@briefgate/mcp 0.7.4 → 0.7.6

package/dist/http-auth.d.ts

@@ -3,7 +3,9 @@ import type { BriefGateConfig } from './client.js';
 export interface HttpAuthOptions {
     /** Hostname this server is published under, or undefined when it is loopback-only. */
     publicHost?: string | undefined;
-    /** BRIEFGATE_API_KEY, used only when the server is NOT published. */
+    /** The operator's own key, from --api-key, used only when NOT published. */
+    cliApiKey?: string | undefined;
+    /** The operator's own key, from BRIEFGATE_API_KEY, used only when NOT published. */
     envApiKey?: string | undefined;
     baseUrl: string;
 }
@@ -11,13 +13,17 @@ export interface HttpAuthOptions {
  * The API key for one request.
  *
  * Published mode reads it from the Authorization header and nowhere else. The
- * environment fallback exists so a laptop can run `--http` against the
- * operator's own key; on a public endpoint it would hand that key to whoever
- * asked first, so it is switched off there rather than merely discouraged.
+ * --api-key / environment / locally-stored-credential fallbacks exist so a
+ * laptop can run `--http` against the operator's own key (or one saved by
+ * `login`); on a public endpoint any of those would hand that key to whoever
+ * asked first, so all three are switched off there rather than merely
+ * discouraged.
  *
  * An absent key is not an error here. `initialize` and `tools/list` have to work
  * without one, or no registry can read the tool list before anybody signs up —
- * a tool call with no key fails later with a sentence saying so.
+ * a tool call with no key fails later with a sentence saying so. Published
+ * mode is stricter about this at the HTTP layer (see index.ts): a request with
+ * no Bearer token never reaches this function at all.
  */
 export declare function configForRequest(req: IncomingMessage, opts: HttpAuthOptions): BriefGateConfig;
 /**
@@ -27,5 +33,33 @@ export declare function configForRequest(req: IncomingMessage, opts: HttpAuthOpt
  * pointed at this box by whoever noticed the IP.
  */
 export declare function isAllowedHost(host: string, publicHost?: string | undefined): boolean;
+/**
+ * Published mode allows any origin: the resource is protected by the Bearer
+ * token, which — unlike a cookie — a browser never attaches on its own, so
+ * restricting origins buys no extra security and would only stop legitimate
+ * OAuth-registered clients (claude.ai and others) from connecting. Loopback
+ * mode keeps the strict allowlist: there, a plain `--http` run may still be
+ * relying on an operator key with no per-request Bearer at all, so the origin
+ * check is doing real work.
+ */
 export declare function isAllowedOrigin(origin: string, publicHost?: string | undefined): boolean;
+export declare const WELL_KNOWN_PROTECTED_RESOURCE_PATH = "/.well-known/oauth-protected-resource";
+export declare const WELL_KNOWN_PROTECTED_RESOURCE_MCP_PATH = "/.well-known/oauth-protected-resource/mcp";
+export interface ProtectedResourceMetadata {
+    resource: string;
+    authorization_servers: string[];
+    bearer_methods_supported: string[];
+    scopes_supported: string[];
+    resource_name: string;
+}
+export declare function protectedResourceMetadata(publicHost: string, authServer: string): ProtectedResourceMetadata;
+/**
+ * Value for the `WWW-Authenticate` header on a 401, pointing the client at
+ * the resource metadata above so it knows where to start the OAuth dance.
+ * Pass `error: 'invalid_token'` when the caller did send a Bearer token and
+ * it was specifically rejected (expired/revoked) — as opposed to no token
+ * having been sent at all — so the client knows to refresh rather than just
+ * retry the same one.
+ */
+export declare function wwwAuthenticateHeader(publicHost: string, error?: 'invalid_token'): string;
 //# sourceMappingURL=http-auth.d.ts.map

package/dist/http-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-auth.d.ts","sourceRoot":"","sources":["../src/http-auth.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,MAAM,WAAW,eAAe;IAC9B,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,GAAG,eAAe,CAO7F;AAID;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAIpF;AAMD,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAGxF"}
+{"version":3,"file":"http-auth.d.ts","sourceRoot":"","sources":["../src/http-auth.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAGnD,MAAM,WAAW,eAAe;IAC9B,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,oFAAoF;IACpF,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,GAAG,eAAe,CAkB7F;AAID;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAIpF;AAMD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAGxF;AAWD,eAAO,MAAM,kCAAkC,0CAA0C,CAAC;AAC1F,eAAO,MAAM,sCAAsC,8CAA8C,CAAC;AAElG,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,yBAAyB,CAQ3B;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,eAAe,GAAG,MAAM,CAGzF"}

package/dist/http-auth.js

@@ -1,20 +1,36 @@
+import { resolveApiKey } from './credentials.js';
 /**
  * The API key for one request.
  *
  * Published mode reads it from the Authorization header and nowhere else. The
- * environment fallback exists so a laptop can run `--http` against the
- * operator's own key; on a public endpoint it would hand that key to whoever
- * asked first, so it is switched off there rather than merely discouraged.
+ * --api-key / environment / locally-stored-credential fallbacks exist so a
+ * laptop can run `--http` against the operator's own key (or one saved by
+ * `login`); on a public endpoint any of those would hand that key to whoever
+ * asked first, so all three are switched off there rather than merely
+ * discouraged.
  *
  * An absent key is not an error here. `initialize` and `tools/list` have to work
  * without one, or no registry can read the tool list before anybody signs up —
- * a tool call with no key fails later with a sentence saying so.
+ * a tool call with no key fails later with a sentence saying so. Published
+ * mode is stricter about this at the HTTP layer (see index.ts): a request with
+ * no Bearer token never reaches this function at all.
  */
 export function configForRequest(req, opts) {
     const header = req.headers['authorization'];
     const bearer = typeof header === 'string' ? /^Bearer\s+(\S+)$/i.exec(header.trim())?.[1] : undefined;
-    const apiKey = opts.publicHost ? (bearer ?? '') : (bearer ?? opts.envApiKey ?? '');
-    return { apiKey, baseUrl: opts.baseUrl };
+    if (opts.publicHost) {
+        return { apiKey: bearer ?? '', baseUrl: opts.baseUrl, apiKeySource: bearer ? 'header' : 'none' };
+    }
+    if (bearer)
+        return { apiKey: bearer, baseUrl: opts.baseUrl, apiKeySource: 'header' };
+    const { apiKey, source } = resolveApiKey({
+        explicitApiKey: opts.cliApiKey,
+        explicitSource: 'flag',
+        envApiKey: opts.envApiKey,
+        baseUrl: opts.baseUrl,
+        allowFileFallback: true,
+    });
+    return { apiKey, baseUrl: opts.baseUrl, apiKeySource: source };
 }
 const LOOPBACK_HOST_RE = /^(?:localhost|127\.0\.0\.1|\[::1\])(?::\d+)?$/;
 /**
@@ -31,9 +47,49 @@ export function isAllowedHost(host, publicHost) {
 }
 /** Loopback origins and claude.ai, which proxies MCP for its own clients. */
 const SAFE_ORIGIN_RE = /^https?:\/\/(?:localhost|127\.0\.0\.1|\[::1\])(?::\d+)?$|^https:\/\/claude\.ai$/;
+/**
+ * Published mode allows any origin: the resource is protected by the Bearer
+ * token, which — unlike a cookie — a browser never attaches on its own, so
+ * restricting origins buys no extra security and would only stop legitimate
+ * OAuth-registered clients (claude.ai and others) from connecting. Loopback
+ * mode keeps the strict allowlist: there, a plain `--http` run may still be
+ * relying on an operator key with no per-request Bearer at all, so the origin
+ * check is doing real work.
+ */
 export function isAllowedOrigin(origin, publicHost) {
-    if (publicHost && origin.toLowerCase() === `https://${publicHost.toLowerCase()}`)
+    if (publicHost)
         return true;
     return SAFE_ORIGIN_RE.test(origin);
 }
+// ─── OAuth 2.1 protected-resource metadata (published mode only) ─────────────
+//
+// Lets an MCP client (claude.ai's connector UI) discover, from the server URL
+// alone, which authorization server to run OAuth against — RFC 9728 as
+// profiled by the MCP authorization spec.
+// RFC 9728 defines the bare path; the MCP authorization spec also has clients
+// look under a path scoped to the resource itself (the resource being `/mcp`
+// here) — both must serve identical content.
+export const WELL_KNOWN_PROTECTED_RESOURCE_PATH = '/.well-known/oauth-protected-resource';
+export const WELL_KNOWN_PROTECTED_RESOURCE_MCP_PATH = `${WELL_KNOWN_PROTECTED_RESOURCE_PATH}/mcp`;
+export function protectedResourceMetadata(publicHost, authServer) {
+    return {
+        resource: `https://${publicHost}/mcp`,
+        authorization_servers: [authServer],
+        bearer_methods_supported: ['header'],
+        scopes_supported: ['admin', 'intakes:read', 'intakes:write', 'secrets:read'],
+        resource_name: 'BriefGate MCP',
+    };
+}
+/**
+ * Value for the `WWW-Authenticate` header on a 401, pointing the client at
+ * the resource metadata above so it knows where to start the OAuth dance.
+ * Pass `error: 'invalid_token'` when the caller did send a Bearer token and
+ * it was specifically rejected (expired/revoked) — as opposed to no token
+ * having been sent at all — so the client knows to refresh rather than just
+ * retry the same one.
+ */
+export function wwwAuthenticateHeader(publicHost, error) {
+    const resourceMetadata = `resource_metadata="https://${publicHost}${WELL_KNOWN_PROTECTED_RESOURCE_PATH}"`;
+    return error ? `Bearer error="${error}", ${resourceMetadata}` : `Bearer ${resourceMetadata}`;
+}
 //# sourceMappingURL=http-auth.js.map

package/dist/http-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"http-auth.js","sourceRoot":"","sources":["../src/http-auth.ts"],"names":[],"mappings":"AAeA;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAoB,EAAE,IAAqB;IAC1E,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5C,MAAM,MAAM,GACV,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAExF,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IACnF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,gBAAgB,GAAG,+CAA+C,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,UAA+B;IACzE,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5D,IAAI,UAAU,IAAI,WAAW,KAAK,UAAU,CAAC,WAAW,EAAE;QAAE,OAAO,IAAI,CAAC;IACxE,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,6EAA6E;AAC7E,MAAM,cAAc,GAClB,iFAAiF,CAAC;AAEpF,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,UAA+B;IAC7E,IAAI,UAAU,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,WAAW,UAAU,CAAC,WAAW,EAAE,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9F,OAAO,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC"}
+{"version":3,"file":"http-auth.js","sourceRoot":"","sources":["../src/http-auth.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAYjD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAoB,EAAE,IAAqB;IAC1E,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5C,MAAM,MAAM,GACV,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAExF,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnG,CAAC;IACD,IAAI,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;IAErF,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC;QACvC,cAAc,EAAE,IAAI,CAAC,SAAS;QAC9B,cAAc,EAAE,MAAM;QACtB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,iBAAiB,EAAE,IAAI;KACxB,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,gBAAgB,GAAG,+CAA+C,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,UAA+B;IACzE,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5D,IAAI,UAAU,IAAI,WAAW,KAAK,UAAU,CAAC,WAAW,EAAE;QAAE,OAAO,IAAI,CAAC;IACxE,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,6EAA6E;AAC7E,MAAM,cAAc,GAClB,iFAAiF,CAAC;AAEpF;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,UAA+B;IAC7E,IAAI,UAAU;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAED,gFAAgF;AAChF,EAAE;AACF,8EAA8E;AAC9E,uEAAuE;AACvE,0CAA0C;AAE1C,8EAA8E;AAC9E,6EAA6E;AAC7E,6CAA6C;AAC7C,MAAM,CAAC,MAAM,kCAAkC,GAAG,uCAAuC,CAAC;AAC1F,MAAM,CAAC,MAAM,sCAAsC,GAAG,GAAG,kCAAkC,MAAM,CAAC;AAUlG,MAAM,UAAU,yBAAyB,CACvC,UAAkB,EAClB,UAAkB;IAElB,OAAO;QACL,QAAQ,EAAE,WAAW,UAAU,MAAM;QACrC,qBAAqB,EAAE,CAAC,UAAU,CAAC;QACnC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;QACpC,gBAAgB,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,CAAC;QAC5E,aAAa,EAAE,eAAe;KAC/B,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAkB,EAAE,KAAuB;IAC/E,MAAM,gBAAgB,GAAG,8BAA8B,UAAU,GAAG,kCAAkC,GAAG,CAAC;IAC1G,OAAO,KAAK,CAAC,CAAC,CAAC,iBAAiB,KAAK,MAAM,gBAAgB,EAAE,CAAC,CAAC,CAAC,UAAU,gBAAgB,EAAE,CAAC;AAC/F,CAAC"}