@lifeaitools/clauth 1.5.26 → 1.5.28

package/cli/commands/serve.js

@@ -2934,38 +2934,14 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       return res.end();
     }
 
-    // ── OAuth Discovery (RFC 9728 + RFC 8414) ──────────────
-    // claude.ai probes these for ALL remote MCP connections.
-    // resource MUST match the connector URL configured in claude.ai.
-    // /.well-known/oauth-protected-resource/gws → resource=/gws
-    // /.well-known/oauth-protected-resource/sse → resource=/sse
-    // /.well-known/oauth-protected-resource     → resource=/sse (default)
-    if (reqPath.startsWith("/.well-known/oauth-protected-resource")) {
-      const base = oauthBase();
-      const suffix = reqPath.replace("/.well-known/oauth-protected-resource", "").replace(/^\//, "");
-      const resourcePath = suffix && ["/gws", "/clauth", "/mcp", "/sse"].includes("/" + suffix) ? "/" + suffix : "/clauth";
-      res.writeHead(200, { "Content-Type": "application/json", ...CORS });
-      return res.end(JSON.stringify({
-        resource: `${base}${resourcePath}`,
-        authorization_servers: [base],
-        scopes_supported: ["mcp:tools"],
-        bearer_methods_supported: ["header"],
-      }));
-    }
-
-    if (reqPath === "/.well-known/oauth-authorization-server") {
-      const base = oauthBase();
-      res.writeHead(200, { "Content-Type": "application/json", ...CORS });
-      return res.end(JSON.stringify({
-        issuer: base,
-        authorization_endpoint: `${base}/authorize`,
-        token_endpoint: `${base}/token`,
-        registration_endpoint: `${base}/register`,
-        response_types_supported: ["code"],
-        grant_types_supported: ["authorization_code", "client_credentials"],
-        code_challenge_methods_supported: ["S256"],
-        scopes_supported: ["mcp:tools"],
-      }));
+    // ── OAuth Discovery — 404 well-known only ──────────────
+    // claude.ai ignores metadata endpoints and constructs /register, /authorize,
+    // /token from the domain root (issue #82). Keep well-known as 404 so claude.ai
+    // uses the fallback paths. OAuth endpoints below are live.
+    if (reqPath.startsWith("/.well-known/oauth-protected-resource") ||
+        reqPath === "/.well-known/oauth-authorization-server") {
+      res.writeHead(404, { "Content-Type": "application/json", ...CORS });
+      return res.end(JSON.stringify({ error: "not_found" }));
     }
 
     // ── Dynamic Client Registration (RFC 7591) ──────────────
@@ -2998,7 +2974,6 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       const redirectUri = url.searchParams.get("redirect_uri");
       const state = url.searchParams.get("state");
       const codeChallenge = url.searchParams.get("code_challenge");
-      const codeChallengeMethod = url.searchParams.get("code_challenge_method");
 
       if (!clientId || !redirectUri) {
         res.writeHead(400, { "Content-Type": "text/plain", ...CORS });
@@ -3008,7 +2983,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       const code = crypto.randomBytes(32).toString("hex");
       oauthCodes.set(code, {
         client_id: clientId, redirect_uri: redirectUri,
-        code_challenge: codeChallenge, code_challenge_method: codeChallengeMethod,
+        code_challenge: codeChallenge,
         expires: Date.now() + 300_000,
       });
 
@@ -3016,7 +2991,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       redirect.searchParams.set("code", code);
       if (state) redirect.searchParams.set("state", state);
 
-      const logMsg = `[${new Date().toISOString()}] OAuth: authorize → code issued for ${clientId}, redirecting to ${redirect.origin}\n`;
+      const logMsg = `[${new Date().toISOString()}] OAuth: authorize → code for ${clientId}, redirect to ${redirect.origin}\n`;
       try { fs.appendFileSync(LOG_FILE, logMsg); } catch {}
       res.writeHead(302, { Location: redirect.toString(), ...CORS });
       return res.end();
@@ -3038,23 +3013,6 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         return res.end(JSON.stringify({ error: "invalid_request" }));
       }
 
-      // client_credentials grant — skip authorize/redirect, just issue token from client_id+secret
-      if (body.grant_type === "client_credentials") {
-        const cid = body.client_id;
-        const csec = body.client_secret;
-        if (cid === OAUTH_CLIENT_ID && csec === OAUTH_CLIENT_SECRET) {
-          const accessToken = crypto.randomBytes(32).toString("hex");
-          oauthTokens.add(accessToken);
-          saveTokens(oauthTokens);
-          const logMsg = `[${new Date().toISOString()}] OAuth: client_credentials token issued for ${cid.slice(0,8)}… (token=${accessToken.slice(0,8)}…)\n`;
-          try { fs.appendFileSync(LOG_FILE, logMsg); } catch {}
-          res.writeHead(200, { "Content-Type": "application/json", ...CORS });
-          return res.end(JSON.stringify({ access_token: accessToken, token_type: "Bearer", expires_in: 86400, scope: "mcp:tools" }));
-        }
-        res.writeHead(401, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "invalid_client" }));
-      }
-
       if (body.grant_type !== "authorization_code") {
         res.writeHead(400, { "Content-Type": "application/json", ...CORS });
         return res.end(JSON.stringify({ error: "unsupported_grant_type" }));
@@ -3073,7 +3031,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         if (computed !== stored.code_challenge) {
           oauthCodes.delete(body.code);
           res.writeHead(400, { "Content-Type": "application/json", ...CORS });
-          return res.end(JSON.stringify({ error: "invalid_grant", error_description: "PKCE verification failed" }));
+          return res.end(JSON.stringify({ error: "invalid_grant", error_description: "PKCE failed" }));
         }
       }
 
@@ -3082,10 +3040,10 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       oauthTokens.add(accessToken);
       saveTokens(oauthTokens);
 
-      const logMsg = `[${new Date().toISOString()}] OAuth: token issued for client ${stored.client_id} (token=${accessToken.slice(0,8)}…)\n`;
+      const logMsg = `[${new Date().toISOString()}] OAuth: token issued for ${stored.client_id} (token=${accessToken.slice(0,8)}…)\n`;
       try { fs.appendFileSync(LOG_FILE, logMsg); } catch {}
       res.writeHead(200, { "Content-Type": "application/json", ...CORS });
-      return res.end(JSON.stringify({ access_token: accessToken, token_type: "Bearer", expires_in: 86400 }));
+      return res.end(JSON.stringify({ access_token: accessToken, token_type: "Bearer", scope: "mcp:tools", expires_in: 86400 }));
     }
 
     // ── MCP path helpers ──

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "1.5.26",
+  "version": "1.5.28",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {