@1mcp/agent 0.12.0 → 0.13.1

package/build/auth/sdkOAuthServerProvider.js

@@ -0,0 +1,359 @@
+import { randomUUID } from 'node:crypto';
+import logger from '../logger/logger.js';
+import { OAuthStorageService } from './storage/oauthStorageService.js';
+import { AgentConfigManager } from '../core/server/agentConfig.js';
+import { AUTH_CONFIG } from '../constants.js';
+import { validateScopesAgainstAvailableTags, tagsToScopes, scopesToTags, auditScopeOperation, } from '../utils/scopeValidation.js';
+import { McpConfigManager } from '../config/mcpConfigManager.js';
+/**
+ * File-based OAuth clients store implementation using the new repository architecture
+ */
+class FileBasedClientsStore {
+    oauthStorage;
+    constructor(oauthStorage) {
+        this.oauthStorage = oauthStorage;
+    }
+    getClientKey(clientId) {
+        return `${AUTH_CONFIG.CLIENT.PREFIXES.CLIENT}${clientId}`;
+    }
+    getClient(clientId) {
+        const clientKey = this.getClientKey(clientId);
+        const clientData = this.oauthStorage.clientDataRepository.get(clientKey);
+        if (!clientData) {
+            return undefined;
+        }
+        return clientData;
+    }
+    registerClient(client) {
+        const clientKey = this.getClientKey(client.client_id);
+        // Store client for 30 days (same as original implementation)
+        const ttlMs = AUTH_CONFIG.CLIENT.OAUTH.TTL_MS;
+        try {
+            this.oauthStorage.clientDataRepository.save(clientKey, client, ttlMs);
+            logger.info(`Registered OAuth client: ${client.client_id}`);
+            return client;
+        }
+        catch (error) {
+            logger.error(`Failed to register client ${client.client_id}:`, error);
+            throw error;
+        }
+    }
+}
+/**
+ * Implementation of SDK's OAuthServerProvider interface using the new repository architecture.
+ *
+ * This provider implements OAuth 2.1 server functionality using the MCP SDK's interfaces
+ * with the new layered storage architecture for better separation of concerns.
+ */
+export class SDKOAuthServerProvider {
+    oauthStorage;
+    configManager;
+    _clientsStore;
+    constructor(sessionStoragePath) {
+        this.oauthStorage = new OAuthStorageService(sessionStoragePath);
+        this.configManager = AgentConfigManager.getInstance();
+        this._clientsStore = new FileBasedClientsStore(this.oauthStorage);
+    }
+    get clientsStore() {
+        return this._clientsStore;
+    }
+    /**
+     * Handles the authorization request with scope validation and user consent
+     */
+    async authorize(client, params, res) {
+        logger.debug('Authorizing client', { clientId: client.client_id, params });
+        try {
+            // Get requested scopes (default to all available tags if none specified)
+            const requestedScopes = params.scopes || [];
+            const configManager = McpConfigManager.getInstance();
+            const availableTags = configManager.getAvailableTags();
+            // If no scopes requested, default to all available tags
+            const finalScopes = requestedScopes.length > 0 ? requestedScopes : tagsToScopes(availableTags);
+            // Validate requested scopes against available tags
+            const validation = validateScopesAgainstAvailableTags(finalScopes, availableTags);
+            if (!validation.isValid) {
+                auditScopeOperation('scope_validation_failed', {
+                    clientId: client.client_id,
+                    requestedScopes: finalScopes,
+                    success: false,
+                    error: validation.errors.join(', '),
+                });
+                logger.warn(`Invalid scopes requested by client ${client.client_id}`, {
+                    requestedScopes: finalScopes,
+                    errors: validation.errors,
+                });
+                res.status(400).json({
+                    error: 'invalid_scope',
+                    error_description: `Invalid scopes: ${validation.errors.join(', ')}`,
+                });
+                return;
+            }
+            // Check if this is a direct authorization (auto-approve) or requires user consent
+            const requiresUserConsent = this.requiresUserConsent(client, finalScopes);
+            if (requiresUserConsent) {
+                // Show consent page
+                await this.renderConsentPage(client, params, finalScopes, availableTags, res);
+            }
+            else {
+                // Auto-approve with validated scopes
+                await this.approveAuthorization(client, params, validation.validScopes, res);
+            }
+        }
+        catch (error) {
+            logger.error('Authorization error:', error);
+            res.status(500).json({ error: 'server_error', error_description: 'Internal server error' });
+        }
+    }
+    /**
+     * Determines if user consent is required for the authorization
+     */
+    requiresUserConsent(client, scopes) {
+        logger.debug('Requires user consent', { clientId: client.client_id, scopes });
+        // For now, always require user consent for security
+        // In the future, this could be configurable based on client trust level
+        return true;
+    }
+    /**
+     * Renders the consent page for scope selection
+     */
+    async renderConsentPage(client, params, requestedScopes, availableTags, res) {
+        // Create temporary authorization request to store the code challenge securely
+        const authRequestId = this.oauthStorage.createAuthorizationRequest(client.client_id, params.redirectUri, params.codeChallenge, params.state, params.resource?.toString(), requestedScopes);
+        const scopeTags = scopesToTags(requestedScopes);
+        const consentPageHtml = this.generateConsentPageHtml(client, authRequestId, scopeTags, availableTags);
+        // Remove any CSP that might interfere with form submission
+        res.removeHeader('Content-Security-Policy');
+        res.set('Content-Type', 'text/html');
+        res.send(consentPageHtml);
+    }
+    /**
+     * Approves the authorization and redirects back to client
+     */
+    async approveAuthorization(client, params, grantedScopes, res) {
+        logger.debug('Approving authorization', { clientId: client.client_id, params, grantedScopes });
+        // Create authorization code with granted scopes
+        const ttlMs = this.configManager.getOAuthCodeTtlMs();
+        const code = this.oauthStorage.authCodeRepository.create(client.client_id, params.redirectUri, params.resource?.toString() || '', grantedScopes, ttlMs, params.codeChallenge);
+        // Build redirect URL
+        const redirectUrl = new URL(params.redirectUri);
+        redirectUrl.searchParams.set('code', code);
+        if (params.state) {
+            redirectUrl.searchParams.set('state', params.state);
+        }
+        auditScopeOperation('authorization_granted', {
+            clientId: client.client_id,
+            requestedScopes: params.scopes || [],
+            grantedScopes,
+            success: true,
+        });
+        logger.info(`OAuth authorization granted for client ${client.client_id}`, {
+            clientId: client.client_id,
+            redirectUri: params.redirectUri,
+            grantedScopes,
+        });
+        res.redirect(redirectUrl.toString());
+    }
+    /**
+     * Generates the HTML for the consent page
+     */
+    generateConsentPageHtml(client, authRequestId, requestedTags, availableTags) {
+        const clientName = client.client_name || client.client_id;
+        return `
+<!DOCTYPE html>
+<html>
+<head>
+    <title>Authorize ${clientName}</title>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <style>
+        body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; margin: 0; padding: 20px; background: #f5f5f5; }
+        .container { max-width: 500px; margin: 0 auto; background: white; padding: 30px; border-radius: 8px; box-shadow: 0 2px 10px rgba(0,0,0,0.1); }
+        h1 { color: #333; margin-bottom: 20px; }
+        .app-info { background: #f8f9fa; padding: 15px; border-radius: 6px; margin-bottom: 20px; }
+        .scopes-section { margin-bottom: 25px; }
+        .scope-item { display: flex; align-items: center; margin-bottom: 10px; }
+        .scope-item input { margin-right: 10px; }
+        .scope-item label { flex: 1; }
+        .tag-description { font-size: 0.9em; color: #666; margin-left: 25px; }
+        .buttons { display: flex; gap: 10px; justify-content: flex-end; }
+        .btn { padding: 10px 20px; border-radius: 4px; font-size: 14px; cursor: pointer; }
+        .btn-primary { background: #007bff; color: white; border: none; }
+        .btn-secondary { background: #6c757d; color: white; border: none; }
+        .btn:hover { opacity: 0.9; }
+        .security-notice { background: #fff3cd; border: 1px solid #ffeaa7; padding: 15px; border-radius: 4px; margin-bottom: 20px; }
+    </style>
+</head>
+<body>
+    <div class="container">
+        <h1>Authorize Application</h1>
+
+        <div class="app-info">
+            <strong>${clientName}</strong> is requesting access to your MCP servers.
+        </div>
+
+        <div class="security-notice">
+            <strong>Security Notice:</strong> Only grant access to server groups that this application needs.
+        </div>
+
+        <form method="POST" action="/oauth/consent">
+            <input type="hidden" name="auth_request_id" value="${authRequestId}">
+
+            <div class="scopes-section">
+                <h3>Server Access Permissions</h3>
+                <p>Select which server groups this application can access:</p>
+
+                ${availableTags
+            .map((tag) => `
+                    <div class="scope-item">
+                        <input type="checkbox"
+                               id="scope_${tag}"
+                               name="scopes"
+                               value="tag:${tag}"
+                               ${requestedTags.includes(tag) ? 'checked' : ''}>
+                        <label for="scope_${tag}">
+                            <strong>${tag}</strong> servers
+                        </label>
+                    </div>
+                    <div class="tag-description">
+                        Access servers tagged with "${tag}"
+                    </div>
+                `)
+            .join('')}
+            </div>
+
+            <div class="buttons">
+                <button type="submit" name="action" value="deny" class="btn btn-secondary">Deny</button>
+                <button type="submit" name="action" value="approve" class="btn btn-primary">Approve</button>
+            </div>
+        </form>
+    </div>
+</body>
+</html>
+    `;
+    }
+    /**
+     * Retrieves the PKCE challenge for an authorization code
+     */
+    async challengeForAuthorizationCode(client, authorizationCode) {
+        logger.debug('Challenge for authorization code', { clientId: client.client_id, authorizationCode });
+        const codeData = this.oauthStorage.authCodeRepository.get(authorizationCode);
+        if (!codeData || codeData.clientId !== client.client_id) {
+            throw new Error('Invalid authorization code');
+        }
+        return codeData.codeChallenge || '';
+    }
+    /**
+     * Exchanges authorization code for access token
+     */
+    async exchangeAuthorizationCode(client, authorizationCode, 
+    // Note: code verifier is checked in SDK's token.ts by default
+    // it's unused here for that reason.
+    _codeVerifier, redirectUri, resource) {
+        logger.debug('Exchanging authorization code', {
+            clientId: client.client_id,
+            authorizationCode,
+            redirectUri,
+            resource,
+        });
+        const codeData = this.oauthStorage.authCodeRepository.get(authorizationCode);
+        if (!codeData) {
+            throw new Error('Invalid or expired authorization code');
+        }
+        // Validate client ID
+        if (codeData.clientId !== client.client_id) {
+            throw new Error('Client ID mismatch');
+        }
+        // Validate redirect URI if provided
+        if (redirectUri && codeData.redirectUri !== redirectUri) {
+            throw new Error('Redirect URI mismatch');
+        }
+        // Validate resource if provided
+        if (resource && codeData.resource && codeData.resource !== resource.toString()) {
+            throw new Error('Resource mismatch');
+        }
+        // Delete the authorization code (one-time use)
+        this.oauthStorage.authCodeRepository.delete(authorizationCode);
+        // Create access token
+        const tokenId = randomUUID();
+        const accessToken = AUTH_CONFIG.SERVER.TOKEN.ID_PREFIX + tokenId;
+        const ttlMs = this.configManager.getOAuthTokenTtlMs();
+        // Store session for token validation
+        this.oauthStorage.sessionRepository.createWithId(tokenId, client.client_id, codeData.resource || '', codeData.scopes, ttlMs);
+        const tokens = {
+            access_token: accessToken,
+            token_type: 'Bearer',
+            expires_in: Math.floor(ttlMs / 1000),
+            scope: codeData.scopes ? codeData.scopes.join(' ') : '',
+        };
+        logger.info(`Exchanged authorization code for access token`, {
+            clientId: client.client_id,
+            tokenId: tokenId.substring(0, 8) + '...',
+            expiresIn: tokens.expires_in,
+        });
+        return tokens;
+    }
+    /**
+     * Exchanges refresh token for new access token (not implemented)
+     */
+    async exchangeRefreshToken(_client, _refreshToken, _scopes, _resource) {
+        throw new Error('Refresh tokens not supported');
+    }
+    /**
+     * Verifies access token and returns auth info with granted scopes
+     */
+    async verifyAccessToken(token) {
+        logger.debug('Verifying access token', { token });
+        if (!this.configManager.isAuthEnabled()) {
+            // Auth disabled, return minimal auth info with all available tags as scopes
+            const configManager = McpConfigManager.getInstance();
+            const availableTags = configManager.getAvailableTags();
+            return {
+                token,
+                clientId: 'anonymous',
+                scopes: tagsToScopes(availableTags),
+            };
+        }
+        // Strip prefix if present
+        const tokenId = token.startsWith(AUTH_CONFIG.SERVER.TOKEN.ID_PREFIX)
+            ? token.slice(AUTH_CONFIG.SERVER.TOKEN.ID_PREFIX.length)
+            : token;
+        // Get session data
+        const sessionId = AUTH_CONFIG.SERVER.SESSION.ID_PREFIX + tokenId;
+        const sessionData = this.oauthStorage.sessionRepository.get(sessionId);
+        if (!sessionData) {
+            throw new Error('Invalid or expired access token');
+        }
+        return {
+            token,
+            clientId: sessionData.clientId,
+            scopes: sessionData.scopes,
+            expiresAt: sessionData.expires,
+            resource: sessionData.resource ? new URL(sessionData.resource) : undefined,
+        };
+    }
+    /**
+     * Revokes a token
+     */
+    async revokeToken(client, request) {
+        logger.debug('Revoking token', { clientId: client.client_id, request });
+        const token = request.token;
+        // Strip prefix if present
+        const tokenId = token.startsWith(AUTH_CONFIG.SERVER.TOKEN.ID_PREFIX)
+            ? token.slice(AUTH_CONFIG.SERVER.TOKEN.ID_PREFIX.length)
+            : token;
+        const sessionId = AUTH_CONFIG.SERVER.SESSION.ID_PREFIX + tokenId;
+        const success = this.oauthStorage.sessionRepository.delete(sessionId);
+        if (success) {
+            logger.info(`Revoked access token for client ${client.client_id}`, {
+                tokenId: tokenId.substring(0, 8) + '...',
+            });
+        }
+    }
+    /**
+     * Graceful shutdown
+     */
+    shutdown() {
+        this.oauthStorage.shutdown();
+    }
+}
+//# sourceMappingURL=sdkOAuthServerProvider.js.map

package/build/auth/sdkOAuthServerProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdkOAuthServerProvider.js","sourceRoot":"","sources":["../../src/auth/sdkOAuthServerProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAUzC,OAAO,MAAM,MAAM,qBAAqB,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EACL,kCAAkC,EAClC,YAAY,EACZ,YAAY,EACZ,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjE;;GAEG;AACH,MAAM,qBAAqB;IACjB,YAAY,CAAsB;IAE1C,YAAY,YAAiC;QAC3C,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnC,CAAC;IAED,YAAY,CAAC,QAAgB;QAC3B,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;IAC5D,CAAC;IAED,SAAS,CAAC,QAAgB;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAEzE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,cAAc,CAAC,MAAkC;QAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtD,6DAA6D;QAC7D,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QAE9C,IAAI,CAAC;YACH,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACtE,MAAM,CAAC,IAAI,CAAC,4BAA4B,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YAC5D,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,6BAA6B,MAAM,CAAC,SAAS,GAAG,EAAE,KAAK,CAAC,CAAC;YACtE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,sBAAsB;IAC1B,YAAY,CAAsB;IACjC,aAAa,CAAqB;IAClC,aAAa,CAA8B;IAEnD,YAAY,kBAA2B;QACrC,IAAI,CAAC,YAAY,GAAG,IAAI,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;QAChE,IAAI,CAAC,aAAa,GAAG,kBAAkB,CAAC,WAAW,EAAE,CAAC;QACtD,IAAI,CAAC,aAAa,GAAG,IAAI,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,MAAkC,EAAE,MAA2B,EAAE,GAAa;QAC5F,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC;YACH,yEAAyE;YACzE,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;YAC5C,MAAM,aAAa,GAAG,gBAAgB,CAAC,WAAW,EAAE,CAAC;YACrD,MAAM,aAAa,GAAG,aAAa,CAAC,gBAAgB,EAAE,CAAC;YAEvD,wDAAwD;YACxD,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;YAE/F,mDAAmD;YACnD,MAAM,UAAU,GAAG,kCAAkC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;YAElF,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBACxB,mBAAmB,CAAC,yBAAyB,EAAE;oBAC7C,QAAQ,EAAE,MAAM,CAAC,SAAS;oBAC1B,eAAe,EAAE,WAAW;oBAC5B,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;iBACpC,CAAC,CAAC;gBAEH,MAAM,CAAC,IAAI,CAAC,sCAAsC,MAAM,CAAC,SAAS,EAAE,EAAE;oBACpE,eAAe,EAAE,WAAW;oBAC5B,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;gBAEH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,eAAe;oBACtB,iBAAiB,EAAE,mBAAmB,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBACrE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,kFAAkF;YAClF,MAAM,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YAE1E,IAAI,mBAAmB,EAAE,CAAC;gBACxB,oBAAoB;gBACpB,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;YAChF,CAAC;iBAAM,CAAC;gBACN,qCAAqC;gBACrC,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IAED;;OAEG;IACK,mBAAmB,CAAC,MAAkC,EAAE,MAAgB;QAC9E,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9E,oDAAoD;QACpD,wEAAwE;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,iBAAiB,CAC7B,MAAkC,EAClC,MAA2B,EAC3B,eAAyB,EACzB,aAAuB,EACvB,GAAa;QAEb,8EAA8E;QAC9E,MAAM,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC,0BAA0B,CAChE,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,aAAa,EACpB,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAC3B,eAAe,CAChB,CAAC;QAEF,MAAM,SAAS,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;QAChD,MAAM,eAAe,GAAG,IAAI,CAAC,uBAAuB,CAAC,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QAEtG,2DAA2D;QAC3D,GAAG,CAAC,YAAY,CAAC,yBAAyB,CAAC,CAAC;QAC5C,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5B,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,oBAAoB,CAC/B,MAAkC,EAClC,MAA2B,EAC3B,aAAuB,EACvB,GAAa;QAEb,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;QAC/F,gDAAgD;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,iBAAiB,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,MAAM,CACtD,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,EACjC,aAAa,EACb,KAAK,EACL,MAAM,CAAC,aAAa,CACrB,CAAC;QAEF,qBAAqB;QACrB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAChD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC3C,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACtD,CAAC;QAED,mBAAmB,CAAC,