@boxxy/auth-oauth 0.2.6 → 0.2.8

package/src/auth/open-mcp-auth.ts

@@ -1,138 +0,0 @@
-// Copied from atc: packages/mcp/src/auth/open-mcp-auth.ts at commit 4fe647cf.
-
-import { randomBytes } from 'node:crypto';
-import { chmodSync, closeSync, openSync } from 'node:fs';
-import { mcp } from '@better-auth/mcp';
-import { oauthProvider } from '@better-auth/oauth-provider';
-import type { OAuthOptions, Scope } from '@better-auth/oauth-provider';
-import { grantScopes } from '@boxxy/contract';
-import { betterAuth } from 'better-auth';
-import type { BetterAuthPlugin } from 'better-auth';
-import { getMigrations } from 'better-auth/db/migration';
-import { Kysely, sql } from 'kysely';
-import { PUBLIC_DOOR_PATHS } from '../http/public-door-paths.ts';
-import { APPROVAL_WINDOW_SECONDS } from './approval-window-seconds.ts';
-import { createOwnerPlugin } from './create-owner-plugin.ts';
-import { deriveTokenHash } from './derive-token-hash.ts';
-import type { MCPAuthDatabase } from './mcp-auth-database.ts';
-import type { MCPAuthSchema } from './mcp-auth-schema.ts';
-
-interface MCPAuthOptions {
-  readonly dbPath: string;
-
-  // The public origin: the issuer, with `<origin>/mcp` the one resource tokens
-  // are bound to. Null opens the store to manage clients and grants only, with
-  // no resource served.
-  readonly origin: string | null;
-
-  // How long a rotated refresh token still answers with its successor; 0
-  // treats any reuse as replay.
-  readonly refreshReuseSeconds?: number;
-
-  // Opens the database file, which the entry wires to boxxy's SQLite opener.
-  readonly openDatabase: (path: string) => MCPAuthDatabase;
-}
-
-// The owner's session lives only to carry one approval from the code page
-// through consent to the code exchange, which every token detaches from.
-const OWNER_SESSION_SECONDS = 3 * APPROVAL_WINDOW_SECONDS;
-
-export async function openMCPAuth(options: MCPAuthOptions) {
-  // better-auth reads these when it builds its context; an empty endpoint
-  // turns its telemetry into a no-op.
-  process.env['BETTER_AUTH_TELEMETRY'] = '0';
-  process.env['BETTER_AUTH_TELEMETRY_ENDPOINT'] = '';
-
-  // The file holds token hashes and owner sessions, so only its owner may
-  // read it. SQLite gives the WAL and shared-memory files the main file's
-  // mode, so the mode is set before SQLite opens it.
-  closeSync(openSync(options.dbPath, 'a', 0o600));
-  chmodSync(options.dbPath, 0o600);
-
-  const database = options.openDatabase(options.dbPath);
-
-  const db = new Kysely<MCPAuthSchema>({ dialect: database.dialect });
-
-  const providerOptions: OAuthOptions<Scope[]> = {
-    loginPage: PUBLIC_DOOR_PATHS.browser.login,
-    consentPage: PUBLIC_DOOR_PATHS.browser.consent,
-    scopes: [...grantScopes, 'offline_access'],
-    disableJwtPlugin: true,
-    allowDynamicClientRegistration: false,
-    grantTypes: ['authorization_code', 'refresh_token'],
-
-    // boxxy serves one resource, so every client may request it.
-    enforcePerClientResources: false,
-    accessTokenExpiresIn: 3600,
-    codeExpiresIn: APPROVAL_WINDOW_SECONDS,
-    refreshTokenReuseInterval: options.refreshReuseSeconds ?? 0,
-    storeTokens: { hash: (token: string) => Promise.resolve(deriveTokenHash(token)) },
-  };
-
-  const provider =
-    options.origin === null
-      ? oauthProvider(providerOptions)
-      : mcp({ ...providerOptions, resource: `${options.origin}${PUBLIC_DOOR_PATHS.machine.mcp}` });
-
-  const baseURL = options.origin ?? 'http://127.0.0.1';
-
-  const auth = betterAuth({
-    baseURL,
-    basePath: '/',
-    secret: randomBytes(32).toString('base64url'),
-    database: { db, type: 'sqlite' },
-    telemetry: { enabled: false },
-    logger: { level: 'error' },
-    rateLimit: { enabled: false },
-
-    // Every open runs the migrations itself, so the startup schema check
-    // would only report the tables a fresh database has yet to get.
-    advanced: { database: { validateSchema: false } },
-    trustedOrigins: [baseURL],
-    session: { expiresIn: OWNER_SESSION_SECONDS, disableSessionRefresh: true },
-
-    // The provider's own endpoint types do not satisfy the plugin type under
-    // exactOptionalPropertyTypes, so boxxy reaches them over HTTP-shaped requests.
-    // oxlint-disable-next-line typescript/consistent-type-assertions -- better-auth's plugin type fails its own type under exactOptionalPropertyTypes
-    plugins: [provider as BetterAuthPlugin, createOwnerPlugin()],
-  });
-
-  const migrations = await getMigrations(auth.options);
-
-  await migrations.runMigrations();
-
-  await sql`create table if not exists boxxy_grant_use (grant_id text primary key not null, last_used_at text not null)`.execute(
-    db,
-  );
-
-  await sql`create table if not exists boxxy_passkey (id text primary key not null, public_key text not null, counter integer not null, transports text not null, created_at text not null, last_used_at text)`.execute(
-    db,
-  );
-
-  await sql`create table if not exists boxxy_enrollment_token (token_hash text primary key not null, created_at text not null, expires_at text not null)`.execute(
-    db,
-  );
-
-  // A resource served under an earlier public URL stays a valid token target
-  // until its row goes.
-  if (options.origin !== null) {
-    await db
-      .deleteFrom('oauthResource')
-      .where('identifier', '!=', `${options.origin}${PUBLIC_DOOR_PATHS.machine.mcp}`)
-      .execute();
-  }
-
-  // better-auth starts its context when it is built, and that start queries
-  // the database, so a close before it settles destroys the driver under it.
-  await auth.$context;
-
-  return {
-    auth,
-    db,
-    async close(): Promise<void> {
-      await db.destroy();
-
-      database.close();
-    },
-  };
-}

