@adminforth/mcp 1.1.2 → 1.2.0

package/README.md

@@ -1,8 +1,8 @@
 # AdminForth MCP
 
-`@adminforth/mcp` exposes the AdminForth API tool surface as an authenticated remote MCP server. Each MCP auth secret belongs to one AdminForth user, so resource permissions and hooks are preserved.
+`@adminforth/mcp` exposes the AdminForth API tool surface as an authenticated remote MCP server. Agents connect through OAuth sign-in or with an auth secret, and act as the AdminForth user who connected them, so resource permissions and hooks are preserved.
 
-The server identifies itself to agents using the configured AdminForth `brandName`. An optional `adminPanelOrigin` can distinguish deployments further; the plugin combines it with the AdminForth `baseUrl`.
+The required `adminPanelOrigin` is the public origin agents connect to; the plugin combines it with the AdminForth `baseUrl` to build the MCP URL and the OAuth issuer.
 
 > **Security:** an MCP auth secret carries the full permissions of the user who created it. An agent
 > holding it can do everything that user can do in the admin panel, including destructive actions and

package/dist/apiTools.d.ts

@@ -1,24 +1,19 @@
+import type { Tool } from '@modelcontextprotocol/server';
 import type { McpPageSize } from './types.js';
 import type { AdminUser, IAdminForth } from 'adminforth';
-export interface McpToolDefinition {
-    name: string;
-    description?: string;
-    inputSchema: Record<string, unknown>;
-    annotations?: {
-        readOnlyHint?: boolean;
-        destructiveHint?: boolean;
-    };
-}
 export declare class AdminForthApiTools {
     private readonly adminforth;
     private readonly hiddenResourceIds;
     private readonly toolTimeoutMs;
     constructor(adminforth: IAdminForth, hiddenResourceIds: ReadonlySet<string>, pageSize: McpPageSize, toolTimeoutMs: number);
     private readonly toolOverrides;
-    private schemas;
+    private fullCatalog?;
+    private readOnlyCatalog?;
+    private catalog;
+    private buildCatalog;
     private description;
     private withTimeout;
-    list(readOnly: boolean): McpToolDefinition[];
+    list(readOnly: boolean): Tool[];
     call(params: {
         name: string;
         arguments?: Record<string, unknown>;

package/dist/apiTools.js

@@ -1,7 +1,9 @@
-import { compactInputSchema } from './inputSchema.js';
+import { compactInputSchema } from './compactInputSchema.js';
 import { adminApiPrefix } from './urls.js';
 import { AdminForthDataTypes } from 'adminforth';
 const METHODS_WITHOUT_REQUEST_BODY = new Set(['GET', 'HEAD']);
+const NON_TOOL_NAME_CHARACTER_RE = /[^a-zA-Z0-9_]+/g;
+const EDGE_UNDERSCORE_RE = /^_+|_+$/g;
 // Milliseconds cost tokens on every datetime value and are never needed to answer the user.
 const ISO_MILLISECONDS_RE = /\.\d+(?=Z$)/;
 const TOOL_TIMEOUT = Symbol('TOOL_TIMEOUT');
@@ -44,15 +46,7 @@ function isRegisteredToolSchema(schema) {
     return typeof schema.handler === 'function' && !schema.agent?.hiddenFromAgents;
 }
 function endpointPathToToolName(path) {
-    return path
-        .replace(/^\/+/, '')
-        .replace(/[^a-zA-Z0-9_]+/g, '_')
-        .replace(/^_+|_+$/g, '');
-}
-function stripAdminApiPrefix(path, adminforth) {
-    const apiPrefix = adminApiPrefix(adminforth.config.baseUrl);
-    const strippedPath = path.startsWith(apiPrefix) ? path.slice(apiPrefix.length) : path;
-    return strippedPath.startsWith('/') ? strippedPath : `/${strippedPath}`;
+    return path.replace(NON_TOOL_NAME_CHARACTER_RE, '_').replace(EDGE_UNDERSCORE_RE, '');
 }
 // Drops frontend-only parts of the get_resource response that are useless for MCP clients and only waste their context.
 // Copies instead of deleting: the response shares nested objects with the AdminForth config.
@@ -174,16 +168,37 @@ export class AdminForthApiTools {
         this.toolOverrides = createToolOverrides(pageSize, adminforth);
     }
     toolOverrides;
-    schemas(readOnly) {
-        const schemas = new Map();
-        for (const schema of this.adminforth.openApi.registeredSchemas) {
-            if (!isRegisteredToolSchema(schema))
-                continue;
-            if (readOnly && !schema.agent?.onlyReadsData)
-                continue;
-            schemas.set(endpointPathToToolName(stripAdminApiPrefix(schema.path, this.adminforth)), schema);
-        }
-        return schemas;
+    fullCatalog;
+    readOnlyCatalog;
+    catalog(readOnly) {
+        return readOnly
+            ? (this.readOnlyCatalog ??= this.buildCatalog(true))
+            : (this.fullCatalog ??= this.buildCatalog(false));
+    }
+    buildCatalog(readOnly) {
+        const apiPrefix = adminApiPrefix(this.adminforth.config.baseUrl);
+        const schemas = new Map(this.adminforth.openApi.registeredSchemas
+            .filter(isRegisteredToolSchema)
+            .filter((schema) => !readOnly || schema.agent?.onlyReadsData)
+            .map((schema) => [endpointPathToToolName(schema.path.slice(apiPrefix.length)), schema]));
+        const tools = Array.from(schemas.entries())
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([name, schema]) => ({
+            name,
+            ...this.description(name, schema),
+            inputSchema: compactInputSchema(overrideInputSchema(schema.request_schema ?? {
+                type: 'object',
+                properties: {},
+                additionalProperties: true,
+            }, this.toolOverrides[name])),
+            ...(schema.agent?.onlyReadsData && {
+                annotations: { readOnlyHint: true },
+            }),
+            ...(schema.agent?.requiresHumanApproval && {
+                annotations: { destructiveHint: true },
+            }),
+        }));
+        return { schemas, tools };
     }
     description(name, schema) {
         const description = [
@@ -215,26 +230,10 @@ export class AdminForthApiTools {
         }
     }
     list(readOnly) {
-        return Array.from(this.schemas(readOnly).entries())
-            .sort(([left], [right]) => left.localeCompare(right))
-            .map(([name, schema]) => ({
-            name,
-            ...this.description(name, schema),
-            inputSchema: compactInputSchema(overrideInputSchema(schema.request_schema ?? {
-                type: 'object',
-                properties: {},
-                additionalProperties: true,
-            }, this.toolOverrides[name])),
-            ...(schema.agent?.onlyReadsData && {
-                annotations: { readOnlyHint: true },
-            }),
-            ...(schema.agent?.requiresHumanApproval && {
-                annotations: { destructiveHint: true },
-            }),
-        }));
+        return this.catalog(readOnly).tools;
     }
     async call(params) {
-        const schema = this.schemas(params.readOnly).get(params.name);
+        const schema = this.catalog(params.readOnly).schemas.get(params.name);
         if (!schema) {
             return { output: { error: `Unknown tool: ${params.name}` }, isError: true };
         }
@@ -261,7 +260,6 @@ export class AdminForthApiTools {
             };
         }
         const response = createDirectResponse();
-        const language = String(params.headers['accept-language'] ?? 'en');
         const output = await this.withTimeout(params.abortSignal, (abortSignal) => schema.handler({
             body,
             query,
@@ -273,7 +271,7 @@ export class AdminForthApiTools {
             abortSignal,
             _raw_express_req: undefined,
             _raw_express_res: undefined,
-            tr: (message, category, translationParams, pluralizationNumber) => this.adminforth.tr(message, category, language, translationParams, pluralizationNumber),
+            tr: (message, category, translationParams, pluralizationNumber) => this.adminforth.tr(message, category, params.headers['accept-language'], translationParams, pluralizationNumber),
         }));
         if (output === TOOL_TIMEOUT) {
             return {

package/dist/authSecretStore.d.ts

@@ -1,5 +1,6 @@
 import { type AdminUser, type HttpExtra, type IAdminForth } from 'adminforth';
-import type { McpAuthSecretResourceOptions, McpClientInfo } from './types.js';
+import type { AuthSecretRepository } from './repositories/authSecret.js';
+import type { McpClientInfo } from './types.js';
 export declare const SECRET_PREFIX = "afmcp_";
 type AdminUserWithExecutor = AdminUser & {
     executedBy?: string;
@@ -20,18 +21,17 @@ export interface AuthenticatedMcpSecret {
 }
 export declare class McpAuthSecretStore {
     private readonly adminforth;
-    private readonly options;
-    private readonly resource;
+    private readonly repository;
     private readonly refreshLock;
-    constructor(adminforth: IAdminForth, options: McpAuthSecretResourceOptions);
+    constructor(adminforth: IAdminForth, repository: AuthSecretRepository);
     list(adminUser: AdminUser): Promise<{
-        id: any;
-        name: any;
-        createdAt: any;
-        lastUsedAt: any;
+        id: string;
+        name: string;
+        createdAt: string;
+        lastUsedAt: string | null;
         lastUsedByAgent: McpClientInfo | null;
-        readOnly: any;
-        oauthClientId: any;
+        readOnly: boolean;
+        oauthClientId: string | null;
     }[]>;
     create(name: string, readOnly: boolean, adminUser: AdminUser, extra: HttpExtra): Promise<{
         error: string;
@@ -59,8 +59,6 @@ export declare class McpAuthSecretStore {
     rotateRefreshToken(grantId: string, refreshToken: string, clientId: string, newRefreshToken: string): Promise<string | null>;
     /** Access tokens are checked against their grant on every request, so revoking the grant applies at once. */
     authenticateOAuthGrant(grantId: string, userId: string): Promise<AuthenticatedMcpSecret | null>;
-    /** The OAuth grant methods are called only when OAuth is enabled, which requires this field. */
-    private get oauthClientIdField();
     private loadAdminUser;
     private toAuthenticated;
     touch(recordId: string, client: McpClientInfo): void;

