@honeyfield/rent2b-mcp 1.1.0 → 1.2.1

package/README.md

@@ -58,6 +58,20 @@ npx @honeyfield/rent2b-mcp --http --port=8080
 
 This exposes a single `/mcp` endpoint supporting POST (JSON-RPC messages), GET (SSE notifications), and DELETE (session termination). Sessions are tracked server-side via the `Mcp-Session-Id` header.
 
+**Authentication:** In HTTP and SSE mode, each client sends their own API key per request via header:
+
+```
+Authorization: Bearer r2b_your-api-key
+```
+
+or:
+
+```
+X-API-Key: r2b_your-api-key
+```
+
+The API key is validated on session creation. The `RENT2B_API_KEY` environment variable is **not required** in HTTP/SSE mode.
+
 ### SSE Mode (Legacy)
 
 For SSE transport (e.g. for older web-based MCP clients):

package/dist/api-client.js

@@ -5,6 +5,11 @@ export class Rent2bApiClient {
     organizationId = null;
     constructor(config) {
         this.config = config;
+        // Reuse an org already resolved by the auth layer to avoid a redundant
+        // GET /zapier/me on every request.
+        if (config.organizationId != null) {
+            this.organizationId = config.organizationId;
+        }
         this.client = axios.create({
             baseURL: config.apiUrl,
             headers: {
@@ -17,12 +22,16 @@ export class Rent2bApiClient {
     async resolveOrganization() {
         if (this.organizationId)
             return this.organizationId;
-        const response = await this.client.get('/organizations');
-        const orgs = response.data;
-        if (!Array.isArray(orgs) || orgs.length === 0) {
-            throw new Error('No organizations found for this API key');
+        // Resolve the organization bound to THIS API key. `GET /organizations` is
+        // NOT key-scoped (it returns every organization in the system, ordered with
+        // org 1 first), so taking [0] picked the wrong org for multi-tenant keys.
+        // `GET /zapier/me` is key-scoped and returns the authenticated key's org.
+        const response = await this.client.get('/zapier/me');
+        const orgId = response.data?.organization?.id ?? response.data?.id;
+        if (typeof orgId !== 'number') {
+            throw new Error('Could not resolve organization for this API key');
         }
-        this.organizationId = orgs[0].id;
+        this.organizationId = orgId;
         return this.organizationId;
     }
     getOrganizationId() {

package/dist/api-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAiB,UAAU,EAAE,MAAM,OAAO,CAAC;AAczD,MAAM,OAAO,eAAe;IAIN;IAHZ,MAAM,CAAgB;IACtB,cAAc,GAAkB,IAAI,CAAC;IAE7C,YAAoB,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;QAChC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;YACzB,OAAO,EAAE,MAAM,CAAC,MAAM;YACtB,OAAO,EAAE;gBACP,WAAW,EAAE,MAAM,CAAC,MAAM;gBAC1B,cAAc,EAAE,kBAAkB;aACnC;YACD,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB;QACvB,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC,cAAc,CAAC;QAEpD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;QAE3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,cAAe,CAAC;IAC9B,CAAC;IAED,iBAAiB;QACf,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,OAAO,CACX,MAAmD,EACnD,IAAY,EACZ,IAAc,EACd,MAAgC;QAEhC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAC/B,kBAAkB,EAClB,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,CACjC,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAI;gBAC5C,MAAM;gBACN,GAAG,EAAE,YAAY;gBACjB,IAAI;gBACJ,MAAM;aACP,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,UAAU,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAClD,MAAM,QAAQ,GAAa;oBACzB,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,IAAI,KAAK,CAAC,OAAO;oBACtD,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;oBACjC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;iBAC7B,CAAC;gBACF,MAAM,QAAQ,CAAC;YACjB,CAAC;YACD,MAAM;gBACJ,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;gBACjE,UAAU,EAAE,CAAC;gBACb,OAAO,EAAE,IAAI;aACF,CAAC;QAChB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAc,IAAY,EAAE,MAAgC;QACnE,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,IAAI,CAAc,IAAY,EAAE,IAAc;QAClD,OAAO,IAAI,CAAC,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,KAAK,CAAc,IAAY,EAAE,IAAc;QACnD,OAAO,IAAI,CAAC,OAAO,CAAI,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,GAAG,CAAc,IAAY,EAAE,IAAc;QACjD,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,MAAM,CAAc,IAAY;QACpC,OAAO,IAAI,CAAC,OAAO,CAAI,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;CACF"}
+{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAiB,UAAU,EAAE,MAAM,OAAO,CAAC;AAczD,MAAM,OAAO,eAAe;IAIN;IAHZ,MAAM,CAAgB;IACtB,cAAc,GAAkB,IAAI,CAAC;IAE7C,YAAoB,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;QAChC,uEAAuE;QACvE,mCAAmC;QACnC,IAAI,MAAM,CAAC,cAAc,IAAI,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;YACzB,OAAO,EAAE,MAAM,CAAC,MAAM;YACtB,OAAO,EAAE;gBACP,WAAW,EAAE,MAAM,CAAC,MAAM;gBAC1B,cAAc,EAAE,kBAAkB;aACnC;YACD,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB;QACvB,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC,cAAc,CAAC;QAEpD,0EAA0E;QAC1E,4EAA4E;QAC5E,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACrD,MAAM,KAAK,GAAY,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAE5E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC;QAC5B,OAAO,IAAI,CAAC,cAAe,CAAC;IAC9B,CAAC;IAED,iBAAiB;QACf,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,OAAO,CACX,MAAmD,EACnD,IAAY,EACZ,IAAc,EACd,MAAgC;QAEhC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAC/B,kBAAkB,EAClB,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,CACjC,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAI;gBAC5C,MAAM;gBACN,GAAG,EAAE,YAAY;gBACjB,IAAI;gBACJ,MAAM;aACP,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,UAAU,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAClD,MAAM,QAAQ,GAAa;oBACzB,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,IAAI,KAAK,CAAC,OAAO;oBACtD,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;oBACjC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;iBAC7B,CAAC;gBACF,MAAM,QAAQ,CAAC;YACjB,CAAC;YACD,MAAM;gBACJ,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;gBACjE,UAAU,EAAE,CAAC;gBACb,OAAO,EAAE,IAAI;aACF,CAAC;QAChB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAc,IAAY,EAAE,MAAgC;QACnE,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,IAAI,CAAc,IAAY,EAAE,IAAc;QAClD,OAAO,IAAI,CAAC,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,KAAK,CAAc,IAAY,EAAE,IAAc;QACnD,OAAO,IAAI,CAAC,OAAO,CAAI,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,GAAG,CAAc,IAAY,EAAE,IAAc;QACjD,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,MAAM,CAAc,IAAY;QACpC,OAAO,IAAI,CAAC,OAAO,CAAI,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;CACF"}

package/dist/api-client.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/api-client.test.js

@@ -0,0 +1,41 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+const mockGet = vi.fn();
+const mockRequest = vi.fn();
+vi.mock('axios', () => ({
+    default: {
+        create: () => ({ get: mockGet, request: mockRequest }),
+    },
+}));
+const { Rent2bApiClient } = await import('./api-client.js');
+describe('resolveOrganization', () => {
+    beforeEach(() => {
+        mockGet.mockReset();
+        mockRequest.mockReset();
+    });
+    it('resolves the key-scoped org via /zapier/me, not GET /organizations[0]', async () => {
+        // /zapier/me returns the org bound to THIS api key (Haus Hana = 54).
+        mockGet.mockResolvedValueOnce({
+            data: { id: 54, organization: { id: 54, name: 'Haus Hana' } },
+        });
+        const client = new Rent2bApiClient({ apiKey: 'r2b_x', apiUrl: 'http://api' });
+        const org = await client.resolveOrganization();
+        expect(mockGet).toHaveBeenCalledWith('/zapier/me');
+        expect(org).toBe(54);
+        // must NOT fall back to the unscoped /organizations list
+        expect(mockGet).not.toHaveBeenCalledWith('/organizations');
+    });
+    it('caches the resolved org (one lookup)', async () => {
+        mockGet.mockResolvedValue({ data: { organization: { id: 54 } } });
+        const client = new Rent2bApiClient({ apiKey: 'r2b_x', apiUrl: 'http://api' });
+        await client.resolveOrganization();
+        await client.resolveOrganization();
+        expect(mockGet).toHaveBeenCalledTimes(1);
+        expect(client.getOrganizationId()).toBe(54);
+    });
+    it('throws when /zapier/me has no organization id', async () => {
+        mockGet.mockResolvedValueOnce({ data: {} });
+        const client = new Rent2bApiClient({ apiKey: 'r2b_x', apiUrl: 'http://api' });
+        await expect(client.resolveOrganization()).rejects.toThrow();
+    });
+});
+//# sourceMappingURL=api-client.test.js.map

package/dist/api-client.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client.test.js","sourceRoot":"","sources":["../src/api-client.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAE9D,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AACxB,MAAM,WAAW,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAE5B,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;IACtB,OAAO,EAAE;QACP,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;KACvD;CACF,CAAC,CAAC,CAAC;AAEJ,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;AAE5D,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,UAAU,CAAC,GAAG,EAAE;QACd,OAAO,CAAC,SAAS,EAAE,CAAC;QACpB,WAAW,CAAC,SAAS,EAAE,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,qEAAqE;QACrE,OAAO,CAAC,qBAAqB,CAAC;YAC5B,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;SAC9D,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAC9E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC/C,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;QACnD,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrB,yDAAyD;QACzD,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,OAAO,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAC9E,MAAM,MAAM,CAAC,mBAAmB,EAAE,CAAC;QACnC,MAAM,MAAM,CAAC,mBAAmB,EAAE,CAAC;QACnC,MAAM,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,OAAO,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAC9E,MAAM,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IAC/D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/auth/authorize-page.d.ts

@@ -0,0 +1,18 @@
+export interface AuthorizePageParams {
+    clientId: string;
+    clientName?: string;
+    redirectUri: string;
+    state: string;
+    codeChallenge: string;
+    scopes: string;
+    resource: string;
+}
+export declare function renderAuthorizePage(p: AuthorizePageParams): string;
+export interface AuthorizeSubmitFields {
+    apiKey: string;
+    clientId: string;
+    redirectUri: string;
+    state: string;
+    codeChallenge: string;
+}
+export declare function parseAuthorizeSubmit(body: Record<string, unknown>): AuthorizeSubmitFields;

package/dist/auth/authorize-page.js

@@ -0,0 +1,60 @@
+function esc(value) {
+    return value
+        .replace(/&/g, '&')
+        .replace(/"/g, '"')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;');
+}
+function hidden(name, value) {
+    return `<input type="hidden" name="${esc(name)}" value="${esc(value)}">`;
+}
+export function renderAuthorizePage(p) {
+    const appName = p.clientName ? esc(p.clientName) : 'this application';
+    // action is relative so it resolves under the gateway path prefix (/rent2b/authorize/submit)
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Connect rent2b</title>
+<style>
+  body { font-family: system-ui, sans-serif; max-width: 28rem; margin: 4rem auto; padding: 0 1rem; color: #1a1a1a; }
+  h1 { font-size: 1.25rem; } label { display:block; margin: 1rem 0 .25rem; font-weight: 600; }
+  input[type=text] { width: 100%; padding: .6rem; font-size: 1rem; border: 1px solid #bbb; border-radius: .4rem; }
+  button { margin-top: 1.25rem; padding: .6rem 1.2rem; font-size: 1rem; border: 0; border-radius: .4rem; background: #111; color: #fff; cursor: pointer; }
+  p.hint { color: #555; font-size: .85rem; }
+</style>
+</head>
+<body>
+  <h1>Connect ${appName} to rent2b</h1>
+  <p class="hint">Enter your rent2b API key to grant access to your organization's data. Your key starts with <code>r2b_</code>.</p>
+  <form method="post" action="authorize/submit">
+    ${hidden('clientId', p.clientId)}
+    ${hidden('redirectUri', p.redirectUri)}
+    ${hidden('state', p.state)}
+    ${hidden('codeChallenge', p.codeChallenge)}
+    ${hidden('scopes', p.scopes)}
+    ${hidden('resource', p.resource)}
+    <label for="apiKey">rent2b API key</label>
+    <input id="apiKey" name="apiKey" type="text" autocomplete="off" spellcheck="false" placeholder="r2b_..." required>
+    <button type="submit">Authorize</button>
+  </form>
+</body>
+</html>`;
+}
+export function parseAuthorizeSubmit(body) {
+    const str = (k) => {
+        const v = body[k];
+        if (typeof v !== 'string' || v.length === 0)
+            throw new Error(`Missing field: ${k}`);
+        return v;
+    };
+    return {
+        apiKey: str('apiKey'),
+        clientId: str('clientId'),
+        redirectUri: str('redirectUri'),
+        state: typeof body.state === 'string' ? body.state : '',
+        codeChallenge: str('codeChallenge'),
+    };
+}
+//# sourceMappingURL=authorize-page.js.map

package/dist/auth/authorize-page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize-page.js","sourceRoot":"","sources":["../../src/auth/authorize-page.ts"],"names":[],"mappings":"AAUA,SAAS,GAAG,CAAC,KAAa;IACxB,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,MAAM,CAAC,IAAY,EAAE,KAAa;IACzC,OAAO,8BAA8B,GAAG,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,CAAsB;IACxD,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC;IACtE,6FAA6F;IAC7F,OAAO;;;;;;;;;;;;;;;gBAeO,OAAO;;;MAGjB,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC;MAC9B,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,WAAW,CAAC;MACpC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC;MACxB,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,aAAa,CAAC;MACxC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;MAC1B,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC;;;;;;QAM5B,CAAC;AACT,CAAC;AAUD,MAAM,UAAU,oBAAoB,CAAC,IAA6B;IAChE,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE;QAChC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;QACpF,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC;QACrB,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC;QACzB,WAAW,EAAE,GAAG,CAAC,aAAa,CAAC;QAC/B,KAAK,EAAE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QACvD,aAAa,EAAE,GAAG,CAAC,eAAe,CAAC;KACpC,CAAC;AACJ,CAAC"}

package/dist/auth/authorize-page.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/auth/authorize-page.test.js

