@kya-os/mcp-i-cloudflare 1.12.3 → 1.12.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/app.d.ts.map +1 -1
- package/dist/app.js +13 -4
- package/dist/app.js.map +1 -1
- package/dist/config.d.ts +4 -2
- package/dist/config.d.ts.map +1 -1
- package/dist/config.js +9 -3
- package/dist/config.js.map +1 -1
- package/dist/delegation-http/consent-anchor-bridge.d.ts +18 -1
- package/dist/delegation-http/consent-anchor-bridge.d.ts.map +1 -1
- package/dist/delegation-http/consent-anchor-bridge.js +18 -5
- package/dist/delegation-http/consent-anchor-bridge.js.map +1 -1
- package/dist/helpers/env-mapper.d.ts.map +1 -1
- package/dist/helpers/env-mapper.js +2 -0
- package/dist/helpers/env-mapper.js.map +1 -1
- package/dist/services/consent-templates/template-renderer.d.ts.map +1 -1
- package/dist/services/consent-templates/template-renderer.js +6 -4
- package/dist/services/consent-templates/template-renderer.js.map +1 -1
- package/dist/services/consent.service.d.ts +17 -2
- package/dist/services/consent.service.d.ts.map +1 -1
- package/dist/services/consent.service.js +48 -21
- package/dist/services/consent.service.js.map +1 -1
- package/dist/types.d.ts +2 -0
- package/dist/types.d.ts.map +1 -1
- package/package.json +1 -1
|
@@ -318,12 +318,27 @@ export declare class ConsentService {
|
|
|
318
318
|
*/
|
|
319
319
|
handle(request: Request): Promise<Response>;
|
|
320
320
|
/**
|
|
321
|
-
* Serve the consent
|
|
321
|
+
* Serve the consent bundle for CSR mode.
|
|
322
322
|
*
|
|
323
323
|
* Returns the bundled Lit Web Components as JavaScript that browsers
|
|
324
324
|
* can execute to render the <mcp-consent> element.
|
|
325
325
|
*
|
|
326
|
-
*
|
|
326
|
+
* Caching is decided by WHICH path was requested, because only one of them can
|
|
327
|
+
* safely promise immutability:
|
|
328
|
+
*
|
|
329
|
+
* - {@link CONSENT_BUNDLE_PATH} is content-addressed, so its bytes can never
|
|
330
|
+
* change. `immutable` is honest here, and a new build is simply a new URL
|
|
331
|
+
* that the shell points at.
|
|
332
|
+
* - `/consent.js` is a stable, unversioned alias. It previously carried
|
|
333
|
+
* `immutable, max-age=31536000` on the claim that the "bundle is versioned via
|
|
334
|
+
* package version" — it is not, the URL has no version in it. Browsers then
|
|
335
|
+
* pinned the bundle for a YEAR and never revalidated, so consent UI fixes
|
|
336
|
+
* could not reach anyone who had already loaded the page. It stays routed for
|
|
337
|
+
* pages cached against it, but must always revalidate so those clients can
|
|
338
|
+
* recover instead of being stuck forever.
|
|
339
|
+
*
|
|
340
|
+
* @param contentAddressed - true when served from the hashed path
|
|
341
|
+
* @returns JavaScript response
|
|
327
342
|
*/
|
|
328
343
|
private serveConsentBundle;
|
|
329
344
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"consent.service.d.ts","sourceRoot":"","sources":["../../src/services/consent.service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAcpD,OAAO,KAAK,EAIV,aAAa,EACd,MAAM,2BAA2B,CAAC;AAYnC,OAAO,EAYL,KAAK,8BAA8B,EACnC,KAAK,gBAAgB,EACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,uBAAuB,CAAC;
|
|
1
|
+