package/dist/authSecretStore.js

@@ -1,120 +1,61 @@
 import { createHash, randomBytes, randomUUID } from 'node:crypto';
-import { Filters, Sorts, logger, } from 'adminforth';
+import { Filters, logger, } from 'adminforth';
 import { UNKNOWN_CLIENT } from './clientInfo.js';
 import { KeyedLock } from './keyedLock.js';
 export const SECRET_PREFIX = 'afmcp_';
 function hashSecret(secret) {
     return createHash('sha256').update(secret).digest('hex');
 }
-/**
- * Stored agent info originates from the MCP client, so it is never trusted to be valid JSON:
- * a database column which truncated an oversized value would otherwise break every next
- * request made with the auth secret, including the page used to revoke it.
- */
-function parseStoredClient(value) {
-    if (typeof value !== 'string' || !value)
-        return null;
-    let parsed;
-    try {
-        parsed = JSON.parse(value);
-    }
-    catch {
-        return null;
-    }
-    if (!parsed || typeof parsed !== 'object' || typeof parsed.client !== 'string')
-        return null;
-    return { client: parsed.client, ver: typeof parsed.ver === 'string' ? parsed.ver : null };
-}
 export class McpAuthSecretStore {
     adminforth;
-    options;
-    resource;
+    repository;
     refreshLock = new KeyedLock();
-    constructor(adminforth, options) {
+    constructor(adminforth, repository) {
         this.adminforth = adminforth;
-        this.options = options;
-        this.resource = adminforth.config.resources.find((resource) => resource.resourceId === options.resourceId);
+        this.repository = repository;
     }
     async list(adminUser) {
-        const fields = this.options;
-        const records = await this.adminforth.resource(fields.resourceId).list(Filters.EQ(fields.userIdField, adminUser.pk), undefined, undefined, Sorts.DESC(fields.createdAtField));
-        return records.map((record) => ({
-            id: record[fields.idField],
-            name: record[fields.nameField],
-            createdAt: record[fields.createdAtField],
-            lastUsedAt: record[fields.lastUsedAtField] ?? null,
-            lastUsedByAgent: parseStoredClient(record[fields.lastUsedByAgentField]),
-            readOnly: record[fields.readOnlyField],
-            oauthClientId: fields.oauthClientIdField ? record[fields.oauthClientIdField] ?? null : null,
-        }));
+        const authSecrets = await this.repository.listByUser(adminUser.pk);
+        return authSecrets.map(({ secretHash, userId, ...authSecret }) => authSecret);
     }
     async create(name, readOnly, adminUser, extra) {
-        const fields = this.options;
         const secret = `${SECRET_PREFIX}${randomBytes(32).toString('base64url')}`;
-        const result = await this.adminforth.createResourceRecord({
-            resource: this.resource,
-            adminUser,
-            extra,
-            record: {
-                [fields.idField]: randomUUID(),
-                [fields.nameField]: name,
-                [fields.secretHashField]: hashSecret(secret),
-                [fields.userIdField]: adminUser.pk,
-                [fields.createdAtField]: new Date().toISOString(),
-                [fields.lastUsedAtField]: null,
-                [fields.lastUsedByAgentField]: null,
-                [fields.readOnlyField]: readOnly,
-                ...(fields.oauthClientIdField && { [fields.oauthClientIdField]: null }),
-            },
-        });
+        const result = await this.repository.create({
+            id: randomUUID(),
+            name,
+            secretHash: hashSecret(secret),
+            userId: adminUser.pk,
+            readOnly,
+            oauthClientId: null,
+        }, adminUser, extra);
         return result.error ? { error: result.error } : { secret };
     }
     async revoke(id, adminUser, extra) {
-        const fields = this.options;
-        const record = await this.adminforth.resource(fields.resourceId).get(Filters.AND(Filters.EQ(fields.idField, id), Filters.EQ(fields.userIdField, adminUser.pk)));
-        if (!record)
-            return { error: 'MCP auth secret not found' };
-        return this.adminforth.deleteResourceRecord({
-            resource: this.resource,
-            record,
-            recordId: id,
-            adminUser,
-            extra,
-        });
+        return await this.repository.deleteByIdAndUser(id, adminUser, extra) ?? { error: 'MCP auth secret not found' };
     }
     async authenticate(secret) {
-        const record = await this.adminforth.resource(this.options.resourceId).get(Filters.EQ(this.options.secretHashField, hashSecret(secret)));
-        return record ? this.toAuthenticated(record) : null;
+        const authSecret = await this.repository.findBySecretHash(hashSecret(secret));
+        return authSecret ? this.toAuthenticated(authSecret) : null;
     }
     /**
      * Stores the connection an MCP client got through OAuth as an auth secret record, so it is listed and revoked
      * like personal secrets. The record id is the authorization code id, which makes every code redeemable once.
      */
     async createOAuthGrant(grant, refreshToken) {
-        const fields = this.options;
-        const resource = this.adminforth.resource(fields.resourceId);
-        if (await resource.get(Filters.EQ(fields.idField, grant.id))) {
+        if (await this.repository.findById(grant.id)) {
             return { error: 'Authorization code was already used' };
         }
         const adminUser = await this.loadAdminUser(grant.userId);
         if (!adminUser)
             return { error: 'User of the authorization code no longer exists' };
-        const result = await this.adminforth.createResourceRecord({
-            resource: this.resource,
-            adminUser,
-            extra: {},
-            record: {
-                [fields.idField]: grant.id,
-                [fields.nameField]: grant.clientName,
-                [fields.secretHashField]: hashSecret(refreshToken),
-                [fields.userIdField]: grant.userId,
-                [fields.createdAtField]: new Date().toISOString(),
-                [fields.lastUsedAtField]: null,
-                [fields.lastUsedByAgentField]: null,
-                [fields.readOnlyField]: grant.readOnly,
-                [this.oauthClientIdField]: grant.clientId,
-            },
-        });
+        const result = await this.repository.create({
+            id: grant.id,
+            name: grant.clientName,
+            secretHash: hashSecret(refreshToken),
+            userId: grant.userId,
+            readOnly: grant.readOnly,
+            oauthClientId: grant.clientId,
+        }, adminUser, {});
         return result.error ? { error: result.error } : {};
     }
     /**
@@ -125,30 +66,23 @@ export class McpAuthSecretStore {
      * from both passing, within this process.
      */
     async rotateRefreshToken(grantId, refreshToken, clientId, newRefreshToken) {
-        const fields = this.options;
-        const resource = this.adminforth.resource(fields.resourceId);
         return this.refreshLock.run(grantId, async () => {
-            const record = await resource.get(Filters.AND(Filters.EQ(fields.idField, grantId), Filters.EQ(this.oauthClientIdField, clientId)));
-            if (!record)
+            const grant = await this.repository.findById(grantId);
+            if (grant?.oauthClientId !== clientId)
                 return null;
-            if (record[fields.secretHashField] !== hashSecret(refreshToken)) {
+            if (grant.secretHash !== hashSecret(refreshToken)) {
                 logger.warn(`AdminForthMcpPlugin: a rotated refresh token of OAuth grant ${grantId} was used again, revoking the grant`);
-                await resource.delete(grantId);
+                await this.repository.deleteById(grantId);
                 return null;
             }
-            await resource.update(grantId, { [fields.secretHashField]: hashSecret(newRefreshToken) });
-            return record[fields.userIdField];
+            await this.repository.updateSecretHash(grantId, hashSecret(newRefreshToken));
+            return grant.userId;
         });
     }
     /** Access tokens are checked against their grant on every request, so revoking the grant applies at once. */
     async authenticateOAuthGrant(grantId, userId) {
-        const fields = this.options;
-        const record = await this.adminforth.resource(fields.resourceId).get(Filters.AND(Filters.EQ(fields.idField, grantId), Filters.EQ(fields.userIdField, userId)));
-        return record?.[this.oauthClientIdField] ? this.toAuthenticated(record) : null;
-    }
-    /** The OAuth grant methods are called only when OAuth is enabled, which requires this field. */
-    get oauthClientIdField() {
-        return this.options.oauthClientIdField;
+        const grant = await this.repository.findById(grantId);
+        return grant?.userId === userId && grant.oauthClientId ? this.toAuthenticated(grant) : null;
     }
     async loadAdminUser(pk) {
         const auth = this.adminforth.config.auth;
@@ -157,28 +91,21 @@ export class McpAuthSecretStore {
         const dbUser = await this.adminforth.resource(usersResource.resourceId).get(Filters.EQ(userPrimaryKeyField, pk));
         return dbUser ? { pk, username: dbUser[auth.usernameField], dbUser } : null;
     }
-    async toAuthenticated(record) {
-        const fields = this.options;
-        const adminUser = await this.loadAdminUser(record[fields.userIdField]);
+    async toAuthenticated(authSecret) {
+        const adminUser = await this.loadAdminUser(authSecret.userId);
         if (!adminUser)
             return null;
         return {
             adminUser,
-            client: parseStoredClient(record[fields.lastUsedByAgentField]),
-            name: record[fields.nameField],
-            readOnly: record[fields.readOnlyField],
-            recordId: record[fields.idField],
+            client: authSecret.lastUsedByAgent,
+            name: authSecret.name,
+            readOnly: authSecret.readOnly,
+            recordId: authSecret.id,
         };
     }
     touch(recordId, client) {
-        const fields = this.options;
-        const updates = {
-            [fields.lastUsedAtField]: new Date().toISOString(),
-        };
-        if (client.client !== UNKNOWN_CLIENT) {
-            updates[fields.lastUsedByAgentField] = JSON.stringify(client);
-        }
-        void this.adminforth.resource(fields.resourceId).update(recordId, updates).catch((error) => {
+        const knownClient = client.client === UNKNOWN_CLIENT ? undefined : client;
+        void this.repository.updateUsage(recordId, knownClient).catch((error) => {
             logger.error(`AdminForthMcpPlugin: failed to update MCP auth secret usage: ${String(error)}`);
         });
     }

package/dist/clientInfo.js

@@ -35,7 +35,7 @@ export function readMcpClient(body, headers) {
     if (client) {
         return { client, ver: normalizeClientVersion(clientInfo.version) };
     }
-    return parseUserAgent(String(headers['user-agent'] ?? '')) ?? {
+    return parseUserAgent(headers['user-agent'] ?? '') ?? {
         client: UNKNOWN_CLIENT,
         ver: null,
     };

package/dist/custom/McpSettings.vue

@@ -68,8 +68,7 @@
       :header="$t('Connect an AI agent')"
       :buttons="dialogButtons"
     >
-      <!-- mounted once the list is loaded: ButtonGroup reads its buttons only on mount -->
-      <ButtonGroup v-if="oauthEnabled" v-model="activeClient">
+      <ButtonGroup v-model="activeClient">
         <template v-for="client in CLIENTS" :key="client" #[`button:${client}`]>
           <span class="px-4 py-2">{{ client }}</span>
         </template>
@@ -148,10 +147,7 @@ const { t } = useI18n();
 const coreStore = useCoreStore();
 const brandName = computed<string>(() => coreStore.config?.brandName);
 const activeClient = ref<Client>('Claude Code');
-// Without OAuth sign-in the agents connect only with auth secrets, so the dialog is the Other tab alone.
-const oauthEnabled = ref(false);
-// Built by the plugin from adminPanelOrigin: OAuth accepts tokens only for this exact URL. Without adminPanelOrigin
-// there is no OAuth and auth secrets do not check the URL, so the address this page was opened at is shown.
+// Built by the plugin from adminPanelOrigin: OAuth accepts tokens only for this exact URL.
 const mcpUrl = ref('');
 
 const authSecrets = ref<AuthSecret[]>([]);
@@ -208,10 +204,6 @@ const dialogButtons = computed(() => {
 
 const createdSecretReadOnly = computed(() => serverReadOnly.value || secretReadOnly.value);
 
-function fallbackMcpUrl() {
-  const baseUrl = (import.meta.env.VITE_ADMINFORTH_PUBLIC_PATH || '').replace(/\/$/, '');
-  return `${window.location.origin}${baseUrl}/adminapi/v1/mcp`;
-}
 // Name the MCP server is registered under in the agent, e.g. `claude mcp add ... my-admin <url>`.
 // A brand name of non-Latin letters only leaves an empty slug, hence the default.
 const serverName = computed(() => brandName.value
@@ -261,9 +253,7 @@ async function loadAuthSecrets() {
     const response = await callAdminForthApi({ method: 'GET', path: '/mcp/auth-secrets' });
     if (response) {
       authSecrets.value = response.authSecrets;
-      if (!response.oauthEnabled) activeClient.value = 'Other';
-      oauthEnabled.value = response.oauthEnabled;
-      mcpUrl.value = response.mcpUrl ?? fallbackMcpUrl();
+      mcpUrl.value = response.mcpUrl;
       serverReadOnly.value = response.serverReadOnly;
     }
   } finally {

