@didim365/agent-cli-core 0.1.0

package/dist/src/mcp/oauth-utils.js

@@ -0,0 +1,289 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { getErrorMessage } from '../utils/errors.js';
+import { debugLogger } from '../utils/debugLogger.js';
+/**
+ * Error thrown when the discovered resource metadata does not match the expected resource.
+ */
+export class ResourceMismatchError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ResourceMismatchError';
+    }
+}
+export const FIVE_MIN_BUFFER_MS = 5 * 60 * 1000;
+/**
+ * Utility class for common OAuth operations.
+ */
+export class OAuthUtils {
+    /**
+     * Construct well-known OAuth endpoint URLs per RFC 9728 §3.1.
+     *
+     * The well-known URI is constructed by inserting /.well-known/oauth-protected-resource
+     * between the host and any existing path component. This preserves the resource's
+     * path structure in the metadata URL.
+     *
+     * Examples:
+     * - https://example.com -> https://example.com/.well-known/oauth-protected-resource
+     * - https://example.com/api/resource -> https://example.com/.well-known/oauth-protected-resource/api/resource
+     *
+     * @param baseUrl The resource URL
+     * @param useRootDiscovery If true, ignores path and uses root-based discovery (for fallback compatibility)
+     */
+    static buildWellKnownUrls(baseUrl, useRootDiscovery = false) {
+        const serverUrl = new URL(baseUrl);
+        const base = `${serverUrl.protocol}//${serverUrl.host}`;
+        const pathSuffix = useRootDiscovery
+            ? ''
+            : serverUrl.pathname.replace(/\/$/, ''); // Remove trailing slash
+        return {
+            protectedResource: new URL(`/.well-known/oauth-protected-resource${pathSuffix}`, base).toString(),
+            authorizationServer: new URL(`/.well-known/oauth-authorization-server${pathSuffix}`, base).toString(),
+        };
+    }
+    /**
+     * Fetch OAuth protected resource metadata.
+     *
+     * @param resourceMetadataUrl The protected resource metadata URL
+     * @returns The protected resource metadata or null if not available
+     */
+    static async fetchProtectedResourceMetadata(resourceMetadataUrl) {
+        try {
+            const response = await fetch(resourceMetadataUrl);
+            if (!response.ok) {
+                return null;
+            }
+            return (await response.json());
+        }
+        catch (error) {
+            debugLogger.debug(`Failed to fetch protected resource metadata from ${resourceMetadataUrl}: ${getErrorMessage(error)}`);
+            return null;
+        }
+    }
+    /**
+     * Fetch OAuth authorization server metadata.
+     *
+     * @param authServerMetadataUrl The authorization server metadata URL
+     * @returns The authorization server metadata or null if not available
+     */
+    static async fetchAuthorizationServerMetadata(authServerMetadataUrl) {
+        try {
+            const response = await fetch(authServerMetadataUrl);
+            if (!response.ok) {
+                return null;
+            }
+            return (await response.json());
+        }
+        catch (error) {
+            debugLogger.debug(`Failed to fetch authorization server metadata from ${authServerMetadataUrl}: ${getErrorMessage(error)}`);
+            return null;
+        }
+    }
+    /**
+     * Convert authorization server metadata to OAuth configuration.
+     *
+     * @param metadata The authorization server metadata
+     * @returns The OAuth configuration
+     */
+    static metadataToOAuthConfig(metadata) {
+        return {
+            authorizationUrl: metadata.authorization_endpoint,
+            tokenUrl: metadata.token_endpoint,
+            scopes: metadata.scopes_supported || [],
+            registrationUrl: metadata.registration_endpoint,
+        };
+    }
+    /**
+     * Discover Oauth Authorization server metadata given an Auth server URL, by
+     * trying the standard well-known endpoints.
+     *
+     * @param authServerUrl The authorization server URL
+     * @returns The authorization server metadata or null if not found
+     */
+    static async discoverAuthorizationServerMetadata(authServerUrl) {
+        const authServerUrlObj = new URL(authServerUrl);
+        const base = `${authServerUrlObj.protocol}//${authServerUrlObj.host}`;
+        const endpointsToTry = [];
+        // With issuer URLs with path components, try the following well-known
+        // endpoints in order:
+        if (authServerUrlObj.pathname !== '/') {
+            // 1. OAuth 2.0 Authorization Server Metadata with path insertion
+            endpointsToTry.push(new URL(`/.well-known/oauth-authorization-server${authServerUrlObj.pathname}`, base).toString());
+            // 2. OpenID Connect Discovery 1.0 with path insertion
+            endpointsToTry.push(new URL(`/.well-known/openid-configuration${authServerUrlObj.pathname}`, base).toString());
+            // 3. OpenID Connect Discovery 1.0 with path appending
+            endpointsToTry.push(new URL(`${authServerUrlObj.pathname}/.well-known/openid-configuration`, base).toString());
+        }
+        // With issuer URLs without path components, and those that failed previous
+        // discoveries, try the following well-known endpoints in order:
+        // 1. OAuth 2.0 Authorization Server Metadata
+        endpointsToTry.push(new URL('/.well-known/oauth-authorization-server', base).toString());
+        // 2. OpenID Connect Discovery 1.0
+        endpointsToTry.push(new URL('/.well-known/openid-configuration', base).toString());
+        for (const endpoint of endpointsToTry) {
+            const authServerMetadata = await this.fetchAuthorizationServerMetadata(endpoint);
+            if (authServerMetadata) {
+                return authServerMetadata;
+            }
+        }
+        debugLogger.debug(`Metadata discovery failed for authorization server ${authServerUrl}`);
+        return null;
+    }
+    /**
+     * Discover OAuth configuration using the standard well-known endpoints.
