@lifeaitools/clauth 1.5.28 → 1.5.30

package/cli/commands/serve.js

@@ -3013,13 +3013,18 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         return res.end(JSON.stringify({ error: "invalid_request" }));
       }
 
+      const tokenLog = (msg) => { try { fs.appendFileSync(LOG_FILE, `[${new Date().toISOString()}] OAuth /token: ${msg}\n`); } catch {} };
+      tokenLog(`grant_type=${body.grant_type} code=${(body.code||"").slice(0,8)}… verifier=${body.code_verifier ? "present" : "missing"}`);
+
       if (body.grant_type !== "authorization_code") {
+        tokenLog(`REJECT: unsupported_grant_type (${body.grant_type})`);
         res.writeHead(400, { "Content-Type": "application/json", ...CORS });
         return res.end(JSON.stringify({ error: "unsupported_grant_type" }));
       }
 
       const stored = oauthCodes.get(body.code);
       if (!stored || stored.expires < Date.now()) {
+        tokenLog(`REJECT: invalid_grant (stored=${!!stored}, expired=${stored ? stored.expires < Date.now() : "n/a"}, codes_size=${oauthCodes.size})`);
         oauthCodes.delete(body.code);
         res.writeHead(400, { "Content-Type": "application/json", ...CORS });
         return res.end(JSON.stringify({ error: "invalid_grant" }));
@@ -3028,11 +3033,14 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       // PKCE verification
       if (stored.code_challenge && body.code_verifier) {
         const computed = sha256base64url(body.code_verifier);
+        tokenLog(`PKCE: challenge=${stored.code_challenge.slice(0,12)}… computed=${computed.slice(0,12)}… match=${computed === stored.code_challenge}`);
         if (computed !== stored.code_challenge) {
           oauthCodes.delete(body.code);
           res.writeHead(400, { "Content-Type": "application/json", ...CORS });
           return res.end(JSON.stringify({ error: "invalid_grant", error_description: "PKCE failed" }));
         }
+      } else {
+        tokenLog(`PKCE: skipped (challenge=${!!stored.code_challenge}, verifier=${!!body.code_verifier})`);
       }
 
       oauthCodes.delete(body.code);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "1.5.28",
+  "version": "1.5.30",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {