@decodo/mcp-server 1.2.6 → 1.3.0

package/build/oauth/backends/mock/subscription-api.js

@@ -0,0 +1,130 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mockSubscriptionApiRouter = exports.MockSubscriptionApi = exports.MockRequestError = void 0;
+const node_crypto_1 = require("node:crypto");
+const express_1 = __importDefault(require("express"));
+const token_exchange_1 = require("../../token-exchange");
+const ttl_store_1 = require("../../ttl-store");
+const request_jwt_1 = require("../decodo/request-jwt");
+const PENDING_TTL_MS = request_jwt_1.REQUEST_JWT.LIFETIME_SECONDS * 1000;
+const CODE_TTL_MS = 60000;
+const CODE_BYTES = 32;
+class MockRequestError extends Error {
+}
+exports.MockRequestError = MockRequestError;
+class MockSubscriptionApi {
+    constructor(publicKey, registeredClient) {
+        this.publicKey = publicKey;
+        this.registeredClient = registeredClient;
+        this.pending = new ttl_store_1.TtlStore(PENDING_TTL_MS);
+        this.codes = new ttl_store_1.TtlStore(CODE_TTL_MS);
+    }
+    validateRequest({ clientId, request }) {
+        var _a, _b;
+        const decoded = (0, request_jwt_1.verifyRequestJwt)(request, this.publicKey);
+        if (!decoded) {
+            throw new MockRequestError('request JWT signature or format is invalid');
+        }
+        const { header, claims } = decoded;
+        const now = Math.floor(Date.now() / 1000);
+        const failures = [
+            header.kid !== this.registeredClient.kid && 'kid is not registered for this client',
+            claims.aud !== request_jwt_1.REQUEST_JWT.AUDIENCE && 'aud must be subscription-api',
+            claims.client_id !== clientId && 'client_id in the JWT differs from the query',
+            clientId !== this.registeredClient.clientId && 'unknown client_id',
+            claims.redirect_uri !== this.registeredClient.redirectUri && 'redirect_uri is not the registered one',
+            claims.code_challenge_method !== request_jwt_1.REQUEST_JWT.CODE_CHALLENGE_METHOD && 'code_challenge_method must be S256',
+            ((_a = claims.code_challenge) === null || _a === void 0 ? void 0 : _a.length) !== 43 && 'code_challenge must be 43 characters',
+            !(((_b = claims.state) === null || _b === void 0 ? void 0 : _b.length) >= 16 && claims.state.length <= 255) && 'state must be 16 to 255 characters',
+            !(claims.exp > claims.iat && claims.exp - claims.iat <= request_jwt_1.REQUEST_JWT.LIFETIME_SECONDS) && 'exp must be within 120 s of iat',
+            claims.exp < now - 30 && 'request has expired',
+        ].filter((failure) => typeof failure === 'string');
+        if (failures.length > 0) {
+            throw new MockRequestError(failures.join('; '));
+        }
+        const uuid = (0, node_crypto_1.randomUUID)();
+        this.pending.set(uuid, {
+            client_id: claims.client_id,
+            redirect_uri: claims.redirect_uri,
+            state: claims.state,
+            code_challenge: claims.code_challenge,
+        });
+        return { uuid, clientName: 'Decodo MCP (mock)' };
+    }
+    pendingRequest(uuid) {
+        const pending = this.pending.get(uuid);
+        return pending && Object.assign(Object.assign({}, pending), { uuid });
+    }
+    decide({ uuid, decision, scraperApiKey }) {
+        const pending = this.pending.take(uuid);
+        if (!pending) {
+            throw new MockRequestError('Exchange request can no longer be decided.');
+        }
+        if (decision !== 'approve') {
+            return { redirectUri: pending.redirect_uri, state: pending.state, error: 'access_denied' };
+        }
+        const code = (0, node_crypto_1.randomBytes)(CODE_BYTES).toString('base64url');
+        this.codes.set(code, Object.assign(Object.assign({}, pending), { scraperApiKey }));
+        return { redirectUri: pending.redirect_uri, state: pending.state, code };
+    }
+    exchange({ clientId, code, codeVerifier }) {
+        const issued = this.codes.take(code);
+        if (!issued) {
+            return { ok: false, status: 400, appCode: token_exchange_1.TOKEN_EXCHANGE_ERROR.INVALID_GRANT };
+        }
+        if (issued.client_id !== clientId) {
+            return { ok: false, status: 403, appCode: token_exchange_1.TOKEN_EXCHANGE_ERROR.INVALID_CLIENT };
+        }
+        if ((0, node_crypto_1.createHash)('sha256').update(codeVerifier).digest('base64url') !== issued.code_challenge) {
+            return { ok: false, status: 400, appCode: token_exchange_1.TOKEN_EXCHANGE_ERROR.INVALID_GRANT };
+        }
+        return { ok: true, sapiToken: issued.scraperApiKey };
+    }
+}
+exports.MockSubscriptionApi = MockSubscriptionApi;
+const mockSubscriptionApiRouter = (api) => {
+    const router = express_1.default.Router();
+    router.use(express_1.default.json());
+    router.post('/token-exchange/request', (req, res) => {
+        var _a;
+        const { client_id: clientId, request } = (_a = req.body) !== null && _a !== void 0 ? _a : {};
+        if (typeof clientId !== 'string' || typeof request !== 'string') {
+            res.status(422).json({ status_code: 422, title: 'Unprocessable Entity', detail: 'client_id and request are required' });
+            return;
+        }
+        try {
+            const { uuid, clientName } = api.validateRequest({ clientId, request });
+            const expiresAt = new Date(Date.now() + PENDING_TTL_MS).toISOString();
+            res.status(201).json({ uuid, client_name: clientName, expires_at: expiresAt });
+        }
+        catch (error) {
+            const detail = error instanceof MockRequestError ? error.message : 'unexpected error';
+            res.status(400).json({ status_code: 400, title: 'Bad Request', detail });
+        }
+    });
+    router.post('/token-exchange/exchange', (req, res) => {
+        var _a;
+        const { client_id: clientId, code, code_verifier: codeVerifier } = (_a = req.body) !== null && _a !== void 0 ? _a : {};
+        if (typeof clientId !== 'string' || typeof code !== 'string' || typeof codeVerifier !== 'string') {
+            res.status(422).json({ status_code: 422, title: 'Unprocessable Entity', detail: 'client_id, code and code_verifier are required' });
+            return;
+        }
+        const result = api.exchange({ clientId, code, codeVerifier });
+        if (!result.ok) {
+            res.status(result.status).json({
+                status_code: result.status,
+                title: result.status === 403 ? 'Forbidden' : 'Bad Request',
+                detail: 'Exchange failed.',
+                app_code: result.appCode,
+            });
+            return;
+        }
+        res.status(200).json({ sapi_token: result.sapiToken, label: 'mock key' });
+    });
+    return router;
+};
+exports.mockSubscriptionApiRouter = mockSubscriptionApiRouter;
+//# sourceMappingURL=subscription-api.js.map

package/build/oauth/backends/mock/subscription-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subscription-api.js","sourceRoot":"","sources":["../../../../src/oauth/backends/mock/subscription-api.ts"],"names":[],"mappings":";;;;;;AAAA,6CAAkE;AAElE,sDAA8B;AAC9B,yDAA4D;AAC5D,+CAA2C;AAC3C,uDAAsE;AAGtE,MAAM,cAAc,GAAG,yBAAW,CAAC,gBAAgB,GAAG,IAAI,CAAC;AAE3D,MAAM,WAAW,GAAG,KAAM,CAAC;AAE3B,MAAM,UAAU,GAAG,EAAE,CAAC;AAetB,MAAa,gBAAiB,SAAQ,KAAK;CAAG;AAA9C,4CAA8C;AAE9C,MAAa,mBAAmB;IAK9B,YACmB,SAAoB,EACpB,gBAAwE;QADxE,cAAS,GAAT,SAAS,CAAW;QACpB,qBAAgB,GAAhB,gBAAgB,CAAwD;QAN1E,YAAO,GAAG,IAAI,oBAAQ,CAAiB,cAAc,CAAC,CAAC;QAEvD,UAAK,GAAG,IAAI,oBAAQ,CAAa,WAAW,CAAC,CAAC;IAK5D,CAAC;IAEJ,eAAe,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAyC;;QAC1E,MAAM,OAAO,GAAG,IAAA,8BAAgB,EAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAE1D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,gBAAgB,CAAC,4CAA4C,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAE1C,MAAM,QAAQ,GAAG;YACf,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,gBAAgB,CAAC,GAAG,IAAI,uCAAuC;YACnF,MAAM,CAAC,GAAG,KAAK,yBAAW,CAAC,QAAQ,IAAI,8BAA8B;YACrE,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,6CAA6C;YAC9E,QAAQ,KAAK,IAAI,CAAC,gBAAgB,CAAC,QAAQ,IAAI,mBAAmB;YAClE,MAAM,CAAC,YAAY,KAAK,IAAI,CAAC,gBAAgB,CAAC,WAAW,IAAI,wCAAwC;YACrG,MAAM,CAAC,qBAAqB,KAAK,yBAAW,CAAC,qBAAqB,IAAI,oCAAoC;YAC1G,CAAA,MAAA,MAAM,CAAC,cAAc,0CAAE,MAAM,MAAK,EAAE,IAAI,sCAAsC;YAC9E,CAAC,CAAC,CAAA,MAAA,MAAM,CAAC,KAAK,0CAAE,MAAM,KAAI,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,oCAAoC;YACnG,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,yBAAW,CAAC,gBAAgB,CAAC,IAAI,iCAAiC;YAC1H,MAAM,CAAC,GAAG,GAAG,GAAG,GAAG,EAAE,IAAI,qBAAqB;SAC/C,CAAC,MAAM,CAAC,CAAC,OAAO,EAAqB,EAAE,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC;QAEtE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,IAAI,GAAG,IAAA,wBAAU,GAAE,CAAC;QAC1B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAC;QAEH,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,mBAAmB,EAAE,CAAC;IACnD,CAAC;IAED,cAAc,CAAC,IAAY;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEvC,OAAO,OAAO,oCAAS,OAAO,KAAE,IAAI,GAAE,CAAC;IACzC,CAAC;IAED,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,aAAa,EAA6D;QACjG,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAExC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,gBAAgB,CAAC,4CAA4C,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,YAAY,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;QAC7F,CAAC;QAED,MAAM,IAAI,GAAG,IAAA,yBAAW,EAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,kCAAO,OAAO,KAAE,aAAa,IAAG,CAAC;QAEpD,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,YAAY,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;IAC3E,CAAC;IAED,QAAQ,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAA4D;QAGjG,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAErC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,qCAAoB,CAAC,aAAa,EAAE,CAAC;QACjF,CAAC;QAED,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,qCAAoB,CAAC,cAAc,EAAE,CAAC;QAClF,CAAC;QAED,IAAI,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,MAAM,CAAC,cAAc,EAAE,CAAC;YAC5F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,qCAAoB,CAAC,aAAa,EAAE,CAAC;QACjF,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC;IACvD,CAAC;CACF;AA1FD,kDA0FC;AAEM,MAAM,yBAAyB,GAAG,CAAC,GAAwB,EAAkB,EAAE;IACpF,MAAM,MAAM,GAAG,iBAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,GAAG,CAAC,iBAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAE3B,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;;QAClD,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAA,GAAG,CAAC,IAAI,mCAAI,EAAE,CAAC;QAExD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,sBAAsB,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC,CAAC;YACxH,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YACxE,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC;YACtE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;QACjF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,KAAK,YAAY,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC;YACtF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;;QACnD,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,MAAA,GAAG,CAAC,IAAI,mCAAI,EAAE,CAAC;QAElF,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;YACjG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,sBAAsB,EAAE,MAAM,EAAE,gDAAgD,EAAE,CAAC,CAAC;YACpI,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAE9D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;gBAC7B,WAAW,EAAE,MAAM,CAAC,MAAM;gBAC1B,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa;gBAC1D,MAAM,EAAE,kBAAkB;gBAC1B,QAAQ,EAAE,MAAM,CAAC,OAAO;aACzB,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AA/CW,QAAA,yBAAyB,6BA+CpC"}

package/build/oauth/bounded-body.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readBoundedText = void 0;
+const readBoundedText = async (response, maxBytes) => {
+    if (Number(response.headers.get('content-length')) > maxBytes) {
+        return;
+    }
+    if (!response.body) {
+        return '';
+    }
+    const reader = response.body.getReader();
+    const chunks = [];
+    let received = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done) {
+            break;
+        }
+        received += value.byteLength;
+        if (received > maxBytes) {
+            await reader.cancel();
+            return;
+        }
+        chunks.push(value);
+    }
+    return Buffer.concat(chunks).toString('utf8');
+};
+exports.readBoundedText = readBoundedText;
+//# sourceMappingURL=bounded-body.js.map

package/build/oauth/bounded-body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bounded-body.js","sourceRoot":"","sources":["../../src/oauth/bounded-body.ts"],"names":[],"mappings":";;;AAAO,MAAM,eAAe,GAAG,KAAK,EAAE,QAAkB,EAAE,QAAgB,EAA+B,EAAE;IACzG,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,GAAG,QAAQ,EAAE,CAAC;QAC9D,OAAO;IACT,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,SAAS,CAAC;QACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAE5C,IAAI,IAAI,EAAE,CAAC;YACT,MAAM;QACR,CAAC;QAED,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC;QAE7B,IAAI,QAAQ,GAAG,QAAQ,EAAE,CAAC;YACxB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC,CAAC;AA/BW,QAAA,eAAe,mBA+B1B"}

package/build/oauth/clients-store.js

@@ -0,0 +1,142 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClientsStore = exports.assertClientMetadataBounded = exports.isClientIdMetadataUrl = exports.MAX_SCOPE_LENGTH = exports.MAX_REDIRECT_URI_LENGTH = exports.MAX_REDIRECT_URIS = exports.MAX_CLIENT_NAME_LENGTH = void 0;
+const errors_js_1 = require("@modelcontextprotocol/sdk/server/auth/errors.js");
+const auth_js_1 = require("@modelcontextprotocol/sdk/shared/auth.js");
+const logger_1 = require("../logger");
+const bounded_body_1 = require("./bounded-body");
+const redirect_uris_1 = require("./redirect-uris");
+const ttl_store_1 = require("./ttl-store");
+const SEAL_PURPOSE = 'client';
+const PUBLIC_CLIENT = 'none';
+exports.MAX_CLIENT_NAME_LENGTH = 128;
+exports.MAX_REDIRECT_URIS = 10;
+exports.MAX_REDIRECT_URI_LENGTH = 1024;
+exports.MAX_SCOPE_LENGTH = 256;
+const MAX_METADATA_DOCUMENT_BYTES = 64 * 1024;
+const METADATA_DOCUMENT_TTL_MS = 60 * 60 * 1000;
+const METADATA_FETCH_TIMEOUT_MS = 5000;
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]']);
+const IP_LITERAL = /^(\d{1,3}\.){3}\d{1,3}$|^\[/;
+const isClientIdMetadataUrl = (clientId) => {
+    if (!URL.canParse(clientId)) {
+        return false;
+    }
+    const url = new URL(clientId);
+    return (url.protocol === 'https:' &&
+        url.pathname !== '/' &&
+        !url.hash &&
+        !url.username &&
+        !LOOPBACK_HOSTS.has(url.hostname) &&
+        !IP_LITERAL.test(url.hostname));
+};
+exports.isClientIdMetadataUrl = isClientIdMetadataUrl;
+const assertClientMetadataBounded = (client) => {
+    if (client.redirect_uris.length === 0) {
+        throw new errors_js_1.InvalidClientMetadataError('redirect_uris must contain at least one uri');
+    }
+    if (client.redirect_uris.length > exports.MAX_REDIRECT_URIS) {
+        throw new errors_js_1.InvalidClientMetadataError(`redirect_uris must contain at most ${exports.MAX_REDIRECT_URIS} uris`);
+    }
+    if (client.redirect_uris.some(uri => uri.length > exports.MAX_REDIRECT_URI_LENGTH)) {
+        throw new errors_js_1.InvalidClientMetadataError(`each redirect_uri must be at most ${exports.MAX_REDIRECT_URI_LENGTH} characters`);
+    }
+    if (client.client_name && client.client_name.length > exports.MAX_CLIENT_NAME_LENGTH) {
+        throw new errors_js_1.InvalidClientMetadataError(`client_name must be at most ${exports.MAX_CLIENT_NAME_LENGTH} characters`);
+    }
+    if (client.scope && client.scope.length > exports.MAX_SCOPE_LENGTH) {
+        throw new errors_js_1.InvalidClientMetadataError(`scope must be at most ${exports.MAX_SCOPE_LENGTH} characters`);
+    }
+};
+exports.assertClientMetadataBounded = assertClientMetadataBounded;
+class ClientsStore {
+    constructor({ sealer, allowedRedirectUris, fetch = globalThis.fetch, }) {
+        this.metadataDocuments = new ttl_store_1.TtlStore(METADATA_DOCUMENT_TTL_MS);
+        this.sealer = sealer;
+        this.allowedRedirectUris = allowedRedirectUris;
+        this.fetch = fetch;
+    }
+    registerClient(client) {
+        if (client.token_endpoint_auth_method !== PUBLIC_CLIENT) {
+            throw new errors_js_1.InvalidClientMetadataError(`only public clients are supported (token_endpoint_auth_method "${PUBLIC_CLIENT}")`);
+        }
+        (0, exports.assertClientMetadataBounded)(client);
+        this.assertRedirectUrisAllowed(client.redirect_uris);
+        const sealed = {
+            client_name: client.client_name,
+            redirect_uris: client.redirect_uris,
+            grant_types: client.grant_types,
+            response_types: client.response_types,
+            scope: client.scope,
+            token_endpoint_auth_method: PUBLIC_CLIENT,
+            client_id_issued_at: Math.floor(Date.now() / 1000),
+        };
+        return Object.assign(Object.assign(Object.assign({}, client), sealed), { client_id: this.sealer.seal(SEAL_PURPOSE, sealed), client_secret: undefined, client_secret_expires_at: undefined });
+    }
+    async getClient(clientId) {
+        var _a;
+        if ((0, exports.isClientIdMetadataUrl)(clientId)) {
+            return (_a = this.metadataDocuments.get(clientId)) !== null && _a !== void 0 ? _a : (await this.fetchMetadataDocument(clientId));
+        }
+        const sealed = this.sealer.unseal(SEAL_PURPOSE, clientId);
+        return sealed && Object.assign(Object.assign({}, sealed), { client_id: clientId });
+    }
+    assertRedirectUrisAllowed(redirectUris) {
+        const disallowed = (0, redirect_uris_1.disallowedRedirectUris)(redirectUris, this.allowedRedirectUris);
+        if (disallowed.length > 0) {
+            throw new errors_js_1.InvalidClientMetadataError(`redirect_uri not allowed: ${disallowed.join(', ')}`);
+        }
+    }
+    async fetchMetadataDocument(clientId) {
+        try {
+            const response = await this.fetch(clientId, {
+                headers: { Accept: 'application/json' },
+                redirect: 'error',
+                signal: AbortSignal.timeout(METADATA_FETCH_TIMEOUT_MS),
+            });
+            if (!response.ok) {
+                (0, logger_1.log)('warn', 'oauth.client_metadata.fetch_failed', { clientId, status: response.status });
+                return;
+            }
+            const text = await (0, bounded_body_1.readBoundedText)(response, MAX_METADATA_DOCUMENT_BYTES);
+            if (text === undefined) {
+                (0, logger_1.log)('warn', 'oauth.client_metadata.too_large', { clientId, maxBytes: MAX_METADATA_DOCUMENT_BYTES });
+                return;
+            }
+            const document = JSON.parse(text);
+            if (document.client_id !== clientId) {
+                (0, logger_1.log)('warn', 'oauth.client_metadata.client_id_mismatch', { clientId });
+                return;
+            }
+            const parsed = auth_js_1.OAuthClientMetadataSchema.safeParse(document);
+            if (!parsed.success) {
+                (0, logger_1.log)('warn', 'oauth.client_metadata.invalid', { clientId, issues: parsed.error.message });
+                return;
+            }
+            try {
+                (0, exports.assertClientMetadataBounded)(parsed.data);
+            }
+            catch (error) {
+                (0, logger_1.log)('warn', 'oauth.client_metadata.invalid', { clientId, issues: error instanceof Error ? error.message : String(error) });
+                return;
+            }
+            const disallowed = (0, redirect_uris_1.disallowedRedirectUris)(parsed.data.redirect_uris, this.allowedRedirectUris);
+            if (disallowed.length > 0) {
+                (0, logger_1.log)('warn', 'oauth.client_metadata.redirect_uri_not_allowed', { clientId, disallowed });
+                return;
+            }
+            const client = Object.assign(Object.assign({}, parsed.data), { client_id: clientId, token_endpoint_auth_method: PUBLIC_CLIENT });
+            this.metadataDocuments.set(clientId, client);
+            return client;
+        }
+        catch (error) {
+            (0, logger_1.log)('warn', 'oauth.client_metadata.fetch_failed', {
+                clientId,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return;
+        }
+    }
+}
+exports.ClientsStore = ClientsStore;
+//# sourceMappingURL=clients-store.js.map

