@mangoc/dsh-sub2api-sync 0.3.0 → 0.3.1

package/lib/index.js

@@ -1405,8 +1405,8 @@ function absoluteHttpUrl(value) {
 	}
 }
 /** The provider issuer path under the instance root; the sub2api provider
-* issues `issuer = {instance}/api/v1/oauth` (no trailing slash). Every
-* discovery URL below is derived from this value, never guessed. */
+* issues `issuer = {instance}/api/v1/oauth` (no trailing slash). The discovery
+* URL is derived from this value, never guessed. */
 const PROVIDER_ISSUER_PATH = "/api/v1/oauth";
 async function discoverOAuthEndpoints(instance, fetchImpl = globalThis.fetch, now = Date.now()) {
 	const key = instance.trim().replace(/\/+$/, "").toLowerCase();
@@ -1417,54 +1417,13 @@ async function discoverOAuthEndpoints(instance, fetchImpl = globalThis.fetch, no
 	}
 	const base = instance.trim().replace(/\/+$/, "");
 	const expectedIssuer = `${base}${PROVIDER_ISSUER_PATH}`;
-	const candidates = [
-		{
-			url: `${base}/.well-known/oauth-authorization-server${PROVIDER_ISSUER_PATH}`,
-			requireIssuerField: true
-		},
-		{
-			url: `${base}/.well-known/oauth-authorization-server`,
-			requireIssuerField: false
-		},
-		{
-			url: `${expectedIssuer}/.well-known`,
-			requireIssuerField: false
-		}
-	];
+	const metadataUrl = `${base}/.well-known/oauth-authorization-server${PROVIDER_ISSUER_PATH}`;
 	let endpoints;
 	let lastError = "";
-	for (const candidate of candidates) try {
-		const response = await fetchImpl(candidate.url, { headers: { accept: "application/json" } });
-		if (!response.ok) {
-			lastError = `HTTP ${response.status} at ${candidate.url}`;
-			continue;
-		}
-		const payload = await response.json();
-		const documentIssuer = typeof payload.issuer === "string" ? payload.issuer : undefined;
-		if (documentIssuer === undefined) {
-			if (candidate.requireIssuerField) {
-				lastError = `metadata at ${candidate.url} omits the required issuer field`;
-				continue;
-			}
-		} else if (documentIssuer !== expectedIssuer) {
-			lastError = `issuer mismatch at ${candidate.url}: ${documentIssuer} (expected ${expectedIssuer})`;
-			continue;
-		}
-		const authorizationEndpoint = absoluteHttpUrl(payload.authorization_endpoint);
-		const tokenEndpoint = absoluteHttpUrl(payload.token_endpoint);
-		if (authorizationEndpoint === undefined || tokenEndpoint === undefined) {
-			lastError = `incomplete metadata at ${candidate.url}`;
-			continue;
-		}
-		const revocationEndpoint = absoluteHttpUrl(payload.revocation_endpoint);
-		endpoints = {
-			authorizationEndpoint,
-			tokenEndpoint,
-			...revocationEndpoint !== undefined ? { revocationEndpoint } : {}
-		};
-		break;
+	try {
+		endpoints = await fetchStrictMetadata(metadataUrl, expectedIssuer, fetchImpl);
 	} catch (error) {
-		lastError = `${candidate.url}: ${error instanceof Error ? error.message : String(error)}`;
+		lastError = error instanceof Error ? error.message : String(error);
 	}
 	discoveryCache.set(key, {
 		endpoints,
@@ -1473,6 +1432,31 @@ async function discoverOAuthEndpoints(instance, fetchImpl = globalThis.fetch, no
 	if (endpoints === undefined) throw new OAuthError("discovery_failed", `sub2api OAuth 发现失败：${lastError}`);
 	return endpoints;
 }
+/** One strict RFC 8414 §3 probe: fetch the metadata document at the derived
+* URL and validate it, or throw a plain Error carrying the failure reason. */
+async function fetchStrictMetadata(metadataUrl, expectedIssuer, fetchImpl) {
+	const response = await fetchImpl(metadataUrl, { headers: { accept: "application/json" } });
+	if (!response.ok) throw new Error(`HTTP ${response.status} at ${metadataUrl}`);
+	let payload;
+	try {
+		payload = await response.json();
+	} catch (error) {
+		const reason = error instanceof Error ? error.message : String(error);
+		throw new Error(`metadata at ${metadataUrl} is not JSON: ${reason}`);
+	}
+	const documentIssuer = typeof payload.issuer === "string" ? payload.issuer : undefined;
+	if (documentIssuer === undefined) throw new Error(`metadata at ${metadataUrl} omits the required issuer field`);
+	if (documentIssuer !== expectedIssuer) throw new Error(`issuer mismatch at ${metadataUrl}: ${documentIssuer} (expected ${expectedIssuer})`);
+	const authorizationEndpoint = absoluteHttpUrl(payload.authorization_endpoint);
+	const tokenEndpoint = absoluteHttpUrl(payload.token_endpoint);
+	if (authorizationEndpoint === undefined || tokenEndpoint === undefined) throw new Error(`incomplete metadata at ${metadataUrl}`);
+	const revocationEndpoint = absoluteHttpUrl(payload.revocation_endpoint);
+	return {
+		authorizationEndpoint,
+		tokenEndpoint,
+		...revocationEndpoint !== undefined ? { revocationEndpoint } : {}
+	};
+}
 function resetDiscoveryCache() {
 	discoveryCache.clear();
 }

package/lib/oauth.d.ts

@@ -4,10 +4,11 @@
  * Implements the plugin-side half of the 2026-10-01 design:
  * - endpoint discovery per RFC 8414: the metadata URL is derived by inserting
  *   `/.well-known/oauth-authorization-server` between the host and the
- *   provider issuer path (§3), the document's `issuer` field must match the
- *   expected provider issuer exactly (§3.3), and the deployed host-root
- *   registration plus the `/api/v1/oauth/.well-known` compatibility alias
- *   serve as gated fallbacks — discovery failure means OAuth is unavailable;
+ *   provider issuer path (§3), and the document's `issuer` field must match
+ *   the expected provider issuer exactly (§3.3) — a single strict location
+ *   with no fallbacks (the host-root endpoint belongs to the upstream MCP
+ *   server and the legacy alias is gone); discovery failure means OAuth is
+ *   unavailable;
  * - PKCE: 64-char base64url verifier, S256 challenge only (never `plain`);
  * - one-shot authorization attempts: `state` is single-use and expires with
  *   the attempt, the verifier never leaves the host process, and the final
@@ -38,15 +39,15 @@ export interface OAuthEndpoints {
     revocationEndpoint?: string;
 }
 /**
- * Resolve the provider metadata per RFC 8414. The strict §3 location (the
- * metadata URL derived from the provider issuer) is tried first and must echo
- * the expected issuer (§3.3 — issuer field required); the deployed host-root
- * registration and the versioned compatibility alias follow as gated
- * fallbacks. Issuer validation is what keeps a complete document served by a
- * *different* authorization server (e.g. the upstream MCP issuer at the host
- * root after route B) from being adopted just because it parses. A failed or
- * incomplete hunt is a loud failure — the caller hides the OAuth channel
- * instead of guessing URLs.
+ * Resolve the provider metadata per RFC 8414. Exactly one location is probed:
+ * the strict §3 derivation from the provider issuer, and the document must
+ * carry an `issuer` field (REQUIRED per §3.2) identical to the expected
+ * provider issuer (§3.3). The former host-root and legacy-alias fallbacks were
+ * removed by decision (2026-11-10): the host-root endpoint on real deployments
+ * belongs to the upstream MCP authorization server (live probes answer "MCP is
+ * disabled" or name a different issuer), and the compatibility alias is no
+ * longer deployed. A failed probe is a loud failure — the caller hides the
+ * OAuth channel instead of guessing URLs.
  */
 export declare function discoverOAuthEndpoints(instance: string, fetchImpl?: typeof fetch, now?: number): Promise<OAuthEndpoints>;
 /** Test seam: drop the process-wide discovery cache. */

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@mangoc/dsh-sub2api-sync",
   "description": "Sync one sub2api instance's groups, keys, and models into dsh-llm-pi-ai provider routes: panel-driven login (password / OAuth), one provider per relay key.",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "license": "MIT",
   "author": "Shuai-S",
   "homepage": "https://github.com/Shuai-S/dsh-sub2api-sync#readme",