@leanmcp/auth 0.3.1 → 0.4.0

package/dist/{auth0-54GZT2EI.mjs → auth0-UTD4QBG6.mjs}

@@ -1,7 +1,9 @@
 import {
-  AuthProviderBase,
+  AuthProviderBase
+} from "./chunk-P4HFKA5R.mjs";
+import {
   __name
-} from "./chunk-EVD2TRPR.mjs";
+} from "./chunk-LPEX4YW6.mjs";
 
 // src/providers/auth0.ts
 import axios from "axios";

package/dist/chunk-LPEX4YW6.mjs

@@ -0,0 +1,13 @@
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+export {
+  __name,
+  __require
+};

package/dist/{chunk-EVD2TRPR.mjs → chunk-P4HFKA5R.mjs}

@@ -1,5 +1,6 @@
-var __defProp = Object.defineProperty;
-var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+import {
+  __name
+} from "./chunk-LPEX4YW6.mjs";
 
 // src/index.ts
 import "reflect-metadata";
@@ -86,29 +87,39 @@ function createAuthenticatedMethod(originalMethod, authProvider, options) {
       }
       throw new AuthenticationError(`Token verification failed: ${error instanceof Error ? error.message : String(error)}`, "VERIFICATION_FAILED");
     }
+    let user = void 0;
     if (options.getUser !== false) {
       try {
-        const user = await authProvider.getUser(token);
-        return await authUserStorage.run(user, async () => {
-          return await originalMethod.apply(this, [
-            args
-          ]);
-        });
+        user = await authProvider.getUser(token);
       } catch (error) {
         console.warn("Failed to fetch user information:", error);
-        return await authUserStorage.run(void 0, async () => {
+      }
+    }
+    let userSecrets = {};
+    if (options.projectId) {
+      try {
+        if ("getUserSecrets" in authProvider && typeof authProvider.getUserSecrets === "function") {
+          userSecrets = await authProvider.getUserSecrets(token, options.projectId);
+        } else {
+          console.warn('[Auth] Auth provider does not support user secrets. Only the LeanMCP provider supports @RequireEnv and getEnv(). Use: new AuthProvider("leanmcp", { apiKey: "..." })');
+        }
+      } catch (error) {
+        console.warn("[Auth] Failed to fetch user secrets:", error instanceof Error ? error.message : error);
+      }
+    }
+    return await authUserStorage.run(user, async () => {
+      if (options.projectId) {
+        const { runWithEnv } = await import("@leanmcp/env-injection");
+        return await runWithEnv(userSecrets, async () => {
           return await originalMethod.apply(this, [
             args
           ]);
         });
       }
-    } else {
-      return await authUserStorage.run(void 0, async () => {
-        return await originalMethod.apply(this, [
-          args
-        ]);
-      });
-    }
+      return await originalMethod.apply(this, [
+        args
+      ]);
+    });
   };
 }
 __name(createAuthenticatedMethod, "createAuthenticatedMethod");
@@ -165,25 +176,31 @@ var AuthProvider = class extends AuthProviderBase {
     const finalConfig = config || this.config;
     switch (this.providerType) {
       case "cognito": {
-        const { AuthCognito } = await import("./cognito-I6V5YNYM.mjs");
+        const { AuthCognito } = await import("./cognito-QQT7LK2Y.mjs");
         this.providerInstance = new AuthCognito();
         await this.providerInstance.init(finalConfig);
         break;
       }
       case "auth0": {
-        const { AuthAuth0 } = await import("./auth0-54GZT2EI.mjs");
+        const { AuthAuth0 } = await import("./auth0-UTD4QBG6.mjs");
         this.providerInstance = new AuthAuth0();
         await this.providerInstance.init(finalConfig);
         break;
       }
       case "clerk": {
-        const { AuthClerk } = await import("./clerk-FR7ITM33.mjs");
+        const { AuthClerk } = await import("./clerk-3SDKGD6C.mjs");
         this.providerInstance = new AuthClerk();
         await this.providerInstance.init(finalConfig);
         break;
       }
+      case "leanmcp": {
+        const { AuthLeanmcp } = await import("./leanmcp-Y7TXNSTD.mjs");
+        this.providerInstance = new AuthLeanmcp();
+        await this.providerInstance.init(finalConfig);
+        break;
+      }
       default:
-        throw new Error(`Unsupported auth provider: ${this.providerType}. Supported providers: cognito`);
+        throw new Error(`Unsupported auth provider: ${this.providerType}. Supported providers: cognito, auth0, clerk, leanmcp`);
     }
   }
   /**
@@ -214,6 +231,19 @@ var AuthProvider = class extends AuthProviderBase {
     return this.providerInstance.getUser(token);
   }
   /**
+  * Get user secrets for a project (LeanMCP provider only)
+  * Other providers will return empty object
+  */
+  async getUserSecrets(token, projectId) {
+    if (!this.providerInstance) {
+      throw new Error("AuthProvider not initialized. Call init() first.");
+    }
+    if ("getUserSecrets" in this.providerInstance && typeof this.providerInstance.getUserSecrets === "function") {
+      return this.providerInstance.getUserSecrets(token, projectId);
+    }
+    return {};
+  }
+  /**
   * Get the provider type
   */
   getProviderType() {
@@ -222,7 +252,6 @@ var AuthProvider = class extends AuthProviderBase {
 };
 
 export {
-  __name,
   getAuthUser,
   AuthenticationError,
   Authenticated,

package/dist/chunk-RGCCBQWG.mjs

@@ -0,0 +1,113 @@
+import {
+  __name
+} from "./chunk-LPEX4YW6.mjs";
+
+// src/storage/types.ts
+function isTokenExpired(tokens, bufferSeconds = 60) {
+  if (!tokens.expires_at && !tokens.expires_in) {
+    return false;
+  }
+  const expiresAt = tokens.expires_at ?? Date.now() / 1e3 + (tokens.expires_in ?? 0);
+  const now = Date.now() / 1e3;
+  return expiresAt <= now + bufferSeconds;
+}
+__name(isTokenExpired, "isTokenExpired");
+function withExpiresAt(tokens) {
+  if (tokens.expires_at || !tokens.expires_in) {
+    return tokens;
+  }
+  return {
+    ...tokens,
+    expires_at: Math.floor(Date.now() / 1e3) + tokens.expires_in
+  };
+}
+__name(withExpiresAt, "withExpiresAt");
+
+// src/storage/memory.ts
+var MemoryStorage = class {
+  static {
+    __name(this, "MemoryStorage");
+  }
+  tokens = /* @__PURE__ */ new Map();
+  clients = /* @__PURE__ */ new Map();
+  /**
+   * Normalize server URL for consistent key lookup
+   */
+  normalizeUrl(serverUrl) {
+    return serverUrl.replace(/\/+$/, "").toLowerCase();
+  }
+  /**
+   * Check if an entry is expired
+   */
+  isExpired(entry) {
+    if (!entry) return true;
+    if (!entry.expiresAt) return false;
+    return Date.now() / 1e3 >= entry.expiresAt;
+  }
+  async getTokens(serverUrl) {
+    const key = this.normalizeUrl(serverUrl);
+    const entry = this.tokens.get(key);
+    if (this.isExpired(entry)) {
+      this.tokens.delete(key);
+      return null;
+    }
+    return entry?.value ?? null;
+  }
+  async setTokens(serverUrl, tokens) {
+    const key = this.normalizeUrl(serverUrl);
+    const enrichedTokens = withExpiresAt(tokens);
+    this.tokens.set(key, {
+      value: enrichedTokens,
+      expiresAt: enrichedTokens.expires_at
+    });
+  }
+  async clearTokens(serverUrl) {
+    const key = this.normalizeUrl(serverUrl);
+    this.tokens.delete(key);
+  }
+  async getClientInfo(serverUrl) {
+    const key = this.normalizeUrl(serverUrl);
+    const entry = this.clients.get(key);
+    if (this.isExpired(entry)) {
+      this.clients.delete(key);
+      return null;
+    }
+    return entry?.value ?? null;
+  }
+  async setClientInfo(serverUrl, info) {
+    const key = this.normalizeUrl(serverUrl);
+    this.clients.set(key, {
+      value: info,
+      expiresAt: info.client_secret_expires_at
+    });
+  }
+  async clearClientInfo(serverUrl) {
+    const key = this.normalizeUrl(serverUrl);
+    this.clients.delete(key);
+  }
+  async clearAll() {
+    this.tokens.clear();
+    this.clients.clear();
+  }
+  async getAllSessions() {
+    const sessions = [];
+    for (const [url, entry] of this.tokens.entries()) {
+      if (!this.isExpired(entry)) {
+        sessions.push({
+          serverUrl: url,
+          tokens: entry.value,
+          clientInfo: this.clients.get(url)?.value,
+          createdAt: Date.now(),
+          updatedAt: Date.now()
+        });
+      }
+    }
+    return sessions;
+  }
+};
+
+export {
+  isTokenExpired,
+  withExpiresAt,
+  MemoryStorage
+};

package/dist/chunk-ZOPKMOPV.mjs

@@ -0,0 +1,53 @@
+import {
+  __name
+} from "./chunk-LPEX4YW6.mjs";
+
+// src/client/pkce.ts
+import { createHash, randomBytes } from "crypto";
+function generateCodeVerifier(length = 64) {
+  if (length < 43 || length > 128) {
+    throw new Error("PKCE code verifier must be between 43-128 characters");
+  }
+  const bytesNeeded = Math.ceil(length * 0.75);
+  const randomBuffer = randomBytes(bytesNeeded);
+  return randomBuffer.toString("base64url").slice(0, length);
+}
+__name(generateCodeVerifier, "generateCodeVerifier");
+function generateCodeChallenge(verifier) {
+  return createHash("sha256").update(verifier, "utf8").digest("base64url");
+}
+__name(generateCodeChallenge, "generateCodeChallenge");
+function generatePKCE(verifierLength = 64) {
+  const verifier = generateCodeVerifier(verifierLength);
+  const challenge = generateCodeChallenge(verifier);
+  return {
+    verifier,
+    challenge,
+    method: "S256"
+  };
+}
+__name(generatePKCE, "generatePKCE");
+function verifyPKCE(verifier, challenge, method = "S256") {
+  if (method === "plain") {
+    return verifier === challenge;
+  }
+  const expectedChallenge = generateCodeChallenge(verifier);
+  return expectedChallenge === challenge;
+}
+__name(verifyPKCE, "verifyPKCE");
+function isValidCodeVerifier(verifier) {
+  if (verifier.length < 43 || verifier.length > 128) {
+    return false;
+  }
+  const validPattern = /^[A-Za-z0-9\-._~]+$/;
+  return validPattern.test(verifier);
+}
+__name(isValidCodeVerifier, "isValidCodeVerifier");
+
+export {
+  generateCodeVerifier,
+  generateCodeChallenge,
+  generatePKCE,
+  verifyPKCE,
+  isValidCodeVerifier
+};

package/dist/{clerk-FR7ITM33.mjs → clerk-3SDKGD6C.mjs}

@@ -1,7 +1,9 @@
 import {
-  AuthProviderBase,
+  AuthProviderBase
+} from "./chunk-P4HFKA5R.mjs";
+import {
   __name
-} from "./chunk-EVD2TRPR.mjs";
+} from "./chunk-LPEX4YW6.mjs";
 
 // src/providers/clerk.ts
 import axios from "axios";