@1mcp/agent 0.12.0 → 0.13.1

package/build/utils/scopeValidation.d.ts

@@ -0,0 +1,102 @@
+/**
+ * Security constants for scope validation
+ */
+export declare const SCOPE_VALIDATION_CONFIG: {
+    /** Maximum allowed length for a single scope */
+    readonly MAX_SCOPE_LENGTH: 100;
+    /** Maximum number of scopes per request */
+    readonly MAX_SCOPES_COUNT: 50;
+    /** Valid tag name pattern: alphanumeric, underscore, hyphen only */
+    readonly TAG_NAME_PATTERN: RegExp;
+    /** Valid tag scope pattern: tag: prefix followed by valid tag name */
+    readonly TAG_SCOPE_PATTERN: RegExp;
+    /** Minimum tag name length */
+    readonly MIN_TAG_LENGTH: 1;
+    /** Maximum tag name length */
+    readonly MAX_TAG_LENGTH: 50;
+};
+/**
+ * Parsed scope structure
+ */
+export interface ParsedScope {
+    type: 'tag';
+    value: string;
+}
+/**
+ * Scope validation result
+ */
+export interface ScopeValidationResult {
+    isValid: boolean;
+    errors: string[];
+    validScopes: string[];
+    invalidScopes: string[];
+}
+/**
+ * Validates if a string is a valid tag name
+ * @param tagName - The tag name to validate
+ * @returns True if valid, false otherwise
+ */
+export declare function isValidTagName(tagName: string): boolean;
+/**
+ * Validates if a string is a valid tag scope
+ * @param scope - The scope to validate
+ * @returns True if valid, false otherwise
+ */
+export declare function isValidTagScope(scope: string): boolean;
+/**
+ * Safely extracts tag name from a tag scope
+ * @param scope - The scope string (e.g., "tag:web")
+ * @returns The tag name if valid, null otherwise
+ */
+export declare function extractTagFromScope(scope: string): string | null;
+/**
+ * Parses a scope string into its components
+ * @param scope - The scope string to parse
+ * @returns Parsed scope object or null if invalid
+ */
+export declare function parseScope(scope: string): ParsedScope | null;
+/**
+ * Validates an array of scopes for format and security
+ * @param scopes - Array of scope strings to validate
+ * @returns Validation result with details
+ */
+export declare function validateScopes(scopes: string[]): ScopeValidationResult;
+/**
+ * Validates that requested scopes are available (allowlist approach)
+ * @param requestedScopes - Scopes requested by client
+ * @param availableTags - Tags available on the server
+ * @returns Validation result
+ */
+export declare function validateScopesAgainstAvailableTags(requestedScopes: string[], availableTags: string[]): ScopeValidationResult;
+/**
+ * Checks if granted scopes satisfy the requirements for requested tags
+ * @param grantedScopes - Scopes granted during OAuth flow
+ * @param requestedTags - Tags requested for current operation
+ * @returns True if all requested tags are covered by granted scopes
+ */
+export declare function hasRequiredScopes(grantedScopes: string[], requestedTags: string[]): boolean;
+/**
+ * Converts tags to their corresponding scopes
+ * @param tags - Array of tag names
+ * @returns Array of tag scopes
+ */
+export declare function tagsToScopes(tags: string[]): string[];
+/**
+ * Converts scopes to their corresponding tags
+ * @param scopes - Array of scope strings
+ * @returns Array of tag names
+ */
+export declare function scopesToTags(scopes: string[]): string[];
+/**
+ * Security utility to audit scope operations
+ * @param operation - The operation being performed
+ * @param context - Additional context for logging
+ */
+export declare function auditScopeOperation(operation: string, context: {
+    clientId?: string;
+    requestedScopes?: string[];
+    grantedScopes?: string[];
+    success?: boolean;
+    error?: string;
+}): void;
+//# sourceMappingURL=scopeValidation.d.ts.map

