@forumone/throughline 2.2.0 → 2.3.0-pr-315-e1a501e

package/dist/mcp-oauth/crypto.js

@@ -0,0 +1,91 @@
+import { createHash, createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+/*
+Every secret this module hands out, and how each is kept.
+
+**Tokens are opaque and stored hashed.** An access token is a random string,
+not a JWT: it is looked up on every MCP request anyway, to re-read the person's
+role, so a signature would buy nothing and would make revocation wait for
+expiry. The database holds an HMAC of each token, keyed from the Payload
+secret, so a leaked table is no use without the secret — the same arrangement
+Payload uses for API keys (`apiKeyIndex`).
+
+**The authorization request travels sealed.** Between `/authorize` and the
+consent screen the request is carried in the URL, HMAC-signed and dated, rather
+than stored: nothing is written until somebody actually clicks Allow, so an
+unauthenticated GET cannot fill a table.
+
+Each use derives its own key from the Payload secret, so a value minted for one
+purpose cannot be replayed as another.
+*/
+export const TOKEN_PREFIX = {
+    access: 'tlo_at_',
+    refresh: 'tlo_rt_',
+    code: 'tlo_ac_',
+    client: 'tlo_client_',
+};
+function base64url(bytes) {
+    return bytes.toString('base64url');
+}
+/** A fresh random token with a recognisable prefix. */
+export function newToken(prefix) {
+    return `${prefix}${base64url(randomBytes(32))}`;
+}
+/** A client id: shorter, because it is not a secret. */
+export function newClientId() {
+    return `${TOKEN_PREFIX.client}${base64url(randomBytes(16))}`;
+}
+/** A key for one purpose, from the Payload secret. */
+export function deriveKey(secret, purpose) {
+    return createHmac('sha256', secret).update(`throughline:mcp-oauth:${purpose}`).digest();
+}
+/** What the database stores in place of a token. */
+export function hashToken(key, token) {
+    return createHmac('sha256', key).update(token).digest('hex');
+}
+/**
+ * PKCE S256 (RFC 7636 §4.6). The verifier is 43–128 unreserved characters;
+ * anything else fails before it is hashed.
+ */
+export function verifyPkce(verifier, challenge) {
+    if (typeof verifier !== 'string' || !/^[A-Za-z0-9._~-]{43,128}$/.test(verifier))
+        return false;
+    const computed = base64url(createHash('sha256').update(verifier).digest());
+    const a = Buffer.from(computed);
+    const b = Buffer.from(challenge);
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+/** A code challenge as RFC 7636 §4.2 shapes it: 43 base64url characters. */
+export function isCodeChallenge(value) {
+    return typeof value === 'string' && /^[A-Za-z0-9_-]{43}$/.test(value);
+}
+/** Signs `value` with an expiry, for carrying through a URL. */
+export function seal(key, value, ttlSeconds, now = Date.now()) {
+    const body = base64url(Buffer.from(JSON.stringify({ ...value, exp: Math.floor(now / 1000) + ttlSeconds })));
+    const mac = base64url(createHmac('sha256', key).update(body).digest());
+    return `${body}.${mac}`;
+}
+/**
+ * The sealed value, if this server signed it and it has not expired. The MAC is
+ * checked before anything is parsed.
+ */
+export function unseal(key, sealed, now = Date.now()) {
+    if (typeof sealed !== 'string')
+        return undefined;
+    const [body, mac, ...rest] = sealed.split('.');
+    if (!body || !mac || rest.length > 0)
+        return undefined;
+    const expected = Buffer.from(base64url(createHmac('sha256', key).update(body).digest()));
+    const given = Buffer.from(mac);
+    if (expected.length !== given.length || !timingSafeEqual(expected, given))
+        return undefined;
+    try {
+        const value = JSON.parse(Buffer.from(body, 'base64url').toString('utf8'));
+        if (typeof value.exp !== 'number' || value.exp * 1000 < now)
+            return undefined;
+        return value;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=crypto.js.map

package/dist/mcp-oauth/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/mcp-oauth/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAElF;;;;;;;;;;;;;;;;;EAiBE;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,MAAM,EAAE,SAAS;IACjB,OAAO,EAAE,SAAS;IAClB,IAAI,EAAE,SAAS;IACf,MAAM,EAAE,aAAa;CACb,CAAA;AAEV,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AACpC,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,QAAQ,CAAC,MAAc;IACrC,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,EAAE,CAAA;AACjD,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,WAAW;IACzB,OAAO,GAAG,YAAY,CAAC,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,EAAE,CAAA;AAC9D,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,SAAS,CAAC,MAAc,EAAE,OAA4B;IACpE,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,yBAAyB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAA;AACzF,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,SAAS,CAAC,GAAW,EAAE,KAAa;IAClD,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,QAAiB,EAAE,SAAiB;IAC7D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAA;IAC7F,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;IAC1E,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC/B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAChC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AACvD,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AACvE,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,IAAI,CAAC,GAAW,EAAE,KAAa,EAAE,UAAkB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACnF,MAAM,IAAI,GAAG,SAAS,CACpB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,UAAU,EAAE,CAAC,CAAC,CACpF,CAAA;IACD,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;IACtE,OAAO,GAAG,IAAI,IAAI,GAAG,EAAE,CAAA;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,MAAM,CACpB,GAAW,EACX,MAAe,EACf,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAChD,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9C,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAA;IACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IACxF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAC3F,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAEvE,CAAA;QACD,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,GAAG,IAAI,GAAG,GAAG;YAAE,OAAO,SAAS,CAAA;QAC7E,OAAO,KAAK,CAAA;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC"}

