@frontmcp/sdk 0.2.5 → 0.3.1

package/src/auth/flows/oauth.register.flow.js

@@ -0,0 +1,201 @@
+"use strict";
+/**
+ * Dynamic Client Registration — POST /oauth/register
+ *
+ * Who calls: Developers/automation.
+ *
+ * Purpose: Let clients register programmatically (redirect URIs, grant types, etc.).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DevClientRegistry = void 0;
+const tslib_1 = require("tslib");
+/**
+ * Quick checklist (security & correctness)
+ * - PKCE (S256) required for public clients (and basically for all).
+ * - Use authorization code grant only (no implicit/hybrid).
+ * - Rotate refresh tokens and bind them to client + user + scopes.
+ * - Prefer private_key_jwt or mTLS for confidential clients.
+ * - PAR + JAR recommended for higher security.
+ * - Consider DPoP (proof-of-possession) to reduce token replay.
+ * - Keep codes very short-lived (e.g., ≤60 s) and single-use.
+ * - Publish discovery and JWKS, rotate keys safely.
+ * - Decide JWT vs opaque access tokens; provide introspection if opaque.
+ */
+const common_1 = require("../../common");
+const zod_1 = require("zod");
+const crypto_1 = require("crypto");
+const CLIENTS = new Map();
+/** Optional: export getters so other flows can validate client_id */
+exports.DevClientRegistry = {
+    get(client_id) {
+        return CLIENTS.get(client_id);
+    },
+    has(client_id) {
+        return CLIENTS.has(client_id);
+    }
+};
+const inputSchema = common_1.httpInputSchema;
+const outputSchema = common_1.HttpJsonSchema;
+const registrationRequestSchema = zod_1.z.object({
+    // RFC 7591-ish minimal set
+    redirect_uris: zod_1.z.array(zod_1.z.string().url()).min(1, "At least one redirect_uri is required"),
+    token_endpoint_auth_method: zod_1.z.enum(["none", "client_secret_basic", "client_secret_post", "private_key_jwt", "tls_client_auth"])
+        .default("none"),
+    grant_types: zod_1.z.array(zod_1.z.enum(["authorization_code", "refresh_token", "urn:ietf:params:oauth:grant-type:device_code"]))
+        .default(["authorization_code"]),
+    response_types: zod_1.z.array(zod_1.z.enum(["code"])).default(["code"]),
+    client_name: zod_1.z.string().optional(),
+    scope: zod_1.z.string().optional(),
+}).passthrough();
+const stateSchema = zod_1.z.object({
+    body: registrationRequestSchema,
+    isDev: zod_1.z.boolean(),
+});
+const plan = {
+    pre: ['parseInput', 'validateInput'],
+    execute: ['registerClient', 'respondRegistration'],
+    post: ['validateOutput'],
+};
+const name = 'oauth:register';
+const Stage = (0, common_1.StageHookOf)(name);
+let OauthRegisterFlow = class OauthRegisterFlow extends common_1.FlowBase {
+    registered;
+    async parseInput() {
+        // Dev-only guard: hide the endpoint in production
+        const isDev = process.env['NODE_ENV'] !== 'production';
+        const { request } = this.rawInput;
+        const parsed = registrationRequestSchema.parse(request.body || {});
+        this.state.set({
+            body: parsed,
+            isDev,
+        });
+    }
+    async validateInput() {
+        if (!this.state.isDev) {
+            // Behave like the endpoint doesn't exist in prod
+            this.next();
+            return;
+        }
+        // Minimal sanity checks for common mistakes in dev
+        const { redirect_uris, token_endpoint_auth_method, grant_types, response_types } = this.state.required.body;
+        // Keep only supported combinations for the dummy server
+        if (!response_types.includes('code')) {
+            this.respond(common_1.httpRespond.json({
+                error: 'invalid_client_metadata',
+                error_description: 'Only response_types=["code"] is supported in dev.',
+            }, { status: 400 }));
+            return;
+        }
+        if (!grant_types.includes('authorization_code')) {
+            this.respond(common_1.httpRespond.json({
+                error: 'invalid_client_metadata',
+                error_description: 'grant_types must include "authorization_code" in dev.',
+            }, { status: 400 }));
+            return;
+        }
+        // Warn (soft) if confidential but no TLS/jwt (still allowed for local only)
+        if (token_endpoint_auth_method !== 'none' && token_endpoint_auth_method !== 'client_secret_post' && token_endpoint_auth_method !== 'client_secret_basic') {
+            this.respond(common_1.httpRespond.json({
+                error: 'invalid_client_metadata',
+                error_description: 'This dev server only supports "none", "client_secret_post", or "client_secret_basic".',
+            }, { status: 400 }));
+            return;
+        }
+        // Ensure localhost/https-ish redirects for dev
+        const bad = redirect_uris.find(u => !/^https?:\/\/(localhost|\d+\.\d+\.\d+\.\d+|127\.0\.0\.1)/.test(u));
+        if (bad) {
+            this.respond(common_1.httpRespond.json({
+                error: 'invalid_redirect_uri',
+                error_description: `Dev registration allows only localhost-style redirect_uris; got ${bad}`,
+            }, { status: 400 }));
+            return;
+        }
+    }
+    async registerClient() {
+        const now = Math.floor(Date.now() / 1000);
+        const { token_endpoint_auth_method, grant_types, response_types, redirect_uris, client_name, scope, } = this.state.required.body;
+        const client_id = (0, crypto_1.randomUUID)();
+        let client_secret;
+        if (token_endpoint_auth_method === 'client_secret_post' || token_endpoint_auth_method === 'client_secret_basic') {
+            client_secret = (0, crypto_1.randomBytes)(24).toString('base64url'); // short-lived dev secret
+        }
+        this.registered = {
+            client_id,
+            client_secret,
+            token_endpoint_auth_method,
+            grant_types,
+            response_types,
+            redirect_uris,
+            client_name,
+            scope,
+            created_at: now,
+            dev: true,
+        };
+        CLIENTS.set(client_id, this.registered);
+    }
+    async respondRegistration() {
+        const c = this.registered;
+        // Minimal RFC 7591-ish response
+        // (intentionally omitting registration_access_token/registration_client_uri for simplicity in dev)
+        this.respond(common_1.httpRespond.json({
+            client_id: c.client_id,
+            ...(c.client_secret ? { client_secret: c.client_secret } : {}),
+            client_id_issued_at: c.created_at,
+            client_secret_expires_at: c.client_secret ? 0 : 0, // 0 = does not expire (dev)
+            token_endpoint_auth_method: c.token_endpoint_auth_method,
+            grant_types: c.grant_types,
+            response_types: c.response_types,
+            redirect_uris: c.redirect_uris,
+            ...(c.client_name ? { client_name: c.client_name } : {}),
+            ...(c.scope ? { scope: c.scope } : {}),
+        }));
+    }
+    async validateOutput() {
+        // no-op; httpRespond.json enforces shape
+    }
+};
+tslib_1.__decorate([
+    Stage('parseInput'),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", Promise)
+], OauthRegisterFlow.prototype, "parseInput", null);
+tslib_1.__decorate([
+    Stage('validateInput'),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", Promise)
+], OauthRegisterFlow.prototype, "validateInput", null);
+tslib_1.__decorate([
+    Stage('registerClient'),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", Promise)
+], OauthRegisterFlow.prototype, "registerClient", null);
+tslib_1.__decorate([
+    Stage('respondRegistration'),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", Promise)
+], OauthRegisterFlow.prototype, "respondRegistration", null);
+tslib_1.__decorate([
+    Stage('validateOutput'),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", Promise)
+], OauthRegisterFlow.prototype, "validateOutput", null);
+OauthRegisterFlow = tslib_1.__decorate([
+    (0, common_1.Flow)({
+        name,
+        plan,
+        inputSchema,
+        outputSchema,
+        access: 'public',
+        middleware: {
+            method: 'POST',
+            path: '/oauth/register',
+        },
+    })
+], OauthRegisterFlow);
+exports.default = OauthRegisterFlow;
+//# sourceMappingURL=oauth.register.flow.js.map

package/src/auth/flows/oauth.register.flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.register.flow.js","sourceRoot":"","sources":["../../../../src/auth/flows/oauth.register.flow.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;;AAEH;;;;;;;;;;;GAWG;AAGH,yCAMsB;AACtB,6BAAsB;AACtB,mCAA+C;AAgB/C,MAAM,OAAO,GAAG,IAAI,GAAG,EAA4B,CAAC;AAEpD,qEAAqE;AACxD,QAAA,iBAAiB,GAAG;IAC/B,GAAG,CAAC,SAAiB;QACnB,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC;IACD,GAAG,CAAC,SAAiB;QACnB,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC;CACF,CAAC;AAEF,MAAM,WAAW,GAAG,wBAAe,CAAC;AACpC,MAAM,YAAY,GAAG,uBAAc,CAAC;AAEpC,MAAM,yBAAyB,GAAG,OAAC,CAAC,MAAM,CAAC;IACzC,2BAA2B;IAC3B,aAAa,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,uCAAuC,CAAC;IACxF,0BAA0B,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;SAC5H,OAAO,CAAC,MAAM,CAAC;IAClB,WAAW,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,eAAe,EAAE,8CAA8C,CAAC,CAAC,CAAC;SAClH,OAAO,CAAC,CAAC,oBAAoB,CAAC,CAAC;IAClC,cAAc,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3D,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC,WAAW,EAAE,CAAA;AAEhB,MAAM,WAAW,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3B,IAAI,EAAE,yBAAyB;IAC/B,KAAK,EAAE,OAAC,CAAC,OAAO,EAAE;CACnB,CAAC,CAAC;AAEH,MAAM,IAAI,GAAG;IACX,GAAG,EAAE,CAAC,YAAY,EAAE,eAAe,CAAC;IACpC,OAAO,EAAE,CAAC,gBAAgB,EAAE,qBAAqB,CAAC;IAClD,IAAI,EAAE,CAAC,gBAAgB,CAAC;CACW,CAAC;AActC,MAAM,IAAI,GAAG,gBAAyB,CAAC;AACvC,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;AAajB,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,iBAAqB;IAE1D,UAAU,CAAoB;IAGhC,AAAN,KAAK,CAAC,UAAU;QACd,kDAAkD;QAClD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY,CAAC;QAEvD,MAAM,EAAC,OAAO,EAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QAChC,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;YACb,IAAI,EAAE,MAAM;YACZ,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IAGK,AAAN,KAAK,CAAC,aAAa;QACjB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACtB,iDAAiD;YACjD,IAAI,CAAC,IAAI,EAAE,CAAC;YACZ,OAAO;QACT,CAAC;QAED,mDAAmD;QACnD,MAAM,EAAC,aAAa,EAAE,0BAA0B,EAAE,WAAW,EAAE,cAAc,EAAC,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAE1G,wDAAwD;QACxD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,OAAO,CAAC,oBAAW,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,yBAAyB;gBAChC,iBAAiB,EAAE,mDAAmD;aACvE,EAAE,EAAC,MAAM,EAAE,GAAG,EAAC,CAAC,CAAC,CAAC;YACnB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,OAAO,CAAC,oBAAW,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,yBAAyB;gBAChC,iBAAiB,EAAE,uDAAuD;aAC3E,EAAE,EAAC,MAAM,EAAE,GAAG,EAAC,CAAC,CAAC,CAAC;YACnB,OAAO;QACT,CAAC;QAED,4EAA4E;QAC5E,IAAI,0BAA0B,KAAK,MAAM,IAAI,0BAA0B,KAAK,oBAAoB,IAAI,0BAA0B,KAAK,qBAAqB,EAAE,CAAC;YACzJ,IAAI,CAAC,OAAO,CAAC,oBAAW,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,yBAAyB;gBAChC,iBAAiB,EAAE,uFAAuF;aAC3G,EAAE,EAAC,MAAM,EAAE,GAAG,EAAC,CAAC,CAAC,CAAC;YACnB,OAAO;QACT,CAAC;QAED,+CAA+C;QAC/C,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,yDAAyD,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACxG,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,CAAC,OAAO,CAAC,oBAAW,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,sBAAsB;gBAC7B,iBAAiB,EAAE,mEAAmE,GAAG,EAAE;aAC5F,EAAE,EAAC,MAAM,EAAE,GAAG,EAAC,CAAC,CAAC,CAAC;YACnB,OAAO;QACT,CAAC;IACH,CAAC;IAGK,AAAN,KAAK,CAAC,cAAc;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,EACJ,0BAA0B,EAC1B,WAAW,EACX,cAAc,EACd,aAAa,EACb,WAAW,EACX,KAAK,GACN,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAE7B,MAAM,SAAS,GAAG,IAAA,mBAAU,GAAE,CAAC;QAC/B,IAAI,aAAiC,CAAC;QAEtC,IAAI,0BAA0B,KAAK,oBAAoB,IAAI,0BAA0B,KAAK,qBAAqB,EAAE,CAAC;YAChH,aAAa,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,yBAAyB;QAClF,CAAC;QAED,IAAI,CAAC,UAAU,GAAG;YAChB,SAAS;YACT,aAAa;YACb,0BAA0B;YAC1B,WAAW;YACX,cAAc;YACd,aAAa;YACb,WAAW;YACX,KAAK;YACL,UAAU,EAAE,GAAG;YACf,GAAG,EAAE,IAAI;SACV,CAAC;QAEF,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;IAGK,AAAN,KAAK,CAAC,mBAAmB;QACvB,MAAM,CAAC,GAAG,IAAI,CAAC,UAAW,CAAC;QAC3B,gCAAgC;QAChC,mGAAmG;QACnG,IAAI,CAAC,OAAO,CAAC,oBAAW,CAAC,IAAI,CAAC;YAC5B,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAC,aAAa,EAAE,CAAC,CAAC,aAAa,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,mBAAmB,EAAE,CAAC,CAAC,UAAU;YACjC,wBAAwB,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,4BAA4B;YAC/E,0BAA0B,EAAE,CAAC,CAAC,0BAA0B;YACxD,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,cAAc,EAAE,CAAC,CAAC,cAAc;YAChC,aAAa,EAAE,CAAC,CAAC,aAAa;YAC9B,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAC,WAAW,EAAE,CAAC,CAAC,WAAW,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAC,KAAK,EAAE,CAAC,CAAC,KAAK,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACrC,CAAC,CAAC,CAAC;IACN,CAAC;IAGK,AAAN,KAAK,CAAC,cAAc;QAClB,yCAAyC;IAC3C,CAAC;CACF,CAAA;AAtHO;IADL,KAAK,CAAC,YAAY,CAAC;;;;mDAWnB;AAGK;IADL,KAAK,CAAC,eAAe,CAAC;;;;sDA8CtB;AAGK;IADL,KAAK,CAAC,gBAAgB,CAAC;;;;uDAiCvB;AAGK;IADL,KAAK,CAAC,qBAAqB,CAAC;;;;4DAiB5B;AAGK;IADL,KAAK,CAAC,gBAAgB,CAAC;;;;uDAGvB;AA1HkB,iBAAiB;IAXrC,IAAA,aAAI,EAAC;QACJ,IAAI;QACJ,IAAI;QACJ,WAAW;QACX,YAAY;QACZ,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE;YACV,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,iBAAiB;SACxB;KACF,CAAC;GACmB,iBAAiB,CA2HrC;kBA3HoB,iBAAiB","sourcesContent":["/**\n * Dynamic Client Registration — POST /oauth/register\n *\n * Who calls: Developers/automation.\n *\n * Purpose: Let clients register programmatically (redirect URIs, grant types, etc.).\n */\n\n/**\n * Quick checklist (security & correctness)\n * - PKCE (S256) required for public clients (and basically for all).\n * - Use authorization code grant only (no implicit/hybrid).\n * - Rotate refresh tokens and bind them to client + user + scopes.\n * - Prefer private_key_jwt or mTLS for confidential clients.\n * - PAR + JAR recommended for higher security.\n * - Consider DPoP (proof-of-possession) to reduce token replay.\n * - Keep codes very short-lived (e.g., ≤60 s) and single-use.\n * - Publish discovery and JWKS, rotate keys safely.\n * - Decide JWT vs opaque access tokens; provide introspection if opaque.\n */\n\n\nimport {\n  Flow, FlowBase, FlowPlan,\n  FlowRunOptions,\n  httpInputSchema, HttpJsonSchema,\n  httpRespond,\n  StageHookOf\n} from \"../../common\";\nimport {z} from \"zod\";\nimport {randomUUID, randomBytes} from \"crypto\";\n\n/** Simple in-memory registry (dev only) */\ntype RegisteredClient = {\n  client_id: string;\n  client_secret?: string;\n  token_endpoint_auth_method: \"none\" | \"client_secret_basic\" | \"client_secret_post\" | \"private_key_jwt\" | \"tls_client_auth\";\n  grant_types: string[];\n  response_types: string[];\n  redirect_uris: string[];\n  client_name?: string;\n  scope?: string;\n  created_at: number;   // seconds since epoch\n  dev: boolean;\n};\n\nconst CLIENTS = new Map<string, RegisteredClient>();\n\n/** Optional: export getters so other flows can validate client_id */\nexport const DevClientRegistry = {\n  get(client_id: string) {\n    return CLIENTS.get(client_id);\n  },\n  has(client_id: string) {\n    return CLIENTS.has(client_id);\n  }\n};\n\nconst inputSchema = httpInputSchema;\nconst outputSchema = HttpJsonSchema;\n\nconst registrationRequestSchema = z.object({\n  // RFC 7591-ish minimal set\n  redirect_uris: z.array(z.string().url()).min(1, \"At least one redirect_uri is required\"),\n  token_endpoint_auth_method: z.enum([\"none\", \"client_secret_basic\", \"client_secret_post\", \"private_key_jwt\", \"tls_client_auth\"])\n    .default(\"none\"),\n  grant_types: z.array(z.enum([\"authorization_code\", \"refresh_token\", \"urn:ietf:params:oauth:grant-type:device_code\"]))\n    .default([\"authorization_code\"]),\n  response_types: z.array(z.enum([\"code\"])).default([\"code\"]),\n  client_name: z.string().optional(),\n  scope: z.string().optional(),\n}).passthrough()\n\nconst stateSchema = z.object({\n  body: registrationRequestSchema,\n  isDev: z.boolean(),\n});\n\nconst plan = {\n  pre: ['parseInput', 'validateInput'],\n  execute: ['registerClient', 'respondRegistration'],\n  post: ['validateOutput'],\n} as const satisfies FlowPlan<string>;\n\ndeclare global {\n    interface ExtendFlows {\n      'oauth:register': FlowRunOptions<\n        OauthRegisterFlow,\n        typeof plan,\n        typeof inputSchema,\n        typeof outputSchema,\n        typeof stateSchema\n      >;\n    }\n}\n\nconst name = 'oauth:register' as const;\nconst Stage = StageHookOf(name);\n\n@Flow({\n  name,\n  plan,\n  inputSchema,\n  outputSchema,\n  access: 'public',\n  middleware: {\n    method: 'POST',\n    path: '/oauth/register',\n  },\n})\nexport default class OauthRegisterFlow extends FlowBase<typeof name> {\n\n  private registered?: RegisteredClient;\n\n  @Stage('parseInput')\n  async parseInput() {\n    // Dev-only guard: hide the endpoint in production\n    const isDev = process.env['NODE_ENV'] !