CAAC,CAAC;YACrD,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjC,SAAS;QACX,CAAC;QAED,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,KAAK,UAAU,OAAO,GAAG,CAAC,CAAC;YACtE,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;IAE5C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,aAAuB,EAAE,aAAuB;IAChF,0CAA0C;IAC1C,IAAI,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACvG,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC,CAAC;QACpF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,4CAA4C;IAC5C,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mCAAmC;IACnC,MAAM,WAAW,GAAG,aAAa;SAC9B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;SAC1C,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,CAAa,CAAC;IAE7C,kDAAkD;IAClD,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAE3E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE;YACpD,WAAW;YACX,aAAa;YACb,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;SACnE,CAAC,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAc;IACzC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,MAAgB;IAC3C,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,CAAa,CAAC;AACrG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAiB,EACjB,OAMC;IAED,MAAM,CAAC,IAAI,CAAC,oBAAoB,SAAS,EAAE,EAAE;QAC3C,SAAS;QACT,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1mcp/agent",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "One MCP server to aggregate them all - A unified Model Context Protocol server implementation",
   "keywords": [
     "mcp",
@@ -42,6 +42,9 @@
     }
   },
   "lint-staged": {
+    "*.ts": [
+      "bash -c 'tsc --noEmit --project tsconfig.test.json'"
+    ],
     "*.{js,ts}": [
       "eslint --fix",
       "prettier --write"
@@ -51,7 +54,7 @@
     ]
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.13.0",
+    "@modelcontextprotocol/sdk": "^1.15.0",
     "body-parser": "^2.2.0",
     "cors": "^2.8.5",
     "express": "^5.1.0",
@@ -76,6 +79,7 @@
     "@typescript-eslint/eslint-plugin": "^8.27.0",
     "@typescript-eslint/parser": "^8.27.0",
     "@vitest/coverage-v8": "^1.4.0",
+    "axios": "^1.10.0",
     "eslint": "^9.22.0",
     "eslint-config-prettier": "^10.1.1",
     "eslint-plugin-prettier": "^5.2.3",
@@ -85,21 +89,26 @@
     "lint-staged": "^16.1.2",
     "prettier": "^3.5.3",
     "ts-node": "^10.9.2",
-    "tsc-watch": "^6.2.1",
+    "tsc-watch": "^7.1.1",
     "typescript": "^5.3.3",
+    "vite-tsconfig-paths": "^5.1.4",
     "vitest": "^1.4.0"
   },
   "scripts": {
-    "dev": "tsc-watch --onSuccess \"node build/index.js --config ./mcp.json --port 3051 --auth\"",
-    "build": "tsc && node -e \"require('fs').chmodSync('build/index.js', '755')\"",
-    "typecheck": "tsc --noEmit --project tsconfig.test.json",
-    "watch": "tsc --watch",
+    "dev": "LOG_LEVEL=debug tsc-watch --project tsconfig.build.json --onSuccess \"node build/index.js --config ./mcp.json --port 3051 --enable-auth\"",
+    "build": "tsc --project tsconfig.build.json && node -e \"require('fs').chmodSync('build/index.js', '755')\"",
+    "watch": "tsc --watch --project tsconfig.build.json",
     "inspector": "npx -y @modelcontextprotocol/inspector",
     "lint": "eslint . --ext .ts",
     "lint:fix": "eslint . --ext .ts --fix",
-    "format": "prettier --write \"src/**/*.{js,ts}\"",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "test:coverage": "vitest run --coverage"
+    "format": "prettier --write \"src/**/*.{js,ts}\" \"test/**/*.{js,ts}\"",
+    "typecheck": "tsc --noEmit --project tsconfig.test.json",
+    "test": "pnpm test:unit && pnpm test:e2e",
+    "test:unit": "vitest run",
+    "test:unit:watch": "vitest",
+    "test:unit:coverage": "vitest run --coverage",
+    "test:e2e": "vitest run --config vitest.e2e.config.ts",
+    "test:e2e:watch": "vitest --config vitest.e2e.config.ts",
+    "test:e2e:coverage": "vitest run --config vitest.e2e.config.ts --coverage"
   }
 }

package/build/auth/authManager.d.ts

@@ -1,109 +0,0 @@
-import { SessionData } from './sessionManager.js';
-/**
- * AuthManager handles OAuth 2.1 authentication flow and token validation.
- *
- * This class orchestrates the OAuth 2.1 authorization code grant flow,
- * manages access token validation, and provides session information.
- * It integrates with SessionManager for persistent storage and
- * ServerConfigManager for configuration settings.
- *
- * Features:
- * - OAuth 2.1 authorization code grant flow
- * - Access token validation with prefix support
- * - Session information retrieval
- * - Configurable authentication settings
- *
- * @example
- * ```typescript
- * const authManager = new AuthManager('/custom/sessions');
- * const token = authManager.exchangeCodeForToken('code-123', 'client-456');
- * const session = authManager.validateAccessToken('tk-sess-789');
- * ```
- */
-export declare class AuthManager {
-    private sessionManager;
-    private configManager;
-    /**
-     * Creates a new AuthManager instance.
-     *
-     * Initializes the session manager with optional custom storage path
-     * and retrieves the server configuration manager instance.
-     *
-     * @param sessionStoragePath - Optional custom path for session storage
-     */
-    constructor(sessionStoragePath?: string);
-    /**
-     * Checks if authentication is currently enabled.
-     *
-     * @returns True if OAuth 2.1 authentication is enabled, false otherwise
-     */
-    isAuthEnabled(): boolean;
-    /**
-     * Validates an access token and returns session data.
-     *
-     * If authentication is disabled, returns null (always valid).
-     * For enabled authentication, strips the token prefix if present
-     * and validates the underlying session.
-     *
-     * @param token - The access token to validate (with or without prefix)
-     * @returns Session data if token is valid, null otherwise
-     */
-    validateAccessToken(token: string): SessionData | null;
-    /**
-     * Creates an authorization code for OAuth 2.1 flow.
-     *
-     * Delegates to the session manager to create a prefixed authorization
-     * code with the configured time-to-live.
-     *
-     * @param clientId - The client identifier
-     * @param redirectUri - The redirect URI for this code
-     * @param resource - The resource this code grants access to
-     * @returns The generated authorization code with prefix
-     */
-    createAuthCode(clientId: string, redirectUri: string, resource: string): string;
-    /**
-     * Exchanges an authorization code for an access token.
-     *
-     * Validates the authorization code, checks client ID and redirect URI
-     * matches, then creates a new access token with the configured TTL.
-     * The authorization code is deleted after successful exchange.
-     *
-     * @param code - The authorization code to exchange
-     * @param clientId - The client identifier
-     * @param redirectUri - Optional redirect URI for validation
-     * @param resource - Optional resource for validation
-     * @returns Access token with prefix if exchange successful, null otherwise
-     */
-    exchangeCodeForToken(code: string, clientId: string, redirectUri?: string, resource?: string): string | null;
-    /**
-     * Gets information about an access token.
-     *
-     * Retrieves session data for the token and returns formatted
-     * information including client ID, resource, and time until expiration.
-     *
-     * @param token - The access token to get information for
-     * @returns Token information if valid, null otherwise
-     */
-    getTokenInfo(token: string): {
-        clientId: string;
-        resource: string;
-        expiresIn: number;
-    } | null;
-    /**
-     * Revokes an access token.
-     *
-     * Removes the session associated with the token from storage.
-     *
-     * @param token - The access token to revoke
-     * @returns True if token was revoked, false if it didn't exist
-     */
-    revokeToken(token: string): boolean;
-    /**
-     * Performs graceful shutdown of the AuthManager.
-     *
-     * Delegates shutdown to the session manager to ensure proper
-     * cleanup of resources and timers.
-     */
-    shutdown(): void;
-}
-//# sourceMappingURL=authManager.d.ts.map

