@hibanacloud/core 0.3.15

package/dist/src/mcp/oauth-utils.d.ts

@@ -0,0 +1,119 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { MCPOAuthConfig } from './oauth-provider.js';
+/**
+ * OAuth authorization server metadata as per RFC 8414.
+ */
+export interface OAuthAuthorizationServerMetadata {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    token_endpoint_auth_methods_supported?: string[];
+    revocation_endpoint?: string;
+    revocation_endpoint_auth_methods_supported?: string[];
+    registration_endpoint?: string;
+    response_types_supported?: string[];
+    grant_types_supported?: string[];
+    code_challenge_methods_supported?: string[];
+    scopes_supported?: string[];
+}
+/**
+ * OAuth protected resource metadata as per RFC 9728.
+ */
+export interface OAuthProtectedResourceMetadata {
+    resource: string;
+    authorization_servers?: string[];
+    bearer_methods_supported?: string[];
+    resource_documentation?: string;
+    resource_signing_alg_values_supported?: string[];
+    resource_encryption_alg_values_supported?: string[];
+    resource_encryption_enc_values_supported?: string[];
+}
+/**
+ * Utility class for common OAuth operations.
+ */
+export declare class OAuthUtils {
+    /**
+     * Construct well-known OAuth endpoint URLs.
+     * By default, uses standard root-based well-known URLs.
+     * If includePathSuffix is true, appends any path from the base URL to the well-known endpoints.
+     */
+    static buildWellKnownUrls(baseUrl: string, includePathSuffix?: boolean): {
+        protectedResource: string;
+        authorizationServer: string;
+    };
+    /**
+     * Fetch OAuth protected resource metadata.
+     *
+     * @param resourceMetadataUrl The protected resource metadata URL
+     * @returns The protected resource metadata or null if not available
+     */
+    static fetchProtectedResourceMetadata(resourceMetadataUrl: string): Promise<OAuthProtectedResourceMetadata | null>;
+    /**
+     * Fetch OAuth authorization server metadata.
+     *
+     * @param authServerMetadataUrl The authorization server metadata URL
+     * @returns The authorization server metadata or null if not available
+     */
+    static fetchAuthorizationServerMetadata(authServerMetadataUrl: string): Promise<OAuthAuthorizationServerMetadata | null>;
+    /**
+     * Convert authorization server metadata to OAuth configuration.
+     *
+     * @param metadata The authorization server metadata
+     * @returns The OAuth configuration
+     */
+    static metadataToOAuthConfig(metadata: OAuthAuthorizationServerMetadata): MCPOAuthConfig;
+    /**
+     * Discover Oauth Authorization server metadata given an Auth server URL, by
+     * trying the standard well-known endpoints.
+     *
+     * @param authServerUrl The authorization server URL
+     * @returns The authorization server metadata or null if not found
+     */
+    static discoverAuthorizationServerMetadata(authServerUrl: string): Promise<OAuthAuthorizationServerMetadata | null>;
+    /**
+     * Discover OAuth configuration using the standard well-known endpoints.
+     *
+     * @param serverUrl The base URL of the server
+     * @returns The discovered OAuth configuration or null if not available
+     */
+    static discoverOAuthConfig(serverUrl: string): Promise<MCPOAuthConfig | null>;
+    /**
+     * Parse WWW-Authenticate header to extract OAuth information.
+     *
+     * @param header The WWW-Authenticate header value
+     * @returns The resource metadata URI if found
+     */
+    static parseWWWAuthenticateHeader(header: string): string | null;
+    /**
+     * Discover OAuth configuration from WWW-Authenticate header.
+     *
+     * @param wwwAuthenticate The WWW-Authenticate header value
+     * @returns The discovered OAuth configuration or null if not available
+     */
+    static discoverOAuthFromWWWAuthenticate(wwwAuthenticate: string): Promise<MCPOAuthConfig | null>;
+    /**
+     * Extract base URL from an MCP server URL.
+     *
+     * @param mcpServerUrl The MCP server URL
+     * @returns The base URL
+     */
+    static extractBaseUrl(mcpServerUrl: string): string;
+    /**
+     * Check if a URL is an SSE endpoint.
+     *
+     * @param url The URL to check
+     * @returns True if the URL appears to be an SSE endpoint
+     */
+    static isSSEEndpoint(url: string): boolean;
+    /**
+     * Build a resource parameter for OAuth requests.
+     *
+     * @param endpointUrl The endpoint URL
+     * @returns The resource parameter value
+     */
+    static buildResourceParameter(endpointUrl: string): string;
+}

package/dist/src/mcp/oauth-utils.js

@@ -0,0 +1,236 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { getErrorMessage } from '../utils/errors.js';
+/**
+ * Utility class for common OAuth operations.
+ */
+export class OAuthUtils {
+    /**
+     * Construct well-known OAuth endpoint URLs.
+     * By default, uses standard root-based well-known URLs.