== 'production';\n\n    const {request} = this.rawInput;\n    const parsed = registrationRequestSchema.parse(request.body || {});\n    this.state.set({\n      body: parsed,\n      isDev,\n    });\n  }\n\n  @Stage('validateInput')\n  async validateInput() {\n    if (!this.state.isDev) {\n      // Behave like the endpoint doesn't exist in prod\n      this.next();\n      return;\n    }\n\n    // Minimal sanity checks for common mistakes in dev\n    const {redirect_uris, token_endpoint_auth_method, grant_types, response_types} = this.state.required.body;\n\n    // Keep only supported combinations for the dummy server\n    if (!response_types.includes('code')) {\n      this.respond(httpRespond.json({\n        error: 'invalid_client_metadata',\n        error_description: 'Only response_types=[\"code\"] is supported in dev.',\n      }, {status: 400}));\n      return;\n    }\n\n    if (!grant_types.includes('authorization_code')) {\n      this.respond(httpRespond.json({\n        error: 'invalid_client_metadata',\n        error_description: 'grant_types must include \"authorization_code\" in dev.',\n      }, {status: 400}));\n      return;\n    }\n\n    // Warn (soft) if confidential but no TLS/jwt (still allowed for local only)\n    if (token_endpoint_auth_method !== 'none' && token_endpoint_auth_method !== 'client_secret_post' && token_endpoint_auth_method !== 'client_secret_basic') {\n      this.respond(httpRespond.json({\n        error: 'invalid_client_metadata',\n        error_description: 'This dev server only supports \"none\", \"client_secret_post\", or \"client_secret_basic\".',\n      }, {status: 400}));\n      return;\n    }\n\n    // Ensure localhost/https-ish redirects for dev\n    const bad = redirect_uris.find(u => !/^https?:\\/\\/(localhost|\\d+\\.\\d+\\.\\d+\\.\\d+|127\\.0\\.0\\.1)/.test(u));\n    if (bad) {\n      this.respond(httpRespond.json({\n        error: 'invalid_redirect_uri',\n        error_description: `Dev registration allows only localhost-style redirect_uris; got ${bad}`,\n      }, {status: 400}));\n      return;\n    }\n  }\n\n  @Stage('registerClient')\n  async registerClient() {\n    const now = Math.floor(Date.now() / 1000);\n    const {\n      token_endpoint_auth_method,\n      grant_types,\n      response_types,\n      redirect_uris,\n      client_name,\n      scope,\n    } = this.state.required.body;\n\n    const client_id = randomUUID();\n    let client_secret: string | undefined;\n\n    if (token_endpoint_auth_method === 'client_secret_post' || token_endpoint_auth_method === 'client_secret_basic') {\n      client_secret = randomBytes(24).toString('base64url'); // short-lived dev secret\n    }\n\n    this.registered = {\n      client_id,\n      client_secret,\n      token_endpoint_auth_method,\n      grant_types,\n      response_types,\n      redirect_uris,\n      client_name,\n      scope,\n      created_at: now,\n      dev: true,\n    };\n\n    CLIENTS.set(client_id, this.registered);\n  }\n\n  @Stage('respondRegistration')\n  async respondRegistration() {\n    const c = this.registered!;\n    // Minimal RFC 7591-ish response\n    // (intentionally omitting registration_access_token/registration_client_uri for simplicity in dev)\n    this.respond(httpRespond.json({\n      client_id: c.client_id,\n      ...(c.client_secret ? {client_secret: c.client_secret} : {}),\n      client_id_issued_at: c.created_at,\n      client_secret_expires_at: c.client_secret ? 0 : 0, // 0 = does not expire (dev)\n      token_endpoint_auth_method: c.token_endpoint_auth_method,\n      grant_types: c.grant_types,\n      response_types: c.response_types,\n      redirect_uris: c.redirect_uris,\n      ...(c.client_name ? {client_name: c.client_name} : {}),\n      ...(c.scope ? {scope: c.scope} : {}),\n    }));\n  }\n\n  @Stage('validateOutput')\n  async validateOutput() {\n    // no-op; httpRespond.json enforces shape\n  }\n}"]}

package/src/auth/flows/oauth.token.flow.d.ts

@@ -0,0 +1,242 @@
+/**
+ * Token Endpoint — POST /oauth/token
+ *
+ * Who calls: Client (server-to-server).
+ *
+ * When: After getting the code (or for refresh).
+ *
+ * Purpose: Exchange authorization code + PKCE verifier for access token (and optional refresh token), or refresh an access token.
+ */
+/**
+ * Typical parameter shapes
+ *
+ * /oauth/token (POST, application/x-www-form-urlencoded)
+ *
+ * For code exchange: grant_type=authorization_code, code, redirect_uri, client_id (and auth), code_verifier
+ *
+ * For refresh: grant_type=refresh_token, refresh_token, client_id (and auth)
+ */
+/**
+ * Quick checklist (security & correctness)
+ * - PKCE (S256) required for public clients (and basically for all).
+ * - Use authorization code grant only (no implicit/hybrid).
+ * - Rotate refresh tokens and bind them to client + user + scopes.
+ * - Prefer private_key_jwt or mTLS for confidential clients.
+ * - PAR + JAR recommended for higher security.
+ * - Consider DPoP (proof-of-possession) to reduce token replay.
+ * - Keep codes very short-lived (e.g., ≤60 s) and single-use.
+ * - Publish discovery and JWKS, rotate keys safely.
+ * - Decide JWT vs opaque access tokens; provide introspection if opaque.
+ */
+/**
+ *
+ * OAuth 2.0 Device Authorization Grant (“device code flow”)
+ * Who does what (at a glance)
+ *
+ * Device/TV/CLI (no browser)
+ * Calls POST /oauth/device_authorization, shows the user a code + URL, and polls POST /oauth/token.
+ *
+ * User (on phone/laptop browser)
+ * Visits the given verification_uri and authenticates using your normal OAuth login (whatever you already have). No new UI required beyond two tiny endpoints.
+ *
+ * Auth Server (you)
+ * Stores the device transaction and, after the user authenticates, marks it as approved so the device’s /oauth/token polling succeeds.
+ *
+ * Endpoints you need (only two “new” ones)
+ *
+ * POST /oauth/device_authorization ✅ (device calls)
+ *
+ * POST /oauth/token with grant urn:ietf:params:oauth:grant-type:device_code ✅ (device polls)
+ *
+ * GET /activate ➜ “UI handler” (user lands here from verification_uri — this just redirects into your existing /oauth/authorize)
+ *
+ * GET /activate/callback ➜ “UI handler” (your existing flow returns here after the user logs in; you flip the device record to approved and show a basic “All set” page)
+ *
+ * That’s it. No pages with complex consent screens are required; reuse your normal /oauth/authorize
+ */
+import { FlowBase, FlowRunOptions } from "../../common";
+import { z } from "zod";
+declare const inputSchema: z.ZodObject<{
+    request: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
+    response: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
+    next: z.ZodOptional<z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodUnknown>>;
+}, "strip", z.ZodTypeAny, {
+    request: {} & {
+        [k: string]: unknown;
+    };
+    response: {} & {
+        [k: string]: unknown;
+    };
+    next?: ((...args: unknown[]) => unknown) | undefined;
+}, {
+    request: {} & {
+        [k: string]: unknown;
+    };
+    response: {} & {
+        [k: string]: unknown;
+    };
+    next?: ((...args: unknown[]) => unknown) | undefined;
+}>;
+declare const stateSchema: z.ZodObject<{
+    body: z.ZodDiscriminatedUnion<"grant_type", [z.ZodObject<{
+        grant_type: z.ZodLiteral<"anonymous">;
+        /** Public client identifier; UUID in your example */
+        client_id: z.ZodString;
+        /** Target resource/audience is required for this custom flow */
+        resource: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        resource: string;
+        grant_type: "anonymous";
+        client_id: string;
+    }, {
+        resource: string;
+        grant_type: "anonymous";
+        client_id: string;
+    }>, z.ZodObject<{
+        grant_type: z.ZodLiteral<"authorization_code">;
+        /** Authorization code returned from the /authorize step */
+        code: z.ZodString;
+        /** Must exactly match the redirect URI used when obtaining the code */
+        redirect_uri: z.ZodString;
+        /** Public client identifier; UUID in your example */
+        client_id: z.ZodString;
+        /** PKCE verifier bound to the code */
+        code_verifier: z.ZodString;
+        /** Optional resource/audience (used by some providers like AAD v1) */
+        resource: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        code: string;
+        resource: string;
+        grant_type: "authorization_code";
+        client_id: string;
+        redirect_uri: string;
+        code_verifier: string;
+    }, {
+        code: string;
+        resource: string;
+        grant_type: "authorization_code";
+        client_id: string;
+        redirect_uri: string;
+        code_verifier: string;
+    }>]>;
+    isDefaultAuthProvider: z.ZodBoolean;
+}, "strip", z.ZodTypeAny, {
+    body: {
+        resource: string;
+        grant_type: "anonymous";
+        client_id: string;
+    } | {
+        code: string;
+        resource: string;
+        grant_type: "authorization_code";
+        client_id: string;
+        redirect_uri: string;
+        code_verifier: string;
+    };
+    isDefaultAuthProvider: boolean;
+}, {
+    body: {
+        resource: string;
+        grant_type: "anonymous";
+        client_id: string;
+    } | {
+        code: string;
+        resource: string;
+        grant_type: "authorization_code";
+        client_id: string;
+        redirect_uri: string;
+        code_verifier: string;
+    };
+    isDefaultAuthProvider: boolean;
+}>;
+declare const outputSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"json">;
+    status: z.ZodEffects<z.ZodNumber, number, number>;
+    body: z.ZodUnion<[z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>, z.ZodArray<z.ZodAny, "many">, z.ZodRecord<z.ZodString, z.ZodAny>]>;
+    contentType: z.ZodDefault<z.ZodString>;
+} & {
+    headers: z.ZodOptional<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>]>>>>;
+    cookies: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        value: z.ZodString;
+        path: z.ZodDefault<z.ZodString>;
+        domain: z.ZodOptional<z.ZodString>;
+        httpOnly: z.ZodDefault<z.ZodBoolean>;
+        secure: z.ZodOptional<z.ZodBoolean>;
+        sameSite: z.ZodOptional<z.ZodEnum<["lax", "strict", "none"]>>;
+        maxAge: z.ZodOptional<z.ZodNumber>;
+        expires: z.ZodOptional<z.ZodDate>;
+    }, "strip", z.ZodTypeAny, {
+        value: string;
+        path: string;
+        name: string;
+        httpOnly: boolean;
+        domain?: string | undefined;
+        secure?: boolean | undefined;
+        sameSite?: "lax" | "strict" | "none" | undefined;
+        maxAge?: number | undefined;
+        expires?: Date | undefined;
+    }, {
+        value: string;
+        name: string;
+        path?: string | undefined;
+        domain?: string | undefined;
+        httpOnly?: boolean | undefined;
+        secure?: boolean | undefined;
+        sameSite?: "lax" | "strict" | "none" | undefined;
+        maxAge?: number | undefined;
+        expires?: Date | undefined;
+    }>, "many">>>;
+}, "strip", z.ZodTypeAny, {
+    status: number;
+    kind: "json";
+    body: any[] | z.objectOutputType<{}, z.ZodTypeAny, "passthrough"> | Record<string, any>;
+    contentType: string;
+    headers?: Record<string, string | string[]> | undefined;
+    cookies?: {
+        value: string;
+        path: string;
+        name: string;
+        httpOnly: boolean;
+        domain?: string | undefined;
+        secure?: boolean | undefined;
+        sameSite?: "lax" | "strict" | "none" | undefined;
+        maxAge?: number | undefined;
+        expires?: Date | undefined;
+    }[] | undefined;
+}, {
+    status: number;
+    kind: "json";
+    body: any[] | z.objectInputType<{}, z.ZodTypeAny, "passthrough"> | Record<string, any>;
+    headers?: Record<string, string | string[]> | undefined;
+    cookies?: {
+        value: string;
+        name: string;
+        path?: string | undefined;
+        domain?: string | undefined;
+        httpOnly?: boolean | undefined;
+        secure?: boolean | undefined;
+        sameSite?: "lax" | "strict" | "none" | undefined;
+        maxAge?: number | undefined;
+        expires?: Date | undefined;
+    }[] | undefined;
+    contentType?: string | undefined;
+}>;
+declare const plan: {
+    readonly pre: ["parseInput", "validateInput"];
+    readonly execute: ["generateJWT", "buildAuthorizeOutput"];
+    readonly post: ["validateOutput"];
+};
+declare global {
+    interface ExtendFlows {
+        'oauth:token': FlowRunOptions<OauthTokenFlow, typeof plan, typeof inputSchema, typeof outputSchema, typeof stateSchema>;
+    }
+}
+declare const name: "oauth:token";
+export default class OauthTokenFlow extends FlowBase<typeof name> {
+    parseInput(): Promise<void>;
+    validateInput(): Promise<void>;
+    buildAuthorizeOutput(): Promise<void>;
+    validateOutput(): Promise<void>;
+}
+export {};

package/src/auth/flows/oauth.token.flow.js

@@ -0,0 +1,181 @@
+"use strict";
+/**
+ * Token Endpoint — POST /oauth/token
+ *
+ * Who calls: Client (server-to-server).
+ *
+ * When: After getting the code (or for refresh).
+ *
+ * Purpose: Exchange authorization code + PKCE verifier for access token (and optional refresh token), or refresh an access token.
+ */
+/**
+ * Typical parameter shapes
+ *
+ * /oauth/token (POST, application/x-www-form-urlencoded)
+ *
+ * For code exchange: grant_type=authorization_code, code, redirect_uri, client_id (and auth), code_verifier
+ *
+ * For refresh: grant_type=refresh_token, refresh_token, client_id (and auth)
+ */
+/**
+ * Quick checklist (security & correctness)
+ * - PKCE (S256) required for public clients (and basically for all).
+ * - Use authorization code grant only (no implicit/hybrid).
+ * - Rotate refresh tokens and bind them to client + user + scopes.
+ * - Prefer private_key_jwt or mTLS for confidential clients.
+ * - PAR + JAR recommended for higher security.
+ * - Consider DPoP (proof-of-possession) to reduce token replay.
+ * - Keep codes very short-lived (e.g., ≤60 s) and single-use.
+ * - Publish discovery and JWKS, rotate keys safely.
+ * - Decide JWT vs opaque access tokens; provide introspection if opaque.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+/**
+ *
+ * OAuth 2.0 Device Authorization Grant (“device code flow”)
+ * Who does what (at a glance)
+ *
+ * Device/TV/CLI (no browser)
+ * Calls POST /oauth/device_authorization, shows the user a code + URL, and polls POST /oauth/token.
+ *
+ * User (on phone/laptop browser)
+ * Visits the given verification_uri and authenticates using your normal OAuth login (whatever you already have). No new UI required beyond two tiny endpoints.
+ *
+ * Auth Server (you)
+ * Stores the device transaction and, after the user authenticates, marks it as approved so the device’s /oauth/token polling succeeds.
+ *
+ * Endpoints you need (only two “new” ones)
+ *
+ * POST /oauth/device_authorization ✅ (device calls)
+ *
+ * POST /oauth/token with grant urn:ietf:params:oauth:grant-type:device_code ✅ (device polls)
+ *
+ * GET /activate ➜ “UI handler” (user lands here from verification_uri — this just redirects into your existing /oauth/authorize)
+ *
+ * GET /activate/callback ➜ “UI handler” (your existing flow returns here after the user logs in; you flip the device record to approved and show a basic “All set” page)
+ *
+ * That’s it. No pages with complex consent screens are required; reuse your normal /oauth/authorize
+ */
+const common_1 = require("../../common");
+const zod_1 = require("zod");
+const crypto_1 = require("crypto");
+const inputSchema = common_1.httpInputSchema;
+// RFC 7636 PKCE: code_verifier is 43–128 chars from ALPHA / DIGIT / "-" / "." / "_" / "~"
+const pkceVerifierRegex = /^[A-Za-z0-9_.~-]{43,128}$/; // TODO: move to shared regex utils
+const authorizationCodeGrant = zod_1.z.object({
+    grant_type: zod_1.z.literal("authorization_code"),
+    /** Authorization code returned from the /authorize step */
+    code: zod_1.z.string().min(1, "code is required"),
+    /** Must exactly match the redirect URI used when obtaining the code */
+    redirect_uri: zod_1.z.string().url(),
+    /** Public client identifier; UUID in your example */
+    client_id: zod_1.z.string().uuid(),
+    /** PKCE verifier bound to the code */
+    code_verifier: zod_1.z.string().regex(pkceVerifierRegex, "code_verifier must be 43–128 chars of A–Z, a–z, 0–9, '-', '.', '_' or '~'"),
+    /** Optional resource/audience (used by some providers like AAD v1) */
+    resource: zod_1.z.string().url().describe("FrontMcp scope url"),
+});
+const anonymousGrant = zod_1.z.object({
+    grant_type: zod_1.z.literal("anonymous"),
+    /** Public client identifier; UUID in your example */
+    client_id: zod_1.z.string().uuid(),
+    /** Target resource/audience is required for this custom flow */
+    resource: zod_1.z.string().url(),
+});
+const stateSchema = zod_1.z.object({
+    body: zod_1.z.discriminatedUnion('grant_type', [anonymousGrant, authorizationCodeGrant]),
+    isDefaultAuthProvider: zod_1.z.boolean().describe("If FrontMcp initialized without auth options"),
+});
+const outputSchema = common_1.HttpJsonSchema;
+const plan = {
+    pre: [
+        'parseInput',
+        'validateInput',
+    ],
+    execute: [
+        'generateJWT',
+        'buildAuthorizeOutput'
+    ],
+    post: [
+        'validateOutput',
+    ],
+};
+const name = 'oauth:token';
+const Stage = (0, common_1.StageHookOf)(name);
+let OauthTokenFlow = class OauthTokenFlow extends common_1.FlowBase {
+    async parseInput() {
+        const { metadata } = this.scope;
+        const { request } = this.rawInput;
+        if (!metadata.auth) {
+            const isDefaultAuthProvider = true;
+            this.state.set(stateSchema.parse({
+                isDefaultAuthProvider, //
+                body: request.body,
+            }));
+        }
+        else {
+            // TODO:
+            //  support local/remote proxy auth provider
+            //  the call next only if scope isn't orchestrated
+            this.next();
+        }
+    }
+    async validateInput() {
+        const localAuth = this.scope.auth;
+        const access_token = await localAuth.signAnonymousJwt();
+        const refresh_token = (0, crypto_1.randomUUID)();
+        this.respond(common_1.httpRespond.json({
+            access_token,
+            token_type: 'Bearer',
+            expires_in: 86500,
+            refresh_token,
+        }));
+        // TBD
+    }
+    async buildAuthorizeOutput() {
+        // TBD
+    }
+    async validateOutput() {
+        // TBD
+    }
+};
+tslib_1.__decorate([
+    Stage('parseInput'),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", Promise)
+], OauthTokenFlow.prototype, "parseInput", null);
+tslib_1.__decorate([
+    Stage('validateInput'),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", Promise)
+], OauthTokenFlow.prototype, "validateInput", null);
+tslib_1.__decorate([
+    Stage('buildAuthorizeOutput'),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", Promise)
+], OauthTokenFlow.prototype, "buildAuthorizeOutput", null);
+tslib_1.__decorate([
+    Stage('validateOutput'),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", Promise)
+], OauthTokenFlow.prototype, "validateOutput", null);
+OauthTokenFlow = tslib_1.__decorate([
+    (0, common_1.Flow)({
+        name,
+        plan,
+        inputSchema,
+        outputSchema,
+        access: 'public',
+        middleware: {
+            method: 'POST',
+            path: '/oauth/token',
+        },
+    })
+], OauthTokenFlow);
+exports.default = OauthTokenFlow;
+//# sourceMappingURL=oauth.token.flow.js.map

package/src/auth/flows/oauth.token.flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.token.flow.js","sourceRoot":"","sources":["../../../../src/auth/flows/oauth.token.flow.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;AACH;;;;;;;;GAQG;AACH;;;;;;;;;;;GAWG;;;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,yCAMsB;AACtB,6BAAsB;AACtB,mCAAkC;AAIlC,MAAM,WAAW,GAAG,wBAAe,CAAC;AAEpC,0FAA0F;AAC1F,MAAM,iBAAiB,GAAG,2BAA2B,CAAC,CAAC,mCAAmC;AAC1F,MAAM,sBAAsB,GAAG,OAAC,CAAC,MAAM,CAAC;IACtC,UAAU,EAAE,OAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;IAC3C,2DAA2D;IAC3D,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,kBAAkB,CAAC;IAC3C,uEAAuE;IACvE,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC9B,qDAAqD;IACrD,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,sCAAsC;IACtC,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,EAAE,2EAA2E,CAAE;IAChI,sEAAsE;IACtE,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC;CAC1D,CAAC,CAAC;AACH,MAAM,cAAc,GAAG,OAAC,CAAC,MAAM,CAAC;IAC9B,UAAU,EAAE,OAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IAClC,qDAAqD;IACrD,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,gEAAgE;IAChE,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;CAC3B,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3B,IAAI,EAAE,OAAC,CAAC,kBAAkB,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,sBAAsB,CAAC,CAAC;IAClF,qBAAqB,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;CAC5F,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,uBAAc,CAAC;AAGpC,MAAM,IAAI,GAAG;IACX,GAAG,EAAE;QACH,YAAY;QACZ,eAAe;KAChB;IACD,OAAO,EAAE;QACP,aAAa;QACb,sBAAsB;KACvB;IACD,IAAI,EAAE;QACJ,gBAAgB;KACjB;CACkC,CAAC;AActC,MAAM,IAAI,GAAG,aAAsB,CAAC;AACpC,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;AAajB,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,iBAAqB;IAGzD,AAAN,KAAK,CAAC,UAAU;QACd,MAAM,EAAC,QAAQ,EAAC,GAAG,IAAI,CAAC,KAAK,CAAC;QAC9B,MAAM,EAAC,OAAO,EAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QAGhC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnB,MAAM,qBAAqB,GAAG,IAAI,CAAA;YAClC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC;gBAC/B,qBAAqB,EAAE,EAAE;gBACzB,IAAI,EAAE,OAAO,CAAC,IAAI;aACnB,CAAC,CAAC,CAAA;QACL,CAAC;aAAM,CAAC;YACN,QAAQ;YACR,4CAA4C;YAC5C,kDAAkD;YAClD,IAAI,CAAC,IAAI,EAAE,CAAA;QACb,CAAC;IACH,CAAC;IAGK,AAAN,KAAK,CAAC,aAAa;QAEjB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAwB,CAAC;QACtD,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,gBAAgB,EAAE,CAAA;QACvD,MAAM,aAAa,GAAG,IAAA,mBAAU,GAAE,CAAA;QAClC,IAAI,CAAC,OAAO,CAAC,oBAAW,CAAC,IAAI,CAAC;YAC5B,YAAY;YACZ,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,KAAK;YACjB,aAAa;SACd,CAAC,CAAC,CAAA;QAEH,MAAM;IACR,CAAC;IAIK,AAAN,KAAK,CAAC,oBAAoB;QACxB,MAAM;IACR,CAAC;IAGK,AAAN,KAAK,CAAC,cAAc;QAClB,MAAM;IACR,CAAC;CACF,CAAA;AA7CO;IADL,KAAK,CAAC,YAAY,CAAC;;;;gDAkBnB;AAGK;IADL,KAAK,CAAC,eAAe,CAAC;;;;mDActB;AAIK;IADL,KAAK,CAAC,sBAAsB,CAAC;;;;0DAG7B;AAGK;IADL,KAAK,CAAC,gBAAgB,CAAC;;;;oDAGvB;AA/CkB,cAAc;IAXlC,IAAA,aAAI,EAAC;QACJ,IAAI;QACJ,IAAI;QACJ,WAAW;QACX,YAAY;QACZ,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE;YACV,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,cAAc;SACrB;KACF,CAAC;GACmB,cAAc,CAgDlC;kBAhDoB,cAAc","sourcesContent":["/**\n * Token Endpoint — POST /oauth/token\n *\n * Who calls: Client (server-to-server).\n *\n * When: After getting the code (or for refresh).\n *\n * Purpose: Exchange authorization code + PKCE verifier for access token (and optional refresh token), or refresh an access token.\n */\n/**\n * Typical parameter shapes\n *\n * /oauth/token (POST, application/x-www-form-urlencoded)\n *\n * For code exchange: grant_type=authorization_code, code, redirect_uri, client_id (and auth), code_verifier\n *\n * For refresh: grant_type=refresh_token, refresh_token, client_id (and auth)\n */\n/**\n * Quick checklist (security & correctness)\n * - PKCE (S256) required for public clients (and basically for all).\n * - Use authorization code grant only (no implicit/hybrid).\n * - Rotate refresh tokens and bind them to client + user + scopes.\n * - Prefer private_key_jwt or mTLS for confidential clients.\n * - PAR + JAR recommended for higher security.\n * - Consider DPoP (proof-of-possession) to reduce token replay.\n * - Keep codes very short-lived (e.g., ≤60 s) and single-use.\n * - Publish discovery and JWKS, rotate keys safely.\n * - Decide JWT vs opaque access tokens; provide introspection if opaque.\n */\n\n/**\n *\n * OAuth 2.0 Device Authorization Grant (“device code flow”)\n * Who does what (at a glance)\n *\n * Device/TV/CLI (no browser)\n * Calls POST /oauth/device_authorization, shows the user a code + URL, and polls POST /oauth/token.\n *\n * User (on phone/laptop browser)\n * Visits the given verification_uri and authenticates using your normal OAuth login (whatever you already have). No new UI required beyond two tiny endpoints.\n *\n * Auth Server (you)\n * Stores the device transaction and, after the user authenticates, marks it as approved so the device’s /oauth/token polling succeeds.\n *\n * Endpoints you need (only two “new” ones)\n *\n * POST /oauth/device_authorization ✅ (device calls)\n *\n * POST /oauth/token with grant urn:ietf:params:oauth:grant-type:device_code ✅ (device polls)\n *\n * GET /activate ➜ “UI handler” (user lands here from verification_uri — this just redirects into your existing /oauth/authorize)\n *\n * GET /activate/callback ➜ “UI handler” (your existing flow returns here after the user logs in; you flip the device record to approved and show a basic “All set” page)\n *\n * That’s it. No pages with complex consent screens are required; reuse your normal /oauth/authorize\n */\n\nimport {\n  Flow, FlowBase, FlowPlan,\n  FlowRunOptions,\n  httpInputSchema, HttpJsonSchema,\n  httpRespond,\n  StageHookOf\n} from \"../../common\";\nimport {z} from \"zod\";\nimport {randomUUID} from \"crypto\";\nimport {LocalPrimaryAuth} from \"../instances/instance.local-primary-auth\";\n\n\nconst inputSchema = httpInputSchema;\n\n// RFC 7636 PKCE: code_verifier is 43–128 chars from ALPHA / DIGIT / \"-\" / \".\" / \"_\" / \"~\"\nconst pkceVerifierRegex = /^[A-Za-z0-9_.~-]{43,128}$/; // TODO: move to shared regex utils\nconst authorizationCodeGrant = z.object({\n  grant_type: z.literal(\"authorization_code\"),\n  /** Authorization code returned from the /authorize step */\n  code: z.string().min(1, \"code is required\"),\n  /** Must exactly match the redirect URI used when obtaining the code */\n  redirect_uri: z.string().url(),\n  /** Public client identifier; UUID in your example */\n  client_id: z.string().uuid(),\n  /** PKCE verifier bound to the code */\n  code_verifier: z.string().regex(pkceVerifierRegex, \"code_verifier must be 43–128 chars of A–Z, a–z, 0–9, '-', '.', '_' or '~'\",),\n  /** Optional resource/audience (used by some providers like AAD v1) */\n  resource: z.string().url().describe(\"FrontMcp scope url\"),\n});\nconst anonymousGrant = z.object({\n  grant_type: z.literal(\"anonymous\"),\n  /** Public client identifier; UUID in your example */\n  client_id: z.string().uuid(),\n  /** Target resource/audience is required for this custom flow */\n  resource: z.string().url(),\n});\n\nconst stateSchema = z.object({\n  body: z.discriminatedUnion('grant_type', [anonymousGrant, authorizationCodeGrant]),\n  isDefaultAuthProvider: z.boolean().describe(\"If FrontMcp initialized without auth options\"),\n});\n\nconst outputSchema = HttpJsonSchema;\n\n\nconst plan = {\n  pre: [\n    'parseInput',\n    'validateInput',\n  ],\n  execute: [\n    'generateJWT',\n    'buildAuthorizeOutput'\n  ],\n  post: [\n    'validateOutput',\n  ],\n} as const satisfies FlowPlan<string>;\n\ndeclare global {\n  interface ExtendFlows {\n    'oauth:token': FlowRunOptions<\n      OauthTokenFlow,\n      typeof plan,\n      typeof inputSchema,\n      typeof outputSchema,\n      typeof stateSchema\n    >;\n  }\n}\n\nconst name = 'oauth:token' as const;\nconst Stage = StageHookOf(name);\n\n@Flow({\n  name,\n  plan,\n  inputSchema,\n  outputSchema,\n  access: 'public',\n  middleware: {\n    method: 'POST',\n    path: '/oauth/token',\n  },\n})\nexport default class OauthTokenFlow extends FlowBase<typeof name> {\n\n  @Stage('parseInput')\n  async parseInput() {\n    const {metadata} = this.scope;\n    const {request} = this.rawInput;\n\n\n    if (!metadata.auth) {\n      const isDefaultAuthProvider = true\n      this.state.set(stateSchema.parse({\n        isDefaultAuthProvider, //\n        body: request.body,\n      }))\n    } else {\n      // TODO:\n      //  support local/remote proxy auth provider\n      //  the call next only if scope isn't orchestrated\n      this.next()\n    }\n  }\n\n  @Stage('validateInput')\n  async validateInput() {\n\n    const localAuth = this.scope.auth as LocalPrimaryAuth;\n    const access_token = await localAuth.signAnonymousJwt()\n    const refresh_token = randomUUID()\n    this.respond(httpRespond.json({\n      access_token,\n      token_type: 'Bearer',\n      expires_in: 86500,\n      refresh_token,\n    }))\n\n    // TBD\n  }\n\n\n  @Stage('buildAuthorizeOutput')\n  async buildAuthorizeOutput() {\n    // TBD\n  }\n\n  @Stage('validateOutput')\n  async validateOutput() {\n    // TBD\n  }\n}"]}