{"version":3,"file":"consent.service.d.ts","sourceRoot":"","sources":["../../src/services/consent.service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAcpD,OAAO,KAAK,EAIV,aAAa,EACd,MAAM,2BAA2B,CAAC;AAYnC,OAAO,EAYL,KAAK,8BAA8B,EACnC,KAAK,gBAAgB,EACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,uBAAuB,CAAC;AA6D/B,qBAAa,cAAc;IACzB,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,QAAQ,CAAmB;IACnC,OAAO,CAAC,GAAG,CAAgB;IAC3B,OAAO,CAAC,OAAO,CAAC,CAAoB;IACpC,OAAO,CAAC,cAAc,CAAC,CAAiB;IAGxC,OAAO,CAAC,YAAY,CAAC,CAAsB;IAC3C,OAAO,CAAC,gBAAgB,CAAC,CAAgB;IAGzC,OAAO,CAAC,gBAAgB,CAAC,CAAmD;IAC5E,OAAO,CAAC,gBAAgB,CAAC,CAAwD;IAEjF;;;OAGG;gBAED,GAAG,EAAE,aAAa,EAClB,OAAO,CAAC,EAAE,iBAAiB,EAC3B,gBAAgB,CAAC,EAAE,OAAO,uBAAuB,EAAE,gBAAgB,EACnE,gBAAgB,CAAC,EAAE,OAAO,uBAAuB,EAAE,qBAAqB;IAW1E;;;;;;;OAOG;YACW,eAAe;IAmC7B;;;;;;;OAOG;IACG,mBAAmB,CAAC,KAAK,EAAE;QAC/B,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC;KACzD,GAAG,OAAO,CAAC,IAAI,CAAC;IAMX,kBAAkB,CAAC,KAAK,EAAE;QAC9B,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE,MAAM,CAAC;QACtB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,OAAO,CAAC,IAAI,CAAC;IAMjB;;;;;;;;;;;;OAYG;IACG,uBAAuB,CAC3B,MAAM,EAAE;QACN,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,eAAe,EAAE,MAAM,CAAC;QACxB,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,EACD,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,OAAO,CAAC;IAWnB;;;;;OAKG;YACW,sBAAsB;IA8CpC;;;;;;;;;;OAUG;YACW,sBAAsB;IAqEpC;;;;;;;;;;;;;;OAcG;IACU,oBAAoB,CAC/B,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,GACnC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAkFzB;;;;;;;;;;;OAWG;YACW,iCAAiC;IA0D/C;;;;;;;;;OASG;IACU,yBAAyB,CACpC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,GACnC,OAAO,CAAC,IAAI,CAAC;IAuIhB;;;;;;;;;OASG;IACU,oBAAoB,CAC/B,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,GACnC,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAsE9B;;;;;;;;;;;;;;OAcG;IACU,yBAAyB,CACpC,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,aAAa,GAC3B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IA0F9B;;;;OAIG;IACH,OAAO,CAAC,2BAA2B;IAInC;;;;;;;;;;;;;OAaG;IACU,kCAAkC,CAC7C,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAmGzB;;;;;;;;;;;;;OAaG;IACU,iBAAiB,CAC5B,UAAU,EAAE,gBAAgB,EAC5B,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,EACpC,eAAe,CAAC,EAAE,WAAW,GAAG,IAAI,GACnC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA4DzB;;;;;;;;;;;;;;;;OAgBG;IACU,kBAAkB,CAC7B,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;QACR,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,GACA,OAAO,CAAC,8BAA8B,GAAG,IAAI,CAAC;IAwJjD;;;;;;;;;;;;OAYG;IACG,eAAe,CACnB,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,aAAa,EAC7B,iBAAiB,CAAC,EAAE,MAAM,EAC1B,cAAc,CAAC,EAAE,OAAO,mCAAmC,EAAE,cAAc,GAC1E,OAAO,CAAC,OAAO,CAAC;IA+HnB;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EAAE,EAChB,SAAS,EAAE,MAAM,EACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,6DAA6D;IAChF,oBAAoB,CAAC,EAAE,OAAO,0BAA0B,EAAE,oBAAoB,EAC9E,SAAS,CAAC,EAAE,MAAM,EAAE,sDAAsD;IAC1E,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC;IAkQlB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,mBAAmB;IAuB3B;;;;;;;;;;;OAWG;IACG,kBAAkB,CACtB,aAAa,EAAE,aAAa,EAC5B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC;IAyElB;;;;;;;;;;OAUG;IACG,oBAAoB,CACxB,aAAa,EAAE,aAAa,EAC5B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC;IAgFhB;;;;;;;;;;OAUG;IACG,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IAqCjD;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,kBAAkB;IAkB1B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,8BAA8B;IAYtC;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAetB;;;;;;;;;;;;;OAaG;YACW,iBAAiB;IAk1B/B;;;;;;;;OAQG;YACW,gBAAgB;IA2lC9B;;;;;;;;OAQG;YACW,cAAc;IAwd5B;;;;;OAKG;YACW,gBAAgB;IA+S9B;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;IAQ7B;;;;;;;;;OASG;YACW,oBAAoB;IAkElC;;;;;;;;;;;;OAYG;YACW,oBAAoB;IA4FlC;;;;;OAKG;YACW,iBAAiB;IAmC/B;;;;OAIG;YACW,sBAAsB;IA4FpC;;;;;;;;;OASG;YACW,wBAAwB;IAoftC;;;;;;;;;OASG;IACH,OAAO,CAAC,WAAW;IA2BnB;;;;;;;OAOG;YACW,2BAA2B;IAkGzC;;;;;;;;;OASG;IACH,OAAO,CAAC,2BAA2B;IA4GnC;;OAEG;YACW,yBAAyB;IAsDvC;;OAEG;YACW,oBAAoB;IAmDlC;;;;;;;;;;;OAWG;YACW,2BAA2B;IAmDzC;;;;;;;;;OASG;IACU,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAuBzE;;;;;OAKG;YACW,eAAe;IAgB7B;;OAEG;IACH,OAAO,CAAC,eAAe;IAOvB;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAI7B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAK7B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAY3B;;OAEG;YACW,sBAAsB;IAmJpC;;;;;;;;;OASG;IACH,OAAO,CAAC,WAAW;IAMnB;;;;;;;;;OASG;IACH,OAAO,CAAC,4BAA4B;IAqLpC;;OAEG;YACW,UAAU;IAqDxB;;;;;OAKG;YACW,WAAW;IA0GzB;;OAEG;YACW,qBAAqB;CAsBpC"}
|
|
@@ -24,7 +24,7 @@ import { createCredentialAuthHandler } from "./credential-auth.handler";
|
|
|
24
24
|
import { IdpTokenStorage } from "./idp-token-storage";
|
|
25
25
|
import { OAuthSecurityService } from "./oauth-security.service";
|
|
26
26
|
import { didKeyFragment } from "@kya-os/mcp";
|
|
27
|
-
import { CONSENT_BUNDLE, CONSENT_BUNDLE_SIZE, resolveExpirationDays, DEFAULT_EXPIRATION_DAYS, resolveCapabilitiesForScopes, } from "@kya-os/consent";
|
|
27
|
+
import { CONSENT_BUNDLE, CONSENT_BUNDLE_SIZE, CONSENT_BUNDLE_PATH, CONSENT_BUNDLE_HASH, resolveExpirationDays, DEFAULT_EXPIRATION_DAYS, resolveCapabilitiesForScopes, } from "@kya-os/consent";
|
|
28
28
|
import { calculateDOInstanceId, parseDORoutingStrategy, parseDOShardCount, } from "../utils/do-routing";
|
|
29
29
|
import { defaultProviders } from "@kya-os/provider-registry";
|
|
30
30
|
const BUILTIN_OAUTH_PROVIDER_IDS = new Set(defaultProviders
|
|
@@ -1394,9 +1394,12 @@ export class ConsentService {
|
|
|
1394
1394
|
if (request.method === "OPTIONS" && url.pathname === "/consent/approve") {
|
|
1395
1395
|
return this.handleCorsPreflightForApproval(request);
|
|
1396
1396
|
}
|
|
1397
|
-
// GET
|
|
1398
|
-
|
|
1399
|
-
|
|
1397
|
+
// GET the consent bundle. The content-addressed path is what shells emit;
|
|
1398
|
+
// the legacy unversioned path stays routed so pages already cached against
|
|
1399
|
+
// it keep working (see serveConsentBundle for why it must not be immutable).
|
|
1400
|
+
if (request.method === "GET" &&
|
|
1401
|
+
(url.pathname === CONSENT_BUNDLE_PATH || url.pathname === "/consent.js")) {
|
|
1402
|
+
return this.serveConsentBundle(url.pathname === CONSENT_BUNDLE_PATH);
|
|
1400
1403
|
}
|
|
1401
1404
|
// GET /consent - Render page
|
|
1402
1405
|
if (request.method === "GET" && url.pathname === "/consent") {
|
|
@@ -1414,20 +1417,38 @@ export class ConsentService {
|
|
|
1414
1417
|
return new Response("Method not allowed", { status: 405 });
|
|
1415
1418
|
}
|
|
1416
1419
|
/**
|
|
1417
|
-
* Serve the consent
|
|
1420
|
+
* Serve the consent bundle for CSR mode.
|
|
1418
1421
|
*
|
|
1419
1422
|
* Returns the bundled Lit Web Components as JavaScript that browsers
|
|
1420
1423
|
* can execute to render the <mcp-consent> element.
|
|
1421
1424
|
*
|
|
1422
|
-
*
|
|
1425
|
+
* Caching is decided by WHICH path was requested, because only one of them can
|
|
1426
|
+
* safely promise immutability:
|
|
1427
|
+
*
|
|
1428
|
+
* - {@link CONSENT_BUNDLE_PATH} is content-addressed, so its bytes can never
|
|
1429
|
+
* change. `immutable` is honest here, and a new build is simply a new URL
|
|
1430
|
+
* that the shell points at.
|
|
1431
|
+
* - `/consent.js` is a stable, unversioned alias. It previously carried
|
|
1432
|
+
* `immutable, max-age=31536000` on the claim that the "bundle is versioned via
|
|
1433
|
+
* package version" — it is not, the URL has no version in it. Browsers then
|
|
1434
|
+
* pinned the bundle for a YEAR and never revalidated, so consent UI fixes
|
|
1435
|
+
* could not reach anyone who had already loaded the page. It stays routed for
|
|
1436
|
+
* pages cached against it, but must always revalidate so those clients can
|
|
1437
|
+
* recover instead of being stuck forever.
|
|
1438
|
+
*
|
|
1439
|
+
* @param contentAddressed - true when served from the hashed path
|
|
1440
|
+
* @returns JavaScript response
|
|
1423
1441
|
*/
|
|
1424
|
-
serveConsentBundle() {
|
|
1442
|
+
serveConsentBundle(contentAddressed) {
|
|
1425
1443
|
return new Response(CONSENT_BUNDLE, {
|
|
1426
1444
|
status: 200,
|
|
1427
1445
|
headers: {
|
|
1428
1446
|
"Content-Type": "application/javascript; charset=utf-8",
|
|
1429
|
-
|
|
1430
|
-
|
|
1447
|
+
"Cache-Control": contentAddressed
|
|
1448
|
+
? "public, max-age=31536000, immutable"
|
|
1449
|
+
: "no-cache",
|
|
1450
|
+
// Lets the legacy alias revalidate cheaply (304) instead of refetching.
|
|
1451
|
+
ETag: `"${CONSENT_BUNDLE_HASH}"`,
|
|
1431
1452
|
// Add content length for better client handling
|
|
1432
1453
|
"Content-Length": CONSENT_BUNDLE_SIZE.toString(),
|
|
1433
1454
|
// CORS headers for cross-origin script loading
|
|
@@ -1846,7 +1867,9 @@ export class ConsentService {
|
|
|
1846
1867
|
headers: { Location: resolvedOAuthUrl },
|
|
1847
1868
|
});
|
|
1848
1869
|
}
|
|
1849
|
-
else if (resolvedOAuthUrl &&
|
|
1870
|
+
else if (resolvedOAuthUrl &&
|
|
1871
|
+
isCustomOAuthProvider &&
|
|
1872
|
+
normalizedUrlProvider) {
|
|
1850
1873
|
logger.warn("[ConsentService] Ignoring custom OAuth consent-skip for untrusted query provider", {
|
|
1851
1874
|
provider,
|
|
1852
1875
|
urlProvider,
|
|
@@ -1968,8 +1991,7 @@ export class ConsentService {
|
|
|
1968
1991
|
// 3. undefined → LIT falls back to "this site"
|
|
1969
1992
|
const friendlyOrgFromHost = (rawHost) => {
|
|
1970
1993
|
// Strip common operational subdomains so we get the brand label.
|
|
1971
|
-
const host = rawHost
|
|
1972
|
-
.replace(/^(authenticate|consent|auth|api|app|www)\./i, "");
|
|
1994
|
+
const host = rawHost.replace(/^(authenticate|consent|auth|api|app|www)\./i, "");
|
|
1973
1995
|
// Drop the TLD by taking the second-to-last label when present
|
|
1974
1996
|
// (e.g. "hardwareworld.com" → "hardwareworld"; for single-label
|
|
1975
1997
|
// hosts like "localhost" use the host as-is).
|
|
@@ -3857,11 +3879,11 @@ export class ConsentService {
|
|
|
3857
3879
|
let userDid = providedUserDid;
|
|
3858
3880
|
if (!userDid && delegationStorage) {
|
|
3859
3881
|
const identityKey = STORAGE_KEYS.sessionIdentity(sessionId);
|
|
3860
|
-
const identityData = await delegationStorage.get(identityKey, "json");
|
|
3882
|
+
const identityData = (await delegationStorage.get(identityKey, "json"));
|
|
3861
3883
|
userDid = identityData?.userDid;
|
|
3862
3884
|
if (!userDid) {
|
|
3863
3885
|
const sessionKey = STORAGE_KEYS.session(sessionId);
|
|
3864
|
-
const sessionData = await delegationStorage.get(sessionKey, "json");
|
|
3886
|
+
const sessionData = (await delegationStorage.get(sessionKey, "json"));
|
|
3865
3887
|
userDid = sessionData?.userDid;
|
|
3866
3888
|
}
|
|
3867
3889
|
}
|
|
@@ -3876,12 +3898,14 @@ export class ConsentService {
|
|
|
3876
3898
|
// Store user+agent scoped key (for cross-session persistence)
|
|
3877
3899
|
if (userDid) {
|
|
3878
3900
|
const userAgentKey = STORAGE_KEYS.delegation(userDid, agentDid);
|
|
3879
|
-
await delegationStorage.put(userAgentKey, token, {
|
|
3901
|
+
await delegationStorage.put(userAgentKey, token, {
|
|
3902
|
+
expirationTtl: ttl,
|
|
3903
|
+
});
|
|
3880
3904
|
logger.debug("[ConsentService] Token also stored to KV (user+agent key)");
|
|
3881
3905
|
}
|
|
3882
3906
|
// Store session key (for session data preservation)
|
|
3883
3907
|
const sessionKey = STORAGE_KEYS.session(sessionId);
|
|
3884
|
-
const existingData = await delegationStorage.get(sessionKey, "json");
|
|
3908
|
+
const existingData = (await delegationStorage.get(sessionKey, "json"));
|
|
3885
3909
|
await delegationStorage.put(sessionKey, JSON.stringify({
|
|
3886
3910
|
...existingData,
|
|
3887
3911
|
userDid,
|
|
@@ -4005,7 +4029,7 @@ export class ConsentService {
|
|
|
4005
4029
|
// Extract standard fields.
|
|
4006
4030
|
// inline_mode and approved are destructured to keep them out of the
|
|
4007
4031
|
// ...credentials rest object (which is sent to the external credential provider).
|
|
4008
|
-
const { tool, scopes: rawScopes, agent_did, session_id, project_id, provider, provider_type, csrf_token, inline_mode: _inlineMode, approved: _approved, termsAccepted: _termsAccepted, ...credentials } = body;
|
|
4032
|
+
const { tool, scopes: rawScopes, agent_did, agent_name, session_id, project_id, provider, provider_type, csrf_token, inline_mode: _inlineMode, approved: _approved, termsAccepted: _termsAccepted, ...credentials } = body;
|
|
4009
4033
|
logger.debug("[ConsentService] Credential submission received", {
|
|
4010
4034
|
hasUsername: !!credentials.username,
|
|
4011
4035
|
hasPassword: !!credentials.password,
|
|
@@ -4285,6 +4309,12 @@ export class ConsentService {
|
|
|
4285
4309
|
// Preserve important state from credential flow
|
|
4286
4310
|
clickwrapUrl.searchParams.set("project_id", project_id);
|
|
4287
4311
|
clickwrapUrl.searchParams.set("agent_did", agent_did);
|
|
4312
|
+
// Only ever a request param — never stored on the session — so dropping it
|
|
4313
|
+
// here makes the consent screen fall back to friendlyAgentNameFromDid(),
|
|
4314
|
+
// which renders a did:key's opaque key material as the agent name.
|
|
4315
|
+
if (agent_name) {
|
|
4316
|
+
clickwrapUrl.searchParams.set("agent_name", agent_name);
|
|
4317
|
+
}
|
|
4288
4318
|
clickwrapUrl.searchParams.set("session_id", session_id);
|
|
4289
4319
|
// Include tool and scopes for display
|
|
4290
4320
|
clickwrapUrl.searchParams.set("tool", tool);
|
|
@@ -4702,10 +4732,7 @@ export class ConsentService {
|
|
|
4702
4732
|
* Base64url encode a string
|
|
4703
4733
|
*/
|
|
4704
4734
|
base64UrlEncodeString(str) {
|
|
4705
|
-
return btoa(str)
|
|
4706
|
-
.replace(/\+/g, "-")
|
|
4707
|
-
.replace(/\//g, "_")
|
|
4708
|
-
.replace(/=/g, "");
|
|
4735
|
+
return btoa(str).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
|
|
4709
4736
|
}
|
|
4710
4737
|
/**
|
|
4711
4738
|
* Base64url decode to string
|