@intentface/latch-mcp 0.10.0 → 0.12.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/connections.d.ts +19 -0
- package/dist/connections.d.ts.map +1 -1
- package/dist/connections.js +28 -6
- package/dist/connections.js.map +1 -1
- package/dist/guarded-fetch.d.ts +52 -0
- package/dist/guarded-fetch.d.ts.map +1 -0
- package/dist/guarded-fetch.js +60 -0
- package/dist/guarded-fetch.js.map +1 -0
- package/dist/guarded-fetch.test.d.ts +2 -0
- package/dist/guarded-fetch.test.d.ts.map +1 -0
- package/dist/guarded-fetch.test.js +153 -0
- package/dist/guarded-fetch.test.js.map +1 -0
- package/dist/host.d.ts +6 -0
- package/dist/host.d.ts.map +1 -1
- package/dist/host.js +24 -2
- package/dist/host.js.map +1 -1
- package/dist/index.d.ts +2 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +1 -0
- package/dist/index.js.map +1 -1
- package/dist/oauth.d.ts +13 -1
- package/dist/oauth.d.ts.map +1 -1
- package/dist/oauth.js +8 -4
- package/dist/oauth.js.map +1 -1
- package/dist/oauth.test.js +64 -0
- package/dist/oauth.test.js.map +1 -1
- package/package.json +5 -5
package/dist/connections.d.ts
CHANGED
|
@@ -71,6 +71,13 @@ export interface OAuthAuthOptions {
|
|
|
71
71
|
authorizationParams?: Record<string, string>;
|
|
72
72
|
/** Extra client-metadata passthrough (merged into the generated metadata). */
|
|
73
73
|
clientMetadata?: Partial<OAuthClientMetadata>;
|
|
74
|
+
/**
|
|
75
|
+
* Origins permitted to act as this connection's authorization server.
|
|
76
|
+
* Defaults to the MCP server's own origin — set this only when the server
|
|
77
|
+
* genuinely delegates authorization to a separate IdP, and list that IdP's
|
|
78
|
+
* origin. See `McpOAuthConfig.allowedAuthorizationServers`.
|
|
79
|
+
*/
|
|
80
|
+
allowedAuthorizationServers?: string[];
|
|
74
81
|
}
|
|
75
82
|
export declare const none: {
|
|
76
83
|
readonly kind: "none";
|
|
@@ -175,6 +182,18 @@ export interface McpConnections<P> {
|
|
|
175
182
|
status(principal: P): Promise<ConnectionStatus[]>;
|
|
176
183
|
/** Open just one connection and return its namespaced tool names (a connectivity probe). */
|
|
177
184
|
testTools(name: string, principal: P): Promise<string[]>;
|
|
185
|
+
/**
|
|
186
|
+
* Release the registry's own resources — one address-guarded fetch per
|
|
187
|
+
* connection, each holding a keep-alive agent. These live for the registry's
|
|
188
|
+
* lifetime by design (a per-turn agent would discard every pooled socket), so
|
|
189
|
+
* a long-lived server never needs this; a test or a short-lived process does,
|
|
190
|
+
* or the sockets keep the event loop alive. Opening tool sets is unaffected —
|
|
191
|
+
* `OpenToolSet.close()` still releases a turn's clients.
|
|
192
|
+
*
|
|
193
|
+
* Optional: a host that hand-builds something satisfying this interface (the
|
|
194
|
+
* platform composes several) owns no such resources and need not implement it.
|
|
195
|
+
*/
|
|
196
|
+
close?(): Promise<void>;
|
|
178
197
|
}
|
|
179
198
|
export declare function createMcpConnections<P>(config: McpConnectionsConfig<P>): McpConnections<P>;
|
|
180
199
|
//# sourceMappingURL=connections.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"connections.d.ts","sourceRoot":"","sources":["../src/connections.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,KAAK,EACV,cAAc,EACd,KAAK,EAEL,UAAU,EACX,MAAM,wBAAwB,CAAC;AAEhC,OAAO,KAAK,EAAiB,iBAAiB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE/E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;
|
|
1
|
+
{"version":3,"file":"connections.d.ts","sourceRoot":"","sources":["../src/connections.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,KAAK,EACV,cAAc,EACd,KAAK,EAEL,UAAU,EACX,MAAM,wBAAwB,CAAC;AAEhC,OAAO,KAAK,EAAiB,iBAAiB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE/E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAK3C;;;;;;;;;GASG;AAEH,0FAA0F;AAC1F,MAAM,MAAM,iBAAiB,CAAC,CAAC,IAC3B;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,CAAC,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CAAE,GACxE;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAEjD,+EAA+E;AAC/E,MAAM,WAAW,gBAAgB;IAC/B,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;OAKG;IACH,SAAS,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACjE;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,8EAA8E;IAC9E,cAAc,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC9C;;;;;OAKG;IACH,2BAA2B,CAAC,EAAE,MAAM,EAAE,CAAC;CACxC;AAED,eAAO,MAAM,IAAI;;CAA4B,CAAC;AAE9C,wBAAgB,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE;IAC9B,QAAQ,EAAE,CAAC,SAAS,EAAE,CAAC,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACtD,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAEvB;AAED,wBAAgB,OAAO,CAAC,CAAC,GAAG,OAAO,EACjC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,iBAAiB,CAAC,CAAC,CAAC,CAEtB;AAED,wBAAgB,KAAK,CAAC,CAAC,GAAG,OAAO,EAC/B,OAAO,GAAE,gBAAqB,GAC7B,iBAAiB,CAAC,CAAC,CAAC,CAEtB;AAED,iFAAiF;AACjF,MAAM,WAAW,gBAAgB,CAAC,CAAC,GAAG,OAAO;IAC3C,uCAAuC;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,gFAAgF;IAChF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qCAAqC;IACrC,IAAI,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAC5B,iFAAiF;IACjF,KAAK,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC/C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,KAAK,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC/E;;;;;OAKG;IACH,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC;IAC9C;;;;OAIG;IACH,eAAe,CAAC,EAAE,CAChB,SAAS,EAAE,CAAC,KACT,CAAC,CAAC,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC;IAChF;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,sEAAsE;AACtE,wBAAgB,mBAAmB,CAAC,CAAC,GAAG,OAAO,EAC7C,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC,GACvB,gBAAgB,CAAC,CAAC,CAAC,CAErB;AAED,MAAM,WAAW,oBAAoB,CAAC,CAAC;IACrC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAChB,sFAAsF;IACtF,OAAO,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;IAC5B,4CAA4C;IAC5C,YAAY,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC,KAAK,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC1E,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CAC5D;AAED,0CAA0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,KAAK,EAAE,OAAO,CAAC;IACf,8EAA8E;IAC9E,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,cAAc,CAAC,CAAC;IAC/B,+EAA+E;IAC/E,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IACxC,iCAAiC;IACjC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,mFAAmF;IACnF,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC;IAC7C,4CAA4C;IAC5C,MAAM,CAAC,SAAS,EAAE,CAAC,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAClD,4FAA4F;IAC5F,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACzD;;;;;;;;;;OAUG;IACH,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AA8BD,wBAAgB,oBAAoB,CAAC,CAAC,EACpC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC,GAC9B,cAAc,CAAC,CAAC,CAAC,CA+OnB"}
|
package/dist/connections.js
CHANGED
|
@@ -2,6 +2,7 @@ import { tool, jsonSchema } from "ai";
|
|
|
2
2
|
import { createMcpHost } from "./host.js";
|
|
3
3
|
import { createMcpOAuth } from "./oauth.js";
|
|
4
4
|
import { createOAuthDiscoveryFetch } from "./oauth-fetch.js";
|
|
5
|
+
import { createGuardedFetch } from "./guarded-fetch.js";
|
|
5
6
|
export const none = { kind: "none" };
|
|
6
7
|
export function bearer(opts) {
|
|
7
8
|
return { kind: "bearer", getToken: opts.getToken };
|
|
@@ -43,9 +44,26 @@ function toolAllowed(localName, filter) {
|
|
|
43
44
|
}
|
|
44
45
|
export function createMcpConnections(config) {
|
|
45
46
|
const entries = Object.entries(config.connections);
|
|
46
|
-
// One McpOAuth +
|
|
47
|
+
// One McpOAuth + address-guarded fetch per connection, built up front.
|
|
47
48
|
const oauthByName = new Map();
|
|
48
49
|
const fetchByName = new Map();
|
|
50
|
+
const guardedByName = new Map();
|
|
51
|
+
// EVERY connection gets a fetch that vets addresses inside the lookup its own
|
|
52
|
+
// socket uses — the transport's requests and, for OAuth connections, every
|
|
53
|
+
// leg of the flow. Checking a hostname and then handing it to `fetch` leaves
|
|
54
|
+
// the name free to resolve somewhere else when the socket opens, which would
|
|
55
|
+
// carry the caller's credentials to whatever answers. `allowPrivateHost`
|
|
56
|
+
// relaxes it per connection, so a developer's loopback server still works.
|
|
57
|
+
for (const [name, def] of entries) {
|
|
58
|
+
const guarded = createGuardedFetch({ allowPrivateHost: def.allowPrivateHost });
|
|
59
|
+
guardedByName.set(name, guarded);
|
|
60
|
+
const normalize = def.auth?.kind === "oauth" ? def.auth.options.normalize : undefined;
|
|
61
|
+
// Discovery normalization, when the host asked for it, sits ON TOP: it sees
|
|
62
|
+
// the documents, the guarded fetch still opens the sockets.
|
|
63
|
+
fetchByName.set(name, normalize
|
|
64
|
+
? createOAuthDiscoveryFetch({ ...normalize, baseFetch: guarded })
|
|
65
|
+
: guarded);
|
|
66
|
+
}
|
|
49
67
|
for (const [name, def] of entries) {
|
|
50
68
|
if (def.auth?.kind !== "oauth")
|
|
51
69
|
continue;
|
|
@@ -53,11 +71,7 @@ export function createMcpConnections(config) {
|
|
|
53
71
|
const redirectUrl = config.callbackBaseUrl
|
|
54
72
|
? `${config.callbackBaseUrl.replace(/\/$/, "")}/${name}/callback`
|
|
55
73
|
: undefined;
|
|
56
|
-
const normFetch =
|
|
57
|
-
? createOAuthDiscoveryFetch(opts.normalize)
|
|
58
|
-
: undefined;
|
|
59
|
-
if (normFetch)
|
|
60
|
-
fetchByName.set(name, normFetch);
|
|
74
|
+
const normFetch = fetchByName.get(name);
|
|
61
75
|
if (!redirectUrl) {
|
|
62
76
|
// Without a callback base we can't run the redirect flow; skip building
|
|
63
77
|
// the OAuth client (status will still report it as an OAuth connection).
|
|
@@ -85,6 +99,8 @@ export function createMcpConnections(config) {
|
|
|
85
99
|
: undefined,
|
|
86
100
|
scope: opts.scopes?.join(" "),
|
|
87
101
|
fetch: normFetch,
|
|
102
|
+
// Undefined → the MCP server's own origin (see the option's doc).
|
|
103
|
+
allowedAuthorizationServers: opts.allowedAuthorizationServers,
|
|
88
104
|
// `undefined` keeps the SDK default (exact origin match on the
|
|
89
105
|
// advertised resource); a defined hook returning undefined omits the
|
|
90
106
|
// resource parameter from the authorize + exchange requests.
|
|
@@ -135,6 +151,7 @@ export function createMcpConnections(config) {
|
|
|
135
151
|
name,
|
|
136
152
|
url: def.url,
|
|
137
153
|
auth: { type: "headers", headers: { Authorization: `Bearer ${token}` } },
|
|
154
|
+
fetch: fetchByName.get(name),
|
|
138
155
|
approval,
|
|
139
156
|
visible,
|
|
140
157
|
allowPrivateHost: def.allowPrivateHost,
|
|
@@ -145,6 +162,7 @@ export function createMcpConnections(config) {
|
|
|
145
162
|
name,
|
|
146
163
|
url: def.url,
|
|
147
164
|
auth: { type: "headers", headers: auth.headers },
|
|
165
|
+
fetch: fetchByName.get(name),
|
|
148
166
|
approval,
|
|
149
167
|
visible,
|
|
150
168
|
allowPrivateHost: def.allowPrivateHost,
|
|
@@ -154,6 +172,7 @@ export function createMcpConnections(config) {
|
|
|
154
172
|
out.push({
|
|
155
173
|
name,
|
|
156
174
|
url: def.url,
|
|
175
|
+
fetch: fetchByName.get(name),
|
|
157
176
|
approval,
|
|
158
177
|
visible,
|
|
159
178
|
allowPrivateHost: def.allowPrivateHost,
|
|
@@ -214,6 +233,9 @@ export function createMcpConnections(config) {
|
|
|
214
233
|
hostFor: (names) => makeHost(new Set(names)),
|
|
215
234
|
names: entries.map(([name]) => name),
|
|
216
235
|
oauth: (name) => oauthByName.get(name),
|
|
236
|
+
async close() {
|
|
237
|
+
await Promise.all([...guardedByName.values()].map((f) => f.close().catch(() => { })));
|
|
238
|
+
},
|
|
217
239
|
async status(principal) {
|
|
218
240
|
const out = [];
|
|
219
241
|
for (const [name, def] of entries) {
|
package/dist/connections.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"connections.js","sourceRoot":"","sources":["../src/connections.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAQtC,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;
|
|
1
|
+
{"version":3,"file":"connections.js","sourceRoot":"","sources":["../src/connections.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAQtC,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAE7D,OAAO,EAAE,kBAAkB,EAAqB,MAAM,oBAAoB,CAAC;AAwE3E,MAAM,CAAC,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,EAAW,CAAC;AAE9C,MAAM,UAAU,MAAM,CAAI,IAEzB;IACC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,OAAO,CACrB,OAA+B;IAE/B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,KAAK,CACnB,UAA4B,EAAE;IAE9B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC;AAqDD,sEAAsE;AACtE,MAAM,UAAU,mBAAmB,CACjC,GAAwB;IAExB,OAAO,GAAG,CAAC;AACb,CAAC;AA4DD,6EAA6E;AAC7E,SAAS,WAAW,CAAC,IAAY,EAAE,GAA6B;IAC9D,OAAO,IAAI,CAAC;QACV,WAAW,EACT,gBAAgB,IAAI,eAAe;YACnC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,wEAAwE;YACxE,8BAA8B,IAAI,yCAAyC;QAC7E,WAAW,EAAE,UAAU,CAAwB;YAC7C,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,EAAE;YACd,oBAAoB,EAAE,KAAK;SAC5B,CAAC;QACF,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;KAC7D,CAAC,CAAC;AACL,CAAC;AAED,mFAAmF;AACnF,SAAS,WAAW,CAClB,SAAiB,EACjB,MAA0C;IAE1C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACpE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,MAA+B;IAE/B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAEnD,uEAAuE;IACvE,MAAM,WAAW,GAAG,IAAI,GAAG,EAAuB,CAAC;IACnD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAyB,CAAC;IACrD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAwB,CAAC;IAEtD,8EAA8E;IAC9E,2EAA2E;IAC3E,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IACzE,2EAA2E;IAC3E,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,OAAO,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAC/E,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACjC,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QACtF,4EAA4E;QAC5E,4DAA4D;QAC5D,WAAW,CAAC,GAAG,CACb,IAAI,EACJ,SAAS;YACP,CAAC,CAAC,yBAAyB,CAAC,EAAE,GAAG,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;YACjE,CAAC,CAAE,OAAyB,CAC/B,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,OAAO,EAAE,CAAC;QAClC,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO;YAAE,SAAS;QACzC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;QAC9B,MAAM,WAAW,GAAG,MAAM,CAAC,eAAe;YACxC,CAAC,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,IAAI,WAAW;YACjE,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,wEAAwE;YACxE,yEAAyE;YACzE,SAAS;QACX,CAAC;QACD,MAAM,cAAc,GAAwB;YAC1C,WAAW,EAAE,IAAI,CAAC,UAAU,IAAI,UAAU,IAAI,GAAG;YACjD,aAAa,EAAE,CAAC,WAAW,CAAC;YAC5B,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,0BAA0B,EAAE,IAAI,CAAC,uBAAuB,IAAI,MAAM;YAClE,GAAG,IAAI,CAAC,cAAc;SACvB,CAAC;QACF,WAAW,CAAC,GAAG,CACb,IAAI,EACJ,cAAc,CAAC;YACb,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE;gBACN,IAAI;gBACJ,SAAS,EAAE,GAAG,CAAC,GAAG;gBAClB,WAAW;gBACX,cAAc;gBACd,qEAAqE;gBACrE,gCAAgC;gBAChC,iBAAiB,EAAE,IAAI,CAAC,QAAQ;oBAC9B,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE;oBAChE,CAAC,CAAC,SAAS;gBACb,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC;gBAC7B,KAAK,EAAE,SAAS;gBAChB,kEAAkE;gBAClE,2BAA2B,EAAE,IAAI,CAAC,2BAA2B;gBAC7D,+DAA+D;gBAC/D,qEAAqE;gBACrE,6DAA6D;gBAC7D,mBAAmB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;gBACpE,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;aAC9C;SACF,CAAC,CACH,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,KAAK,UAAU,kBAAkB,CAAC,SAAY;QAC5C,MAAM,GAAG,GAAoB,EAAE,CAAC;QAChC,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,OAAO,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC;YAC9B,2EAA2E;YAC3E,2EAA2E;YAC3E,sEAAsE;YACtE,uCAAuC;YACvC,IAAI,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC5B,IAAI,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC;YAC/B,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,WAAW;oBAAE,QAAQ,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;gBACjE,IAAI,GAAG,CAAC,eAAe;oBAAE,OAAO,GAAG,MAAM,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YAC1E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,iBAAiB,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBACxC,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC1B,MAAM,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAChC,mEAAmE;gBACnE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;oBAC3C,GAAG,CAAC,IAAI,CAAC;wBACP,IAAI;wBACJ,GAAG,EAAE,GAAG,CAAC,GAAG;wBACZ,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;wBACnC,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;wBAC5B,QAAQ;wBACR,OAAO;wBACP,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;qBACvC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAClC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;gBAC7C,GAAG,CAAC,IAAI,CAAC;oBACP,IAAI;oBACJ,GAAG,EAAE,GAAG,CAAC,GAAG;oBACZ,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE;oBACxE,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;oBAC5B,QAAQ;oBACR,OAAO;oBACP,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;iBACvC,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBACnC,GAAG,CAAC,IAAI,CAAC;oBACP,IAAI;oBACJ,GAAG,EAAE,GAAG,CAAC,GAAG;oBACZ,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;oBAChD,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;oBAC5B,QAAQ;oBACR,OAAO;oBACP,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;iBACvC,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,IAAI,CAAC;oBACP,IAAI;oBACJ,GAAG,EAAE,GAAG,CAAC,GAAG;oBACZ,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;oBAC5B,QAAQ;oBACR,OAAO;oBACP,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;iBACvC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAU,CAAC,CACzD,CAAC;IAEF;;;;;OAKG;IACH,SAAS,QAAQ,CAAC,IAAkB;QAClC,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,YAAY,GAAG,aAAa,CAAI;YACpC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAC/B,CAAC,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SACvE,CAAC,CAAC;QAEH,OAAO;YACL,KAAK,CAAC,IAAI,CAAC,SAAS;gBAClB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAElD,kEAAkE;gBAClE,MAAM,KAAK,GAA4B,EAAE,CAAC;gBAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;oBACpD,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBAC5B,MAAM,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAChD,MAAM,KAAK,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;oBAClD,IAAI,WAAW,CAAC,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;wBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACjE,CAAC;gBAED,sEAAsE;gBACtE,uEAAuE;gBACvE,MAAM,YAAY,GAA4B,EAAE,CAAC;gBACjD,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;oBAChE,IAAI,GAAG,IAAI,KAAK;wBAAE,YAAY,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;gBAC/C,CAAC;gBACD,MAAM,YAAY,GAAa,EAAE,CAAC;gBAClC,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,OAAO,EAAE,CAAC;oBAClC,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;wBAAE,SAAS;oBAC3D,MAAM,GAAG,GAAG,WAAW,IAAI,EAAE,CAAC;oBAC9B,KAAK,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;oBACpC,YAAY,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC;oBACpC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,iDAAiD;gBAC3E,CAAC;gBAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;YACpE,CAAC;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,QAAQ,EAAE;QAChB,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5C,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC;QACpC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;QACtC,KAAK,CAAC,KAAK;YACT,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACvF,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,SAAS;YACpB,MAAM,GAAG,GAAuB,EAAE,CAAC;YACnC,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,OAAO,EAAE,CAAC;gBAClC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC;gBAC3C,MAAM,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAChC,GAAG,CAAC,IAAI,CAAC;oBACP,IAAI;oBACJ,WAAW,EAAE,GAAG,CAAC,WAAW;oBAC5B,KAAK,EAAE,OAAO;oBACd,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;iBAC3E,CAAC,CAAC;YACL,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS;YAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC;YACzD,uEAAuE;YACvE,MAAM,KAAK,GAAG,aAAa,CAAI;gBAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;gBAC3C,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;oBACvB,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,CAAC,CAAC,CAAC;oBACxC,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;gBAC5C,CAAC;aACF,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC3C,IAAI,CAAC;gBACH,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnC,CAAC;oBAAS,CAAC;gBACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
|
|
@@ -0,0 +1,52 @@
|
|
|
1
|
+
import { createPinnedFetch } from "@intentface/latch-net/pinned";
|
|
2
|
+
import type { FetchFunction } from "./oauth-fetch.js";
|
|
3
|
+
/**
|
|
4
|
+
* The fetch every MCP request goes through — the transport's, and the OAuth
|
|
5
|
+
* flow's.
|
|
6
|
+
*
|
|
7
|
+
* Two guarantees the plain `fetch` cannot give:
|
|
8
|
+
*
|
|
9
|
+
* **The address checked is the address connected to.** `host.open()` vets a
|
|
10
|
+
* connection's hostname before opening it, but `fetch` then performs its own
|
|
11
|
+
* DNS lookup: a name that answers public to the check and private to the
|
|
12
|
+
* connect reaches an internal service carrying the caller's credentials. That
|
|
13
|
+
* is a time-of-check/time-of-use gap, not a weak blocklist, and it closes only
|
|
14
|
+
* by validating inside the lookup the socket itself uses —
|
|
15
|
+
* `createPinnedFetch`. TLS is untouched: SNI and certificate validation stay
|
|
16
|
+
* against the original hostname.
|
|
17
|
+
*
|
|
18
|
+
* **Addresses are checked on EVERY leg, not just the transport's.** An OAuth
|
|
19
|
+
* flow follows addresses the MCP server chose: the authorization server named
|
|
20
|
+
* in its protected-resource metadata, then that server's registration and
|
|
21
|
+
* token endpoints. Those legs had no address check at all, which made adding a
|
|
22
|
+
* custom MCP server by URL an SSRF with a read-back channel.
|
|
23
|
+
*
|
|
24
|
+
* Redirects are refused rather than followed — a 302 is another address the
|
|
25
|
+
* server operator chose, and nothing in the MCP or OAuth protocols needs one.
|
|
26
|
+
*/
|
|
27
|
+
export interface GuardedFetch {
|
|
28
|
+
(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
|
|
29
|
+
/** Close the underlying agent. Keep-alive sockets would hold a test's event loop. */
|
|
30
|
+
close(): Promise<void>;
|
|
31
|
+
}
|
|
32
|
+
export interface GuardedFetchOptions {
|
|
33
|
+
/**
|
|
34
|
+
* Permit private, loopback and link-local addresses — a trusted local or
|
|
35
|
+
* in-cluster MCP server, or a developer's `http://localhost:3999/mcp`. This
|
|
36
|
+
* is the connection's own `allowPrivateHost`, so the OAuth legs relax
|
|
37
|
+
* exactly when the transport does and local development is unaffected.
|
|
38
|
+
*/
|
|
39
|
+
allowPrivateHost?: boolean;
|
|
40
|
+
/** Test seam: the resolver `createPinnedFetch` vets. Defaults to `node:dns`. */
|
|
41
|
+
lookup?: Parameters<typeof createPinnedFetch>[0] extends {
|
|
42
|
+
lookup?: infer L;
|
|
43
|
+
} ? L : never;
|
|
44
|
+
}
|
|
45
|
+
export declare function createGuardedFetch(options?: GuardedFetchOptions): GuardedFetch;
|
|
46
|
+
/**
|
|
47
|
+
* The guarded fetch, with a host's own fetch layered on top when it supplied
|
|
48
|
+
* one (discovery-document normalization, typically). The host's wrapper sees
|
|
49
|
+
* the requests; the guarded fetch still opens the sockets.
|
|
50
|
+
*/
|
|
51
|
+
export declare function composeGuardedFetch(guarded: GuardedFetch, wrap?: (base: FetchFunction) => FetchFunction): GuardedFetch;
|
|
52
|
+
//# sourceMappingURL=guarded-fetch.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"guarded-fetch.d.ts","sourceRoot":"","sources":["../src/guarded-fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,YAAY;IAC3B,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClE,qFAAqF;IACrF,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gFAAgF;IAChF,MAAM,CAAC,EAAE,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,CAAC,GAAG,KAAK,CAAC;CAC3F;AAsCD,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,mBAAwB,GAAG,YAAY,CAalF;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,YAAY,EACrB,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,aAAa,KAAK,aAAa,GAC5C,YAAY,CAKd"}
|
|
@@ -0,0 +1,60 @@
|
|
|
1
|
+
import { createPinnedFetch } from "@intentface/latch-net/pinned";
|
|
2
|
+
/**
|
|
3
|
+
* Normalize to what the pinned fetch accepts. undici rejects a `Request` built
|
|
4
|
+
* by another fetch implementation (a cross-realm brand check), so a `Request`
|
|
5
|
+
* is unpacked rather than passed through. The OAuth SDK calls fetch as
|
|
6
|
+
* `(url, init)`; this exists so a caller that doesn't cannot silently bypass
|
|
7
|
+
* the guard.
|
|
8
|
+
*/
|
|
9
|
+
async function unpack(input, init) {
|
|
10
|
+
if (typeof input === "string" || input instanceof URL)
|
|
11
|
+
return [input, init ?? {}];
|
|
12
|
+
const request = input;
|
|
13
|
+
const body = request.method === "GET" || request.method === "HEAD"
|
|
14
|
+
? undefined
|
|
15
|
+
: await request.arrayBuffer();
|
|
16
|
+
const headers = {};
|
|
17
|
+
request.headers.forEach((value, key) => {
|
|
18
|
+
headers[key] = value;
|
|
19
|
+
});
|
|
20
|
+
return [
|
|
21
|
+
request.url,
|
|
22
|
+
{
|
|
23
|
+
method: request.method,
|
|
24
|
+
headers,
|
|
25
|
+
...(body && body.byteLength > 0 ? { body } : {}),
|
|
26
|
+
// The Request's own signal, or nothing survives cancellation: an aborted
|
|
27
|
+
// MCP call would keep its socket until the server answered. `init` still
|
|
28
|
+
// wins, so a caller passing both replaces it deliberately.
|
|
29
|
+
signal: request.signal,
|
|
30
|
+
...init,
|
|
31
|
+
},
|
|
32
|
+
];
|
|
33
|
+
}
|
|
34
|
+
export function createGuardedFetch(options = {}) {
|
|
35
|
+
const pinned = createPinnedFetch({
|
|
36
|
+
allowPrivate: options.allowPrivateHost === true,
|
|
37
|
+
...(options.lookup ? { lookup: options.lookup } : {}),
|
|
38
|
+
});
|
|
39
|
+
const guarded = (async (input, init) => {
|
|
40
|
+
const [url, base] = await unpack(input, init);
|
|
41
|
+
// `redirect: "error"` last: a caller asking to follow redirects is asking
|
|
42
|
+
// to connect to an address nothing vetted.
|
|
43
|
+
return pinned(url, { ...base, redirect: "error" });
|
|
44
|
+
});
|
|
45
|
+
guarded.close = () => pinned.close();
|
|
46
|
+
return guarded;
|
|
47
|
+
}
|
|
48
|
+
/**
|
|
49
|
+
* The guarded fetch, with a host's own fetch layered on top when it supplied
|
|
50
|
+
* one (discovery-document normalization, typically). The host's wrapper sees
|
|
51
|
+
* the requests; the guarded fetch still opens the sockets.
|
|
52
|
+
*/
|
|
53
|
+
export function composeGuardedFetch(guarded, wrap) {
|
|
54
|
+
if (!wrap)
|
|
55
|
+
return guarded;
|
|
56
|
+
const composed = wrap(guarded);
|
|
57
|
+
composed.close = () => guarded.close();
|
|
58
|
+
return composed;
|
|
59
|
+
}
|
|
60
|
+
//# sourceMappingURL=guarded-fetch.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"guarded-fetch.js","sourceRoot":"","sources":["../src/guarded-fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AA6CjE;;;;;;GAMG;AACH,KAAK,UAAU,MAAM,CACnB,KAAwB,EACxB,IAAkB;IAElB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,YAAY,GAAG;QAAE,OAAO,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IAClF,MAAM,OAAO,GAAG,KAAgB,CAAC;IACjC,MAAM,IAAI,GACR,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;QACnD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC;IAClC,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACrC,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACvB,CAAC,CAAC,CAAC;IACH,OAAO;QACL,OAAO,CAAC,GAAG;QACX;YACE,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO;YACP,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,yEAAyE;YACzE,yEAAyE;YACzE,2DAA2D;YAC3D,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,IAAI;SACR;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,UAA+B,EAAE;IAClE,MAAM,MAAM,GAAG,iBAAiB,CAAC;QAC/B,YAAY,EAAE,OAAO,CAAC,gBAAgB,KAAK,IAAI;QAC/C,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,CAAC,KAAK,EAAE,KAAwB,EAAE,IAAkB,EAAE,EAAE;QACtE,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC9C,0EAA0E;QAC1E,2CAA2C;QAC3C,OAAO,MAAM,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACrD,CAAC,CAAiB,CAAC;IACnB,OAAO,CAAC,KAAK,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACrC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAqB,EACrB,IAA6C;IAE7C,IAAI,CAAC,IAAI;QAAE,OAAO,OAAO,CAAC;IAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAwB,CAAiB,CAAC;IAChE,QAAQ,CAAC,KAAK,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvC,OAAO,QAAQ,CAAC;AAClB,CAAC"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"guarded-fetch.test.d.ts","sourceRoot":"","sources":["../src/guarded-fetch.test.ts"],"names":[],"mappings":""}
|
|
@@ -0,0 +1,153 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* The fetch behind every MCP request — transport and OAuth alike.
|
|
3
|
+
*
|
|
4
|
+
* What is asserted here is the difference between "we checked the hostname"
|
|
5
|
+
* and "we connected to the address we checked": the vetting happens inside the
|
|
6
|
+
* lookup the socket itself uses, so a name cannot answer public to the check
|
|
7
|
+
* and private to the connect. Plus the two things this wrapper adds on top of
|
|
8
|
+
* the pinned fetch — redirects refused, and a `Request` unpacked rather than
|
|
9
|
+
* handed to undici, which rejects one built by another fetch implementation.
|
|
10
|
+
*/
|
|
11
|
+
import { createServer } from "node:http";
|
|
12
|
+
import { afterEach, describe, expect, it } from "vitest";
|
|
13
|
+
import { createGuardedFetch } from "./guarded-fetch.js";
|
|
14
|
+
const A = (address, family = 4) => ({ address, family });
|
|
15
|
+
const cleanups = [];
|
|
16
|
+
afterEach(async () => {
|
|
17
|
+
while (cleanups.length)
|
|
18
|
+
await cleanups.pop()();
|
|
19
|
+
});
|
|
20
|
+
function guarded(...args) {
|
|
21
|
+
const f = createGuardedFetch(...args);
|
|
22
|
+
cleanups.push(() => f.close());
|
|
23
|
+
return f;
|
|
24
|
+
}
|
|
25
|
+
async function listen(server) {
|
|
26
|
+
await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
|
|
27
|
+
cleanups.push(() => new Promise((resolve) => server.close(resolve)));
|
|
28
|
+
return server.address().port;
|
|
29
|
+
}
|
|
30
|
+
/** A lookup backed by a mutable table — no real DNS in any test. */
|
|
31
|
+
const tableLookup = (table) => (hostname, _options, cb) => {
|
|
32
|
+
const addrs = table[hostname];
|
|
33
|
+
if (!addrs)
|
|
34
|
+
return cb(Object.assign(new Error(`ENOTFOUND ${hostname}`), { code: "ENOTFOUND" }));
|
|
35
|
+
cb(null, addrs);
|
|
36
|
+
};
|
|
37
|
+
async function rejection(p) {
|
|
38
|
+
try {
|
|
39
|
+
await p;
|
|
40
|
+
}
|
|
41
|
+
catch (err) {
|
|
42
|
+
const parts = [];
|
|
43
|
+
const walk = (e) => {
|
|
44
|
+
if (!e)
|
|
45
|
+
return;
|
|
46
|
+
if (e instanceof AggregateError)
|
|
47
|
+
e.errors.forEach(walk);
|
|
48
|
+
if (e instanceof Error) {
|
|
49
|
+
parts.push(e.message);
|
|
50
|
+
walk(e.cause);
|
|
51
|
+
}
|
|
52
|
+
};
|
|
53
|
+
walk(err);
|
|
54
|
+
return parts.join(" <- ");
|
|
55
|
+
}
|
|
56
|
+
throw new Error("expected the fetch to reject");
|
|
57
|
+
}
|
|
58
|
+
describe("address vetting", () => {
|
|
59
|
+
it("refuses a name that resolves to an internal address", async () => {
|
|
60
|
+
// The cloud metadata endpoint, reached through a name the MCP server's
|
|
61
|
+
// metadata could perfectly well have pointed at.
|
|
62
|
+
const f = guarded({
|
|
63
|
+
lookup: tableLookup({ "auth.evil.example": [A("169.254.169.254")] }),
|
|
64
|
+
});
|
|
65
|
+
expect(await rejection(f("http://auth.evil.example/.well-known/openid-configuration"))).toMatch(/Blocked private\/internal address: auth\.evil\.example -> 169\.254\.169\.254/);
|
|
66
|
+
});
|
|
67
|
+
it("refuses a name that answers public first and private when the socket opens", async () => {
|
|
68
|
+
// DNS rebinding: the open-time check would pass, the connect would land
|
|
69
|
+
// inside. The vetting is in the lookup the socket uses, so there is no gap.
|
|
70
|
+
const table = { "rebind.example": [A("93.184.216.34")] };
|
|
71
|
+
const f = guarded({ lookup: tableLookup(table) });
|
|
72
|
+
table["rebind.example"] = [A("127.0.0.1")];
|
|
73
|
+
expect(await rejection(f("http://rebind.example/mcp"))).toMatch(/Blocked private\/internal address: rebind\.example -> 127\.0\.0\.1/);
|
|
74
|
+
});
|
|
75
|
+
it("permits a loopback server when the connection opted in", async () => {
|
|
76
|
+
// A developer's `http://localhost:3999/mcp`, and an in-cluster server.
|
|
77
|
+
const port = await listen(createServer((_req, res) => {
|
|
78
|
+
res.writeHead(200, { "content-type": "application/json" });
|
|
79
|
+
res.end('{"ok":true}');
|
|
80
|
+
}));
|
|
81
|
+
const f = guarded({ allowPrivateHost: true });
|
|
82
|
+
const res = await f(`http://127.0.0.1:${port}/mcp`);
|
|
83
|
+
expect(res.status).toBe(200);
|
|
84
|
+
expect(await res.json()).toEqual({ ok: true });
|
|
85
|
+
});
|
|
86
|
+
});
|
|
87
|
+
describe("what the wrapper adds", () => {
|
|
88
|
+
it("refuses to follow a redirect, even when the caller asks for one", async () => {
|
|
89
|
+
// A 302 names an address nothing vetted; no MCP or OAuth leg needs one.
|
|
90
|
+
const port = await listen(createServer((_req, res) => {
|
|
91
|
+
res.writeHead(302, { location: "http://169.254.169.254/latest/meta-data/" });
|
|
92
|
+
res.end();
|
|
93
|
+
}));
|
|
94
|
+
const f = guarded({ allowPrivateHost: true });
|
|
95
|
+
expect(await rejection(f(`http://127.0.0.1:${port}/`, { redirect: "follow" }))).toMatch(/redirect/i);
|
|
96
|
+
});
|
|
97
|
+
it("carries the Request's abort signal, so a cancelled call releases its socket", async () => {
|
|
98
|
+
// Without this the reconstruction drops `signal` and an aborted MCP or
|
|
99
|
+
// OAuth call keeps its socket until the server finally answers.
|
|
100
|
+
let release;
|
|
101
|
+
const held = new Promise((resolve) => (release = resolve));
|
|
102
|
+
cleanups.push(() => release());
|
|
103
|
+
const port = await listen(createServer(async (_req, res) => {
|
|
104
|
+
await held; // never answers until the test lets it
|
|
105
|
+
res.writeHead(200);
|
|
106
|
+
res.end("late");
|
|
107
|
+
}));
|
|
108
|
+
const f = guarded({ allowPrivateHost: true });
|
|
109
|
+
const controller = new AbortController();
|
|
110
|
+
const inflight = f(new Request(`http://127.0.0.1:${port}/slow`, { signal: controller.signal }));
|
|
111
|
+
controller.abort();
|
|
112
|
+
expect(await rejection(inflight)).toMatch(/abort/i);
|
|
113
|
+
});
|
|
114
|
+
it("an explicit init signal replaces the Request's", async () => {
|
|
115
|
+
const port = await listen(createServer((_req, res) => {
|
|
116
|
+
res.writeHead(200);
|
|
117
|
+
res.end("ok");
|
|
118
|
+
}));
|
|
119
|
+
const f = guarded({ allowPrivateHost: true });
|
|
120
|
+
const requestSide = new AbortController();
|
|
121
|
+
requestSide.abort(); // already aborted — must NOT decide the outcome
|
|
122
|
+
const res = await f(new Request(`http://127.0.0.1:${port}/`, { signal: requestSide.signal }), {
|
|
123
|
+
signal: new AbortController().signal,
|
|
124
|
+
});
|
|
125
|
+
expect(res.status).toBe(200);
|
|
126
|
+
});
|
|
127
|
+
it("unpacks a Request rather than handing it to undici", async () => {
|
|
128
|
+
// undici rejects a Request built by another fetch implementation
|
|
129
|
+
// (cross-realm brand check), so a caller passing one must not silently
|
|
130
|
+
// bypass the guard — method, headers and body have to survive.
|
|
131
|
+
let seen = {};
|
|
132
|
+
const port = await listen(createServer((req, res) => {
|
|
133
|
+
let body = "";
|
|
134
|
+
req.on("data", (c) => (body += c));
|
|
135
|
+
req.on("end", () => {
|
|
136
|
+
seen = { method: req.method, auth: req.headers.authorization, body };
|
|
137
|
+
res.writeHead(200, { "content-type": "application/json" });
|
|
138
|
+
res.end('{"ok":true}');
|
|
139
|
+
});
|
|
140
|
+
}));
|
|
141
|
+
const f = guarded({ allowPrivateHost: true });
|
|
142
|
+
const res = await f(new Request(`http://127.0.0.1:${port}/token`, {
|
|
143
|
+
method: "POST",
|
|
144
|
+
headers: { authorization: "Bearer t0ken", "content-type": "application/json" },
|
|
145
|
+
body: '{"grant_type":"authorization_code"}',
|
|
146
|
+
}));
|
|
147
|
+
expect(res.status).toBe(200);
|
|
148
|
+
expect(seen.method).toBe("POST");
|
|
149
|
+
expect(seen.auth).toBe("Bearer t0ken");
|
|
150
|
+
expect(seen.body).toBe('{"grant_type":"authorization_code"}');
|
|
151
|
+
});
|
|
152
|
+
});
|
|
153
|
+
//# sourceMappingURL=guarded-fetch.test.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"guarded-fetch.test.js","sourceRoot":"","sources":["../src/guarded-fetch.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAqB,MAAM,oBAAoB,CAAC;AAG3E,MAAM,CAAC,GAAG,CAAC,OAAe,EAAE,MAAM,GAAG,CAAC,EAAQ,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;AAEvE,MAAM,QAAQ,GAA4C,EAAE,CAAC;AAC7D,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,OAAO,QAAQ,CAAC,MAAM;QAAE,MAAM,QAAQ,CAAC,GAAG,EAAG,EAAE,CAAC;AAClD,CAAC,CAAC,CAAC;AAEH,SAAS,OAAO,CAAC,GAAG,IAA2C;IAC7D,MAAM,CAAC,GAAG,kBAAkB,CAAC,GAAG,IAAI,CAAC,CAAC;IACtC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC/B,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,MAAc;IAClC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7E,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACrE,OAAQ,MAAM,CAAC,OAAO,EAAkB,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,oEAAoE;AACpE,MAAM,WAAW,GACf,CAAC,KAA6B,EAAE,EAAE,CAClC,CACE,QAAgB,EAChB,QAAiB,EACjB,EAA+D,EACzD,EAAE;IACR,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,aAAa,QAAQ,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;IAChG,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAClB,CAAC,CAAC;AAEJ,KAAK,UAAU,SAAS,CAAC,CAAmB;IAC1C,IAAI,CAAC;QACH,MAAM,CAAC,CAAC;IACV,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,CAAC,CAAU,EAAQ,EAAE;YAChC,IAAI,CAAC,CAAC;gBAAE,OAAO;YACf,IAAI,CAAC,YAAY,cAAc;gBAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACxD,IAAI,CAAC,YAAY,KAAK,EAAE,CAAC;gBACvB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBACtB,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC;QACH,CAAC,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;AAClD,CAAC;AAED,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,uEAAuE;QACvE,iDAAiD;QACjD,MAAM,CAAC,GAAG,OAAO,CAAC;YAChB,MAAM,EAAE,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAU;SAC9E,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,SAAS,CAAC,CAAC,CAAC,2DAA2D,CAAC,CAAC,CAAC,CAAC,OAAO,CAC7F,8EAA8E,CAC/E,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,wEAAwE;QACxE,4EAA4E;QAC5E,MAAM,KAAK,GAA2B,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;QACjF,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,KAAK,CAAU,EAAE,CAAC,CAAC;QAC3D,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,SAAS,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,OAAO,CAC7D,oEAAoE,CACrE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,uEAAuE;QACvE,MAAM,IAAI,GAAG,MAAM,MAAM,CACvB,YAAY,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YACzB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACzB,CAAC,CAAC,CACH,CAAC;QACF,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,oBAAoB,IAAI,MAAM,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,wEAAwE;QACxE,MAAM,IAAI,GAAG,MAAM,MAAM,CACvB,YAAY,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YACzB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,0CAA0C,EAAE,CAAC,CAAC;YAC7E,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC,CAAC,CACH,CAAC;QACF,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,CACJ,MAAM,SAAS,CAAC,CAAC,CAAC,oBAAoB,IAAI,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CACxE,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,uEAAuE;QACvE,gEAAgE;QAChE,IAAI,OAAoB,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;QACjE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,MAAM,CACvB,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;YAC/B,MAAM,IAAI,CAAC,CAAC,uCAAuC;YACnD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC,CACH,CAAC;QACF,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,CAAC,CAChB,IAAI,OAAO,CAAC,oBAAoB,IAAI,OAAO,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAC5E,CAAC;QACF,UAAU,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,CAAC,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,IAAI,GAAG,MAAM,MAAM,CACvB,YAAY,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YACzB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC,CACH,CAAC;QACF,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,WAAW,GAAG,IAAI,eAAe,EAAE,CAAC;QAC1C,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,gDAAgD;QACrE,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,IAAI,OAAO,CAAC,oBAAoB,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE;YAC5F,MAAM,EAAE,IAAI,eAAe,EAAE,CAAC,MAAM;SACrC,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,iEAAiE;QACjE,uEAAuE;QACvE,+DAA+D;QAC/D,IAAI,IAAI,GAAsD,EAAE,CAAC;QACjE,MAAM,IAAI,GAAG,MAAM,MAAM,CACvB,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACxB,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;YACnC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;gBACrE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACzB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CACH,CAAC;QACF,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,CACjB,IAAI,OAAO,CAAC,oBAAoB,IAAI,QAAQ,EAAE;YAC5C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC9E,IAAI,EAAE,qCAAqC;SAC5C,CAAC,CACH,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
|
package/dist/host.d.ts
CHANGED
|
@@ -128,6 +128,12 @@ export type McpConnection = {
|
|
|
128
128
|
* Custom fetch for this connection's requests AND the transport's on-401
|
|
129
129
|
* re-auth/refresh. Pass the same fetch used by the OAuth flow (e.g.
|
|
130
130
|
* `createOAuthDiscoveryFetch`) so discovery normalization is consistent.
|
|
131
|
+
*
|
|
132
|
+
* It REPLACES the address-guarded fetch the host would otherwise build,
|
|
133
|
+
* so layer it over `createGuardedFetch` rather than over `globalThis.fetch`
|
|
134
|
+
* — otherwise the transport resolves the hostname a second time and the
|
|
135
|
+
* open-time address check can be defeated by a name that changes answer.
|
|
136
|
+
* `createMcpConnections` does this composition for you.
|
|
131
137
|
*/
|
|
132
138
|
fetch?: FetchFunction;
|
|
133
139
|
/**
|
package/dist/host.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../src/host.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACzB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,0BAA0B,EAAE,kBAAkB,EAAE,MAAM,IAAI,CAAC;AACzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAGL,aAAa,EACd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;
|
|
1
|
+
{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../src/host.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACzB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,0BAA0B,EAAE,kBAAkB,EAAE,MAAM,IAAI,CAAC;AACzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAGL,aAAa,EACd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGtD;;;;;;;;;GASG;AAEH,MAAM,MAAM,OAAO,GACf;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC;AAEzD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,OAAO,CAAC,GAAG,SAAS,GAC/C,CAAC,IAAI,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,KAAK,OAAO,CA2B5E;AAED,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE;QACZ,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;KACtB,CAAC;CACH;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAE7E;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,iBAAiB,GACzB,aAAa,GACb,KAAK,GACL,MAAM,GACN,CAAC,CAAC,IAAI,EAAE,WAAW,KAAK,OAAO,GAAG,eAAe,CAAC,CAAC;AAQvD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,iBAAiB,GAAG,SAAS,EACrC,IAAI,EAAE,WAAW,GAChB,OAAO,GAAG,eAAe,CAM3B;AAED;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAC5B,kBAAkB,GAClB,0BAA0B,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAE1D;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,iBAAiB,GAAG,SAAS,EACrC,IAAI,EAAE,WAAW,GAChB,oBAAoB,CAQtB;AAED,uFAAuF;AACvF,MAAM,WAAW,oBAAoB;IACnC,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,iFAAiF;IACjF,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAsDD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,CAAC,EAAE,oBAAoB,GAC1B,CAAC,IAAI,EAAE,WAAW,KAAK,OAAO,CAsBhC;AAED;;;;GAIG;AACH,MAAM,MAAM,aAAa,GACrB;IACE,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,yEAAyE;IACzE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,wFAAwF;IACxF,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC;;;;;;;;;;OAUG;IACH,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC;CAC1C,GACD;IACE,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,SAAS,EAAE,YAAY,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC;CAC1C,CAAC;AAEN,MAAM,WAAW,aAAa,CAAC,CAAC;IAC9B,mFAAmF;IACnF,WAAW,EACP,aAAa,EAAE,GACf,CAAC,CAAC,SAAS,EAAE,CAAC,KAAK,aAAa,EAAE,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;IACnE;;;;OAIG;IACH,YAAY,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC,KAAK,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC1E,6CAA6C;IAC7C,OAAO,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;IAC5B,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CAC5D;AAED,MAAM,WAAW,OAAO;IACtB,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IACnD,kEAAkE;IAClE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,OAAO,CAAC,CAAC;IACxB,IAAI,CAAC,SAAS,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtC;AAID,OAAO,EAAE,aAAa,EAAE,CAAC;AAEzB;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,EACtC,SAAS,EAAE,CAAC,EACZ,OAAO,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,GAC1B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAgBjC;AAED,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAuHrE"}
|
package/dist/host.js
CHANGED
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import { createMCPClient, } from "@ai-sdk/mcp";
|
|
2
2
|
import { isBlockedHost, isBlockedResolved, isHostAllowed, } from "@intentface/latch-net";
|
|
3
|
+
import { createGuardedFetch } from "./guarded-fetch.js";
|
|
3
4
|
/**
|
|
4
5
|
* What the model sees of an MCP tool result, fixed for structured-only servers.
|
|
5
6
|
*
|
|
@@ -177,9 +178,15 @@ export function createMcpHost(config) {
|
|
|
177
178
|
? await config.connections(principal)
|
|
178
179
|
: config.connections;
|
|
179
180
|
const clients = [];
|
|
181
|
+
// Fetches built here (not supplied by the caller) are ours to close —
|
|
182
|
+
// their keep-alive sockets would otherwise outlive the turn.
|
|
183
|
+
const ownedFetches = [];
|
|
180
184
|
const tools = {};
|
|
181
185
|
const toolApproval = {};
|
|
182
|
-
const closeAll = () => Promise.all(
|
|
186
|
+
const closeAll = () => Promise.all([
|
|
187
|
+
...clients.map((c) => c.close().catch(() => { })),
|
|
188
|
+
...ownedFetches.map((f) => f.close().catch(() => { })),
|
|
189
|
+
]).then(() => undefined);
|
|
183
190
|
for (const conn of connections) {
|
|
184
191
|
// SSRF guard is a HARD failure (security): an unlisted host throws,
|
|
185
192
|
// before any socket opens.
|
|
@@ -210,6 +217,21 @@ export function createMcpHost(config) {
|
|
|
210
217
|
}
|
|
211
218
|
else {
|
|
212
219
|
const headers = await buildAuthHeaders(conn, principal, config.secrets);
|
|
220
|
+
// The check above resolved the hostname; `fetch` would resolve it
|
|
221
|
+
// AGAIN when the socket opens, and a name that answers public to
|
|
222
|
+
// the first and private to the second reaches an internal service
|
|
223
|
+
// carrying this connection's credentials. A guarded fetch vets
|
|
224
|
+
// inside the lookup the socket uses, closing that gap. A
|
|
225
|
+
// caller-supplied `fetch` wins — `createMcpConnections` passes one
|
|
226
|
+
// that is already guarded.
|
|
227
|
+
let connFetch = conn.fetch;
|
|
228
|
+
if (!connFetch) {
|
|
229
|
+
const guarded = createGuardedFetch({
|
|
230
|
+
allowPrivateHost: conn.allowPrivateHost,
|
|
231
|
+
});
|
|
232
|
+
ownedFetches.push(guarded);
|
|
233
|
+
connFetch = guarded;
|
|
234
|
+
}
|
|
213
235
|
client = await createMCPClient({
|
|
214
236
|
transport: {
|
|
215
237
|
type: "http",
|
|
@@ -217,7 +239,7 @@ export function createMcpHost(config) {
|
|
|
217
239
|
headers,
|
|
218
240
|
authProvider: conn.authProvider, // OAuth (auto-refresh) if present
|
|
219
241
|
redirect: "error", // no redirect-based SSRF
|
|
220
|
-
fetch:
|
|
242
|
+
fetch: connFetch, // address-guarded; normalizing on top, if set
|
|
221
243
|
},
|
|
222
244
|
});
|
|
223
245
|
}
|
package/dist/host.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"host.js","sourceRoot":"","sources":["../src/host.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,GAIhB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,aAAa,GACd,MAAM,uBAAuB,CAAC;
|
|
1
|
+
{"version":3,"file":"host.js","sourceRoot":"","sources":["../src/host.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,GAIhB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,aAAa,GACd,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,kBAAkB,EAAqB,MAAM,oBAAoB,CAAC;AAiB3E;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,6BAA6B,CAC3C,QAAgD;IAEhD,OAAO,CAAC,IAAI,EAAE,EAAE;QACd,MAAM,MAAM,GAAG,IAAI,CAAC,MAIZ,CAAC;QACT,IACE,MAAM;YACN,OAAO,MAAM,KAAK,QAAQ;YAC1B,CAAC,MAAM,CAAC,OAAO;YACf,MAAM,CAAC,iBAAiB,IAAI,IAAI;YAChC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;YAC7B,uEAAuE;YACvE,4DAA4D;YAC5D,MAAM,CAAC,OAAO,CAAC,KAAK,CAClB,CAAC,IAAI,EAAE,EAAE,CACP,CAAE,IAAyC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;gBACzD,IAA0B,CAAC,IAAI,KAAK,MAAM,CAC9C,EACD,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC3D,CAAC;QACD,OAAO,QAAQ;YACb,CAAC,CAAE,QAAwC,CAAC,IAAI,CAAC;YACjD,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IAC3C,CAAC,CAAC;AACJ,CAAC;AA0CD,6EAA6E;AAC7E,SAAS,wBAAwB,CAAC,IAAiB;IACjD,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;IACjC,OAAO,CAAC,CAAC,eAAe,KAAK,IAAI,IAAI,CAAC,CAAC,YAAY,KAAK,KAAK,CAAC;AAChE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAqC,EACrC,IAAiB;IAEjB,MAAM,CAAC,GAAG,MAAM,IAAI,aAAa,CAAC;IAClC,IAAI,OAAO,CAAC,KAAK,UAAU;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC/B,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAqC,EACrC,IAAiB;IAEjB,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC5C,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,qEAAqE;QACrE,OAAO,KAAK,EAAE,KAAc,EAAE,EAAE,CAC9B,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC;AAUD,oEAAoE;AACpE,MAAM,mBAAmB,GAAG;IAC1B,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,KAAK;IACL,KAAK;IACL,MAAM;IACN,OAAO;IACP,KAAK;IACL,QAAQ;IACR,MAAM;IACN,MAAM;IACN,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,SAAS;IACT,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,WAAW;IACX,MAAM;IACN,SAAS;IACT,SAAS;IACT,MAAM;IACN,OAAO;CACR,CAAC;AAEF,wEAAwE;AACxE,MAAM,yBAAyB,GAAG;IAChC,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,SAAS;IACT,SAAS;IACT,OAAO;CACR,CAAC;AAEF,kFAAkF;AAClF,SAAS,iBAAiB,CAAC,CAAS;IAClC,OAAO,CAAC,CAAC,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAA2B;IAE3B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CACtB,IAAI,GAAG,CAAC;QACN,GAAG,mBAAmB;QACtB,GAAG,yBAAyB;QAC5B,GAAG,CAAC,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,EAAE,gBAAgB,IAAI,EAAE,CAAC;KAClC,CAAC,CACH,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,MAAM,CACxB,KAAK,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,EACnD,GAAG,CACJ,CAAC;IACF,OAAO,CAAC,IAAiB,EAAW,EAAE;QACpC,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;QACjC,2EAA2E;QAC3E,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACpE,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;QACD,wDAAwD;QACxD,OAAO,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,CAAC,CAAC;AACJ,CAAC;AA+FD,4EAA4E;AAC5E,+DAA+D;AAC/D,OAAO,EAAE,aAAa,EAAE,CAAC;AAEzB;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAsC,EACtC,SAAY,EACZ,OAA2B;IAE3B,IAAI,CAAC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IAC1B,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;IAClE,SAAS;IACT,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,CAAC,IAAI,2DAA2D,CACxF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,CAAC,IAAI,cAAc,IAAI,CAAC,IAAI,CAAC,QAAQ,6BAA6B,CAC1F,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,aAAa,CAAI,MAAwB;IACvD,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,SAAS;YAClB,MAAM,OAAO,GACX,OAAO,MAAM,CAAC,YAAY,KAAK,UAAU;gBACvC,CAAC,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC;gBACtC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;YAC1B,MAAM,WAAW,GACf,OAAO,MAAM,CAAC,WAAW,KAAK,UAAU;gBACtC,CAAC,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC;gBACrC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;YAEzB,MAAM,OAAO,GAAgB,EAAE,CAAC;YAChC,sEAAsE;YACtE,6DAA6D;YAC7D,MAAM,YAAY,GAAmB,EAAE,CAAC;YACxC,MAAM,KAAK,GAA4B,EAAE,CAAC;YAC1C,MAAM,YAAY,GAAyC,EAAE,CAAC;YAC9D,MAAM,QAAQ,GAAG,GAAG,EAAE,CACpB,OAAO,CAAC,GAAG,CAAC;gBACV,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAChD,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;aACtD,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAE3B,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;gBAC/B,oEAAoE;gBACpE,2BAA2B;gBAC3B,IAAI,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,EAAE,CAAC;oBAC3B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;oBACxC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;wBAClC,MAAM,QAAQ,EAAE,CAAC;wBACjB,MAAM,IAAI,KAAK,CACb,yCAAyC,IAAI,iBAAiB,IAAI,CAAC,IAAI,IAAI,CAC5E,CAAC;oBACJ,CAAC;oBACD,iEAAiE;oBACjE,sEAAsE;oBACtE,mEAAmE;oBACnE,qDAAqD;oBACrD,IACE,CAAC,IAAI,CAAC,gBAAgB;wBACtB,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EACxD,CAAC;wBACD,MAAM,QAAQ,EAAE,CAAC;wBACjB,MAAM,IAAI,KAAK,CACb,oDAAoD,IAAI,iBAAiB,IAAI,CAAC,IAAI,4DAA4D,CAC/I,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,qEAAqE;gBACrE,iEAAiE;gBACjE,IAAI,CAAC;oBACH,IAAI,MAAiB,CAAC;oBACtB,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;wBACxB,MAAM,GAAG,MAAM,eAAe,CAAC;4BAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;yBACe,CAAC,CAAC;oBAC9C,CAAC;yBAAM,CAAC;wBACN,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;wBACxE,kEAAkE;wBAClE,iEAAiE;wBACjE,kEAAkE;wBAClE,+DAA+D;wBAC/D,yDAAyD;wBACzD,mEAAmE;wBACnE,2BAA2B;wBAC3B,IAAI,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC;wBAC3B,IAAI,CAAC,SAAS,EAAE,CAAC;4BACf,MAAM,OAAO,GAAG,kBAAkB,CAAC;gCACjC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;6BACxC,CAAC,CAAC;4BACH,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;4BAC3B,SAAS,GAAG,OAAO,CAAC;wBACtB,CAAC;wBACD,MAAM,GAAG,MAAM,eAAe,CAAC;4BAC7B,SAAS,EAAE;gCACT,IAAI,EAAE,MAAM;gCACZ,GAAG,EAAE,IAAI,CAAC,GAAG;gCACb,OAAO;gCACP,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,kCAAkC;gCACnE,QAAQ,EAAE,OAAO,EAAE,yBAAyB;gCAC5C,KAAK,EAAE,SAAS,EAAE,8CAA8C;6BACjE;yBACuC,CAAC,CAAC;oBAC9C,CAAC;oBACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBACrB,kEAAkE;oBAClE,qEAAqE;oBACrE,qEAAqE;oBACrE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;oBACtC,MAAM,WAAW,GAAG,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;oBACtD,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CACvD,CAAC;oBACF,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;wBACvD,MAAM,IAAI,GAAgB,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;wBACvE,mEAAmE;wBACnE,gEAAgE;wBAChE,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;4BAAE,SAAS;wBAClD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,gCAAgC;wBACpE,kEAAkE;wBAClE,8DAA8D;wBAC9D,6BAA6B;wBAC7B,MAAM,OAAO,GAAG,IAAoD,CAAC;wBACrE,KAAK,CAAC,GAAG,CAAC,GAAG;4BACX,GAAG,OAAO;4BACV,aAAa,EAAE,6BAA6B,CAAC,OAAO,CAAC,aAAa,CAAC;yBACpE,CAAC;wBACF,MAAM,aAAa,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;wBAC5D,IAAI,aAAa,KAAK,SAAS;4BAAE,YAAY,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC;oBACrE,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC/C,CAAC;YACH,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QAClD,CAAC;KACF,CAAC;AACJ,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -10,6 +10,8 @@ export type { McpHost, McpHostConfig, McpConnection, McpAuth, McpApprovalPolicy,
|
|
|
10
10
|
export { createMcpOAuth, createVaultOAuthProvider, decodeOAuthState, } from "./oauth.js";
|
|
11
11
|
export type { McpOAuth, McpOAuthConfig, StartResult } from "./oauth.js";
|
|
12
12
|
export { createOAuthDiscoveryFetch } from "./oauth-fetch.js";
|
|
13
|
+
export { createGuardedFetch, composeGuardedFetch } from "./guarded-fetch.js";
|
|
14
|
+
export type { GuardedFetch, GuardedFetchOptions } from "./guarded-fetch.js";
|
|
13
15
|
export type { OAuthDiscoveryFetchOptions, FetchFunction, } from "./oauth-fetch.js";
|
|
14
16
|
export { createMcpConnections, defineMcpConnection, none, bearer, headers, oauth, } from "./connections.js";
|
|
15
17
|
export type { McpConnections, McpConnectionsConfig, McpConnectionDef, McpConnectionAuth, OAuthAuthOptions, ConnectionStatus, } from "./connections.js";
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,OAAO,EACP,aAAa,EACb,aAAa,EACb,OAAO,EACP,iBAAiB,EACjB,eAAe,EACf,oBAAoB,EACpB,WAAW,EACX,oBAAoB,EACpB,OAAO,GACR,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,YAAY,EACV,0BAA0B,EAC1B,aAAa,GACd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,IAAI,EACJ,MAAM,EACN,OAAO,EACP,KAAK,GACN,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,OAAO,EACP,aAAa,EACb,aAAa,EACb,OAAO,EACP,iBAAiB,EACjB,eAAe,EACf,oBAAoB,EACpB,WAAW,EACX,oBAAoB,EACpB,OAAO,GACR,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC7E,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,YAAY,EACV,0BAA0B,EAC1B,aAAa,GACd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,IAAI,EACJ,MAAM,EACN,OAAO,EACP,KAAK,GACN,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -8,5 +8,6 @@
|
|
|
8
8
|
export { createMcpHost, isHostAllowed, buildAuthHeaders, needsMcpApproval, mcpApprovalValue, nameHeuristicApproval, } from "./host.js";
|
|
9
9
|
export { createMcpOAuth, createVaultOAuthProvider, decodeOAuthState, } from "./oauth.js";
|
|
10
10
|
export { createOAuthDiscoveryFetch } from "./oauth-fetch.js";
|
|
11
|
+
export { createGuardedFetch, composeGuardedFetch } from "./guarded-fetch.js";
|
|
11
12
|
export { createMcpConnections, defineMcpConnection, none, bearer, headers, oauth, } from "./connections.js";
|
|
12
13
|
//# sourceMappingURL=index.js.map
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,WAAW,CAAC;AAanB,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,WAAW,CAAC;AAanB,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAM7E,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,IAAI,EACJ,MAAM,EACN,OAAO,EACP,KAAK,GACN,MAAM,kBAAkB,CAAC"}
|
package/dist/oauth.d.ts
CHANGED
|
@@ -33,7 +33,19 @@ export interface McpOAuthConfig<P = unknown> {
|
|
|
33
33
|
* in the caller's Vault).
|
|
34
34
|
*/
|
|
35
35
|
clientInformation?: OAuthClientInformation | ((principal: P) => OAuthClientInformation | undefined | Promise<OAuthClientInformation | undefined>);
|
|
36
|
-
/**
|
|
36
|
+
/**
|
|
37
|
+
* Origins permitted to act as this connection's OAuth authorization server.
|
|
38
|
+
*
|
|
39
|
+
* DEFAULT: the MCP server's own origin. The authorization server is named by
|
|
40
|
+
* the MCP server's own protected-resource metadata, so without a bound this
|
|
41
|
+
* is "fetch, register a client with, and send a code to whatever address the
|
|
42
|
+
* server operator writes down" — an SSRF whose errors carry the response
|
|
43
|
+
* body back to the user who added the connection.
|
|
44
|
+
*
|
|
45
|
+
* A server that genuinely delegates to a separate IdP is the exception, and
|
|
46
|
+
* an exception should be declared: list its origin here. An empty array is
|
|
47
|
+
* NOT "allow any" — it allows nothing.
|
|
48
|
+
*/
|
|
37
49
|
allowedAuthorizationServers?: string[];
|
|
38
50
|
/**
|
|
39
51
|
* Requested scope string, if the server expects one.
|
package/dist/oauth.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAG5B,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,cAAc,CAAC,CAAC,GAAG,OAAO;IACzC,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,SAAS,EAAE,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACjE,gEAAgE;IAChE,WAAW,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,cAAc,EAAE,mBAAmB,CAAC;IACpC;;;;;;OAMG;IACH,iBAAiB,CAAC,EACd,sBAAsB,GACtB,CAAC,CAAC,SAAS,EAAE,CAAC,KAAK,sBAAsB,GAAG,SAAS,GAAG,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAAC,CAAC;IACzG
|
|
1
|
+
{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAG5B,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,cAAc,CAAC,CAAC,GAAG,OAAO;IACzC,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,SAAS,EAAE,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACjE,gEAAgE;IAChE,WAAW,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,cAAc,EAAE,mBAAmB,CAAC;IACpC;;;;;;OAMG;IACH,iBAAiB,CAAC,EACd,sBAAsB,GACtB,CAAC,CAAC,SAAS,EAAE,CAAC,KAAK,sBAAsB,GAAG,SAAS,GAAG,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAAC,CAAC;IACzG;;;;;;;;;;;;OAYG;IACH,2BAA2B,CAAC,EAAE,MAAM,EAAE,CAAC;IACvC;;;;;;;;;OASG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC,KAAK,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IACtF;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,CACpB,SAAS,EAAE,MAAM,GAAG,GAAG,EACvB,QAAQ,CAAC,EAAE,MAAM,KACd,GAAG,GAAG,SAAS,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAAC;IAChD;;;;;OAKG;IACH,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9C;AAgCD,gFAAgF;AAChF,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAYrC;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,IAAI,EAAE;IAChD,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAChB,SAAS,EAAE,CAAC,CAAC;IACb,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;IAC1B,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC,GAAG;IAAE,QAAQ,EAAE,mBAAmB,CAAC;IAAC,oBAAoB,EAAE,MAAM,GAAG,GAAG,SAAS,CAAA;CAAE,CAoHjF;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,MAAM,EAAE,YAAY,CAAA;CAAE,CAAC;AAE7B,MAAM,WAAW,QAAQ,CAAC,CAAC;IACzB,mEAAmE;IACnE,YAAY,CAAC,SAAS,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C;;;;OAIG;IACH,KAAK,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACtF,oFAAoF;IACpF,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,YAAY,CAAA;KAAE,CAAC,CAAC;IAClG,6EAA6E;IAC7E,QAAQ,CAAC,SAAS,EAAE,CAAC,GAAG,mBAAmB,CAAC;CAC7C;AAED,wBAAgB,cAAc,CAAC,CAAC,EAAE,IAAI,EAAE;IACtC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAChB,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;CAC3B,GAAG,QAAQ,CAAC,CAAC,CAAC,CA2Dd"}
|
package/dist/oauth.js
CHANGED
|
@@ -124,12 +124,16 @@ export function createVaultOAuthProvider(opts) {
|
|
|
124
124
|
? async (serverUrl, resource) => config.validateResourceURL(serverUrl, resource)
|
|
125
125
|
: undefined,
|
|
126
126
|
validateAuthorizationServerURL(serverUrl, authorizationServerUrl) {
|
|
127
|
-
|
|
128
|
-
|
|
129
|
-
|
|
127
|
+
// Undefined → the server's own origin, not "anything". `serverUrl` is the
|
|
128
|
+
// one the SDK resolved for this flow, so a per-principal `serverUrl`
|
|
129
|
+
// function is honoured without resolving it twice.
|
|
130
|
+
const allow = config.allowedAuthorizationServers ?? [new URL(serverUrl).origin];
|
|
130
131
|
const origin = new URL(authorizationServerUrl).origin;
|
|
131
132
|
if (!allow.includes(origin)) {
|
|
132
|
-
throw new Error(`MCP OAuth "${config.name}": authorization server ${origin} is not allowed`
|
|
133
|
+
throw new Error(`MCP OAuth "${config.name}": authorization server ${origin} is not allowed` +
|
|
134
|
+
` (permitted: ${allow.join(", ") || "none"}).` +
|
|
135
|
+
" Set allowedAuthorizationServers on the connection's oauth() options" +
|
|
136
|
+
" if this server delegates authorization elsewhere.");
|
|
133
137
|
}
|
|
134
138
|
},
|
|
135
139
|
async invalidateCredentials(which) {
|
package/dist/oauth.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,IAAI,GAML,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,IAAI,GAML,MAAM,aAAa,CAAC;AA0FrB,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE,CAAC,aAAa,IAAI,IAAI,IAAI,EAAE,CAAC;AAE7E,SAAS,WAAW;IAClB,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,+EAA+E;AAC/E,8EAA8E;AAC9E,+EAA+E;AAC/E,4EAA4E;AAC5E,gFAAgF;AAEhF,SAAS,YAAY,CAAC,IAAa;IACjC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,EAAE,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC7E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACtB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,gBAAgB,CAC9B,KAAgC;IAEhC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACnD,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO;YAC3C,CAAC,CAAE,OAAmC;YACtC,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAI,IAM3C;IACC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IACrD,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAExD,IAAI,QAAyB,CAAC;IAE9B,MAAM,QAAQ,GAAwB;QACpC,IAAI,WAAW;YACb,OAAO,MAAM,CAAC,WAAW,CAAC;QAC5B,CAAC;QACD,IAAI,cAAc;YAChB,OAAO,MAAM,CAAC,cAAc,CAAC;QAC/B,CAAC;QAED,KAAK,CAAC,MAAM;YACV,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YACpD,OAAO,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5D,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,MAAM;YACrB,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAClE,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,QAAQ;YAC7B,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,CAAC;QACtD,CAAC;QACD,KAAK,CAAC,YAAY;YAChB,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;YACpD,IAAI,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,cAAc,MAAM,CAAC,IAAI,+BAA+B,CAAC,CAAC;YAClF,OAAO,CAAC,CAAC;QACX,CAAC;QAED,KAAK,CAAC,iBAAiB;YACrB,oEAAoE;YACpE,6CAA6C;YAC7C,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;gBAC7B,MAAM,EAAE,GACN,OAAO,MAAM,CAAC,iBAAiB,KAAK,UAAU;oBAC5C,CAAC,CAAC,MAAM,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC;oBAC3C,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC;gBAC/B,IAAI,EAAE;oBAAE,OAAO,EAAE,CAAC;YACpB,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YACpD,OAAO,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,CAAC;QACD,KAAK,CAAC,qBAAqB,CAAC,IAAI;YAC9B,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAChE,CAAC;QAED,6EAA6E;QAC7E,yEAAyE;QACzE,6EAA6E;QAC7E,6EAA6E;QAC7E,6DAA6D;QAC7D,KAAK,CAAC,8BAA8B;YAGlC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;YACrD,OAAO,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpF,CAAC;QACD,KAAK,CAAC,kCAAkC,CAAC,IAAI;YAC3C,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACjE,CAAC;QAED,KAAK;YACH,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;YAC3B,OAAO,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC;gBACnD,CAAC,CAAC,GAAG,IAAI,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE;gBACtC,CAAC,CAAC,IAAI,CAAC;QACX,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,KAAK;YACnB,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;QACD,KAAK,CAAC,WAAW;YACf,OAAO,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;QAC/D,CAAC;QAED,uBAAuB,CAAC,GAAG;YACzB,QAAQ,GAAG,GAAG,CAAC,CAAC,0CAA0C;QAC5D,CAAC;QAED,2DAA2D;QAC3D,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;YAC7C,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,CAC5B,MAAM,CAAC,mBAAoB,CAAC,SAAS,EAAE,QAAQ,CAAC;YACpD,CAAC,CAAC,SAAS;QAEb,8BAA8B,CAAC,SAAS,EAAE,sBAAsB;YAC9D,0EAA0E;YAC1E,qEAAqE;YACrE,mDAAmD;YACnD,MAAM,KAAK,GAAG,MAAM,CAAC,2BAA2B,IAAI,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;YAChF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC;YACtD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CACb,cAAc,MAAM,CAAC,IAAI,2BAA2B,MAAM,iBAAiB;oBACzE,gBAAgB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,IAAI;oBAC9C,sEAAsE;oBACtE,oDAAoD,CACvD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,KAAK,CAAC,qBAAqB,CAAC,KAAK;YAC/B,MAAM,KAAK,GACT,KAAK,KAAK,KAAK;gBACb,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC;gBACtD,CAAC,CAAC,KAAK,KAAK,QAAQ;oBAClB,CAAC,CAAC,CAAC,QAAQ,CAAC;oBACZ,CAAC,CAAC,KAAK,KAAK,UAAU;wBACpB,CAAC,CAAC,CAAC,UAAU,CAAC;wBACd,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACrB,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,CAAC;KACF,CAAC;IAEF,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;AAC5D,CAAC;AAqBD,MAAM,UAAU,cAAc,CAAI,IAGjC;IACC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC/B,MAAM,gBAAgB,GAAG,CAAC,SAAY,EAA4B,EAAE,CAClE,OAAO,MAAM,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;IAC1F,MAAM,YAAY,GAAG,CAAC,SAAY,EAAoD,EAAE,CACtF,OAAO,MAAM,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;IAC9E,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,SAAS;YAC1B,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC/D,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI;YACzB,MAAM,EAAE,QAAQ,EAAE,oBAAoB,EAAE,GAAG,wBAAwB,CAAC;gBAClE,KAAK;gBACL,SAAS;gBACT,MAAM;gBACN,SAAS,EAAE,IAAI,EAAE,KAAK;aACvB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE;gBAClC,SAAS,EAAE,MAAM,gBAAgB,CAAC,SAAS,CAAC;gBAC5C,KAAK,EAAE,MAAM,YAAY,CAAC,SAAS,CAAC;gBACpC,OAAO,EAAE,MAAM,CAAC,KAAK;aACtB,CAAC,CAAC;YACH,IAAI,MAAM,KAAK,YAAY;gBAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;YAC7D,MAAM,GAAG,GAAG,oBAAoB,EAAE,CAAC;YACnC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,KAAK,CACb,cAAc,MAAM,CAAC,IAAI,4DAA4D,CACtF,CAAC;YACJ,CAAC;YACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC5E,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACnC,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;QAClE,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM;YAC5B,MAAM,EAAE,QAAQ,EAAE,GAAG,wBAAwB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5E,MAAM,IAAI,CAAC,QAAQ,EAAE;gBACnB,SAAS,EAAE,MAAM,gBAAgB,CAAC,SAAS,CAAC;gBAC5C,iBAAiB,EAAE,MAAM,CAAC,IAAI;gBAC9B,aAAa,EAAE,MAAM,CAAC,KAAK;gBAC3B,OAAO,EAAE,MAAM,CAAC,KAAK;aACtB,CAAC,CAAC;YACH,wEAAwE;YACxE,wEAAwE;YACxE,qEAAqE;YACrE,sEAAsE;YACtE,MAAM,OAAO,CAAC,GAAG,CAAC;gBAChB,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACvD,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;aAC3D,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QAClC,CAAC;QAED,QAAQ,CAAC,SAAS;YAChB,OAAO,wBAAwB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC;QACzE,CAAC;KACF,CAAC;AACJ,CAAC"}
|
package/dist/oauth.test.js
CHANGED
|
@@ -208,4 +208,68 @@ describe("invalidateCredentials", () => {
|
|
|
208
208
|
expect(await vault.get(theirs, "mcp_oauth:loredex:tokens")).toBe("theirs");
|
|
209
209
|
});
|
|
210
210
|
});
|
|
211
|
+
/**
|
|
212
|
+
* The authorization-server allowlist.
|
|
213
|
+
*
|
|
214
|
+
* An MCP server's protected-resource metadata NAMES its authorization server,
|
|
215
|
+
* and Latch then fetches that server's metadata, registers a client with it and
|
|
216
|
+
* posts the code to it. Unbounded, that is "connect to whatever address the
|
|
217
|
+
* server operator writes down" — an SSRF whose errors carry the response back
|
|
218
|
+
* to whoever added the connection. So the bound defaults to the MCP server's
|
|
219
|
+
* own origin, and delegating elsewhere has to be declared.
|
|
220
|
+
*/
|
|
221
|
+
describe("authorization-server allowlist", () => {
|
|
222
|
+
const principal = { userId: "u1" };
|
|
223
|
+
const serverUrl = "https://loredex.example/ws/mcp";
|
|
224
|
+
function providerFor(allowedAuthorizationServers) {
|
|
225
|
+
const vault = fakeVault();
|
|
226
|
+
return createMcpOAuth({
|
|
227
|
+
vault: vault,
|
|
228
|
+
config: {
|
|
229
|
+
name: "loredex",
|
|
230
|
+
serverUrl,
|
|
231
|
+
redirectUrl: "https://latch.example/cb",
|
|
232
|
+
clientMetadata: {
|
|
233
|
+
client_name: "Latch (loredex)",
|
|
234
|
+
redirect_uris: ["https://latch.example/cb"],
|
|
235
|
+
},
|
|
236
|
+
...(allowedAuthorizationServers ? { allowedAuthorizationServers } : {}),
|
|
237
|
+
},
|
|
238
|
+
}).provider(principal);
|
|
239
|
+
}
|
|
240
|
+
const validate = (p, as) => p.validateAuthorizationServerURL(serverUrl, as);
|
|
241
|
+
it("undeclared, an authorization server on another origin is refused", () => {
|
|
242
|
+
// The whole attack in one line: the metadata names an internal address.
|
|
243
|
+
expect(() => validate(providerFor(), "http://10.0.0.7:8500/register")).toThrow(/authorization server http:\/\/10\.0\.0\.7:8500 is not allowed/);
|
|
244
|
+
});
|
|
245
|
+
it("undeclared, the MCP server's own origin is allowed", () => {
|
|
246
|
+
// The common case — a server that is its own authorization server — keeps
|
|
247
|
+
// working with no host configuration at all.
|
|
248
|
+
expect(() => validate(providerFor(), "https://loredex.example/oauth/authorize")).not.toThrow();
|
|
249
|
+
});
|
|
250
|
+
it("a declared third-party authorization server is allowed", () => {
|
|
251
|
+
const p = providerFor(["https://accounts.google.com"]);
|
|
252
|
+
expect(() => validate(p, "https://accounts.google.com/o/oauth2/v2/auth")).not.toThrow();
|
|
253
|
+
// …and declaring one does not re-admit everything else.
|
|
254
|
+
expect(() => validate(p, "http://169.254.169.254/")).toThrow(/is not allowed/);
|
|
255
|
+
});
|
|
256
|
+
it("an empty list allows nothing, rather than everything", () => {
|
|
257
|
+
// The old reading of `[]` was "not configured → allow any", which is how
|
|
258
|
+
// the guard came to be dead code.
|
|
259
|
+
expect(() => validate(providerFor([]), "https://loredex.example/oauth/authorize")).toThrow(/is not allowed/);
|
|
260
|
+
});
|
|
261
|
+
it("the refusal names the origin and quotes no response body", () => {
|
|
262
|
+
let message = "";
|
|
263
|
+
try {
|
|
264
|
+
validate(providerFor(), "http://10.0.0.7:8500/register");
|
|
265
|
+
}
|
|
266
|
+
catch (e) {
|
|
267
|
+
message = e.message;
|
|
268
|
+
}
|
|
269
|
+
expect(message).toContain("http://10.0.0.7:8500");
|
|
270
|
+
expect(message).toContain("allowedAuthorizationServers");
|
|
271
|
+
// The SDK's own errors embed `Raw body: …`; ours must never grow one.
|
|
272
|
+
expect(message).not.toMatch(/raw body|<html|\{"error"/i);
|
|
273
|
+
});
|
|
274
|
+
});
|
|
211
275
|
//# sourceMappingURL=oauth.test.js.map
|
package/dist/oauth.test.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oauth.test.js","sourceRoot":"","sources":["../src/oauth.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAE9D;;;;;;;;;;GAUG;AAEH,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAE3C,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5B,IAAI,EAAE,QAAQ;CACf,CAAC,CAAC,CAAC;AAEJ,MAAM,EAAE,cAAc,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;AAMxE,4EAA4E;AAC5E,SAAS,SAAS;IAChB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,MAAM,CAAC,GAAG,CAAC,CAAI,EAAE,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;IACvD,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,CAAI,EAAE,GAAW,EAAE,KAAa;YACxC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,CAAI,EAAE,GAAW;YACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,CAAI,EAAE,GAAW;YACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,CAAI,EAAE,GAAW;YAC5B,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC1B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,CAAI;YACb,OAAO,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QACxE,CAAC;QACD,QAAQ,EAAE,EAAW;QACrB,MAAM,EAAE,KAAK;KACd,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,KAAc,EAAE,KAAK,GAAG,SAAS,EAAE;IAChD,OAAO;QACL,KAAK;QACL,KAAK,EAAE,cAAc,CAAI;YACvB,KAAK,EAAE,KAAc;YACrB,MAAM,EAAE;gBACN,IAAI,EAAE,SAAS;gBACf,SAAS,EAAE,gCAAgC;gBAC3C,WAAW,EAAE,0BAA0B;gBACvC,cAAc,EAAE;oBACd,WAAW,EAAE,iBAAiB;oBAC9B,aAAa,EAAE,CAAC,0BAA0B,CAAC;iBACnC;gBACV,KAAK,EAAE,KAAc;aACtB;SACF,CAAC;KACH,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;AAE/D,UAAU,CAAC,GAAG,EAAE;IACd,QAAQ,CAAC,SAAS,EAAE,CAAC;IACrB,QAAQ,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;AAC3C,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;QACxC,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,wEAAwE;QACxE,qEAAqE;QACrE,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,MAAM,GAAuC;YACjD,EAAE,EAAE,cAAc;YAClB,EAAE,EAAE,SAAS;SACd,CAAC;QACF,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,CAAC,CAAI,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAEpD,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAEzC,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC;QAEpC,sEAAsE;QACtE,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,2EAA2E;QAC3E,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,CAAI,EAAE,EAAE,CACrC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS,CACxD,CAAC;QACF,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,0EAA0E;IAC1E,uEAAuE;IACvE,qDAAqD;IACrD,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,cAAc,CAAI;YAC9B,KAAK,EAAE,KAAc;YACrB,MAAM,EAAE;gBACN,IAAI,EAAE,MAAM;gBACZ,SAAS,EAAE,oCAAoC;gBAC/C,WAAW,EAAE,0BAA0B;gBACvC,cAAc,EAAE;oBACd,WAAW,EAAE,cAAc;oBAC3B,aAAa,EAAE,CAAC,0BAA0B,CAAC;iBACnC;gBACV,mBAAmB,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE;aACnE;SACF,CAAC,CAAC;QACH,kDAAkD;QAClD,QAAQ,CAAC,sBAAsB,CAAC,KAAK,EAAE,QAEtC,EAAE,EAAE;YACH,QAAQ,CAAC,uBAAuB,CAC9B,IAAI,GAAG,CAAC,6CAA6C,CAAC,CACvD,CAAC;YACF,OAAO,UAAU,CAAC;QACpB,CAAC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAkB;QACzE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5D,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,iEAAiE;QACjE,8DAA8D;QAC9D,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG;YAChB,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,iBAAiB,EAAE;SACzE,CAAC;QACF,IAAI,IAAwB,CAAC;QAC7B,QAAQ,CAAC,sBAAsB,CAAC,KAAK,EAAE,QAItC,EAAE,EAAE;YACH,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC;YACxB,MAAM,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC/B,QAAQ,CAAC,uBAAuB,CAAC,IAAI,GAAG,CAAC,+BAA+B,CAAC,CAAC,CAAC;YAC3E,OAAO,UAAU,CAAC;QACpB,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACrD,MAAM,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACnE,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;IACtB,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,0EAA0E;QAC1E,yDAAyD;QACzD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YACxE,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,qBAAqB,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QACD,QAAQ,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClE,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,4BAA4B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClE,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClE,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,+DAA+D;QAC/D,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC9B,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,yBAAyB,EAAE,GAAG,CAAC,CAAC;QACnD,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,4BAA4B,EAAE,GAAG,CAAC,CAAC;QACtD,QAAQ,CAAC,qBAAqB,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAC7D,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC7E,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,4BAA4B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,wEAAwE;QACxE,qEAAqE;QACrE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YACxE,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,qBAAqB,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACjC,MAAM,MAAM,GAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACnC,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,0BAA0B,EAAE,MAAM,CAAC,CAAC;QAC1D,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,0BAA0B,EAAE,QAAQ,CAAC,CAAC;QAC9D,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
|
|
1
|
+
{"version":3,"file":"oauth.test.js","sourceRoot":"","sources":["../src/oauth.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAE9D;;;;;;;;;;GAUG;AAEH,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAE3C,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5B,IAAI,EAAE,QAAQ;CACf,CAAC,CAAC,CAAC;AAEJ,MAAM,EAAE,cAAc,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;AAMxE,4EAA4E;AAC5E,SAAS,SAAS;IAChB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,MAAM,CAAC,GAAG,CAAC,CAAI,EAAE,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;IACvD,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,CAAI,EAAE,GAAW,EAAE,KAAa;YACxC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,CAAI,EAAE,GAAW;YACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,CAAI,EAAE,GAAW;YACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,CAAI,EAAE,GAAW;YAC5B,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC1B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,CAAI;YACb,OAAO,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QACxE,CAAC;QACD,QAAQ,EAAE,EAAW;QACrB,MAAM,EAAE,KAAK;KACd,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,KAAc,EAAE,KAAK,GAAG,SAAS,EAAE;IAChD,OAAO;QACL,KAAK;QACL,KAAK,EAAE,cAAc,CAAI;YACvB,KAAK,EAAE,KAAc;YACrB,MAAM,EAAE;gBACN,IAAI,EAAE,SAAS;gBACf,SAAS,EAAE,gCAAgC;gBAC3C,WAAW,EAAE,0BAA0B;gBACvC,cAAc,EAAE;oBACd,WAAW,EAAE,iBAAiB;oBAC9B,aAAa,EAAE,CAAC,0BAA0B,CAAC;iBACnC;gBACV,KAAK,EAAE,KAAc;aACtB;SACF,CAAC;KACH,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;AAE/D,UAAU,CAAC,GAAG,EAAE;IACd,QAAQ,CAAC,SAAS,EAAE,CAAC;IACrB,QAAQ,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;AAC3C,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;QACxC,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,wEAAwE;QACxE,qEAAqE;QACrE,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,MAAM,GAAuC;YACjD,EAAE,EAAE,cAAc;YAClB,EAAE,EAAE,SAAS;SACd,CAAC;QACF,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,CAAC,CAAI,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAEpD,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAEzC,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC;QAEpC,sEAAsE;QACtE,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,2EAA2E;QAC3E,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,CAAI,EAAE,EAAE,CACrC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS,CACxD,CAAC;QACF,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,0EAA0E;IAC1E,uEAAuE;IACvE,qDAAqD;IACrD,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,cAAc,CAAI;YAC9B,KAAK,EAAE,KAAc;YACrB,MAAM,EAAE;gBACN,IAAI,EAAE,MAAM;gBACZ,SAAS,EAAE,oCAAoC;gBAC/C,WAAW,EAAE,0BAA0B;gBACvC,cAAc,EAAE;oBACd,WAAW,EAAE,cAAc;oBAC3B,aAAa,EAAE,CAAC,0BAA0B,CAAC;iBACnC;gBACV,mBAAmB,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE;aACnE;SACF,CAAC,CAAC;QACH,kDAAkD;QAClD,QAAQ,CAAC,sBAAsB,CAAC,KAAK,EAAE,QAEtC,EAAE,EAAE;YACH,QAAQ,CAAC,uBAAuB,CAC9B,IAAI,GAAG,CAAC,6CAA6C,CAAC,CACvD,CAAC;YACF,OAAO,UAAU,CAAC;QACpB,CAAC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAkB;QACzE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5D,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,iEAAiE;QACjE,8DAA8D;QAC9D,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG;YAChB,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,iBAAiB,EAAE;SACzE,CAAC;QACF,IAAI,IAAwB,CAAC;QAC7B,QAAQ,CAAC,sBAAsB,CAAC,KAAK,EAAE,QAItC,EAAE,EAAE;YACH,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC;YACxB,MAAM,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC/B,QAAQ,CAAC,uBAAuB,CAAC,IAAI,GAAG,CAAC,+BAA+B,CAAC,CAAC,CAAC;YAC3E,OAAO,UAAU,CAAC;QACpB,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACrD,MAAM,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACnE,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;IACtB,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,0EAA0E;QAC1E,yDAAyD;QACzD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YACxE,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,qBAAqB,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QACD,QAAQ,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClE,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,4BAA4B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClE,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClE,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,+DAA+D;QAC/D,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC9B,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,yBAAyB,EAAE,GAAG,CAAC,CAAC;QACnD,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,4BAA4B,EAAE,GAAG,CAAC,CAAC;QACtD,QAAQ,CAAC,qBAAqB,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAC7D,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC7E,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,4BAA4B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,wEAAwE;QACxE,qEAAqE;QACrE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YACxE,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,qBAAqB,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACjC,MAAM,MAAM,GAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACnC,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,0BAA0B,EAAE,MAAM,CAAC,CAAC;QAC1D,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,0BAA0B,EAAE,QAAQ,CAAC,CAAC;QAC9D,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,MAAM,SAAS,GAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,gCAAgC,CAAC;IAEnD,SAAS,WAAW,CAAC,2BAAsC;QACzD,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAC1B,OAAO,cAAc,CAAI;YACvB,KAAK,EAAE,KAAc;YACrB,MAAM,EAAE;gBACN,IAAI,EAAE,SAAS;gBACf,SAAS;gBACT,WAAW,EAAE,0BAA0B;gBACvC,cAAc,EAAE;oBACd,WAAW,EAAE,iBAAiB;oBAC9B,aAAa,EAAE,CAAC,0BAA0B,CAAC;iBACnC;gBACV,GAAG,CAAC,2BAA2B,CAAC,CAAC,CAAC,EAAE,2BAA2B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxE;SACF,CAAC,CAAC,QAAQ,CAAC,SAAS,CAEpB,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,CAAiC,EAAE,EAAU,EAAE,EAAE,CACjE,CAAC,CAAC,8BAA8B,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAElD,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,wEAAwE;QACxE,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,+BAA+B,CAAC,CAAC,CAAC,OAAO,CAC5E,+DAA+D,CAChE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,0EAA0E;QAC1E,6CAA6C;QAC7C,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,yCAAyC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IACjG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,8CAA8C,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACxF,wDAAwD;QACxD,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,yEAAyE;QACzE,kCAAkC;QAClC,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,yCAAyC,CAAC,CAAC,CAAC,OAAO,CACxF,gBAAgB,CACjB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,IAAI,OAAO,GAAG,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,QAAQ,CAAC,WAAW,EAAE,EAAE,+BAA+B,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,GAAI,CAAW,CAAC,OAAO,CAAC;QACjC,CAAC;QACD,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QAClD,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;QACzD,sEAAsE;QACtE,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@intentface/latch-mcp",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.12.0",
|
|
4
4
|
"description": "Latch MCP host — connect to MCP servers as tools, with a per-tenant SSRF allowlist and vault-brokered auth.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"ai",
|
|
@@ -31,16 +31,16 @@
|
|
|
31
31
|
"registry": "https://registry.npmjs.org"
|
|
32
32
|
},
|
|
33
33
|
"dependencies": {
|
|
34
|
-
"@intentface/latch-core": "^0.
|
|
35
|
-
"@intentface/latch-net": "^0.
|
|
34
|
+
"@intentface/latch-core": "^0.12.0",
|
|
35
|
+
"@intentface/latch-net": "^0.12.0"
|
|
36
36
|
},
|
|
37
37
|
"peerDependencies": {
|
|
38
38
|
"@ai-sdk/mcp": ">=2.0.0",
|
|
39
39
|
"ai": ">=7.0.0"
|
|
40
40
|
},
|
|
41
41
|
"devDependencies": {
|
|
42
|
-
"@ai-sdk/mcp": "^2.0.
|
|
43
|
-
"ai": "^7.0.
|
|
42
|
+
"@ai-sdk/mcp": "^2.0.53",
|
|
43
|
+
"ai": "^7.0.106",
|
|
44
44
|
"typescript": "^5.7.0",
|
|
45
45
|
"vitest": "^4"
|
|
46
46
|
},
|