package/build/utils/scopeValidation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopeValidation.d.ts","sourceRoot":"","sources":["../../src/utils/scopeValidation.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,eAAO,MAAM,uBAAuB;IAClC,gDAAgD;;IAEhD,2CAA2C;;IAE3C,oEAAoE;;IAEpE,sEAAsE;;IAEtE,8BAA8B;;IAE9B,8BAA8B;;CAEtB,CAAC;AAEX;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,KAAK,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAevD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAkBtD;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOhE;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAgB5D;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,qBAAqB,CA8CtE;AAED;;;;;GAKG;AACH,wBAAgB,kCAAkC,CAChD,eAAe,EAAE,MAAM,EAAE,EACzB,aAAa,EAAE,MAAM,EAAE,GACtB,qBAAqB,CAqCvB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,CA6B3F;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAMrD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAMvD;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE;IACP,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GACA,IAAI,CAUN"}

package/build/utils/scopeValidation.js

@@ -0,0 +1,244 @@
+import logger from '../logger/logger.js';
+/**
+ * Security constants for scope validation
+ */
+export const SCOPE_VALIDATION_CONFIG = {
+    /** Maximum allowed length for a single scope */
+    MAX_SCOPE_LENGTH: 100,
+    /** Maximum number of scopes per request */
+    MAX_SCOPES_COUNT: 50,
+    /** Valid tag name pattern: alphanumeric, underscore, hyphen only */
+    TAG_NAME_PATTERN: /^[a-zA-Z0-9_-]+$/,
+    /** Valid tag scope pattern: tag: prefix followed by valid tag name */
+    TAG_SCOPE_PATTERN: /^tag:[a-zA-Z0-9_-]+$/,
+    /** Minimum tag name length */
+    MIN_TAG_LENGTH: 1,
+    /** Maximum tag name length */
+    MAX_TAG_LENGTH: 50,
+};
+/**
+ * Validates if a string is a valid tag name
+ * @param tagName - The tag name to validate
+ * @returns True if valid, false otherwise
+ */
+export function isValidTagName(tagName) {
+    if (!tagName || typeof tagName !== 'string') {
+        return false;
+    }
+    // Check length constraints
+    if (tagName.length < SCOPE_VALIDATION_CONFIG.MIN_TAG_LENGTH ||
+        tagName.length > SCOPE_VALIDATION_CONFIG.MAX_TAG_LENGTH) {
+        return false;
+    }
+    // Check pattern
+    return SCOPE_VALIDATION_CONFIG.TAG_NAME_PATTERN.test(tagName);
+}
+/**
+ * Validates if a string is a valid tag scope
+ * @param scope - The scope to validate
+ * @returns True if valid, false otherwise
+ */
+export function isValidTagScope(scope) {
+    if (!scope || typeof scope !== 'string') {
+        return false;
+    }
+    // Check length constraints
+    if (scope.length > SCOPE_VALIDATION_CONFIG.MAX_SCOPE_LENGTH) {
+        return false;
+    }
+    // Check pattern
+    if (!SCOPE_VALIDATION_CONFIG.TAG_SCOPE_PATTERN.test(scope)) {
+        return false;
+    }
+    // Extract and validate tag name
+    const tagName = scope.slice(4); // Remove "tag:" prefix
+    return isValidTagName(tagName);
+}
+/**
+ * Safely extracts tag name from a tag scope
+ * @param scope - The scope string (e.g., "tag:web")
+ * @returns The tag name if valid, null otherwise
+ */
+export function extractTagFromScope(scope) {
+    if (!isValidTagScope(scope)) {
+        logger.warn(`Invalid tag scope format: ${scope}`);
+        return null;
+    }
+    return scope.slice(4); // Remove "tag:" prefix
+}
+/**
+ * Parses a scope string into its components
+ * @param scope - The scope string to parse
+ * @returns Parsed scope object or null if invalid
+ */
+export function parseScope(scope) {
+    if (!scope || typeof scope !== 'string') {
+        return null;
+    }
+    // Currently only supporting tag scopes
+    if (scope.startsWith('tag:')) {
+        const tagName = extractTagFromScope(scope);
+        if (!tagName) {
+            return null;
+        }
+        return { type: 'tag', value: tagName };
+    }
+    // Future: Add support for other scope types (capability:, resource:, etc.)
+    return null;
+}
+/**
+ * Validates an array of scopes for format and security
+ * @param scopes - Array of scope strings to validate
+ * @returns Validation result with details
+ */
+export function validateScopes(scopes) {
+    const result = {
+        isValid: true,
+        errors: [],
+        validScopes: [],
+        invalidScopes: [],
+    };
+    // Check for null/undefined input
+    if (!scopes || !Array.isArray(scopes)) {
+        result.isValid = false;
+        result.errors.push('Scopes must be an array');
+        return result;
+    }
+    // Check count limits
+    if (scopes.length > SCOPE_VALIDATION_CONFIG.MAX_SCOPES_COUNT) {
+        result.isValid = false;
+        result.errors.push(`Too many scopes: ${scopes.length} > ${SCOPE_VALIDATION_CONFIG.MAX_SCOPES_COUNT}`);
+        return result;
+    }
+    // Validate each scope
+    const seenScopes = new Set();
+    for (const scope of scopes) {
+        // Check for duplicates
+        if (seenScopes.has(scope)) {
+            result.errors.push(`Duplicate scope: ${scope}`);
+            result.invalidScopes.push(scope);
+            continue;
+        }
+        seenScopes.add(scope);
+        // Validate scope format
+        if (isValidTagScope(scope)) {
+            result.validScopes.push(scope);
+        }
+        else {
+            result.errors.push(`Invalid scope format: ${scope}`);
+            result.invalidScopes.push(scope);
+        }
+    }
+    // Set overall validity
+    result.isValid = result.errors.length === 0;
+    return result;
+}
+/**
+ * Validates that requested scopes are available (allowlist approach)
+ * @param requestedScopes - Scopes requested by client
+ * @param availableTags - Tags available on the server
+ * @returns Validation result
+ */
+export function validateScopesAgainstAvailableTags(requestedScopes, availableTags) {
+    const result = {
+        isValid: true,
+        errors: [],
+        validScopes: [],
+        invalidScopes: [],
+    };
+    // First validate scope formats
+    const formatValidation = validateScopes(requestedScopes);
+    if (!formatValidation.isValid) {
+        return formatValidation;
+    }
+    // Create set of available tags for fast lookup
+    const availableTagSet = new Set(availableTags);
+    // Check each scope against available tags
+    for (const scope of requestedScopes) {
+        const tagName = extractTagFromScope(scope);
+        if (!tagName) {
+            result.errors.push(`Invalid scope format: ${scope}`);
+            result.invalidScopes.push(scope);
+            continue;
+        }
+        if (availableTagSet.has(tagName)) {
+            result.validScopes.push(scope);
+        }
+        else {
+            result.errors.push(`Scope not available: ${scope} (tag: ${tagName})`);
+            result.invalidScopes.push(scope);
+        }
+    }
+    result.isValid = result.errors.length === 0;
+    return result;
+}
+/**
+ * Checks if granted scopes satisfy the requirements for requested tags
+ * @param grantedScopes - Scopes granted during OAuth flow
+ * @param requestedTags - Tags requested for current operation
+ * @returns True if all requested tags are covered by granted scopes
+ */
+export function hasRequiredScopes(grantedScopes, requestedTags) {
+    // Fail-secure: deny if inputs are invalid
+    if (!grantedScopes || !Array.isArray(grantedScopes) || !requestedTags || !Array.isArray(requestedTags)) {
+        logger.warn('Invalid input to hasRequiredScopes', { grantedScopes, requestedTags });
+        return false;
+    }
+    // No tags requested means access is allowed
+    if (requestedTags.length === 0) {
+        return true;
+    }
+    // Extract tags from granted scopes
+    const grantedTags = grantedScopes
+        .map((scope) => extractTagFromScope(scope))
+        .filter((tag) => tag !== null);
+    // Check if all requested tags are in granted tags
+    const hasAllTags = requestedTags.every((tag) => grantedTags.includes(tag));
+    if (!hasAllTags) {
+        logger.warn('Insufficient scopes for requested tags', {
+            grantedTags,
+            requestedTags,
+            missing: requestedTags.filter((tag) => !grantedTags.includes(tag)),
+        });
+    }
+    return hasAllTags;
+}
+/**
+ * Converts tags to their corresponding scopes
+ * @param tags - Array of tag names
+ * @returns Array of tag scopes
+ */
+export function tagsToScopes(tags) {
+    if (!tags || !Array.isArray(tags)) {
+        return [];
+    }
+    return tags.filter((tag) => isValidTagName(tag)).map((tag) => `tag:${tag}`);
+}
+/**
+ * Converts scopes to their corresponding tags
+ * @param scopes - Array of scope strings
+ * @returns Array of tag names
+ */
+export function scopesToTags(scopes) {
+    if (!scopes || !Array.isArray(scopes)) {
+        return [];
+    }
+    return scopes.map((scope) => extractTagFromScope(scope)).filter((tag) => tag !== null);
+}
+/**
+ * Security utility to audit scope operations
+ * @param operation - The operation being performed
+ * @param context - Additional context for logging
+ */
+export function auditScopeOperation(operation, context) {
+    logger.info(`Scope operation: ${operation}`, {
+        operation,
+        clientId: context.clientId,
+        requestedScopes: context.requestedScopes,
+        grantedScopes: context.grantedScopes,
+        success: context.success,
+        error: context.error,
+        timestamp: new Date().toISOString(),
+    });
+}
+//# sourceMappingURL=scopeValidation.js.map

package/build/utils/scopeValidation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopeValidation.js","sourceRoot":"","sources":["../../src/utils/scopeValidation.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,qBAAqB,CAAC;AAEzC;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,gDAAgD;IAChD,gBAAgB,EAAE,GAAG;IACrB,2CAA2C;IAC3C,gBAAgB,EAAE,EAAE;IACpB,oEAAoE;IACpE,gBAAgB,EAAE,kBAAkB;IACpC,sEAAsE;IACtE,iBAAiB,EAAE,sBAAsB;IACzC,8BAA8B;IAC9B,cAAc,EAAE,CAAC;IACjB,8BAA8B;IAC9B,cAAc,EAAE,EAAE;CACV,CAAC;AAoBX;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,2BAA2B;IAC3B,IACE,OAAO,CAAC,MAAM,GAAG,uBAAuB,CAAC,cAAc;QACvD,OAAO,CAAC,MAAM,GAAG,uBAAuB,CAAC,cAAc,EACvD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,gBAAgB;IAChB,OAAO,uBAAuB,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,2BAA2B;IAC3B,IAAI,KAAK,CAAC,MAAM,GAAG,uBAAuB,CAAC,gBAAgB,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,gBAAgB;IAChB,IAAI,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,gCAAgC;IAChC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,uBAAuB;IACvD,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,6BAA6B,KAAK,EAAE,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,uBAAuB;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,uCAAuC;IACvC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACzC,CAAC;IAED,2EAA2E;IAC3E,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,MAAgB;IAC7C,MAAM,MAAM,GAA0B;QACpC,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,EAAE;QACV,WAAW,EAAE,EAAE;QACf,aAAa,EAAE,EAAE;KAClB,CAAC;IAEF,iCAAiC;IACjC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QAC9C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,qBAAqB;IACrB,IAAI,MAAM,CAAC,MAAM,GAAG,uBAAuB,CAAC,gBAAgB,EAAE,CAAC;QAC7D,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,MAAM,CAAC,MAAM,MAAM,uBAAuB,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACtG,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,sBAAsB;IACtB,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,uBAAuB;QACvB,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,KAAK,EAAE,CAAC,CAAC;YAChD,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjC,SAAS;QACX,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAEtB,wBAAwB;QACxB,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,KAAK,EAAE,CAAC,CAAC;YACrD,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;IAE5C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kCAAkC,CAChD,eAAyB,EACzB,aAAuB;IAEvB,MAAM,MAAM,GAA0B;QACpC,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,EAAE;QACV,WAAW,EAAE,EAAE;QACf,aAAa,EAAE,EAAE;KAClB,CAAC;IAEF,+BAA+B;IAC/B,MAAM,gBAAgB,GAAG,cAAc,CAAC,eAAe,CAAC,CAAC;IACzD,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;QAC9B,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,+CAA+C;IAC/C,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IAE/C,0CAA0C;IAC1C,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,KAAK,EAAE,CAAC,CAAC;YACrD,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjC,SAAS;QACX,CAAC;QAED,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,KAAK,UAAU,OAAO,GAAG,CAAC,CAAC;YACtE,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;IAE5C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,aAAuB,EAAE,aAAuB;IAChF,0CAA0C;IAC1C,IAAI,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACvG,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC,CAAC;QACpF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,4CAA4C;IAC5C,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mCAAmC;IACnC,MAAM,WAAW,GAAG,aAAa;SAC9B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;SAC1C,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,CAAa,CAAC;IAE7C,kDAAkD;IAClD,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAE3E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE;YACpD,WAAW;YACX,aAAa;YACb,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;SACnE,CAAC,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAc;IACzC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,MAAgB;IAC3C,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,CAAa,CAAC;AACrG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAiB,EACjB,OAMC;IAED,MAAM,CAAC,IAAI,CAAC,oBAAoB,SAAS,EAAE,EAAE;QAC3C,SAAS;QACT,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1mcp/agent",
-  "version": "0.12.0",
+  "version": "0.13.1",
   "description": "One MCP server to aggregate them all - A unified Model Context Protocol server implementation",
   "keywords": [
     "mcp",
@@ -42,6 +42,9 @@
     }
   },
   "lint-staged": {
+    "*.ts": [
+      "bash -c 'tsc --noEmit --project tsconfig.test.json'"
+    ],
     "*.{js,ts}": [
       "eslint --fix",
       "prettier --write"
@@ -51,7 +54,7 @@
     ]
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.13.0",
+    "@modelcontextprotocol/sdk": "^1.15.0",
     "body-parser": "^2.2.0",
     "cors": "^2.8.5",
     "express": "^5.1.0",
@@ -76,6 +79,7 @@
     "@typescript-eslint/eslint-plugin": "^8.27.0",
     "@typescript-eslint/parser": "^8.27.0",
     "@vitest/coverage-v8": "^1.4.0",
+    "axios": "^1.10.0",
     "eslint": "^9.22.0",
     "eslint-config-prettier": "^10.1.1",
     "eslint-plugin-prettier": "^5.2.3",
@@ -85,21 +89,26 @@
     "lint-staged": "^16.1.2",
     "prettier": "^3.5.3",
     "ts-node": "^10.9.2",
-    "tsc-watch": "^6.2.1",
+    "tsc-watch": "^7.1.1",
     "typescript": "^5.3.3",
+    "vite-tsconfig-paths": "^5.1.4",
     "vitest": "^1.4.0"
   },
   "scripts": {
-    "dev": "tsc-watch --onSuccess \"node build/index.js --config ./mcp.json --port 3051 --auth\"",
-    "build": "tsc && node -e \"require('fs').chmodSync('build/index.js', '755')\"",
-    "typecheck": "tsc --noEmit --project tsconfig.test.json",
-    "watch": "tsc --watch",
+    "dev": "LOG_LEVEL=debug tsc-watch --project tsconfig.build.json --onSuccess \"node build/index.js --config ./mcp.json --port 3051 --enable-auth\"",
+    "build": "tsc --project tsconfig.build.json && node -e \"require('fs').chmodSync('build/index.js', '755')\"",
+    "watch": "tsc --watch --project tsconfig.build.json",
     "inspector": "npx -y @modelcontextprotocol/inspector",
     "lint": "eslint . --ext .ts",
     "lint:fix": "eslint . --ext .ts --fix",
-    "format": "prettier --write \"src/**/*.{js,ts}\"",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "test:coverage": "vitest run --coverage"
+    "format": "prettier --write \"src/**/*.{js,ts}\" \"test/**/*.{js,ts}\"",
+    "typecheck": "tsc --noEmit --project tsconfig.test.json",
+    "test": "pnpm test:unit && pnpm test:e2e",
+    "test:unit": "vitest run",
+    "test:unit:watch": "vitest",
+    "test:unit:coverage": "vitest run --coverage",
+    "test:e2e": "vitest run --config vitest.e2e.config.ts",
+    "test:e2e:watch": "vitest --config vitest.e2e.config.ts",
+    "test:e2e:coverage": "vitest run --config vitest.e2e.config.ts --coverage"
   }
 }

package/build/auth/authManager.d.ts

@@ -1,109 +0,0 @@
-import { SessionData } from './sessionManager.js';
-/**
- * AuthManager handles OAuth 2.1 authentication flow and token validation.
- *
- * This class orchestrates the OAuth 2.1 authorization code grant flow,
- * manages access token validation, and provides session information.