+     *
+     * @param serverUrl The base URL of the server
+     * @returns The discovered OAuth configuration or null if not available
+     */
+    static async discoverOAuthConfig(serverUrl) {
+        try {
+            // RFC 9728 §3.1: Construct well-known URL by inserting /.well-known/oauth-protected-resource
+            // between the host and path. This is the RFC-compliant approach.
+            const wellKnownUrls = this.buildWellKnownUrls(serverUrl);
+            let resourceMetadata = await this.fetchProtectedResourceMetadata(wellKnownUrls.protectedResource);
+            // Fallback: If path-based discovery fails and we have a path, try root-based discovery
+            // for backwards compatibility with servers that don't implement RFC 9728 path handling
+            if (!resourceMetadata) {
+                const url = new URL(serverUrl);
+                if (url.pathname && url.pathname !== '/') {
+                    const rootBasedUrls = this.buildWellKnownUrls(serverUrl, true);
+                    resourceMetadata = await this.fetchProtectedResourceMetadata(rootBasedUrls.protectedResource);
+                }
+            }
+            if (resourceMetadata) {
+                // RFC 9728 Section 7.3: The client MUST ensure that the resource identifier URL
+                // it is using as the prefix for the metadata request exactly matches the value
+                // of the resource metadata parameter in the protected resource metadata document.
+                const expectedResource = this.buildResourceParameter(serverUrl);
+                if (resourceMetadata.resource !== expectedResource) {
+                    throw new ResourceMismatchError(`Protected resource ${resourceMetadata.resource} does not match expected ${expectedResource}`);
+                }
+            }
+            if (resourceMetadata?.authorization_servers?.length) {
+                // Use the first authorization server
+                const authServerUrl = resourceMetadata.authorization_servers[0];
+                const authServerMetadata = await this.discoverAuthorizationServerMetadata(authServerUrl);
+                if (authServerMetadata) {
+                    const config = this.metadataToOAuthConfig(authServerMetadata);
+                    if (authServerMetadata.registration_endpoint) {
+                        debugLogger.log('Dynamic client registration is supported at:', authServerMetadata.registration_endpoint);
+                    }
+                    return config;
+                }
+            }
+            // Fallback: try well-known endpoints at the base URL
+            debugLogger.debug(`Trying OAuth discovery fallback at ${serverUrl}`);
+            const authServerMetadata = await this.discoverAuthorizationServerMetadata(serverUrl);
+            if (authServerMetadata) {
+                const config = this.metadataToOAuthConfig(authServerMetadata);
+                if (authServerMetadata.registration_endpoint) {
+                    debugLogger.log('Dynamic client registration is supported at:', authServerMetadata.registration_endpoint);
+                }
+                return config;
+            }
+            return null;
+        }
+        catch (error) {
+            if (error instanceof ResourceMismatchError) {
+                throw error;
+            }
+            debugLogger.debug(`Failed to discover OAuth configuration: ${getErrorMessage(error)}`);
+            return null;
+        }
+    }
+    /**
+     * Parse WWW-Authenticate header to extract OAuth information.
+     *
+     * @param header The WWW-Authenticate header value
+     * @returns The resource metadata URI if found
+     */
+    static parseWWWAuthenticateHeader(header) {
+        // Parse Bearer realm and resource_metadata
+        const match = header.match(/resource_metadata="([^"]+)"/);
+        if (match) {
+            return match[1];
+        }
+        return null;
+    }
+    /**
+     * Discover OAuth configuration from WWW-Authenticate header.
+     *
+     * @param wwwAuthenticate The WWW-Authenticate header value
+     * @param mcpServerUrl Optional MCP server URL to validate against the resource metadata
+     * @returns The discovered OAuth configuration or null if not available
+     */
+    static async discoverOAuthFromWWWAuthenticate(wwwAuthenticate, mcpServerUrl) {
+        const resourceMetadataUri = this.parseWWWAuthenticateHeader(wwwAuthenticate);
+        if (!resourceMetadataUri) {
+            return null;
+        }
+        const resourceMetadata = await this.fetchProtectedResourceMetadata(resourceMetadataUri);
+        if (resourceMetadata && mcpServerUrl) {
+            // Validate resource parameter per RFC 9728 Section 7.3
+            const expectedResource = this.buildResourceParameter(mcpServerUrl);
+            if (resourceMetadata.resource !== expectedResource) {
+                throw new ResourceMismatchError(`Protected resource ${resourceMetadata.resource} does not match expected ${expectedResource}`);
+            }
+        }
+        if (!resourceMetadata?.authorization_servers?.length) {
+            return null;
+        }
+        const authServerUrl = resourceMetadata.authorization_servers[0];
+        const authServerMetadata = await this.discoverAuthorizationServerMetadata(authServerUrl);
+        if (authServerMetadata) {
+            return this.metadataToOAuthConfig(authServerMetadata);
+        }
+        return null;
+    }
+    /**
+     * Extract base URL from an MCP server URL.
+     *
+     * @param mcpServerUrl The MCP server URL
+     * @returns The base URL
+     */
+    static extractBaseUrl(mcpServerUrl) {
+        const serverUrl = new URL(mcpServerUrl);
+        return `${serverUrl.protocol}//${serverUrl.host}`;
+    }
+    /**
+     * Check if a URL is an SSE endpoint.
+     *
+     * @param url The URL to check
+     * @returns True if the URL appears to be an SSE endpoint
+     */
+    static isSSEEndpoint(url) {
+        return url.includes('/sse') || !url.includes('/mcp');
+    }
+    /**
+     * Build a resource parameter for OAuth requests.
+     *
+     * @param endpointUrl The endpoint URL
+     * @returns The resource parameter value
+     */
+    static buildResourceParameter(endpointUrl) {
+        const url = new URL(endpointUrl);
+        return `${url.protocol}//${url.host}${url.pathname}`;
+    }
+    /**
+     * Parses a JWT string to extract its expiry time.
+     * @param idToken The JWT ID token.
+     * @returns The expiry time in **milliseconds**, or undefined if parsing fails.
+     */
+    static parseTokenExpiry(idToken) {
+        try {
+            const payload = JSON.parse(Buffer.from(idToken.split('.')[1], 'base64').toString());
+            if (payload && typeof payload.exp === 'number') {
+                return payload.exp * 1000; // Convert seconds to milliseconds
+            }
+        }
+        catch (e) {
+            debugLogger.error('Failed to parse ID token for expiry time with error:', e);
+        }
+        // Return undefined if try block fails or 'exp' is missing/invalid
+        return undefined;
+    }
+}
+//# sourceMappingURL=oauth-utils.js.map

package/dist/src/mcp/oauth-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-utils.js","sourceRoot":"","sources":["../../../src/mcp/oauth-utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEtD;;GAEG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAgCD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhD;;GAEG;AACH,MAAM,OAAO,UAAU;IACrB;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,kBAAkB,CAAC,OAAe,EAAE,gBAAgB,GAAG,KAAK;QACjE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,GAAG,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;QACxD,MAAM,UAAU,GAAG,gBAAgB;YACjC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,wBAAwB;QAEnE,OAAO;YACL,iBAAiB,EAAE,IAAI,GAAG,CACxB,wCAAwC,UAAU,EAAE,EACpD,IAAI,CACL,CAAC,QAAQ,EAAE;YACZ,mBAAmB,EAAE,IAAI,GAAG,CAC1B,0CAA0C,UAAU,EAAE,EACtD,IAAI,CACL,CAAC,QAAQ,EAAE;SACb,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,8BAA8B,CACzC,mBAA2B;QAE3B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,CAAC;YAClD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmC,CAAC;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,KAAK,CACf,oDAAoD,mBAAmB,KAAK,eAAe,CAAC,KAAK,CAAC,EAAE,CACrG,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAC3C,qBAA6B;QAE7B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACpD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAqC,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,KAAK,CACf,sDAAsD,qBAAqB,KAAK,eAAe,CAAC,KAAK,CAAC,EAAE,CACzG,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,qBAAqB,CAC1B,QAA0C;QAE1C,OAAO;YACL,gBAAgB,EAAE,QAAQ,CAAC,sBAAsB;YACjD,QAAQ,EAAE,QAAQ,CAAC,cAAc;YACjC,MAAM,EAAE,QAAQ,CAAC,gBAAgB,IAAI,EAAE;YACvC,eAAe,EAAE,QAAQ,CAAC,qBAAqB;SAChD,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAC9C,aAAqB;QAErB,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,GAAG,gBAAgB,CAAC,QAAQ,KAAK,gBAAgB,CAAC,IAAI,EAAE,CAAC;QAEtE,MAAM,cAAc,GAAa,EAAE,CAAC;QAEpC,sEAAsE;QACtE,sBAAsB;QACtB,IAAI,gBAAgB,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;YACtC,iEAAiE;YACjE,cAAc,CAAC,IAAI,CACjB,IAAI,GAAG,CACL,0CAA0C,gBAAgB,CAAC,QAAQ,EAAE,EACrE,IAAI,CACL,CAAC,QAAQ,EAAE,CACb,CAAC;YAEF,sDAAsD;YACtD,cAAc,CAAC,IAAI,CACjB,IAAI,GAAG,CACL,oCAAoC,gBAAgB,CAAC,QAAQ,EAAE,EAC/D,IAAI,CACL,CAAC,QAAQ,EAAE,CACb,CAAC;YAEF,sDAAsD;YACtD,cAAc,CAAC,IAAI,CACjB,IAAI,GAAG,CACL,GAAG,gBAAgB,CAAC,QAAQ,mCAAmC,EAC/D,IAAI,CACL,CAAC,QAAQ,EAAE,CACb,CAAC;QACJ,CAAC;QAED,2EAA2E;QAC3E,gEAAgE;QAEhE,6CAA6C;QAC7C,cAAc,CAAC,IAAI,CACjB,IAAI,GAAG,CAAC,yCAAyC,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CACpE,CAAC;QAEF,kCAAkC;QAClC,cAAc,CAAC,IAAI,CACjB,IAAI,GAAG,CAAC,mCAAmC,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CAC9D,CAAC;QAEF,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;YACtC,MAAM,kBAAkB,GACtB,MAAM,IAAI,CAAC,gCAAgC,CAAC,QAAQ,CAAC,CAAC;YACxD,IAAI,kBAAkB,EAAE,CAAC;gBACvB,OAAO,kBAAkB,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,WAAW,CAAC,KAAK,CACf,sDAAsD,aAAa,EAAE,CACtE,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAC9B,SAAiB;QAEjB,IAAI,CAAC;YACH,6FAA6F;YAC7F,iEAAiE;YACjE,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;YACzD,IAAI,gBAAgB,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAC9D,aAAa,CAAC,iBAAiB,CAChC,CAAC;YAEF,uFAAuF;YACvF,uFAAuF;YACvF,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC/B,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;oBACzC,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;oBAC/D,gBAAgB,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAC1D,aAAa,CAAC,iBAAiB,CAChC,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,IAAI,gBAAgB,EAAE,CAAC;gBACrB,gFAAgF;gBAChF,+EAA+E;gBAC/E,kFAAkF;gBAClF,MAAM,gBAAgB,GAAG,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;gBAChE,IAAI,gBAAgB,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;oBACnD,MAAM,IAAI,qBAAqB,CAC7B,sBAAsB,gBAAgB,CAAC,QAAQ,4BAA4B,gBAAgB,EAAE,CAC9F,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,IAAI,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC;gBACpD,qCAAqC;gBACrC,MAAM,aAAa,GAAG,gBAAgB,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;gBAChE,MAAM,kBAAkB,GACtB,MAAM,IAAI,CAAC,mCAAmC,CAAC,aAAa,CAAC,CAAC;gBAEhE,IAAI,kBAAkB,EAAE,CAAC;oBACvB,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;oBAC9D,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;wBAC7C,WAAW,CAAC,GAAG,CACb,8CAA8C,EAC9C,kBAAkB,CAAC,qBAAqB,CACzC,CAAC;oBACJ,CAAC;oBACD,OAAO,MAAM,CAAC;gBAChB,CAAC;YACH,CAAC;YAED,qDAAqD;YACrD,WAAW,CAAC,KAAK,CAAC,sCAAsC,SAAS,EAAE,CAAC,CAAC;YACrE,MAAM,kBAAkB,GACtB,MAAM,IAAI,CAAC,mCAAmC,CAAC,SAAS,CAAC,CAAC;YAE5D,IAAI,kBAAkB,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;gBAC9D,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;oBAC7C,WAAW,CAAC,GAAG,CACb,8CAA8C,EAC9C,kBAAkB,CAAC,qBAAqB,CACzC,CAAC;gBACJ,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;gBAC3C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,WAAW,CAAC,KAAK,CACf,2CAA2C,eAAe,CAAC,KAAK,CAAC,EAAE,CACpE,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,0BAA0B,CAAC,MAAc;QAC9C,2CAA2C;QAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC1D,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAC3C,eAAuB,EACvB,YAAqB;QAErB,MAAM,mBAAmB,GACvB,IAAI,CAAC,0BAA0B,CAAC,eAAe,CAAC,CAAC;QACnD,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,gBAAgB,GACpB,MAAM,IAAI,CAAC,8BAA8B,CAAC,mBAAmB,CAAC,CAAC;QAEjE,IAAI,gBAAgB,IAAI,YAAY,EAAE,CAAC;YACrC,uDAAuD;YACvD,MAAM,gBAAgB,GAAG,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC;YACnE,IAAI,gBAAgB,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;gBACnD,MAAM,IAAI,qBAAqB,CAC7B,sBAAsB,gBAAgB,CAAC,QAAQ,4BAA4B,gBAAgB,EAAE,CAC9F,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,aAAa,GAAG,gBAAgB,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAChE,MAAM,kBAAkB,GACtB,MAAM,IAAI,CAAC,mCAAmC,CAAC,aAAa,CAAC,CAAC;QAEhE,IAAI,kBAAkB,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;QACxD,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CAAC,YAAoB;QACxC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;QACxC,OAAO,GAAG,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;IACpD,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,aAAa,CAAC,GAAW;QAC9B,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,sBAAsB,CAAC,WAAmB;QAC/C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACjC,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IACvD,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,gBAAgB,CAAC,OAAe;QACrC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CACxD,CAAC;YAEF,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC/C,OAAO,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,kCAAkC;YAC/D,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,WAAW,CAAC,KAAK,CACf,sDAAsD,EACtD,CAAC,CACF,CAAC;QACJ,CAAC;QAED,kEAAkE;QAClE,OAAO,SAAS,CAAC;IACnB,CAAC;CACF"}

package/dist/src/mcp/oauth-utils.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export {};

package/dist/src/mcp/oauth-utils.test.js

@@ -0,0 +1,289 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { OAuthUtils } from './oauth-utils.js';
+// Mock fetch globally
+const mockFetch = vi.fn();
+global.fetch = mockFetch;
+describe('OAuthUtils', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+        vi.spyOn(console, 'debug').mockImplementation(() => { });
+        vi.spyOn(console, 'error').mockImplementation(() => { });
+        vi.spyOn(console, 'log').mockImplementation(() => { });
+    });
+    afterEach(() => {
+        vi.restoreAllMocks();
+    });
+    describe('buildWellKnownUrls', () => {
+        it('should build RFC 9728 compliant path-based URLs by default', () => {
+            const urls = OAuthUtils.buildWellKnownUrls('https://example.com/mcp');
+            expect(urls.protectedResource).toBe('https://example.com/.well-known/oauth-protected-resource/mcp');
+            expect(urls.authorizationServer).toBe('https://example.com/.well-known/oauth-authorization-server/mcp');
+        });
+        it('should build root-based URLs when useRootDiscovery is true', () => {
+            const urls = OAuthUtils.buildWellKnownUrls('https://example.com/mcp', true);
+            expect(urls.protectedResource).toBe('https://example.com/.well-known/oauth-protected-resource');
+            expect(urls.authorizationServer).toBe('https://example.com/.well-known/oauth-authorization-server');
+        });
+        it('should handle root path correctly', () => {
+            const urls = OAuthUtils.buildWellKnownUrls('https://example.com');
+            expect(urls.protectedResource).toBe('https://example.com/.well-known/oauth-protected-resource');
+            expect(urls.authorizationServer).toBe('https://example.com/.well-known/oauth-authorization-server');
+        });
+        it('should handle trailing slash in path', () => {
+            const urls = OAuthUtils.buildWellKnownUrls('https://example.com/mcp/');
+            expect(urls.protectedResource).toBe('https://example.com/.well-known/oauth-protected-resource/mcp');
+            expect(urls.authorizationServer).toBe('https://example.com/.well-known/oauth-authorization-server/mcp');
+        });
+        it('should handle deep paths per RFC 9728', () => {
+            const urls = OAuthUtils.buildWellKnownUrls('https://app.mintmcp.com/s/g_2lj2CNDoJdf3xnbFeeF6vx/mcp');
+            expect(urls.protectedResource).toBe('https://app.mintmcp.com/.well-known/oauth-protected-resource/s/g_2lj2CNDoJdf3xnbFeeF6vx/mcp');
+            expect(urls.authorizationServer).toBe('https://app.mintmcp.com/.well-known/oauth-authorization-server/s/g_2lj2CNDoJdf3xnbFeeF6vx/mcp');
+        });
+    });
+    describe('fetchProtectedResourceMetadata', () => {
+        const mockResourceMetadata = {
+            resource: 'https://api.example.com',
+            authorization_servers: ['https://auth.example.com'],
+            bearer_methods_supported: ['header'],
+        };
+        it('should fetch protected resource metadata successfully', async () => {
+            mockFetch.mockResolvedValueOnce({
+                ok: true,
+                json: () => Promise.resolve(mockResourceMetadata),
+            });
+            const result = await OAuthUtils.fetchProtectedResourceMetadata('https://example.com/.well-known/oauth-protected-resource');
+            expect(result).toEqual(mockResourceMetadata);
+        });
+        it('should return null when fetch fails', async () => {
+            mockFetch.mockResolvedValueOnce({
+                ok: false,
+            });
+            const result = await OAuthUtils.fetchProtectedResourceMetadata('https://example.com/.well-known/oauth-protected-resource');
+            expect(result).toBeNull();
+        });
+    });
+    describe('fetchAuthorizationServerMetadata', () => {
+        const mockAuthServerMetadata = {
+            issuer: 'https://auth.example.com',
+            authorization_endpoint: 'https://auth.example.com/authorize',
+            token_endpoint: 'https://auth.example.com/token',
+            scopes_supported: ['read', 'write'],
+        };
+        it('should fetch authorization server metadata successfully', async () => {
+            mockFetch.mockResolvedValueOnce({
+                ok: true,
+                json: () => Promise.resolve(mockAuthServerMetadata),
+            });
+            const result = await OAuthUtils.fetchAuthorizationServerMetadata('https://auth.example.com/.well-known/oauth-authorization-server');
+            expect(result).toEqual(mockAuthServerMetadata);
+        });
+        it('should return null when fetch fails', async () => {
+            mockFetch.mockResolvedValueOnce({
+                ok: false,
+            });
+            const result = await OAuthUtils.fetchAuthorizationServerMetadata('https://auth.example.com/.well-known/oauth-authorization-server');
+            expect(result).toBeNull();
+        });
+    });
+    describe('discoverAuthorizationServerMetadata', () => {
+        const mockAuthServerMetadata = {
+            issuer: 'https://auth.example.com',
+            authorization_endpoint: 'https://auth.example.com/authorize',
+            token_endpoint: 'https://auth.example.com/token',
+            scopes_supported: ['read', 'write'],
+        };
+        it('should handle URLs without path components correctly', async () => {
+            mockFetch
+                .mockResolvedValueOnce({
+                ok: false,
+            })
+                .mockResolvedValueOnce({
+                ok: true,
+                json: () => Promise.resolve(mockAuthServerMetadata),
+            });
+            const result = await OAuthUtils.discoverAuthorizationServerMetadata('https://auth.example.com/');
+            expect(result).toEqual(mockAuthServerMetadata);
+            expect(mockFetch).nthCalledWith(1, 'https://auth.example.com/.well-known/oauth-authorization-server');
+            expect(mockFetch).nthCalledWith(2, 'https://auth.example.com/.well-known/openid-configuration');
+        });
+        it('should handle URLs with path components correctly', async () => {
+            mockFetch
+                .mockResolvedValueOnce({
+                ok: false,
+            })
+                .mockResolvedValueOnce({
+                ok: false,
+            })
+                .mockResolvedValueOnce({
+                ok: true,
+                json: () => Promise.resolve(mockAuthServerMetadata),
+            });
+            const result = await OAuthUtils.discoverAuthorizationServerMetadata('https://auth.example.com/mcp');
+            expect(result).toEqual(mockAuthServerMetadata);
+            expect(mockFetch).nthCalledWith(1, 'https://auth.example.com/.well-known/oauth-authorization-server/mcp');
+            expect(mockFetch).nthCalledWith(2, 'https://auth.example.com/.well-known/openid-configuration/mcp');
+            expect(mockFetch).nthCalledWith(3, 'https://auth.example.com/mcp/.well-known/openid-configuration');
+        });
+    });
+    describe('discoverOAuthConfig', () => {
+        const mockResourceMetadata = {
+            resource: 'https://example.com/mcp',
+            authorization_servers: ['https://auth.example.com'],
+            bearer_methods_supported: ['header'],
+        };
+        const mockAuthServerMetadata = {
+            issuer: 'https://auth.example.com',
+            authorization_endpoint: 'https://auth.example.com/authorize',
+            token_endpoint: 'https://auth.example.com/token',
+            scopes_supported: ['read', 'write'],
+        };
+        it('should succeed when resource metadata matches server URL', async () => {
+            mockFetch
+                // fetchProtectedResourceMetadata
+                .mockResolvedValueOnce({
+                ok: true,
+                json: () => Promise.resolve(mockResourceMetadata),
+            })
+                // discoverAuthorizationServerMetadata
+                .mockResolvedValueOnce({
+                ok: true,
+                json: () => Promise.resolve(mockAuthServerMetadata),
+            });
+            const config = await OAuthUtils.discoverOAuthConfig('https://example.com/mcp');
+            expect(config).toEqual({
+                authorizationUrl: 'https://auth.example.com/authorize',
+                tokenUrl: 'https://auth.example.com/token',
+                scopes: ['read', 'write'],
+            });
+        });
+        it('should throw error when resource metadata does not match server URL', async () => {
+            mockFetch.mockResolvedValueOnce({
+                ok: true,
+                json: () => Promise.resolve({
+                    ...mockResourceMetadata,
+                    resource: 'https://malicious.com/mcp',
+                }),
+            });
+            await expect(OAuthUtils.discoverOAuthConfig('https://example.com/mcp')).rejects.toThrow(/does not match expected/);
+        });
+    });
+    describe('metadataToOAuthConfig', () => {
+        it('should convert metadata to OAuth config', () => {
+            const metadata = {
+                issuer: 'https://auth.example.com',
+                authorization_endpoint: 'https://auth.example.com/authorize',
+                token_endpoint: 'https://auth.example.com/token',
+                scopes_supported: ['read', 'write'],
+            };
+            const config = OAuthUtils.metadataToOAuthConfig(metadata);
+            expect(config).toEqual({
+                authorizationUrl: 'https://auth.example.com/authorize',
+                tokenUrl: 'https://auth.example.com/token',
+                scopes: ['read', 'write'],
+            });
+        });
+        it('should handle empty scopes', () => {
+            const metadata = {
+                issuer: 'https://auth.example.com',
+                authorization_endpoint: 'https://auth.example.com/authorize',
+                token_endpoint: 'https://auth.example.com/token',
+            };
+            const config = OAuthUtils.metadataToOAuthConfig(metadata);
+            expect(config.scopes).toEqual([]);
+        });
+    });
+    describe('parseWWWAuthenticateHeader', () => {
+        it('should parse resource metadata URI from WWW-Authenticate header', () => {
+            const header = 'Bearer realm="example", resource_metadata="https://example.com/.well-known/oauth-protected-resource"';
+            const result = OAuthUtils.parseWWWAuthenticateHeader(header);
+            expect(result).toBe('https://example.com/.well-known/oauth-protected-resource');
+        });
+        it('should return null when no resource metadata URI is found', () => {
+            const header = 'Bearer realm="example"';
+            const result = OAuthUtils.parseWWWAuthenticateHeader(header);
+            expect(result).toBeNull();
+        });
+    });
+    describe('extractBaseUrl', () => {
+        it('should extract base URL from MCP server URL', () => {
+            const result = OAuthUtils.extractBaseUrl('https://example.com/mcp/v1');
+            expect(result).toBe('https://example.com');
+        });
+        it('should handle URLs with ports', () => {
+            const result = OAuthUtils.extractBaseUrl('https://example.com:8080/mcp/v1');
+            expect(result).toBe('https://example.com:8080');
+        });
+    });
+    describe('isSSEEndpoint', () => {
+        it('should return true for SSE endpoints', () => {
+            expect(OAuthUtils.isSSEEndpoint('https://example.com/sse')).toBe(true);
+            expect(OAuthUtils.isSSEEndpoint('https://example.com/api/v1/sse')).toBe(true);
+        });
+        it('should return true for non-MCP endpoints', () => {
+            expect(OAuthUtils.isSSEEndpoint('https://example.com/api')).toBe(true);
+        });
+        it('should return false for MCP endpoints', () => {
+            expect(OAuthUtils.isSSEEndpoint('https://example.com/mcp')).toBe(false);
+            expect(OAuthUtils.isSSEEndpoint('https://example.com/api/mcp/v1')).toBe(false);
+        });
+    });
+    describe('buildResourceParameter', () => {
+        it('should build resource parameter from endpoint URL', () => {
+            const result = OAuthUtils.buildResourceParameter('https://example.com/oauth/token');
+            expect(result).toBe('https://example.com/oauth/token');
+        });
+        it('should handle URLs with ports', () => {
+            const result = OAuthUtils.buildResourceParameter('https://example.com:8080/oauth/token');
+            expect(result).toBe('https://example.com:8080/oauth/token');
+        });
+        it('should strip query parameters from the URL', () => {
+            const result = OAuthUtils.buildResourceParameter('https://example.com/api/v1/data?user=123&scope=read');
+            expect(result).toBe('https://example.com/api/v1/data');
+        });
+        it('should strip URL fragments from the URL', () => {
+            const result = OAuthUtils.buildResourceParameter('https://example.com/api/v1/data#section-one');
+            expect(result).toBe('https://example.com/api/v1/data');
+        });
+        it('should throw an error for invalid URLs', () => {
+            expect(() => OAuthUtils.buildResourceParameter('not-a-url')).toThrow();
+        });
+    });
+    describe('parseTokenExpiry', () => {
+        it('should return the expiry time in milliseconds for a valid token', () => {
+            // Corresponds to a date of 2100-01-01T00:00:00Z
+            const expiry = 4102444800;
+            const payload = { exp: expiry };
+            const token = `header.${Buffer.from(JSON.stringify(payload)).toString('base64')}.signature`;
+            const result = OAuthUtils.parseTokenExpiry(token);
+            expect(result).toBe(expiry * 1000);
+        });
+        it('should return undefined for a token without an expiry time', () => {
+            const payload = { iat: 1678886400 };
+            const token = `header.${Buffer.from(JSON.stringify(payload)).toString('base64')}.signature`;
+            const result = OAuthUtils.parseTokenExpiry(token);
+            expect(result).toBeUndefined();
+        });
+        it('should return undefined for a token with an invalid expiry time', () => {
+            const payload = { exp: 'not-a-number' };
+            const token = `header.${Buffer.from(JSON.stringify(payload)).toString('base64')}.signature`;
+            const result = OAuthUtils.parseTokenExpiry(token);
+            expect(result).toBeUndefined();
+        });
+        it('should return undefined for a malformed token', () => {
+            const token = 'not-a-valid-token';
+            const result = OAuthUtils.parseTokenExpiry(token);