package/src/auth/passkey-script.ts

@@ -1,50 +0,0 @@
-// Copied from atc: packages/mcp/src/auth/passkey-script.ts at commit 4fe647cf.
-
-import { createHash } from 'node:crypto';
-
-// runs the `create` or `get` ceremony a page's `boxxy-passkey` block holds and posts
-// the credential's JSON with the form; a prompt that ends without one leaves the
-// form unsent and the button ready again.
-const SOURCE = `(() => {
-  const data = document.getElementById('boxxy-passkey');
-  const form = document.getElementById('boxxy-passkey-form');
-  const button = document.getElementById('boxxy-passkey-start');
-  const status = document.getElementById('boxxy-passkey-status');
-  if (data === null || form === null || button === null || status === null) return;
-  const spec = JSON.parse(data.textContent);
-  const toBytes = (value) => {
-    const base64 = value.replace(/-/g, '+').replace(/_/g, '/');
-    const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);
-    return Uint8Array.from(atob(padded), (c) => c.charCodeAt(0));
-  };
-  const toText = (buffer) => {
-    let text = '';
-    for (const byte of new Uint8Array(buffer)) text += String.fromCharCode(byte);
-    return btoa(text).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');
-  };
-  const toDescriptors = (list) => (list || []).map((item) => ({ ...item, id: toBytes(item.id) }));
-  button.addEventListener('click', async () => {
-    button.disabled = true;
-    status.textContent = '';
-    try {
-      const options = spec.options;
-      const credential = spec.mode === 'create'
-        ? await navigator.credentials.create({ publicKey: { ...options, challenge: toBytes(options.challenge), user: { ...options.user, id: toBytes(options.user.id) }, excludeCredentials: toDescriptors(options.excludeCredentials) } })
-        : await navigator.credentials.get({ publicKey: { ...options, challenge: toBytes(options.challenge), allowCredentials: toDescriptors(options.allowCredentials) } });
-      const reply = credential.response;
-      const response = spec.mode === 'create'
-        ? { clientDataJSON: toText(reply.clientDataJSON), attestationObject: toText(reply.attestationObject), transports: typeof reply.getTransports === 'function' ? reply.getTransports() : [] }
-        : { clientDataJSON: toText(reply.clientDataJSON), authenticatorData: toText(reply.authenticatorData), signature: toText(reply.signature), userHandle: reply.userHandle ? toText(reply.userHandle) : undefined };
-      form.elements.namedItem('credential').value = JSON.stringify({ id: credential.id, rawId: toText(credential.rawId), type: credential.type, response, clientExtensionResults: credential.getClientExtensionResults(), authenticatorAttachment: credential.authenticatorAttachment || undefined });
-      form.submit();
-    } catch (error) {
-      status.textContent = 'The passkey prompt ended without a passkey (' + (error && error.name ? error.name : 'Error') + '). Try again.';
-      button.disabled = false;
-    }
-  });
-})();`;
-
-export const PASSKEY_SCRIPT = {
-  source: SOURCE,
-  policySource: `'sha256-${createHash('sha256').update(SOURCE).digest('base64')}'`,
-} as const;

package/src/auth/read-client-name.ts

@@ -1,17 +0,0 @@
-// Copied from atc: packages/mcp/src/auth/read-client-name.ts at commit 4fe647cf.
-
-import type { Kysely } from 'kysely';
-import type { MCPAuthSchema } from './mcp-auth-schema.ts';
-
-export async function readClientName(
-  db: Kysely<MCPAuthSchema>,
-  clientID: string,
-): Promise<string | null> {
-  const row = await db
-    .selectFrom('oauthClient')
-    .select('name')
-    .where('clientId', '=', clientID)
-    .executeTakeFirst();
-
-  return row?.name ?? null;
-}

package/src/auth/read-client-views.ts

@@ -1,27 +0,0 @@
-// Copied from atc: packages/mcp/src/auth/read-client-views.ts at commit 4fe647cf.
-
-import type { Kysely } from 'kysely';
-import { parseJSONStrings } from '../utils/parse-json-strings.ts';
-import type { MCPAuthSchema } from './mcp-auth-schema.ts';
-
-export interface ClientView {
-  readonly clientID: string;
-  readonly name: string;
-  readonly redirectURIs: readonly string[];
-  readonly createdAt: string | null;
-}
-
-export async function readClientViews(db: Kysely<MCPAuthSchema>): Promise<readonly ClientView[]> {
-  const rows = await db
-    .selectFrom('oauthClient')
-    .select(['clientId', 'name', 'redirectUris', 'createdAt'])
-    .orderBy('createdAt')
-    .execute();
-
-  return rows.map((row) => ({
-    clientID: row.clientId,
-    name: row.name ?? '',
-    redirectURIs: parseJSONStrings(row.redirectUris) ?? [],
-    createdAt: row.createdAt,
-  }));
-}

package/src/auth/read-enrollment-token.ts

@@ -1,20 +0,0 @@
-// Copied from atc: packages/mcp/src/auth/read-enrollment-token.ts at commit 4fe647cf.
-
-import type { Kysely } from 'kysely';
-import { deriveTokenHash } from './derive-token-hash.ts';
-import type { MCPAuthSchema } from './mcp-auth-schema.ts';
-
-export async function readEnrollmentToken(
-  db: Kysely<MCPAuthSchema>,
-  token: string,
-  now: number,
-): Promise<string | null> {
-  const row = await db
-    .selectFrom('boxxy_enrollment_token')
-    .select('token_hash')
-    .where('token_hash', '=', deriveTokenHash(token))
-    .where('expires_at', '>', new Date(now).toISOString())
-    .executeTakeFirst();
-
-  return row?.token_hash ?? null;
-}

package/src/auth/read-grant-views.ts

@@ -1,53 +0,0 @@
-// Copied from atc: packages/mcp/src/auth/read-grant-views.ts at commit 4fe647cf.
-
-import { grantScopes } from '@boxxy/contract';
-import type { GrantScope } from '@boxxy/contract';
-import type { Kysely } from 'kysely';
-import { parseJSONStrings } from '../utils/parse-json-strings.ts';
-import type { MCPAuthSchema } from './mcp-auth-schema.ts';
-
-export interface GrantView {
-  readonly grantID: string;
-  readonly clientID: string;
-  readonly clientName: string;
-  readonly scopes: readonly GrantScope[];
-  readonly createdAt: string;
-  readonly lastUsedAt: string | null;
-}
-
-export async function readGrantViews(db: Kysely<MCPAuthSchema>): Promise<readonly GrantView[]> {
-  const rows = await db
-    .selectFrom('oauthRefreshToken')
-    .leftJoin('oauthClient', 'oauthClient.clientId', 'oauthRefreshToken.clientId')
-    .leftJoin(
-      'boxxy_grant_use',
-      'boxxy_grant_use.grant_id',
-      'oauthRefreshToken.authorizationCodeId',
-    )
-    .select([
-      'oauthRefreshToken.authorizationCodeId',
-      'oauthRefreshToken.clientId',
-      'oauthRefreshToken.scopes',
-      'oauthRefreshToken.createdAt',
-      'oauthClient.name',
-      'boxxy_grant_use.last_used_at',
-    ])
-    .where('oauthRefreshToken.revoked', 'is', null)
-    .where('oauthRefreshToken.expiresAt', '>', new Date().toISOString())
-    .where('oauthRefreshToken.authorizationCodeId', 'is not', null)
-    .orderBy('oauthRefreshToken.createdAt')
-    .execute();
-
-  return rows.map((row) => {
-    const scopes = parseJSONStrings(row.scopes) ?? [];
-
-    return {
-      grantID: row.authorizationCodeId ?? '',
-      clientID: row.clientId,
-      clientName: row.name ?? '',
-      scopes: grantScopes.filter((scope) => scopes.includes(scope)),
-      createdAt: row.createdAt,
-      lastUsedAt: row.last_used_at,
-    };
-  });
-}

package/src/auth/read-owner-session-id.ts

@@ -1,16 +0,0 @@
-// Copied from atc: packages/mcp/src/auth/read-owner-session-id.ts at commit 4fe647cf.
-
-import type { HTTPServerContext } from './types.ts';
-
-export async function readOwnerSessionID(
-  ctx: HTTPServerContext,
-  cookie: string | null,
-): Promise<string | null> {
-  if (cookie === null || cookie === '') {
-    return null;
-  }
-
-  const found = await ctx.store.auth.api.getSession({ headers: new Headers({ cookie }) });
-
-  return found?.session.id ?? null;
-}

package/src/auth/record-refused-exchange.ts

@@ -1,74 +0,0 @@
-// Copied from atc: packages/mcp/src/auth/record-refused-exchange.ts at commit 4fe647cf.
-
-import { isRecord } from '../utils/is-record.ts';
-import { normalizeClientName } from './normalize-client-name.ts';
-import { readClientName } from './read-client-name.ts';
-import type { HTTPServerContext, Requester, TokenExchangeReason } from './types.ts';
-
-interface RefusedExchange {
-  // The refused request's body, read only for its client id.
-  readonly contentType: string | null;
-  readonly body: string;
-  readonly response: Response;
-  readonly path: string;
-  readonly requester: Requester;
-}
-
-// The event holds better-auth's error code from a fixed list, and the
-// client's id and name only for a client boxxy holds. It never holds the
-// code, the verifier, or a token the request carried.
-export async function recordRefusedExchange(
-  ctx: Pick<HTTPServerContext, 'store' | 'security'>,
-  exchange: RefusedExchange,
-): Promise<void> {
-  const code = await readErrorCode(exchange.response);
-
-  const reason = isTokenExchangeError(code) ? code : 'other';
-  const clientID = findClientID(exchange);
-  const storedName = clientID === null ? null : await readClientName(ctx.store.db, clientID);
-
-  ctx.security.record({
-    kind: 'token_exchange',
-    outcome: 'rejected',
-    reason,
-    path: exchange.path,
-    requester: exchange.requester,
-    ...(clientID === null || storedName === null
-      ? {}
-      : { client: { id: clientID, name: normalizeClientName(storedName) } }),
-  });
-}
-
-async function readErrorCode(response: Response): Promise<string | null> {
-  try {
-    const body: unknown = await response.clone().json();
-
-    return isRecord(body) && typeof body['error'] === 'string' ? body['error'] : null;
-  } catch {
-    return null;
-  }
-}
-
-// A fixed list keeps the reason a value a log rule can match, whatever text
-// a future better-auth puts in its error field.
-const TOKEN_EXCHANGE_ERRORS: ReadonlySet<string> = new Set([
-  'invalid_request',
-  'invalid_client',
-  'invalid_grant',
-  'unauthorized_client',
-  'unsupported_grant_type',
-  'invalid_scope',
-  'invalid_target',
-]);
-
-function isTokenExchangeError(code: string | null): code is TokenExchangeReason {
-  return code !== null && TOKEN_EXCHANGE_ERRORS.has(code);
-}
-
-function findClientID(exchange: RefusedExchange): string | null {
-  if (exchange.contentType?.startsWith('application/x-www-form-urlencoded') !== true) {
-    return null;
-  }
-
-  return new URLSearchParams(exchange.body).get('client_id');
-}