package/dist/mcp-oauth/endpoints.d.ts

@@ -0,0 +1,11 @@
+import type { Endpoint } from 'payload';
+import type { FetchLike } from './cimd.js';
+import { type McpOAuthRuntime } from './runtime.js';
+/** `redirectUri` with the response parameters added, `iss` always among them. */
+export declare function withParams(redirectUri: string, params: Record<string, string | undefined>): string;
+export interface EndpointOptions {
+    /** For tests: how a client metadata document is fetched. */
+    fetch?: FetchLike;
+}
+export declare function oauthEndpoints(runtime: McpOAuthRuntime, options?: EndpointOptions): Endpoint[];
+//# sourceMappingURL=endpoints.d.ts.map

package/dist/mcp-oauth/endpoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoints.d.ts","sourceRoot":"","sources":["../../src/mcp-oauth/endpoints.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAkB,MAAM,SAAS,CAAA;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAK1C,OAAO,EAA2C,KAAK,eAAe,EAAE,MAAM,cAAc,CAAA;AA2E5F,iFAAiF;AACjF,wBAAgB,UAAU,CACxB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACzC,MAAM,CAMR;AAoDD,MAAM,WAAW,eAAe;IAC9B,4DAA4D;IAC5D,KAAK,CAAC,EAAE,SAAS,CAAA;CAClB;AAED,wBAAgB,cAAc,CAC5B,OAAO,EAAE,eAAe,EACxB,OAAO,GAAE,eAAoB,GAC5B,QAAQ,EAAE,CAoTZ"}

package/dist/mcp-oauth/endpoints.js

@@ -0,0 +1,365 @@
+import { clientKindFor, redirectRegistered } from './clients.js';
+import { signedInPerson } from './collections.js';
+import { isCodeChallenge, seal, unseal } from './crypto.js';
+import { authorizationServerMetadata, protectedResourceMetadata } from './metadata.js';
+import { keys, MCP_OAUTH_GRANTS_SLUG, readPolicy } from './runtime.js';
+import { createPendingGrant, exchangeCode, refresh, registerClient, resolveClient, revokeGrant, revokeToken, } from './store.js';
+/*
+The authorization server, as Payload endpoints under `/api/oauth`.
+
+| Endpoint | Who calls it |
+| --- | --- |
+| `GET  metadata`, `GET protected-resource` | the app, discovering (rewritten from `/.well-known`) |
+| `POST register` | the app, registering itself (RFC 7591) |
+| `GET  authorize` | the person's browser, sent by the app |
+| `POST consent` | the consent screen, signed in |
+| `POST token` | the app: a code or a refresh token for tokens |
+| `POST revoke` | the app, disconnecting (RFC 7009) |
+| `POST grants/:id/revoke` | the Connect MCP page, signed in |
+
+The app-facing ones answer any origin, because a browser-based MCP client calls
+them cross-origin and none of them takes a cookie. The two a signed-in person
+calls refuse a cross-origin request outright: they act on the session cookie, so
+an `Origin` that is not this site is a forgery.
+*/
+const APP_CORS = {
+    'access-control-allow-origin': '*',
+    'access-control-allow-methods': 'GET, POST, OPTIONS',
+    'access-control-allow-headers': 'authorization, content-type, mcp-protocol-version',
+    'access-control-max-age': '86400',
+};
+function json(body, status = 200, headers = {}) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: { 'content-type': 'application/json', ...headers },
+    });
+}
+function appJson(body, status = 200) {
+    return json(body, status, { ...APP_CORS, 'cache-control': 'no-store', pragma: 'no-cache' });
+}
+function escapeHtml(value) {
+    return value.replace(/[&<>"']/g, (char) => `&#${char.charCodeAt(0)};`);
+}
+/*
+An error the browser shows rather than one sent back to the app. RFC 6749
+§4.1.2.1: when the client or its redirect cannot be trusted, the server must not
+redirect — that would make it an open redirector for anybody who can write a
+URL. So these are a page, with a way back to the instructions.
+*/
+function errorPage(runtime, adminRoute, title, message) {
+    const html = `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${escapeHtml(title)}</title>
+<style>body{font:16px/1.5 system-ui,sans-serif;max-width:36rem;margin:10vh auto;padding:0 1rem;color:#1a1a1a}h1{font-size:1.4rem}a{color:inherit}</style></head>
+<body><h1>${escapeHtml(title)}</h1><p>${escapeHtml(message)}</p>
+<p><a href="${escapeHtml(`${adminRoute}${runtime.connectPath}`)}">How to connect an app to ${escapeHtml(runtime.serverName)}</a></p></body></html>`;
+    return new Response(html, {
+        status: 400,
+        headers: { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' },
+    });
+}
+/** `redirectUri` with the response parameters added, `iss` always among them. */
+export function withParams(redirectUri, params) {
+    const url = new URL(redirectUri);
+    for (const [name, value] of Object.entries(params)) {
+        if (value !== undefined)
+            url.searchParams.set(name, value);
+    }
+    return url.toString();
+}
+function sameResource(given, ours) {
+    return given.replace(/\/+$/, '') === ours.replace(/\/+$/, '');
+}
+async function readParams(req) {
+    const type = req.headers.get('content-type') ?? '';
+    const text = typeof req.text === 'function' ? await req.text() : '';
+    if (type.includes('application/json')) {
+        try {
+            const parsed = JSON.parse(text);
+            return Object.fromEntries(Object.entries(parsed).filter((entry) => typeof entry[1] === 'string'));
+        }
+        catch {
+            return {};
+        }
+    }
+    return Object.fromEntries(new URLSearchParams(text));
+}
+async function readJson(req) {
+    try {
+        const text = typeof req.text === 'function' ? await req.text() : '';
+        const parsed = JSON.parse(text);
+        return parsed && typeof parsed === 'object' && !Array.isArray(parsed)
+            ? parsed
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** True when a cookie-authenticated request came from this site. */
+function sameOrigin(req, runtime) {
+    const origin = req.headers.get('origin');
+    if (!origin)
+        return false;
+    if (origin === runtime.origin)
+        return true;
+    try {
+        return origin === new URL(req.url ?? '').origin;
+    }
+    catch {
+        return false;
+    }
+}
+function adminRouteOf(req) {
+    return req.payload.config.routes?.admin ?? '/admin';
+}
+export function oauthEndpoints(runtime, options = {}) {
+    const preflight = (path) => ({
+        path,
+        method: 'options',
+        handler: () => new Response(null, { status: 204, headers: APP_CORS }),
+    });
+    return [
+        {
+            path: '/oauth/metadata',
+            method: 'get',
+            handler: () => json(authorizationServerMetadata(runtime), 200, {
+                ...APP_CORS,
+                'cache-control': 'public, max-age=300',
+            }),
+        },
+        {
+            path: '/oauth/protected-resource',
+            method: 'get',
+            handler: () => json(protectedResourceMetadata(runtime), 200, {
+                ...APP_CORS,
+                'cache-control': 'public, max-age=300',
+            }),
+        },
+        preflight('/oauth/metadata'),
+        preflight('/oauth/protected-resource'),
+        preflight('/oauth/register'),
+        preflight('/oauth/token'),
+        preflight('/oauth/revoke'),
+        {
+            path: '/oauth/register',
+            method: 'post',
+            handler: async (req) => {
+                const body = await readJson(req);
+                if (!body) {
+                    return appJson({
+                        error: 'invalid_client_metadata',
+                        error_description: 'The body must be a JSON object.',
+                    }, 400);
+                }
+                const redirectUris = body['redirect_uris'];
+                if (!Array.isArray(redirectUris)) {
+                    return appJson({ error: 'invalid_redirect_uri', error_description: 'redirect_uris is required.' }, 400);
+                }
+                const grantTypes = body['grant_types'];
+                if (Array.isArray(grantTypes) &&
+                    grantTypes.some((each) => each !== 'authorization_code' && each !== 'refresh_token')) {
+                    return appJson({
+                        error: 'invalid_client_metadata',
+                        error_description: 'Only authorization_code and refresh_token are supported.',
+                    }, 400);
+                }
+                const policy = await readPolicy(req.payload, runtime);
+                const name = typeof body['client_name'] === 'string' ? body['client_name'] : undefined;
+                const client = await registerClient(req.payload, policy, {
+                    redirectUris,
+                    ...(name ? { name } : {}),
+                });
+                if ('error' in client) {
+                    return appJson({ error: 'invalid_redirect_uri', error_description: client.error }, 400);
+                }
+                return appJson({
+                    client_id: client.clientId,
+                    client_id_issued_at: Math.floor(Date.now() / 1000),
+                    ...(client.name ? { client_name: client.name } : {}),
+                    redirect_uris: client.redirectUris,
+                    grant_types: ['authorization_code', 'refresh_token'],
+                    response_types: ['code'],
+                    token_endpoint_auth_method: 'none',
+                }, 201);
+            },
+        },
+        {
+            path: '/oauth/authorize',
+            method: 'get',
+            handler: async (req) => {
+                const adminRoute = adminRouteOf(req);
+                const params = new URL(req.url ?? '', runtime.origin).searchParams;
+                const policy = await readPolicy(req.payload, runtime);
+                const client = await resolveClient(req.payload, policy, params.get('client_id'), options.fetch);
+                if ('error' in client)
+                    return errorPage(runtime, adminRoute, 'This app can’t connect', client.error);
+                const requested = params.get('redirect_uri') ?? undefined;
+                const redirectUri = requested ?? (client.redirectUris.length === 1 ? client.redirectUris[0] : undefined);
+                if (!redirectUri || !redirectRegistered(redirectUri, client.redirectUris)) {
+                    return errorPage(runtime, adminRoute, 'This app can’t connect', 'The address it asked to return to is not one it registered.');
+                }
+                if (clientKindFor(redirectUri, (kind) => policy.clients[kind]) !== client.kind) {
+                    return errorPage(runtime, adminRoute, 'This app can’t connect', 'Connections from this app are turned off on this site.');
+                }
+                // From here the redirect is trusted, so errors go back to the app.
+                const state = params.get('state') ?? undefined;
+                const back = (error, description) => new Response(null, {
+                    status: 302,
+                    headers: {
+                        location: withParams(redirectUri, {
+                            error,
+                            error_description: description,
+                            state,
+                            iss: runtime.issuer,
+                        }),
+                        'cache-control': 'no-store',
+                    },
+                });
+                if (params.get('response_type') !== 'code') {
+                    return back('unsupported_response_type', 'Only response_type=code is supported.');
+                }
+                const challenge = params.get('code_challenge');
+                if (!isCodeChallenge(challenge) || params.get('code_challenge_method') !== 'S256') {
+                    return back('invalid_request', 'PKCE with code_challenge_method=S256 is required.');
+                }
+                const resource = params.get('resource');
+                if (resource && !sameResource(resource, runtime.resource)) {
+                    return back('invalid_target', `This server issues tokens for ${runtime.resource} only.`);
+                }
+                const request = {
+                    clientId: client.clientId,
+                    redirectUri,
+                    codeChallenge: challenge,
+                    ...(state !== undefined ? { state } : {}),
+                };
+                const sealed = seal(keys(req.payload).request, request, 15 * 60);
+                return new Response(null, {
+                    status: 302,
+                    headers: {
+                        location: `${adminRoute}${runtime.connectPath}/authorize?request=${encodeURIComponent(sealed)}`,
+                        'cache-control': 'no-store',
+                    },
+                });
+            },
+        },
+        {
+            path: '/oauth/consent',
+            method: 'post',
+            handler: async (req) => {
+                const user = signedInPerson(req);
+                if (!user)
+                    return json({ error: 'Sign in first.' }, 401);
+                if (!sameOrigin(req, runtime))
+                    return json({ error: 'Cross-origin request refused.' }, 403);
+                const body = await readJson(req);
+                const request = unseal(keys(req.payload).request, body?.['request']);
+                if (!request) {
+                    return json({ error: 'This sign-in request has expired. Start again from the app.' }, 400);
+                }
+                const policy = await readPolicy(req.payload, runtime);
+                const client = await resolveClient(req.payload, policy, request.clientId, options.fetch);
+                if ('error' in client)
+                    return json({ error: client.error }, 400);
+                if (!redirectRegistered(request.redirectUri, client.redirectUris)) {
+                    return json({ error: 'This app’s registration has changed. Start again from the app.' }, 400);
+                }
+                if (body?.['decision'] !== 'allow') {
+                    return json({
+                        redirect: withParams(request.redirectUri, {
+                            error: 'access_denied',
+                            error_description: 'The person declined.',
+                            state: request.state,
+                            iss: runtime.issuer,
+                        }),
+                    });
+                }
+                const verdict = runtime.eligible(user);
+                if (verdict !== true)
+                    return json({ error: verdict }, 403);
+                const code = await createPendingGrant(req.payload, user, client, request);
+                return json({
+                    redirect: withParams(request.redirectUri, {
+                        code,
+                        state: request.state,
+                        iss: runtime.issuer,
+                    }),
+                });
+            },
+        },
+        {
+            path: '/oauth/token',
+            method: 'post',
+            handler: async (req) => {
+                const params = await readParams(req);
+                if (params['resource'] && !sameResource(params['resource'], runtime.resource)) {
+                    return appJson({
+                        error: 'invalid_target',
+                        error_description: `This server issues tokens for ${runtime.resource} only.`,
+                    }, 400);
+                }
+                const policy = await readPolicy(req.payload, runtime);
+                const grantType = params['grant_type'];
+                if (grantType === 'authorization_code') {
+                    const result = await exchangeCode(req.payload, runtime, policy, {
+                        ...(params['code'] ? { code: params['code'] } : {}),
+                        ...(params['client_id'] ? { clientId: params['client_id'] } : {}),
+                        ...(params['redirect_uri'] ? { redirectUri: params['redirect_uri'] } : {}),
+                        ...(params['code_verifier'] ? { codeVerifier: params['code_verifier'] } : {}),
+                    });
+                    return appJson(result, 'error' in result ? 400 : 200);
+                }
+                if (grantType === 'refresh_token') {
+                    const result = await refresh(req.payload, runtime, policy, {
+                        ...(params['refresh_token'] ? { refreshToken: params['refresh_token'] } : {}),
+                        ...(params['client_id'] ? { clientId: params['client_id'] } : {}),
+                    });
+                    return appJson(result, 'error' in result ? 400 : 200);
+                }
+                return appJson({
+                    error: 'unsupported_grant_type',
+                    error_description: 'Use authorization_code or refresh_token.',
+                }, 400);
+            },
+        },
+        {
+            path: '/oauth/revoke',
+            method: 'post',
+            handler: async (req) => {
+                const params = await readParams(req);
+                await revokeToken(req.payload, params['token']);
+                return new Response(null, {
+                    status: 200,
+                    headers: { ...APP_CORS, 'cache-control': 'no-store' },
+                });
+            },
+        },
+        {
+            path: '/oauth/grants/:id/revoke',
+            method: 'post',
+            handler: async (req) => {
+                const user = signedInPerson(req);
+                if (!user)
+                    return json({ error: 'Sign in first.' }, 401);
+                if (!sameOrigin(req, runtime))
+                    return json({ error: 'Cross-origin request refused.' }, 403);
+                const id = req.routeParams?.['id'];
+                const grant = (await req.payload.findByID({
+                    collection: MCP_OAUTH_GRANTS_SLUG,
+                    id: id,
+                    depth: 0,
+                    overrideAccess: true,
+                    disableErrors: true,
+                }));
+                const admin = runtime.isAdmin(user);
+                if (!grant || (!admin && String(grant['user']) !== String(user['id']))) {
+                    return json({ error: 'No such connection.' }, 404);
+                }
+                if (grant['status'] !== 'revoked') {
+                    const own = String(grant['user']) === String(user['id']);
+                    await revokeGrant(req.payload, grant, own ? 'disconnected by its owner' : 'revoked by an administrator');
+                }
+                return json({ ok: true });
+            },
+        },
+    ];
+}
+//# sourceMappingURL=endpoints.js.map

package/dist/mcp-oauth/endpoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoints.js","sourceRoot":"","sources":["../../src/mcp-oauth/endpoints.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAC3D,OAAO,EAAE,2BAA2B,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAA;AACtF,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,UAAU,EAAwB,MAAM,cAAc,CAAA;AAC5F,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,OAAO,EACP,cAAc,EACd,aAAa,EACb,WAAW,EACX,WAAW,GAEZ,MAAM,YAAY,CAAA;AAEnB;;;;;;;;;;;;;;;;;EAiBE;AAEF,MAAM,QAAQ,GAAG;IACf,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,oBAAoB;IACpD,8BAA8B,EAAE,mDAAmD;IACnF,wBAAwB,EAAE,OAAO;CAClC,CAAA;AAED,SAAS,IAAI,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG,EAAE,UAAkC,EAAE;IAC7E,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE;KAC5D,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG;IAC1C,OAAO,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAA;AAC7F,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;AACxE,CAAC;AAED;;;;;EAKE;AACF,SAAS,SAAS,CAChB,OAAwB,EACxB,UAAkB,EAClB,KAAa,EACb,OAAe;IAEf,MAAM,IAAI,GAAG,yIAAyI,UAAU,CAAC,KAAK,CAAC;;YAE7J,UAAU,CAAC,KAAK,CAAC,WAAW,UAAU,CAAC,OAAO,CAAC;cAC7C,UAAU,CAAC,GAAG,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,8BAA8B,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAA;IACjJ,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,eAAe,EAAE,UAAU,EAAE;KACrF,CAAC,CAAA;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,UAAU,CACxB,WAAmB,EACnB,MAA0C;IAE1C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAA;IAChC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAC5D,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;AACvB,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,IAAY;IAC/C,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AAC/D,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,GAAmB;IAC3C,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAA;IAClD,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACnE,IAAI,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAA;YAC1D,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAC3B,CAAC,KAAK,EAA6B,EAAE,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CACnE,CACF,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAA;AACtD,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAmB;IACzC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAA;QAC1C,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACnE,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,SAAS,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,SAAS,UAAU,CAAC,GAAmB,EAAE,OAAwB;IAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACzB,IAAI,MAAM,KAAK,OAAO,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IAC1C,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,MAAM,CAAA;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,GAAmB;IACvC,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,QAAQ,CAAA;AACrD,CAAC;AAOD,MAAM,UAAU,cAAc,CAC5B,OAAwB,EACxB,UAA2B,EAAE;IAE7B,MAAM,SAAS,GAAG,CAAC,IAAY,EAAY,EAAE,CAAC,CAAC;QAC7C,IAAI;QACJ,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;KACtE,CAAC,CAAA;IAEF,OAAO;QACL;YACE,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,GAAG,EAAE,CACZ,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE;gBAC9C,GAAG,QAAQ;gBACX,eAAe,EAAE,qBAAqB;aACvC,CAAC;SACL;QACD;YACE,IAAI,EAAE,2BAA2B;YACjC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,GAAG,EAAE,CACZ,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE;gBAC5C,GAAG,QAAQ;gBACX,eAAe,EAAE,qBAAqB;aACvC,CAAC;SACL;QACD,SAAS,CAAC,iBAAiB,CAAC;QAC5B,SAAS,CAAC,2BAA2B,CAAC;QACtC,SAAS,CAAC,iBAAiB,CAAC;QAC5B,SAAS,CAAC,cAAc,CAAC;QACzB,SAAS,CAAC,eAAe,CAAC;QAE1B;YACE,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACrB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAA;gBAChC,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,OAAO,OAAO,CACZ;wBACE,KAAK,EAAE,yBAAyB;wBAChC,iBAAiB,EAAE,iCAAiC;qBACrD,EACD,GAAG,CACJ,CAAA;gBACH,CAAC;gBACD,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,CAAA;gBAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;oBACjC,OAAO,OAAO,CACZ,EAAE,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,EAClF,GAAG,CACJ,CAAA;gBACH,CAAC;gBACD,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,CAAA;gBACtC,IACE,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;oBACzB,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,oBAAoB,IAAI,IAAI,KAAK,eAAe,CAAC,EACpF,CAAC;oBACD,OAAO,OAAO,CACZ;wBACE,KAAK,EAAE,yBAAyB;wBAChC,iBAAiB,EAAE,0DAA0D;qBAC9E,EACD,GAAG,CACJ,CAAA;gBACH,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;gBACrD,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;gBACtF,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE;oBACvD,YAAY;oBACZ,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1B,CAAC,CAAA;gBACF,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;oBACtB,OAAO,OAAO,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,CAAA;gBACzF,CAAC;gBACD,OAAO,OAAO,CACZ;oBACE,SAAS,EAAE,MAAM,CAAC,QAAQ;oBAC1B,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;oBAClD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACpD,aAAa,EAAE,MAAM,CAAC,YAAY;oBAClC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;oBACpD,cAAc,EAAE,CAAC,MAAM,CAAC;oBACxB,0BAA0B,EAAE,MAAM;iBACnC,EACD,GAAG,CACJ,CAAA;YACH,CAAC;SACF;QAED;YACE,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACrB,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;gBACpC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,YAAY,CAAA;gBAClE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;gBAErD,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,GAAG,CAAC,OAAO,EACX,MAAM,EACN,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EACvB,OAAO,CAAC,KAAK,CACd,CAAA;gBACD,IAAI,OAAO,IAAI,MAAM;oBACnB,OAAO,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;gBAE/E,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS,CAAA;gBACzD,MAAM,WAAW,GACf,SAAS,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;gBACtF,IAAI,CAAC,WAAW,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;oBAC1E,OAAO,SAAS,CACd,OAAO,EACP,UAAU,EACV,wBAAwB,EACxB,6DAA6D,CAC9D,CAAA;gBACH,CAAC;gBACD,IAAI,aAAa,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;oBAC/E,OAAO,SAAS,CACd,OAAO,EACP,UAAU,EACV,wBAAwB,EACxB,wDAAwD,CACzD,CAAA;gBACH,CAAC;gBAED,mEAAmE;gBACnE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAA;gBAC9C,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,WAAmB,EAAE,EAAE,CAClD,IAAI,QAAQ,CAAC,IAAI,EAAE;oBACjB,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE;wBACP,QAAQ,EAAE,UAAU,CAAC,WAAW,EAAE;4BAChC,KAAK;4BACL,iBAAiB,EAAE,WAAW;4BAC9B,KAAK;4BACL,GAAG,EAAE,OAAO,CAAC,MAAM;yBACpB,CAAC;wBACF,eAAe,EAAE,UAAU;qBAC5B;iBACF,CAAC,CAAA;gBAEJ,IAAI,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,MAAM,EAAE,CAAC;oBAC3C,OAAO,IAAI,CAAC,2BAA2B,EAAE,uCAAuC,CAAC,CAAA;gBACnF,CAAC;gBACD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;gBAC9C,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,MAAM,EAAE,CAAC;oBAClF,OAAO,IAAI,CAAC,iBAAiB,EAAE,mDAAmD,CAAC,CAAA;gBACrF,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;gBACvC,IAAI,QAAQ,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC1D,OAAO,IAAI,CAAC,gBAAgB,EAAE,iCAAiC,OAAO,CAAC,QAAQ,QAAQ,CAAC,CAAA;gBAC1F,CAAC;gBAED,MAAM,OAAO,GAAmB;oBAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,WAAW;oBACX,aAAa,EAAE,SAAS;oBACxB,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1C,CAAA;gBACD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;gBAChE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;oBACxB,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE;wBACP,QAAQ,EAAE,GAAG,UAAU,GAAG,OAAO,CAAC,WAAW,sBAAsB,kBAAkB,CAAC,MAAM,CAAC,EAAE;wBAC/F,eAAe,EAAE,UAAU;qBAC5B;iBACF,CAAC,CAAA;YACJ,CAAC;SACF;QAED;YACE,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACrB,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAA;gBAChC,IAAI,CAAC,IAAI;oBAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAA;gBACxD,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;oBAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,EAAE,GAAG,CAAC,CAAA;gBAE3F,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAA;gBAChC,MAAM,OAAO,GAAG,MAAM,CAAiB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;gBACpF,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,6DAA6D,EAAE,EAAE,GAAG,CAAC,CAAA;gBAC5F,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;gBACrD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;gBACxF,IAAI,OAAO,IAAI,MAAM;oBAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,CAAA;gBAChE,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;oBAClE,OAAO,IAAI,CACT,EAAE,KAAK,EAAE,gEAAgE,EAAE,EAC3E,GAAG,CACJ,CAAA;gBACH,CAAC;gBAED,IAAI,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,OAAO,EAAE,CAAC;oBACnC,OAAO,IAAI,CAAC;wBACV,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE;4BACxC,KAAK,EAAE,eAAe;4BACtB,iBAAiB,EAAE,sBAAsB;4BACzC,KAAK,EAAE,OAAO,CAAC,KAAK;4BACpB,GAAG,EAAE,OAAO,CAAC,MAAM;yBACpB,CAAC;qBACH,CAAC,CAAA;gBACJ,CAAC;gBAED,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;gBACtC,IAAI,OAAO,KAAK,IAAI;oBAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAA;gBAE1D,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;gBACzE,OAAO,IAAI,CAAC;oBACV,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE;wBACxC,IAAI;wBACJ,KAAK,EAAE,OAAO,CAAC,KAAK;wBACpB,GAAG,EAAE,OAAO,CAAC,MAAM;qBACpB,CAAC;iBACH,CAAC,CAAA;YACJ,CAAC;SACF;QAED;YACE,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACrB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAA;gBACpC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC9E,OAAO,OAAO,CACZ;wBACE,KAAK,EAAE,gBAAgB;wBACvB,iBAAiB,EAAE,iCAAiC,OAAO,CAAC,QAAQ,QAAQ;qBAC7E,EACD,GAAG,CACJ,CAAA;gBACH,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;gBACrD,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,CAAA;gBAEtC,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;oBACvC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE;wBAC9D,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACnD,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACjE,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC1E,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC9E,CAAC,CAAA;oBACF,OAAO,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;gBACvD,CAAC;gBACD,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;oBAClC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE;wBACzD,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC7E,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAClE,CAAC,CAAA;oBACF,OAAO,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;gBACvD,CAAC;gBACD,OAAO,OAAO,CACZ;oBACE,KAAK,EAAE,wBAAwB;oBAC/B,iBAAiB,EAAE,0CAA0C;iBAC9D,EACD,GAAG,CACJ,CAAA;YACH,CAAC;SACF;QAED;YACE,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACrB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAA;gBACpC,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;gBAC/C,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;oBACxB,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,GAAG,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE;iBACtD,CAAC,CAAA;YACJ,CAAC;SACF;QAED;YACE,IAAI,EAAE,0BAA0B;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACrB,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAA;gBAChC,IAAI,CAAC,IAAI;oBAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAA;gBACxD,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;oBAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,EAAE,GAAG,CAAC,CAAA;gBAE3F,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAA;gBAClC,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC;oBACxC,UAAU,EAAE,qBAA8B;oBAC1C,EAAE,EAAE,EAAW;oBACf,KAAK,EAAE,CAAC;oBACR,cAAc,EAAE,IAAI;oBACpB,aAAa,EAAE,IAAI;iBACpB,CAAC,CAA8C,CAAA;gBAChD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;gBACnC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAA;gBACpD,CAAC;gBACD,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,SAAS,EAAE,CAAC;oBAClC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;oBACxD,MAAM,WAAW,CACf,GAAG,CAAC,OAAO,EACX,KAAK,EACL,GAAG,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,6BAA6B,CAClE,CAAA;gBACH,CAAC;gBACD,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;YAC3B,CAAC;SACF;KACF,CAAA;AACH,CAAC"}

package/dist/mcp-oauth/index.d.ts

@@ -0,0 +1,10 @@
+export { mcpOAuth, CONNECT_MCP_VIEW_PATH, MCP_AUTHORIZE_VIEW_PATH } from './plugin.js';
+export type { McpOAuth } from './plugin.js';
+export { createOverrideAuth } from './auth.js';
+export type { McpAccessSettings, OverrideAuth } from './auth.js';
+export { MCP_ACCESS_SLUG, MCP_OAUTH_CLIENTS_SLUG, MCP_OAUTH_GRANTS_SLUG, MCP_OAUTH_STRATEGY, readPolicy, toolsFor, } from './runtime.js';
+export type { McpAccessPolicy, McpOAuthOptions, McpOAuthRuntime } from './runtime.js';
+export { MCP_CLIENT_KINDS, MCP_CLIENT_RULES, classifyRedirects, clientKindFor, redirectRegistered, } from './clients.js';
+export type { McpClientKind, McpClientRule } from './clients.js';
+export { authorizationServerMetadata, mcpOAuthRewrites, protectedResourceMetadata, protectedResourceMetadataUrl, } from './metadata.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/mcp-oauth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mcp-oauth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AACtF,YAAY,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAC9C,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,EAClB,UAAU,EACV,QAAQ,GACT,MAAM,cAAc,CAAA;AACrB,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AACrF,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,kBAAkB,GACnB,MAAM,cAAc,CAAA;AACrB,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAChE,OAAO,EACL,2BAA2B,EAC3B,gBAAgB,EAChB,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,eAAe,CAAA"}

package/dist/mcp-oauth/index.js

@@ -0,0 +1,6 @@
+export { mcpOAuth, CONNECT_MCP_VIEW_PATH, MCP_AUTHORIZE_VIEW_PATH } from './plugin.js';
+export { createOverrideAuth } from './auth.js';
+export { MCP_ACCESS_SLUG, MCP_OAUTH_CLIENTS_SLUG, MCP_OAUTH_GRANTS_SLUG, MCP_OAUTH_STRATEGY, readPolicy, toolsFor, } from './runtime.js';
+export { MCP_CLIENT_KINDS, MCP_CLIENT_RULES, classifyRedirects, clientKindFor, redirectRegistered, } from './clients.js';
+export { authorizationServerMetadata, mcpOAuthRewrites, protectedResourceMetadata, protectedResourceMetadataUrl, } from './metadata.js';
+//# sourceMappingURL=index.js.map

package/dist/mcp-oauth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mcp-oauth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAEtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAE9C,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,EAClB,UAAU,EACV,QAAQ,GACT,MAAM,cAAc,CAAA;AAErB,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,kBAAkB,GACnB,MAAM,cAAc,CAAA;AAErB,OAAO,EACL,2BAA2B,EAC3B,gBAAgB,EAChB,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,eAAe,CAAA"}

package/dist/mcp-oauth/metadata.d.ts

@@ -0,0 +1,45 @@
+import type { McpOAuthRuntime } from './runtime.js';
+export declare const MCP_SCOPE = "mcp";
+export declare function authorizationServerMetadata(runtime: McpOAuthRuntime): {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    registration_endpoint: string;
+    revocation_endpoint: string;
+    response_types_supported: string[];
+    response_modes_supported: string[];
+    grant_types_supported: string[];
+    token_endpoint_auth_methods_supported: string[];
+    revocation_endpoint_auth_methods_supported: string[];
+    code_challenge_methods_supported: string[];
+    scopes_supported: string[];
+    client_id_metadata_document_supported: boolean;
+    authorization_response_iss_parameter_supported: boolean;
+};
+export declare function protectedResourceMetadata(runtime: McpOAuthRuntime): {
+    resource: string;
+    authorization_servers: string[];
+    bearer_methods_supported: string[];
+    scopes_supported: string[];
+    resource_name: string;
+};
+/** Where the protected-resource metadata is served. */
+export declare function protectedResourceMetadataUrl(runtime: McpOAuthRuntime): string;
+/**
+ * Rewrites for `next.config`, so the well-known paths at the root reach the
+ * endpoints Payload serves under its API route. Payload only routes under
+ * `/api`; RFC 8414 and RFC 9728 put discovery at `/.well-known`.
+ *
+ * ```js
+ * async rewrites() {
+ *   return mcpOAuthRewrites()
+ * }
+ * ```
+ */
+export declare function mcpOAuthRewrites({ apiRoute }?: {
+    apiRoute?: string;
+}): {
+    source: string;
+    destination: string;
+}[];
+//# sourceMappingURL=metadata.d.ts.map

package/dist/mcp-oauth/metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.d.ts","sourceRoot":"","sources":["../../src/mcp-oauth/metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAsBnD,eAAO,MAAM,SAAS,QAAQ,CAAA;AAE9B,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,eAAe;;;;;;;;;;;;;;;EAiBnE;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,eAAe;;;;;;EAQjE;AAED,uDAAuD;AACvD,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,eAAe,GAAG,MAAM,CAE7E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,QAAiB,EAAE,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO;;;IAoBjF"}