@boxxy/auth-oauth 0.0.0-stage → 0.2.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 the boxxy authors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,48 @@
-# Temporary Holding Version
+<div align="center">
+  <h1>@boxxy/auth-oauth</h1>
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+  <p>
+    <a href="https://www.npmjs.com/package/@boxxy/auth-oauth"><img src="https://img.shields.io/npm/v/@boxxy/auth-oauth" alt="npm version"></a>
+    <a href="./LICENSE"><img src="https://img.shields.io/badge/license-MIT-blue" alt="MIT license"></a>
+  </p>
+
+  <p>
+    <a href="../../docs/design/boxxy/README.md">Documentation</a>
+  </p>
+</div>
+
+The OAuth server behind boxxy's public door: it lets the owner's assistant reach the owner's MCP
+tools from anywhere, with a grant that the owner approved with a passkey.
+
+## Install
+
+Install the package from [npm](https://www.npmjs.com/package/@boxxy/auth-oauth) with Bun:
+
+```bash
+bun add @boxxy/auth-oauth
+```
+
+The package runs on [Bun](https://bun.sh) 1.3 or newer.
+
+## Features
+
+- `createPublicDoor(options)` opens the auth database and returns the door: `answerRequest` for each
+  request, `addLocalPort` for the loopback address, `admin` for the owner's commands and `stop`.
+- The door serves `/mcp`, the OAuth routes (`/oauth2/authorize`, `/oauth2/token`, `/oauth2/revoke`
+  and the two `.well-known` documents) and the sign-in pages (`/login`, `/enroll`, `/consent`,
+  `/error`), and answers 404 on any other path.
+- It checks the `Host` and `Origin` headers, verifies each bearer token against the auth database,
+  and passes the verified token to the `serveMCP` callback that the app gives it.
+- It writes each sign-in outcome and each refused token to `writeSecurityLine` as a JSON line.
+- `admin` enrolls a passkey, adds and removes clients, and lists and revokes grants.
+- `./test-utils/authorize-test-client` runs the whole sign-in against a door with a stub passkey,
+  for tests.
+
+The code is a copy of the OAuth server in atc's `@atc/mcp`. Each copied file names its source path
+and commit in its first line.
+
+## Documentation
+
+[The public door](../../docs/design/boxxy/v1-api-and-auth.md#the-public-door) describes the
+endpoints, the scopes and the token lifetimes, and
+[0018](../../docs/decisions/0018-public-owner-mcp.md) records the decision.

package/dist/auth/answer-authorize-request.d.ts

@@ -0,0 +1,2 @@
+import type { HTTPServerContext, Requester } from './types.ts';
+export declare function answerAuthorizeRequest(ctx: HTTPServerContext, url: URL, requester: Requester): Promise<Response>;

package/dist/auth/answer-consent-request.d.ts

@@ -0,0 +1,10 @@
+import type { HTTPServerContext, Requester } from './types.ts';
+interface ConsentRequest {
+    readonly method: 'GET' | 'POST';
+    readonly url: URL;
+    readonly cookie: string | null;
+    readonly body: string;
+    readonly requester: Requester;
+}
+export declare function answerConsentRequest(ctx: HTTPServerContext, request: ConsentRequest): Promise<Response>;
+export {};

package/dist/auth/answer-enroll-request.d.ts

@@ -0,0 +1,9 @@
+import type { HTTPServerContext, Requester } from './types.ts';
+interface EnrollRequest {
+    readonly method: 'GET' | 'POST';
+    readonly url: URL;
+    readonly body: string;
+    readonly requester: Requester;
+}
+export declare function answerEnrollRequest(ctx: HTTPServerContext, request: EnrollRequest): Promise<Response>;
+export {};

package/dist/auth/answer-login-request.d.ts

@@ -0,0 +1,9 @@
+import type { HTTPServerContext, Requester } from './types.ts';
+interface LoginRequest {
+    readonly method: 'GET' | 'POST';
+    readonly url: URL;
+    readonly body: string;
+    readonly requester: Requester;
+}
+export declare function answerLoginRequest(ctx: HTTPServerContext, request: LoginRequest): Promise<Response>;
+export {};

package/dist/auth/approval-window-seconds.d.ts

@@ -0,0 +1 @@
+export declare const APPROVAL_WINDOW_SECONDS = 600;

package/dist/auth/build-consent-binding.d.ts

@@ -0,0 +1 @@
+export declare function buildConsentBinding(oauthQuery: string): string;

package/dist/auth/create-approval-state.d.ts

@@ -0,0 +1,41 @@
+interface ApprovalRequest {
+    readonly key: string;
+    readonly clientID: string;
+    readonly clientName: string;
+    readonly redirectURI: string;
+}
+interface PendingApproval extends ApprovalRequest {
+    readonly correlationID: string;
+    failures: number;
+    readonly expiresAt: number;
+    challenge: {
+        readonly value: string;
+        readonly expiresAt: number;
+    } | null;
+}
+export type TakenChallenge = {
+    readonly kind: 'taken';
+    readonly challenge: string;
+} | {
+    readonly kind: 'expired';
+} | {
+    readonly kind: 'missing';
+};
+interface ApprovedRequest {
+    readonly binding: string;
+    readonly correlationID: string;
+    readonly expiresAt: number;
+}
+export interface ApprovalState {
+    readonly createPending: (request: ApprovalRequest) => PendingApproval | null;
+    readonly findPending: (key: string) => PendingApproval | null;
+    readonly mintChallenge: (key: string) => string | null;
+    readonly claimChallenge: (key: string) => TakenChallenge;
+    readonly recordFailure: (key: string) => 'retry' | 'locked';
+    readonly removePending: (key: string) => void;
+    readonly recordApproved: (sessionID: string, approved: Omit<ApprovedRequest, 'expiresAt'>) => void;
+    readonly findApproved: (sessionID: string) => ApprovedRequest | null;
+    readonly removeApproved: (sessionID: string) => void;
+}
+export declare function createApprovalState(pendingMs: number, now: () => number): ApprovalState;
+export {};

package/dist/auth/create-auth-admin.d.ts

@@ -0,0 +1,33 @@
+import type { AuthClock } from '../utils/types.ts';
+import type { openMCPAuth } from './open-mcp-auth.ts';
+import type { ClientView } from './read-client-views.ts';
+import type { GrantView } from './read-grant-views.ts';
+type MCPAuth = Awaited<ReturnType<typeof openMCPAuth>>;
+export interface AuthAdminInput {
+    readonly store: MCPAuth;
+    readonly origin: string;
+    readonly clock: AuthClock;
+}
+export type AddClientAnswer = {
+    readonly kind: 'added';
+    readonly clientID: string;
+    readonly name: string;
+} | {
+    readonly kind: 'refused';
+    readonly redirectURI: string;
+};
+export interface EnrollmentLink {
+    readonly token: string;
+    readonly link: string;
+    readonly expiresAt: number;
+}
+export interface AuthAdmin {
+    readonly enroll: () => Promise<EnrollmentLink>;
+    readonly addClient: (name: string, redirectURIs: readonly string[]) => Promise<AddClientAnswer>;
+    readonly listClients: () => Promise<readonly ClientView[]>;
+    readonly removeClient: (clientID: string) => Promise<boolean>;
+    readonly listGrants: () => Promise<readonly GrantView[]>;
+    readonly revokeGrant: (grantID: string) => Promise<boolean>;
+}
+export declare function createAuthAdmin(input: AuthAdminInput): AuthAdmin;
+export {};

package/dist/auth/create-enrollment-state.d.ts

@@ -0,0 +1,6 @@
+import type { TakenChallenge } from './create-approval-state.ts';
+export interface EnrollmentState {
+    readonly mintChallenge: (tokenHash: string) => string;
+    readonly claimChallenge: (tokenHash: string) => TakenChallenge;
+}
+export declare function createEnrollmentState(now: () => number): EnrollmentState;

package/dist/auth/create-enrollment-token.d.ts

@@ -0,0 +1,6 @@
+import type { Kysely } from 'kysely';
+import type { MCPAuthSchema } from './mcp-auth-schema.ts';
+export declare function createEnrollmentToken(db: Kysely<MCPAuthSchema>, now: number): Promise<{
+    readonly token: string;
+    readonly expiresAt: number;
+}>;

package/dist/auth/create-owner-plugin.d.ts

@@ -0,0 +1,38 @@
+import { z } from 'zod';
+export declare function createOwnerPlugin(): {
+    id: "boxxy-owner";
+    endpoints: {
+        signInOwner: import("better-auth").StrictEndpoint<"/boxxy/sign-in-owner", {
+            method: "POST";
+            body: z.ZodObject<{
+                oauth_query: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>;
+            metadata: {
+                SERVER_ONLY: true;
+            };
+        }, {
+            signedIn: boolean;
+        }>;
+        verifyMCPAccessToken: import("better-auth").StrictEndpoint<"/boxxy/verify-access-token", {
+            method: "POST";
+            body: z.ZodObject<{
+                token: z.ZodString;
+            }, z.core.$strip>;
+            metadata: {
+                SERVER_ONLY: true;
+            };
+        }, import("@better-auth/oauth-provider").ActiveAccessTokenPayload>;
+        createFixedClient: import("better-auth").StrictEndpoint<"/boxxy/create-fixed-client", {
+            method: "POST";
+            body: z.ZodObject<{
+                name: z.ZodString;
+                redirectURIs: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>;
+            metadata: {
+                SERVER_ONLY: true;
+            };
+        }, {
+            clientID: string;
+        }>;
+    };
+};

package/dist/auth/create-passkey.d.ts

@@ -0,0 +1,11 @@
+import type { Kysely } from 'kysely';
+import type { MCPAuthSchema } from './mcp-auth-schema.ts';
+export interface NewPasskey {
+    readonly tokenHash: string;
+    readonly id: string;
+    readonly publicKey: string;
+    readonly counter: number;
+    readonly transports: readonly string[];
+    readonly now: number;
+}
+export declare function createPasskey(db: Kysely<MCPAuthSchema>, passkey: NewPasskey): Promise<boolean>;

package/dist/auth/create-security-event-log.d.ts

@@ -0,0 +1,12 @@
+import type { AuthClock } from '../utils/types.ts';
+import type { SecurityEvent } from './types.ts';
+interface SecurityEventLogOptions {
+    readonly print: (line: string) => void;
+    readonly clock: AuthClock;
+}
+export interface SecurityEventLog {
+    readonly record: (event: SecurityEvent) => void;
+    readonly drain: () => void;
+}
+export declare function createSecurityEventLog(opts: SecurityEventLogOptions): SecurityEventLog;
+export {};

package/dist/auth/derive-token-hash.d.ts

@@ -0,0 +1 @@
+export declare function deriveTokenHash(token: string): string;

package/dist/auth/format-security-event.d.ts

@@ -0,0 +1,7 @@
+import type { SecurityEvent } from './types.ts';
+export interface SuppressedSecurityEvent {
+    readonly kind: 'suppressed';
+    readonly reason: SecurityEvent['kind'];
+    readonly count: number;
+}
+export declare function formatSecurityEvent(event: SecurityEvent | SuppressedSecurityEvent, at: number): string;

package/dist/auth/is-allowed-redirect-uri.d.ts

@@ -0,0 +1 @@
+export declare function isAllowedRedirectURI(raw: string): boolean;

package/dist/auth/load-web-authn.d.ts

@@ -0,0 +1,6 @@
+import type { verifyAuthenticationResponse, verifyRegistrationResponse } from '@simplewebauthn/server';
+export interface WebAuthn {
+    readonly verifyAuthenticationResponse: typeof verifyAuthenticationResponse;
+    readonly verifyRegistrationResponse: typeof verifyRegistrationResponse;
+}
+export declare function loadWebAuthn(): Promise<WebAuthn>;

package/dist/auth/mcp-auth-database.d.ts

@@ -0,0 +1,5 @@
+import type { Dialect } from 'kysely';
+export interface MCPAuthDatabase {
+    readonly dialect: Dialect;
+    readonly close: () => void;
+}

package/dist/auth/mcp-auth-schema.d.ts

@@ -0,0 +1,54 @@
+export interface MCPAuthSchema {
+    readonly oauthClient: {
+        readonly id: string;
+        readonly clientId: string;
+        readonly name: string | null;
+        readonly redirectUris: string;
+        readonly createdAt: string | null;
+    };
+    readonly oauthAccessToken: {
+        readonly id: string;
+        readonly token: string;
+        readonly clientId: string;
+        readonly sessionId: string | null;
+        readonly authorizationCodeId: string | null;
+    };
+    readonly oauthRefreshToken: {
+        readonly id: string;
+        readonly clientId: string;
+        readonly sessionId: string | null;
+        readonly authorizationCodeId: string | null;
+        readonly scopes: string;
+        readonly createdAt: string;
+        readonly expiresAt: string;
+        readonly revoked: string | null;
+    };
+    readonly oauthConsent: {
+        readonly id: string;
+        readonly clientId: string;
+    };
+    readonly oauthResource: {
+        readonly identifier: string;
+    };
+    readonly session: {
+        readonly id: string;
+        readonly expiresAt: string;
+    };
+    readonly boxxy_grant_use: {
+        readonly grant_id: string;
+        readonly last_used_at: string;
+    };
+    readonly boxxy_passkey: {
+        readonly id: string;
+        readonly public_key: string;
+        readonly counter: number;
+        readonly transports: string;
+        readonly created_at: string;
+        readonly last_used_at: string | null;
+    };
+    readonly boxxy_enrollment_token: {
+        readonly token_hash: string;
+        readonly created_at: string;
+        readonly expires_at: string;
+    };
+}

package/dist/auth/normalize-client-name.d.ts

@@ -0,0 +1 @@
+export declare function normalizeClientName(raw: unknown, fallback?: string, maxLength?: number): string;

package/dist/auth/open-auth-database.d.ts

@@ -0,0 +1,2 @@
+import type { MCPAuthDatabase } from './mcp-auth-database.ts';
+export declare function openAuthDatabase(path: string): MCPAuthDatabase;

package/dist/auth/open-mcp-auth.d.ts

@@ -0,0 +1,80 @@
+import type { BetterAuthPlugin } from 'better-auth';
+import { Kysely } from 'kysely';
+import type { MCPAuthDatabase } from './mcp-auth-database.ts';
+import type { MCPAuthSchema } from './mcp-auth-schema.ts';
+interface MCPAuthOptions {
+    readonly dbPath: string;
+    readonly origin: string | null;
+    readonly refreshReuseSeconds?: number;
+    readonly openDatabase: (path: string) => MCPAuthDatabase;
+}
+export declare function openMCPAuth(options: MCPAuthOptions): Promise<{
+    auth: import("better-auth").Auth<{
+        baseURL: string;
+        basePath: string;
+        secret: string;
+        database: {
+            db: Kysely<MCPAuthSchema>;
+            type: "sqlite";
+        };
+        telemetry: {
+            enabled: false;
+        };
+        logger: {
+            level: "error";
+        };
+        rateLimit: {
+            enabled: false;
+        };
+        advanced: {
+            database: {
+                validateSchema: false;
+            };
+        };
+        trustedOrigins: string[];
+        session: {
+            expiresIn: number;
+            disableSessionRefresh: true;
+        };
+        plugins: [BetterAuthPlugin, {
+            id: "boxxy-owner";
+            endpoints: {
+                signInOwner: import("better-auth").StrictEndpoint<"/boxxy/sign-in-owner", {
+                    method: "POST";
+                    body: import("zod").ZodObject<{
+                        oauth_query: import("zod").ZodOptional<import("zod").ZodString>;
+                    }, import("zod/v4/core").$strip>;
+                    metadata: {
+                        SERVER_ONLY: true;
+                    };
+                }, {
+                    signedIn: boolean;
+                }>;
+                verifyMCPAccessToken: import("better-auth").StrictEndpoint<"/boxxy/verify-access-token", {
+                    method: "POST";
+                    body: import("zod").ZodObject<{
+                        token: import("zod").ZodString;
+                    }, import("zod/v4/core").$strip>;
+                    metadata: {
+                        SERVER_ONLY: true;
+                    };
+                }, import("@better-auth/oauth-provider").ActiveAccessTokenPayload>;
+                createFixedClient: import("better-auth").StrictEndpoint<"/boxxy/create-fixed-client", {
+                    method: "POST";
+                    body: import("zod").ZodObject<{
+                        name: import("zod").ZodString;
+                        redirectURIs: import("zod").ZodArray<import("zod").ZodString>;
+                    }, import("zod/v4/core").$strip>;
+                    metadata: {
+                        SERVER_ONLY: true;
+                    };
+                }, {
+                    clientID: string;
+                }>;
+            };
+        }];
+    }>;
+    db: Kysely<MCPAuthSchema>;
+    close(): Promise<void>;
+}>;
+export {};

package/dist/auth/passkey-script.d.ts

@@ -0,0 +1,4 @@
+export declare const PASSKEY_SCRIPT: {
+    readonly source: "(() => {\n  const data = document.getElementById('boxxy-passkey');\n  const form = document.getElementById('boxxy-passkey-form');\n  const button = document.getElementById('boxxy-passkey-start');\n  const status = document.getElementById('boxxy-passkey-status');\n  if (data === null || form === null || button === null || status === null) return;\n  const spec = JSON.parse(data.textContent);\n  const toBytes = (value) => {\n    const base64 = value.replace(/-/g, '+').replace(/_/g, '/');\n    const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);\n    return Uint8Array.from(atob(padded), (c) => c.charCodeAt(0));\n  };\n  const toText = (buffer) => {\n    let text = '';\n    for (const byte of new Uint8Array(buffer)) text += String.fromCharCode(byte);\n    return btoa(text).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n  };\n  const toDescriptors = (list) => (list || []).map((item) => ({ ...item, id: toBytes(item.id) }));\n  button.addEventListener('click', async () => {\n    button.disabled = true;\n    status.textContent = '';\n    try {\n      const options = spec.options;\n      const credential = spec.mode === 'create'\n        ? await navigator.credentials.create({ publicKey: { ...options, challenge: toBytes(options.challenge), user: { ...options.user, id: toBytes(options.user.id) }, excludeCredentials: toDescriptors(options.excludeCredentials) } })\n        : await navigator.credentials.get({ publicKey: { ...options, challenge: toBytes(options.challenge), allowCredentials: toDescriptors(options.allowCredentials) } });\n      const reply = credential.response;\n      const response = spec.mode === 'create'\n        ? { clientDataJSON: toText(reply.clientDataJSON), attestationObject: toText(reply.attestationObject), transports: typeof reply.getTransports === 'function' ? reply.getTransports() : [] }\n        : { clientDataJSON: toText(reply.clientDataJSON), authenticatorData: toText(reply.authenticatorData), signature: toText(reply.signature), userHandle: reply.userHandle ? toText(reply.userHandle) : undefined };\n      form.elements.namedItem('credential').value = JSON.stringify({ id: credential.id, rawId: toText(credential.rawId), type: credential.type, response, clientExtensionResults: credential.getClientExtensionResults(), authenticatorAttachment: credential.authenticatorAttachment || undefined });\n      form.submit();\n    } catch (error) {\n      status.textContent = 'The passkey prompt ended without a passkey (' + (error && error.name ? error.name : 'Error') + '). Try again.';\n      button.disabled = false;\n    }\n  });\n})();";
+    readonly policySource: `'sha256-${string}'`;
+};

package/dist/auth/read-client-name.d.ts

@@ -0,0 +1,3 @@
+import type { Kysely } from 'kysely';
+import type { MCPAuthSchema } from './mcp-auth-schema.ts';
+export declare function readClientName(db: Kysely<MCPAuthSchema>, clientID: string): Promise<string | null>;