package/build/auth/authManager.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"authManager.d.ts","sourceRoot":"","sources":["../../src/auth/authManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAkB,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAKlE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,aAAa,CAAsB;IAE3C;;;;;;;OAOG;gBACS,kBAAkB,CAAC,EAAE,MAAM;IAKvC;;;;OAIG;IACI,aAAa,IAAI,OAAO;IAI/B;;;;;;;;;OASG;IACI,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI;IAmB7D;;;;;;;;;;OAUG;IACI,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAKtF;;;;;;;;;;;;OAYG;IACI,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAoCnH;;;;;;;;OAQG;IACI,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAapG;;;;;;;OAOG;IACI,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAI1C;;;;;OAKG;IACI,QAAQ,IAAI,IAAI;CAGxB"}

package/build/auth/authManager.js

@@ -1,173 +0,0 @@
-import logger from '../logger/logger.js';
-import { SessionManager } from './sessionManager.js';
-import { ServerConfigManager } from '../core/server/serverConfig.js';
-import { AUTH_CONFIG } from '../constants.js';
-import { v4 as uuidv4 } from 'uuid';
-/**
- * AuthManager handles OAuth 2.1 authentication flow and token validation.
- *
- * This class orchestrates the OAuth 2.1 authorization code grant flow,
- * manages access token validation, and provides session information.
- * It integrates with SessionManager for persistent storage and
- * ServerConfigManager for configuration settings.
- *
- * Features:
- * - OAuth 2.1 authorization code grant flow
- * - Access token validation with prefix support
- * - Session information retrieval
- * - Configurable authentication settings
- *
- * @example
- * ```typescript
- * const authManager = new AuthManager('/custom/sessions');
- * const token = authManager.exchangeCodeForToken('code-123', 'client-456');
- * const session = authManager.validateAccessToken('tk-sess-789');
- * ```
- */
-export class AuthManager {
-    sessionManager;
-    configManager;
-    /**
-     * Creates a new AuthManager instance.
-     *
-     * Initializes the session manager with optional custom storage path
-     * and retrieves the server configuration manager instance.
-     *
-     * @param sessionStoragePath - Optional custom path for session storage
-     */
-    constructor(sessionStoragePath) {
-        this.sessionManager = new SessionManager(sessionStoragePath);
-        this.configManager = ServerConfigManager.getInstance();
-    }
-    /**
-     * Checks if authentication is currently enabled.
-     *
-     * @returns True if OAuth 2.1 authentication is enabled, false otherwise
-     */
-    isAuthEnabled() {
-        return this.configManager.isAuthEnabled();
-    }
-    /**
-     * Validates an access token and returns session data.
-     *
-     * If authentication is disabled, returns null (always valid).
-     * For enabled authentication, strips the token prefix if present
-     * and validates the underlying session.
-     *
-     * @param token - The access token to validate (with or without prefix)
-     * @returns Session data if token is valid, null otherwise
-     */
-    validateAccessToken(token) {
-        if (!this.isAuthEnabled()) {
-            return null; // Auth disabled, always valid
-        }
-        if (!token) {
-            return null;
-        }
-        // Strip token prefix if present
-        const tokenId = token.startsWith(AUTH_CONFIG.PREFIXES.ACCESS_TOKEN)
-            ? token.slice(AUTH_CONFIG.PREFIXES.ACCESS_TOKEN.length)
-            : token;
-        // Session is stored with 'sess-' + tokenId
-        const sessionId = AUTH_CONFIG.PREFIXES.SESSION_ID + tokenId;
-        return this.sessionManager.getSession(sessionId);
-    }
-    /**
-     * Creates an authorization code for OAuth 2.1 flow.
-     *
-     * Delegates to the session manager to create a prefixed authorization
-     * code with the configured time-to-live.
-     *
-     * @param clientId - The client identifier
-     * @param redirectUri - The redirect URI for this code
-     * @param resource - The resource this code grants access to
-     * @returns The generated authorization code with prefix
-     */
-    createAuthCode(clientId, redirectUri, resource) {
-        const ttlMs = this.configManager.getOAuthCodeTtlMs();
-        return this.sessionManager.createAuthCode(clientId, redirectUri, resource, ttlMs);
-    }
-    /**
-     * Exchanges an authorization code for an access token.
-     *
-     * Validates the authorization code, checks client ID and redirect URI
-     * matches, then creates a new access token with the configured TTL.
-     * The authorization code is deleted after successful exchange.
-     *
-     * @param code - The authorization code to exchange
-     * @param clientId - The client identifier
-     * @param redirectUri - Optional redirect URI for validation
-     * @param resource - Optional resource for validation
-     * @returns Access token with prefix if exchange successful, null otherwise
-     */
-    exchangeCodeForToken(code, clientId, redirectUri, resource) {
-        const codeData = this.sessionManager.getAuthCode(code);
-        if (!codeData) {
-            logger.warn(`Invalid or expired auth code: ${code}`);
-            return null;
-        }
-        if (codeData.clientId !== clientId) {
-            logger.warn(`Client ID mismatch for code ${code}: expected ${codeData.clientId}, got ${clientId}`);
-            return null;
-        }
-        if (redirectUri && codeData.redirectUri !== redirectUri) {
-            logger.warn(`Redirect URI mismatch for code ${code}: expected ${codeData.redirectUri}, got ${redirectUri}`);
-            return null;
-        }
-        if (resource && codeData.resource && codeData.resource !== resource) {
-            logger.warn(`Resource mismatch for code ${code}: expected ${codeData.resource}, got ${resource}`);
-            return null;
-        }
-        // Delete the auth code after successful exchange
-        this.sessionManager.deleteAuthCode(code);
-        // Create access token with prefix and a new UUID
-        const rawTokenId = uuidv4();
-        const accessToken = AUTH_CONFIG.PREFIXES.ACCESS_TOKEN + rawTokenId;
-        const ttlMs = this.configManager.getOAuthTokenTtlMs();
-        // Store the session using the rawTokenId (not prefixed)
-        this.sessionManager.createSessionWithId(rawTokenId, clientId, codeData.resource, ttlMs);
-        logger.info(`Exchanged code ${code} for token ${accessToken} for client ${clientId}`);
-        return accessToken;
-    }
-    /**
-     * Gets information about an access token.
-     *
-     * Retrieves session data for the token and returns formatted
-     * information including client ID, resource, and time until expiration.
-     *
-     * @param token - The access token to get information for
-     * @returns Token information if valid, null otherwise
-     */
-    getTokenInfo(token) {
-        const session = this.sessionManager.getSession(token);
-        if (!session) {
-            return null;
-        }
-        return {
-            clientId: session.clientId,
-            resource: session.resource,
-            expiresIn: Math.max(0, Math.floor((session.expires - Date.now()) / 1000)),
-        };
-    }
-    /**
-     * Revokes an access token.
-     *
-     * Removes the session associated with the token from storage.
-     *
-     * @param token - The access token to revoke
-     * @returns True if token was revoked, false if it didn't exist
-     */
-    revokeToken(token) {
-        return this.sessionManager.deleteSession(token);
-    }
-    /**
-     * Performs graceful shutdown of the AuthManager.
-     *
-     * Delegates shutdown to the session manager to ensure proper
-     * cleanup of resources and timers.
-     */
-    shutdown() {
-        this.sessionManager.shutdown();
-    }
-}
-//# sourceMappingURL=authManager.js.map

package/build/auth/authManager.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"authManager.js","sourceRoot":"","sources":["../../src/auth/authManager.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,qBAAqB,CAAC;AACzC,OAAO,EAAE,cAAc,EAAe,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,WAAW;IACd,cAAc,CAAiB;IAC/B,aAAa,CAAsB;IAE3C;;;;;;;OAOG;IACH,YAAY,kBAA2B;QACrC,IAAI,CAAC,cAAc,GAAG,IAAI,cAAc,CAAC,kBAAkB,CAAC,CAAC;QAC7D,IAAI,CAAC,aAAa,GAAG,mBAAmB,CAAC,WAAW,EAAE,CAAC;IACzD,CAAC;IAED;;;;OAIG;IACI,aAAa;QAClB,OAAO,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC;IAC5C,CAAC;IAED;;;;;;;;;OASG;IACI,mBAAmB,CAAC,KAAa;QACtC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,CAAC,8BAA8B;QAC7C,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QAED,gCAAgC;QAChC,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC;YACjE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC;YACvD,CAAC,CAAC,KAAK,CAAC;QAEV,2CAA2C;QAC3C,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,CAAC,UAAU,GAAG,OAAO,CAAC;QAC5D,OAAO,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;;;;OAUG;IACI,cAAc,CAAC,QAAgB,EAAE,WAAmB,EAAE,QAAgB;QAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,iBAAiB,EAAE,CAAC;QACrD,OAAO,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACpF,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,oBAAoB,CAAC,IAAY,EAAE,QAAgB,EAAE,WAAoB,EAAE,QAAiB;QACjG,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAC;YACrD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,+BAA+B,IAAI,cAAc,QAAQ,CAAC,QAAQ,SAAS,QAAQ,EAAE,CAAC,CAAC;YACnG,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,WAAW,IAAI,QAAQ,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,kCAAkC,IAAI,cAAc,QAAQ,CAAC,WAAW,SAAS,WAAW,EAAE,CAAC,CAAC;YAC5G,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,QAAQ,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACpE,MAAM,CAAC,IAAI,CAAC,8BAA8B,IAAI,cAAc,QAAQ,CAAC,QAAQ,SAAS,QAAQ,EAAE,CAAC,CAAC;YAClG,OAAO,IAAI,CAAC;QACd,CAAC;QAED,iDAAiD;QACjD,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAEzC,iDAAiD;QACjD,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC;QAC5B,MAAM,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC,YAAY,GAAG,UAAU,CAAC;QACnE,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,kBAAkB,EAAE,CAAC;QACtD,wDAAwD;QACxD,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAExF,MAAM,CAAC,IAAI,CAAC,kBAAkB,IAAI,cAAc,WAAW,eAAe,QAAQ,EAAE,CAAC,CAAC;QACtF,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;;;;;;OAQG;IACI,YAAY,CAAC,KAAa;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;SAC1E,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACI,WAAW,CAAC,KAAa;QAC9B,OAAO,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC;IAED;;;;;OAKG;IACI,QAAQ;QACb,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC;IACjC,CAAC;CACF"}

package/build/auth/authMiddleware.d.ts

@@ -1,16 +0,0 @@
-import express from 'express';
-import { AuthManager } from './authManager.js';
-export declare function createAuthMiddleware(authManager: AuthManager): (req: express.Request, res: express.Response, next: express.NextFunction) => void;
-declare global {
-    namespace Express {
-        interface Request {
-            sessionData?: {
-                clientId: string;
-                resource: string;
-                expires: number;
-                createdAt: number;
-            };
-        }
-    }
-}
-//# sourceMappingURL=authMiddleware.d.ts.map

package/build/auth/authMiddleware.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"authMiddleware.d.ts","sourceRoot":"","sources":["../../src/auth/authMiddleware.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,WAAW,IACnD,KAAK,OAAO,CAAC,OAAO,EAAE,KAAK,OAAO,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,YAAY,UA8ChF;AAGD,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,WAAW,CAAC,EAAE;gBACZ,QAAQ,EAAE,MAAM,CAAC;gBACjB,QAAQ,EAAE,MAAM,CAAC;gBACjB,OAAO,EAAE,MAAM,CAAC;gBAChB,SAAS,EAAE,MAAM,CAAC;aACnB,CAAC;SACH;KACF;CACF"}