@lifeaitools/clauth 1.5.24 → 1.5.25

package/cli/commands/serve.js

@@ -2962,7 +2962,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         token_endpoint: `${base}/token`,
         registration_endpoint: `${base}/register`,
         response_types_supported: ["code"],
-        grant_types_supported: ["authorization_code"],
+        grant_types_supported: ["authorization_code", "client_credentials"],
         code_challenge_methods_supported: ["S256"],
         scopes_supported: ["mcp:tools"],
       }));
@@ -3038,6 +3038,23 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         return res.end(JSON.stringify({ error: "invalid_request" }));
       }
 
+      // client_credentials grant — skip authorize/redirect, just issue token from client_id+secret
+      if (body.grant_type === "client_credentials") {
+        const cid = body.client_id;
+        const csec = body.client_secret;
+        if (cid === OAUTH_CLIENT_ID && csec === OAUTH_CLIENT_SECRET) {
+          const accessToken = crypto.randomBytes(32).toString("hex");
+          oauthTokens.add(accessToken);
+          saveTokens(oauthTokens);
+          const logMsg = `[${new Date().toISOString()}] OAuth: client_credentials token issued for ${cid.slice(0,8)}… (token=${accessToken.slice(0,8)}…)\n`;
+          try { fs.appendFileSync(LOG_FILE, logMsg); } catch {}
+          res.writeHead(200, { "Content-Type": "application/json", ...CORS });
+          return res.end(JSON.stringify({ access_token: accessToken, token_type: "Bearer", expires_in: 86400, scope: "mcp:tools" }));
+        }
+        res.writeHead(401, { "Content-Type": "application/json", ...CORS });
+        return res.end(JSON.stringify({ error: "invalid_client" }));
+      }
+
       if (body.grant_type !== "authorization_code") {
         res.writeHead(400, { "Content-Type": "application/json", ...CORS });
         return res.end(JSON.stringify({ error: "unsupported_grant_type" }));
@@ -3114,15 +3131,20 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
           return res.end(JSON.stringify({ error: "unauthorized" }));
         }
         const token = authHeader.slice(7);
-        if (!oauthTokens.has(token)) {
-          const logMsg = `[${new Date().toISOString()}] OAuth: REJECTED token ${token.slice(0,8)}… (pool=${oauthTokens.size})\n`;
+        // Accept: OAuth-issued tokens OR the stable client_secret directly
+        const isValidToken = oauthTokens.has(token) || token === OAUTH_CLIENT_SECRET;
+        if (!isValidToken) {
+          const logMsg = `[${new Date().toISOString()}] OAuth: REJECTED token ${token.slice(0,8)}… (pool=${oauthTokens.size}, secret=${token === OAUTH_CLIENT_SECRET})\n`;
           try { fs.appendFileSync(LOG_FILE, logMsg); } catch {}
           res.writeHead(401, { "Content-Type": "application/json", ...CORS });
           return res.end(JSON.stringify({ error: "invalid_token" }));
         }
         req._clauthRemote = true;
-      } else if (authHeader?.startsWith("Bearer ") && oauthTokens.has(authHeader.slice(7))) {
-        req._clauthRemote = true;
+      } else if (authHeader?.startsWith("Bearer ")) {
+        const token = authHeader.slice(7);
+        if (oauthTokens.has(token) || token === OAUTH_CLIENT_SECRET) {
+          req._clauthRemote = true;
+        }
       }
       // fall through to MCP handling
     }
@@ -3200,7 +3222,8 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
           });
           return res.end(JSON.stringify({ error: "unauthorized" }));
         }
-        if (!oauthTokens.has(authHeader.slice(7))) {
+        const sseToken = authHeader.slice(7);
+        if (!oauthTokens.has(sseToken) && sseToken !== OAUTH_CLIENT_SECRET) {
           res.writeHead(401, { "Content-Type": "application/json", ...CORS });
           return res.end(JSON.stringify({ error: "invalid_token" }));
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "1.5.24",
+  "version": "1.5.25",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {