@aotter/mantle 0.2.0-alpha.6 → 0.2.0-alpha.8

package/dist/auth/oauth.d.ts

@@ -0,0 +1,63 @@
+import type { oauthProvider } from "@better-auth/oauth-provider";
+import type { AuthInstance } from "./caller.js";
+/**
+ * Fail closed for unbound tokens; reconsent cannot resurrect an issued JWT. As in Better Auth, an `offline_access` grant outlives
+ * the browser session: without a live session it stands on an unrevoked, unexpired offline refresh token for the same user and client.
+ */
+export declare function assertActiveUserGrant(auth: AuthInstance, claims: Record<string, unknown>, audience: string | readonly string[]): Promise<{
+    id: string;
+}>;
+/** Add first to oauthProvider/mcp extensions; Better Auth retains ownership of referenceId. */
+export declare const oauthGrantExtension: NonNullable<Parameters<typeof oauthProvider>[0]["extensions"]>[number];
+export declare const OAUTH_GRANT_REVOCATION = "mantle-oauth-grant-revocation";
+/**
+ * Add to the Better Auth plugins with the OAuth provider. An `offline_access` grant outlives sign-out and session expiry
+ * (as in Better Auth), but a successful password reset, a password change that signs out other devices, an admin ban
+ * (`/admin/ban-user`, or `/admin/update-user` setting `banned: true`), an admin session revocation or an admin password
+ * change ends every OAuth grant of that user: tokens, consents and unredeemed codes. So does an email OTP or magic-link
+ * sign-in attempt on an unverified user: Better Auth strips what was set up before that proof, possibly by someone else
+ * who registered the address first, and Mantle ends that party's grants before the attempt is checked.
+ */
+export declare function oauthGrantRevocation(): {
+    id: "mantle-oauth-grant-revocation";
+    hooks: {
+        before: ({
+            matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
+            handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                context: {
+                    mantleResetPasswordUser: string;
+                };
+            } | undefined>>;
+        } | {
+            matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
+            handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
+        })[];
+        after: {
+            matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
+            handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
+        }[];
+    };
+};
+export interface OAuthConsentRequest {
+    readonly clientName: string;
+    readonly redirectUri: string;
+    readonly scopes: readonly string[];
+    readonly oauthQuery: string;
+}
+export interface OAuthConsentInfo {
+    readonly id: string;
+    readonly clientId: string;
+    readonly clientName: string;
+    readonly scopes: readonly string[];
+}
+/** Signed-query and consent APIs over the same application-owned instance and adapter (including renamed tables). */
+export declare function oauthConsents(auth: AuthInstance & {
+    handler(request: Request): Promise<Response>;
+}): {
+    getOAuthConsentRequest: (request: Request) => Promise<OAuthConsentRequest | null>;
+    completeOAuthConsent: (request: Request, accept: boolean) => Promise<string>;
+    listOAuthConsents: (userId: string) => Promise<OAuthConsentInfo[]>;
+    revokeOAuthConsent: (userId: string, consentId: string) => Promise<boolean>;
+};
+/** Optional scheduled storage hygiene, not boot work or an authorization rule. Owned/CIMD clients survive. */
+export declare function pruneLegacyOAuthClients(auth: AuthInstance): Promise<number>;

package/dist/auth/oauth.js

@@ -0,0 +1,217 @@
+import { createAuthMiddleware } from "@better-auth/core/api";
+import { nativeAuthRead } from "./adapter.js";
+import { ContractError } from "../kernel/contracts.js";
+const pair = (field, value) => ({ field, value });
+const array = (value) => {
+    try {
+        const parsed = typeof value === "string" ? JSON.parse(value) : value;
+        return Array.isArray(parsed) && parsed.every(x => typeof x === "string") ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+};
+/**
+ * Fail closed for unbound tokens; reconsent cannot resurrect an issued JWT. As in Better Auth, an `offline_access` grant outlives
+ * the browser session: without a live session it stands on an unrevoked, unexpired offline refresh token for the same user and client.
+ */
+export async function assertActiveUserGrant(auth, claims, audience) {
+    const { sub, azp, sid, mantle_consent_id: id, mantle_consent_reference: reference, mantle_skip_consent: skip } = claims;
+    const tokenScopes = typeof claims.scope === "string" ? claims.scope.split(/\s+/).filter(Boolean) : array(claims.scope);
+    const offline = !!tokenScopes?.includes("offline_access");
+    if (![sub, azp].every(x => typeof x === "string" && x.length) || !(offline && sid == null || typeof sid === "string" && sid.length) || !(skip === true && id === null || typeof id === "string" && id.length))
+        throw new ContractError("UNAUTHENTICATED", "OAuth token is not bound to a user session.");
+    const { exec, param, now, table, column } = nativeAuthRead(auth.options);
+    const at = now(Date.now());
+    const c = (field) => `c.${column("oauthConsent", field)}`, s = (field) => `s.${column("session", field)}`, client = (field) => `client.${column("oauthClient", field)}`, r = (field) => column("oauthRefreshToken", field);
+    const { rows } = await exec(`SELECT ${s("id")} AS session, ${c("id")} AS "consentId", ${c("referenceId")} AS reference, ${c("resources")} AS resources, ${c("scopes")} AS scopes,
+      ${client("skipConsent")} AS "skipConsent", ${client("disabled")} AS disabled, ${client("scopes")} AS "clientScopes"
+    FROM ${table("oauthClient")} client LEFT JOIN ${table("session")} s ON ${s("id")} = ${param(1)} AND ${s("userId")} = ${param(2)} AND ${s("expiresAt")} > ${param(3)}
+    LEFT JOIN ${table("oauthConsent")} c ON ${c("id")} = ${param(4)} AND ${c("userId")} = ${param(2)} AND ${c("clientId")} = ${client("clientId")}
+    WHERE ${client("clientId")} = ${param(5)}`, [sid ?? null, sub, at, id, azp]);
+    const grant = rows[0];
+    const live = !!grant?.session || offline && !!grant && (await exec(`SELECT ${r("scopes")} AS scopes FROM ${table("oauthRefreshToken")}
+    WHERE ${r("userId")} = ${param(1)} AND ${r("clientId")} = ${param(2)} AND ${r("revoked")} IS NULL AND ${r("expiresAt")} > ${param(3)}`, [sub, azp, at])).rows.some(row => array(row.scopes)?.includes("offline_access"));
+    const provider = auth.options.plugins?.find(plugin => plugin.id === "oauth-provider");
+    const firstParty = skip === true && id === null && !!grant?.skipConsent;
+    const resources = firstParty ? (typeof claims.aud === "string" ? [claims.aud] : array(claims.aud)) : array(grant?.resources);
+    const scopes = firstParty ? array(grant?.clientScopes) ?? provider?.options?.scopes : array(grant?.scopes);
+    const requested = typeof audience === "string" ? [audience] : audience;
+    const tokenAudiences = typeof claims.aud === "string" ? [claims.aud] : array(claims.aud) ?? [];
+    if (!grant || !live || grant.disabled || !firstParty && (!grant.consentId || (grant.reference ?? null) !== reference) || !resources || !scopes || !tokenScopes || !requested.some(x => resources.includes(x) && tokenAudiences.includes(x)) || !tokenScopes.every(x => scopes.includes(x)))
+        throw new ContractError("UNAUTHENTICATED", "OAuth authorization grant is no longer active.");
+    return { id: sub };
+}
+/** Add first to oauthProvider/mcp extensions; Better Auth retains ownership of referenceId. */
+export const oauthGrantExtension = {
+    claims: { accessToken: async ({ ctx, user, client, referenceId, grantType, scopes, sessionId }) => {
+            // Narrowing away offline_access on refresh would mint a session-bound token for a session that has already ended.
+            if (grantType === "refresh_token" && !scopes.includes("offline_access")) {
+                const session = sessionId ? await ctx.context.adapter.findOne({ model: "session", where: [pair("id", sessionId)] }) : null;
+                if (!session || new Date(session.expiresAt).getTime() <= Date.now())
+                    throw ctx.error("BAD_REQUEST", { error: "invalid_grant", error_description: "The browser session for this grant has ended; keep offline_access or sign in again." });
+            }
+            if (client.skipConsent)
+                return { mantle_consent_id: null, mantle_skip_consent: true };
+            const consent = user && await ctx.context.adapter.findOne({ model: "oauthConsent", where: [pair("userId", user.id), pair("clientId", client.clientId), { field: "referenceId", value: referenceId ?? null }] });
+            return { mantle_consent_id: consent?.id ?? null, mantle_consent_reference: referenceId ?? null };
+        } },
+};
+export const OAUTH_GRANT_REVOCATION = "mantle-oauth-grant-revocation";
+/** Password resets (all channels) and an admin password change: the old credential may be compromised, so every session ends too. */
+const RESETS = ["/reset-password", "/email-otp/reset-password", "/phone-number/reset-password", "/admin/set-user-password"];
+const ENDING = [...RESETS, "/change-password", "/admin/ban-user", "/admin/update-user", "/admin/revoke-user-sessions"];
+const RESET_USER = "mantleResetPasswordUser";
+/** Better Auth's email-proof sign-ins: on an unverified user they delete its accounts and sessions (revokeUnprovenAccountAccess). */
+const PROVING = ["/sign-in/email-otp", "/magic-link/verify"];
+/**
+ * Add to the Better Auth plugins with the OAuth provider. An `offline_access` grant outlives sign-out and session expiry
+ * (as in Better Auth), but a successful password reset, a password change that signs out other devices, an admin ban
+ * (`/admin/ban-user`, or `/admin/update-user` setting `banned: true`), an admin session revocation or an admin password
+ * change ends every OAuth grant of that user: tokens, consents and unredeemed codes. So does an email OTP or magic-link
+ * sign-in attempt on an unverified user: Better Auth strips what was set up before that proof, possibly by someone else
+ * who registered the address first, and Mantle ends that party's grants before the attempt is checked.
+ */
+export function oauthGrantRevocation() {
+    return {
+        id: OAUTH_GRANT_REVOCATION,
+        hooks: {
+            // Better Auth consumes the reset token, so its user rides this request's own context to the after hook.
+            before: [{ matcher: ctx => ctx.path === "/reset-password", handler: createAuthMiddleware(async (ctx) => {
+                        // Better Auth reads the token from the body or the query, in that order.
+                        const token = ctx.body?.token || ctx.query?.token;
+                        const value = typeof token === "string" && token ? await ctx.context.internalAdapter.findVerificationValue(`reset-password:${token}`) : null;
+                        if (value)
+                            return { context: { [RESET_USER]: value.value } };
+                    }) }, { matcher: ctx => PROVING.includes(ctx.path ?? ""), handler: createAuthMiddleware(async (ctx) => {
+                        // Before the endpoint, while the user is still unverified and the magic-link token is unconsumed: once Better Auth
+                        // marks the address verified, no later request would tell the pre-registrant's grants apart. A failure here fails
+                        // the request before verification, so a retry ends them. A failed attempt ends them too: an unverified user's grants
+                        // are exactly the pre-hijack risk.
+                        const email = ctx.path === "/sign-in/email-otp" ? ctx.body?.email : await magicLinkEmail(ctx.context, ctx.query?.token);
+                        const found = typeof email === "string" && email ? await ctx.context.internalAdapter.findUserByEmail(email.toLowerCase()) : null;
+                        if (found && !found.user.emailVerified)
+                            await endGrants(ctx.context.adapter, found.user.id);
+                    }) }],
+            // After the endpoint: its own validation and permission checks have passed and it succeeded.
+            after: [{ matcher: ctx => ENDING.includes(ctx.path ?? ""), handler: createAuthMiddleware(async (ctx) => {
+                        const returned = ctx.context.returned, path = ctx.path ?? "";
+                        if (returned instanceof Error || returned instanceof Response && !returned.ok)
+                            return;
+                        const body = ctx.body;
+                        const userId = path === "/reset-password" ? ctx[RESET_USER]
+                            : path === "/email-otp/reset-password" ? typeof body?.email === "string" && (await ctx.context.internalAdapter.findUserByEmail(body.email.toLowerCase()))?.user.id
+                                : path === "/phone-number/reset-password" ? typeof body?.phoneNumber === "string" && (await ctx.context.adapter.findOne({ model: "user", where: [pair("phoneNumber", body.phoneNumber)] }))?.id
+                                    // Better Auth itself ends the other sessions and keeps the current one.
+                                    : path === "/change-password" ? body?.revokeOtherSessions === true && (ctx.context.session?.user.id ?? returned?.user?.id)
+                                        : path === "/admin/update-user" ? body?.data?.banned === true && body.userId
+                                            : body?.userId;
+                        if (typeof userId !== "string" || !userId)
+                            return;
+                        // Sessions first: a live session (perhaps the attacker's) could otherwise authorize a new grant after endGrants.
+                        if (RESETS.includes(path))
+                            await ctx.context.internalAdapter.deleteUserSessions(userId);
+                        await endGrants(ctx.context.adapter, userId);
+                    }) }],
+        },
+    };
+}
+/** The email a magic-link token names, read without consuming it; the token is stored as the magic-link plugin's `storeToken` says. */
+async function magicLinkEmail(context, token) {
+    if (typeof token !== "string" || !token)
+        return;
+    const store = context.options.plugins?.find(plugin => plugin.id === "magic-link")?.options?.storeToken ?? "plain";
+    const hash = typeof store === "object" && store && "hash" in store && typeof store.hash === "function" ? store.hash : undefined;
+    const stored = store === "plain" ? token : hash ? await hash(token)
+        : store === "hashed" ? btoa(String.fromCharCode(...new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(token))))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "") : undefined;
+    const value = stored === undefined ? null : await context.internalAdapter.findVerificationValue(`magic-link:${stored}`);
+    try {
+        return value ? JSON.parse(value.value).email : undefined;
+    }
+    catch {
+        return;
+    }
+}
+/** Ends a user's grants (for one client, or all): consents, tokens and unredeemed authorization codes. */
+async function endGrants(db, userId, clientId) {
+    const where = [pair("userId", userId), ...clientId ? [pair("clientId", clientId)] : []];
+    // Delete first: even if cleanup fails, every issued JWT fails the live-grant check immediately.
+    await db.deleteMany({ model: "oauthConsent", where });
+    for (const model of ["oauthRefreshToken", "oauthAccessToken"])
+        await db.updateMany({ model, where: [...where, { field: "revoked", value: null }], update: { revoked: new Date() } });
+    // An unredeemed code would mint a new token lineage after reconsent.
+    const code = (v) => { const x = authCode(v); return x?.userId === userId && (!clientId || x.query.client_id === clientId); };
+    const codes = [userId, clientId].filter(x => x !== undefined).map(x => ({ field: "value", operator: "contains", value: JSON.stringify(x) }));
+    for (let offset = 0;;) {
+        const page = await db.findMany({ model: "verification", where: codes, limit: 100, offset, sortBy: { field: "id", direction: "asc" } });
+        const ids = page.filter(v => code(v.value)).map(v => v.id);
+        if (ids.length)
+            await db.deleteMany({ model: "verification", where: [{ field: "id", operator: "in", value: ids }] });
+        if (page.length < 100)
+            break;
+        offset += page.length - ids.length;
+    }
+}
+/** A verification value that is an authorization code, with its user and client; else undefined. */
+function authCode(text) {
+    let value;
+    try {
+        value = JSON.parse(text);
+    }
+    catch {
+        return;
+    }
+    return value?.type === "authorization_code" && typeof value.userId === "string" && typeof value.query?.client_id === "string" ? value : undefined;
+}
+/** Signed-query and consent APIs over the same application-owned instance and adapter (including renamed tables). */
+export function oauthConsents(auth) {
+    const adapter = async () => (await auth.$context).adapter;
+    return {
+        getOAuthConsentRequest: async (request) => {
+            const url = new URL(request.url), clientId = url.searchParams.get("client_id");
+            if (!clientId || !url.search)
+                return null;
+            const api = auth.api;
+            const oauthQuery = url.search.slice(1);
+            const client = await api.getOAuthClientPublicPrelogin({ headers: request.headers, body: { client_id: clientId, oauth_query: oauthQuery } });
+            return { clientName: client.client_name ?? clientId, redirectUri: url.searchParams.get("redirect_uri") ?? client.redirect_uris?.[0] ?? "", scopes: (url.searchParams.get("scope") ?? "").split(/\s+/).filter(Boolean), oauthQuery };
+        },
+        completeOAuthConsent: async (request, accept) => {
+            const oauth_query = (await request.formData()).get("oauth_query");
+            if (typeof oauth_query !== "string" || !oauth_query)
+                throw new ContractError("INPUT_VALIDATION_FAILED", "Missing signed authorization request.");
+            const headers = new Headers(request.headers);
+            headers.set("content-type", "application/json");
+            headers.delete("content-length");
+            const response = await auth.handler(new Request(new URL(`${auth.options.basePath ?? "/api/auth"}/oauth2/consent`, request.url).href, { method: "POST", headers, body: JSON.stringify({ accept, oauth_query }) }));
+            const body = await response.json();
+            if (!response.ok || typeof body.url !== "string")
+                throw new ContractError("INPUT_VALIDATION_FAILED", "Invalid authorization request.");
+            return body.url;
+        },
+        listOAuthConsents: async (userId) => {
+            const { exec, param, table, column } = nativeAuthRead(auth.options);
+            const c = (field) => `c.${column("oauthConsent", field)}`, client = (field) => `client.${column("oauthClient", field)}`;
+            const { rows } = await exec(`SELECT ${c("id")} AS id, ${c("clientId")} AS "clientId", COALESCE(${client("name")}, ${c("clientId")}) AS "clientName", ${c("scopes")} AS scopes
+        FROM ${table("oauthConsent")} c LEFT JOIN ${table("oauthClient")} client ON ${client("clientId")} = ${c("clientId")}
+        WHERE ${c("userId")} = ${param(1)} ORDER BY ${c("updatedAt")} DESC, ${c("id")} ASC`, [userId]);
+            return rows.map(row => ({ id: row.id, clientId: row.clientId, clientName: row.clientName, scopes: array(row.scopes) ?? [] }));
+        },
+        revokeOAuthConsent: async (userId, consentId) => {
+            const db = await adapter();
+            const consent = await db.findOne({ model: "oauthConsent", where: [pair("id", consentId), pair("userId", userId)] });
+            if (!consent)
+                return false;
+            await endGrants(db, userId, consent.clientId);
+            return true;
+        },
+    };
+}
+/** Optional scheduled storage hygiene, not boot work or an authorization rule. Owned/CIMD clients survive. */
+export async function pruneLegacyOAuthClients(auth) {
+    const { adapter } = await auth.$context;
+    return adapter.deleteMany({ model: "oauthClient", where: [
+            { field: "clientDiscoveryId", value: null }, { field: "userId", value: null }, { field: "referenceId", value: null },
+            { field: "createdAt", operator: "lt", value: new Date(Date.now() - 90 * 86400_000) },
+        ] });
+}

package/dist/auth/resource-seeds.js

@@ -0,0 +1,10 @@
+/** Keep runtime inputs while disabling the provider's eager and bulk lazy seeding. No schema or database work. */
+// OAuth provider 1.7.7 shares plugin.options with its eager/lazy seed closures; its seedResources/checkIdentifier helpers are not exported.
+const seeds = new WeakMap();
+export function resourceSeeds(options) {
+    const inputs = (seeds.get(options) ?? options.resources ?? []);
+    if (!seeds.has(options))
+        seeds.set(options, [...inputs]);
+    options.resources = [];
+    return inputs;
+}

package/dist/auth/routes.d.ts

@@ -0,0 +1,32 @@
+/** Optional app-mounted auth routes; consent and raw admin routes resolve fresh authority. Better Auth owns tokens. */
+import { type Caller } from "../kernel/contracts.js";
+import { type AuthInstance, type AuthLoader } from "./caller.js";
+export interface AuthRoutesOptions {
+    /** Same basePath as app-owned betterAuth options. */
+    readonly basePath?: string;
+    readonly resolver?: (request: Request) => Caller | Promise<Caller>;
+    readonly methods: readonly ({
+        readonly kind: "social";
+        readonly provider: string;
+    } | {
+        readonly kind: "oauth";
+        readonly providerId: string;
+        readonly displayName?: string;
+    } | {
+        readonly kind: "email-otp" | "magic-link";
+    })[];
+    readonly connectedAppsPage?: string;
+}
+/** The service's auth entry: a Response for a path it owns, `null` for any other. */
+export declare function authRoutes(loader: AuthLoader<AuthInstance & {
+    handler(request: Request): Promise<Response>;
+}>, options: AuthRoutesOptions): (request: Request) => Promise<Response | null>;
+/**
+ * A dynamic registration whose every redirect URI is http on a loopback host and that names no application_type is a
+ * native app (RFC 8252 7.3): local MCP clients register this way. Better Auth reads the missing type as `web`, which
+ * needs https on a non-loopback host, so it would refuse them all. Mark it native, as the client could itself; a
+ * registration naming a type, mixing hosts or using any other redirect is passed through unchanged.
+ */
+export declare function loopbackClientsAreNative(request: Request): Promise<Request>;
+/** Better Auth and host fetch implementations may merge several Set-Cookie values into one header. */
+export declare function normalizeAuthResponseCookies(response: Response): Promise<Response>;

package/dist/auth/routes.js

@@ -0,0 +1,225 @@
+/** Optional app-mounted auth routes; consent and raw admin routes resolve fresh authority. Better Auth owns tokens. */
+import { checkOrigin, surfaceFailure, ContractError } from "../kernel/contracts.js";
+import { draining } from "../kernel/drain.js";
+import { guardAuthAdminRequest } from "./admin.js";
+import { resolveCaller } from "./caller.js";
+const PRIVATE = { "cache-control": "private, no-store" };
+const CONSENT = new Set(["GET /oauth/consent", "GET /oauth/consent/data", "POST /oauth/consent", "GET /oauth/consents", "GET /oauth/consents/data", "POST /oauth/consents/revoke"]);
+const MAX_BODY = 1_048_576;
+const text = (body, status) => new Response(body, { status, headers: PRIVATE });
+const json = (body, status = 200) => Response.json(body, { status, headers: PRIVATE });
+const redirect = (location, status = 302) => new Response(null, { status, headers: { location, ...PRIVATE } });
+const tooLarge = () => new ContractError("INPUT_VALIDATION_FAILED", "Request body exceeds 1 MiB.");
+const basePathOf = (options) => (options.basePath ?? "/api/auth").replace(/\/+$/, "");
+const WELL_KNOWN = /^\/\.well-known\/(oauth-authorization-server|oauth-protected-resource)(\/|$)/;
+/** The service's auth entry: a Response for a path it owns, `null` for any other. */
+export function authRoutes(loader, options) {
+    const base = basePathOf(options);
+    if (options.connectedAppsPage && (!options.connectedAppsPage.startsWith("/") || options.connectedAppsPage.startsWith("//") || /[\\\r\n]/.test(options.connectedAppsPage)))
+        throw new Error("connectedAppsPage must be a same-origin absolute path.");
+    const resolve = options.resolver ?? ((request) => resolveCaller(request, loader));
+    return draining(async (request) => {
+        const { pathname } = new URL(request.url);
+        const route = `${request.method} ${pathname}`;
+        if (pathname === `${base}/methods` && request.method === "GET")
+            return json({ methods: options.methods });
+        if (pathname.startsWith(`${base}/`) || WELL_KNOWN.test(pathname)) {
+            const auth = await loader.get();
+            if (basePathOf(auth.options) !== base)
+                throw new Error("authRoutes basePath differs from betterAuth options.");
+            try {
+                await guardAuthAdminRequest(request, () => resolve(request), base);
+                const registration = request.method === "POST" && pathname === `${base}/oauth2/register` ? await loopbackClientsAreNative(request) : request;
+                return await normalizeAuthResponseCookies(await auth.handler(registration));
+            }
+            catch (error) {
+                return surfaceFailure(error, undefined, `auth ${route}`);
+            }
+        }
+        if (!CONSENT.has(route))
+            return null;
+        try {
+            const caller = await resolve(request);
+            checkOrigin(request, caller);
+            if (request.method === "POST" && Number(request.headers.get("content-length")) > MAX_BODY)
+                return text("request body too large", 413);
+            return await consentSurface((await import("./oauth.js")).oauthConsents(await loader.get()), options)(request, caller, route);
+        }
+        catch (error) {
+            return surfaceFailure(error, undefined, `auth ${route}`);
+        }
+    });
+}
+function consentSurface(auth, options) {
+    const { listOAuthConsents: list, revokeOAuthConsent: revoke } = auth;
+    return async (request, caller, route) => {
+        const person = caller.kind === "user" && caller.credential === "session" ? caller.subject : null;
+        const locale = /zh[-_]tw/i.test(request.headers.get("accept-language") ?? "") ? "zh-TW" : "en";
+        if (route === "GET /oauth/consent/data") {
+            if (!person)
+                return json({ consent: null }, 401);
+            const model = await auth.getOAuthConsentRequest(request).catch(() => null); // an invalid signed query stays secret-free
+            return json({ consent: model }, model ? 200 : 400);
+        }
+        if (route === "GET /oauth/consent") {
+            const model = await auth.getOAuthConsentRequest(request).catch(() => null);
+            return html(consentHtml(locale, model), model ? 200 : 400);
+        }
+        if (route === "POST /oauth/consent") {
+            if (!person)
+                return text("sign in to answer this request", 401);
+            const body = await readBody(request);
+            const decision = new URLSearchParams(body).get("decision");
+            if (decision !== "approve" && decision !== "deny")
+                return text("invalid consent decision", 400);
+            // the redirect is the one Better Auth validated against the client's registration; nothing in the request names it
+            const location = await auth.completeOAuthConsent(new Request(request, { body }), decision === "approve").catch(() => null);
+            const target = location && URL.canParse(location) ? new URL(location) : null;
+            if (!target || /^(javascript|data|vbscript|blob):$/i.test(target.protocol))
+                return text("invalid authorization request", 400);
+            // the parsed form, so a browser cannot read `https:\\evil.test` differently from the check
+            return redirect(target.href);
+        }
+        if (!list || !revoke)
+            return text("not found", 404);
+        if (route === "GET /oauth/consents") {
+            if (options.connectedAppsPage)
+                return redirect(options.connectedAppsPage);
+            if (!person)
+                return text("sign in to see your connected apps", 401);
+            return html(connectedAppsHtml(locale, await list(person)), 200);
+        }
+        if (route === "GET /oauth/consents/data") {
+            if (!person)
+                return json({ consents: [] }, 401);
+            return json({ consents: await list(person) });
+        }
+        if (route === "POST /oauth/consents/revoke") {
+            if (!person)
+                return text("sign in to revoke a connection", 401);
+            const body = await readBody(request);
+            const id = new URLSearchParams(body).get("consent_id");
+            if (!id)
+                return text("invalid consent id", 400);
+            if (!await revoke(person, id))
+                return text("consent not found", 404);
+            return redirect("/oauth/consents", 303);
+        }
+        return text("not found", 404);
+    };
+}
+// ---- the pages a service without Admin shows: Admin is an optional subpath (ADR-0032 decision 13), OAuth is not tied to it
+/**
+ * No `form-action`: browsers check it against every redirect of a form's navigation, so a callback that redirects again
+ * (www.cursor.com answers 308 to cursor.com) would hang the approval. The page runs no script and escapes every value.
+ */
+function html(body, status) {
+    return new Response(body, {
+        status,
+        headers: {
+            ...PRIVATE, "content-type": "text/html; charset=UTF-8", "referrer-policy": "same-origin", "x-content-type-options": "nosniff", "x-frame-options": "DENY",
+            "content-security-policy": "default-src 'none'; script-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'; base-uri 'none'",
+        },
+    });
+}
+const T = {
+    en: {
+        lang: "en", title: "Authorize", eyebrow: "Connect an MCP client", heading: (c) => `Connect ${c}?`,
+        body: (c) => `${c} will be able to use this site's tools through MCP. What it can view or change is still limited by your account permissions.`,
+        returnsTo: "Returns to", scopes: "Requested access", approve: "Connect", deny: "Cancel", invalid: "Invalid authorization request", invalidBody: "Missing or malformed consent payload. Return to your MCP client and try again.",
+        apps: "MCP connections", appsBody: "These MCP clients can use this site's tools. Every action is still checked against your current account permissions.", empty: "No MCP clients are connected.", revoke: "Disconnect",
+    },
+    "zh-TW": {
+        lang: "zh-Hant-TW", title: "授權", eyebrow: "連結 MCP 客戶端", heading: (c) => `要連結 ${c} 嗎？`,
+        body: (c) => `${c} 將能透過 MCP 使用這個網站提供的工具；它能查看或變更哪些內容，仍會依照你的帳號權限決定。`,
+        returnsTo: "完成後返回", scopes: "要求的權限", approve: "連結", deny: "取消", invalid: "無效的授權請求", invalidBody: "缺少或格式錯誤的授權資訊，請返回 MCP 客戶端重試。",
+        apps: "MCP 連線", appsBody: "這些 MCP 客戶端可以使用網站提供的工具；每次操作仍會依照你當下的帳號權限檢查。", empty: "目前沒有已連結的 MCP 客戶端。", revoke: "中斷連線",
+    },
+};
+const esc = (s) => s.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
+const page = (l, title, main) => `<!doctype html><html lang="${T[l].lang}"><head><meta charset="utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><title>${title}</title>` +
+    `<style>:root{color-scheme:light dark;font:1rem/1.5 system-ui,sans-serif}body{margin:0;padding:2rem 1rem}main{max-width:32rem;margin:10vh auto}code{overflow-wrap:anywhere}button{font:inherit;padding:.5rem 1rem;cursor:pointer}</style></head><body><main>${main}</main></body></html>`;
+function consentHtml(l, model) {
+    const t = T[l];
+    if (!model)
+        return page(l, t.title, `<p>${t.eyebrow}</p><h1>${t.invalid}</h1><p>${t.invalidBody}</p>`);
+    const client = esc(model.clientName);
+    // where the answer goes and what is asked, so a look-alike client name cannot hide either
+    const host = URL.canParse(model.redirectUri) ? new URL(model.redirectUri).host || new URL(model.redirectUri).protocol : model.redirectUri;
+    return page(l, t.title, `<p>${t.eyebrow}</p><h1>${t.heading(client)}</h1><p>${t.body(client)}</p>` +
+        `<p>${t.returnsTo} <code>${esc(host)}</code></p><p>${t.scopes}</p><ul>${model.scopes.map((sc) => `<li><code>${esc(sc)}</code></li>`).join("")}</ul><form method="post" action="/oauth/consent">` +
+        `<input type="hidden" name="oauth_query" value="${esc(model.oauthQuery)}"/><button type="submit" name="decision" value="approve">${t.approve}</button> ` +
+        `<button type="submit" name="decision" value="deny">${t.deny}</button></form>`);
+}
+function connectedAppsHtml(l, consents) {
+    const t = T[l];
+    const apps = consents.length === 0 ? `<p>${t.empty}</p>` : consents.map((c) => `<section><h2>${esc(c.clientName)}</h2><code>${esc(c.clientId)}</code><form method="post" action="/oauth/consents/revoke">` +
+        `<input type="hidden" name="consent_id" value="${esc(c.id)}"/><button type="submit">${t.revoke}</button></form></section>`).join("");
+    return page(l, t.apps, `<h1>${t.apps}</h1><p>${t.appsBody}</p>${apps}`);
+}
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
+/**
+ * A dynamic registration whose every redirect URI is http on a loopback host and that names no application_type is a
+ * native app (RFC 8252 7.3): local MCP clients register this way. Better Auth reads the missing type as `web`, which
+ * needs https on a non-loopback host, so it would refuse them all. Mark it native, as the client could itself; a
+ * registration naming a type, mixing hosts or using any other redirect is passed through unchanged.
+ */
+export async function loopbackClientsAreNative(request) {
+    const body = await readBody(request.clone()).then(JSON.parse).catch(error => { if (error instanceof ContractError)
+        throw error; return null; });
+    const uris = body?.redirect_uris;
+    if (!body || typeof body !== "object" || Array.isArray(body) || body.application_type !== undefined || !Array.isArray(uris) || !uris.length)
+        return request;
+    const loopback = uris.every((uri) => {
+        if (typeof uri !== "string" || !URL.canParse(uri))
+            return false;
+        const url = new URL(uri);
+        return url.protocol === "http:" && LOOPBACK_HOSTS.has(url.hostname);
+    });
+    if (!loopback)
+        return request;
+    const headers = new Headers(request.headers);
+    headers.delete("content-length");
+    return new Request(request.url, { method: "POST", headers, body: JSON.stringify({ ...body, application_type: "native" }) });
+}
+/** Bounded streaming read even without Content-Length; the native parser still owns JSON/form semantics. */
+async function readBody(request) {
+    if (Number(request.headers.get("content-length")) > MAX_BODY)
+        throw tooLarge();
+    const reader = request.body?.getReader();
+    if (!reader)
+        return "";
+    const decoder = new TextDecoder();
+    let size = 0, text = "";
+    try {
+        for (;;) {
+            const { value, done } = await reader.read();
+            if (done)
+                return text + decoder.decode();
+            size += value.byteLength;
+            if (size > MAX_BODY) {
+                void reader.cancel();
+                throw tooLarge();
+            }
+            text += decoder.decode(value, { stream: true });
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+}
+/** Better Auth and host fetch implementations may merge several Set-Cookie values into one header. */
+export async function normalizeAuthResponseCookies(response) {
+    if (!response.headers.has("set-cookie"))
+        return response;
+    const { splitSetCookieHeader } = await import("better-auth/cookies");
+    const values = response.headers.getSetCookie?.() ?? [response.headers.get("set-cookie")];
+    const cookies = values.flatMap(splitSetCookieHeader);
+    if (cookies.length < 2)
+        return response;
+    const headers = new Headers(response.headers);
+    headers.delete("set-cookie");
+    for (const cookie of cookies)
+        headers.append("set-cookie", cookie);
+    return new Response(response.body, { status: response.status, statusText: response.statusText, headers });
+}