+     * If includePathSuffix is true, appends any path from the base URL to the well-known endpoints.
+     */
+    static buildWellKnownUrls(baseUrl, includePathSuffix = false) {
+        const serverUrl = new URL(baseUrl);
+        const base = `${serverUrl.protocol}//${serverUrl.host}`;
+        if (!includePathSuffix) {
+            // Standard discovery: use root-based well-known URLs
+            return {
+                protectedResource: new URL('/.well-known/oauth-protected-resource', base).toString(),
+                authorizationServer: new URL('/.well-known/oauth-authorization-server', base).toString(),
+            };
+        }
+        // Path-based discovery: append path suffix to well-known URLs
+        const pathSuffix = serverUrl.pathname.replace(/\/$/, ''); // Remove trailing slash
+        return {
+            protectedResource: new URL(`/.well-known/oauth-protected-resource${pathSuffix}`, base).toString(),
+            authorizationServer: new URL(`/.well-known/oauth-authorization-server${pathSuffix}`, base).toString(),
+        };
+    }
+    /**
+     * Fetch OAuth protected resource metadata.
+     *
+     * @param resourceMetadataUrl The protected resource metadata URL
+     * @returns The protected resource metadata or null if not available
+     */
+    static async fetchProtectedResourceMetadata(resourceMetadataUrl) {
+        try {
+            const response = await fetch(resourceMetadataUrl);
+            if (!response.ok) {
+                return null;
+            }
+            return (await response.json());
+        }
+        catch (error) {
+            console.debug(`Failed to fetch protected resource metadata from ${resourceMetadataUrl}: ${getErrorMessage(error)}`);
+            return null;
+        }
+    }
+    /**
+     * Fetch OAuth authorization server metadata.
+     *
+     * @param authServerMetadataUrl The authorization server metadata URL
+     * @returns The authorization server metadata or null if not available
+     */
+    static async fetchAuthorizationServerMetadata(authServerMetadataUrl) {
+        try {
+            const response = await fetch(authServerMetadataUrl);
+            if (!response.ok) {
+                return null;
+            }
+            return (await response.json());
+        }
+        catch (error) {
+            console.debug(`Failed to fetch authorization server metadata from ${authServerMetadataUrl}: ${getErrorMessage(error)}`);
+            return null;
+        }
+    }
+    /**
+     * Convert authorization server metadata to OAuth configuration.
+     *
+     * @param metadata The authorization server metadata
+     * @returns The OAuth configuration
+     */
+    static metadataToOAuthConfig(metadata) {
+        return {
+            authorizationUrl: metadata.authorization_endpoint,
+            tokenUrl: metadata.token_endpoint,
+            scopes: metadata.scopes_supported || [],
+            registrationUrl: metadata.registration_endpoint,
+        };
+    }
+    /**
+     * Discover Oauth Authorization server metadata given an Auth server URL, by
+     * trying the standard well-known endpoints.
+     *
+     * @param authServerUrl The authorization server URL
+     * @returns The authorization server metadata or null if not found
+     */
+    static async discoverAuthorizationServerMetadata(authServerUrl) {
+        const authServerUrlObj = new URL(authServerUrl);
+        const base = `${authServerUrlObj.protocol}//${authServerUrlObj.host}`;
+        const endpointsToTry = [];
+        // With issuer URLs with path components, try the following well-known
+        // endpoints in order:
+        if (authServerUrlObj.pathname !== '/') {
+            // 1. OAuth 2.0 Authorization Server Metadata with path insertion
+            endpointsToTry.push(new URL(`/.well-known/oauth-authorization-server${authServerUrlObj.pathname}`, base).toString());
+            // 2. OpenID Connect Discovery 1.0 with path insertion
+            endpointsToTry.push(new URL(`/.well-known/openid-configuration${authServerUrlObj.pathname}`, base).toString());
+            // 3. OpenID Connect Discovery 1.0 with path appending
+            endpointsToTry.push(new URL(`${authServerUrlObj.pathname}/.well-known/openid-configuration`, base).toString());
+        }
+        // With issuer URLs without path components, and those that failed previous
+        // discoveries, try the following well-known endpoints in order:
+        // 1. OAuth 2.0 Authorization Server Metadata
+        endpointsToTry.push(new URL('/.well-known/oauth-authorization-server', base).toString());
+        // 2. OpenID Connect Discovery 1.0
+        endpointsToTry.push(new URL('/.well-known/openid-configuration', base).toString());
+        for (const endpoint of endpointsToTry) {
+            const authServerMetadata = await this.fetchAuthorizationServerMetadata(endpoint);
+            if (authServerMetadata) {
+                return authServerMetadata;
+            }
+        }
+        console.debug(`Metadata discovery failed for authorization server ${authServerUrl}`);
+        return null;
+    }
+    /**
+     * Discover OAuth configuration using the standard well-known endpoints.
+     *
+     * @param serverUrl The base URL of the server
+     * @returns The discovered OAuth configuration or null if not available
+     */
+    static async discoverOAuthConfig(serverUrl) {
+        try {
+            // First try standard root-based discovery
+            const wellKnownUrls = this.buildWellKnownUrls(serverUrl, false);
+            // Try to get the protected resource metadata at root
+            let resourceMetadata = await this.fetchProtectedResourceMetadata(wellKnownUrls.protectedResource);
+            // If root discovery fails and we have a path, try path-based discovery
+            if (!resourceMetadata) {
+                const url = new URL(serverUrl);
+                if (url.pathname && url.pathname !== '/') {
+                    const pathBasedUrls = this.buildWellKnownUrls(serverUrl, true);
+                    resourceMetadata = await this.fetchProtectedResourceMetadata(pathBasedUrls.protectedResource);
+                }
+            }
+            if (resourceMetadata?.authorization_servers?.length) {
+                // Use the first authorization server
+                const authServerUrl = resourceMetadata.authorization_servers[0];
+                const authServerMetadata = await this.discoverAuthorizationServerMetadata(authServerUrl);
+                if (authServerMetadata) {
+                    const config = this.metadataToOAuthConfig(authServerMetadata);
+                    if (authServerMetadata.registration_endpoint) {
+                        console.log('Dynamic client registration is supported at:', authServerMetadata.registration_endpoint);
+                    }
+                    return config;
+                }
+            }
+            // Fallback: try well-known endpoints at the base URL
+            console.debug(`Trying OAuth discovery fallback at ${serverUrl}`);
+            const authServerMetadata = await this.discoverAuthorizationServerMetadata(serverUrl);
+            if (authServerMetadata) {
+                const config = this.metadataToOAuthConfig(authServerMetadata);
+                if (authServerMetadata.registration_endpoint) {
+                    console.log('Dynamic client registration is supported at:', authServerMetadata.registration_endpoint);
+                }
+                return config;
+            }
+            return null;
+        }
+        catch (error) {
+            console.debug(`Failed to discover OAuth configuration: ${getErrorMessage(error)}`);
+            return null;
+        }
+    }
+    /**
+     * Parse WWW-Authenticate header to extract OAuth information.
+     *
+     * @param header The WWW-Authenticate header value
+     * @returns The resource metadata URI if found
+     */
+    static parseWWWAuthenticateHeader(header) {
+        // Parse Bearer realm and resource_metadata
+        const match = header.match(/resource_metadata="([^"]+)"/);
+        if (match) {
+            return match[1];
+        }
+        return null;
+    }
+    /**
+     * Discover OAuth configuration from WWW-Authenticate header.
+     *
+     * @param wwwAuthenticate The WWW-Authenticate header value
+     * @returns The discovered OAuth configuration or null if not available
+     */
+    static async discoverOAuthFromWWWAuthenticate(wwwAuthenticate) {
+        const resourceMetadataUri = this.parseWWWAuthenticateHeader(wwwAuthenticate);
+        if (!resourceMetadataUri) {
+            return null;
+        }
+        const resourceMetadata = await this.fetchProtectedResourceMetadata(resourceMetadataUri);
+        if (!resourceMetadata?.authorization_servers?.length) {
+            return null;
+        }
+        const authServerUrl = resourceMetadata.authorization_servers[0];
+        const authServerMetadata = await this.discoverAuthorizationServerMetadata(authServerUrl);
+        if (authServerMetadata) {
+            return this.metadataToOAuthConfig(authServerMetadata);
+        }
+        return null;
+    }
+    /**
+     * Extract base URL from an MCP server URL.
+     *
+     * @param mcpServerUrl The MCP server URL
+     * @returns The base URL
+     */
+    static extractBaseUrl(mcpServerUrl) {
+        const serverUrl = new URL(mcpServerUrl);
+        return `${serverUrl.protocol}//${serverUrl.host}`;
+    }
+    /**
+     * Check if a URL is an SSE endpoint.
+     *
+     * @param url The URL to check
+     * @returns True if the URL appears to be an SSE endpoint
+     */
+    static isSSEEndpoint(url) {
+        return url.includes('/sse') || !url.includes('/mcp');
+    }
+    /**
+     * Build a resource parameter for OAuth requests.