package/src/auth/remove-client.ts

@@ -1,33 +0,0 @@
-// Copied from atc: packages/mcp/src/auth/remove-client.ts at commit 4fe647cf.
-
-import type { Kysely } from 'kysely';
-import type { MCPAuthSchema } from './mcp-auth-schema.ts';
-
-export function removeClient(db: Kysely<MCPAuthSchema>, clientID: string): Promise<boolean> {
-  return db.transaction().execute(async (trx) => {
-    const grants = await trx
-      .selectFrom('oauthRefreshToken')
-      .select('authorizationCodeId')
-      .where('clientId', '=', clientID)
-      .execute();
-
-    const grantIDs = grants.flatMap((grant) =>
-      grant.authorizationCodeId === null ? [] : [grant.authorizationCodeId],
-    );
-
-    if (grantIDs.length > 0) {
-      await trx.deleteFrom('boxxy_grant_use').where('grant_id', 'in', grantIDs).execute();
-    }
-
-    await trx.deleteFrom('oauthAccessToken').where('clientId', '=', clientID).execute();
-    await trx.deleteFrom('oauthRefreshToken').where('clientId', '=', clientID).execute();
-    await trx.deleteFrom('oauthConsent').where('clientId', '=', clientID).execute();
-
-    const removed = await trx
-      .deleteFrom('oauthClient')
-      .where('clientId', '=', clientID)
-      .executeTakeFirst();
-
-    return removed.numDeletedRows > 0n;
-  });
-}

package/src/auth/remove-owner-session.ts

@@ -1,11 +0,0 @@
-// Copied from atc: packages/mcp/src/auth/remove-owner-session.ts at commit 4fe647cf.
-
-import type { Kysely } from 'kysely';
-import type { MCPAuthSchema } from './mcp-auth-schema.ts';
-
-export async function removeOwnerSession(
-  db: Kysely<MCPAuthSchema>,
-  sessionID: string,
-): Promise<void> {
-  await db.deleteFrom('session').where('id', '=', sessionID).execute();
-}

package/src/auth/render-consent-page.ts

@@ -1,61 +0,0 @@
-// Copied from atc: packages/mcp/src/auth/render-consent-page.ts at commit 4fe647cf.
-
-import type { GrantScope } from '@boxxy/contract';
-import { PUBLIC_DOOR_PATHS } from '../http/public-door-paths.ts';
-import { toHTMLText } from './to-html-text.ts';
-
-interface ConsentPageView {
-  // The signed authorization query the page posts back.
-  readonly oauthQuery: string;
-  readonly clientName: string;
-  readonly redirectURI: string;
-  readonly scopes: readonly GrantScope[];
-}
-
-const SCOPE_LABELS: Readonly<Record<GrantScope, string>> = {
-  read: 'Read items, their cost and times, and the runner status',
-  write:
-    'File and change items, add notes, retry, wake and close them, and pause or resume the runner',
-};
-
-// Only reading starts granted; every scope that lets the client act starts
-// withheld.
-const GRANTED_BY_DEFAULT: ReadonlySet<GrantScope> = new Set<GrantScope>(['read']);
-
-export function renderConsentPage(view: ConsentPageView): string {
-  const scopeRows = view.scopes
-    .map((scope) => {
-      const checked = GRANTED_BY_DEFAULT.has(scope) ? ' checked' : '';
-
-      return `<label><input type="checkbox" name="scope" value="${scope}"${checked}> ${toHTMLText(SCOPE_LABELS[scope])}</label>`;
-    })
-    .join('\n');
-
-  return `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>Choose what to allow</title>
-<style>
-body { font-family: system-ui, sans-serif; max-width: 32rem; margin: 3rem auto; padding: 0 1rem; line-height: 1.5; }
-label { display: block; margin: 0.25rem 0; }
-code { word-break: break-all; }
-button { font: inherit; margin-right: 0.5rem; }
-</style>
-</head>
-<body>
-<h1>Choose what to allow</h1>
-<p><strong>${toHTMLText(view.clientName)}</strong> returns to <code>${toHTMLText(view.redirectURI)}</code> with the access you allow here.</p>
-<form method="post" action="${PUBLIC_DOOR_PATHS.browser.consent}">
-<input type="hidden" name="oauth_query" value="${toHTMLText(view.oauthQuery)}">
-<fieldset>
-<legend>Allow it to</legend>
-${scopeRows}
-</fieldset>
-<p><button type="submit" name="decision" value="approve">Allow</button><button type="submit" name="decision" value="deny">Deny</button></p>
-</form>
-</body>
-</html>
-`;
-}

package/src/auth/render-enroll-page.ts

@@ -1,59 +0,0 @@
-// Copied from atc: packages/mcp/src/auth/render-enroll-page.ts at commit 4fe647cf.
-
-import { PUBLIC_DOOR_PATHS } from '../http/public-door-paths.ts';
-import { PASSKEY_SCRIPT } from './passkey-script.ts';
-import { toHTMLText } from './to-html-text.ts';
-import { toScriptJSON } from './to-script-json.ts';
-
-interface EnrollPageView {
-  // The enrollment token the owner typed, once it checked out, with the
-  // WebAuthn creation options for its challenge; null asks for the token.
-  readonly ceremony: { readonly token: string; readonly options: unknown } | null;
-  readonly error: string | null;
-
-  // The token a link carried, to fill in the form; absent when the owner types it
-  readonly prefill?: string;
-}
-
-export function renderEnrollPage(view: EnrollPageView): string {
-  const error = view.error === null ? '' : `<p class="error">${toHTMLText(view.error)}</p>`;
-
-  const step =
-    view.ceremony === null
-      ? `<p>Type the enrollment token that <code>boxxy auth enroll</code> printed, or open the link it printed.</p>
-<form method="post" action="${PUBLIC_DOOR_PATHS.browser.enroll}">
-<label>Enrollment token <input name="token" autocomplete="off" autofocus required${view.prefill === undefined ? '' : ` value="${toHTMLText(view.prefill)}"`}></label>
-<button type="submit">Continue</button>
-</form>`
-      : `<p>Create a passkey for boxxy. Your device asks you to verify yourself.</p>
-<script type="application/json" id="boxxy-passkey">${toScriptJSON({ mode: 'create', options: view.ceremony.options })}</script>
-<form method="post" action="${PUBLIC_DOOR_PATHS.browser.enroll}" id="boxxy-passkey-form">
-<input type="hidden" name="token" value="${toHTMLText(view.ceremony.token)}">
-<input type="hidden" name="credential" value="">
-<button type="button" id="boxxy-passkey-start" autofocus>Create a passkey</button>
-</form>
-<p id="boxxy-passkey-status" class="error" role="status"></p>
-<script>${PASSKEY_SCRIPT.source}</script>`;
-
-  return `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>Enroll a passkey for boxxy</title>
-<style>
-body { font-family: system-ui, sans-serif; max-width: 32rem; margin: 3rem auto; padding: 0 1rem; line-height: 1.5; }
-input[name="token"] { font: inherit; font-family: ui-monospace, monospace; padding: 0.25rem; width: 100%; }
-.error { color: #b00020; }
-code { word-break: break-all; }
-button { font: inherit; }
-</style>
-</head>
-<body>
-<h1>Enroll a passkey for boxxy</h1>
-${error}
-${step}
-</body>
-</html>
-`;
-}

package/src/auth/render-login-page.ts

@@ -1,58 +0,0 @@
-// Copied from atc: packages/mcp/src/auth/render-login-page.ts at commit 4fe647cf.
-
-import { PUBLIC_DOOR_PATHS } from '../http/public-door-paths.ts';
-import { PASSKEY_SCRIPT } from './passkey-script.ts';
-import { toHTMLText } from './to-html-text.ts';
-import { toScriptJSON } from './to-script-json.ts';
-
-interface LoginPageView {
-  // The signed authorization query the page posts back.
-  readonly oauthQuery: string;
-  readonly clientName: string;
-  readonly redirectURI: string;
-
-  // The WebAuthn request options for this page's challenge, or null when
-  // no passkey is enrolled, so there is nothing to sign in with.
-  readonly options: unknown;
-  readonly error: string | null;
-}
-
-export function renderLoginPage(view: LoginPageView): string {
-  const error = view.error === null ? '' : `<p class="error">${toHTMLText(view.error)}</p>`;
-
-  const signIn =
-    view.options === null
-      ? `<p class="error">No passkey is enrolled, so nobody can sign in. On the host that runs boxxy, run <code>boxxy auth enroll</code>, then follow what it prints.</p>`
-      : `<script type="application/json" id="boxxy-passkey">${toScriptJSON({ mode: 'get', options: view.options })}</script>
-<form method="post" action="${PUBLIC_DOOR_PATHS.browser.login}" id="boxxy-passkey-form">
-<input type="hidden" name="oauth_query" value="${toHTMLText(view.oauthQuery)}">
-<input type="hidden" name="credential" value="">
-<button type="button" id="boxxy-passkey-start" autofocus>Sign in with a passkey</button>
-</form>
-<p id="boxxy-passkey-status" class="error" role="status"></p>
-<script>${PASSKEY_SCRIPT.source}</script>`;
-
-  return `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>Sign in to boxxy</title>
-<style>
-body { font-family: system-ui, sans-serif; max-width: 32rem; margin: 3rem auto; padding: 0 1rem; line-height: 1.5; }
-.error { color: #b00020; }
-code { word-break: break-all; }
-button { font: inherit; }
-</style>
-</head>
-<body>
-<h1>Sign in to boxxy</h1>
-<p><strong>${toHTMLText(view.clientName)}</strong> wants access to your boxxy work.</p>
-<p>After approval it returns to <code>${toHTMLText(view.redirectURI)}</code>.</p>
-<p>Sign in with your passkey. You choose what to allow on the next page.</p>
-${error}
-${signIn}
-</body>
-</html>
-`;
-}

package/src/auth/revoke-grant.ts

@@ -1,25 +0,0 @@
-// Copied from atc: packages/mcp/src/auth/revoke-grant.ts at commit 4fe647cf.
-
-import type { Kysely } from 'kysely';
-import type { MCPAuthSchema } from './mcp-auth-schema.ts';
-
-export function revokeGrant(db: Kysely<MCPAuthSchema>, grantID: string): Promise<boolean> {
-  return db.transaction().execute(async (trx) => {
-    const grant = await trx
-      .selectFrom('oauthRefreshToken')
-      .select('clientId')
-      .where('authorizationCodeId', '=', grantID)
-      .executeTakeFirst();
-
-    if (grant === undefined) {
-      return false;
-    }
-
-    await trx.deleteFrom('oauthAccessToken').where('authorizationCodeId', '=', grantID).execute();
-    await trx.deleteFrom('oauthRefreshToken').where('authorizationCodeId', '=', grantID).execute();
-    await trx.deleteFrom('oauthConsent').where('clientId', '=', grant.clientId).execute();
-    await trx.deleteFrom('boxxy_grant_use').where('grant_id', '=', grantID).execute();
-
-    return true;
-  });
-}

package/src/auth/to-html-text.ts

@@ -1,10 +0,0 @@
-// Copied from atc: packages/mcp/src/auth/to-html-text.ts at commit 4fe647cf.
-
-export function toHTMLText(text: string): string {
-  return text
-    .replaceAll('&', '&')
-    .replaceAll('<', '&lt;')
-    .replaceAll('>', '&gt;')
-    .replaceAll('"', '&quot;')
-    .replaceAll("'", '&#39;');
-}