@centia-io/mcp-server 1.0.18 → 1.0.19

package/centia-api.json

@@ -3013,6 +3013,41 @@
                 }
             }
         },
+        "/api/v4/oauth/guest": {
+            "post": {
+                "tags": [
+                    "OAuth"
+                ],
+                "description": "Get a guest token.",
+                "operationId": "postGuest",
+                "requestBody": {
+                    "description": "Get a guest token. A default user must be present.",
+                    "required": true,
+                    "content": {
+                        "application/json": {
+                            "schema": {
+                                "$ref": "#/components/schemas/OAuthGuest"
+                            }
+                        }
+                    }
+                },
+                "responses": {
+                    "201": {
+                        "description": "Created",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "$ref": "#/components/schemas/OAuthResponse"
+                                }
+                            }
+                        }
+                    },
+                    "400": {
+                        "description": "Bad request"
+                    }
+                }
+            }
+        },
         "/api/v4/ogc/database/{database}": {
             "get": {
                 "tags": [
@@ -6894,6 +6929,34 @@
                 },
                 "type": "object"
             },
+            "OAuthGuest": {
+                "description": "Guest token request payload.",
+                "required": [
+                    "client_id",
+                    "database"
+                ],
+                "properties": {
+                    "database": {
+                        "title": "Database",
+                        "description": "Database name the guest token will be created for.",
+                        "type": "string",
+                        "example": "my_database"
+                    },
+                    "client_id": {
+                        "title": "Client id",
+                        "description": "OAuth client id.",
+                        "type": "string",
+                        "example": "MTQ0NjJkZmQ5OTM2NDE1ZTZjNGZmZjI3"
+                    },
+                    "client_secret": {
+                        "title": "Client secret",
+                        "description": "OAuth client secret.",
+                        "type": "string",
+                        "example": "xxx"
+                    }
+                },
+                "type": "object"
+            },
             "Outbox": {
                 "description": "",
                 "required": [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@centia-io/mcp-server",
-  "version": "1.0.18",
+  "version": "1.0.19",
   "publishConfig": {
     "access": "public"
   },

package/skills/centia-auth-model/SKILL.md

@@ -31,6 +31,25 @@ Forbidden:
 - manual OAuth implementation
 - provisioning API calls from browser runtime
 
+## Public (anonymous) access without sign-in
+
+When an app must call the API before any user has signed in, use the **guest token flow**: SDK class `GuestFlow` (`POST /api/v4/oauth/guest`; MCP tool `postGuest`).
+
+```ts
+import { GuestFlow } from '@centia-io/sdk'
+const flow = new GuestFlow({ host, clientId, database, clientSecret? })
+await flow.signIn()  // stores access/refresh tokens; Sql/Rpc/Gql now run as the default user
+flow.signOut()       // clears tokens
+```
+
+- Body: `database`, `client_id`, and `client_secret` only when the OAuth client is confidential (public clients omit it).
+- No `Authorization` header. Returns the normal OAuth response (`access_token`, `refresh_token`, `token_type: bearer`, `expires_in`), refreshable with the standard refresh flow.
+- The token is issued for the database's **default user** (`default_user=true`, see `centia-privileges`) and carries exactly that user's privileges — the same identity anonymous OGC/OWS requests get.
+- Prerequisites: a default user must exist on the database (otherwise 404 `NO_DEFAULT_USER_FOUND`) and an OAuth client must be registered (`postClient`); unknown client → 401 `invalid_grant`, wrong secret → 401 `invalid_client`.
+- Use it for read-only/public UIs and for token-only endpoints (Feature, SQL, GraphQL, RPC) that need a bearer even for public data. Never grant the default user write or admin privileges to make a guest app "work".
+- In browsers use a **public** client so no secret ships in the bundle; switch to `CodeFlow` once the user signs in.
+- Errors are thrown as plain `Error` with status and response body, like the other auth flows — not `CentiaApiError`. `GuestFlow` ships in `@centia-io/sdk` >= 0.2.14 (unreleased as of 2026-09-11; latest is 0.2.13).
+
 ## Server and CLI
 
 Allowed methods:
@@ -63,6 +82,7 @@ Forbidden:
 
 - Browser app: `CodeFlow`
 - Browser signup: `SignUp`
+- Browser/public access before sign-in: `GuestFlow`
 - Backend app: `PasswordFlow`
 - Provisioning: `PasswordFlow` or access token
 - CLI: `PasswordFlow`

package/skills/centia-delivery/SKILL.md

@@ -39,7 +39,7 @@ Query and API:
 
 Auth and access:
 
-- `postOauth`, `postDevice`
+- `postOauth`, `postDevice`, `postGuest`
 - `getUser`, `postUser`, `patchUser`, `deleteUsers`
 - `getRule`, `postRule`, `patchRule`, `deleteRule`
 - `getPrivileges`, `patchPrivileges`

package/skills/centia-ogc/SKILL.md

@@ -52,6 +52,7 @@ Same per-layer model as WMS/WFS (`centia-privileges`): anonymous callers read la
 | Existing `Read/write` collection, identity without privilege | 403 `INSUFFICIENT_PRIVILEGES` |
 | Geofence deny | 403 `FORBIDDEN` |
 | Bad/unknown parameter, bad CRS, interval datetime, items on a raster | 400 |
+| Map backend (MapServer) failure, e.g. missing mapfile | 502 `MAP_BACKEND_ERROR` (JSON, never an HTML page with 200) |
 
 `/collections` simply omits what the caller may not read. Errors use the v4 JSON shape `{"success":false,"message":…,"code":…,"errorCode":…}`.
 

package/skills/centia-runtime-sdk/SKILL.md

@@ -32,7 +32,7 @@ Prefer exports:
 - `Gql`
 - `createApi`
 - `createSqlBuilder`
-- `CodeFlow`, `PasswordFlow`, `SignUp` (by runtime context)
+- `CodeFlow`, `PasswordFlow`, `GuestFlow`, `SignUp` (by runtime context, see `centia-auth-model`)
 
 ## GraphQL notes