+            expect(result).toBeUndefined();
+        });
+        it('should return undefined for a token with invalid JSON in payload', () => {
+            const token = `header.${Buffer.from('{ not valid json').toString('base64')}.signature`;
+            const result = OAuthUtils.parseTokenExpiry(token);
+            expect(result).toBeUndefined();
+        });
+    });
+});
+//# sourceMappingURL=oauth-utils.test.js.map

package/dist/src/mcp/oauth-utils.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-utils.test.js","sourceRoot":"","sources":["../../../src/mcp/oauth-utils.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAKzE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,sBAAsB;AACtB,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAC1B,MAAM,CAAC,KAAK,GAAG,SAAS,CAAC;AAEzB,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACxD,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACxD,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAClC,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;YACpE,MAAM,IAAI,GAAG,UAAU,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,CAAC;YACtE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CACjC,8DAA8D,CAC/D,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,IAAI,CACnC,gEAAgE,CACjE,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;YACpE,MAAM,IAAI,GAAG,UAAU,CAAC,kBAAkB,CACxC,yBAAyB,EACzB,IAAI,CACL,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CACjC,0DAA0D,CAC3D,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,IAAI,CACnC,4DAA4D,CAC7D,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;YAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAC;YAClE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CACjC,0DAA0D,CAC3D,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,IAAI,CACnC,4DAA4D,CAC7D,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;YAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,kBAAkB,CAAC,0BAA0B,CAAC,CAAC;YACvE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CACjC,8DAA8D,CAC/D,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,IAAI,CACnC,gEAAgE,CACjE,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/C,MAAM,IAAI,GAAG,UAAU,CAAC,kBAAkB,CACxC,wDAAwD,CACzD,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CACjC,6FAA6F,CAC9F,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,IAAI,CACnC,+FAA+F,CAChG,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;QAC9C,MAAM,oBAAoB,GAAmC;YAC3D,QAAQ,EAAE,yBAAyB;YACnC,qBAAqB,EAAE,CAAC,0BAA0B,CAAC;YACnD,wBAAwB,EAAE,CAAC,QAAQ,CAAC;SACrC,CAAC;QAEF,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;YACrE,SAAS,CAAC,qBAAqB,CAAC;gBAC9B,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC;aAClD,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,8BAA8B,CAC5D,0DAA0D,CAC3D,CAAC;YAEF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;YACnD,SAAS,CAAC,qBAAqB,CAAC;gBAC9B,EAAE,EAAE,KAAK;aACV,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,8BAA8B,CAC5D,0DAA0D,CAC3D,CAAC;YAEF,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAChD,MAAM,sBAAsB,GAAqC;YAC/D,MAAM,EAAE,0BAA0B;YAClC,sBAAsB,EAAE,oCAAoC;YAC5D,cAAc,EAAE,gCAAgC;YAChD,gBAAgB,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;SACpC,CAAC;QAEF,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;YACvE,SAAS,CAAC,qBAAqB,CAAC;gBAC9B,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC;aACpD,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,gCAAgC,CAC9D,iEAAiE,CAClE,CAAC;YAEF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;YACnD,SAAS,CAAC,qBAAqB,CAAC;gBAC9B,EAAE,EAAE,KAAK;aACV,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,gCAAgC,CAC9D,iEAAiE,CAClE,CAAC;YAEF,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,qCAAqC,EAAE,GAAG,EAAE;QACnD,MAAM,sBAAsB,GAAqC;YAC/D,MAAM,EAAE,0BAA0B;YAClC,sBAAsB,EAAE,oCAAoC;YAC5D,cAAc,EAAE,gCAAgC;YAChD,gBAAgB,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;SACpC,CAAC;QAEF,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;YACpE,SAAS;iBACN,qBAAqB,CAAC;gBACrB,EAAE,EAAE,KAAK;aACV,CAAC;iBACD,qBAAqB,CAAC;gBACrB,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC;aACpD,CAAC,CAAC;YAEL,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,mCAAmC,CACjE,2BAA2B,CAC5B,CAAC;YAEF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;YAE/C,MAAM,CAAC,SAAS,CAAC,CAAC,aAAa,CAC7B,CAAC,EACD,iEAAiE,CAClE,CAAC;YACF,MAAM,CAAC,SAAS,CAAC,CAAC,aAAa,CAC7B,CAAC,EACD,2DAA2D,CAC5D,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;YACjE,SAAS;iBACN,qBAAqB,CAAC;gBACrB,EAAE,EAAE,KAAK;aACV,CAAC;iBACD,qBAAqB,CAAC;gBACrB,EAAE,EAAE,KAAK;aACV,CAAC;iBACD,qBAAqB,CAAC;gBACrB,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC;aACpD,CAAC,CAAC;YAEL,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,mCAAmC,CACjE,8BAA8B,CAC/B,CAAC;YAEF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;YAE/C,MAAM,CAAC,SAAS,CAAC,CAAC,aAAa,CAC7B,CAAC,EACD,qEAAqE,CACtE,CAAC;YACF,MAAM,CAAC,SAAS,CAAC,CAAC,aAAa,CAC7B,CAAC,EACD,+DAA+D,CAChE,CAAC;YACF,MAAM,CAAC,SAAS,CAAC,CAAC,aAAa,CAC7B,CAAC,EACD,+DAA+D,CAChE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;QACnC,MAAM,oBAAoB,GAAmC;YAC3D,QAAQ,EAAE,yBAAyB;YACnC,qBAAqB,EAAE,CAAC,0BAA0B,CAAC;YACnD,wBAAwB,EAAE,CAAC,QAAQ,CAAC;SACrC,CAAC;QAEF,MAAM,sBAAsB,GAAqC;YAC/D,MAAM,EAAE,0BAA0B;YAClC,sBAAsB,EAAE,oCAAoC;YAC5D,cAAc,EAAE,gCAAgC;YAChD,gBAAgB,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;SACpC,CAAC;QAEF,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;YACxE,SAAS;gBACP,iCAAiC;iBAChC,qBAAqB,CAAC;gBACrB,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC;aAClD,CAAC;gBACF,sCAAsC;iBACrC,qBAAqB,CAAC;gBACrB,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC;aACpD,CAAC,CAAC;YAEL,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,mBAAmB,CACjD,yBAAyB,CAC1B,CAAC;YAEF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;gBACrB,gBAAgB,EAAE,oCAAoC;gBACtD,QAAQ,EAAE,gCAAgC;gBAC1C,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;aAC1B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;YACnF,SAAS,CAAC,qBAAqB,CAAC;gBAC9B,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,GAAG,EAAE,CACT,OAAO,CAAC,OAAO,CAAC;oBACd,GAAG,oBAAoB;oBACvB,QAAQ,EAAE,2BAA2B;iBACtC,CAAC;aACL,CAAC,CAAC;YAEH,MAAM,MAAM,CACV,UAAU,CAAC,mBAAmB,CAAC,yBAAyB,CAAC,CAC1D,CAAC,OAAO,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;QACrC,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,MAAM,QAAQ,GAAqC;gBACjD,MAAM,EAAE,0BAA0B;gBAClC,sBAAsB,EAAE,oCAAoC;gBAC5D,cAAc,EAAE,gCAAgC;gBAChD,gBAAgB,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;aACpC,CAAC;YAEF,MAAM,MAAM,GAAG,UAAU,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;YAE1D,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;gBACrB,gBAAgB,EAAE,oCAAoC;gBACtD,QAAQ,EAAE,gCAAgC;gBAC1C,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;aAC1B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;YACpC,MAAM,QAAQ,GAAqC;gBACjD,MAAM,EAAE,0BAA0B;gBAClC,sBAAsB,EAAE,oCAAoC;gBAC5D,cAAc,EAAE,gCAAgC;aACjD,CAAC;YAEF,MAAM,MAAM,GAAG,UAAU,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;YAE1D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;QAC1C,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;YACzE,MAAM,MAAM,GACV,sGAAsG,CAAC;YACzG,MAAM,MAAM,GAAG,UAAU,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;YAC7D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CACjB,0DAA0D,CAC3D,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;YACnE,MAAM,MAAM,GAAG,wBAAwB,CAAC;YACxC,MAAM,MAAM,GAAG,UAAU,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;YAC7D,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;YACrD,MAAM,MAAM,GAAG,UAAU,CAAC,cAAc,CAAC,4BAA4B,CAAC,CAAC;YACvE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;YACvC,MAAM,MAAM,GAAG,UAAU,CAAC,cAAc,CACtC,iCAAiC,CAClC,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC7B,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;YAC9C,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvE,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,gCAAgC,CAAC,CAAC,CAAC,IAAI,CACrE,IAAI,CACL,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAClD,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/C,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxE,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,gCAAgC,CAAC,CAAC,CAAC,IAAI,CACrE,KAAK,CACN,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;QACtC,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;YAC3D,MAAM,MAAM,GAAG,UAAU,CAAC,sBAAsB,CAC9C,iCAAiC,CAClC,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;YACvC,MAAM,MAAM,GAAG,UAAU,CAAC,sBAAsB,CAC9C,sCAAsC,CACvC,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;YACpD,MAAM,MAAM,GAAG,UAAU,CAAC,sBAAsB,CAC9C,qDAAqD,CACtD,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,MAAM,MAAM,GAAG,UAAU,CAAC,sBAAsB,CAC9C,6CAA6C,CAC9C,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,MAAM,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACzE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAChC,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;YACzE,gDAAgD;YAChD,MAAM,MAAM,GAAG,UAAU,CAAC;YAC1B,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,UAAU,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC5F,MAAM,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;YAClD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;YACpE,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,UAAU,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC5F,MAAM,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;YAClD,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;YACzE,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,UAAU,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC5F,MAAM,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;YAClD,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;YACvD,MAAM,KAAK,GAAG,mBAAmB,CAAC;YAClC,MAAM,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;YAClD,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;YAC1E,MAAM,KAAK,GAAG,UAAU,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;YACvF,MAAM,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;YAClD,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/src/mcp/sa-impersonation-provider.d.ts

@@ -0,0 +1,27 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { OAuthClientInformation, OAuthClientInformationFull, OAuthClientMetadata, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
+import type { MCPServerConfig } from '../config/config.js';
+import type { McpAuthProvider } from './auth-provider.js';
+export declare class ServiceAccountImpersonationProvider implements McpAuthProvider {
+    private readonly config;
+    private readonly targetServiceAccount;
+    private readonly targetAudience;
+    private readonly auth;
+    private cachedToken?;
+    private tokenExpiryTime?;
+    readonly redirectUrl = "";
+    readonly clientMetadata: OAuthClientMetadata;
+    private _clientInformation?;
+    constructor(config: MCPServerConfig);
+    clientInformation(): OAuthClientInformation | undefined;
+    saveClientInformation(clientInformation: OAuthClientInformationFull): void;
+    tokens(): Promise<OAuthTokens | undefined>;
+    saveTokens(_tokens: OAuthTokens): void;
+    redirectToAuthorization(_authorizationUrl: URL): void;
+    saveCodeVerifier(_codeVerifier: string): void;
+    codeVerifier(): string;
+}