- * It integrates with SessionManager for persistent storage and
- * ServerConfigManager for configuration settings.
- *
- * Features:
- * - OAuth 2.1 authorization code grant flow
- * - Access token validation with prefix support
- * - Session information retrieval
- * - Configurable authentication settings
- *
- * @example
- * ```typescript
- * const authManager = new AuthManager('/custom/sessions');
- * const token = authManager.exchangeCodeForToken('code-123', 'client-456');
- * const session = authManager.validateAccessToken('tk-sess-789');
- * ```
- */
-export declare class AuthManager {
-    private sessionManager;
-    private configManager;
-    /**
-     * Creates a new AuthManager instance.
-     *
-     * Initializes the session manager with optional custom storage path
-     * and retrieves the server configuration manager instance.
-     *
-     * @param sessionStoragePath - Optional custom path for session storage
-     */
-    constructor(sessionStoragePath?: string);
-    /**
-     * Checks if authentication is currently enabled.
-     *
-     * @returns True if OAuth 2.1 authentication is enabled, false otherwise
-     */
-    isAuthEnabled(): boolean;
-    /**
-     * Validates an access token and returns session data.
-     *
-     * If authentication is disabled, returns null (always valid).
-     * For enabled authentication, strips the token prefix if present
-     * and validates the underlying session.
-     *
-     * @param token - The access token to validate (with or without prefix)
-     * @returns Session data if token is valid, null otherwise
-     */
-    validateAccessToken(token: string): SessionData | null;
-    /**
-     * Creates an authorization code for OAuth 2.1 flow.
-     *
-     * Delegates to the session manager to create a prefixed authorization
-     * code with the configured time-to-live.
-     *
-     * @param clientId - The client identifier
-     * @param redirectUri - The redirect URI for this code
-     * @param resource - The resource this code grants access to
-     * @returns The generated authorization code with prefix
-     */
-    createAuthCode(clientId: string, redirectUri: string, resource: string): string;
-    /**
-     * Exchanges an authorization code for an access token.
-     *
-     * Validates the authorization code, checks client ID and redirect URI
-     * matches, then creates a new access token with the configured TTL.
-     * The authorization code is deleted after successful exchange.
-     *
-     * @param code - The authorization code to exchange
-     * @param clientId - The client identifier
-     * @param redirectUri - Optional redirect URI for validation
-     * @param resource - Optional resource for validation
-     * @returns Access token with prefix if exchange successful, null otherwise
-     */
-    exchangeCodeForToken(code: string, clientId: string, redirectUri?: string, resource?: string): string | null;
-    /**
-     * Gets information about an access token.
-     *
-     * Retrieves session data for the token and returns formatted
-     * information including client ID, resource, and time until expiration.
-     *
-     * @param token - The access token to get information for
-     * @returns Token information if valid, null otherwise
-     */
-    getTokenInfo(token: string): {
-        clientId: string;
-        resource: string;
-        expiresIn: number;
-    } | null;
-    /**
-     * Revokes an access token.
-     *
-     * Removes the session associated with the token from storage.
-     *
-     * @param token - The access token to revoke
-     * @returns True if token was revoked, false if it didn't exist
-     */
-    revokeToken(token: string): boolean;
-    /**
-     * Performs graceful shutdown of the AuthManager.
-     *
-     * Delegates shutdown to the session manager to ensure proper
-     * cleanup of resources and timers.
-     */
-    shutdown(): void;
-}
-//# sourceMappingURL=authManager.d.ts.map

package/build/auth/authManager.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"authManager.d.ts","sourceRoot":"","sources":["../../src/auth/authManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAkB,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAKlE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,aAAa,CAAsB;IAE3C;;;;;;;OAOG;gBACS,kBAAkB,CAAC,EAAE,MAAM;IAKvC;;;;OAIG;IACI,aAAa,IAAI,OAAO;IAI/B;;;;;;;;;OASG;IACI,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI;IAmB7D;;;;;;;;;;OAUG;IACI,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAKtF;;;;;;;;;;;;OAYG;IACI,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAoCnH;;;;;;;;OAQG;IACI,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAapG;;;;;;;OAOG;IACI,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAI1C;;;;;OAKG;IACI,QAAQ,IAAI,IAAI;CAGxB"}