@@ -0,0 +1,37 @@
+import { describe, it, expect } from 'vitest';
+import { renderAuthorizePage, parseAuthorizeSubmit } from './authorize-page.js';
+describe('renderAuthorizePage', () => {
+    it('embeds params as hidden fields and escapes attributes', () => {
+        const html = renderAuthorizePage({
+            clientId: 'c1',
+            clientName: 'Claude',
+            redirectUri: 'https://claude.ai/cb',
+            state: 'st"ate',
+            codeChallenge: 'CHAL',
+            scopes: '',
+            resource: '',
+        });
+        expect(html).toContain('name="apiKey"');
+        expect(html).toContain('action="authorize/submit"');
+        expect(html).toContain('value="c1"');
+        expect(html).toContain('value="CHAL"');
+        expect(html).toContain('st"ate'); // escaped quote
+    });
+});
+describe('parseAuthorizeSubmit', () => {
+    it('parses a valid body', () => {
+        const fields = parseAuthorizeSubmit({
+            apiKey: 'r2b_x',
+            clientId: 'c1',
+            redirectUri: 'https://claude.ai/cb',
+            state: 's',
+            codeChallenge: 'CHAL',
+        });
+        expect(fields.apiKey).toBe('r2b_x');
+        expect(fields.redirectUri).toBe('https://claude.ai/cb');
+    });
+    it('throws when apiKey is missing', () => {
+        expect(() => parseAuthorizeSubmit({ clientId: 'c1', redirectUri: 'x', codeChallenge: 'y' })).toThrow();
+    });
+});
+//# sourceMappingURL=authorize-page.test.js.map

package/dist/auth/authorize-page.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize-page.test.js","sourceRoot":"","sources":["../../src/auth/authorize-page.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEhF,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,IAAI,GAAG,mBAAmB,CAAC;YAC/B,QAAQ,EAAE,IAAI;YACd,UAAU,EAAE,QAAQ;YACpB,WAAW,EAAE,sBAAsB;YACnC,KAAK,EAAE,QAAQ;YACf,aAAa,EAAE,MAAM;YACrB,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,EAAE;SACb,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,gBAAgB;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,qBAAqB,EAAE,GAAG,EAAE;QAC7B,MAAM,MAAM,GAAG,oBAAoB,CAAC;YAClC,MAAM,EAAE,OAAO;YACf,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,sBAAsB;YACnC,KAAK,EAAE,GAAG;YACV,aAAa,EAAE,MAAM;SACtB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,GAAG,EAAE,CACV,oBAAoB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAC/E,CAAC,OAAO,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/auth/http-oauth.d.ts

@@ -0,0 +1,28 @@
+import { type Express, type RequestHandler } from 'express';
+import type { OAuthRuntimeConfig } from './oauth-config.js';
+import type { Rent2bOAuthProvider } from './provider.js';
+export interface RegisterOAuthOptions {
+    oauthCfg: OAuthRuntimeConfig;
+    provider: Rent2bOAuthProvider;
+    validateKey: (apiKey: string) => Promise<number>;
+}
+/**
+ * Wires the OAuth 2.1 + DCR surface onto an Express app and returns the
+ * bearer-auth middleware to guard the MCP endpoint.
+ *
+ * Note on path-prefixed deployment: the MCP SDK serves the auth handlers at the
+ * origin root (`/authorize`, `/token`, `/register`) and advertises them
+ * origin-level, dropping any issuer path. Behind the gateway, Caddy strips the
+ * `/rent2b` prefix before the container sees these paths, so the handlers line
+ * up — but the SDK's authorization-server metadata would advertise the wrong
+ * (origin-level) URLs. We therefore override that one document with
+ * path-correct endpoint URLs. The SDK's protected-resource metadata is already
+ * correct (it advertises the full issuer URL), so we keep it.
+ */
+export declare function registerOAuth(app: Express, opts: RegisterOAuthOptions): RequestHandler;
+/**
+ * Lets existing clients that authenticate with `X-API-Key: r2b_...` (and no
+ * `Authorization` header) keep working: copies the key into a Bearer header so
+ * `requireBearerAuth` -> `verifyAccessToken`'s raw-key branch accepts it.
+ */
+export declare const xApiKeyToBearer: RequestHandler;

package/dist/auth/http-oauth.js

@@ -0,0 +1,93 @@
+import express from 'express';
+import { mcpAuthRouter, getOAuthProtectedResourceMetadataUrl, } from '@modelcontextprotocol/sdk/server/auth/router.js';
+import { requireBearerAuth } from '@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js';
+import { parseAuthorizeSubmit } from './authorize-page.js';
+/**
+ * Wires the OAuth 2.1 + DCR surface onto an Express app and returns the
+ * bearer-auth middleware to guard the MCP endpoint.
+ *
+ * Note on path-prefixed deployment: the MCP SDK serves the auth handlers at the
+ * origin root (`/authorize`, `/token`, `/register`) and advertises them
+ * origin-level, dropping any issuer path. Behind the gateway, Caddy strips the
+ * `/rent2b` prefix before the container sees these paths, so the handlers line
+ * up — but the SDK's authorization-server metadata would advertise the wrong
+ * (origin-level) URLs. We therefore override that one document with
+ * path-correct endpoint URLs. The SDK's protected-resource metadata is already
+ * correct (it advertises the full issuer URL), so we keep it.
+ */
+export function registerOAuth(app, opts) {
+    const { oauthCfg, provider, validateKey } = opts;
+    const issuerHref = oauthCfg.issuerUrl.href.replace(/\/$/, '');
+    app.use(express.urlencoded({ extended: false }));
+    // Override: path-aware authorization-server metadata (registered before the
+    // SDK router so it shadows the SDK's origin-level document).
+    const authServerMetadata = {
+        issuer: issuerHref,
+        authorization_endpoint: `${issuerHref}/authorize`,
+        token_endpoint: `${issuerHref}/token`,
+        registration_endpoint: `${issuerHref}/register`,
+        response_types_supported: ['code'],
+        grant_types_supported: ['authorization_code', 'refresh_token'],
+        code_challenge_methods_supported: ['S256'],
+        token_endpoint_auth_methods_supported: ['client_secret_post', 'none'],
+        scopes_supported: [],
+    };
+    app.get('/.well-known/oauth-authorization-server', (_req, res) => {
+        res.json(authServerMetadata);
+    });
+    app.use(mcpAuthRouter({
+        provider,
+        issuerUrl: oauthCfg.issuerUrl,
+        baseUrl: oauthCfg.issuerUrl,
+        resourceServerUrl: oauthCfg.resourceUrl,
+        scopesSupported: [],
+    }));
+    // The API-key entry page (provider.authorize) posts here.
+    app.post('/authorize/submit', async (req, res) => {
+        let fields;
+        try {
+            fields = parseAuthorizeSubmit(req.body);
+        }
+        catch {
+            res.status(400).send('Missing required fields');
+            return;
+        }
+        let orgId;
+        try {
+            orgId = await validateKey(fields.apiKey);
+        }
+        catch {
+            res.status(401).setHeader('Content-Type', 'text/html; charset=utf-8');
+            res.send('<p>Invalid rent2b API key. <a href="javascript:history.back()">Try again</a>.</p>');
+            return;
+        }
+        const code = provider.issueAuthCode({
+            apiKey: fields.apiKey,
+            orgId,
+            codeChallenge: fields.codeChallenge,
+            redirectUri: fields.redirectUri,
+            clientId: fields.clientId,
+        });
+        const redirect = new URL(fields.redirectUri);
+        redirect.searchParams.set('code', code);
+        if (fields.state)
+            redirect.searchParams.set('state', fields.state);
+        res.redirect(302, redirect.toString());
+    });
+    return requireBearerAuth({
+        verifier: provider,
+        resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(oauthCfg.resourceUrl),
+    });
+}
+/**
+ * Lets existing clients that authenticate with `X-API-Key: r2b_...` (and no
+ * `Authorization` header) keep working: copies the key into a Bearer header so
+ * `requireBearerAuth` -> `verifyAccessToken`'s raw-key branch accepts it.
+ */
+export const xApiKeyToBearer = (req, _res, next) => {
+    if (!req.headers['authorization'] && typeof req.headers['x-api-key'] === 'string') {
+        req.headers['authorization'] = `Bearer ${req.headers['x-api-key']}`;
+    }
+    next();
+};
+//# sourceMappingURL=http-oauth.js.map

package/dist/auth/http-oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-oauth.js","sourceRoot":"","sources":["../../src/auth/http-oauth.ts"],"names":[],"mappings":"AAAA,OAAO,OAA8C,MAAM,SAAS,CAAC;AACrE,OAAO,EACL,aAAa,EACb,oCAAoC,GACrC,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gEAAgE,CAAC;AAGnG,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAQ3D;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa,CAAC,GAAY,EAAE,IAA0B;IACpE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IACjD,MAAM,UAAU,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAE9D,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAEjD,4EAA4E;IAC5E,6DAA6D;IAC7D,MAAM,kBAAkB,GAAG;QACzB,MAAM,EAAE,UAAU;QAClB,sBAAsB,EAAE,GAAG,UAAU,YAAY;QACjD,cAAc,EAAE,GAAG,UAAU,QAAQ;QACrC,qBAAqB,EAAE,GAAG,UAAU,WAAW;QAC/C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC9D,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,qCAAqC,EAAE,CAAC,oBAAoB,EAAE,MAAM,CAAC;QACrE,gBAAgB,EAAE,EAAE;KACrB,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,yCAAyC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC/D,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CACL,aAAa,CAAC;QACZ,QAAQ;QACR,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,OAAO,EAAE,QAAQ,CAAC,SAAS;QAC3B,iBAAiB,EAAE,QAAQ,CAAC,WAAW;QACvC,eAAe,EAAE,EAAE;KACpB,CAAC,CACH,CAAC;IAEF,0DAA0D;IAC1D,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/C,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,IAA+B,CAAC,CAAC;QACrE,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QACD,IAAI,KAAa,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;YACtE,GAAG,CAAC,IAAI,CACN,mFAAmF,CACpF,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,CAAC;YAClC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK;YACL,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC7C,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,KAAK;YAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACnE,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,OAAO,iBAAiB,CAAC;QACvB,QAAQ,EAAE,QAAQ;QAClB,mBAAmB,EAAE,oCAAoC,CAAC,QAAQ,CAAC,WAAW,CAAC;KAChF,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAmB,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;IACjE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,QAAQ,EAAE,CAAC;QAClF,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;IACtE,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC,CAAC"}

package/dist/auth/oauth-config.d.ts

@@ -0,0 +1,6 @@
+export interface OAuthRuntimeConfig {
+    issuerUrl: URL;
+    resourceUrl: URL;
+    encryptionKey: Buffer;
+}
+export declare function loadOAuthConfig(env?: NodeJS.ProcessEnv): OAuthRuntimeConfig;

package/dist/auth/oauth-config.js

@@ -0,0 +1,16 @@
+export function loadOAuthConfig(env = process.env) {
+    const issuer = env.OAUTH_ISSUER_URL;
+    if (!issuer)
+        throw new Error('OAUTH_ISSUER_URL is required to enable OAuth');
+    const issuerUrl = new URL(issuer);
+    const resourceUrl = new URL(issuerUrl.href.replace(/\/$/, '') + '/mcp');
+    const rawKey = env.OAUTH_ENCRYPTION_KEY;
+    if (!rawKey)
+        throw new Error('OAUTH_ENCRYPTION_KEY is required to enable OAuth');
+    const encryptionKey = Buffer.from(rawKey, 'base64');
+    if (encryptionKey.length !== 32) {
+        throw new Error('OAUTH_ENCRYPTION_KEY must decode (base64) to exactly 32 bytes');
+    }
+    return { issuerUrl, resourceUrl, encryptionKey };
+}
+//# sourceMappingURL=oauth-config.js.map

package/dist/auth/oauth-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-config.js","sourceRoot":"","sources":["../../src/auth/oauth-config.ts"],"names":[],"mappings":"AAMA,MAAM,UAAU,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,MAAM,MAAM,GAAG,GAAG,CAAC,gBAAgB,CAAC;IACpC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAC7E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAElC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC;IAExE,MAAM,MAAM,GAAG,GAAG,CAAC,oBAAoB,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACjF,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACpD,IAAI,aAAa,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;AACnD,CAAC"}

package/dist/auth/oauth-config.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/auth/oauth-config.test.js

@@ -0,0 +1,25 @@
+import { describe, it, expect } from 'vitest';
+import { randomBytes } from 'node:crypto';
+import { loadOAuthConfig } from './oauth-config.js';
+const key = randomBytes(32).toString('base64');
+describe('loadOAuthConfig', () => {
+    it('loads issuer, derives resource, decodes key', () => {
+        const cfg = loadOAuthConfig({
+            OAUTH_ISSUER_URL: 'https://mcp.honeyfield.at/rent2b',
+            OAUTH_ENCRYPTION_KEY: key,
+        });
+        expect(cfg.issuerUrl.href).toBe('https://mcp.honeyfield.at/rent2b');
+        expect(cfg.resourceUrl.href).toBe('https://mcp.honeyfield.at/rent2b/mcp');
+        expect(cfg.encryptionKey.length).toBe(32);
+    });
+    it('throws when issuer missing', () => {
+        expect(() => loadOAuthConfig({ OAUTH_ENCRYPTION_KEY: key })).toThrow();
+    });
+    it('throws when key is not 32 bytes', () => {
+        expect(() => loadOAuthConfig({
+            OAUTH_ISSUER_URL: 'https://x/rent2b',
+            OAUTH_ENCRYPTION_KEY: 'c2hvcnQ=',
+        })).toThrow();
+    });
+});
+//# sourceMappingURL=oauth-config.test.js.map

package/dist/auth/oauth-config.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-config.test.js","sourceRoot":"","sources":["../../src/auth/oauth-config.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAE/C,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,GAAG,GAAG,eAAe,CAAC;YAC1B,gBAAgB,EAAE,kCAAkC;YACpD,oBAAoB,EAAE,GAAG;SACnB,CAAC,CAAC;QACV,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QACpE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;QAC1E,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,oBAAoB,EAAE,GAAG,EAAS,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,GAAG,EAAE,CACV,eAAe,CAAC;YACd,gBAAgB,EAAE,kBAAkB;YACpC,oBAAoB,EAAE,UAAU;SAC1B,CAAC,CACV,CAAC,OAAO,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/auth/provider.d.ts

@@ -0,0 +1,28 @@
+import type { Response } from 'express';
+import type { OAuthServerProvider, AuthorizationParams } from '@modelcontextprotocol/sdk/server/auth/provider.js';
+import type { OAuthClientInformationFull, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
+import type { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types.js';
+import type { TokenCodec } from './token-crypto.js';
+import type { InMemoryClientsStore, AuthCodeStore, AuthCodeRecord } from './stores.js';
+export interface ProviderOptions {
+    codec: TokenCodec;
+    clientsStore: InMemoryClientsStore;
+    codeStore: AuthCodeStore;
+    validateKey: (apiKey: string) => Promise<number>;
+    accessTtlSec?: number;
+    refreshTtlSec?: number;
+}
+export declare class Rent2bOAuthProvider implements OAuthServerProvider {
+    private readonly opts;
+    private readonly pending;
+    constructor(opts: ProviderOptions);
+    get clientsStore(): InMemoryClientsStore;
+    /** Called by the /authorize/submit handler after a valid r2b_ key is entered. */
+    issueAuthCode(input: Omit<AuthCodeRecord, 'expiresAt'>): string;
+    authorize(client: OAuthClientInformationFull, params: AuthorizationParams, res: Response): Promise<void>;
+    challengeForAuthorizationCode(_client: OAuthClientInformationFull, authorizationCode: string): Promise<string>;
+    exchangeAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string, _codeVerifier?: string, _redirectUri?: string): Promise<OAuthTokens>;
+    exchangeRefreshToken(client: OAuthClientInformationFull, refreshToken: string, _scopes?: string[]): Promise<OAuthTokens>;
+    verifyAccessToken(token: string): Promise<AuthInfo>;
+    private mintTokens;
+}

package/dist/auth/provider.js

@@ -0,0 +1,127 @@
+import { randomUUID } from 'node:crypto';
+import { TokenError } from './token-crypto.js';
+import { renderAuthorizePage } from './authorize-page.js';
+export class Rent2bOAuthProvider {
+    opts;
+    // Holds the code record between challengeForAuthorizationCode (peek) and
+    // exchangeAuthorizationCode (consume), since the code store is one-time.
+    pending = new Map();
+    constructor(opts) {
+        this.opts = { accessTtlSec: 3600, refreshTtlSec: 60 * 60 * 24 * 30, ...opts };
+    }
+    get clientsStore() {
+        return this.opts.clientsStore;
+    }
+    /** Called by the /authorize/submit handler after a valid r2b_ key is entered. */
+    issueAuthCode(input) {
+        return this.opts.codeStore.create(input);
+    }
+    async authorize(client, params, res) {
+        res.setHeader('Content-Type', 'text/html; charset=utf-8');
+        res.send(renderAuthorizePage({
+            clientId: client.client_id,
+            clientName: client.client_name,
+            redirectUri: params.redirectUri,
+            state: params.state ?? '',
+            codeChallenge: params.codeChallenge,
+            scopes: (params.scopes ?? []).join(' '),
+            resource: params.resource ? String(params.resource) : '',
+        }));
+    }
+    async challengeForAuthorizationCode(_client, authorizationCode) {
+        let rec = this.pending.get(authorizationCode);
+        if (!rec) {
+            const taken = this.opts.codeStore.take(authorizationCode);
+            if (!taken)
+                throw new Error('Invalid or expired authorization code');
+            this.pending.set(authorizationCode, taken);
+            rec = taken;
+        }
+        return rec.codeChallenge;
+    }
+    async exchangeAuthorizationCode(client, authorizationCode, _codeVerifier, _redirectUri) {
+        let rec = this.pending.get(authorizationCode);
+        if (rec) {
+            this.pending.delete(authorizationCode);
+        }
+        else {
+            rec = this.opts.codeStore.take(authorizationCode);
+        }
+        if (!rec)
+            throw new Error('Invalid or expired authorization code');
+        if (rec.clientId !== client.client_id) {
+            throw new Error('Authorization code was issued to a different client');
+        }
+        return this.mintTokens(rec.apiKey, rec.orgId, client.client_id);
+    }
+    async exchangeRefreshToken(client, refreshToken, _scopes) {
+        let payload;
+        try {
+            payload = this.opts.codec.decrypt(refreshToken);
+        }
+        catch {
+            throw new Error('Invalid refresh token');
+        }
+        if (payload.type !== 'refresh')
+            throw new Error('Not a refresh token');
+        return this.mintTokens(payload.apiKey, payload.orgId, client.client_id);
+    }
+    async verifyAccessToken(token) {
+        if (token.startsWith('r2b_')) {
+            // Backward-compat: a raw rent2b API key used directly as the bearer.
+            // requireBearerAuth requires an expiry; raw keys don't expire, so we set
+            // a short rolling window (the key is re-validated on each new session).
+            const orgId = await this.opts.validateKey(token);
+            return {
+                token,
+                clientId: 'rent2b-direct',
+                scopes: [],
+                expiresAt: Math.floor(Date.now() / 1000) + this.opts.accessTtlSec,
+                extra: { apiKey: token, orgId },
+            };
+        }
+        let payload;
+        try {
+            payload = this.opts.codec.decrypt(token);
+        }
+        catch (err) {
+            if (err instanceof TokenError)
+                throw new Error('Invalid or expired access token');
+            throw err;
+        }
+        if (payload.type !== 'access')
+            throw new Error('Not an access token');
+        return {
+            token,
+            clientId: 'rent2b-oauth',
+            scopes: [],
+            expiresAt: payload.exp,
+            extra: { apiKey: payload.apiKey, orgId: payload.orgId },
+        };
+    }
+    mintTokens(apiKey, orgId, _clientId) {
+        const now = Math.floor(Date.now() / 1000);
+        const access = this.opts.codec.encrypt({
+            apiKey,
+            orgId,
+            type: 'access',
+            exp: now + this.opts.accessTtlSec,
+            jti: randomUUID(),
+        });
+        const refresh = this.opts.codec.encrypt({
+            apiKey,
+            orgId,
+            type: 'refresh',
+            exp: now + this.opts.refreshTtlSec,
+            jti: randomUUID(),
+        });
+        return {
+            access_token: access,
+            token_type: 'Bearer',
+            expires_in: this.opts.accessTtlSec,
+            refresh_token: refresh,
+            scope: '',
+        };
+    }
+}
+//# sourceMappingURL=provider.js.map

package/dist/auth/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../src/auth/provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAYzC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAW1D,MAAM,OAAO,mBAAmB;IACb,IAAI,CAGH;IAClB,yEAAyE;IACzE,yEAAyE;IACxD,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAE7D,YAAY,IAAqB;QAC/B,IAAI,CAAC,IAAI,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC;IAChF,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;IAChC,CAAC;IAED,iFAAiF;IACjF,aAAa,CAAC,KAAwC;QACpD,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,SAAS,CACb,MAAkC,EAClC,MAA2B,EAC3B,GAAa;QAEb,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;QAC1D,GAAG,CAAC,IAAI,CACN,mBAAmB,CAAC;YAClB,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,UAAU,EAAE,MAAM,CAAC,WAAW;YAC9B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE;YACzB,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACvC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;SACzD,CAAC,CACH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,6BAA6B,CACjC,OAAmC,EACnC,iBAAyB;QAEzB,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC9C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC1D,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YACrE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;YAC3C,GAAG,GAAG,KAAK,CAAC;QACd,CAAC;QACD,OAAO,GAAG,CAAC,aAAa,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,yBAAyB,CAC7B,MAAkC,EAClC,iBAAyB,EACzB,aAAsB,EACtB,YAAqB;QAErB,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC9C,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACnE,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,MAAkC,EAClC,YAAoB,EACpB,OAAkB;QAElB,IAAI,OAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1E,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,qEAAqE;YACrE,yEAAyE;YACzE,wEAAwE;YACxE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACjD,OAAO;gBACL,KAAK;gBACL,QAAQ,EAAE,eAAe;gBACzB,MAAM,EAAE,EAAE;gBACV,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY;gBACjE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE;aAChC,CAAC;QACJ,CAAC;QACD,IAAI,OAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YAClF,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACtE,OAAO;YACL,KAAK;YACL,QAAQ,EAAE,cAAc;YACxB,MAAM,EAAE,EAAE;YACV,SAAS,EAAE,OAAO,CAAC,GAAG;YACtB,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE;SACxD,CAAC;IACJ,CAAC;IAEO,UAAU,CAAC,MAAc,EAAE,KAAa,EAAE,SAAiB;QACjE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;YACrC,MAAM;YACN,KAAK;YACL,IAAI,EAAE,QAAQ;YACd,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY;YACjC,GAAG,EAAE,UAAU,EAAE;SAClB,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;YACtC,MAAM;YACN,KAAK;YACL,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa;YAClC,GAAG,EAAE,UAAU,EAAE;SAClB,CAAC,CAAC;QACH,OAAO;YACL,YAAY,EAAE,MAAM;YACpB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY;YAClC,aAAa,EAAE,OAAO;YACtB,KAAK,EAAE,EAAE;SACV,CAAC;IACJ,CAAC;CACF"}

package/dist/auth/provider.test.d.ts

@@ -0,0 +1 @@
+export {};