@lifeaitools/clauth 1.5.29 → 1.5.30

package/cli/commands/serve.js

@@ -2944,17 +2944,8 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       return res.end(JSON.stringify({ error: "not_found" }));
     }
 
-    // ── Dynamic Client Registration — DISABLED ──────────────
-    // claude.ai's OAuth authorization_code flow is bugged (token issued, never used).
-    // If /register returns 201, claude.ai starts OAuth and fails.
-    // If /register returns 404, claude.ai falls back to authless (which works).
+    // ── Dynamic Client Registration (RFC 7591) ──────────────
     if (method === "POST" && reqPath === "/register") {
-      res.writeHead(404, { "Content-Type": "application/json", ...CORS });
-      return res.end(JSON.stringify({ error: "not_found" }));
-    }
-
-    // ── Dynamic Client Registration (kept for future use) ──────────────
-    if (false && method === "POST" && reqPath === "/register") {
       let body;
       try { body = await readBody(req); } catch {
         res.writeHead(400, { "Content-Type": "application/json", ...CORS });
@@ -3022,13 +3013,18 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         return res.end(JSON.stringify({ error: "invalid_request" }));
       }
 
+      const tokenLog = (msg) => { try { fs.appendFileSync(LOG_FILE, `[${new Date().toISOString()}] OAuth /token: ${msg}\n`); } catch {} };
+      tokenLog(`grant_type=${body.grant_type} code=${(body.code||"").slice(0,8)}… verifier=${body.code_verifier ? "present" : "missing"}`);
+
       if (body.grant_type !== "authorization_code") {
+        tokenLog(`REJECT: unsupported_grant_type (${body.grant_type})`);
         res.writeHead(400, { "Content-Type": "application/json", ...CORS });
         return res.end(JSON.stringify({ error: "unsupported_grant_type" }));
       }
 
       const stored = oauthCodes.get(body.code);
       if (!stored || stored.expires < Date.now()) {
+        tokenLog(`REJECT: invalid_grant (stored=${!!stored}, expired=${stored ? stored.expires < Date.now() : "n/a"}, codes_size=${oauthCodes.size})`);
         oauthCodes.delete(body.code);
         res.writeHead(400, { "Content-Type": "application/json", ...CORS });
         return res.end(JSON.stringify({ error: "invalid_grant" }));
@@ -3037,11 +3033,14 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       // PKCE verification
       if (stored.code_challenge && body.code_verifier) {
         const computed = sha256base64url(body.code_verifier);
+        tokenLog(`PKCE: challenge=${stored.code_challenge.slice(0,12)}… computed=${computed.slice(0,12)}… match=${computed === stored.code_challenge}`);
         if (computed !== stored.code_challenge) {
           oauthCodes.delete(body.code);
           res.writeHead(400, { "Content-Type": "application/json", ...CORS });
           return res.end(JSON.stringify({ error: "invalid_grant", error_description: "PKCE failed" }));
         }
+      } else {
+        tokenLog(`PKCE: skipped (challenge=${!!stored.code_challenge}, verifier=${!!body.code_verifier})`);
       }
 
       oauthCodes.delete(body.code);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "1.5.29",
+  "version": "1.5.30",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {