@jeffjassky/oauth-host 0.1.0 → 0.2.0

package/README.md

@@ -48,14 +48,22 @@ app.use('/mcp', oauth.protect('contacts.read'), mcpRouter);
 Register each client once — there is no RFC 7591 dynamic client registration:
 
 ```js
+import { CLAUDE_CONNECTOR_REDIRECT_URI, CLAUDE_CODE_REDIRECT_URIS } from '@jeffjassky/oauth-host';
+
 const { clientId, clientSecret } = await oauth.clients.create({
   name: 'Claude',
-  redirectUris: ['<Claude connector callback, from their docs>'],
+  redirectUris: [CLAUDE_CONNECTOR_REDIRECT_URI, ...CLAUDE_CODE_REDIRECT_URIS],
   allowedScopes: ['openid', 'contacts.read'],
   branding: { publisher: 'Anthropic' },
 });   // secret returned once, never again
 ```
 
+The callbacks ship as constants because `create()` compares them byte-for-byte
+and retyping one out of a vendor's docs is the most typo-prone step in the setup.
+ChatGPT's current callback is per-connector and therefore not a constant — copy
+it from its setup screen. See
+[Vendor callback URLs](https://jeffjassky.github.io/oauth-host/guide/mcp#vendor-callback-urls).
+
 Or let Claude and ChatGPT register themselves with a [client ID metadata
 document](https://jeffjassky.github.io/oauth-host/guide/cimd) — their
 `client_id` is an `https://` URL serving a JSON description of themselves, and

package/dist/index.cjs

@@ -500,6 +500,7 @@ function resolveConfig(config) {
   }
   const store = rateLimits.store ?? memoryStore();
   const normalizedMount = `/${String(mountPath).replace(/^\/+|\/+$/g, "")}`;
+  const indexes = { ready: false };
   const ctx = {
     models,
     issuer,
@@ -531,6 +532,11 @@ function resolveConfig(config) {
     cors: { tokenEndpoint: cors.tokenEndpoint ?? false, origins: cors.origins ?? [] },
     clockSkewMs,
     cimd: resolveCimd(clientIdMetadata, scopeIndex),
+    indexes,
+    async syncIndexes() {
+      await syncModelIndexes(models);
+      indexes.ready = true;
+    },
     logger,
     track,
     async audit(entry) {
@@ -2480,8 +2486,17 @@ function createOAuthRouter(ctx) {
   const ipKey = (req) => req.ip ?? "unknown";
   const clientKey = (req) => clientIdFromRequest(req) ?? ipKey(req);
   const cors = corsMiddleware(ctx);
+  const requireIndexes = w((_req, _res, next) => {
+    if (ctx.indexes.ready) return next();
+    throw new OAuthError(
+      503,
+      "server_error",
+      "This authorization server is not ready: `syncIndexes()` has not resolved yet. Await `oauth.syncIndexes()` at boot, before mounting the routers."
+    );
+  });
   router.get(
     "/authorize",
+    requireIndexes,
     rateLimit(ctx, "authorize", ipKey),
     w(async (req, res) => {
       let validated;
@@ -2540,6 +2555,7 @@ function createOAuthRouter(ctx) {
   router.post(
     "/token",
     cors,
+    requireIndexes,
     form,
     rateLimit(ctx, "token", clientKey),
     w(async (req, res) => {
@@ -2644,6 +2660,7 @@ function createOAuthRouter(ctx) {
   );
   router.post(
     "/consent/:requestId",
+    requireIndexes,
     rateLimit(ctx, "consent", ipKey),
     w(async (req, res) => {
       const user = await requireUser(ctx, req);
@@ -2745,6 +2762,16 @@ function corsMiddleware(ctx) {
   };
 }
 
+// src/server/vendors.ts
+var CLAUDE_CONNECTOR_REDIRECT_URI = "https://claude.ai/api/mcp/auth_callback";
+var CLAUDE_CODE_REDIRECT_URIS = [
+  "http://localhost/callback",
+  "http://127.0.0.1/callback"
+];
+var CHATGPT_LEGACY_REDIRECT_URI = "https://chatgpt.com/connector_platform_oauth_redirect";
+var CHATGPT_CONNECTOR_REDIRECT_URI_PATTERN = "https://chatgpt.com/connector/oauth/{callback_id}";
+var CIMD_ALLOWED_HOSTS = ["claude.ai", "chatgpt.com"];
+
 // src/server/index.ts
 function createOAuthHost(config) {
   const ctx = resolveConfig(config);
@@ -2768,13 +2795,35 @@ function createOAuthHost(config) {
      * stops one user holding two live grants for the same client, and mongoose
      * builds indexes in the background — a cold database will happily serve
      * the write that violates it first. See standards/traps.md #3.
+     *
+     * Resolving this is also what flips `ready` and un-gates `/authorize`,
+     * `POST /consent/:requestId` and `POST /token`.
      */
-    syncIndexes: () => syncModelIndexes(ctx.models),
+    syncIndexes: () => ctx.syncIndexes(),
+    /**
+     * Has `syncIndexes()` resolved?
+     *
+     * A boolean, not a promise, and the difference is the failure mode. A
+     * promise would have to exist from construction, so a host that never calls
+     * `syncIndexes()` would await it forever — a boot-order mistake turning into
+     * an unexplained hang with no message. A boolean is plainly `false`, cannot
+     * be awaited by accident, and is backed by three routes that say what is
+     * wrong by name. Gate a mount on it, or simply
+     * `await oauth.syncIndexes()` first, which is the same thing said directly.
+     */
+    get ready() {
+      return ctx.indexes.ready;
+    },
     /** Escape hatch. Prefer the APIs above; these carry no invariants. */
     models: ctx.models
   };
 }
 
+exports.CHATGPT_CONNECTOR_REDIRECT_URI_PATTERN = CHATGPT_CONNECTOR_REDIRECT_URI_PATTERN;
+exports.CHATGPT_LEGACY_REDIRECT_URI = CHATGPT_LEGACY_REDIRECT_URI;
+exports.CIMD_ALLOWED_HOSTS = CIMD_ALLOWED_HOSTS;
+exports.CLAUDE_CODE_REDIRECT_URIS = CLAUDE_CODE_REDIRECT_URIS;
+exports.CLAUDE_CONNECTOR_REDIRECT_URI = CLAUDE_CONNECTOR_REDIRECT_URI;
 exports.OAuthError = OAuthError;
 exports.RedirectableAuthError = RedirectableAuthError;
 exports.UnredirectableError = UnredirectableError;