@coffer-org/server 1.8.0 → 1.10.0

package/dist/auth-api.d.ts

@@ -6,6 +6,7 @@ declare module 'fastify' {
     }
 }
 export declare const PUBLIC_API_PATHS: string[];
+export declare function startPasswordSession(reply: FastifyReply, login: string, password: string): Promise<AuthUser | null>;
 export declare function resolveRequestUser(req: FastifyRequest): Promise<AuthUser | null>;
 export declare function requireAdmin(req: FastifyRequest, reply: FastifyReply): boolean;
 export declare function registerAuthApi(app: FastifyInstance): Promise<void>;

package/dist/auth-api.js

@@ -1,5 +1,7 @@
 import { field } from '@coffer-org/sdk/fields';
 import { countUsers, createUser, findUserByLogin, findUserById, getPasswordHash, listUsers, updateUser, deleteUser, countAdmins, createSession, resolveSession, deleteSession, createApiToken, resolveApiToken, listApiTokens, revokeApiToken, } from "./auth-store.js";
+import { resolveAccessToken } from "./oauth-store.js";
+import { mcpResource } from "./public-url.js";
 import { verifyPassword } from "./auth-crypto.js";
 import { maskSecrets, preserveSecrets } from "./field-masking.js";
 import { rowMatch } from "./records-api.js";
@@ -24,10 +26,21 @@ function setCookie(reply, value, maxAgeSec) {
     const secure = process.env['NODE_ENV'] === 'production' ? '; Secure' : '';
     reply.header('set-cookie', `${COOKIE_NAME}=${value}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${maxAgeSec}${secure}`);
 }
+export async function startPasswordSession(reply, login, password) {
+    if (!login || !password)
+        return null;
+    const row = await findUserByLogin(login);
+    if (!row || row.disabled || !(await verifyPassword(password, row.passwordHash)))
+        return null;
+    const { raw } = await createSession(row.id, SESSION_TTL_MS);
+    setCookie(reply, raw, SESSION_TTL_MS / 1000);
+    return row;
+}
 export async function resolveRequestUser(req) {
     const auth = req.headers.authorization;
     if (auth?.startsWith('Bearer ')) {
-        return resolveApiToken(auth.slice('Bearer '.length));
+        const raw = auth.slice('Bearer '.length);
+        return (await resolveApiToken(raw)) ?? (await resolveAccessToken(raw, await mcpResource(req)));
     }
     const sid = readCookie(req, COOKIE_NAME);
     if (!sid)
@@ -73,13 +86,10 @@ export async function registerAuthApi(app) {
         const body = (req.body ?? {});
         if (!body.login || !body.password)
             return reply.code(422).send({ issues: [{ field: 'login', code: 'required' }] });
-        const row = await findUserByLogin(body.login);
-        if (!row || row.disabled || !(await verifyPassword(body.password, row.passwordHash))) {
+        const user = await startPasswordSession(reply, body.login, body.password);
+        if (!user)
             return reply.code(401).send({ error: 'invalid_credentials' });
-        }
-        const { raw } = await createSession(row.id, SESSION_TTL_MS);
-        setCookie(reply, raw, SESSION_TTL_MS / 1000);
-        return publicUser(row);
+        return publicUser(user);
     });
     app.post('/api/auth/logout', async (req, reply) => {
         const sid = readCookie(req, COOKIE_NAME);

package/dist/entity-schema.d.ts

@@ -22,4 +22,7 @@ export declare const MsgLogSchema: EntitySchema<any, never, import("@mikro-orm/c
 export declare const UserSchema: EntitySchema<any, never, import("@mikro-orm/core").EntityCtor<any>>;
 export declare const SessionSchema: EntitySchema<any, never, import("@mikro-orm/core").EntityCtor<any>>;
 export declare const ApiTokenSchema: EntitySchema<any, never, import("@mikro-orm/core").EntityCtor<any>>;
+export declare const OAuthClientSchema: EntitySchema<any, never, import("@mikro-orm/core").EntityCtor<any>>;
+export declare const OAuthCodeSchema: EntitySchema<any, never, import("@mikro-orm/core").EntityCtor<any>>;
+export declare const OAuthTokenSchema: EntitySchema<any, never, import("@mikro-orm/core").EntityCtor<any>>;
 export declare const systemEntities: EntitySchema[];

package/dist/entity-schema.js

@@ -225,9 +225,49 @@ export const ApiTokenSchema = new EntitySchema({
         revoked: { type: 'integer' },
     },
 });
+export const OAuthClientSchema = new EntitySchema({
+    name: '_OAuthClient',
+    tableName: '_oauth_clients',
+    properties: {
+        client_id: { type: 'text', primary: true },
+        client_name: { type: 'text' },
+        redirect_uris: { type: 'text' },
+        created_at: { type: 'text' },
+    },
+});
+export const OAuthCodeSchema = new EntitySchema({
+    name: '_OAuthCode',
+    tableName: '_oauth_codes',
+    properties: {
+        code_hash: { type: 'text', primary: true },
+        client_id: { type: 'text' },
+        user_id: { type: 'integer' },
+        redirect_uri: { type: 'text' },
+        code_challenge: { type: 'text' },
+        resource: { type: 'text' },
+        expires_at: { type: 'text' },
+        created_at: { type: 'text' },
+    },
+});
+export const OAuthTokenSchema = new EntitySchema({
+    name: '_OAuthToken',
+    tableName: '_oauth_tokens',
+    properties: {
+        token_hash: { type: 'text', primary: true },
+        kind: { type: 'text' },
+        client_id: { type: 'text' },
+        user_id: { type: 'integer' },
+        resource: { type: 'text' },
+        expires_at: { type: 'text' },
+        created_at: { type: 'text' },
+        last_used_at: { type: 'text', nullable: true },
+        revoked: { type: 'integer' },
+    },
+});
 export const systemEntities = [
     EventSchema, PluginRowSchema, MigrationRowSchema, SeedRowSchema,
     EmbeddingSchema, PluginStateSchema, MsgLogSchema,
     UserSchema, SessionSchema, ApiTokenSchema,
+    OAuthClientSchema, OAuthCodeSchema, OAuthTokenSchema,
     ThreadMessageSchema,
 ];

package/dist/index.js

@@ -21,6 +21,8 @@ import { registerPluginsApi } from "./plugins-api.js";
 import { pluginHooks, HttpError } from "./plugin-hooks.js";
 import { registerAuthApi, resolveRequestUser, requireAdmin, PUBLIC_API_PATHS } from "./auth-api.js";
 import { registerMcpHttp } from "./mcp-http.js";
+import { registerOAuthApi } from "./oauth-api.js";
+import { baseUrl } from "./public-url.js";
 import { discoverPluginAssets, discoverRuntime } from "./plugin-discovery.js";
 import { checkLatestVersion, resolveUpdateTarget, resolveAllUpdateTargets, resolveRuntimeTarget, runNpmInstall, } from "./plugin-updates.js";
 import { buildClientSchema } from "./schema-api.js";
@@ -67,14 +69,19 @@ app.addHook('onSend', async (req, reply, payload) => {
     return payload;
 });
 app.addHook('onRequest', async (req, reply) => {
-    const gated = req.url.startsWith('/api/') || req.url.startsWith('/uploads/') || req.url === '/mcp' || req.url.startsWith('/mcp?');
+    const isMcp = req.url === '/mcp' || req.url.startsWith('/mcp?');
+    const gated = req.url.startsWith('/api/') || req.url.startsWith('/uploads/') || isMcp;
     if (!gated)
         return;
     if (PUBLIC_API_PATHS.some((p) => req.url.startsWith(p)))
         return;
     const user = await resolveRequestUser(req);
-    if (!user)
+    if (!user) {
+        if (isMcp) {
+            reply.header('WWW-Authenticate', `Bearer resource_metadata="${await baseUrl(req)}/.well-known/oauth-protected-resource"`);
+        }
         return reply.code(401).send({ error: 'unauthorized' });
+    }
     req.user = user;
 });
 app.post('/api/upload', async (req, reply) => {
@@ -440,6 +447,7 @@ app.delete('/api/:library/:type/:id', (req, reply) => guard(reply, async () => {
     }
 }));
 await registerAuthApi(app);
+registerOAuthApi(app);
 await registerMcpHttp(app);
 await registerPluginsApi(app);
 const WEB_DIST = process.env.WEB_DIST;

package/dist/oauth-api.d.ts

@@ -0,0 +1,2 @@
+import type { FastifyInstance } from 'fastify';
+export declare function registerOAuthApi(app: FastifyInstance): void;

package/dist/oauth-api.js

@@ -0,0 +1,281 @@
+import { createCode, findClient, issueTokens, listGrants, redeemCode, registerClient, revokeGrant, rotateRefresh, } from "./oauth-store.js";
+import { resolveRequestUser, startPasswordSession } from "./auth-api.js";
+import { baseUrl, mcpResource } from "./public-url.js";
+import { getLogger } from "./log.js";
+const log = getLogger('oauth');
+const DEFAULT_REDIRECT_ALLOW = [
+    'https://claude.ai/api/mcp/auth_callback',
+    'https://claude.com/api/mcp/auth_callback',
+];
+function redirectAllowlist() {
+    const extra = (process.env['OAUTH_REDIRECT_ALLOW'] ?? '')
+        .split(',')
+        .map((s) => s.trim())
+        .filter(Boolean);
+    return [...DEFAULT_REDIRECT_ALLOW, ...extra];
+}
+function allowInsecure() {
+    return process.env['OAUTH_ALLOW_INSECURE'] === '1';
+}
+const hits = new Map();
+const RATE_WINDOW_MS = 60_000;
+function rateLimited(key, max) {
+    const now = Date.now();
+    const cur = hits.get(key);
+    if (!cur || cur.resetAt < now) {
+        hits.set(key, { count: 1, resetAt: now + RATE_WINDOW_MS });
+        return false;
+    }
+    cur.count += 1;
+    return cur.count > max;
+}
+function esc(s) {
+    return s.replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c]);
+}
+function page(title, body) {
+    return `<!doctype html><html lang="en"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>${esc(title)}</title>
+<style>
+ body{font:16px/1.5 system-ui,sans-serif;background:#f6f6f5;color:#1a1a19;margin:0;
+      display:flex;min-height:100vh;align-items:center;justify-content:center}
+ .card{background:#fff;border:1px solid #e3e3e0;border-radius:12px;padding:28px;max-width:26rem;width:calc(100% - 2rem)}
+ h1{font-size:1.15rem;margin:0 0 .75rem}
+ p{margin:.5rem 0;color:#57564f}
+ label{display:block;margin:.75rem 0 .25rem;font-size:.85rem;color:#57564f}
+ input{width:100%;box-sizing:border-box;padding:.55rem .65rem;border:1px solid #d5d4cf;border-radius:8px;font:inherit}
+ button{margin-top:1.25rem;width:100%;padding:.6rem;border:0;border-radius:8px;background:#1a1a19;color:#fff;font:inherit;cursor:pointer}
+ .muted{font-size:.85rem}
+ .err{color:#b42318}
+ @media(prefers-color-scheme:dark){body{background:#1a1a19;color:#f6f6f5}.card{background:#232320;border-color:#3a3a36}
+  p,label{color:#a8a79f}input{background:#1a1a19;color:#f6f6f5;border-color:#3a3a36}button{background:#f6f6f5;color:#1a1a19}}
+</style></head><body><div class="card">${body}</div></body></html>`;
+}
+function hidden(params) {
+    return Object.entries(params)
+        .map(([k, v]) => `<input type="hidden" name="${esc(k)}" value="${esc(v)}">`)
+        .join('');
+}
+function readAuthzParams(src) {
+    const s = (k) => (typeof src[k] === 'string' ? src[k] : '');
+    return {
+        client_id: s('client_id'),
+        redirect_uri: s('redirect_uri'),
+        state: s('state'),
+        code_challenge: s('code_challenge'),
+        resource: s('resource'),
+    };
+}
+function loginForm(p, clientName, error) {
+    return page('Sign in to Coffer', `<h1>Sign in to Coffer</h1>
+     <p><b>${esc(clientName)}</b> wants access to your data. Sign in to continue.</p>
+     ${error ? `<p class="err">${esc(error)}</p>` : ''}
+     <form method="post" action="/oauth/authorize">
+       ${hidden({ ...p, action: 'login' })}
+       <label for="login">Login</label><input id="login" name="login" autocomplete="username" autofocus>
+       <label for="password">Password</label><input id="password" name="password" type="password" autocomplete="current-password">
+       <button type="submit">Sign in</button>
+     </form>`);
+}
+function consentForm(p, clientName, user) {
+    const roleLine = user.role === 'admin'
+        ? 'Your account is an <b>administrator</b> — the app will also get the admin-only tools of installed plugins, including settings.'
+        : 'Your account is a <b>member</b> — the app gets read/write access to your records, but no admin tools.';
+    return page('Authorize access', `<h1>Authorize ${esc(clientName)}</h1>
+     <p>It will be able to read, create, update and delete records in your Coffer as <b>${esc(user.login)}</b>.</p>
+     <p class="muted">${roleLine}</p>
+     <form method="post" action="/oauth/authorize">
+       ${hidden({ ...p, action: 'approve' })}
+       <button type="submit">Authorize</button>
+     </form>
+     <p class="muted">You can revoke this at any time in Settings → Connected apps.</p>`);
+}
+function redirectWithError(reply, p, error) {
+    const url = new URL(p.redirect_uri);
+    url.searchParams.set('error', error);
+    if (p.state)
+        url.searchParams.set('state', p.state);
+    return reply.redirect(url.toString(), 302);
+}
+export function registerOAuthApi(app) {
+    app.addContentTypeParser('application/x-www-form-urlencoded', { parseAs: 'string' }, (_req, body, done) => {
+        try {
+            done(null, Object.fromEntries(new URLSearchParams(body)));
+        }
+        catch (e) {
+            done(e, undefined);
+        }
+    });
+    app.get('/.well-known/oauth-protected-resource', async (req) => ({
+        resource: await mcpResource(req),
+        authorization_servers: [await baseUrl(req)],
+        bearer_methods_supported: ['header'],
+    }));
+    app.get('/.well-known/oauth-protected-resource/mcp', async (req) => ({
+        resource: await mcpResource(req),
+        authorization_servers: [await baseUrl(req)],
+        bearer_methods_supported: ['header'],
+    }));
+    const asMetadata = async (req) => {
+        const base = await baseUrl(req);
+        return {
+            issuer: base,
+            authorization_endpoint: `${base}/oauth/authorize`,
+            token_endpoint: `${base}/oauth/token`,
+            registration_endpoint: `${base}/oauth/register`,
+            response_types_supported: ['code'],
+            grant_types_supported: ['authorization_code', 'refresh_token'],
+            code_challenge_methods_supported: ['S256'],
+            token_endpoint_auth_methods_supported: ['none'],
+        };
+    };
+    app.get('/.well-known/oauth-authorization-server', async (req) => asMetadata(req));
+    app.get('/.well-known/oauth-authorization-server/mcp', async (req) => asMetadata(req));
+    app.post('/oauth/register', async (req, reply) => {
+        if (rateLimited(`reg:${req.ip}`, 10))
+            return reply.code(429).send({ error: 'rate_limited' });
+        const body = (req.body ?? {});
+        const uris = Array.isArray(body.redirect_uris) ? body.redirect_uris.filter((u) => typeof u === 'string') : [];
+        if (uris.length === 0) {
+            return reply.code(400).send({ error: 'invalid_redirect_uri', error_description: 'redirect_uris is required' });
+        }
+        const allow = redirectAllowlist();
+        const bad = uris.find((u) => !allow.includes(u));
+        if (bad) {
+            log.warn(`registration rejected: redirect_uri not allowlisted (${bad})`);
+            return reply
+                .code(400)
+                .send({ error: 'invalid_redirect_uri', error_description: `redirect_uri not allowed: ${bad}` });
+        }
+        const client = await registerClient({ clientName: body.client_name?.slice(0, 200) || 'MCP client', redirectUris: uris });
+        log.info(`registered client ${client.clientId} (${client.clientName})`);
+        return reply.code(201).send({
+            client_id: client.clientId,
+            client_name: client.clientName,
+            redirect_uris: client.redirectUris,
+            token_endpoint_auth_method: 'none',
+            grant_types: ['authorization_code', 'refresh_token'],
+            response_types: ['code'],
+        });
+    });
+    async function validateAuthz(p) {
+        if (!p.client_id || !p.redirect_uri) {
+            return { ok: false, html: page('Invalid request', '<h1>Invalid request</h1><p>Missing client_id or redirect_uri.</p>') };
+        }
+        const client = await findClient(p.client_id);
+        if (!client) {
+            return { ok: false, html: page('Unknown client', '<h1>Unknown client</h1><p>This application is not registered.</p>') };
+        }
+        if (!client.redirectUris.includes(p.redirect_uri)) {
+            return { ok: false, html: page('Invalid redirect', '<h1>Invalid redirect</h1><p>redirect_uri does not match this client.</p>') };
+        }
+        return { ok: true, clientName: client.clientName };
+    }
+    app.get('/oauth/authorize', async (req, reply) => {
+        const p = readAuthzParams((req.query ?? {}));
+        const check = await validateAuthz(p);
+        if (!check.ok)
+            return reply.code(400).type('text/html').send(check.html);
+        const q = (req.query ?? {});
+        if (q['response_type'] !== 'code')
+            return redirectWithError(reply, p, 'unsupported_response_type');
+        if (q['code_challenge_method'] !== 'S256' || !p.code_challenge) {
+            return redirectWithError(reply, p, 'invalid_request');
+        }
+        const user = await resolveRequestUser(req);
+        const html = user ? consentForm(p, check.clientName, user) : loginForm(p, check.clientName);
+        return reply.type('text/html').send(html);
+    });
+    app.post('/oauth/authorize', async (req, reply) => {
+        const body = (req.body ?? {});
+        const p = readAuthzParams(body);
+        const check = await validateAuthz(p);
+        if (!check.ok)
+            return reply.code(400).type('text/html').send(check.html);
+        if (body['action'] === 'login') {
+            if (rateLimited(`login:${req.ip}`, 20))
+                return reply.code(429).type('text/html').send(page('Slow down', '<h1>Too many attempts</h1>'));
+            const user = await startPasswordSession(reply, String(body['login'] ?? ''), String(body['password'] ?? ''));
+            if (!user)
+                return reply.code(401).type('text/html').send(loginForm(p, check.clientName, 'Wrong login or password.'));
+            return reply.type('text/html').send(consentForm(p, check.clientName, user));
+        }
+        const user = await resolveRequestUser(req);
+        if (!user)
+            return reply.code(401).type('text/html').send(loginForm(p, check.clientName, 'Your session expired. Sign in again.'));
+        if (body['action'] !== 'approve')
+            return redirectWithError(reply, p, 'access_denied');
+        if (!p.code_challenge)
+            return redirectWithError(reply, p, 'invalid_request');
+        const code = await createCode({
+            clientId: p.client_id,
+            userId: user.id,
+            redirectUri: p.redirect_uri,
+            codeChallenge: p.code_challenge,
+            resource: p.resource || (await mcpResource(req)),
+        });
+        const url = new URL(p.redirect_uri);
+        url.searchParams.set('code', code);
+        if (p.state)
+            url.searchParams.set('state', p.state);
+        log.info(`authorized client ${p.client_id} for user ${user.login}`);
+        return reply.redirect(url.toString(), 302);
+    });
+    app.get('/api/oauth/grants', async (req, reply) => {
+        if (!req.user)
+            return reply.code(401).send({ error: 'unauthorized' });
+        return listGrants(req.user.id);
+    });
+    app.delete('/api/oauth/grants/:clientId', async (req, reply) => {
+        if (!req.user)
+            return reply.code(401).send({ error: 'unauthorized' });
+        const { clientId } = req.params;
+        const revoked = await revokeGrant(req.user.id, clientId);
+        if (revoked === 0)
+            return reply.code(404).send({ error: 'not_found' });
+        log.info(`revoked ${revoked} token(s) of client ${clientId} for user ${req.user.login}`);
+        return { ok: true };
+    });
+    app.post('/oauth/token', async (req, reply) => {
+        reply.header('cache-control', 'no-store');
+        if (rateLimited(`token:${req.ip}`, 60))
+            return reply.code(429).send({ error: 'slow_down' });
+        if (!(await baseUrl(req)).startsWith('https://') && !allowInsecure()) {
+            log.error('refusing to issue tokens over plain HTTP (set PUBLIC_URL to the https origin, or OAUTH_ALLOW_INSECURE=1 for local testing)');
+            return reply.code(400).send({ error: 'invalid_request', error_description: 'https required' });
+        }
+        const body = (req.body ?? {});
+        const s = (k) => (typeof body[k] === 'string' ? body[k] : '');
+        const grant = s('grant_type');
+        if (grant === 'refresh_token') {
+            const tokens = await rotateRefresh(s('refresh_token'), s('client_id'));
+            if (!tokens)
+                return reply.code(400).send({ error: 'invalid_grant' });
+            return reply.send({
+                access_token: tokens.accessToken,
+                refresh_token: tokens.refreshToken,
+                token_type: 'Bearer',
+                expires_in: tokens.expiresIn,
+            });
+        }
+        if (grant !== 'authorization_code') {
+            return reply.code(400).send({ error: 'unsupported_grant_type' });
+        }
+        const result = await redeemCode({
+            code: s('code'),
+            clientId: s('client_id'),
+            redirectUri: s('redirect_uri'),
+            codeVerifier: s('code_verifier'),
+        });
+        if (!result.ok)
+            return reply.code(400).send({ error: result.error });
+        const tokens = await issueTokens({ clientId: s('client_id'), userId: result.user.id, resource: result.resource });
+        return reply.send({
+            access_token: tokens.accessToken,
+            refresh_token: tokens.refreshToken,
+            token_type: 'Bearer',
+            expires_in: tokens.expiresIn,
+            scope: result.user.role,
+        });
+    });
+}

package/dist/oauth-store.d.ts

@@ -0,0 +1,56 @@
+import { type AuthUser } from './auth-store.ts';
+export declare const CODE_TTL_MS = 60000;
+export declare const ACCESS_TTL_MS: number;
+export declare const REFRESH_TTL_MS: number;
+export interface OAuthClient {
+    clientId: string;
+    clientName: string;
+    redirectUris: string[];
+    createdAt: string;
+}
+export declare function registerClient(input: {
+    clientName: string;
+    redirectUris: string[];
+}): Promise<OAuthClient>;
+export declare function findClient(clientId: string): Promise<OAuthClient | null>;
+export declare function createCode(input: {
+    clientId: string;
+    userId: number;
+    redirectUri: string;
+    codeChallenge: string;
+    resource: string;
+}): Promise<string>;
+export type CodeRedemption = {
+    ok: true;
+    user: AuthUser;
+    resource: string;
+} | {
+    ok: false;
+    error: 'invalid_grant';
+};
+export declare function redeemCode(input: {
+    code: string;
+    clientId: string;
+    redirectUri: string;
+    codeVerifier: string;
+}): Promise<CodeRedemption>;
+export interface IssuedTokens {
+    accessToken: string;
+    refreshToken: string;
+    expiresIn: number;
+}
+export declare function issueTokens(input: {
+    clientId: string;
+    userId: number;
+    resource: string;
+}): Promise<IssuedTokens>;
+export declare function resolveAccessToken(raw: string, expectedResource: string): Promise<AuthUser | null>;
+export declare function rotateRefresh(raw: string, clientId: string): Promise<IssuedTokens | null>;
+export interface Grant {
+    clientId: string;
+    clientName: string;
+    createdAt: string;
+    lastUsedAt: string | null;
+}
+export declare function listGrants(userId: number): Promise<Grant[]>;
+export declare function revokeGrant(userId: number, clientId: string): Promise<number>;

package/dist/oauth-store.js

@@ -0,0 +1,159 @@
+import { createHash, randomUUID, timingSafeEqual } from 'node:crypto';
+import { getEm } from "./db.js";
+import { generateToken, hashToken } from "./auth-crypto.js";
+import { findUserById } from "./auth-store.js";
+export const CODE_TTL_MS = 60_000;
+export const ACCESS_TTL_MS = 60 * 60_000;
+export const REFRESH_TTL_MS = 30 * 24 * 60 * 60_000;
+function toClient(row) {
+    return {
+        clientId: row.client_id,
+        clientName: row.client_name,
+        redirectUris: JSON.parse(row.redirect_uris),
+        createdAt: row.created_at,
+    };
+}
+export async function registerClient(input) {
+    const em = getEm().fork();
+    const row = {
+        client_id: randomUUID(),
+        client_name: input.clientName,
+        redirect_uris: JSON.stringify(input.redirectUris),
+        created_at: new Date().toISOString(),
+    };
+    em.create('_OAuthClient', row);
+    await em.flush();
+    return toClient(row);
+}
+export async function findClient(clientId) {
+    const em = getEm().fork();
+    const row = (await em.findOne('_OAuthClient', { client_id: clientId }));
+    return row ? toClient(row) : null;
+}
+export async function createCode(input) {
+    const em = getEm().fork();
+    const raw = generateToken();
+    em.create('_OAuthCode', {
+        code_hash: hashToken(raw),
+        client_id: input.clientId,
+        user_id: input.userId,
+        redirect_uri: input.redirectUri,
+        code_challenge: input.codeChallenge,
+        resource: input.resource,
+        expires_at: new Date(Date.now() + CODE_TTL_MS).toISOString(),
+        created_at: new Date().toISOString(),
+    });
+    await em.flush();
+    return raw;
+}
+function verifyPkce(verifier, challenge) {
+    const computed = createHash('sha256').update(verifier).digest('base64url');
+    const a = Buffer.from(computed);
+    const b = Buffer.from(challenge);
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+export async function redeemCode(input) {
+    const em = getEm().fork();
+    const row = (await em.findOne('_OAuthCode', { code_hash: hashToken(input.code) }));
+    if (!row)
+        return { ok: false, error: 'invalid_grant' };
+    em.remove(row);
+    await em.flush();
+    if (row.client_id !== input.clientId)
+        return { ok: false, error: 'invalid_grant' };
+    if (row.redirect_uri !== input.redirectUri)
+        return { ok: false, error: 'invalid_grant' };
+    if (new Date(row.expires_at).getTime() < Date.now())
+        return { ok: false, error: 'invalid_grant' };
+    if (!verifyPkce(input.codeVerifier, row.code_challenge))
+        return { ok: false, error: 'invalid_grant' };
+    const user = await findUserById(row.user_id);
+    if (!user || user.disabled)
+        return { ok: false, error: 'invalid_grant' };
+    return { ok: true, user, resource: row.resource };
+}
+export async function issueTokens(input) {
+    const em = getEm().fork();
+    const now = new Date().toISOString();
+    const accessToken = generateToken();
+    const refreshToken = generateToken();
+    for (const [raw, kind, ttl] of [
+        [accessToken, 'access', ACCESS_TTL_MS],
+        [refreshToken, 'refresh', REFRESH_TTL_MS],
+    ]) {
+        em.create('_OAuthToken', {
+            token_hash: hashToken(raw),
+            kind,
+            client_id: input.clientId,
+            user_id: input.userId,
+            resource: input.resource,
+            expires_at: new Date(Date.now() + ttl).toISOString(),
+            created_at: now,
+            last_used_at: null,
+            revoked: 0,
+        });
+    }
+    await em.flush();
+    return { accessToken, refreshToken, expiresIn: Math.floor(ACCESS_TTL_MS / 1000) };
+}
+async function findLiveToken(raw, kind) {
+    const em = getEm().fork();
+    const row = (await em.findOne('_OAuthToken', { token_hash: hashToken(raw), kind, revoked: 0 }));
+    if (!row)
+        return null;
+    if (new Date(row.expires_at).getTime() < Date.now())
+        return null;
+    return row;
+}
+export async function resolveAccessToken(raw, expectedResource) {
+    const row = await findLiveToken(raw, 'access');
+    if (!row)
+        return null;
+    if (row.resource !== expectedResource)
+        return null;
+    const user = await findUserById(row.user_id);
+    if (!user || user.disabled)
+        return null;
+    await getEm()
+        .fork()
+        .nativeUpdate('_OAuthToken', { token_hash: row.token_hash }, { last_used_at: new Date().toISOString() });
+    return user;
+}
+export async function rotateRefresh(raw, clientId) {
+    const row = await findLiveToken(raw, 'refresh');
+    if (!row || row.client_id !== clientId)
+        return null;
+    const user = await findUserById(row.user_id);
+    if (!user || user.disabled)
+        return null;
+    await getEm()
+        .fork()
+        .nativeUpdate('_OAuthToken', { token_hash: row.token_hash }, { revoked: 1 });
+    return issueTokens({ clientId, userId: row.user_id, resource: row.resource });
+}
+export async function listGrants(userId) {
+    const em = getEm().fork();
+    const rows = (await em.find('_OAuthToken', { user_id: userId, revoked: 0 }));
+    const byClient = new Map();
+    for (const r of rows) {
+        const prev = byClient.get(r.client_id);
+        const lastUsed = [prev?.lastUsedAt, r.last_used_at].filter(Boolean).sort().pop() ?? null;
+        byClient.set(r.client_id, {
+            clientId: r.client_id,
+            clientName: prev?.clientName ?? r.client_id,
+            createdAt: prev && prev.createdAt < r.created_at ? prev.createdAt : r.created_at,
+            lastUsedAt: lastUsed,
+        });
+    }
+    for (const [clientId, grant] of byClient) {
+        const client = await findClient(clientId);
+        if (client)
+            grant.clientName = client.clientName;
+    }
+    return [...byClient.values()];
+}
+export async function revokeGrant(userId, clientId) {
+    return getEm()
+        .fork()
+        .nativeUpdate('_OAuthToken', { user_id: userId, client_id: clientId, revoked: 0 }, { revoked: 1 });
+}

package/dist/public-url.d.ts

@@ -0,0 +1,4 @@
+import type { FastifyRequest } from 'fastify';
+export declare function invalidatePublicUrlCache(): void;
+export declare function baseUrl(req: FastifyRequest): Promise<string>;
+export declare function mcpResource(req: FastifyRequest): Promise<string>;

package/dist/public-url.js

@@ -0,0 +1,35 @@
+import { getPluginSettings } from "./plugin-runtime.js";
+const CACHE_TTL_MS = 30_000;
+let cached = null;
+export function invalidatePublicUrlCache() {
+    cached = null;
+}
+function normalize(raw) {
+    return typeof raw === 'string' ? raw.trim().replace(/\/+$/, '') : '';
+}
+async function configuredBase() {
+    if (cached && Date.now() - cached.readAt < CACHE_TTL_MS)
+        return cached.value;
+    let value = '';
+    try {
+        value = normalize((await getPluginSettings('core'))['publicUrl']);
+    }
+    catch {
+        value = '';
+    }
+    if (!value)
+        value = normalize(process.env['PUBLIC_URL']);
+    cached = { value, readAt: Date.now() };
+    return value;
+}
+export async function baseUrl(req) {
+    const configured = await configuredBase();
+    if (configured)
+        return configured;
+    const proto = req.headers['x-forwarded-proto']?.split(',')[0]?.trim() ?? req.protocol;
+    const host = req.headers['x-forwarded-host']?.split(',')[0]?.trim() ?? req.headers.host;
+    return `${proto}://${host}`;
+}
+export async function mcpResource(req) {
+    return `${await baseUrl(req)}/mcp`;
+}

package/dist/settings-write.js

@@ -2,6 +2,7 @@ import { fieldEntries, buildZodObject } from '@coffer-org/sdk/shelf';
 import { preserveTree, maskTree } from "./field-masking.js";
 import { ValidationError, NotFoundError, toIssue } from "./mutate.js";
 import { getPlugins, getPluginSettings } from "./plugin-runtime.js";
+import { invalidatePublicUrlCache } from "./public-url.js";
 export function describeSettingsFields(fields) {
     return fieldEntries(fields).map(([key, f]) => ({
         key,
@@ -35,6 +36,8 @@ export async function writePluginSettings(em, pluginId, incoming, actor, plugins
     const data = buildSettingsBody(pluginId, fields, incoming, existing);
     const row = { plugin_id: pluginId, ...data };
     await em.upsert(`_settings__${pluginId}`, row);
+    if (pluginId === 'core')
+        invalidatePublicUrlCache();
     const masked = maskTree(fields, row);
     em.create('_Event', {
         ts: new Date().toISOString(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffer-org/server",
-  "version": "1.8.0",
+  "version": "1.10.0",
   "type": "module",
   "engines": {
     "node": ">=24"
@@ -25,13 +25,14 @@
   },
   "dependencies": {
     "@coffer-org/core": "^1.4.0",
-    "@coffer-org/sdk": "^1.5.0",
+    "@coffer-org/sdk": "^1.6.0",
     "@extractus/oembed-extractor": "^4.1.0",
     "@fastify/cors": "^11.2.0",
     "@fastify/multipart": "^10.0.0",
     "@fastify/static": "^9.1.3",
     "@mikro-orm/core": "^7.1.6",
     "@mikro-orm/sqlite": "^7.1.6",
+    "@modelcontextprotocol/sdk": "^1.5.0",
     "fastify": "^5.2.1",
     "open-graph-scraper": "^6.11.0",
     "pino": "^9.14.0",