@jeffjassky/oauth-host 0.1.0 → 0.2.0

package/dist/index.js

@@ -493,6 +493,7 @@ function resolveConfig(config) {
   }
   const store = rateLimits.store ?? memoryStore();
   const normalizedMount = `/${String(mountPath).replace(/^\/+|\/+$/g, "")}`;
+  const indexes = { ready: false };
   const ctx = {
     models,
     issuer,
@@ -524,6 +525,11 @@ function resolveConfig(config) {
     cors: { tokenEndpoint: cors.tokenEndpoint ?? false, origins: cors.origins ?? [] },
     clockSkewMs,
     cimd: resolveCimd(clientIdMetadata, scopeIndex),
+    indexes,
+    async syncIndexes() {
+      await syncModelIndexes(models);
+      indexes.ready = true;
+    },
     logger,
     track,
     async audit(entry) {
@@ -2473,8 +2479,17 @@ function createOAuthRouter(ctx) {
   const ipKey = (req) => req.ip ?? "unknown";
   const clientKey = (req) => clientIdFromRequest(req) ?? ipKey(req);
   const cors = corsMiddleware(ctx);
+  const requireIndexes = w((_req, _res, next) => {
+    if (ctx.indexes.ready) return next();
+    throw new OAuthError(
+      503,
+      "server_error",
+      "This authorization server is not ready: `syncIndexes()` has not resolved yet. Await `oauth.syncIndexes()` at boot, before mounting the routers."
+    );
+  });
   router.get(
     "/authorize",
+    requireIndexes,
     rateLimit(ctx, "authorize", ipKey),
     w(async (req, res) => {
       let validated;
@@ -2533,6 +2548,7 @@ function createOAuthRouter(ctx) {
   router.post(
     "/token",
     cors,
+    requireIndexes,
     form,
     rateLimit(ctx, "token", clientKey),
     w(async (req, res) => {
@@ -2637,6 +2653,7 @@ function createOAuthRouter(ctx) {
   );
   router.post(
     "/consent/:requestId",
+    requireIndexes,
     rateLimit(ctx, "consent", ipKey),
     w(async (req, res) => {
       const user = await requireUser(ctx, req);
@@ -2738,6 +2755,16 @@ function corsMiddleware(ctx) {
   };
 }
 
+// src/server/vendors.ts
+var CLAUDE_CONNECTOR_REDIRECT_URI = "https://claude.ai/api/mcp/auth_callback";
+var CLAUDE_CODE_REDIRECT_URIS = [
+  "http://localhost/callback",
+  "http://127.0.0.1/callback"
+];
+var CHATGPT_LEGACY_REDIRECT_URI = "https://chatgpt.com/connector_platform_oauth_redirect";
+var CHATGPT_CONNECTOR_REDIRECT_URI_PATTERN = "https://chatgpt.com/connector/oauth/{callback_id}";
+var CIMD_ALLOWED_HOSTS = ["claude.ai", "chatgpt.com"];
+
 // src/server/index.ts
 function createOAuthHost(config) {
   const ctx = resolveConfig(config);
@@ -2761,13 +2788,30 @@ function createOAuthHost(config) {
      * stops one user holding two live grants for the same client, and mongoose
      * builds indexes in the background — a cold database will happily serve
      * the write that violates it first. See standards/traps.md #3.
+     *
+     * Resolving this is also what flips `ready` and un-gates `/authorize`,
+     * `POST /consent/:requestId` and `POST /token`.
      */
-    syncIndexes: () => syncModelIndexes(ctx.models),
+    syncIndexes: () => ctx.syncIndexes(),
+    /**
+     * Has `syncIndexes()` resolved?
+     *
+     * A boolean, not a promise, and the difference is the failure mode. A
+     * promise would have to exist from construction, so a host that never calls
+     * `syncIndexes()` would await it forever — a boot-order mistake turning into
+     * an unexplained hang with no message. A boolean is plainly `false`, cannot
+     * be awaited by accident, and is backed by three routes that say what is
+     * wrong by name. Gate a mount on it, or simply
+     * `await oauth.syncIndexes()` first, which is the same thing said directly.
+     */
+    get ready() {
+      return ctx.indexes.ready;
+    },
     /** Escape hatch. Prefer the APIs above; these carry no invariants. */
     models: ctx.models
   };
 }
 
-export { OAuthError, RedirectableAuthError, UnredirectableError, createModels, createOAuthHost, createUserAdapter, defaultResolveUser, syncModelIndexes };
+export { CHATGPT_CONNECTOR_REDIRECT_URI_PATTERN, CHATGPT_LEGACY_REDIRECT_URI, CIMD_ALLOWED_HOSTS, CLAUDE_CODE_REDIRECT_URIS, CLAUDE_CONNECTOR_REDIRECT_URI, OAuthError, RedirectableAuthError, UnredirectableError, createModels, createOAuthHost, createUserAdapter, defaultResolveUser, syncModelIndexes };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map