@1mcp/agent 0.12.0 → 0.13.1

package/README.md

@@ -16,6 +16,8 @@ A unified Model Context Protocol server implementation that aggregates multiple
 - Provides a standardized way for AI models to interact with external tools and resources
 - Supports dynamic configuration reloading without server restart
 - Handles graceful shutdown and resource cleanup
+- Includes comprehensive authentication and security features
+- Supports advanced filtering, pagination, and request optimization
 
 ## Quick Start
 
@@ -62,28 +64,25 @@ npx -y @1mcp/agent --help
 
 Available options:
 
-- `--transport, -t`: Choose transport type ("stdio" or "http", default: "http")
-- `--config, -c`: Use a specific config file
-- `--port, -P`: Change HTTP port (default: 3050)
-- `--host, -H`: Change HTTP host (default: localhost)
-- `--tags, -g`: Filter servers by tags (see Tags section below)
-- `--pagination, -p`: Enable pagination for client/server lists (boolean, default: false)
-- `--auth`: Enable authentication (OAuth 2.1) (boolean, default: false)
-- `--session-ttl`: Session expiry time in minutes (number, default: 1440)
-- `--session-storage-path`: Custom session storage directory path (string, default: undefined)
-- `--help, -h`: Show help
-
-Example with environment variables:
-
-```bash
-# Using environment variables
-ONE_MCP_PORT=3051 ONE_MCP_TAGS=network,filesystem npx -y @1mcp/agent
-
-# Or in your shell configuration
-export ONE_MCP_PORT=3051
-export ONE_MCP_TAGS=network,filesystem
-npx -y @1mcp/agent
-```
+| Option (CLI)                 | Environment Variable               | Description                                           |  Default  | Deprecated? |
+| :--------------------------- | :--------------------------------- | :---------------------------------------------------- | :-------: | :---------: |
+| `--transport`, `-t`          | `ONE_MCP_TRANSPORT`                | Choose transport type ("stdio", "http", or "sse")     |  "http"   |             |
+| `--config`, `-c`             | `ONE_MCP_CONFIG`                   | Use a specific config file                            |           |             |
+| `--port`, `-P`               | `ONE_MCP_PORT`                     | Change HTTP port                                      |   3050    |             |
+| `--host`, `-H`               | `ONE_MCP_HOST`                     | Change HTTP host                                      | localhost |             |
+| `--tags`, `-g`               | `ONE_MCP_TAGS`                     | Filter servers by tags                                |           |             |
+| `--pagination`, `-p`         | `ONE_MCP_PAGINATION`               | Enable pagination for client/server lists (boolean)   |   false   |             |
+| `--auth`                     | `ONE_MCP_AUTH`                     | Enable authentication (OAuth 2.1)                     |   false   |     Yes     |
+| `--enable-auth`              | `ONE_MCP_ENABLE_AUTH`              | Enable authentication (OAuth 2.1)                     |   false   |             |
+| `--enable-scope-validation`  | `ONE_MCP_ENABLE_SCOPE_VALIDATION`  | Enable tag-based scope validation (boolean)           |   true    |             |
+| `--enable-enhanced-security` | `ONE_MCP_ENABLE_ENHANCED_SECURITY` | Enable enhanced security middleware (boolean)         |   false   |             |
+| `--session-ttl`              | `ONE_MCP_SESSION_TTL`              | Session expiry time in minutes (number)               |   1440    |             |
+| `--session-storage-path`     | `ONE_MCP_SESSION_STORAGE_PATH`     | Custom session storage directory path (string)        |           |             |
+| `--rate-limit-window`        | `ONE_MCP_RATE_LIMIT_WINDOW`        | OAuth rate limit window in minutes (number)           |    15     |             |
+| `--rate-limit-max`           | `ONE_MCP_RATE_LIMIT_MAX`           | Maximum requests per OAuth rate limit window (number) |    100    |             |
+| `--help`, `-h`               |                                    | Show help                                             |           |             |
+
+> 💡 **Note:** Deprecated options are provided for backward compatibility. Prefer using the non-deprecated options for new configurations.
 
 ## Docker
 
@@ -109,21 +108,7 @@ Available image tags:
 - `vX.Y.Z`: Specific version (e.g. `v1.0.0`)
 - `sha-<commit>`: Specific commit
 
-### Environment Variables
-
-You can configure 1MCP using environment variables prefixed with `ONE_MCP_`:
-
-- `ONE_MCP_TRANSPORT`: Transport type ("stdio" or "http", default: "http")
-- `ONE_MCP_PORT`: HTTP port (default: 3050)
-- `ONE_MCP_HOST`: HTTP host (default: "localhost")
-- `ONE_MCP_CONFIG`: Path to config file
-- `ONE_MCP_TAGS`: Comma-separated list of tags to filter servers
-- `ONE_MCP_PAGINATION`: Enable pagination for client/server lists (boolean, default: false)
-- `ONE_MCP_AUTH`: Enable authentication (OAuth 2.1) (boolean, default: false)
-- `ONE_MCP_SESSION_TTL`: Session expiry time in minutes (number, default: 1440)
-- `ONE_MCP_SESSION_STORAGE_PATH`: Custom session storage directory path (string, default: undefined)
-
-Example with environment variables:
+Example:
 
 ```bash
 docker run -p 3051:3051 \

package/build/auth/sdkOAuthClientProvider.d.ts

@@ -0,0 +1,93 @@
+import { OAuthClientProvider } from '@modelcontextprotocol/sdk/client/auth.js';
+import type { OAuthClientMetadata, OAuthClientInformationFull, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
+/**
+ * OAuth client configuration for connecting to downstream MCP servers
+ */
+export interface OAuthClientConfig {
+    clientId?: string;
+    clientSecret?: string;
+    scopes?: string[];
+    redirectUrl: string;
+}
+/**
+ * SDK-compatible OAuth client provider that replaces the custom implementation.
+ *
+ * This provider implements the OAuth 2.1 Authorization Code Grant flow using
+ * the SDK's OAuthClientProvider interface while maintaining compatibility with
+ * the existing session storage system.
+ */
+export declare class SDKOAuthClientProvider implements OAuthClientProvider {
+    private _clientMetadata;
+    private _clientInfo?;
+    private _tokens?;
+    private _codeVerifier?;
+    private _state?;
+    private sessionRepository;
+    private serverName;
+    private config;
+    private _authorizationUrl?;
+    constructor(serverName: string, config: OAuthClientConfig, sessionStoragePath?: string);
+    get redirectUrl(): string;
+    get clientMetadata(): OAuthClientMetadata;
+    /**
+     * Returns current client registration information
+     */
+    clientInformation(): OAuthClientInformationFull | undefined;
+    /**
+     * Saves client registration information from dynamic registration
+     */
+    saveClientInformation(clientInfo: OAuthClientInformationFull): void;
+    /**
+     * Returns current OAuth tokens
+     */
+    tokens(): OAuthTokens | undefined;
+    /**
+     * Saves OAuth tokens after successful authorization
+     */
+    saveTokens(tokens: OAuthTokens): void;
+    /**
+     * Stores authorization URL instead of prompting user in console
+     */
+    redirectToAuthorization(authorizationUrl: URL): void;
+    /**
+     * Gets the current authorization URL
+     */
+    getAuthorizationUrl(): string | undefined;
+    /**
+     * Clears the stored authorization URL
+     */
+    clearAuthorizationUrl(): void;
+    /**
+     * Saves PKCE code verifier for the authorization session
