@honeyfield/rent2b-mcp 1.2.2 → 1.3.0

package/dist/api-client.js

@@ -6,26 +6,42 @@ export class Rent2bApiClient {
     constructor(config) {
         this.config = config;
         // Reuse an org already resolved by the auth layer to avoid a redundant
-        // GET /zapier/me on every request.
+        // lookup on every request.
         if (config.organizationId != null) {
             this.organizationId = config.organizationId;
         }
+        const headers = { 'Content-Type': 'application/json' };
+        // JWT mode (user logged in via OAuth) authenticates as the user so RLS
+        // applies; key mode keeps the X-API-Key path for stdio/scripting.
+        if (config.accessToken) {
+            headers['Authorization'] = `Bearer ${config.accessToken}`;
+        }
+        else if (config.apiKey) {
+            headers['X-API-Key'] = config.apiKey;
+        }
         this.client = axios.create({
             baseURL: config.apiUrl,
-            headers: {
-                'X-API-Key': config.apiKey,
-                'Content-Type': 'application/json',
-            },
+            headers,
             timeout: 30_000,
         });
     }
     async resolveOrganization() {
         if (this.organizationId)
             return this.organizationId;
-        // Resolve the organization bound to THIS API key. `GET /organizations` is
-        // NOT key-scoped (it returns every organization in the system, ordered with
-        // org 1 first), so taking [0] picked the wrong org for multi-tenant keys.
-        // `GET /zapier/me` is key-scoped and returns the authenticated key's org.
+        if (this.config.accessToken) {
+            // JWT mode: `GET /settings` is user-scoped (RLS) and returns the caller's
+            // organization. (`/zapier/me` is API-key-only.)
+            const response = await this.client.get('/settings');
+            const orgId = response.data?.organization?.id;
+            if (typeof orgId !== 'number') {
+                throw new Error('Could not resolve organization for this account');
+            }
+            this.organizationId = orgId;
+            return this.organizationId;
+        }
+        // Key mode: `GET /organizations` is NOT key-scoped (it returns every
+        // organization, org 1 first), so taking [0] picked the wrong org. `GET
+        // /zapier/me` is key-scoped and returns the authenticated key's org.
         const response = await this.client.get('/zapier/me');
         const orgId = response.data?.organization?.id ?? response.data?.id;
         if (typeof orgId !== 'number') {

package/dist/api-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAiB,UAAU,EAAE,MAAM,OAAO,CAAC;AAczD,MAAM,OAAO,eAAe;IAIN;IAHZ,MAAM,CAAgB;IACtB,cAAc,GAAkB,IAAI,CAAC;IAE7C,YAAoB,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;QAChC,uEAAuE;QACvE,mCAAmC;QACnC,IAAI,MAAM,CAAC,cAAc,IAAI,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;YACzB,OAAO,EAAE,MAAM,CAAC,MAAM;YACtB,OAAO,EAAE;gBACP,WAAW,EAAE,MAAM,CAAC,MAAM;gBAC1B,cAAc,EAAE,kBAAkB;aACnC;YACD,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB;QACvB,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC,cAAc,CAAC;QAEpD,0EAA0E;QAC1E,4EAA4E;QAC5E,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACrD,MAAM,KAAK,GAAY,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAE5E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC;QAC5B,OAAO,IAAI,CAAC,cAAe,CAAC;IAC9B,CAAC;IAED,iBAAiB;QACf,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,OAAO,CACX,MAAmD,EACnD,IAAY,EACZ,IAAc,EACd,MAAgC;QAEhC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAC/B,kBAAkB,EAClB,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,CACjC,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAI;gBAC5C,MAAM;gBACN,GAAG,EAAE,YAAY;gBACjB,IAAI;gBACJ,MAAM;aACP,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,UAAU,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAClD,MAAM,QAAQ,GAAa;oBACzB,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,IAAI,KAAK,CAAC,OAAO;oBACtD,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;oBACjC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;iBAC7B,CAAC;gBACF,MAAM,QAAQ,CAAC;YACjB,CAAC;YACD,MAAM;gBACJ,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;gBACjE,UAAU,EAAE,CAAC;gBACb,OAAO,EAAE,IAAI;aACF,CAAC;QAChB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAc,IAAY,EAAE,MAAgC;QACnE,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,IAAI,CAAc,IAAY,EAAE,IAAc;QAClD,OAAO,IAAI,CAAC,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,KAAK,CAAc,IAAY,EAAE,IAAc;QACnD,OAAO,IAAI,CAAC,OAAO,CAAI,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,GAAG,CAAc,IAAY,EAAE,IAAc;QACjD,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,MAAM,CAAc,IAAY;QACpC,OAAO,IAAI,CAAC,OAAO,CAAI,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;CACF"}
+{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAiB,UAAU,EAAE,MAAM,OAAO,CAAC;AAczD,MAAM,OAAO,eAAe;IAIN;IAHZ,MAAM,CAAgB;IACtB,cAAc,GAAkB,IAAI,CAAC;IAE7C,YAAoB,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;QAChC,uEAAuE;QACvE,2BAA2B;QAC3B,IAAI,MAAM,CAAC,cAAc,IAAI,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QAC9C,CAAC;QACD,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;QAC/E,uEAAuE;QACvE,kEAAkE;QAClE,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,MAAM,CAAC,WAAW,EAAE,CAAC;QAC5D,CAAC;aAAM,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACzB,OAAO,CAAC,WAAW,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;QACvC,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;YACzB,OAAO,EAAE,MAAM,CAAC,MAAM;YACtB,OAAO;YACP,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB;QACvB,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC,cAAc,CAAC;QAEpD,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC5B,0EAA0E;YAC1E,gDAAgD;YAChD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACpD,MAAM,KAAK,GAAY,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,CAAC;YACvD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACrE,CAAC;YACD,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC;YAC5B,OAAO,IAAI,CAAC,cAAe,CAAC;QAC9B,CAAC;QAED,qEAAqE;QACrE,uEAAuE;QACvE,qEAAqE;QACrE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACrD,MAAM,KAAK,GAAY,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAE5E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC;QAC5B,OAAO,IAAI,CAAC,cAAe,CAAC;IAC9B,CAAC;IAED,iBAAiB;QACf,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,OAAO,CACX,MAAmD,EACnD,IAAY,EACZ,IAAc,EACd,MAAgC;QAEhC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAC/B,kBAAkB,EAClB,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,CACjC,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAI;gBAC5C,MAAM;gBACN,GAAG,EAAE,YAAY;gBACjB,IAAI;gBACJ,MAAM;aACP,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,UAAU,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAClD,MAAM,QAAQ,GAAa;oBACzB,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,IAAI,KAAK,CAAC,OAAO;oBACtD,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;oBACjC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;iBAC7B,CAAC;gBACF,MAAM,QAAQ,CAAC;YACjB,CAAC;YACD,MAAM;gBACJ,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;gBACjE,UAAU,EAAE,CAAC;gBACb,OAAO,EAAE,IAAI;aACF,CAAC;QAChB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAc,IAAY,EAAE,MAAgC;QACnE,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,IAAI,CAAc,IAAY,EAAE,IAAc;QAClD,OAAO,IAAI,CAAC,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,KAAK,CAAc,IAAY,EAAE,IAAc;QACnD,OAAO,IAAI,CAAC,OAAO,CAAI,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,GAAG,CAAc,IAAY,EAAE,IAAc;QACjD,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,MAAM,CAAc,IAAY;QACpC,OAAO,IAAI,CAAC,OAAO,CAAI,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;CACF"}

package/dist/auth/api-auth.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Thin client for the rent2b-api auth surface, used by the OAuth layer to log a
+ * user in (Supabase session) instead of requiring a pasted `r2b_` API key.
+ *
+ * The MCP never talks to Supabase directly — it goes through the existing
+ * rent2b-api endpoints (`POST /auth/signin`, `POST /auth/refresh`,
+ * `GET /auth/{provider}`), so all Supabase config stays server-side in the API.
+ */
+export interface SupabaseSession {
+    access_token: string;
+    refresh_token: string;
+}
+export interface LoginResult {
+    session: SupabaseSession;
+    /** Resolved from the signin response when present, else looked up later. */
+    orgId: number | null;
+}
+export declare class ApiAuthClient {
+    private readonly http;
+    constructor(apiUrl: string);
+    /** Email + password → Supabase session (+ org if the response carries it). */
+    signInWithPassword(email: string, password: string): Promise<LoginResult>;
+    /** Exchange a (rotating) Supabase refresh token for a fresh session. */
+    refreshSession(refreshToken: string): Promise<SupabaseSession>;
+    /** Returns the provider's hosted login URL to redirect the browser to. */
+    getSocialUrl(provider: 'google' | 'apple', redirectTo: string): Promise<string>;
+    /** Resolve the caller's organization id from a Supabase access token. */
+    resolveOrg(accessToken: string): Promise<number>;
+}

package/dist/auth/api-auth.js

@@ -0,0 +1,88 @@
+import axios, { AxiosError } from 'axios';
+function coerceSession(raw) {
+    if (!raw ||
+        typeof raw.access_token !== 'string' ||
+        typeof raw.refresh_token !== 'string') {
+        throw new Error('Auth response did not contain a usable session');
+    }
+    return { access_token: raw.access_token, refresh_token: raw.refresh_token };
+}
+function orgIdFrom(data) {
+    const org = data?.organization;
+    return typeof org?.id === 'number' ? org.id : null;
+}
+export class ApiAuthClient {
+    http;
+    constructor(apiUrl) {
+        this.http = axios.create({
+            baseURL: apiUrl,
+            headers: { 'Content-Type': 'application/json' },
+            timeout: 15_000,
+        });
+    }
+    /** Email + password → Supabase session (+ org if the response carries it). */
+    async signInWithPassword(email, password) {
+        try {
+            const res = await this.http.post('/auth/signin', { email, password });
+            return {
+                session: coerceSession(res.data?.session),
+                orgId: orgIdFrom(res.data),
+            };
+        }
+        catch (err) {
+            throw toAuthError(err, 'Invalid email or password');
+        }
+    }
+    /** Exchange a (rotating) Supabase refresh token for a fresh session. */
+    async refreshSession(refreshToken) {
+        try {
+            const res = await this.http.post('/auth/refresh', {
+                refresh_token: refreshToken,
+            });
+            return coerceSession(res.data?.session);
+        }
+        catch (err) {
+            throw toAuthError(err, 'Session expired, please reconnect');
+        }
+    }
+    /** Returns the provider's hosted login URL to redirect the browser to. */
+    async getSocialUrl(provider, redirectTo) {
+        try {
+            const res = await this.http.get(`/auth/${provider}`, {
+                params: { redirectTo },
+            });
+            const url = res.data?.url;
+            if (typeof url !== 'string')
+                throw new Error('No url in response');
+            return url;
+        }
+        catch (err) {
+            throw toAuthError(err, `Could not start ${provider} sign-in`);
+        }
+    }
+    /** Resolve the caller's organization id from a Supabase access token. */
+    async resolveOrg(accessToken) {
+        try {
+            const res = await this.http.get('/settings', {
+                headers: { Authorization: `Bearer ${accessToken}` },
+            });
+            const id = orgIdFrom(res.data);
+            if (typeof id !== 'number') {
+                throw new Error('No organization for this account');
+            }
+            return id;
+        }
+        catch (err) {
+            throw toAuthError(err, 'Could not resolve organization for this account');
+        }
+    }
+}
+function toAuthError(err, fallback) {
+    if (err instanceof AxiosError && err.response) {
+        const msg = err.response.data?.message ??
+            fallback;
+        return new Error(typeof msg === 'string' ? msg : fallback);
+    }
+    return new Error(err instanceof Error ? err.message : fallback);
+}
+//# sourceMappingURL=api-auth.js.map

package/dist/auth/api-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-auth.js","sourceRoot":"","sources":["../../src/auth/api-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAiB,UAAU,EAAE,MAAM,OAAO,CAAC;AA2BzD,SAAS,aAAa,CAAC,GAAkC;IACvD,IACE,CAAC,GAAG;QACJ,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ;QACpC,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,EACrC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC;AAC9E,CAAC;AAED,SAAS,SAAS,CAAC,IAAa;IAC9B,MAAM,GAAG,GAAI,IAAmD,EAAE,YAAY,CAAC;IAC/E,OAAO,OAAO,GAAG,EAAE,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC;AAED,MAAM,OAAO,aAAa;IACP,IAAI,CAAgB;IAErC,YAAY,MAAc;QACxB,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC;YACvB,OAAO,EAAE,MAAM;YACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,kBAAkB,CAAC,KAAa,EAAE,QAAgB;QACtD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YACtE,OAAO;gBACL,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,OAAqB,CAAC;gBACvD,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;aAC3B,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,WAAW,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,cAAc,CAAC,YAAoB;QACvC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE;gBAChD,aAAa,EAAE,YAAY;aAC5B,CAAC,CAAC;YACH,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,OAAqB,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,WAAW,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,YAAY,CAChB,QAA4B,EAC5B,UAAkB;QAElB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,QAAQ,EAAE,EAAE;gBACnD,MAAM,EAAE,EAAE,UAAU,EAAE;aACvB,CAAC,CAAC;YACH,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC;YAC1B,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACnE,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,WAAW,CAAC,GAAG,EAAE,mBAAmB,QAAQ,UAAU,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,UAAU,CAAC,WAAmB;QAClC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE;gBAC3C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;aACpD,CAAC,CAAC;YACH,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACtD,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,WAAW,CAAC,GAAG,EAAE,iDAAiD,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;CACF;AAED,SAAS,WAAW,CAAC,GAAY,EAAE,QAAgB;IACjD,IAAI,GAAG,YAAY,UAAU,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9C,MAAM,GAAG,GACN,GAAG,CAAC,QAAQ,CAAC,IAA0C,EAAE,OAAO;YACjE,QAAQ,CAAC;QACX,OAAO,IAAI,KAAK,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AAClE,CAAC"}

package/dist/auth/authorize-page.d.ts

@@ -7,12 +7,33 @@ export interface AuthorizePageParams {
     scopes: string;
     resource: string;
 }
-export declare function renderAuthorizePage(p: AuthorizePageParams): string;
-export interface AuthorizeSubmitFields {
-    apiKey: string;
+export declare function renderAuthorizePage(p: AuthorizePageParams, errorMessage?: string, showSocial?: boolean): string;
+/**
+ * Page shown after the social provider redirects back. The Supabase session
+ * arrives in the URL fragment (`#access_token=…&refresh_token=…`), which is only
+ * readable client-side, so this tiny script lifts it out and re-submits it (with
+ * the preserved OAuth-flow fields) to /authorize/submit as a normal form post.
+ */
+export declare function renderSocialCallbackPage(params: Record<string, string>): string;
+interface FlowFields {
     clientId: string;
     redirectUri: string;
     state: string;
     codeChallenge: string;
 }
+export type AuthorizeSubmitFields = ({
+    mode: 'password';
+    email: string;
+    password: string;
+} & FlowFields) | ({
+    mode: 'session';
+    accessToken: string;
+    refreshToken: string;
+} & FlowFields);
 export declare function parseAuthorizeSubmit(body: Record<string, unknown>): AuthorizeSubmitFields;
+/** Validate + extract the OAuth-flow fields for the /authorize/social handler. */
+export declare function parseSocialStart(query: Record<string, unknown>): {
+    provider: 'google' | 'apple';
+    flow: Record<string, string>;
+};
+export {};

package/dist/auth/authorize-page.js

@@ -8,40 +8,103 @@ function esc(value) {
 function hidden(name, value) {
     return `<input type="hidden" name="${esc(name)}" value="${esc(value)}">`;
 }
-export function renderAuthorizePage(p) {
+/** The OAuth-flow fields that must survive the login (form post or social round-trip). */
+const FLOW_FIELDS = [
+    'clientId',
+    'redirectUri',
+    'state',
+    'codeChallenge',
+    'scopes',
+    'resource',
+];
+function flowQuery(p) {
+    const q = new URLSearchParams();
+    for (const k of FLOW_FIELDS)
+        q.set(k, p[k] ?? '');
+    return q.toString();
+}
+const STYLE = `
+  body { font-family: system-ui, sans-serif; max-width: 26rem; margin: 3.5rem auto; padding: 0 1rem; color: #1a1a1a; }
+  h1 { font-size: 1.25rem; } label { display:block; margin: .9rem 0 .25rem; font-weight: 600; }
+  input { width: 100%; padding: .6rem; font-size: 1rem; border: 1px solid #bbb; border-radius: .4rem; box-sizing: border-box; }
+  button { margin-top: 1.1rem; width: 100%; padding: .65rem 1.2rem; font-size: 1rem; border: 0; border-radius: .4rem; background: #111; color: #fff; cursor: pointer; }
+  .sso { display:block; text-align:center; margin-top:.6rem; padding:.6rem; border:1px solid #ccc; border-radius:.4rem; text-decoration:none; color:#111; background:#fff; }
+  .divider { text-align:center; color:#999; margin:1.2rem 0 .4rem; font-size:.8rem; }
+  p.hint { color: #555; font-size: .85rem; } .err { color:#b00020; font-size:.9rem; margin:.5rem 0; }
+`;
+export function renderAuthorizePage(p, errorMessage, showSocial = false) {
     const appName = p.clientName ? esc(p.clientName) : 'this application';
-    // action is relative so it resolves under the gateway path prefix (/rent2b/authorize/submit)
+    const q = esc(flowQuery(p));
+    const err = errorMessage ? `<p class="err">${esc(errorMessage)}</p>` : '';
+    // Social login depends on the API returning a fragment-based session; gated
+    // off until that path is verified (see RENT2B_MCP_SOCIAL_LOGIN).
+    const social = showSocial
+        ? `<div class="divider">or</div>
+  <a class="sso" href="authorize/social?provider=google&amp;${q}">Continue with Google</a>
+  <a class="sso" href="authorize/social?provider=apple&amp;${q}">Continue with Apple</a>`
+        : '';
+    // action/href are relative so they resolve under the gateway path prefix
+    // (/rent2b/authorize/submit, /rent2b/authorize/social).
     return `<!doctype html>
 <html lang="en">
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
-<title>Connect rent2b</title>
-<style>
-  body { font-family: system-ui, sans-serif; max-width: 28rem; margin: 4rem auto; padding: 0 1rem; color: #1a1a1a; }
-  h1 { font-size: 1.25rem; } label { display:block; margin: 1rem 0 .25rem; font-weight: 600; }
-  input[type=text] { width: 100%; padding: .6rem; font-size: 1rem; border: 1px solid #bbb; border-radius: .4rem; }
-  button { margin-top: 1.25rem; padding: .6rem 1.2rem; font-size: 1rem; border: 0; border-radius: .4rem; background: #111; color: #fff; cursor: pointer; }
-  p.hint { color: #555; font-size: .85rem; }
-</style>
+<title>Sign in to rent2b</title>
+<style>${STYLE}</style>
 </head>
 <body>
-  <h1>Connect ${appName} to rent2b</h1>
-  <p class="hint">Enter your rent2b API key to grant access to your organization's data. Your key starts with <code>r2b_</code>.</p>
+  <h1>Sign in to connect ${appName}</h1>
+  <p class="hint">Use your rent2b account to grant access to your organization's data.</p>
+  ${err}
   <form method="post" action="authorize/submit">
-    ${hidden('clientId', p.clientId)}
-    ${hidden('redirectUri', p.redirectUri)}
-    ${hidden('state', p.state)}
-    ${hidden('codeChallenge', p.codeChallenge)}
-    ${hidden('scopes', p.scopes)}
-    ${hidden('resource', p.resource)}
-    <label for="apiKey">rent2b API key</label>
-    <input id="apiKey" name="apiKey" type="text" autocomplete="off" spellcheck="false" placeholder="r2b_..." required>
-    <button type="submit">Authorize</button>
+    ${FLOW_FIELDS.map((k) => hidden(k, p[k] ?? '')).join('\n    ')}
+    <label for="email">Email</label>
+    <input id="email" name="email" type="email" autocomplete="username" required>
+    <label for="password">Password</label>
+    <input id="password" name="password" type="password" autocomplete="current-password" required>
+    <button type="submit">Sign in</button>
   </form>
+  ${social}
 </body>
 </html>`;
 }
+/**
+ * Page shown after the social provider redirects back. The Supabase session
+ * arrives in the URL fragment (`#access_token=…&refresh_token=…`), which is only
+ * readable client-side, so this tiny script lifts it out and re-submits it (with
+ * the preserved OAuth-flow fields) to /authorize/submit as a normal form post.
+ */
+export function renderSocialCallbackPage(params) {
+    const fields = Object.entries(params)
+        .map(([k, v]) => hidden(k, v))
+        .join('\n    ');
+    return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><title>Signing you in…</title>
+<style>${STYLE}</style></head>
+<body>
+  <p class="hint">Completing sign-in…</p>
+  <form id="f" method="post" action="submit">
+    ${fields}
+    <input type="hidden" name="access_token" id="at">
+    <input type="hidden" name="refresh_token" id="rt">
+    <noscript><p class="err">JavaScript is required to finish signing in.</p></noscript>
+  </form>
+  <script>
+    (function () {
+      var h = new URLSearchParams((location.hash || '').replace(/^#/, ''));
+      var at = h.get('access_token'), rt = h.get('refresh_token');
+      if (at && rt) {
+        document.getElementById('at').value = at;
+        document.getElementById('rt').value = rt;
+        document.getElementById('f').submit();
+      } else {
+        document.body.textContent = 'Sign-in did not return a session. Please try again.';
+      }
+    })();
+  </script>
+</body></html>`;
+}
 export function parseAuthorizeSubmit(body) {
     const str = (k) => {
         const v = body[k];
@@ -49,12 +112,37 @@ export function parseAuthorizeSubmit(body) {
             throw new Error(`Missing field: ${k}`);
         return v;
     };
-    return {
-        apiKey: str('apiKey'),
+    const flow = {
         clientId: str('clientId'),
         redirectUri: str('redirectUri'),
         state: typeof body.state === 'string' ? body.state : '',
         codeChallenge: str('codeChallenge'),
     };
+    if (typeof body.access_token === 'string' && body.access_token.length > 0) {
+        return {
+            mode: 'session',
+            accessToken: str('access_token'),
+            refreshToken: str('refresh_token'),
+            ...flow,
+        };
+    }
+    return {
+        mode: 'password',
+        email: str('email'),
+        password: str('password'),
+        ...flow,
+    };
+}
+/** Validate + extract the OAuth-flow fields for the /authorize/social handler. */
+export function parseSocialStart(query) {
+    const provider = query.provider === 'apple' ? 'apple' : 'google';
+    const flow = {};
+    for (const k of FLOW_FIELDS) {
+        flow[k] = typeof query[k] === 'string' ? query[k] : '';
+    }
+    if (!flow.clientId || !flow.redirectUri || !flow.codeChallenge) {
+        throw new Error('Missing OAuth flow parameters');
+    }
+    return { provider, flow };
 }
 //# sourceMappingURL=authorize-page.js.map

package/dist/auth/authorize-page.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorize-page.js","sourceRoot":"","sources":["../../src/auth/authorize-page.ts"],"names":[],"mappings":"AAUA,SAAS,GAAG,CAAC,KAAa;IACxB,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,MAAM,CAAC,IAAY,EAAE,KAAa;IACzC,OAAO,8BAA8B,GAAG,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,CAAsB;IACxD,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC;IACtE,6FAA6F;IAC7F,OAAO;;;;;;;;;;;;;;;gBAeO,OAAO;;;MAGjB,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC;MAC9B,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,WAAW,CAAC;MACpC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC;MACxB,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,aAAa,CAAC;MACxC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;MAC1B,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC;;;;;;QAM5B,CAAC;AACT,CAAC;AAUD,MAAM,UAAU,oBAAoB,CAAC,IAA6B;IAChE,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE;QAChC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;QACpF,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC;QACrB,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC;QACzB,WAAW,EAAE,GAAG,CAAC,aAAa,CAAC;QAC/B,KAAK,EAAE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QACvD,aAAa,EAAE,GAAG,CAAC,eAAe,CAAC;KACpC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"authorize-page.js","sourceRoot":"","sources":["../../src/auth/authorize-page.ts"],"names":[],"mappings":"AAUA,SAAS,GAAG,CAAC,KAAa;IACxB,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,MAAM,CAAC,IAAY,EAAE,KAAa;IACzC,OAAO,8BAA8B,GAAG,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;AAC3E,CAAC;AAED,0FAA0F;AAC1F,MAAM,WAAW,GAAG;IAClB,UAAU;IACV,aAAa;IACb,OAAO;IACP,eAAe;IACf,QAAQ;IACR,UAAU;CACF,CAAC;AAEX,SAAS,SAAS,CAAC,CAAsB;IACvC,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,WAAW;QAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAClD,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,KAAK,GAAG;;;;;;;;CAQb,CAAC;AAEF,MAAM,UAAU,mBAAmB,CACjC,CAAsB,EACtB,YAAqB,EACrB,UAAU,GAAG,KAAK;IAElB,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC;IACtE,MAAM,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,kBAAkB,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,4EAA4E;IAC5E,iEAAiE;IACjE,MAAM,MAAM,GAAG,UAAU;QACvB,CAAC,CAAC;8DACwD,CAAC;6DACF,CAAC,2BAA2B;QACrF,CAAC,CAAC,EAAE,CAAC;IACP,yEAAyE;IACzE,wDAAwD;IACxD,OAAO;;;;;;SAMA,KAAK;;;2BAGa,OAAO;;IAE9B,GAAG;;MAED,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;;;;;;;IAO9D,MAAM;;QAEF,CAAC;AACT,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAA8B;IACrE,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;SAClC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;SAC7B,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClB,OAAO;;SAEA,KAAK;;;;MAIR,MAAM;;;;;;;;;;;;;;;;;;eAkBG,CAAC;AAChB,CAAC;AAaD,MAAM,UAAU,oBAAoB,CAClC,IAA6B;IAE7B,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE;QAChC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;QACpF,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,MAAM,IAAI,GAAe;QACvB,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC;QACzB,WAAW,EAAE,GAAG,CAAC,aAAa,CAAC;QAC/B,KAAK,EAAE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QACvD,aAAa,EAAE,GAAG,CAAC,eAAe,CAAC;KACpC,CAAC;IAEF,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1E,OAAO;YACL,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,GAAG,CAAC,cAAc,CAAC;YAChC,YAAY,EAAE,GAAG,CAAC,eAAe,CAAC;YAClC,GAAG,IAAI;SACR,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC;QACnB,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC;QACzB,GAAG,IAAI;KACR,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,gBAAgB,CAAC,KAA8B;IAI7D,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;IACjE,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAK,CAAC,CAAC,CAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC"}

package/dist/auth/authorize-page.test.js

@@ -1,37 +1,91 @@
 import { describe, it, expect } from 'vitest';
-import { renderAuthorizePage, parseAuthorizeSubmit } from './authorize-page.js';
+import { renderAuthorizePage, parseAuthorizeSubmit, parseSocialStart, } from './authorize-page.js';
 describe('renderAuthorizePage', () => {
-    it('embeds params as hidden fields and escapes attributes', () => {
-        const html = renderAuthorizePage({
-            clientId: 'c1',
-            clientName: 'Claude',
-            redirectUri: 'https://claude.ai/cb',
-            state: 'st"ate',
-            codeChallenge: 'CHAL',
-            scopes: '',
-            resource: '',
-        });
-        expect(html).toContain('name="apiKey"');
+    const params = {
+        clientId: 'c1',
+        clientName: 'Claude',
+        redirectUri: 'https://claude.ai/cb',
+        state: 'st"ate',
+        codeChallenge: 'CHAL',
+        scopes: '',
+        resource: '',
+    };
+    it('renders a login form with flow fields, escaping attrs', () => {
+        const html = renderAuthorizePage(params);
+        expect(html).toContain('name="email"');
+        expect(html).toContain('name="password"');
         expect(html).toContain('action="authorize/submit"');
         expect(html).toContain('value="c1"');
         expect(html).toContain('value="CHAL"');
         expect(html).toContain('st"ate'); // escaped quote
     });
+    it('hides social buttons by default and shows them when enabled', () => {
+        expect(renderAuthorizePage(params)).not.toContain('authorize/social');
+        expect(renderAuthorizePage(params, undefined, true)).toContain('authorize/social?provider=google');
+    });
+    it('shows an error message when provided', () => {
+        const html = renderAuthorizePage({
+            clientId: 'c1',
+            redirectUri: 'x',
+            state: '',
+            codeChallenge: 'y',
+            scopes: '',
+            resource: '',
+        }, 'Invalid email or password');
+        expect(html).toContain('Invalid email or password');
+    });
 });
 describe('parseAuthorizeSubmit', () => {
-    it('parses a valid body', () => {
-        const fields = parseAuthorizeSubmit({
-            apiKey: 'r2b_x',
+    it('parses a password login', () => {
+        const f = parseAuthorizeSubmit({
+            email: 'a@b.c',
+            password: 'pw',
             clientId: 'c1',
             redirectUri: 'https://claude.ai/cb',
             state: 's',
             codeChallenge: 'CHAL',
         });
-        expect(fields.apiKey).toBe('r2b_x');
-        expect(fields.redirectUri).toBe('https://claude.ai/cb');
+        expect(f.mode).toBe('password');
+        if (f.mode === 'password') {
+            expect(f.email).toBe('a@b.c');
+            expect(f.password).toBe('pw');
+        }
+        expect(f.redirectUri).toBe('https://claude.ai/cb');
     });
-    it('throws when apiKey is missing', () => {
+    it('parses a social session submit', () => {
+        const f = parseAuthorizeSubmit({
+            access_token: 'AT',
+            refresh_token: 'RT',
+            clientId: 'c1',
+            redirectUri: 'x',
+            codeChallenge: 'y',
+        });
+        expect(f.mode).toBe('session');
+        if (f.mode === 'session') {
+            expect(f.accessToken).toBe('AT');
+            expect(f.refreshToken).toBe('RT');
+        }
+    });
+    it('throws when required fields are missing', () => {
         expect(() => parseAuthorizeSubmit({ clientId: 'c1', redirectUri: 'x', codeChallenge: 'y' })).toThrow();
     });
 });
+describe('parseSocialStart', () => {
+    it('extracts provider + flow fields', () => {
+        const r = parseSocialStart({
+            provider: 'google',
+            clientId: 'c1',
+            redirectUri: 'https://claude.ai/cb',
+            codeChallenge: 'CHAL',
+            state: 's',
+            scopes: '',
+            resource: '',
+        });
+        expect(r.provider).toBe('google');
+        expect(r.flow.clientId).toBe('c1');
+    });
+    it('throws on missing flow params', () => {
+        expect(() => parseSocialStart({ provider: 'google' })).toThrow();
+    });
+});
 //# sourceMappingURL=authorize-page.test.js.map

package/dist/auth/authorize-page.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorize-page.test.js","sourceRoot":"","sources":["../../src/auth/authorize-page.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEhF,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,IAAI,GAAG,mBAAmB,CAAC;YAC/B,QAAQ,EAAE,IAAI;YACd,UAAU,EAAE,QAAQ;YACpB,WAAW,EAAE,sBAAsB;YACnC,KAAK,EAAE,QAAQ;YACf,aAAa,EAAE,MAAM;YACrB,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,EAAE;SACb,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,gBAAgB;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,qBAAqB,EAAE,GAAG,EAAE;QAC7B,MAAM,MAAM,GAAG,oBAAoB,CAAC;YAClC,MAAM,EAAE,OAAO;YACf,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,sBAAsB;YACnC,KAAK,EAAE,GAAG;YACV,aAAa,EAAE,MAAM;SACtB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,GAAG,EAAE,CACV,oBAAoB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAC/E,CAAC,OAAO,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"authorize-page.test.js","sourceRoot":"","sources":["../../src/auth/authorize-page.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAE7B,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,MAAM,MAAM,GAAG;QACb,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,QAAQ;QACpB,WAAW,EAAE,sBAAsB;QACnC,KAAK,EAAE,QAAQ;QACf,aAAa,EAAE,MAAM;QACrB,MAAM,EAAE,EAAE;QACV,QAAQ,EAAE,EAAE;KACb,CAAC;IAEF,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,gBAAgB;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACtE,MAAM,CAAC,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,CAC5D,kCAAkC,CACnC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,IAAI,GAAG,mBAAmB,CAC9B;YACE,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,GAAG;YAChB,KAAK,EAAE,EAAE;YACT,aAAa,EAAE,GAAG;YAClB,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,EAAE;SACb,EACD,2BAA2B,CAC5B,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,GAAG,oBAAoB,CAAC;YAC7B,KAAK,EAAE,OAAO;YACd,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,sBAAsB;YACnC,KAAK,EAAE,GAAG;YACV,aAAa,EAAE,MAAM;SACtB,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAChC,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC1B,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9B,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,GAAG,oBAAoB,CAAC;YAC7B,YAAY,EAAE,IAAI;YAClB,aAAa,EAAE,IAAI;YACnB,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,GAAG;YAChB,aAAa,EAAE,GAAG;SACnB,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,GAAG,EAAE,CACV,oBAAoB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAC/E,CAAC,OAAO,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,GAAG,gBAAgB,CAAC;YACzB,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,sBAAsB;YACnC,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,GAAG;YACV,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,EAAE;SACb,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/auth/http-oauth.d.ts

@@ -1,23 +1,28 @@
 import { type Express, type RequestHandler } from 'express';
 import type { OAuthRuntimeConfig } from './oauth-config.js';
 import type { Rent2bOAuthProvider } from './provider.js';
+import type { ApiAuthClient } from './api-auth.js';
 export interface RegisterOAuthOptions {
     oauthCfg: OAuthRuntimeConfig;
     provider: Rent2bOAuthProvider;
-    validateKey: (apiKey: string) => Promise<number>;
+    apiAuth: ApiAuthClient;
+    /** Enable the Google/Apple social-login endpoints + buttons. */
+    socialLogin?: boolean;
 }
 /**
  * Wires the OAuth 2.1 + DCR surface onto an Express app and returns the
  * bearer-auth middleware to guard the MCP endpoint.
  *
+ * Login is the user's own rent2b account (email/password or Google/Apple),
+ * delegated to the rent2b-api auth endpoints; the issued token carries the
+ * resulting Supabase session (see provider.mintSessionTokens). Raw `r2b_`
+ * bearer tokens and `X-API-Key` headers still work (backward compat).
+ *
  * Note on path-prefixed deployment: the MCP SDK serves the auth handlers at the
- * origin root (`/authorize`, `/token`, `/register`) and advertises them
- * origin-level, dropping any issuer path. Behind the gateway, Caddy strips the
- * `/rent2b` prefix before the container sees these paths, so the handlers line
- * up — but the SDK's authorization-server metadata would advertise the wrong
- * (origin-level) URLs. We therefore override that one document with
- * path-correct endpoint URLs. The SDK's protected-resource metadata is already
- * correct (it advertises the full issuer URL), so we keep it.
+ * origin root and advertises them origin-level, dropping any issuer path.
+ * Behind the gateway, Caddy strips `/rent2b` before the container sees these
+ * paths, so they line up — but the SDK's authorization-server metadata would
+ * advertise the wrong (origin-level) URLs, so we override that one document.
  */
 export declare function registerOAuth(app: Express, opts: RegisterOAuthOptions): RequestHandler;
 /**