uBAAuB,EAAE;YAC3C,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,eAAe,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YACpC,aAAa;YACb,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,0CAA0C,MAAM,CAAC,SAAS,EAAE,EAAE;YACxE,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,aAAa;SACd,CAAC,CAAC;QAEH,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACK,uBAAuB,CAC7B,MAAkC,EAClC,aAAqB,EACrB,aAAuB,EACvB,aAAuB;QAEvB,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,SAAS,CAAC;QAE1D,OAAO;;;;uBAIY,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;sBA0BX,UAAU;;;;;;;;iEAQiC,aAAa;;;;;;kBAM5D,aAAa;aACZ,GAAG,CACF,CAAC,GAAG,EAAE,EAAE,CAAC;;;2CAGc,GAAG;;4CAEF,GAAG;iCACd,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;4CACjC,GAAG;sCACT,GAAG;;;;sDAIa,GAAG;;iBAExC,CACE;aACA,IAAI,CAAC,EAAE,CAAC;;;;;;;;;;;KAWtB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,6BAA6B,CAAC,MAAkC,EAAE,iBAAyB;QAC/F,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAEpG,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC7E,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,OAAO,QAAQ,CAAC,aAAa,IAAI,EAAE,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,yBAAyB,CAC7B,MAAkC,EAClC,iBAAyB;IACzB,8DAA8D;IAC9D,oCAAoC;IACpC,aAAsB,EACtB,WAAoB,EACpB,QAAc;QAEd,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE;YAC5C,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,iBAAiB;YACjB,WAAW;YACX,QAAQ;SACT,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC7E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QAED,qBAAqB;QACrB,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACxC,CAAC;QAED,oCAAoC;QACpC,IAAI,WAAW,IAAI,QAAQ,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QAED,gCAAgC;QAChC,IAAI,QAAQ,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvC,CAAC;QAED,+CAA+C;QAC/C,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAE/D,sBAAsB;QACtB,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,OAAO,CAAC;QACjE,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,kBAAkB,EAAE,CAAC;QAEtD,qCAAqC;QACrC,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,YAAY,CAC9C,OAAO,EACP,MAAM,CAAC,SAAS,EAChB,QAAQ,CAAC,QAAQ,IAAI,EAAE,EACvB,QAAQ,CAAC,MAAM,EACf,KAAK,CACN,CAAC;QAEF,MAAM,MAAM,GAAgB;YAC1B,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;YACpC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;SACxD,CAAC;QAEF,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE;YAC3D,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK;YACxC,SAAS,EAAE,MAAM,CAAC,UAAU;SAC7B,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAAmC,EACnC,aAAqB,EACrB,OAAkB,EAClB,SAAe;QAEf,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAElD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,EAAE,CAAC;YACxC,4EAA4E;YAC5E,MAAM,aAAa,GAAG,gBAAgB,CAAC,WAAW,EAAE,CAAC;YACrD,MAAM,aAAa,GAAG,aAAa,CAAC,gBAAgB,EAAE,CAAC;YACvD,OAAO;gBACL,KAAK;gBACL,QAAQ,EAAE,WAAW;gBACrB,MAAM,EAAE,YAAY,CAAC,aAAa,CAAC;aACpC,CAAC;QACJ,CAAC;QAED,0BAA0B;QAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;YAClE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC;YACxD,CAAC,CAAC,KAAK,CAAC;QAEV,mBAAmB;QACnB,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC;QACjE,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAEvE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QAED,OAAO;YACL,KAAK;YACL,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,SAAS,EAAE,WAAW,CAAC,OAAO;YAC9B,QAAQ,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;SAC3E,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,MAAkC,EAAE,OAAoC;QACxF,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QAExE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAE5B,0BAA0B;QAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;YAClE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC;YACxD,CAAC,CAAC,KAAK,CAAC;QAEV,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC;QACjE,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEtE,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,mCAAmC,MAAM,CAAC,SAAS,EAAE,EAAE;gBACjE,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK;aACzC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;IAC/B,CAAC;CACF"}

package/build/auth/sessionTypes.d.ts

@@ -0,0 +1,38 @@
+import { OAuthClientInformationFull } from '@modelcontextprotocol/sdk/shared/auth.js';
+/**
+ * Base interface for all data that can expire
+ */
+export interface ExpirableData {
+    expires: number;
+    createdAt: number;
+}
+export interface SessionData extends ExpirableData {
+    clientId: string;
+    resource: string;
+    scopes: string[];
+}
+export interface ClientData extends ExpirableData, OAuthClientInformationFull {
+}
+export interface AuthCodeData extends ExpirableData {
+    clientId: string;
+    redirectUri: string;
+    resource: string;
+    scopes: string[];
+    codeChallenge?: string;
+}
+export interface ClientSessionData extends ExpirableData {
+    serverName: string;
+    clientInfo?: string;
+    tokens?: string;
+    codeVerifier?: string;
+    state?: string;
+}
+export interface AuthRequestData extends ExpirableData {
+    clientId: string;
+    redirectUri: string;
+    codeChallenge?: string;
+    state?: string;
+    resource?: string;
+    scopes?: string[];
+}
+//# sourceMappingURL=sessionTypes.d.ts.map

package/build/auth/sessionTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionTypes.d.ts","sourceRoot":"","sources":["../../src/auth/sessionTypes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,0BAA0B,EAAE,MAAM,0CAA0C,CAAC;AAEtF;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAY,SAAQ,aAAa;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,UAAW,SAAQ,aAAa,EAAE,0BAA0B;CAAG;AAEhF,MAAM,WAAW,YAAa,SAAQ,aAAa;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAGD,MAAM,WAAW,iBAAkB,SAAQ,aAAa;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAGD,MAAM,WAAW,eAAgB,SAAQ,aAAa;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB"}

package/build/auth/sessionTypes.js

@@ -0,0 +1,3 @@
+// Shared session types for server and client session managers
+export {};
+//# sourceMappingURL=sessionTypes.js.map

package/build/auth/sessionTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionTypes.js","sourceRoot":"","sources":["../../src/auth/sessionTypes.ts"],"names":[],"mappings":"AAAA,8DAA8D"}

package/build/auth/storage/authCodeRepository.d.ts

@@ -0,0 +1,25 @@
+import { AuthCodeData } from '../sessionTypes.js';
+import { FileStorageService } from './fileStorageService.js';
+/**
+ * Repository for authorization code operations
+ *
+ * Manages OAuth 2.1 authorization codes for token exchange.
+ * Authorization codes are short-lived (1 minute) and single-use.
+ */
+export declare class AuthCodeRepository {
+    private storage;
+    constructor(storage: FileStorageService);
+    /**
+     * Creates a new authorization code
+     */
+    create(clientId: string, redirectUri: string, resource: string, scopes: string[], ttlMs: number, codeChallenge?: string): string;
+    /**
+     * Retrieves authorization code data by code
+     */
+    get(code: string): AuthCodeData | null;
+    /**
+     * Deletes an authorization code by code
+     */
+    delete(code: string): boolean;
+}
+//# sourceMappingURL=authCodeRepository.d.ts.map

package/build/auth/storage/authCodeRepository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authCodeRepository.d.ts","sourceRoot":"","sources":["../../../src/auth/storage/authCodeRepository.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D;;;;;GAKG;AACH,qBAAa,kBAAkB;IACjB,OAAO,CAAC,OAAO;gBAAP,OAAO,EAAE,kBAAkB;IAE/C;;OAEG;IACH,MAAM,CACJ,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EAAE,EAChB,KAAK,EAAE,MAAM,EACb,aAAa,CAAC,EAAE,MAAM,GACrB,MAAM;IAiBT;;OAEG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IAItC;;OAEG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;CAO9B"}

package/build/auth/storage/authCodeRepository.js

@@ -0,0 +1,50 @@
+import { randomUUID } from 'node:crypto';
+import logger from '../../logger/logger.js';
+import { AUTH_CONFIG } from '../../constants.js';
+/**
+ * Repository for authorization code operations
+ *
+ * Manages OAuth 2.1 authorization codes for token exchange.
+ * Authorization codes are short-lived (1 minute) and single-use.
+ */
+export class AuthCodeRepository {
+    storage;
+    constructor(storage) {
+        this.storage = storage;
+    }
+    /**
+     * Creates a new authorization code
+     */
+    create(clientId, redirectUri, resource, scopes, ttlMs, codeChallenge) {
+        const code = AUTH_CONFIG.SERVER.AUTH_CODE.ID_PREFIX + randomUUID();
+        const authCodeData = {
+            clientId,
+            redirectUri,
+            resource,
+            scopes,
+            codeChallenge,
+            expires: Date.now() + ttlMs,
+            createdAt: Date.now(),
+        };
+        this.storage.writeData(AUTH_CONFIG.SERVER.AUTH_CODE.FILE_PREFIX, code, authCodeData);
+        logger.info(`Created auth code: ${code} for client: ${clientId}`);
+        return code;
+    }
+    /**
+     * Retrieves authorization code data by code
+     */
+    get(code) {
+        return this.storage.readData(AUTH_CONFIG.SERVER.AUTH_CODE.FILE_PREFIX, code);
+    }
+    /**
+     * Deletes an authorization code by code
+     */
+    delete(code) {
+        const result = this.storage.deleteData(AUTH_CONFIG.SERVER.AUTH_CODE.FILE_PREFIX, code);
+        if (result) {
+            logger.info(`Deleted auth code: ${code}`);
+        }
+        return result;
+    }
+}
+//# sourceMappingURL=authCodeRepository.js.map

package/build/auth/storage/authCodeRepository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authCodeRepository.js","sourceRoot":"","sources":["../../../src/auth/storage/authCodeRepository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,MAAM,MAAM,wBAAwB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAIjD;;;;;GAKG;AACH,MAAM,OAAO,kBAAkB;IACT;IAApB,YAAoB,OAA2B;QAA3B,YAAO,GAAP,OAAO,CAAoB;IAAG,CAAC;IAEnD;;OAEG;IACH,MAAM,CACJ,QAAgB,EAChB,WAAmB,EACnB,QAAgB,EAChB,MAAgB,EAChB,KAAa,EACb,aAAsB;QAEtB,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,GAAG,UAAU,EAAE,CAAC;QACnE,MAAM,YAAY,GAAiB;YACjC,QAAQ;YACR,WAAW;YACX,QAAQ;YACR,MAAM;YACN,aAAa;YACb,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC3B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QAEF,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;QACrF,MAAM,CAAC,IAAI,CAAC,sBAAsB,IAAI,gBAAgB,QAAQ,EAAE,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAe,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAC7F,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,IAAY;QACjB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACvF,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/build/auth/storage/authRequestRepository.d.ts

@@ -0,0 +1,25 @@
+import { AuthRequestData } from '../sessionTypes.js';
+import { FileStorageService } from './fileStorageService.js';
+/**
+ * Repository for authorization request operations
+ *
+ * Manages temporary authorization requests used in the consent flow.
+ * These store OAuth parameters securely server-side while user reviews consent.
+ */
+export declare class AuthRequestRepository {
+    private storage;
+    constructor(storage: FileStorageService);
+    /**
+     * Creates a new authorization request
+     */
+    create(clientId: string, redirectUri: string, codeChallenge?: string, state?: string, resource?: string, scopes?: string[]): string;
+    /**
+     * Retrieves authorization request data by ID
+     */
+    get(authRequestId: string): AuthRequestData | null;
+    /**
+     * Deletes an authorization request by ID
+     */
+    delete(authRequestId: string): boolean;
+}
+//# sourceMappingURL=authRequestRepository.d.ts.map

package/build/auth/storage/authRequestRepository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authRequestRepository.d.ts","sourceRoot":"","sources":["../../../src/auth/storage/authRequestRepository.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D;;;;;GAKG;AACH,qBAAa,qBAAqB;IACpB,OAAO,CAAC,OAAO;gBAAP,OAAO,EAAE,kBAAkB;IAE/C;;OAEG;IACH,MAAM,CACJ,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,aAAa,CAAC,EAAE,MAAM,EACtB,KAAK,CAAC,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,EAAE,GAChB,MAAM;IAkBT;;OAEG;IACH,GAAG,CAAC,aAAa,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;IAIlD;;OAEG;IACH,MAAM,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO;CAOvC"}

package/build/auth/storage/authRequestRepository.js

@@ -0,0 +1,51 @@
+import { randomUUID } from 'node:crypto';
+import logger from '../../logger/logger.js';
+import { AUTH_CONFIG } from '../../constants.js';
+/**
+ * Repository for authorization request operations
+ *
+ * Manages temporary authorization requests used in the consent flow.
+ * These store OAuth parameters securely server-side while user reviews consent.
+ */
+export class AuthRequestRepository {
+    storage;
+    constructor(storage) {
+        this.storage = storage;
+    }
+    /**
+     * Creates a new authorization request
+     */
+    create(clientId, redirectUri, codeChallenge, state, resource, scopes) {
+        const authRequestId = AUTH_CONFIG.SERVER.AUTH_REQUEST.ID_PREFIX + randomUUID();
+        const authRequestData = {
+            clientId,
+            redirectUri,
+            codeChallenge,
+            state,
+            resource,
+            scopes,
+            expires: Date.now() + AUTH_CONFIG.SERVER.AUTH_REQUEST.TTL_MS,
+            createdAt: Date.now(),
+        };
+        this.storage.writeData(AUTH_CONFIG.SERVER.AUTH_REQUEST.FILE_PREFIX, authRequestId, authRequestData);
+        logger.info(`Created auth request: ${authRequestId} for client: ${clientId}`);
+        return authRequestId;
+    }
+    /**
+     * Retrieves authorization request data by ID
+     */
+    get(authRequestId) {
+        return this.storage.readData(AUTH_CONFIG.SERVER.AUTH_REQUEST.FILE_PREFIX, authRequestId);
+    }
+    /**
+     * Deletes an authorization request by ID
+     */
+    delete(authRequestId) {
+        const result = this.storage.deleteData(AUTH_CONFIG.SERVER.AUTH_REQUEST.FILE_PREFIX, authRequestId);
+        if (result) {
+            logger.info(`Deleted auth request: ${authRequestId}`);
+        }
+        return result;
+    }
+}
+//# sourceMappingURL=authRequestRepository.js.map

package/build/auth/storage/authRequestRepository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authRequestRepository.js","sourceRoot":"","sources":["../../../src/auth/storage/authRequestRepository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,MAAM,MAAM,wBAAwB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAIjD;;;;;GAKG;AACH,MAAM,OAAO,qBAAqB;IACZ;IAApB,YAAoB,OAA2B;QAA3B,YAAO,GAAP,OAAO,CAAoB;IAAG,CAAC;IAEnD;;OAEG;IACH,MAAM,CACJ,QAAgB,EAChB,WAAmB,EACnB,aAAsB,EACtB,KAAc,EACd,QAAiB,EACjB,MAAiB;QAEjB,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,GAAG,UAAU,EAAE,CAAC;QAC/E,MAAM,eAAe,GAAoB;YACvC,QAAQ;YACR,WAAW;YACX,aAAa;YACb,KAAK;YACL,QAAQ;YACR,MAAM;YACN,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM;YAC5D,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QAEF,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC;QACpG,MAAM,CAAC,IAAI,CAAC,yBAAyB,aAAa,gBAAgB,QAAQ,EAAE,CAAC,CAAC;QAC9E,OAAO,aAAa,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,aAAqB;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAkB,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAC5G,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,aAAqB;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QACnG,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,yBAAyB,aAAa,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/build/auth/storage/clientDataRepository.d.ts

@@ -0,0 +1,25 @@
+import { FileStorageService } from './fileStorageService.js';
+import { OAuthClientInformationFull } from '@modelcontextprotocol/sdk/shared/auth.js';
+/**
+ * Repository for OAuth client data operations
+ *
+ * Manages registered OAuth client information with automatic expiration.
+ * Client data is stored for a configurable period (default 30 days).
+ */
+export declare class ClientDataRepository {
+    private storage;
+    constructor(storage: FileStorageService);
+    /**
+     * Saves OAuth client data
+     */
+    save(clientId: string, data: OAuthClientInformationFull, ttlMs: number): string;
+    /**
+     * Retrieves OAuth client data by client ID
+     */
+    get(clientId: string): OAuthClientInformationFull | null;
+    /**
+     * Deletes OAuth client data by client ID
+     */
+    delete(clientId: string): boolean;
+}
+//# sourceMappingURL=clientDataRepository.d.ts.map

package/build/auth/storage/clientDataRepository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientDataRepository.d.ts","sourceRoot":"","sources":["../../../src/auth/storage/clientDataRepository.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,0BAA0B,EAAE,MAAM,0CAA0C,CAAC;AAEtF;;;;;GAKG;AACH,qBAAa,oBAAoB;IACnB,OAAO,CAAC,OAAO;gBAAP,OAAO,EAAE,kBAAkB;IAE/C;;OAEG;IACH,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM;IAY/E;;OAEG;IACH,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,0BAA0B,GAAG,IAAI;IAKxD;;OAEG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;CAOlC"}