package/dist/endpoints/mcp.d.ts

@@ -0,0 +1,2 @@
+import type { IAdminForthEndpointHandlerInput, IHttpServer } from 'adminforth';
+export declare function registerMcpEndpoints(server: IHttpServer, handleMcpRequest: (input: IAdminForthEndpointHandlerInput) => Promise<unknown>): void;

package/dist/endpoints/mcp.js

@@ -0,0 +1,24 @@
+import { MCP_PATH } from '../urls.js';
+export function registerMcpEndpoints(server, handleMcpRequest) {
+    server.endpoint({
+        method: 'POST',
+        path: MCP_PATH,
+        agent: {
+            hiddenFromAgents: true,
+        },
+        noAuth: true,
+        handler: handleMcpRequest,
+    });
+    server.endpoint({
+        method: 'GET',
+        path: MCP_PATH,
+        agent: {
+            hiddenFromAgents: true,
+        },
+        noAuth: true,
+        handler: async ({ response }) => {
+            response.setHeader('Allow', 'POST');
+            response.setStatus(405, 'Method Not Allowed');
+        },
+    });
+}

package/dist/endpoints/oAuth.d.ts

@@ -0,0 +1,3 @@
+import { type IHttpServer } from 'adminforth';
+import type { McpOAuth } from '../oauth/authorizationServer.js';
+export declare function registerOAuthEndpoints(server: IHttpServer, oauth: McpOAuth, apiPrefix: string): void;

package/dist/{oauthEndpoints.js → endpoints/oAuth.js}

@@ -1,31 +1,12 @@
 import { logger } from 'adminforth';
-import { OAUTH_PATHS } from './oauth.js';
-import { OAuthError } from './oauthError.js';
-import { MCP_PATH } from './urls.js';
-const MAX_FORM_BODY_BYTES = 16 * 1024;
-/**
- * RFC 6749 token requests are application/x-www-form-urlencoded. The host app may already have parsed the body
- * with its own urlencoded middleware; otherwise the stream is still unread.
- */
-async function readFormBody(req) {
-    if (req.body && typeof req.body === 'object' && Object.keys(req.body).length) {
-        return req.body;
-    }
-    const chunks = [];
-    let size = 0;
-    for await (const chunk of req) {
-        size += chunk.length;
-        if (size > MAX_FORM_BODY_BYTES) {
-            throw new OAuthError('invalid_request', `Request body is larger than ${MAX_FORM_BODY_BYTES} bytes`);
-        }
-        chunks.push(chunk);
-    }
-    return Object.fromEntries(new URLSearchParams(Buffer.concat(chunks).toString('utf8')));
-}
+import express from 'express';
+import { OAuthError } from '../oauth/errors.js';
+import { resolveAuthorizationBodySchema } from '../schemas/oAuth.js';
+import { MCP_PATH, OAUTH_PATHS } from '../urls.js';
+const FORM_BODY_LIMIT = '16kb';
 async function oauthResponse(input, handler) {
     try {
         const result = await handler();
-        // A handler that answered through the raw response returns null; headers can no longer be set then.
         if (result !== null)
             input.response.setHeader('Cache-Control', 'no-store');
         return result;
@@ -38,7 +19,7 @@ async function oauthResponse(input, handler) {
         return error.toResponseObject();
     }
 }
-export function setupOAuthEndpoints(server, oauth, apiPrefix) {
+export function registerOAuthEndpoints(server, oauth, apiPrefix) {
     server.endpoint({
         method: 'GET',
         path: OAUTH_PATHS.protectedResourceMetadata,
@@ -93,15 +74,15 @@ export function setupOAuthEndpoints(server, oauth, apiPrefix) {
         agent: {
             hiddenFromAgents: true,
         },
-        handler: async (input) => oauthResponse(input, async () => ({
-            redirectUrl: await oauth.resolveAuthorization(String(input.body.request), input.body.approved === true, input.adminUser, input.body.readOnly === true),
-        })),
+        request_schema: resolveAuthorizationBodySchema,
+        handler: async (input) => {
+            const body = input.body;
+            return oauthResponse(input, async () => ({
+                redirectUrl: await oauth.resolveAuthorization(body.request, body.approved, input.adminUser, body.readOnly),
+            }));
+        },
     });
     const { expressApp } = server;
-    // MCP clients try the host-root well-known URLs first and stop at the first 200 response. The AdminForth SPA
-    // answers every unknown path with 200 HTML, so unless these are served the client fails before it reaches
-    // `<issuer>/.well-known/openid-configuration`. Behind a proxy that forwards only the AdminForth path they 404,
-    // and the client goes on to that URL.
     const mcpPath = `${apiPrefix}${MCP_PATH}`;
     expressApp.get(`/.well-known/oauth-protected-resource${mcpPath}`, async (_req, res) => {
         res.json(oauth.protectedResourceMetadata());
@@ -109,10 +90,10 @@ export function setupOAuthEndpoints(server, oauth, apiPrefix) {
     expressApp.get(`/.well-known/oauth-authorization-server${mcpPath}`, async (_req, res) => {
         res.json(oauth.authorizationServerMetadata());
     });
-    expressApp.post(`${apiPrefix}${OAUTH_PATHS.token}`, async (req, res) => {
+    expressApp.post(`${apiPrefix}${OAUTH_PATHS.token}`, express.urlencoded({ extended: false, limit: FORM_BODY_LIMIT }), async (req, res) => {
         res.set('Cache-Control', 'no-store');
         try {
-            res.json(await oauth.exchangeToken(await readFormBody(req)));
+            res.json(await oauth.exchangeToken(req.body ?? {}));
         }
         catch (error) {
             if (error instanceof OAuthError) {

package/dist/endpoints/settings.d.ts

@@ -0,0 +1,3 @@
+import type { IHttpServer } from 'adminforth';
+import type { McpAuthSecretStore } from '../authSecretStore.js';
+export declare function registerSettingsEndpoints(server: IHttpServer, authSecretStore: McpAuthSecretStore, mcpUrl: string, serverReadOnly: boolean): void;

package/dist/endpoints/settings.js

@@ -0,0 +1,44 @@
+import { requestExtra } from '../requestExtra.js';
+import { createAuthSecretBodySchema, revokeAuthSecretBodySchema, } from '../schemas/settings.js';
+import { MCP_PATH } from '../urls.js';
+export function registerSettingsEndpoints(server, authSecretStore, mcpUrl, serverReadOnly) {
+    server.endpoint({
+        method: 'GET',
+        path: `${MCP_PATH}/auth-secrets`,
+        agent: {
+            hiddenFromAgents: true,
+        },
+        handler: async ({ adminUser }) => ({
+            authSecrets: await authSecretStore.list(adminUser),
+            mcpUrl,
+            serverReadOnly,
+        }),
+    });
+    server.endpoint({
+        method: 'POST',
+        path: `${MCP_PATH}/auth-secrets`,
+        agent: {
+            hiddenFromAgents: true,
+        },
+        request_schema: createAuthSecretBodySchema,
+        handler: async (input) => {
+            const body = input.body;
+            return authSecretStore.create(body.name, serverReadOnly || body.readOnly, input.adminUser, requestExtra(input));
+        },
+    });
+    server.endpoint({
+        method: 'DELETE',
+        path: `${MCP_PATH}/auth-secrets`,
+        agent: {
+            hiddenFromAgents: true,
+        },
+        request_schema: revokeAuthSecretBodySchema,
+        handler: async (input) => {
+            const body = input.body;
+            const result = await authSecretStore.revoke(body.id, input.adminUser, requestExtra(input));
+            if (result.error)
+                input.response.setStatus(404);
+            return result;
+        },
+    });
+}