+     */
+    saveCodeVerifier(codeVerifier: string): void;
+    /**
+     * Returns the PKCE code verifier for token exchange
+     */
+    codeVerifier(): string | Promise<string>;
+    /**
+     * Returns the OAuth state parameter for CSRF protection
+     */
+    state(): string | Promise<string>;
+    /**
+     * Custom resource validation (optional)
+     */
+    validateResourceURL(serverUrl: string | URL, resource?: string): Promise<URL | undefined>;
+    /**
+     * Load persisted OAuth data from unified client session storage
+     */
+    private loadPersistedData;
+    /**
+     * Persist all OAuth data to unified client session storage
+     */
+    private persistAllData;
+    /**
+     * Check if OAuth tokens are expired
+     */
+    private isTokenExpired;
+    /**
+     * Clean up resources
+     */
+    shutdown(): void;
+}
+//# sourceMappingURL=sdkOAuthClientProvider.d.ts.map

package/build/auth/sdkOAuthClientProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdkOAuthClientProvider.d.ts","sourceRoot":"","sources":["../../src/auth/sdkOAuthClientProvider.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAC/E,OAAO,KAAK,EACV,mBAAmB,EACnB,0BAA0B,EAC1B,WAAW,EACZ,MAAM,0CAA0C,CAAC;AAQlD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;GAMG;AACH,qBAAa,sBAAuB,YAAW,mBAAmB;IAChE,OAAO,CAAC,eAAe,CAAsB;IAC7C,OAAO,CAAC,WAAW,CAAC,CAA6B;IACjD,OAAO,CAAC,OAAO,CAAC,CAAc;IAC9B,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,iBAAiB,CAA0B;IACnD,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,iBAAiB,CAAC,CAAS;gBAEvB,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,kBAAkB,CAAC,EAAE,MAAM;IAyBtF,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED;;OAEG;IACH,iBAAiB,IAAI,0BAA0B,GAAG,SAAS;IAI3D;;OAEG;IACH,qBAAqB,CAAC,UAAU,EAAE,0BAA0B,GAAG,IAAI;IAMnE;;OAEG;IACH,MAAM,IAAI,WAAW,GAAG,SAAS;IAIjC;;OAEG;IACH,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI;IAMrC;;OAEG;IACH,uBAAuB,CAAC,gBAAgB,EAAE,GAAG,GAAG,IAAI;IAIpD;;OAEG;IACH,mBAAmB,IAAI,MAAM,GAAG,SAAS;IAIzC;;OAEG;IACH,qBAAqB,IAAI,IAAI;IAI7B;;OAEG;IACH,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI;IAK5C;;OAEG;IACH,YAAY,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIxC;;OAEG;IACH,KAAK,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQjC;;OAEG;IACG,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC;IAS/F;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAiCzB;;OAEG;IACH,OAAO,CAAC,cAAc;IAwBtB;;OAEG;IACH,OAAO,CAAC,cAAc;IAUtB;;OAEG;IACH,QAAQ,IAAI,IAAI;CAMjB"}

package/build/auth/sdkOAuthClientProvider.js

@@ -0,0 +1,204 @@
+import { randomUUID } from 'node:crypto';
+import logger from '../logger/logger.js';
+import { ClientSessionRepository } from './storage/clientSessionRepository.js';
+import { FileStorageService } from './storage/fileStorageService.js';
+import { AUTH_CONFIG, getGlobalConfigDir } from '../constants.js';
+import path from 'path';
+/**
+ * SDK-compatible OAuth client provider that replaces the custom implementation.
+ *
+ * This provider implements the OAuth 2.1 Authorization Code Grant flow using
+ * the SDK's OAuthClientProvider interface while maintaining compatibility with
+ * the existing session storage system.
+ */
+export class SDKOAuthClientProvider {
+    _clientMetadata;
+    _clientInfo;
+    _tokens;
+    _codeVerifier;
+    _state;
+    sessionRepository;
+    serverName;
+    config;
+    _authorizationUrl;
+    constructor(serverName, config, sessionStoragePath) {
+        this.serverName = serverName;
+        this.config = config;
+        // Create FileStorageService and ClientSessionRepository
+        const storagePath = sessionStoragePath || path.join(getGlobalConfigDir(), 'clientSessions');
+        const fileStorage = new FileStorageService(storagePath);
+        this.sessionRepository = new ClientSessionRepository(fileStorage);
+        // Set up client metadata for registration with better defaults
+        this._clientMetadata = {
+            client_name: `1MCP Agent - ${serverName}`,
+            redirect_uris: [config.redirectUrl || ''],
+            grant_types: ['authorization_code', 'refresh_token'],
+            response_types: ['code'],
+            token_endpoint_auth_method: config.clientSecret ? 'client_secret_post' : 'none',
+            scope: config.scopes?.join(' ') || AUTH_CONFIG.CLIENT.OAUTH.DEFAULT_SCOPES.join(' '),
+        };
+        logger.debug(`OAuth client metadata: ${JSON.stringify(this._clientMetadata)}`);
+        // Load existing client info and tokens if available
+        this.loadPersistedData();
+    }
+    get redirectUrl() {
+        return this.config.redirectUrl || '';
+    }
+    get clientMetadata() {
+        return this._clientMetadata;
+    }
+    /**
+     * Returns current client registration information
+     */
+    clientInformation() {
+        return this._clientInfo;
+    }
+    /**
+     * Saves client registration information from dynamic registration
+     */
+    saveClientInformation(clientInfo) {
+        this._clientInfo = clientInfo;
+        this.persistAllData();
+        logger.info(`OAuth client registered for ${this.serverName}: ${clientInfo.client_id}`);
+    }
+    /**
+     * Returns current OAuth tokens
+     */
+    tokens() {
+        return this._tokens;
+    }
+    /**
+     * Saves OAuth tokens after successful authorization
+     */
+    saveTokens(tokens) {
+        this._tokens = tokens;
+        this.persistAllData();
+        logger.info(`OAuth tokens saved for ${this.serverName}`);
+    }
+    /**
+     * Stores authorization URL instead of prompting user in console
+     */
+    redirectToAuthorization(authorizationUrl) {
+        this._authorizationUrl = authorizationUrl.toString();
+    }
+    /**
+     * Gets the current authorization URL
+     */
+    getAuthorizationUrl() {
+        return this._authorizationUrl;
+    }
+    /**
+     * Clears the stored authorization URL
+     */
+    clearAuthorizationUrl() {
+        this._authorizationUrl = undefined;
+    }
+    /**
+     * Saves PKCE code verifier for the authorization session
+     */
+    saveCodeVerifier(codeVerifier) {
+        this._codeVerifier = codeVerifier;
+        this.persistAllData();
+    }
+    /**
+     * Returns the PKCE code verifier for token exchange
+     */
+    codeVerifier() {
+        return this._codeVerifier || '';
+    }
+    /**
+     * Returns the OAuth state parameter for CSRF protection
+     */
+    state() {
+        if (!this._state) {
+            this._state = randomUUID();
+            this.persistAllData();
+        }
+        return this._state;
+    }
+    /**
+     * Custom resource validation (optional)
+     */
+    async validateResourceURL(serverUrl, resource) {
+        const url = typeof serverUrl === 'string' ? new URL(serverUrl) : serverUrl;
+        // Basic validation - can be extended for specific requirements
+        if (resource && !resource.startsWith(url.origin)) {
+            return undefined;
+        }
+        return url;
+    }
+    /**
+     * Load persisted OAuth data from unified client session storage
+     */
+    loadPersistedData() {
+        const clientSession = this.sessionRepository.get(this.serverName);
+        if (clientSession) {
+            // Load client info
+            if (clientSession.clientInfo) {
+                this._clientInfo = JSON.parse(clientSession.clientInfo);
+            }
+            // Load tokens
+            if (clientSession.tokens) {
+                this._tokens = JSON.parse(clientSession.tokens);
+                // Check if tokens are expired
+                if (this._tokens && this.isTokenExpired(this._tokens)) {
+                    logger.warn(`OAuth tokens expired for ${this.serverName}, clearing`);
+                    this._tokens = undefined;
+                    this.persistAllData();
+                }
+            }
+            // Load code verifier
+            if (clientSession.codeVerifier) {
+                this._codeVerifier = clientSession.codeVerifier;
+            }
+            // Load state
+            if (clientSession.state) {
+                this._state = clientSession.state;
+            }
+        }
+    }
+    /**
+     * Persist all OAuth data to unified client session storage
+     */
+    persistAllData() {
+        // Calculate the longest TTL based on the data we have
+        let maxTtl = AUTH_CONFIG.CLIENT.OAUTH.TTL_MS; // Default to 30 days
+        // If we have tokens, use their expiry time
+        if (this._tokens && this._tokens.expires_in) {
+            const tokenTtl = this._tokens.expires_in * 1000;
+            maxTtl = Math.max(maxTtl, tokenTtl);
+        }
+        // Code verifier and state have shorter TTL, but we keep them for completeness
+        const clientSessionData = {
+            serverName: this.serverName,
+            clientInfo: this._clientInfo ? JSON.stringify(this._clientInfo) : undefined,
+            tokens: this._tokens ? JSON.stringify(this._tokens) : undefined,
+            codeVerifier: this._codeVerifier,
+            state: this._state,
+            expires: Date.now() + maxTtl,
+            createdAt: Date.now(),
+        };
+        this.sessionRepository.save(this.serverName, clientSessionData, maxTtl);
+    }
+    /**
+     * Check if OAuth tokens are expired
+     */
+    isTokenExpired(tokens) {
+        if (!tokens.expires_in) {
+            return false; // No expiration info, assume valid
+        }
+        // This is a simple check - in practice, you might want to store the issued_at time
+        // For now, we'll rely on the session storage TTL for expiration
+        return false;
+    }
+    /**
+     * Clean up resources
+     */
+    shutdown() {
+        // Clean up temporary session data by clearing verifier and state
+        this._codeVerifier = undefined;
+        this._state = undefined;
+        this.persistAllData();
+    }
+}
+//# sourceMappingURL=sdkOAuthClientProvider.js.map

package/build/auth/sdkOAuthClientProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdkOAuthClientProvider.js","sourceRoot":"","sources":["../../src/auth/sdkOAuthClientProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAOzC,OAAO,MAAM,MAAM,qBAAqB,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAElE,OAAO,IAAI,MAAM,MAAM,CAAC;AAYxB;;;;;;GAMG;AACH,MAAM,OAAO,sBAAsB;IACzB,eAAe,CAAsB;IACrC,WAAW,CAA8B;IACzC,OAAO,CAAe;IACtB,aAAa,CAAU;IACvB,MAAM,CAAU;IAChB,iBAAiB,CAA0B;IAC3C,UAAU,CAAS;IACnB,MAAM,CAAoB;IAC1B,iBAAiB,CAAU;IAEnC,YAAY,UAAkB,EAAE,MAAyB,EAAE,kBAA2B;QACpF,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAErB,wDAAwD;QACxD,MAAM,WAAW,GAAG,kBAAkB,IAAI,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,gBAAgB,CAAC,CAAC;QAC5F,MAAM,WAAW,GAAG,IAAI,kBAAkB,CAAC,WAAW,CAAC,CAAC;QACxD,IAAI,CAAC,iBAAiB,GAAG,IAAI,uBAAuB,CAAC,WAAW,CAAC,CAAC;QAElE,+DAA+D;QAC/D,IAAI,CAAC,eAAe,GAAG;YACrB,WAAW,EAAE,gBAAgB,UAAU,EAAE;YACzC,aAAa,EAAE,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;YACzC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,0BAA0B,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM;YAC/E,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;SACrF,CAAC;QAEF,MAAM,CAAC,KAAK,CAAC,0BAA0B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAE/E,oDAAoD;QACpD,IAAI,CAAC,iBAAiB,EAAE,CAAC;IAC3B,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;IACvC,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,qBAAqB,CAAC,UAAsC;QAC1D,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC;QAC9B,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,+BAA+B,IAAI,CAAC,UAAU,KAAK,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;IACzF,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,MAAmB;QAC5B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,0BAA0B,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,uBAAuB,CAAC,gBAAqB;QAC3C,IAAI,CAAC,iBAAiB,GAAG,gBAAgB,CAAC,QAAQ,EAAE,CAAC;IACvD,CAAC;IAED;;OAEG;IACH,mBAAmB;QACjB,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,qBAAqB;QACnB,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,YAAoB;QACnC,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;QAClC,IAAI,CAAC,cAAc,EAAE,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,mBAAmB,CAAC,SAAuB,EAAE,QAAiB;QAClE,MAAM,GAAG,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,+DAA+D;QAC/D,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACjD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;OAEG;IACK,iBAAiB;QACvB,MAAM,aAAa,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAElE,IAAI,aAAa,EAAE,CAAC;YAClB,mBAAmB;YACnB,IAAI,aAAa,CAAC,UAAU,EAAE,CAAC;gBAC7B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;YAC1D,CAAC;YAED,cAAc;YACd,IAAI,aAAa,CAAC,MAAM,EAAE,CAAC;gBACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;gBAEhD,8BAA8B;gBAC9B,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBACtD,MAAM,CAAC,IAAI,CAAC,4BAA4B,IAAI,CAAC,UAAU,YAAY,CAAC,CAAC;oBACrE,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;oBACzB,IAAI,CAAC,cAAc,EAAE,CAAC;gBACxB,CAAC;YACH,CAAC;YAED,qBAAqB;YACrB,IAAI,aAAa,CAAC,YAAY,EAAE,CAAC;gBAC/B,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC,YAAY,CAAC;YAClD,CAAC;YAED,aAAa;YACb,IAAI,aAAa,CAAC,KAAK,EAAE,CAAC;gBACxB,IAAI,CAAC,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACK,cAAc;QACpB,sDAAsD;QACtD,IAAI,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,qBAAqB;QAEnE,2CAA2C;QAC3C,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;YAChD,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACtC,CAAC;QAED,8EAA8E;QAC9E,MAAM,iBAAiB,GAAsB;YAC3C,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;YAC3E,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;YAC/D,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,KAAK,EAAE,IAAI,CAAC,MAAM;YAClB,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM;YAC5B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QAEF,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC;IAC1E,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,MAAmB;QACxC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC,CAAC,mCAAmC;QACnD,CAAC;QAED,mFAAmF;QACnF,gEAAgE;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,iEAAiE;QACjE,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,IAAI,CAAC,cAAc,EAAE,CAAC;IACxB,CAAC;CACF"}

package/build/auth/sdkOAuthServerProvider.d.ts

@@ -0,0 +1,64 @@
+import type { Response } from 'express';
+import type { OAuthServerProvider, AuthorizationParams } from '@modelcontextprotocol/sdk/server/auth/provider.js';
+import type { OAuthRegisteredClientsStore } from '@modelcontextprotocol/sdk/server/auth/clients.js';
+import type { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types.js';
+import type { OAuthClientInformationFull, OAuthTokens, OAuthTokenRevocationRequest } from '@modelcontextprotocol/sdk/shared/auth.js';
+import { OAuthStorageService } from './storage/oauthStorageService.js';
+/**
+ * Implementation of SDK's OAuthServerProvider interface using the new repository architecture.
+ *
+ * This provider implements OAuth 2.1 server functionality using the MCP SDK's interfaces
+ * with the new layered storage architecture for better separation of concerns.
+ */
+export declare class SDKOAuthServerProvider implements OAuthServerProvider {
+    oauthStorage: OAuthStorageService;
+    private configManager;
+    private _clientsStore;
+    constructor(sessionStoragePath?: string);
+    get clientsStore(): OAuthRegisteredClientsStore;
+    /**
+     * Handles the authorization request with scope validation and user consent
+     */
+    authorize(client: OAuthClientInformationFull, params: AuthorizationParams, res: Response): Promise<void>;
+    /**
+     * Determines if user consent is required for the authorization
+     */
+    private requiresUserConsent;
+    /**
+     * Renders the consent page for scope selection
+     */
+    private renderConsentPage;
+    /**
+     * Approves the authorization and redirects back to client
+     */
+    approveAuthorization(client: OAuthClientInformationFull, params: AuthorizationParams, grantedScopes: string[], res: Response): Promise<void>;
+    /**
+     * Generates the HTML for the consent page
+     */
+    private generateConsentPageHtml;
+    /**
+     * Retrieves the PKCE challenge for an authorization code
+     */
+    challengeForAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string): Promise<string>;
+    /**
+     * Exchanges authorization code for access token
+     */
+    exchangeAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string, _codeVerifier?: string, redirectUri?: string, resource?: URL): Promise<OAuthTokens>;
+    /**
+     * Exchanges refresh token for new access token (not implemented)
+     */
+    exchangeRefreshToken(_client: OAuthClientInformationFull, _refreshToken: string, _scopes?: string[], _resource?: URL): Promise<OAuthTokens>;
+    /**
+     * Verifies access token and returns auth info with granted scopes
+     */
+    verifyAccessToken(token: string): Promise<AuthInfo>;
+    /**
+     * Revokes a token
+     */
+    revokeToken(client: OAuthClientInformationFull, request: OAuthTokenRevocationRequest): Promise<void>;
+    /**
+     * Graceful shutdown
+     */
+    shutdown(): void;
+}
+//# sourceMappingURL=sdkOAuthServerProvider.d.ts.map

package/build/auth/sdkOAuthServerProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdkOAuthServerProvider.d.ts","sourceRoot":"","sources":["../../src/auth/sdkOAuthServerProvider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,mDAAmD,CAAC;AAClH,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AACpG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,KAAK,EACV,0BAA0B,EAC1B,WAAW,EACX,2BAA2B,EAC5B,MAAM,0CAA0C,CAAC;AAElD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAoDvE;;;;;GAKG;AACH,qBAAa,sBAAuB,YAAW,mBAAmB;IACzD,YAAY,EAAE,mBAAmB,CAAC;IACzC,OAAO,CAAC,aAAa,CAAqB;IAC1C,OAAO,CAAC,aAAa,CAA8B;gBAEvC,kBAAkB,CAAC,EAAE,MAAM;IAMvC,IAAI,YAAY,IAAI,2BAA2B,CAE9C;IAED;;OAEG;IACG,SAAS,CAAC,MAAM,EAAE,0BAA0B,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAkD9G;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAO3B;;OAEG;YACW,iBAAiB;IA0B/B;;OAEG;IACU,oBAAoB,CAC/B,MAAM,EAAE,0BAA0B,EAClC,MAAM,EAAE,mBAAmB,EAC3B,aAAa,EAAE,MAAM,EAAE,EACvB,GAAG,EAAE,QAAQ,GACZ,OAAO,CAAC,IAAI,CAAC;IAoChB;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAoF/B;;OAEG;IACG,6BAA6B,CAAC,MAAM,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAWnH;;OAEG;IACG,yBAAyB,CAC7B,MAAM,EAAE,0BAA0B,EAClC,iBAAiB,EAAE,MAAM,EAGzB,aAAa,CAAC,EAAE,MAAM,EACtB,WAAW,CAAC,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,GAAG,GACb,OAAO,CAAC,WAAW,CAAC;IA6DvB;;OAEG;IACG,oBAAoB,CACxB,OAAO,EAAE,0BAA0B,EACnC,aAAa,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE,MAAM,EAAE,EAClB,SAAS,CAAC,EAAE,GAAG,GACd,OAAO,CAAC,WAAW,CAAC;IAIvB;;OAEG;IACG,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAoCzD;;OAEG;IACG,WAAW,CAAC,MAAM,EAAE,0BAA0B,EAAE,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC;IAoB1G;;OAEG;IACH,QAAQ,IAAI,IAAI;CAGjB"}