@lifeaitools/clauth 1.5.24 → 1.5.26

package/cli/commands/serve.js

@@ -2962,7 +2962,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         token_endpoint: `${base}/token`,
         registration_endpoint: `${base}/register`,
         response_types_supported: ["code"],
-        grant_types_supported: ["authorization_code"],
+        grant_types_supported: ["authorization_code", "client_credentials"],
         code_challenge_methods_supported: ["S256"],
         scopes_supported: ["mcp:tools"],
       }));
@@ -3038,6 +3038,23 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         return res.end(JSON.stringify({ error: "invalid_request" }));
       }
 
+      // client_credentials grant — skip authorize/redirect, just issue token from client_id+secret
+      if (body.grant_type === "client_credentials") {
+        const cid = body.client_id;
+        const csec = body.client_secret;
+        if (cid === OAUTH_CLIENT_ID && csec === OAUTH_CLIENT_SECRET) {
+          const accessToken = crypto.randomBytes(32).toString("hex");
+          oauthTokens.add(accessToken);
+          saveTokens(oauthTokens);
+          const logMsg = `[${new Date().toISOString()}] OAuth: client_credentials token issued for ${cid.slice(0,8)}… (token=${accessToken.slice(0,8)}…)\n`;
+          try { fs.appendFileSync(LOG_FILE, logMsg); } catch {}
+          res.writeHead(200, { "Content-Type": "application/json", ...CORS });
+          return res.end(JSON.stringify({ access_token: accessToken, token_type: "Bearer", expires_in: 86400, scope: "mcp:tools" }));
+        }
+        res.writeHead(401, { "Content-Type": "application/json", ...CORS });
+        return res.end(JSON.stringify({ error: "invalid_client" }));
+      }
+
       if (body.grant_type !== "authorization_code") {
         res.writeHead(400, { "Content-Type": "application/json", ...CORS });
         return res.end(JSON.stringify({ error: "unsupported_grant_type" }));
@@ -3086,43 +3103,15 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
     }
 
     // ── MCP endpoint auth ──
-    // Tunnel requests (Host = tunnel hostname) MUST have Bearer token → 401 triggers OAuth.
-    // Local requests (Host = 127.0.0.1) pass through without auth.
+    // No 401 gate — tunnel URL is the shared secret. Accept all connections.
+    // If Bearer token present, mark as remote for vault scoping.
     if (method === "POST" && (reqPath === "/sse" || isMcpPath)) {
       const authHeader = req.headers.authorization;
-      const host = (req.headers.host || "").split(":")[0];
-      const isTunnelReq = tunnelUrl && host !== "127.0.0.1" && host !== "localhost" && host !== "::1";
-      const authLogMsg = [
-        `[${new Date().toISOString()}] MCP POST ${reqPath}`,
-        `  Host: ${req.headers.host || "(none)"} (tunnel=${isTunnelReq})`,
-        `  Authorization: ${authHeader ? (authHeader.startsWith("Bearer ") ? `Bearer ${authHeader.slice(7, 15)}… (known=${oauthTokens.has(authHeader.slice(7))})` : authHeader.slice(0, 30) + "…") : "(none)"}`,
-        `  mcp-protocol-version: ${req.headers["mcp-protocol-version"] || "(not set)"}`,
-        `  accept: ${req.headers["accept"] || "(not set)"}`,
-      ].join("\n") + "\n";
-      try { fs.appendFileSync(LOG_FILE, authLogMsg); } catch {}
-
-      if (isTunnelReq) {
-        if (!authHeader || !authHeader.startsWith("Bearer ")) {
-          const base = oauthBase();
-          const logMsg = `[${new Date().toISOString()}] OAuth: 401 → requiring auth for tunnel POST ${reqPath}\n`;
-          try { fs.appendFileSync(LOG_FILE, logMsg); } catch {}
-          res.writeHead(401, {
-            "Content-Type": "application/json",
-            "WWW-Authenticate": `Bearer resource_metadata="${base}/.well-known/oauth-protected-resource"`,
-            ...CORS,
-          });
-          return res.end(JSON.stringify({ error: "unauthorized" }));
-        }
+      if (authHeader?.startsWith("Bearer ")) {
         const token = authHeader.slice(7);
-        if (!oauthTokens.has(token)) {
-          const logMsg = `[${new Date().toISOString()}] OAuth: REJECTED token ${token.slice(0,8)}… (pool=${oauthTokens.size})\n`;
-          try { fs.appendFileSync(LOG_FILE, logMsg); } catch {}
-          res.writeHead(401, { "Content-Type": "application/json", ...CORS });
-          return res.end(JSON.stringify({ error: "invalid_token" }));
+        if (oauthTokens.has(token) || token === OAUTH_CLIENT_SECRET) {
+          req._clauthRemote = true;
         }
-        req._clauthRemote = true;
-      } else if (authHeader?.startsWith("Bearer ") && oauthTokens.has(authHeader.slice(7))) {
-        req._clauthRemote = true;
       }
       // fall through to MCP handling
     }
@@ -3185,27 +3174,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
 
     // ── MCP SSE transport — /sse and namespaced paths ────
     // GET /sse|/gws|/clauth — open SSE stream, receive endpoint event
-    // Tunnel requests require Bearer token (same as POST above)
     if (method === "GET" && (reqPath === "/sse" || isMcpPath)) {
-      const authHeader = req.headers.authorization;
-      const host = (req.headers.host || "").split(":")[0];
-      const isTunnelReq = tunnelUrl && host !== "127.0.0.1" && host !== "localhost" && host !== "::1";
-      if (isTunnelReq) {
-        if (!authHeader || !authHeader.startsWith("Bearer ")) {
-          const base = oauthBase();
-          res.writeHead(401, {
-            "Content-Type": "application/json",
-            "WWW-Authenticate": `Bearer resource_metadata="${base}/.well-known/oauth-protected-resource"`,
-            ...CORS,
-          });
-          return res.end(JSON.stringify({ error: "unauthorized" }));
-        }
-        if (!oauthTokens.has(authHeader.slice(7))) {
-          res.writeHead(401, { "Content-Type": "application/json", ...CORS });
-          return res.end(JSON.stringify({ error: "invalid_token" }));
-        }
-        // Token valid — mark as remote
-      }
       const sessionId = `ses_${++sseCounter}_${Date.now()}`;
 
       res.writeHead(200, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "1.5.24",
+  "version": "1.5.26",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {