@boxxy/auth-oauth 0.2.7 → 0.2.8

package/dist/auth/create-auth-admin.d.ts

@@ -19,9 +19,6 @@ export type RemoveClientAnswer = {
     readonly kind: 'removed';
 } | {
     readonly kind: 'not-found';
-} | {
-    readonly kind: 'ambiguous';
-    readonly name: string;
 };
 export interface EnrollmentLink {
     readonly token: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boxxy/auth-oauth",
-  "version": "0.2.7",
+  "version": "0.2.8",
   "description": "boxxy's public door: an OAuth server for the owner's MCP endpoint, with passkey sign-in",
   "homepage": "https://github.com/zgeoff/boxxy/tree/main/adapters/auth-oauth#readme",
   "bugs": "https://github.com/zgeoff/boxxy/issues",
@@ -31,9 +31,9 @@
     "typecheck": "tsrs --noEmit"
   },
   "dependencies": {
-    "@boxxy/contract": "0.2.7",
+    "@boxxy/contract": "0.2.8",
     "@zgeoff/kysely-bun-sqlite": "0.3.2",
-    "@zgeoff/mcp-auth": "0.1.0",
+    "@zgeoff/mcp-auth": "0.2.1",
     "@zgeoff/std": "0.4.3",
     "elysia": "2.0.0-rc.3",
     "exact-mirror": "1.2.7",

package/src/auth/create-auth-admin.ts

@@ -1,7 +1,7 @@
 import type { GrantScope } from '@boxxy/contract';
 import { grantScopes } from '@boxxy/contract';
 import { MCPAuthError } from '@zgeoff/mcp-auth';
-import type { ClientView, GrantID, GrantView, MCPAuth } from '@zgeoff/mcp-auth';
+import type { ClientView, GrantID, GrantView, MCPAuth, OAuthClientID } from '@zgeoff/mcp-auth';
 import { toTagged } from '@zgeoff/std';
 
 export interface AuthAdminInput {
@@ -16,12 +16,7 @@ export type AddClientAnswer =
   | { readonly kind: 'refused'; readonly message: string }
   | { readonly kind: 'conflict'; readonly name: string };
 
-export type RemoveClientAnswer =
-  | { readonly kind: 'removed' }
-  | { readonly kind: 'not-found' }
-
-  // another client has the same name, and the OAuth server removes a client by its name
-  | { readonly kind: 'ambiguous'; readonly name: string };
+export type RemoveClientAnswer = { readonly kind: 'removed' } | { readonly kind: 'not-found' };
 
 export interface EnrollmentLink {
   readonly token: string;
@@ -72,17 +67,13 @@ export function createAuthAdmin(input: AuthAdminInput): AuthAdmin {
     },
     listClients: () => auth.clients.list(),
     removeClient: async (clientID) => {
-      const clients = await auth.clients.list();
-
-      const answer = pickClientToRemove(clients, clientID);
-
-      if (answer.kind === 'remove') {
-        await auth.clients.remove(answer.name);
+      try {
+        await auth.clients.remove(toTagged<OAuthClientID>(clientID));
 
         return { kind: 'removed' };
+      } catch (error) {
+        return pickRemoveRefusal(error);
       }
-
-      return answer;
     },
     listGrants: async () => {
       const grants = await auth.grants.list();
@@ -114,24 +105,14 @@ function pickAddRefusal(error: unknown, name: string): AddClientAnswer {
   throw error;
 }
 
-type ClientToRemove =
-  | { readonly kind: 'remove'; readonly name: string }
-  | Exclude<RemoveClientAnswer, { readonly kind: 'removed' }>;
-
-function pickClientToRemove(clients: readonly ClientView[], clientID: string): ClientToRemove {
-  const client = clients.find((view) => view.clientID === clientID);
-
-  if (client === undefined) {
+// The package refuses an unknown client ID with a coded error; any other error is not the owner's
+// input.
+function pickRemoveRefusal(error: unknown): RemoveClientAnswer {
+  if (error instanceof MCPAuthError && error.code === 'not-found') {
     return { kind: 'not-found' };
   }
 
-  const isShared = clients.some(
-    (view) => view.name === client.name && view.clientID !== client.clientID,
-  );
-
-  return isShared
-    ? { kind: 'ambiguous', name: client.name }
-    : { kind: 'remove', name: client.name };
+  throw error;
 }
 
 function toAuthGrantView(grant: GrantView): AuthGrantView {

package/src/auth/format-security-event.ts

@@ -1,6 +1,5 @@
-import { DEFAULT_PATHS } from '@zgeoff/mcp-auth';
+import { DEFAULT_PATHS, normalizeClientName } from '@zgeoff/mcp-auth';
 import type { SecurityEvent } from '@zgeoff/mcp-auth';
-import { normalizeClientName } from './normalize-client-name.ts';
 
 // The IDs in an event are tagged strings, and a line needs only their text.
 type LoggedSecurityEvent = Omit<SecurityEvent, 'client' | 'correlationID'> & {

package/dist/auth/normalize-client-name.d.ts

@@ -1 +0,0 @@
-export declare function normalizeClientName(raw: unknown, fallback?: string, maxLength?: number): string;

package/src/auth/normalize-client-name.ts

@@ -1,20 +0,0 @@
-export function normalizeClientName(
-  raw: unknown,
-  fallback = 'unnamed client',
-  maxLength = 100,
-): string {
-  if (typeof raw !== 'string') {
-    return fallback;
-  }
-
-  const folded = raw
-    .replaceAll(/[\t\n\v\f\r]/gu, ' ')
-    .replaceAll(/[\p{Cc}\p{Cf}]/gu, '')
-    .replaceAll(/\s+/gu, ' ')
-    .trim();
-
-  // The cut counts code points, so it never splits a surrogate pair.
-  const cut = folded.replace(new RegExp(`^(?<kept>.{${maxLength}}).+$`, 'su'), '$<kept>').trim();
-
-  return cut === '' ? fallback : cut;
-}