@asif2bd/umami-mcp 0.1.0

package/dist/oauth/router.js

@@ -0,0 +1,329 @@
+import { UmamiClient } from '../client.js';
+import { redactUnknown } from '../redact.js';
+import { consentPage, errorPage } from './consent.js';
+import { MemoryStore } from './store.js';
+import { seal, unseal, verifyPkce, safeEqual, SealError } from './seal.js';
+const MODES = ['read', 'write', 'admin'];
+function json(res, status, body) {
+    const text = JSON.stringify(body);
+    res.writeHead(status, {
+        'content-type': 'application/json',
+        'cache-control': 'no-store',
+        'content-length': Buffer.byteLength(text),
+    });
+    res.end(text);
+}
+function html(res, status, body, redirectUri) {
+    // form-action must name the redirect target as well as 'self'.
+    //
+    // Browsers enforce form-action across the redirect chain that FOLLOWS a form
+    // submission, not just the initial POST. With a bare 'self', the consent form
+    // posts fine and the server answers 302 to the client's redirect_uri -- and
+    // the browser then silently blocks that navigation. The visible symptom is a
+    // Connect button that does nothing at all, which is a miserable thing to debug.
+    let formAction = "'self'";
+    if (redirectUri) {
+        try {
+            formAction += ` ${new URL(redirectUri).origin}`;
+        }
+        catch {
+            /* unparseable redirect_uri is rejected elsewhere */
+        }
+    }
+    res.writeHead(status, {
+        'content-type': 'text/html; charset=utf-8',
+        'cache-control': 'no-store',
+        'content-security-policy': `default-src 'none'; style-src 'unsafe-inline'; form-action ${formAction}`,
+        'x-frame-options': 'DENY',
+        'referrer-policy': 'no-referrer',
+    });
+    res.end(body);
+}
+async function readBody(req, limit = 64 * 1024) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        size += chunk.length;
+        if (size > limit)
+            throw new Error('Request body too large.');
+        chunks.push(chunk);
+    }
+    return Buffer.concat(chunks).toString('utf8');
+}
+async function readForm(req) {
+    const type = req.headers['content-type'] ?? '';
+    const body = await readBody(req);
+    if (type.includes('application/json')) {
+        const parsed = JSON.parse(body);
+        const params = new URLSearchParams();
+        for (const [k, v] of Object.entries(parsed)) {
+            if (v !== undefined && v !== null)
+                params.set(k, String(v));
+        }
+        return params;
+    }
+    return new URLSearchParams(body);
+}
+export class OAuthProvider {
+    o;
+    store = new MemoryStore();
+    constructor(o) {
+        this.o = o;
+    }
+    /** Validate an Authorization header and return the caller's identity. */
+    authenticate(req) {
+        const header = req.headers.authorization ?? '';
+        const match = /^Bearer\s+(.+)$/i.exec(header.trim());
+        if (!match)
+            throw new SealError('Missing bearer token.');
+        return unseal(match[1].trim(), this.o.key);
+    }
+    /** Returns true when the request was an OAuth endpoint and has been handled. */
+    async handle(req, res, url) {
+        const p = url.pathname;
+        if (p === '/.well-known/oauth-authorization-server') {
+            json(res, 200, {
+                issuer: this.o.issuer,
+                authorization_endpoint: `${this.o.issuer}/authorize`,
+                token_endpoint: `${this.o.issuer}/token`,
+                registration_endpoint: `${this.o.issuer}/register`,
+                response_types_supported: ['code'],
+                grant_types_supported: ['authorization_code'],
+                code_challenge_methods_supported: ['S256'],
+                token_endpoint_auth_methods_supported: ['client_secret_post', 'none'],
+                scopes_supported: ['umami:read', 'umami:write', 'umami:admin'],
+            });
+            return true;
+        }
+        if (p === '/.well-known/oauth-protected-resource') {
+            json(res, 200, {
+                resource: this.o.issuer,
+                authorization_servers: [this.o.issuer],
+                scopes_supported: ['umami:read', 'umami:write', 'umami:admin'],
+            });
+            return true;
+        }
+        if (p === '/register' && req.method === 'POST') {
+            await this.register(req, res);
+            return true;
+        }
+        if (p === '/authorize') {
+            if (req.method === 'GET')
+                return this.showConsent(res, url), true;
+            if (req.method === 'POST')
+                return await this.grant(req, res), true;
+        }
+        if (p === '/token' && req.method === 'POST') {
+            await this.token(req, res);
+            return true;
+        }
+        return false;
+    }
+    async register(req, res) {
+        let body;
+        try {
+            body = JSON.parse(await readBody(req));
+        }
+        catch {
+            json(res, 400, { error: 'invalid_client_metadata', error_description: 'Body must be JSON.' });
+            return;
+        }
+        const uris = Array.isArray(body.redirect_uris) ? body.redirect_uris : [];
+        if (uris.length === 0) {
+            json(res, 400, { error: 'invalid_redirect_uri', error_description: 'redirect_uris is required.' });
+            return;
+        }
+        for (const u of uris) {
+            let parsed;
+            try {
+                parsed = new URL(u);
+            }
+            catch {
+                json(res, 400, { error: 'invalid_redirect_uri', error_description: `Not a URL: ${u}` });
+                return;
+            }
+            // Loopback may be plaintext; anything else must be HTTPS, or the code
+            // can be intercepted in transit.
+            const loopback = ['localhost', '127.0.0.1', '::1'].includes(parsed.hostname);
+            if (parsed.protocol !== 'https:' && !loopback) {
+                json(res, 400, {
+                    error: 'invalid_redirect_uri',
+                    error_description: `redirect_uri must use https (or be loopback): ${u}`,
+                });
+                return;
+            }
+        }
+        const client = this.store.registerClient(uris, typeof body.client_name === 'string' ? body.client_name : undefined);
+        json(res, 201, {
+            client_id: client.clientId,
+            client_secret: client.clientSecret,
+            client_id_issued_at: Math.floor(client.createdAt / 1000),
+            redirect_uris: client.redirectUris,
+            token_endpoint_auth_method: 'client_secret_post',
+            grant_types: ['authorization_code'],
+            response_types: ['code'],
+        });
+    }
+    showConsent(res, url, error) {
+        const q = url.searchParams;
+        const clientId = q.get('client_id') ?? '';
+        const redirectUri = q.get('redirect_uri') ?? '';
+        const method = q.get('code_challenge_method') ?? 'S256';
+        if (!clientId || !redirectUri) {
+            html(res, 400, errorPage('Invalid request', 'client_id and redirect_uri are required.'));
+            return;
+        }
+        if (q.get('code_challenge') && method !== 'S256') {
+            html(res, 400, errorPage('Unsupported PKCE method', 'Only S256 is accepted.'));
+            return;
+        }
+        const client = this.store.getClient(clientId);
+        // An unregistered client_id is allowed (operators may configure a static
+        // one), but a registered client's redirect_uri must match exactly.
+        if (client && !client.redirectUris.includes(redirectUri)) {
+            html(res, 400, errorPage('Invalid redirect URI', 'It does not match this client registration.'));
+            return;
+        }
+        html(res, 200, consentPage({
+            action: url.pathname,
+            clientName: client?.name,
+            fixedUrl: this.o.fixedUrl,
+            error,
+            hiddenFields: {
+                client_id: clientId,
+                redirect_uri: redirectUri,
+                state: q.get('state') ?? '',
+                code_challenge: q.get('code_challenge') ?? '',
+                code_challenge_method: method,
+                scope: q.get('scope') ?? '',
+            },
+        }), redirectUri);
+    }
+    /** Consent submitted: verify the credentials for real, then mint a code. */
+    async grant(req, res) {
+        let form;
+        try {
+            form = await readForm(req);
+        }
+        catch (err) {
+            html(res, 400, errorPage('Invalid request', redactUnknown(err)));
+            return;
+        }
+        const clientId = form.get('client_id') ?? '';
+        const redirectUri = form.get('redirect_uri') ?? '';
+        const umamiUrl = (this.o.fixedUrl ?? form.get('umami_url') ?? '').trim().replace(/\/+$/, '');
+        const username = (form.get('umami_username') ?? '').trim();
+        const password = form.get('umami_password') ?? '';
+        const mode = (form.get('mode') ?? 'read');
+        const rerender = (message) => {
+            const back = new URL(`${this.o.issuer}/authorize`);
+            for (const k of ['client_id', 'redirect_uri', 'state', 'code_challenge', 'code_challenge_method', 'scope']) {
+                const v = form.get(k);
+                if (v)
+                    back.searchParams.set(k, v);
+            }
+            this.showConsent(res, back, message);
+        };
+        if (!clientId || !redirectUri)
+            return rerender('Missing client_id or redirect_uri.');
+        if (!MODES.includes(mode))
+            return rerender('Invalid permission selection.');
+        if (!umamiUrl || !username || !password)
+            return rerender('All fields are required.');
+        let parsed;
+        try {
+            parsed = new URL(umamiUrl);
+        }
+        catch {
+            return rerender('That does not look like a valid URL.');
+        }
+        const loopback = ['localhost', '127.0.0.1', '::1'].includes(parsed.hostname);
+        if (parsed.protocol !== 'https:' && !loopback) {
+            return rerender('Refusing to send your password over plaintext HTTP. Use an https:// URL.');
+        }
+        // Prove the credentials work before issuing anything, so a typo fails here
+        // rather than silently producing a token that never works.
+        const probe = new UmamiClient({ ...this.o.baseConfig, url: umamiUrl, username, password, apiKey: undefined });
+        try {
+            await probe.verify();
+        }
+        catch (err) {
+            return rerender(`Umami rejected those credentials: ${redactUnknown(err)}`);
+        }
+        const now = Math.floor(Date.now() / 1000);
+        const identity = {
+            url: umamiUrl,
+            username,
+            password,
+            mode,
+            iat: now,
+            exp: now + this.o.tokenTtlSeconds,
+        };
+        const code = this.store.createCode({
+            clientId,
+            redirectUri,
+            codeChallenge: form.get('code_challenge') || undefined,
+            codeChallengeMethod: form.get('code_challenge_method') || undefined,
+            scope: form.get('scope') || undefined,
+            state: form.get('state') || undefined,
+            token: seal(identity, this.o.key),
+        });
+        const location = new URL(redirectUri);
+        location.searchParams.set('code', code);
+        const state = form.get('state');
+        if (state)
+            location.searchParams.set('state', state);
+        res.writeHead(302, { location: location.toString(), 'cache-control': 'no-store' });
+        res.end();
+    }
+    async token(req, res) {
+        let form;
+        try {
+            form = await readForm(req);
+        }
+        catch {
+            json(res, 400, { error: 'invalid_request' });
+            return;
+        }
+        if (form.get('grant_type') !== 'authorization_code') {
+            json(res, 400, { error: 'unsupported_grant_type', error_description: 'Only authorization_code is supported.' });
+            return;
+        }
+        const code = form.get('code') ?? '';
+        const pending = this.store.consumeCode(code);
+        if (!pending) {
+            json(res, 400, { error: 'invalid_grant', error_description: 'Code is unknown, used, or expired.' });
+            return;
+        }
+        if (!safeEqual(pending.clientId, form.get('client_id') ?? '')) {
+            json(res, 400, { error: 'invalid_grant', error_description: 'Code was issued to a different client.' });
+            return;
+        }
+        if (!safeEqual(pending.redirectUri, form.get('redirect_uri') ?? '')) {
+            json(res, 400, { error: 'invalid_grant', error_description: 'redirect_uri does not match the authorization request.' });
+            return;
+        }
+        const client = this.store.getClient(pending.clientId);
+        if (client?.clientSecret) {
+            const presented = form.get('client_secret') ?? '';
+            if (!safeEqual(client.clientSecret, presented)) {
+                json(res, 401, { error: 'invalid_client' });
+                return;
+            }
+        }
+        if (pending.codeChallenge) {
+            const verifier = form.get('code_verifier') ?? '';
+            if (!verifier || !verifyPkce(verifier, pending.codeChallenge, pending.codeChallengeMethod ?? 'S256')) {
+                json(res, 400, { error: 'invalid_grant', error_description: 'PKCE verification failed.' });
+                return;
+            }
+        }
+        json(res, 200, {
+            access_token: pending.token,
+            token_type: 'Bearer',
+            expires_in: this.o.tokenTtlSeconds,
+            scope: pending.scope ?? 'umami:read',
+        });
+    }
+}
+//# sourceMappingURL=router.js.map

package/dist/oauth/router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/oauth/router.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAuB,SAAS,EAAE,MAAM,WAAW,CAAC;AAYhG,MAAM,KAAK,GAAW,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAEjD,SAAS,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;QACpB,cAAc,EAAE,kBAAkB;QAClC,eAAe,EAAE,UAAU;QAC3B,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;KAC1C,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAY,EAAE,WAAoB;IACnF,+DAA+D;IAC/D,EAAE;IACF,6EAA6E;IAC7E,8EAA8E;IAC9E,4EAA4E;IAC5E,6EAA6E;IAC7E,gFAAgF;IAChF,IAAI,UAAU,GAAG,QAAQ,CAAC;IAC1B,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,UAAU,IAAI,IAAI,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,oDAAoD;QACtD,CAAC;IACH,CAAC;IACD,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;QACpB,cAAc,EAAE,0BAA0B;QAC1C,eAAe,EAAE,UAAU;QAC3B,yBAAyB,EAAE,8DAA8D,UAAU,EAAE;QACrG,iBAAiB,EAAE,MAAM;QACzB,iBAAiB,EAAE,aAAa;KACjC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAoB,EAAE,KAAK,GAAG,EAAE,GAAG,IAAI;IAC7D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,IAAI,IAAK,KAAgB,CAAC,MAAM,CAAC;QACjC,IAAI,IAAI,GAAG,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAoB;IAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC/C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,OAAO,aAAa;IAGK;IAFpB,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC;IAEnC,YAA6B,CAAe;QAAf,MAAC,GAAD,CAAC,CAAc;IAAG,CAAC;IAEhD,yEAAyE;IACzE,YAAY,CAAC,GAAoB;QAC/B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,SAAS,CAAC,uBAAuB,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,MAAM,CAAC,GAAoB,EAAE,GAAmB,EAAE,GAAQ;QAC9D,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC;QAEvB,IAAI,CAAC,KAAK,yCAAyC,EAAE,CAAC;YACpD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;gBACb,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM;gBACrB,sBAAsB,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,YAAY;gBACpD,cAAc,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,QAAQ;gBACxC,qBAAqB,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,WAAW;gBAClD,wBAAwB,EAAE,CAAC,MAAM,CAAC;gBAClC,qBAAqB,EAAE,CAAC,oBAAoB,CAAC;gBAC7C,gCAAgC,EAAE,CAAC,MAAM,CAAC;gBAC1C,qCAAqC,EAAE,CAAC,oBAAoB,EAAE,MAAM,CAAC;gBACrE,gBAAgB,EAAE,CAAC,YAAY,EAAE,aAAa,EAAE,aAAa,CAAC;aAC/D,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,KAAK,uCAAuC,EAAE,CAAC;YAClD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;gBACb,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM;gBACvB,qBAAqB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;gBACtC,gBAAgB,EAAE,CAAC,YAAY,EAAE,aAAa,EAAE,aAAa,CAAC;aAC/D,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,KAAK,WAAW,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC/C,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,KAAK,YAAY,EAAE,CAAC;YACvB,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK;gBAAE,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC;YAClE,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC;QACrE,CAAC;QAED,IAAI,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5C,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,GAAoB,EAAE,GAAmB;QAC9D,IAAI,IAA6B,CAAC;QAClC,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAA4B,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC9F,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,aAA0B,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACnG,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,MAAW,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;gBACxF,OAAO;YACT,CAAC;YACD,sEAAsE;YACtE,iCAAiC;YACjC,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC7E,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC9C,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;oBACb,KAAK,EAAE,sBAAsB;oBAC7B,iBAAiB,EAAE,iDAAiD,CAAC,EAAE;iBACxE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACpH,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;YACb,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;YACxD,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,0BAA0B,EAAE,oBAAoB;YAChD,WAAW,EAAE,CAAC,oBAAoB,CAAC;YACnC,cAAc,EAAE,CAAC,MAAM,CAAC;SACzB,CAAC,CAAC;IACL,CAAC;IAEO,WAAW,CAAC,GAAmB,EAAE,GAAQ,EAAE,KAAc;QAC/D,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC;QAC3B,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QAC1C,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,MAAM,CAAC;QAExD,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,iBAAiB,EAAE,0CAA0C,CAAC,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACjD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,yBAAyB,EAAE,wBAAwB,CAAC,CAAC,CAAC;YAC/E,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC9C,yEAAyE;QACzE,mEAAmE;QACnE,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACzD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,sBAAsB,EAAE,6CAA6C,CAAC,CAAC,CAAC;YACjG,OAAO;QACT,CAAC;QAED,IAAI,CACF,GAAG,EACH,GAAG,EACH,WAAW,CAAC;YACV,MAAM,EAAE,GAAG,CAAC,QAAQ;YACpB,UAAU,EAAE,MAAM,EAAE,IAAI;YACxB,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ;YACzB,KAAK;YACL,YAAY,EAAE;gBACZ,SAAS,EAAE,QAAQ;gBACnB,YAAY,EAAE,WAAW;gBACzB,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE;gBAC3B,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE;gBAC7C,qBAAqB,EAAE,MAAM;gBAC7B,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE;aAC5B;SACF,CAAC,EACF,WAAW,CACZ,CAAC;IACJ,CAAC;IAED,4EAA4E;IACpE,KAAK,CAAC,KAAK,CAAC,GAAoB,EAAE,GAAmB;QAC3D,IAAI,IAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,iBAAiB,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACjE,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACnD,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7F,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,CAAS,CAAC;QAElD,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAE,EAAE;YACnC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,CAAC;YACnD,KAAK,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,OAAO,CAAC,EAAE,CAAC;gBAC3G,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACtB,IAAI,CAAC;oBAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACrC,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACvC,CAAC,CAAC;QAEF,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW;YAAE,OAAO,QAAQ,CAAC,oCAAoC,CAAC,CAAC;QACrF,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,QAAQ,CAAC,+BAA+B,CAAC,CAAC;QAC5E,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;YAAE,OAAO,QAAQ,CAAC,0BAA0B,CAAC,CAAC;QAErF,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,QAAQ,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC7E,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9C,OAAO,QAAQ,CAAC,0EAA0E,CAAC,CAAC;QAC9F,CAAC;QAED,2EAA2E;QAC3E,2DAA2D;QAC3D,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9G,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC,qCAAqC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAmB;YAC/B,GAAG,EAAE,QAAQ;YACb,QAAQ;YACR,QAAQ;YACR,IAAI;YACJ,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,eAAe;SAClC,CAAC;QAEF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YACjC,QAAQ;YACR,WAAW;YACX,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,SAAS;YACtD,mBAAmB,EAAE,IAAI,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,SAAS;YACnE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS;YACrC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS;YACrC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;SAClC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACtC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,KAAK;YAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;QACnF,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,GAAoB,EAAE,GAAmB;QAC3D,IAAI,IAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,oBAAoB,EAAE,CAAC;YACpD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,uCAAuC,EAAE,CAAC,CAAC;YAChH,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,oCAAoC,EAAE,CAAC,CAAC;YACpG,OAAO;QACT,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC9D,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,wCAAwC,EAAE,CAAC,CAAC;YACxG,OAAO;QACT,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACpE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,wDAAwD,EAAE,CAAC,CAAC;YACxH,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACtD,IAAI,MAAM,EAAE,YAAY,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;YAClD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,EAAE,CAAC;gBAC/C,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBAC5C,OAAO;YACT,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;YACjD,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,mBAAmB,IAAI,MAAM,CAAC,EAAE,CAAC;gBACrG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,2BAA2B,EAAE,CAAC,CAAC;gBAC3F,OAAO;YACT,CAAC;QACH,CAAC;QAED,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;YACb,YAAY,EAAE,OAAO,CAAC,KAAK;YAC3B,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,eAAe;YAClC,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,YAAY;SACrC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/oauth/seal.d.ts

@@ -0,0 +1,22 @@
+export interface SealedIdentity {
+    url: string;
+    username?: string;
+    password?: string;
+    apiKey?: string;
+    /** Permission tier the user consented to. */
+    mode: 'read' | 'write' | 'admin';
+    /** Unix seconds. */
+    iat: number;
+    exp: number;
+}
+export declare class SealError extends Error {
+}
+/** Derive a 32-byte key from arbitrary operator-supplied material. */
+export declare function deriveKey(material: string): Buffer;
+export declare function generateKey(): string;
+export declare function seal(identity: SealedIdentity, key: Buffer): string;
+export declare function unseal(token: string, key: Buffer): SealedIdentity;
+/** Constant-time compare for client secrets and PKCE verifiers. */
+export declare function safeEqual(a: string, b: string): boolean;
+/** RFC 7636 S256 challenge verification. */
+export declare function verifyPkce(verifier: string, challenge: string, method?: string): boolean;

package/dist/oauth/seal.js

@@ -0,0 +1,82 @@
+import { createCipheriv, createDecipheriv, randomBytes, createHash, timingSafeEqual } from 'node:crypto';
+/**
+ * Access tokens are sealed credential envelopes, not database keys.
+ *
+ * A multi-tenant hosted deployment must let each user reach their own Umami
+ * with their own login. The obvious way is a sessions table mapping token to
+ * credentials -- which means the host is now storing a pile of other people's
+ * analytics passwords, and is one backup leak away from a very bad day.
+ *
+ * Instead the credentials travel inside the token itself, encrypted with a key
+ * only the server holds. The server keeps no session state at all: it decrypts
+ * on each request, uses the credentials, and forgets them.
+ *
+ * Trade-off, stated plainly: anyone holding the sealing key can decrypt any
+ * token they capture. The key must be persisted out of band (UMAMI_MCP_TOKEN_KEY)
+ * and treated as the most sensitive value in the deployment. Rotating it
+ * invalidates every issued token, which is the intended blast-radius control.
+ */
+const ALG = 'aes-256-gcm';
+const VERSION = 'v1';
+export class SealError extends Error {
+}
+/** Derive a 32-byte key from arbitrary operator-supplied material. */
+export function deriveKey(material) {
+    if (material.length < 16) {
+        throw new SealError('UMAMI_MCP_TOKEN_KEY must be at least 16 characters; 32+ random bytes is better.');
+    }
+    return createHash('sha256').update(material, 'utf8').digest();
+}
+export function generateKey() {
+    return randomBytes(32).toString('base64url');
+}
+export function seal(identity, key) {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv(ALG, key, iv);
+    const plaintext = Buffer.from(JSON.stringify(identity), 'utf8');
+    const body = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return [VERSION, iv.toString('base64url'), body.toString('base64url'), tag.toString('base64url')].join('.');
+}
+export function unseal(token, key) {
+    const parts = token.split('.');
+    if (parts.length !== 4 || parts[0] !== VERSION)
+        throw new SealError('Malformed token.');
+    let identity;
+    try {
+        const iv = Buffer.from(parts[1], 'base64url');
+        const body = Buffer.from(parts[2], 'base64url');
+        const tag = Buffer.from(parts[3], 'base64url');
+        const decipher = createDecipheriv(ALG, key, iv);
+        decipher.setAuthTag(tag);
+        const plaintext = Buffer.concat([decipher.update(body), decipher.final()]);
+        identity = JSON.parse(plaintext.toString('utf8'));
+    }
+    catch {
+        // Never distinguish "wrong key" from "tampered" from "malformed":
+        // that distinction is a decryption oracle.
+        throw new SealError('Invalid or expired token.');
+    }
+    if (typeof identity.exp !== 'number' || identity.exp * 1000 < Date.now()) {
+        throw new SealError('Invalid or expired token.');
+    }
+    return identity;
+}
+/** Constant-time compare for client secrets and PKCE verifiers. */
+export function safeEqual(a, b) {
+    const ab = Buffer.from(a, 'utf8');
+    const bb = Buffer.from(b, 'utf8');
+    if (ab.length !== bb.length)
+        return false;
+    return timingSafeEqual(ab, bb);
+}
+/** RFC 7636 S256 challenge verification. */
+export function verifyPkce(verifier, challenge, method = 'S256') {
+    if (method === 'plain')
+        return safeEqual(verifier, challenge);
+    if (method !== 'S256')
+        return false;
+    const computed = createHash('sha256').update(verifier, 'utf8').digest('base64url');
+    return safeEqual(computed, challenge);
+}
+//# sourceMappingURL=seal.js.map

package/dist/oauth/seal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seal.js","sourceRoot":"","sources":["../../src/oauth/seal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEzG;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,GAAG,GAAG,aAAa,CAAC;AAC1B,MAAM,OAAO,GAAG,IAAI,CAAC;AAcrB,MAAM,OAAO,SAAU,SAAQ,KAAK;CAAG;AAEvC,sEAAsE;AACtE,MAAM,UAAU,SAAS,CAAC,QAAgB;IACxC,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,SAAS,CAAC,iFAAiF,CAAC,CAAC;IACzG,CAAC;IACD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,QAAwB,EAAE,GAAW;IACxD,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9G,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,KAAa,EAAE,GAAW;IAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO;QAAE,MAAM,IAAI,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACxF,IAAI,QAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAChD,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC3E,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAmB,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;QAClE,2CAA2C;QAC3C,MAAM,IAAI,SAAS,CAAC,2BAA2B,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ,IAAI,QAAQ,CAAC,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACzE,MAAM,IAAI,SAAS,CAAC,2BAA2B,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,SAAS,CAAC,CAAS,EAAE,CAAS;IAC5C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAClC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAClC,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,SAAiB,EAAE,MAAM,GAAG,MAAM;IAC7E,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACnF,OAAO,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AACxC,CAAC"}

package/dist/oauth/store.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Authorization codes and dynamically-registered clients live in memory only.
+ *
+ * Codes are single-use and expire in a minute, so losing them on restart costs
+ * a user one retry. Registered clients are also in memory: a restart forces
+ * re-registration, which MCP clients handle automatically. Nothing here is
+ * worth the operational weight of a database.
+ */
+export interface PendingAuth {
+    clientId: string;
+    redirectUri: string;
+    codeChallenge?: string;
+    codeChallengeMethod?: string;
+    scope?: string;
+    state?: string;
+    /** Sealed identity, minted at consent time. */
+    token: string;
+    expiresAt: number;
+}
+export interface RegisteredClient {
+    clientId: string;
+    clientSecret?: string;
+    redirectUris: string[];
+    name?: string;
+    createdAt: number;
+}
+export declare class MemoryStore {
+    private codes;
+    private clients;
+    createCode(auth: Omit<PendingAuth, 'expiresAt'>): string;
+    /** Codes are single-use: consuming one removes it, replay included. */
+    consumeCode(code: string): PendingAuth | undefined;
+    registerClient(redirectUris: string[], name?: string): RegisteredClient;
+    getClient(clientId: string): RegisteredClient | undefined;
+    private sweep;
+    get stats(): {
+        codes: number;
+        clients: number;
+    };
+}

package/dist/oauth/store.js

@@ -0,0 +1,48 @@
+import { randomBytes } from 'node:crypto';
+const CODE_TTL_MS = 60_000;
+export class MemoryStore {
+    codes = new Map();
+    clients = new Map();
+    createCode(auth) {
+        this.sweep();
+        const code = randomBytes(32).toString('base64url');
+        this.codes.set(code, { ...auth, expiresAt: Date.now() + CODE_TTL_MS });
+        return code;
+    }
+    /** Codes are single-use: consuming one removes it, replay included. */
+    consumeCode(code) {
+        this.sweep();
+        const found = this.codes.get(code);
+        if (!found)
+            return undefined;
+        this.codes.delete(code);
+        if (found.expiresAt < Date.now())
+            return undefined;
+        return found;
+    }
+    registerClient(redirectUris, name) {
+        const client = {
+            clientId: randomBytes(16).toString('base64url'),
+            clientSecret: randomBytes(32).toString('base64url'),
+            redirectUris,
+            name,
+            createdAt: Date.now(),
+        };
+        this.clients.set(client.clientId, client);
+        return client;
+    }
+    getClient(clientId) {
+        return this.clients.get(clientId);
+    }
+    sweep() {
+        const now = Date.now();
+        for (const [code, auth] of this.codes) {
+            if (auth.expiresAt < now)
+                this.codes.delete(code);
+        }
+    }
+    get stats() {
+        return { codes: this.codes.size, clients: this.clients.size };
+    }
+}
+//# sourceMappingURL=store.js.map

package/dist/oauth/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/oauth/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA+B1C,MAAM,WAAW,GAAG,MAAM,CAAC;AAE3B,MAAM,OAAO,WAAW;IACd,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IACvC,OAAO,GAAG,IAAI,GAAG,EAA4B,CAAC;IAEtD,UAAU,CAAC,IAAoC;QAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,uEAAuE;IACvE,WAAW,CAAC,IAAY;QACtB,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,SAAS,CAAC;QACnD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,cAAc,CAAC,YAAsB,EAAE,IAAa;QAClD,MAAM,MAAM,GAAqB;YAC/B,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC/C,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;YACnD,YAAY;YACZ,IAAI;YACJ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC1C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,SAAS,CAAC,QAAgB;QACxB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAEO,KAAK;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACtC,IAAI,IAAI,CAAC,SAAS,GAAG,GAAG;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,IAAI,KAAK;QACP,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAChE,CAAC;CACF"}

package/dist/redact.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Defence in depth: an MCP server hands its output straight to a language
+ * model, and from there often into a chat transcript. A stack trace or an
+ * echoed request body that happens to contain a password would leak it into
+ * places it can never be recalled from. Every string leaving this server is
+ * scrubbed first.
+ */
+/** Register values that must never appear in output. Call once at startup. */
+export declare function registerSecrets(...values: (string | undefined)[]): void;
+/** Test seam. */
+export declare function _resetSecrets(): void;
+export declare function redact(input: string): string;
+/** Redact anything, including Error objects and nested structures. */
+export declare function redactUnknown(value: unknown): string;

package/dist/redact.js

@@ -0,0 +1,54 @@
+/**
+ * Defence in depth: an MCP server hands its output straight to a language
+ * model, and from there often into a chat transcript. A stack trace or an
+ * echoed request body that happens to contain a password would leak it into
+ * places it can never be recalled from. Every string leaving this server is
+ * scrubbed first.
+ */
+let secrets = [];
+/** Register values that must never appear in output. Call once at startup. */
+export function registerSecrets(...values) {
+    for (const v of values) {
+        // Very short values would cause absurd over-redaction of ordinary text.
+        if (v && v.length >= 6)
+            secrets.push(v);
+    }
+    // Longest first, so an overlapping secret is fully masked.
+    secrets.sort((a, b) => b.length - a.length);
+}
+/** Test seam. */
+export function _resetSecrets() {
+    secrets = [];
+}
+const PATTERNS = [
+    // JSON fields commonly carrying credentials.
+    [/("(?:password|token|apiKey|api_key|secret|authorization)"\s*:\s*)"[^"]*"/gi, '$1"[redacted]"'],
+    // Authorization headers in any casing.
+    [/(authorization\s*:\s*bearer\s+)[A-Za-z0-9._~+/=-]+/gi, '$1[redacted]'],
+    // Bare JWTs.
+    [/\beyJ[A-Za-z0-9._-]{20,}/g, '[redacted-jwt]'],
+];
+export function redact(input) {
+    let out = input;
+    for (const s of secrets) {
+        // Literal replacement; secrets are not regexes.
+        out = out.split(s).join('[redacted]');
+    }
+    for (const [re, sub] of PATTERNS)
+        out = out.replace(re, sub);
+    return out;
+}
+/** Redact anything, including Error objects and nested structures. */
+export function redactUnknown(value) {
+    if (value instanceof Error)
+        return redact(value.message);
+    if (typeof value === 'string')
+        return redact(value);
+    try {
+        return redact(JSON.stringify(value));
+    }
+    catch {
+        return redact(String(value));
+    }
+}
+//# sourceMappingURL=redact.js.map

package/dist/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,IAAI,OAAO,GAAa,EAAE,CAAC;AAE3B,8EAA8E;AAC9E,MAAM,UAAU,eAAe,CAAC,GAAG,MAA8B;IAC/D,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,wEAAwE;QACxE,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,2DAA2D;IAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;AAC9C,CAAC;AAED,iBAAiB;AACjB,MAAM,UAAU,aAAa;IAC3B,OAAO,GAAG,EAAE,CAAC;AACf,CAAC;AAED,MAAM,QAAQ,GAAuB;IACnC,6CAA6C;IAC7C,CAAC,4EAA4E,EAAE,gBAAgB,CAAC;IAChG,uCAAuC;IACvC,CAAC,sDAAsD,EAAE,cAAc,CAAC;IACxE,aAAa;IACb,CAAC,2BAA2B,EAAE,gBAAgB,CAAC;CAChD,CAAC;AAEF,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,gDAAgD;QAChD,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACxC,CAAC;IACD,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,QAAQ;QAAE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC7D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,YAAY,KAAK;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACzD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC"}

package/dist/server.d.ts

@@ -0,0 +1,12 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { UmamiClient } from './client.js';
+import type { Config } from './config.js';
+import { type ToolDef } from './tools/index.js';
+export declare const SERVER_NAME = "umami-mcp";
+export declare const SERVER_VERSION = "0.1.0";
+export interface BuiltServer {
+    server: McpServer;
+    registered: ToolDef[];
+    withheld: ToolDef[];
+}
+export declare function buildServer(config: Config, client?: UmamiClient): BuiltServer;