+     *
+     * @param endpointUrl The endpoint URL
+     * @returns The resource parameter value
+     */
+    static buildResourceParameter(endpointUrl) {
+        const url = new URL(endpointUrl);
+        return `${url.protocol}//${url.host}`;
+    }
+}
+//# sourceMappingURL=oauth-utils.js.map

package/dist/src/mcp/oauth-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-utils.js","sourceRoot":"","sources":["../../../src/mcp/oauth-utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAgCrD;;GAEG;AACH,MAAM,OAAO,UAAU;IACrB;;;;OAIG;IACH,MAAM,CAAC,kBAAkB,CAAC,OAAe,EAAE,iBAAiB,GAAG,KAAK;QAClE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,GAAG,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;QAExD,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,qDAAqD;YACrD,OAAO;gBACL,iBAAiB,EAAE,IAAI,GAAG,CACxB,uCAAuC,EACvC,IAAI,CACL,CAAC,QAAQ,EAAE;gBACZ,mBAAmB,EAAE,IAAI,GAAG,CAC1B,yCAAyC,EACzC,IAAI,CACL,CAAC,QAAQ,EAAE;aACb,CAAC;QACJ,CAAC;QAED,8DAA8D;QAC9D,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,wBAAwB;QAClF,OAAO;YACL,iBAAiB,EAAE,IAAI,GAAG,CACxB,wCAAwC,UAAU,EAAE,EACpD,IAAI,CACL,CAAC,QAAQ,EAAE;YACZ,mBAAmB,EAAE,IAAI,GAAG,CAC1B,0CAA0C,UAAU,EAAE,EACtD,IAAI,CACL,CAAC,QAAQ,EAAE;SACb,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,8BAA8B,CACzC,mBAA2B;QAE3B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,CAAC;YAClD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmC,CAAC;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,oDAAoD,mBAAmB,KAAK,eAAe,CAAC,KAAK,CAAC,EAAE,CACrG,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAC3C,qBAA6B;QAE7B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACpD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAqC,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,sDAAsD,qBAAqB,KAAK,eAAe,CAAC,KAAK,CAAC,EAAE,CACzG,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,qBAAqB,CAC1B,QAA0C;QAE1C,OAAO;YACL,gBAAgB,EAAE,QAAQ,CAAC,sBAAsB;YACjD,QAAQ,EAAE,QAAQ,CAAC,cAAc;YACjC,MAAM,EAAE,QAAQ,CAAC,gBAAgB,IAAI,EAAE;YACvC,eAAe,EAAE,QAAQ,CAAC,qBAAqB;SAChD,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAC9C,aAAqB;QAErB,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,GAAG,gBAAgB,CAAC,QAAQ,KAAK,gBAAgB,CAAC,IAAI,EAAE,CAAC;QAEtE,MAAM,cAAc,GAAa,EAAE,CAAC;QAEpC,sEAAsE;QACtE,sBAAsB;QACtB,IAAI,gBAAgB,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;YACtC,iEAAiE;YACjE,cAAc,CAAC,IAAI,CACjB,IAAI,GAAG,CACL,0CAA0C,gBAAgB,CAAC,QAAQ,EAAE,EACrE,IAAI,CACL,CAAC,QAAQ,EAAE,CACb,CAAC;YAEF,sDAAsD;YACtD,cAAc,CAAC,IAAI,CACjB,IAAI,GAAG,CACL,oCAAoC,gBAAgB,CAAC,QAAQ,EAAE,EAC/D,IAAI,CACL,CAAC,QAAQ,EAAE,CACb,CAAC;YAEF,sDAAsD;YACtD,cAAc,CAAC,IAAI,CACjB,IAAI,GAAG,CACL,GAAG,gBAAgB,CAAC,QAAQ,mCAAmC,EAC/D,IAAI,CACL,CAAC,QAAQ,EAAE,CACb,CAAC;QACJ,CAAC;QAED,2EAA2E;QAC3E,gEAAgE;QAEhE,6CAA6C;QAC7C,cAAc,CAAC,IAAI,CACjB,IAAI,GAAG,CAAC,yCAAyC,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CACpE,CAAC;QAEF,kCAAkC;QAClC,cAAc,CAAC,IAAI,CACjB,IAAI,GAAG,CAAC,mCAAmC,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CAC9D,CAAC;QAEF,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;YACtC,MAAM,kBAAkB,GACtB,MAAM,IAAI,CAAC,gCAAgC,CAAC,QAAQ,CAAC,CAAC;YACxD,IAAI,kBAAkB,EAAE,CAAC;gBACvB,OAAO,kBAAkB,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,OAAO,CAAC,KAAK,CACX,sDAAsD,aAAa,EAAE,CACtE,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAC9B,SAAiB;QAEjB,IAAI,CAAC;YACH,0CAA0C;YAC1C,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAEhE,qDAAqD;YACrD,IAAI,gBAAgB,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAC9D,aAAa,CAAC,iBAAiB,CAChC,CAAC;YAEF,uEAAuE;YACvE,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC/B,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;oBACzC,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;oBAC/D,gBAAgB,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAC1D,aAAa,CAAC,iBAAiB,CAChC,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,IAAI,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC;gBACpD,qCAAqC;gBACrC,MAAM,aAAa,GAAG,gBAAgB,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;gBAChE,MAAM,kBAAkB,GACtB,MAAM,IAAI,CAAC,mCAAmC,CAAC,aAAa,CAAC,CAAC;gBAEhE,IAAI,kBAAkB,EAAE,CAAC;oBACvB,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;oBAC9D,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;wBAC7C,OAAO,CAAC,GAAG,CACT,8CAA8C,EAC9C,kBAAkB,CAAC,qBAAqB,CACzC,CAAC;oBACJ,CAAC;oBACD,OAAO,MAAM,CAAC;gBAChB,CAAC;YACH,CAAC;YAED,qDAAqD;YACrD,OAAO,CAAC,KAAK,CAAC,sCAAsC,SAAS,EAAE,CAAC,CAAC;YACjE,MAAM,kBAAkB,GACtB,MAAM,IAAI,CAAC,mCAAmC,CAAC,SAAS,CAAC,CAAC;YAE5D,IAAI,kBAAkB,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;gBAC9D,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;oBAC7C,OAAO,CAAC,GAAG,CACT,8CAA8C,EAC9C,kBAAkB,CAAC,qBAAqB,CACzC,CAAC;gBACJ,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,2CAA2C,eAAe,CAAC,KAAK,CAAC,EAAE,CACpE,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,0BAA0B,CAAC,MAAc;QAC9C,2CAA2C;QAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC1D,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAC3C,eAAuB;QAEvB,MAAM,mBAAmB,GACvB,IAAI,CAAC,0BAA0B,CAAC,eAAe,CAAC,CAAC;QACnD,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,gBAAgB,GACpB,MAAM,IAAI,CAAC,8BAA8B,CAAC,mBAAmB,CAAC,CAAC;QACjE,IAAI,CAAC,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,aAAa,GAAG,gBAAgB,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAChE,MAAM,kBAAkB,GACtB,MAAM,IAAI,CAAC,mCAAmC,CAAC,aAAa,CAAC,CAAC;QAEhE,IAAI,kBAAkB,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;QACxD,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CAAC,YAAoB;QACxC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;QACxC,OAAO,GAAG,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;IACpD,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,aAAa,CAAC,GAAW;QAC9B,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,sBAAsB,CAAC,WAAmB;QAC/C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACjC,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;IACxC,CAAC;CACF"}

package/dist/src/mcp/oauth-utils.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export {};

package/dist/src/mcp/oauth-utils.test.js

@@ -0,0 +1,199 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { OAuthUtils } from './oauth-utils.js';
+// Mock fetch globally
+const mockFetch = vi.fn();
+global.fetch = mockFetch;
+describe('OAuthUtils', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+        vi.spyOn(console, 'debug').mockImplementation(() => { });
+        vi.spyOn(console, 'error').mockImplementation(() => { });
+        vi.spyOn(console, 'log').mockImplementation(() => { });
+    });
+    afterEach(() => {
+        vi.restoreAllMocks();
+    });
+    describe('buildWellKnownUrls', () => {
+        it('should build standard root-based URLs by default', () => {
+            const urls = OAuthUtils.buildWellKnownUrls('https://example.com/mcp');
+            expect(urls.protectedResource).toBe('https://example.com/.well-known/oauth-protected-resource');
+            expect(urls.authorizationServer).toBe('https://example.com/.well-known/oauth-authorization-server');
+        });
+        it('should build path-based URLs when includePathSuffix is true', () => {
+            const urls = OAuthUtils.buildWellKnownUrls('https://example.com/mcp', true);
+            expect(urls.protectedResource).toBe('https://example.com/.well-known/oauth-protected-resource/mcp');
+            expect(urls.authorizationServer).toBe('https://example.com/.well-known/oauth-authorization-server/mcp');
+        });
+        it('should handle root path correctly', () => {
+            const urls = OAuthUtils.buildWellKnownUrls('https://example.com', true);
+            expect(urls.protectedResource).toBe('https://example.com/.well-known/oauth-protected-resource');
+            expect(urls.authorizationServer).toBe('https://example.com/.well-known/oauth-authorization-server');
+        });
+        it('should handle trailing slash in path', () => {
+            const urls = OAuthUtils.buildWellKnownUrls('https://example.com/mcp/', true);
+            expect(urls.protectedResource).toBe('https://example.com/.well-known/oauth-protected-resource/mcp');
+            expect(urls.authorizationServer).toBe('https://example.com/.well-known/oauth-authorization-server/mcp');
+        });
+    });
+    describe('fetchProtectedResourceMetadata', () => {
+        const mockResourceMetadata = {
+            resource: 'https://api.example.com',
+            authorization_servers: ['https://auth.example.com'],
+            bearer_methods_supported: ['header'],
+        };
+        it('should fetch protected resource metadata successfully', async () => {
+            mockFetch.mockResolvedValueOnce({
+                ok: true,
+                json: () => Promise.resolve(mockResourceMetadata),
+            });
+            const result = await OAuthUtils.fetchProtectedResourceMetadata('https://example.com/.well-known/oauth-protected-resource');
+            expect(result).toEqual(mockResourceMetadata);
+        });
+        it('should return null when fetch fails', async () => {
+            mockFetch.mockResolvedValueOnce({
+                ok: false,
+            });
+            const result = await OAuthUtils.fetchProtectedResourceMetadata('https://example.com/.well-known/oauth-protected-resource');
+            expect(result).toBeNull();
+        });
+    });
+    describe('fetchAuthorizationServerMetadata', () => {
+        const mockAuthServerMetadata = {
+            issuer: 'https://auth.example.com',
+            authorization_endpoint: 'https://auth.example.com/authorize',
+            token_endpoint: 'https://auth.example.com/token',
+            scopes_supported: ['read', 'write'],
+        };
+        it('should fetch authorization server metadata successfully', async () => {
+            mockFetch.mockResolvedValueOnce({
+                ok: true,
+                json: () => Promise.resolve(mockAuthServerMetadata),
+            });
+            const result = await OAuthUtils.fetchAuthorizationServerMetadata('https://auth.example.com/.well-known/oauth-authorization-server');
+            expect(result).toEqual(mockAuthServerMetadata);
+        });
+        it('should return null when fetch fails', async () => {
+            mockFetch.mockResolvedValueOnce({
+                ok: false,
+            });
+            const result = await OAuthUtils.fetchAuthorizationServerMetadata('https://auth.example.com/.well-known/oauth-authorization-server');
+            expect(result).toBeNull();
+        });
+    });
+    describe('discoverAuthorizationServerMetadata', () => {
+        const mockAuthServerMetadata = {
+            issuer: 'https://auth.example.com',
+            authorization_endpoint: 'https://auth.example.com/authorize',
+            token_endpoint: 'https://auth.example.com/token',
+            scopes_supported: ['read', 'write'],
+        };
+        it('should handle URLs without path components correctly', async () => {
+            mockFetch
+                .mockResolvedValueOnce({
+                ok: false,
+            })
+                .mockResolvedValueOnce({
+                ok: true,
+                json: () => Promise.resolve(mockAuthServerMetadata),
+            });
+            const result = await OAuthUtils.discoverAuthorizationServerMetadata('https://auth.example.com/');
+            expect(result).toEqual(mockAuthServerMetadata);
+            expect(mockFetch).nthCalledWith(1, 'https://auth.example.com/.well-known/oauth-authorization-server');
+            expect(mockFetch).nthCalledWith(2, 'https://auth.example.com/.well-known/openid-configuration');
+        });
+        it('should handle URLs with path components correctly', async () => {
+            mockFetch
+                .mockResolvedValueOnce({
+                ok: false,
+            })
+                .mockResolvedValueOnce({
+                ok: false,
+            })
+                .mockResolvedValueOnce({
+                ok: true,
+                json: () => Promise.resolve(mockAuthServerMetadata),
+            });
+            const result = await OAuthUtils.discoverAuthorizationServerMetadata('https://auth.example.com/mcp');
+            expect(result).toEqual(mockAuthServerMetadata);
+            expect(mockFetch).nthCalledWith(1, 'https://auth.example.com/.well-known/oauth-authorization-server/mcp');
+            expect(mockFetch).nthCalledWith(2, 'https://auth.example.com/.well-known/openid-configuration/mcp');
+            expect(mockFetch).nthCalledWith(3, 'https://auth.example.com/mcp/.well-known/openid-configuration');
+        });
+    });
+    describe('metadataToOAuthConfig', () => {
+        it('should convert metadata to OAuth config', () => {
+            const metadata = {
+                issuer: 'https://auth.example.com',
+                authorization_endpoint: 'https://auth.example.com/authorize',
+                token_endpoint: 'https://auth.example.com/token',
+                scopes_supported: ['read', 'write'],
+            };
+            const config = OAuthUtils.metadataToOAuthConfig(metadata);
+            expect(config).toEqual({
+                authorizationUrl: 'https://auth.example.com/authorize',
+                tokenUrl: 'https://auth.example.com/token',
+                scopes: ['read', 'write'],
+            });
+        });
+        it('should handle empty scopes', () => {
+            const metadata = {
+                issuer: 'https://auth.example.com',
+                authorization_endpoint: 'https://auth.example.com/authorize',
+                token_endpoint: 'https://auth.example.com/token',
+            };
+            const config = OAuthUtils.metadataToOAuthConfig(metadata);
+            expect(config.scopes).toEqual([]);
+        });
+    });
+    describe('parseWWWAuthenticateHeader', () => {
+        it('should parse resource metadata URI from WWW-Authenticate header', () => {
+            const header = 'Bearer realm="example", resource_metadata="https://example.com/.well-known/oauth-protected-resource"';
+            const result = OAuthUtils.parseWWWAuthenticateHeader(header);
+            expect(result).toBe('https://example.com/.well-known/oauth-protected-resource');
+        });
+        it('should return null when no resource metadata URI is found', () => {
+            const header = 'Bearer realm="example"';
+            const result = OAuthUtils.parseWWWAuthenticateHeader(header);
+            expect(result).toBeNull();
+        });
+    });
+    describe('extractBaseUrl', () => {
+        it('should extract base URL from MCP server URL', () => {
+            const result = OAuthUtils.extractBaseUrl('https://example.com/mcp/v1');
+            expect(result).toBe('https://example.com');
+        });
+        it('should handle URLs with ports', () => {
+            const result = OAuthUtils.extractBaseUrl('https://example.com:8080/mcp/v1');
+            expect(result).toBe('https://example.com:8080');
+        });
+    });
+    describe('isSSEEndpoint', () => {
+        it('should return true for SSE endpoints', () => {
+            expect(OAuthUtils.isSSEEndpoint('https://example.com/sse')).toBe(true);
+            expect(OAuthUtils.isSSEEndpoint('https://example.com/api/v1/sse')).toBe(true);
+        });
+        it('should return true for non-MCP endpoints', () => {
+            expect(OAuthUtils.isSSEEndpoint('https://example.com/api')).toBe(true);
+        });
+        it('should return false for MCP endpoints', () => {
+            expect(OAuthUtils.isSSEEndpoint('https://example.com/mcp')).toBe(false);
+            expect(OAuthUtils.isSSEEndpoint('https://example.com/api/mcp/v1')).toBe(false);
+        });
+    });
+    describe('buildResourceParameter', () => {
+        it('should build resource parameter from endpoint URL', () => {
+            const result = OAuthUtils.buildResourceParameter('https://example.com/oauth/token');
+            expect(result).toBe('https://example.com');
+        });
+        it('should handle URLs with ports', () => {
+            const result = OAuthUtils.buildResourceParameter('https://example.com:8080/oauth/token');
+            expect(result).toBe('https://example.com:8080');
+        });
+    });
+});
+//# sourceMappingURL=oauth-utils.test.js.map

package/dist/src/mcp/oauth-utils.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-utils.test.js","sourceRoot":"","sources":["../../../src/mcp/oauth-utils.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAKzE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,sBAAsB;AACtB,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAC1B,MAAM,CAAC,KAAK,GAAG,SAAS,CAAC;AAEzB,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACxD,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACxD,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAClC,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;YAC1D,MAAM,IAAI,GAAG,UAAU,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,CAAC;YACtE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CACjC,0DAA0D,CAC3D,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,IAAI,CACnC,4DAA4D,CAC7D,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;YACrE,MAAM,IAAI,GAAG,UAAU,CAAC,kBAAkB,CACxC,yBAAyB,EACzB,IAAI,CACL,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CACjC,8DAA8D,CAC/D,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,IAAI,CACnC,gEAAgE,CACjE,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;YAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;YACxE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CACjC,0DAA0D,CAC3D,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,IAAI,CACnC,4DAA4D,CAC7D,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;YAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,kBAAkB,CACxC,0BAA0B,EAC1B,IAAI,CACL,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CACjC,8DAA8D,CAC/D,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,IAAI,CACnC,gEAAgE,CACjE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;QAC9C,MAAM,oBAAoB,GAAmC;YAC3D,QAAQ,EAAE,yBAAyB;YACnC,qBAAqB,EAAE,CAAC,0BAA0B,CAAC;YACnD,wBAAwB,EAAE,CAAC,QAAQ,CAAC;SACrC,CAAC;QAEF,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;YACrE,SAAS,CAAC,qBAAqB,CAAC;gBAC9B,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC;aAClD,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,8BAA8B,CAC5D,0DAA0D,CAC3D,CAAC;YAEF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;YACnD,SAAS,CAAC,qBAAqB,CAAC;gBAC9B,EAAE,EAAE,KAAK;aACV,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,8BAA8B,CAC5D,0DAA0D,CAC3D,CAAC;YAEF,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAChD,MAAM,sBAAsB,GAAqC;YAC/D,MAAM,EAAE,0BAA0B;YAClC,sBAAsB,EAAE,oCAAoC;YAC5D,cAAc,EAAE,gCAAgC;YAChD,gBAAgB,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;SACpC,CAAC;QAEF,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;YACvE,SAAS,CAAC,qBAAqB,CAAC;gBAC9B,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC;aACpD,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,gCAAgC,CAC9D,iEAAiE,CAClE,CAAC;YAEF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;YACnD,SAAS,CAAC,qBAAqB,CAAC;gBAC9B,EAAE,EAAE,KAAK;aACV,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,gCAAgC,CAC9D,iEAAiE,CAClE,CAAC;YAEF,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,qCAAqC,EAAE,GAAG,EAAE;QACnD,MAAM,sBAAsB,GAAqC;YAC/D,MAAM,EAAE,0BAA0B;YAClC,sBAAsB,EAAE,oCAAoC;YAC5D,cAAc,EAAE,gCAAgC;YAChD,gBAAgB,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;SACpC,CAAC;QAEF,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;YACpE,SAAS;iBACN,qBAAqB,CAAC;gBACrB,EAAE,EAAE,KAAK;aACV,CAAC;iBACD,qBAAqB,CAAC;gBACrB,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC;aACpD,CAAC,CAAC;YAEL,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,mCAAmC,CACjE,2BAA2B,CAC5B,CAAC;YAEF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;YAE/C,MAAM,CAAC,SAAS,CAAC,CAAC,aAAa,CAC7B,CAAC,EACD,iEAAiE,CAClE,CAAC;YACF,MAAM,CAAC,SAAS,CAAC,CAAC,aAAa,CAC7B,CAAC,EACD,2DAA2D,CAC5D,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;YACjE,SAAS;iBACN,qBAAqB,CAAC;gBACrB,EAAE,EAAE,KAAK;aACV,CAAC;iBACD,qBAAqB,CAAC;gBACrB,EAAE,EAAE,KAAK;aACV,CAAC;iBACD,qBAAqB,CAAC;gBACrB,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC;aACpD,CAAC,CAAC;YAEL,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,mCAAmC,CACjE,8BAA8B,CAC/B,CAAC;YAEF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;YAE/C,MAAM,CAAC,SAAS,CAAC,CAAC,aAAa,CAC7B,CAAC,EACD,qEAAqE,CACtE,CAAC;YACF,MAAM,CAAC,SAAS,CAAC,CAAC,aAAa,CAC7B,CAAC,EACD,+DAA+D,CAChE,CAAC;YACF,MAAM,CAAC,SAAS,CAAC,CAAC,aAAa,CAC7B,CAAC,EACD,+DAA+D,CAChE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;QACrC,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,MAAM,QAAQ,GAAqC;gBACjD,MAAM,EAAE,0BAA0B;gBAClC,sBAAsB,EAAE,oCAAoC;gBAC5D,cAAc,EAAE,gCAAgC;gBAChD,gBAAgB,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;aACpC,CAAC;YAEF,MAAM,MAAM,GAAG,UAAU,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;YAE1D,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;gBACrB,gBAAgB,EAAE,oCAAoC;gBACtD,QAAQ,EAAE,gCAAgC;gBAC1C,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;aAC1B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;YACpC,MAAM,QAAQ,GAAqC;gBACjD,MAAM,EAAE,0BAA0B;gBAClC,sBAAsB,EAAE,oCAAoC;gBAC5D,cAAc,EAAE,gCAAgC;aACjD,CAAC;YAEF,MAAM,MAAM,GAAG,UAAU,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;YAE1D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;QAC1C,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;YACzE,MAAM,MAAM,GACV,sGAAsG,CAAC;YACzG,MAAM,MAAM,GAAG,UAAU,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;YAC7D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CACjB,0DAA0D,CAC3D,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;YACnE,MAAM,MAAM,GAAG,wBAAwB,CAAC;YACxC,MAAM,MAAM,GAAG,UAAU,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;YAC7D,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;YACrD,MAAM,MAAM,GAAG,UAAU,CAAC,cAAc,CAAC,4BAA4B,CAAC,CAAC;YACvE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;YACvC,MAAM,MAAM,GAAG,UAAU,CAAC,cAAc,CACtC,iCAAiC,CAClC,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC7B,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;YAC9C,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvE,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,gCAAgC,CAAC,CAAC,CAAC,IAAI,CACrE,IAAI,CACL,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAClD,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/C,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxE,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,gCAAgC,CAAC,CAAC,CAAC,IAAI,CACrE,KAAK,CACN,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;QACtC,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;YAC3D,MAAM,MAAM,GAAG,UAAU,CAAC,sBAAsB,CAC9C,iCAAiC,CAClC,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;YACvC,MAAM,MAAM,GAAG,UAAU,CAAC,sBAAsB,CAC9C,sCAAsC,CACvC,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/src/mcp/sa-impersonation-provider.d.ts

@@ -0,0 +1,33 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { OAuthClientInformation, OAuthClientInformationFull, OAuthClientMetadata, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
+import type { MCPServerConfig } from '../config/config.js';
+import type { OAuthClientProvider } from '@modelcontextprotocol/sdk/client/auth.js';
+export declare class ServiceAccountImpersonationProvider implements OAuthClientProvider {
+    private readonly config;
+    private readonly targetServiceAccount;
+    private readonly targetAudience;
+    private readonly auth;
+    private cachedToken?;
+    private tokenExpiryTime?;
+    readonly redirectUrl = "";
+    readonly clientMetadata: OAuthClientMetadata;
+    private _clientInformation?;
+    constructor(config: MCPServerConfig);
+    clientInformation(): OAuthClientInformation | undefined;
+    saveClientInformation(clientInformation: OAuthClientInformationFull): void;
+    tokens(): Promise<OAuthTokens | undefined>;
+    saveTokens(_tokens: OAuthTokens): void;
+    redirectToAuthorization(_authorizationUrl: URL): void;
+    saveCodeVerifier(_codeVerifier: string): void;
+    codeVerifier(): string;
+    /**
+     * Parses a JWT string to extract its expiry time.
+     * @param idToken The JWT ID token.
+     * @returns The expiry time in **milliseconds**, or undefined if parsing fails.
+     */
+    private parseTokenExpiry;
+}