package/dist/auth/read-client-views.d.ts

@@ -0,0 +1,9 @@
+import type { Kysely } from 'kysely';
+import type { MCPAuthSchema } from './mcp-auth-schema.ts';
+export interface ClientView {
+    readonly clientID: string;
+    readonly name: string;
+    readonly redirectURIs: readonly string[];
+    readonly createdAt: string | null;
+}
+export declare function readClientViews(db: Kysely<MCPAuthSchema>): Promise<readonly ClientView[]>;

package/dist/auth/read-enrollment-token.d.ts

@@ -0,0 +1,3 @@
+import type { Kysely } from 'kysely';
+import type { MCPAuthSchema } from './mcp-auth-schema.ts';
+export declare function readEnrollmentToken(db: Kysely<MCPAuthSchema>, token: string, now: number): Promise<string | null>;

package/dist/auth/read-grant-views.d.ts

@@ -0,0 +1,12 @@
+import type { GrantScope } from '@boxxy/contract';
+import type { Kysely } from 'kysely';
+import type { MCPAuthSchema } from './mcp-auth-schema.ts';
+export interface GrantView {
+    readonly grantID: string;
+    readonly clientID: string;
+    readonly clientName: string;
+    readonly scopes: readonly GrantScope[];
+    readonly createdAt: string;
+    readonly lastUsedAt: string | null;
+}
+export declare function readGrantViews(db: Kysely<MCPAuthSchema>): Promise<readonly GrantView[]>;

package/dist/auth/read-owner-session-id.d.ts

@@ -0,0 +1,2 @@
+import type { HTTPServerContext } from './types.ts';
+export declare function readOwnerSessionID(ctx: HTTPServerContext, cookie: string | null): Promise<string | null>;

package/dist/auth/record-refused-exchange.d.ts

@@ -0,0 +1,10 @@
+import type { HTTPServerContext, Requester } from './types.ts';
+interface RefusedExchange {
+    readonly contentType: string | null;
+    readonly body: string;
+    readonly response: Response;
+    readonly path: string;
+    readonly requester: Requester;
+}
+export declare function recordRefusedExchange(ctx: Pick<HTTPServerContext, 'store' | 'security'>, exchange: RefusedExchange): Promise<void>;
+export {};

package/dist/auth/remove-client.d.ts

@@ -0,0 +1,3 @@
+import type { Kysely } from 'kysely';
+import type { MCPAuthSchema } from './mcp-auth-schema.ts';
+export declare function removeClient(db: Kysely<MCPAuthSchema>, clientID: string): Promise<boolean>;

package/dist/auth/remove-owner-session.d.ts

@@ -0,0 +1,3 @@
+import type { Kysely } from 'kysely';
+import type { MCPAuthSchema } from './mcp-auth-schema.ts';
+export declare function removeOwnerSession(db: Kysely<MCPAuthSchema>, sessionID: string): Promise<void>;

package/dist/auth/render-consent-page.d.ts

@@ -0,0 +1,9 @@
+import type { GrantScope } from '@boxxy/contract';
+interface ConsentPageView {
+    readonly oauthQuery: string;
+    readonly clientName: string;
+    readonly redirectURI: string;
+    readonly scopes: readonly GrantScope[];
+}
+export declare function renderConsentPage(view: ConsentPageView): string;
+export {};

package/dist/auth/render-enroll-page.d.ts

@@ -0,0 +1,10 @@
+interface EnrollPageView {
+    readonly ceremony: {
+        readonly token: string;
+        readonly options: unknown;
+    } | null;
+    readonly error: string | null;
+    readonly prefill?: string;
+}
+export declare function renderEnrollPage(view: EnrollPageView): string;
+export {};

package/dist/auth/render-login-page.d.ts

@@ -0,0 +1,9 @@
+interface LoginPageView {
+    readonly oauthQuery: string;
+    readonly clientName: string;
+    readonly redirectURI: string;
+    readonly options: unknown;
+    readonly error: string | null;
+}
+export declare function renderLoginPage(view: LoginPageView): string;
+export {};

package/dist/auth/revoke-grant.d.ts

@@ -0,0 +1,3 @@
+import type { Kysely } from 'kysely';
+import type { MCPAuthSchema } from './mcp-auth-schema.ts';
+export declare function revokeGrant(db: Kysely<MCPAuthSchema>, grantID: string): Promise<boolean>;

package/dist/auth/to-html-text.d.ts

@@ -0,0 +1 @@
+export declare function toHTMLText(text: string): string;

package/dist/auth/to-script-json.d.ts

@@ -0,0 +1 @@
+export declare function toScriptJSON(value: unknown): string;

package/dist/auth/types.d.ts

@@ -0,0 +1,79 @@
+import type { GrantScope } from '@boxxy/contract';
+import type { AuthClock } from '../utils/types.ts';
+import type { ApprovalState } from './create-approval-state.ts';
+import type { EnrollmentState } from './create-enrollment-state.ts';
+import type { openMCPAuth } from './open-mcp-auth.ts';
+export interface Requester {
+    readonly socketAddress: string | null;
+    readonly connectingIP: {
+        readonly address: string;
+        readonly provenance: 'trusted' | 'unverified';
+    } | null;
+    readonly userAgent: string | null;
+}
+export type SecurityOutcome = {
+    readonly kind: 'authorize_started';
+    readonly outcome: 'accepted';
+} | {
+    readonly kind: 'authorize_started';
+    readonly outcome: 'rejected';
+    readonly reason: 'rate_limited';
+} | {
+    readonly kind: 'authorize_invalid';
+    readonly outcome: 'rejected';
+    readonly reason: AuthorizeInvalidReason;
+} | {
+    readonly kind: 'owner_auth';
+    readonly outcome: 'succeeded';
+} | {
+    readonly kind: 'owner_auth';
+    readonly outcome: 'failed';
+    readonly reason?: OwnerAuthFailure;
+} | {
+    readonly kind: 'consent';
+    readonly outcome: 'allowed';
+} | {
+    readonly kind: 'consent';
+    readonly outcome: 'denied';
+    readonly reason?: 'none_ticked';
+} | {
+    readonly kind: 'token_exchange';
+    readonly outcome: 'rejected';
+    readonly reason: TokenExchangeReason;
+} | {
+    readonly kind: 'bearer';
+    readonly outcome: 'rejected';
+    readonly reason: BearerReason;
+};
+export type OwnerAuthFailure = 'assertion_failed' | 'locked' | 'expired' | 'not_enrolled' | 'invalid_token';
+export type AuthorizeInvalidReason = 'invalid_client' | 'client_disabled' | 'invalid_redirect' | 'unauthorized_client' | 'unsupported_response_type' | 'invalid_request' | 'invalid_scope' | 'invalid_target' | 'bad_host' | 'bad_origin' | 'other';
+export type TokenExchangeReason = 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'unauthorized_client' | 'unsupported_grant_type' | 'invalid_scope' | 'invalid_target' | 'other';
+type BearerReason = 'malformed' | 'invalid_token';
+export type SecurityEvent = SecurityOutcome & {
+    readonly path: string;
+    readonly requester: Requester;
+    readonly client?: {
+        readonly id: string;
+        readonly name: string;
+    };
+    readonly redirectHost?: string;
+    readonly correlationID?: string;
+};
+export interface VerifiedAccess {
+    readonly clientID: string;
+    readonly clientName: string;
+    readonly scopes: readonly GrantScope[];
+}
+type MCPAuth = Awaited<ReturnType<typeof openMCPAuth>>;
+export interface HTTPServerContext {
+    readonly origin: string;
+    readonly resource: string;
+    readonly store: MCPAuth;
+    readonly approvals: ApprovalState;
+    readonly enrollments: EnrollmentState;
+    readonly security: {
+        readonly record: (event: SecurityEvent) => void;
+    };
+    readonly clock: AuthClock;
+}
+export {};