package/build/oauth/clients-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clients-store.js","sourceRoot":"","sources":["../../src/oauth/clients-store.ts"],"names":[],"mappings":";;;AACA,+EAA6F;AAC7F,sEAAqF;AAErF,sCAAgC;AAChC,iDAAiD;AACjD,mDAAyD;AAEzD,2CAAuC;AAIvC,MAAM,YAAY,GAAG,QAAQ,CAAC;AAE9B,MAAM,aAAa,GAAG,MAAM,CAAC;AAEhB,QAAA,sBAAsB,GAAG,GAAG,CAAC;AAE7B,QAAA,iBAAiB,GAAG,EAAE,CAAC;AAEvB,QAAA,uBAAuB,GAAG,IAAI,CAAC;AAE/B,QAAA,gBAAgB,GAAG,GAAG,CAAC;AAEpC,MAAM,2BAA2B,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9C,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhD,MAAM,yBAAyB,GAAG,IAAK,CAAC;AAExC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpE,MAAM,UAAU,GAAG,6BAA6B,CAAC;AAS1C,MAAM,qBAAqB,GAAG,CAAC,QAAgB,EAAW,EAAE;IACjE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAE9B,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACzB,GAAG,CAAC,QAAQ,KAAK,GAAG;QACpB,CAAC,GAAG,CAAC,IAAI;QACT,CAAC,GAAG,CAAC,QAAQ;QACb,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;QACjC,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAC/B,CAAC;AACJ,CAAC,CAAC;AAfW,QAAA,qBAAqB,yBAehC;AAEK,MAAM,2BAA2B,GAAG,CAAC,MAA4E,EAAQ,EAAE;IAChI,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,sCAA0B,CAAC,6CAA6C,CAAC,CAAC;IACtF,CAAC;IAED,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,yBAAiB,EAAE,CAAC;QACpD,MAAM,IAAI,sCAA0B,CAAC,sCAAsC,yBAAiB,OAAO,CAAC,CAAC;IACvG,CAAC;IAED,IAAI,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,GAAG,+BAAuB,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,sCAA0B,CAAC,qCAAqC,+BAAuB,aAAa,CAAC,CAAC;IAClH,CAAC;IAED,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,8BAAsB,EAAE,CAAC;QAC7E,MAAM,IAAI,sCAA0B,CAAC,+BAA+B,8BAAsB,aAAa,CAAC,CAAC;IAC3G,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,wBAAgB,EAAE,CAAC;QAC3D,MAAM,IAAI,sCAA0B,CAAC,yBAAyB,wBAAgB,aAAa,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC,CAAC;AApBW,QAAA,2BAA2B,+BAoBtC;AAEF,MAAa,YAAY;IASvB,YAAY,EACV,MAAM,EACN,mBAAmB,EACnB,KAAK,GAAG,UAAU,CAAC,KAAK,GAKzB;QAhBgB,sBAAiB,GAAG,IAAI,oBAAQ,CAA6B,wBAAwB,CAAC,CAAC;QAiBtG,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;QAC/C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,cAAc,CAAC,MAA6E;QAC1F,IAAI,MAAM,CAAC,0BAA0B,KAAK,aAAa,EAAE,CAAC;YACxD,MAAM,IAAI,sCAA0B,CAAC,kEAAkE,aAAa,IAAI,CAAC,CAAC;QAC5H,CAAC;QAED,IAAA,mCAA2B,EAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAErD,MAAM,MAAM,GAAiB;YAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,0BAA0B,EAAE,aAAa;YACzC,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;SACnD,CAAC;QAEF,qDACK,MAAM,GACN,MAAM,KACT,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,EACjD,aAAa,EAAE,SAAS,EACxB,wBAAwB,EAAE,SAAS,IACnC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,QAAgB;;QAC9B,IAAI,IAAA,6BAAqB,EAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,OAAO,MAAA,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,mCAAI,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9F,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAe,YAAY,EAAE,QAAQ,CAAC,CAAC;QAExE,OAAO,MAAM,oCAAS,MAAM,KAAE,SAAS,EAAE,QAAQ,GAAE,CAAC;IACtD,CAAC;IAEO,yBAAyB,CAAC,YAAsB;QACtD,MAAM,UAAU,GAAG,IAAA,sCAAsB,EAAC,YAAY,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAElF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,sCAA0B,CAAC,6BAA6B,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,qBAAqB,CAAC,QAAgB;QAClD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE;gBAC1C,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBACvC,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,yBAAyB,CAAC;aACvD,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,IAAA,YAAG,EAAC,MAAM,EAAE,oCAAoC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;gBACzF,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAA,8BAAe,EAAC,QAAQ,EAAE,2BAA2B,CAAC,CAAC;YAE1E,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,IAAA,YAAG,EAAC,MAAM,EAAE,iCAAiC,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,2BAA2B,EAAE,CAAC,CAAC;gBACpG,OAAO;YACT,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;YAE7D,IAAI,QAAQ,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBACpC,IAAA,YAAG,EAAC,MAAM,EAAE,0CAA0C,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACtE,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,mCAAyB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAE7D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,IAAA,YAAG,EAAC,MAAM,EAAE,+BAA+B,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBACzF,OAAO;YACT,CAAC;YAED,IAAI,CAAC;gBACH,IAAA,mCAA2B,EAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAA,YAAG,EAAC,MAAM,EAAE,+BAA+B,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAC3H,OAAO;YACT,CAAC;YAED,MAAM,UAAU,GAAG,IAAA,sCAAsB,EAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAE/F,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,IAAA,YAAG,EAAC,MAAM,EAAE,gDAAgD,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;gBACxF,OAAO;YACT,CAAC;YAED,MAAM,MAAM,mCACP,MAAM,CAAC,IAAI,KACd,SAAS,EAAE,QAAQ,EACnB,0BAA0B,EAAE,aAAa,GAC1C,CAAC;YAEF,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAE7C,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAA,YAAG,EAAC,MAAM,EAAE,oCAAoC,EAAE;gBAChD,QAAQ;gBACR,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,OAAO;QACT,CAAC;IACH,CAAC;CACF;AArID,oCAqIC"}

package/build/oauth/config.js

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.oauthConfigFromEnv = exports.MCP_PATH = exports.CALLBACK_PATH = exports.CLAUDE_REDIRECT_URIS = exports.DEFAULT_TOKEN_EXCHANGE_CLIENT_ID = exports.DEFAULT_TOKEN_EXCHANGE_BASE_URL = exports.DEFAULT_DASHBOARD_AUTHORIZE_URL = exports.OAUTH_BACKEND = void 0;
+const node_fs_1 = require("node:fs");
+const logger_1 = require("../logger");
+const sealer_1 = require("./sealer");
+exports.OAUTH_BACKEND = {
+    DECODO: 'decodo',
+    MOCK: 'mock',
+};
+exports.DEFAULT_DASHBOARD_AUTHORIZE_URL = 'https://dashboard.decodo.com/scraper/token-exchange/decision';
+exports.DEFAULT_TOKEN_EXCHANGE_BASE_URL = 'https://dashboard.decodo.com/subscription-api/v1/api/scraper/apikey/token-exchange';
+exports.DEFAULT_TOKEN_EXCHANGE_CLIENT_ID = 'scrapper-mcp';
+exports.CLAUDE_REDIRECT_URIS = [
+    'https://claude.ai/api/mcp/auth_callback',
+    'https://claude.com/api/mcp/auth_callback',
+];
+exports.CALLBACK_PATH = '/oauth/callback';
+exports.MCP_PATH = '/mcp';
+const urlFromEnv = (env, key, fallback) => {
+    var _a;
+    const value = ((_a = env[key]) === null || _a === void 0 ? void 0 : _a.trim()) || fallback;
+    if (!URL.canParse(value)) {
+        throw new Error(`${key} must be an absolute URL, got "${value}"`);
+    }
+    return new URL(value);
+};
+const listFromEnv = (env, key) => {
+    var _a;
+    return ((_a = env[key]) !== null && _a !== void 0 ? _a : '')
+        .split(',')
+        .map(value => value.trim())
+        .filter(Boolean);
+};
+const privateKeyFromEnv = (env) => {
+    var _a, _b;
+    const file = (_a = env.TOKEN_EXCHANGE_PRIVATE_KEY_FILE) === null || _a === void 0 ? void 0 : _a.trim();
+    if (file) {
+        try {
+            return (0, node_fs_1.readFileSync)(file, 'utf8');
+        }
+        catch (error) {
+            throw new Error(`TOKEN_EXCHANGE_PRIVATE_KEY_FILE cannot be read (${file}): ${error.message}`, { cause: error });
+        }
+    }
+    return ((_b = env.TOKEN_EXCHANGE_PRIVATE_KEY) !== null && _b !== void 0 ? _b : '').replace(/\\n/g, '\n').trim();
+};
+const stateSecretFromEnv = (env) => {
+    var _a;
+    const secret = (_a = env.OAUTH_STATE_SECRET) === null || _a === void 0 ? void 0 : _a.trim();
+    if (secret) {
+        return secret;
+    }
+    (0, logger_1.log)('warn', 'oauth.state_secret_missing', {
+        message: 'OAUTH_STATE_SECRET is not set; using a random one, so sign-in only works with a single replica',
+    });
+    return sealer_1.Sealer.randomSecret();
+};
+const oauthConfigFromEnv = (env, port) => {
+    var _a, _b, _c;
+    return ({
+        publicUrl: urlFromEnv(env, 'PUBLIC_URL', `http://localhost:${port}`),
+        backend: env.OAUTH_BACKEND === exports.OAUTH_BACKEND.MOCK ? exports.OAUTH_BACKEND.MOCK : exports.OAUTH_BACKEND.DECODO,
+        stateSecret: stateSecretFromEnv(env),
+        dashboardAuthorizeUrl: urlFromEnv(env, 'DASHBOARD_AUTHORIZE_URL', exports.DEFAULT_DASHBOARD_AUTHORIZE_URL),
+        tokenExchange: {
+            clientId: ((_a = env.TOKEN_EXCHANGE_CLIENT_ID) === null || _a === void 0 ? void 0 : _a.trim()) || exports.DEFAULT_TOKEN_EXCHANGE_CLIENT_ID,
+            kid: ((_b = env.TOKEN_EXCHANGE_KID) === null || _b === void 0 ? void 0 : _b.trim()) || '',
+            privateKey: privateKeyFromEnv(env),
+            baseUrl: urlFromEnv(env, 'TOKEN_EXCHANGE_BASE_URL', exports.DEFAULT_TOKEN_EXCHANGE_BASE_URL),
+        },
+        allowedRedirectUris: [...exports.CLAUDE_REDIRECT_URIS, ...listFromEnv(env, 'OAUTH_ALLOWED_REDIRECT_URIS')],
+        mockScraperApiKey: ((_c = env.MOCK_SCRAPER_API_KEY) === null || _c === void 0 ? void 0 : _c.trim()) || '',
+    });
+};
+exports.oauthConfigFromEnv = oauthConfigFromEnv;
+//# sourceMappingURL=config.js.map

package/build/oauth/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/oauth/config.ts"],"names":[],"mappings":";;;AAAA,qCAAuC;AACvC,sCAAgC;AAChC,qCAAkC;AAErB,QAAA,aAAa,GAAG;IAC3B,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,MAAM;CACJ,CAAC;AAqBE,QAAA,+BAA+B,GAAG,8DAA8D,CAAC;AAEjG,QAAA,+BAA+B,GAC1C,oFAAoF,CAAC;AAE1E,QAAA,gCAAgC,GAAG,cAAc,CAAC;AAElD,QAAA,oBAAoB,GAAG;IAClC,yCAAyC;IACzC,0CAA0C;CAC3C,CAAC;AAEW,QAAA,aAAa,GAAG,iBAAiB,CAAC;AAElC,QAAA,QAAQ,GAAG,MAAM,CAAC;AAI/B,MAAM,UAAU,GAAG,CAAC,GAAQ,EAAE,GAAW,EAAE,QAAgB,EAAO,EAAE;;IAClE,MAAM,KAAK,GAAG,CAAA,MAAA,GAAG,CAAC,GAAG,CAAC,0CAAE,IAAI,EAAE,KAAI,QAAQ,CAAC;IAE3C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,kCAAkC,KAAK,GAAG,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,GAAQ,EAAE,GAAW,EAAY,EAAE;;IACtD,OAAA,CAAC,MAAA,GAAG,CAAC,GAAG,CAAC,mCAAI,EAAE,CAAC;SACb,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAA;CAAA,CAAC;AAErB,MAAM,iBAAiB,GAAG,CAAC,GAAQ,EAAU,EAAE;;IAC7C,MAAM,IAAI,GAAG,MAAA,GAAG,CAAC,+BAA+B,0CAAE,IAAI,EAAE,CAAC;IAEzD,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC;YACH,OAAO,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,mDAAmD,IAAI,MAAO,KAAe,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7H,CAAC;IACH,CAAC;IAED,OAAO,CAAC,MAAA,GAAG,CAAC,0BAA0B,mCAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;AAC7E,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,GAAQ,EAAU,EAAE;;IAC9C,MAAM,MAAM,GAAG,MAAA,GAAG,CAAC,kBAAkB,0CAAE,IAAI,EAAE,CAAC;IAE9C,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAA,YAAG,EAAC,MAAM,EAAE,4BAA4B,EAAE;QACxC,OAAO,EAAE,gGAAgG;KAC1G,CAAC,CAAC;IAEH,OAAO,eAAM,CAAC,YAAY,EAAE,CAAC;AAC/B,CAAC,CAAC;AAEK,MAAM,kBAAkB,GAAG,CAAC,GAAQ,EAAE,IAAY,EAAe,EAAE;;IAAC,OAAA,CAAC;QAC1E,SAAS,EAAE,UAAU,CAAC,GAAG,EAAE,YAAY,EAAE,oBAAoB,IAAI,EAAE,CAAC;QACpE,OAAO,EAAE,GAAG,CAAC,aAAa,KAAK,qBAAa,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAa,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAa,CAAC,MAAM;QAC7F,WAAW,EAAE,kBAAkB,CAAC,GAAG,CAAC;QACpC,qBAAqB,EAAE,UAAU,CAAC,GAAG,EAAE,yBAAyB,EAAE,uCAA+B,CAAC;QAClG,aAAa,EAAE;YACb,QAAQ,EAAE,CAAA,MAAA,GAAG,CAAC,wBAAwB,0CAAE,IAAI,EAAE,KAAI,wCAAgC;YAClF,GAAG,EAAE,CAAA,MAAA,GAAG,CAAC,kBAAkB,0CAAE,IAAI,EAAE,KAAI,EAAE;YACzC,UAAU,EAAE,iBAAiB,CAAC,GAAG,CAAC;YAClC,OAAO,EAAE,UAAU,CAAC,GAAG,EAAE,yBAAyB,EAAE,uCAA+B,CAAC;SACrF;QACD,mBAAmB,EAAE,CAAC,GAAG,4BAAoB,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC;QAClG,iBAAiB,EAAE,CAAA,MAAA,GAAG,CAAC,oBAAoB,0CAAE,IAAI,EAAE,KAAI,EAAE;KAC1D,CAAC,CAAA;CAAA,CAAC;AAbU,QAAA,kBAAkB,sBAa5B"}

package/build/oauth/cookies.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cookieValue = void 0;
+const cookieValue = (header, name) => {
+    if (!header) {
+        return;
+    }
+    for (const part of header.split(';')) {
+        const separator = part.indexOf('=');
+        if (separator === -1) {
+            continue;
+        }
+        if (part.slice(0, separator).trim() === name) {
+            try {
+                return decodeURIComponent(part.slice(separator + 1).trim());
+            }
+            catch (_a) {
+                return;
+            }
+        }
+    }
+    return;
+};
+exports.cookieValue = cookieValue;
+//# sourceMappingURL=cookies.js.map

package/build/oauth/cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../../src/oauth/cookies.ts"],"names":[],"mappings":";;;AAAO,MAAM,WAAW,GAAG,CAAC,MAA0B,EAAE,IAAY,EAAsB,EAAE;IAC1F,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;IACT,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAEpC,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;YACrB,SAAS;QACX,CAAC;QAED,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAC7C,IAAI,CAAC;gBACH,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC9D,CAAC;YAAC,WAAM,CAAC;gBACP,OAAO;YACT,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;AACT,CAAC,CAAC;AAtBW,QAAA,WAAW,eAsBtB"}

package/build/oauth/index.js

@@ -0,0 +1,46 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createOAuth = exports.oauthConfigFromEnv = exports.OAUTH_BACKEND = void 0;
+const express_1 = __importDefault(require("express"));
+const router_js_1 = require("@modelcontextprotocol/sdk/server/auth/router.js");
+const decodo_1 = require("./backends/decodo");
+const mock_1 = require("./backends/mock");
+const clients_store_1 = require("./clients-store");
+const config_1 = require("./config");
+const provider_1 = require("./provider");
+const router_1 = require("./router");
+const sealer_1 = require("./sealer");
+var config_2 = require("./config");
+Object.defineProperty(exports, "OAUTH_BACKEND", { enumerable: true, get: function () { return config_2.OAUTH_BACKEND; } });
+Object.defineProperty(exports, "oauthConfigFromEnv", { enumerable: true, get: function () { return config_2.oauthConfigFromEnv; } });
+const BACKENDS = {
+    [config_1.OAUTH_BACKEND.DECODO]: decodo_1.createDecodoBackend,
+    [config_1.OAUTH_BACKEND.MOCK]: mock_1.createMockBackend,
+};
+const createOAuth = (config, { fetch, onTokenIssued } = {}) => {
+    const callbackUrl = new URL(config_1.CALLBACK_PATH, config.publicUrl);
+    const resourceServerUrl = new URL(config_1.MCP_PATH, config.publicUrl);
+    const sealer = new sealer_1.Sealer(config.stateSecret);
+    const backend = BACKENDS[config.backend](config, { callbackUrl, fetch });
+    const provider = new provider_1.DecodoOAuthProvider({
+        clientsStore: new clients_store_1.ClientsStore({ sealer, allowedRedirectUris: config.allowedRedirectUris, fetch }),
+        backend,
+        sealer,
+        callbackUrl,
+        onTokenIssued,
+    });
+    const router = express_1.default.Router();
+    if (backend.router) {
+        router.use(backend.router);
+    }
+    router.use((0, router_1.oauthRouter)({ provider, issuerUrl: config.publicUrl, resourceServerUrl }));
+    return {
+        router,
+        resourceMetadataUrl: (0, router_js_1.getOAuthProtectedResourceMetadataUrl)(resourceServerUrl),
+    };
+};
+exports.createOAuth = createOAuth;
+//# sourceMappingURL=index.js.map

package/build/oauth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":";;;;;;AAAA,sDAA8B;AAC9B,+EAAuG;AAEvG,8CAAwD;AACxD,0CAAoD;AACpD,mDAA+C;AAC/C,qCAAkE;AAElE,yCAAiD;AACjD,qCAAuC;AACvC,qCAAkC;AAElC,mCAA6D;AAApD,uGAAA,aAAa,OAAA;AAAE,4GAAA,kBAAkB,OAAA;AAG1C,MAAM,QAAQ,GAAkD;IAC9D,CAAC,sBAAa,CAAC,MAAM,CAAC,EAAE,4BAAmB;IAC3C,CAAC,sBAAa,CAAC,IAAI,CAAC,EAAE,wBAAiB;CACxC,CAAC;AASK,MAAM,WAAW,GAAG,CACzB,MAAmB,EACnB,EAAE,KAAK,EAAE,aAAa,KAA6E,EAAE,EAC9F,EAAE;IACT,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,sBAAa,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAC7D,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,iBAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IAEzE,MAAM,QAAQ,GAAG,IAAI,8BAAmB,CAAC;QACvC,YAAY,EAAE,IAAI,4BAAY,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,EAAE,KAAK,EAAE,CAAC;QAClG,OAAO;QACP,MAAM;QACN,WAAW;QACX,aAAa;KACd,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,iBAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAED,MAAM,CAAC,GAAG,CAAC,IAAA,oBAAW,EAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC;IAEtF,OAAO;QACL,MAAM;QACN,mBAAmB,EAAE,IAAA,gDAAoC,EAAC,iBAAiB,CAAC;KAC7E,CAAC;AACJ,CAAC,CAAC;AA7BW,QAAA,WAAW,eA6BtB"}