@mcp-z/oauth-microsoft 1.0.0

package/dist/cjs/types.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/Users/kevin/Dev/Projects/ai/mcp-z/oauth/oauth-microsoft/src/types.ts"],"sourcesContent":["/**\n * Standalone types for Microsoft OAuth\n * No dependencies on other @mcp-z packages except @mcp-z/oauth\n */\n\n// Import shared types from base @mcp-z/oauth package\n// Public types (will be re-exported)\n// Internal-only types (not re-exported, used by providers)\nimport type { AuthFlowDescriptor, CachedToken, DcrClientInformation, DcrClientMetadata, Logger, OAuth2TokenStorageProvider, ProviderTokens, ToolHandler, ToolModule, UserAuthProvider } from '@mcp-z/oauth';\nimport type { RequestHandlerExtra } from '@modelcontextprotocol/sdk/shared/protocol.js';\nimport type { ServerNotification, ServerRequest } from '@modelcontextprotocol/sdk/types.js';\nimport type { Keyv } from 'keyv';\n\n// Re-export only essential shared types for public API\nexport type { Logger, CachedToken, ToolModule, ProviderTokens, DcrClientMetadata, DcrClientInformation };\n\n// Re-export error class\nexport { AuthRequiredError } from '@mcp-z/oauth';\n\n// Make internal types available for internal use without exporting\nexport type { ToolHandler, AuthFlowDescriptor, OAuth2TokenStorageProvider, UserAuthProvider, RequestHandlerExtra, ServerRequest, ServerNotification };\n\n// ============================================================================\n// Core Authentication Types\n// ============================================================================\n\n/**\n * Microsoft service types that support OAuth\n * OAuth clients support all Microsoft services provided by Microsoft Graph\n * @public\n */\nexport type MicrosoftService = string;\n\n// ============================================================================\n// Configuration Types\n// ============================================================================\n\n/**\n * OAuth client configuration for upstream provider\n * @public\n */\nexport interface OAuthClientConfig {\n  /** OAuth client ID for upstream provider */\n  clientId: string;\n  /** OAuth client secret (optional for some flows) */\n  clientSecret?: string;\n  /** Tenant/directory ID (for multi-tenant providers) */\n  tenantId?: string;\n}\n\n/**\n * Microsoft OAuth configuration interface.\n * Contains all OAuth-related configuration from CLI arguments and environment variables.\n * @public\n */\nexport interface OAuthConfig {\n  /** OAuth client ID */\n  clientId: string;\n  /** OAuth client secret (optional for public clients) */\n  clientSecret?: string;\n  /** Azure AD tenant ID */\n  tenantId: string;\n  /** OAuth adapter mode */\n  auth: 'loopback-oauth' | 'device-code' | 'dcr';\n  /** Whether to run in headless mode (no browser interaction) */\n  headless: boolean;\n  /** Optional redirect URI override (defaults to ephemeral loopback) */\n  redirectUri?: string;\n}\n\n/**\n * DCR configuration for dynamic client registration\n * @public\n */\nexport interface DcrConfig {\n  /** DCR mode: self-hosted (runs own OAuth server) or external (uses Auth0/Stitch) */\n  mode: 'self-hosted' | 'external';\n  /** External verification endpoint URL (required for external mode) */\n  verifyUrl?: string;\n  /** DCR client storage URI (required for self-hosted mode) */\n  storeUri?: string;\n  /** OAuth client ID for Microsoft Graph */\n  clientId: string;\n  /** OAuth client secret (optional for public clients) */\n  clientSecret?: string;\n  /** Azure AD tenant ID */\n  tenantId: string;\n  /** OAuth scopes to request */\n  scope: string;\n  /** Logger instance */\n  logger?: Logger;\n}\n\n/**\n * Configuration for loopback OAuth client\n * @public\n */\nexport interface LoopbackOAuthConfig {\n  /** Microsoft service type (e.g., 'outlook') */\n  service: MicrosoftService;\n  /** OAuth client ID */\n  clientId: string;\n  /** OAuth client secret (optional for public clients) */\n  clientSecret?: string | undefined;\n  /** Azure AD tenant ID */\n  tenantId: string;\n  /** OAuth scopes to request */\n  scope: string;\n  /** Whether to run in headless mode (no browser interaction) */\n  headless: boolean;\n  /** Logger instance */\n  logger: Logger;\n  /** Token storage */\n  tokenStore: Keyv<unknown>;\n  /** Optional redirect URI override (defaults to ephemeral loopback) */\n  redirectUri?: string;\n}\n\n// ============================================================================\n// Middleware Types\n// ============================================================================\n\n/**\n * Microsoft Graph AuthenticationProvider interface\n * Used by Microsoft Graph SDK for API authentication\n * @public\n */\nexport interface MicrosoftAuthProvider {\n  getAccessToken: () => Promise<string>;\n}\n\n/**\n * Auth context injected into extra by middleware\n * @public\n */\nexport interface AuthContext {\n  /**\n   * Microsoft Graph AuthenticationProvider ready for Graph SDK\n   * GUARANTEED to exist when handler runs\n   */\n  auth: MicrosoftAuthProvider;\n\n  /**\n   * Account being used (for logging, debugging)\n   */\n  accountId: string;\n\n  /**\n   * User ID (multi-tenant only)\n   */\n}\n\n/**\n * Enriched extra with guaranteed auth context and logger\n * Handlers receive this type - never plain RequestHandlerExtra\n * @public\n */\nexport interface EnrichedExtra extends RequestHandlerExtra<ServerRequest, ServerNotification> {\n  /**\n   * Auth context injected by middleware\n   * GUARANTEED to exist (middleware catches auth failures)\n   */\n  authContext: AuthContext;\n\n  /**\n   * Logger injected by middleware\n   * GUARANTEED to exist\n   */\n  logger: Logger;\n\n  /**\n   * HTTP request object (for HTTP transport scenarios)\n   * Optional - present when using HTTP transport with JWT/session auth\n   */\n  req?: unknown;\n\n  // Preserve backchannel support\n  _meta?: {\n    accountId?: string;\n    [key: string]: unknown;\n  };\n}\n\n// ============================================================================\n// DCR Internal Types\n// ============================================================================\n\n/**\n * Registered client with full metadata\n * Extends DcrClientInformation with internal timestamps\n * @internal\n */\nexport interface RegisteredClient extends DcrClientInformation {\n  /** Creation timestamp (milliseconds since epoch) */\n  created_at: number;\n}\n\n/**\n * Authorization code data structure\n * @public\n */\nexport interface AuthorizationCode {\n  code: string;\n  client_id: string;\n  redirect_uri: string;\n  scope: string;\n  code_challenge?: string;\n  code_challenge_method?: string;\n  /** Microsoft provider tokens obtained during authorization */\n  providerTokens: ProviderTokens;\n  created_at: number;\n  expires_at: number;\n}\n\n/**\n * Access token data structure\n * @public\n */\nexport interface AccessToken {\n  access_token: string;\n  token_type: 'Bearer';\n  expires_in: number;\n  refresh_token?: string;\n  scope: string;\n  client_id: string;\n  /** Microsoft provider tokens */\n  providerTokens: ProviderTokens;\n  created_at: number;\n}\n\n// ============================================================================\n// Schema Types\n// ============================================================================\n\n/**\n * Auth required response interface\n * Re-exported from @mcp-z/oauth for consistency\n */\nexport type { AuthRequired, AuthRequiredBranch } from './schemas/index.ts';\n"],"names":["AuthRequiredError"],"mappings":"AAAA;;;CAGC,GAED,qDAAqD;AACrD,qCAAqC;AACrC,2DAA2D;;;;;+BAUlDA;;;eAAAA,wBAAiB;;;qBAAQ"}

package/dist/esm/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * @mcp-z/oauth-microsoft - Shared Microsoft OAuth implementation
+ *
+ * Provides OAuth authentication:
+ * - Loopback OAuth (RFC 8252) - Server-managed, file-based tokens
+ * - Device Code flow (RFC 8628) - For headless/limited-input scenarios
+ */
+export { createDcrRouter, type DcrRouterConfig } from './lib/dcr-router.js';
+export { type VerificationResult, verifyBearerToken } from './lib/dcr-verify.js';
+export { type AuthInfo, DcrTokenVerifier } from './lib/token-verifier.js';
+export { DcrOAuthProvider, type DcrOAuthProviderConfig } from './providers/dcr.js';
+export { type DeviceCodeConfig, DeviceCodeProvider } from './providers/device-code.js';
+export { LoopbackOAuthProvider } from './providers/loopback-oauth.js';
+export * as schemas from './schemas/index.js';
+export { createConfig, parseConfig, parseDcrConfig } from './setup/config.js';
+export * from './types.js';

package/dist/esm/index.js

@@ -0,0 +1,16 @@
+/**
+ * @mcp-z/oauth-microsoft - Shared Microsoft OAuth implementation
+ *
+ * Provides OAuth authentication:
+ * - Loopback OAuth (RFC 8252) - Server-managed, file-based tokens
+ * - Device Code flow (RFC 8628) - For headless/limited-input scenarios
+ */ export { createDcrRouter } from './lib/dcr-router.js';
+export { verifyBearerToken } from './lib/dcr-verify.js';
+export { DcrTokenVerifier } from './lib/token-verifier.js';
+export { DcrOAuthProvider } from './providers/dcr.js';
+export { DeviceCodeProvider } from './providers/device-code.js';
+export { LoopbackOAuthProvider } from './providers/loopback-oauth.js';
+import * as _schemas from './schemas/index.js';
+export { _schemas as schemas };
+export { createConfig, parseConfig, parseDcrConfig } from './setup/config.js';
+export * from './types.js';

package/dist/esm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/Users/kevin/Dev/Projects/ai/mcp-z/oauth/oauth-microsoft/src/index.ts"],"sourcesContent":["/**\n * @mcp-z/oauth-microsoft - Shared Microsoft OAuth implementation\n *\n * Provides OAuth authentication:\n * - Loopback OAuth (RFC 8252) - Server-managed, file-based tokens\n * - Device Code flow (RFC 8628) - For headless/limited-input scenarios\n */\n\nexport { createDcrRouter, type DcrRouterConfig } from './lib/dcr-router.ts';\nexport { type VerificationResult, verifyBearerToken } from './lib/dcr-verify.ts';\nexport { type AuthInfo, DcrTokenVerifier } from './lib/token-verifier.ts';\nexport { DcrOAuthProvider, type DcrOAuthProviderConfig } from './providers/dcr.ts';\nexport { type DeviceCodeConfig, DeviceCodeProvider } from './providers/device-code.ts';\nexport { LoopbackOAuthProvider } from './providers/loopback-oauth.ts';\nexport * as schemas from './schemas/index.ts';\nexport { createConfig, parseConfig, parseDcrConfig } from './setup/config.ts';\nexport * from './types.ts';\n"],"names":["createDcrRouter","verifyBearerToken","DcrTokenVerifier","DcrOAuthProvider","DeviceCodeProvider","LoopbackOAuthProvider","schemas","createConfig","parseConfig","parseDcrConfig"],"mappings":"AAAA;;;;;;CAMC,GAED,SAASA,eAAe,QAA8B,sBAAsB;AAC5E,SAAkCC,iBAAiB,QAAQ,sBAAsB;AACjF,SAAwBC,gBAAgB,QAAQ,0BAA0B;AAC1E,SAASC,gBAAgB,QAAqC,qBAAqB;AACnF,SAAgCC,kBAAkB,QAAQ,6BAA6B;AACvF,SAASC,qBAAqB,QAAQ,gCAAgC;AACtE,0BAAyB,qBAAqB;AAA9C,SAAO,YAAKC,OAAO,GAA2B;AAC9C,SAASC,YAAY,EAAEC,WAAW,EAAEC,cAAc,QAAQ,oBAAoB;AAC9E,cAAc,aAAa"}

package/dist/esm/lib/dcr-router.d.ts

@@ -0,0 +1,44 @@
+/**
+ * DCR Router - OAuth 2.0 Authorization Server
+ *
+ * Implements OAuth 2.0 Dynamic Client Registration Protocol (RFC 7591)
+ * and OAuth 2.0 Authorization Server endpoints (RFC 6749, RFC 8414, RFC 9728).
+ *
+ * Endpoints:
+ * - GET /.well-known/oauth-authorization-server (RFC 8414 metadata)
+ * - GET /.well-known/oauth-protected-resource (RFC 9728 metadata - root)
+ * - GET /.well-known/oauth-protected-resource/mcp (RFC 9728 metadata - sub-path)
+ * - POST /oauth/register (RFC 7591 client registration)
+ * - GET /oauth/authorize (RFC 6749 authorization endpoint)
+ * - POST /oauth/token (RFC 6749 token endpoint)
+ * - POST /oauth/revoke (RFC 7009 token revocation)
+ * - GET /oauth/verify (token verification for Resource Server)
+ */
+import express from 'express';
+import type { Keyv } from 'keyv';
+import type { OAuthClientConfig } from '../types.js';
+/**
+ * Configuration for DCR Router (self-hosted mode only)
+ */
+export interface DcrRouterConfig {
+    /** Single Keyv store for all DCR data */
+    store: Keyv;
+    /** Authorization Server issuer URL */
+    issuerUrl: string;
+    /** Base URL for OAuth endpoints */
+    baseUrl: string;
+    /** Supported OAuth scopes */
+    scopesSupported: string[];
+    /** OAuth client configuration for upstream provider */
+    clientConfig: OAuthClientConfig;
+}
+/**
+ * Create DCR Router with OAuth 2.0 endpoints (self-hosted mode)
+ *
+ * For external mode (Auth0/Stitch), don't call this function - no router needed.
+ * The server code should check DcrConfig.mode and only call this for 'self-hosted'.
+ *
+ * @param config - Router configuration
+ * @returns Express router with OAuth endpoints
+ */
+export declare function createDcrRouter(config: DcrRouterConfig): express.Router;

package/dist/esm/lib/dcr-router.js

@@ -0,0 +1,556 @@
+/**
+ * DCR Router - OAuth 2.0 Authorization Server
+ *
+ * Implements OAuth 2.0 Dynamic Client Registration Protocol (RFC 7591)
+ * and OAuth 2.0 Authorization Server endpoints (RFC 6749, RFC 8414, RFC 9728).
+ *
+ * Endpoints:
+ * - GET /.well-known/oauth-authorization-server (RFC 8414 metadata)
+ * - GET /.well-known/oauth-protected-resource (RFC 9728 metadata - root)
+ * - GET /.well-known/oauth-protected-resource/mcp (RFC 9728 metadata - sub-path)
+ * - POST /oauth/register (RFC 7591 client registration)
+ * - GET /oauth/authorize (RFC 6749 authorization endpoint)
+ * - POST /oauth/token (RFC 6749 token endpoint)
+ * - POST /oauth/revoke (RFC 7009 token revocation)
+ * - GET /oauth/verify (token verification for Resource Server)
+ */ import { createHash, randomUUID } from 'crypto';
+import express from 'express';
+import { DcrOAuthProvider } from '../providers/dcr.js';
+import * as dcrUtils from './dcr-utils.js';
+/**
+ * Create DCR Router with OAuth 2.0 endpoints (self-hosted mode)
+ *
+ * For external mode (Auth0/Stitch), don't call this function - no router needed.
+ * The server code should check DcrConfig.mode and only call this for 'self-hosted'.
+ *
+ * @param config - Router configuration
+ * @returns Express router with OAuth endpoints
+ */ export function createDcrRouter(config) {
+    const router = express.Router();
+    const { store, issuerUrl, baseUrl, scopesSupported, clientConfig } = config;
+    // Apply required middleware for OAuth 2.0 endpoints (RFC 6749)
+    router.use(express.json()); // For /oauth/register (application/json)
+    router.use(express.urlencoded({
+        extended: true
+    })); // For /oauth/token (application/x-www-form-urlencoded)
+    /**
+   * OAuth Authorization Server Metadata (RFC 8414)
+   * GET /.well-known/oauth-authorization-server
+   */ router.get('/.well-known/oauth-authorization-server', (_req, res)=>{
+        const metadata = {
+            issuer: issuerUrl,
+            authorization_endpoint: `${baseUrl}/oauth/authorize`,
+            token_endpoint: `${baseUrl}/oauth/token`,
+            registration_endpoint: `${baseUrl}/oauth/register`,
+            revocation_endpoint: `${baseUrl}/oauth/revoke`,
+            scopes_supported: scopesSupported,
+            response_types_supported: [
+                'code'
+            ],
+            grant_types_supported: [
+                'authorization_code',
+                'refresh_token'
+            ],
+            token_endpoint_auth_methods_supported: [
+                'client_secret_basic',
+                'client_secret_post'
+            ],
+            code_challenge_methods_supported: [
+                'S256',
+                'plain'
+            ],
+            service_documentation: `${baseUrl}/docs`
+        };
+        res.json(metadata);
+    });
+    /**
+   * OAuth Protected Resource Metadata (RFC 9728 - Root)
+   * GET /.well-known/oauth-protected-resource
+   */ router.get('/.well-known/oauth-protected-resource', (_req, res)=>{
+        const metadata = {
+            resource: baseUrl,
+            authorization_servers: [
+                baseUrl
+            ],
+            scopes_supported: scopesSupported,
+            bearer_methods_supported: [
+                'header'
+            ]
+        };
+        res.json(metadata);
+    });
+    /**
+   * OAuth Protected Resource Metadata (RFC 9728 - Sub-path /mcp)
+   * GET /.well-known/oauth-protected-resource/mcp
+   */ router.get('/.well-known/oauth-protected-resource/mcp', (_req, res)=>{
+        const metadata = {
+            resource: `${baseUrl}/mcp`,
+            authorization_servers: [
+                baseUrl
+            ],
+            scopes_supported: scopesSupported,
+            bearer_methods_supported: [
+                'header'
+            ]
+        };
+        res.json(metadata);
+    });
+    /**
+   * Dynamic Client Registration (RFC 7591)
+   * POST /oauth/register
+   */ router.post('/oauth/register', async (req, res)=>{
+        try {
+            const registrationRequest = req.body;
+            // Register the client
+            const client = await dcrUtils.registerClient(store, registrationRequest);
+            // Return client information (RFC 7591 Section 3.2.1)
+            res.status(201).json(client);
+        } catch (error) {
+            res.status(400).json({
+                error: 'invalid_client_metadata',
+                error_description: error instanceof Error ? error.message : 'Invalid registration request'
+            });
+        }
+    });
+    /**
+   * OAuth Authorization Endpoint (RFC 6749 Section 3.1)
+   * GET /oauth/authorize
+   *
+   * Initiates Microsoft OAuth flow, then generates DCR authorization code
+   */ router.get('/oauth/authorize', async (req, res)=>{
+        const { response_type, client_id, redirect_uri, scope = '', state = '', code_challenge, code_challenge_method } = req.query;
+        // Validate required parameters
+        if (response_type !== 'code') {
+            return res.status(400).json({
+                error: 'unsupported_response_type',
+                error_description: 'Only response_type=code is supported'
+            });
+        }
+        if (!client_id || typeof client_id !== 'string') {
+            return res.status(400).json({
+                error: 'invalid_request',
+                error_description: 'client_id is required'
+            });
+        }
+        if (!redirect_uri || typeof redirect_uri !== 'string') {
+            return res.status(400).json({
+                error: 'invalid_request',
+                error_description: 'redirect_uri is required'
+            });
+        }
+        // Validate client
+        const client = await dcrUtils.getClient(store, client_id);
+        if (!client) {
+            return res.status(400).json({
+                error: 'invalid_client',
+                error_description: 'Unknown client_id'
+            });
+        }
+        // Validate redirect_uri
+        const isValidRedirect = await dcrUtils.validateRedirectUri(store, client_id, redirect_uri);
+        if (!isValidRedirect) {
+            return res.status(400).json({
+                error: 'invalid_request',
+                error_description: 'Invalid redirect_uri'
+            });
+        }
+        // Store DCR request state for Microsoft OAuth callback
+        const msState = randomUUID();
+        const dcrRequestState = {
+            client_id,
+            redirect_uri,
+            scope: typeof scope === 'string' ? scope : '',
+            state: typeof state === 'string' ? state : undefined,
+            code_challenge: typeof code_challenge === 'string' ? code_challenge : undefined,
+            code_challenge_method: typeof code_challenge_method === 'string' ? code_challenge_method : undefined,
+            created_at: Date.now(),
+            expires_at: Date.now() + 600000
+        };
+        await store.set(`dcr:ms-state:${msState}`, dcrRequestState, 600000); // 10 min TTL
+        // Build Microsoft authorization URL
+        const msAuthUrl = new URL(`https://login.microsoftonline.com/${clientConfig.tenantId || 'common'}/oauth2/v2.0/authorize`);
+        msAuthUrl.searchParams.set('client_id', clientConfig.clientId);
+        msAuthUrl.searchParams.set('response_type', 'code');
+        msAuthUrl.searchParams.set('redirect_uri', `${baseUrl}/oauth/callback`);
+        msAuthUrl.searchParams.set('scope', typeof scope === 'string' ? scope : '');
+        msAuthUrl.searchParams.set('state', msState);
+        msAuthUrl.searchParams.set('response_mode', 'query');
+        // Redirect user to Microsoft for authorization
+        return res.redirect(msAuthUrl.toString());
+    });
+    /**
+   * OAuth Callback Handler
+   * GET /oauth/callback
+   *
+   * Handles callback from Microsoft after user authorization
+   */ router.get('/oauth/callback', async (req, res)=>{
+        const { code: msCode, state: msState, error, error_description } = req.query;
+        // Handle Microsoft OAuth errors
+        if (error) {
+            return res.status(400).json({
+                error,
+                error_description: error_description || 'Microsoft OAuth authorization failed'
+            });
+        }
+        if (!msCode || typeof msCode !== 'string') {
+            return res.status(400).json({
+                error: 'invalid_request',
+                error_description: 'Authorization code is required'
+            });
+        }
+        if (!msState || typeof msState !== 'string') {
+            return res.status(400).json({
+                error: 'invalid_request',
+                error_description: 'State parameter is required'
+            });
+        }
+        // Retrieve original DCR request state
+        const dcrRequestState = await store.get(`dcr:ms-state:${msState}`);
+        if (!dcrRequestState) {
+            return res.status(400).json({
+                error: 'invalid_request',
+                error_description: 'Invalid or expired state parameter'
+            });
+        }
+        // Delete state (one-time use)
+        await store.delete(`dcr:ms-state:${msState}`);
+        // Exchange Microsoft authorization code for tokens
+        try {
+            const tokenUrl = `https://login.microsoftonline.com/${clientConfig.tenantId || 'common'}/oauth2/v2.0/token`;
+            const tokenParams = new URLSearchParams({
+                grant_type: 'authorization_code',
+                code: msCode,
+                client_id: clientConfig.clientId,
+                redirect_uri: `${baseUrl}/oauth/callback`,
+                scope: dcrRequestState.scope
+            });
+            // Add client_secret if available (confidential client)
+            if (clientConfig.clientSecret) {
+                tokenParams.set('client_secret', clientConfig.clientSecret);
+            }
+            const tokenResponse = await fetch(tokenUrl, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded'
+                },
+                body: tokenParams.toString()
+            });
+            if (!tokenResponse.ok) {
+                const errorData = await tokenResponse.json();
+                throw new Error(`Microsoft token exchange failed: ${errorData.error_description || errorData.error}`);
+            }
+            const tokenData = await tokenResponse.json();
+            // Create provider tokens from Microsoft response
+            const providerTokens = {
+                accessToken: tokenData.access_token,
+                ...tokenData.refresh_token && {
+                    refreshToken: tokenData.refresh_token
+                },
+                expiresAt: Date.now() + tokenData.expires_in * 1000,
+                scope: tokenData.scope
+            };
+            // Generate DCR authorization code with real provider tokens
+            const dcrCode = randomUUID();
+            const authCode = {
+                code: dcrCode,
+                client_id: dcrRequestState.client_id,
+                redirect_uri: dcrRequestState.redirect_uri,
+                scope: dcrRequestState.scope,
+                ...dcrRequestState.code_challenge && {
+                    code_challenge: dcrRequestState.code_challenge
+                },
+                ...dcrRequestState.code_challenge_method && {
+                    code_challenge_method: dcrRequestState.code_challenge_method
+                },
+                providerTokens,
+                created_at: Date.now(),
+                expires_at: Date.now() + 600000
+            };
+            await dcrUtils.setAuthCode(store, dcrCode, authCode);
+            // Redirect back to MCP client with DCR authorization code
+            const clientRedirectUrl = new URL(dcrRequestState.redirect_uri);
+            clientRedirectUrl.searchParams.set('code', dcrCode);
+            if (dcrRequestState.state) {
+                clientRedirectUrl.searchParams.set('state', dcrRequestState.state);
+            }
+            return res.redirect(clientRedirectUrl.toString());
+        } catch (error) {
+            return res.status(500).json({
+                error: 'server_error',
+                error_description: error instanceof Error ? error.message : 'Failed to exchange authorization code'
+            });
+        }
+    });
+    /**
+   * OAuth Token Endpoint (RFC 6749 Section 3.2)
+   * POST /oauth/token
+   */ router.post('/oauth/token', async (req, res)=>{
+        // Extract client credentials from either body or Basic Auth header
+        let client_id = req.body.client_id;
+        let client_secret = req.body.client_secret;
+        // Support client_secret_basic authentication (RFC 6749 Section 2.3.1)
+        const authHeader = req.headers.authorization;
+        if (authHeader && authHeader.startsWith('Basic ')) {
+            const base64Credentials = authHeader.substring(6);
+            const credentials = Buffer.from(base64Credentials, 'base64').toString('utf-8');
+            const [id, secret] = credentials.split(':');
+            client_id = id;
+            client_secret = secret;
+        }
+        const { grant_type, code, redirect_uri, refresh_token, code_verifier } = req.body;
+        // Validate grant_type
+        if (!grant_type) {
+            return res.status(400).json({
+                error: 'invalid_request',
+                error_description: 'grant_type is required'
+            });
+        }
+        if (grant_type === 'authorization_code') {
+            // Authorization Code Grant
+            if (!code || !client_id || !redirect_uri) {
+                return res.status(400).json({
+                    error: 'invalid_request',
+                    error_description: 'code, client_id, and redirect_uri are required'
+                });
+            }
+            // Validate client credentials
+            const isValidClient = await dcrUtils.validateClient(store, client_id, client_secret !== null && client_secret !== void 0 ? client_secret : '');
+            if (!isValidClient) {
+                return res.status(401).json({
+                    error: 'invalid_client',
+                    error_description: 'Invalid client credentials'
+                });
+            }
+            // Get authorization code
+            const authCode = await dcrUtils.getAuthCode(store, code);
+            if (!authCode) {
+                return res.status(400).json({
+                    error: 'invalid_grant',
+                    error_description: 'Invalid or expired authorization code'
+                });
+            }
+            // Validate authorization code
+            if (authCode.client_id !== client_id || authCode.redirect_uri !== redirect_uri) {
+                return res.status(400).json({
+                    error: 'invalid_grant',
+                    error_description: 'Authorization code mismatch'
+                });
+            }
+            if (Date.now() > authCode.expires_at) {
+                await dcrUtils.deleteAuthCode(store, code);
+                return res.status(400).json({
+                    error: 'invalid_grant',
+                    error_description: 'Authorization code expired'
+                });
+            }
+            // Validate PKCE if used
+            if (authCode.code_challenge) {
+                var _authCode_code_challenge_method;
+                if (!code_verifier) {
+                    return res.status(400).json({
+                        error: 'invalid_request',
+                        error_description: 'code_verifier is required for PKCE'
+                    });
+                }
+                // Validate code_verifier against code_challenge
+                const method = (_authCode_code_challenge_method = authCode.code_challenge_method) !== null && _authCode_code_challenge_method !== void 0 ? _authCode_code_challenge_method : 'plain';
+                const computedChallenge = method === 'S256' ? createHash('sha256').update(code_verifier).digest('base64url') : code_verifier;
+                if (computedChallenge !== authCode.code_challenge) {
+                    return res.status(400).json({
+                        error: 'invalid_grant',
+                        error_description: 'Invalid code_verifier'
+                    });
+                }
+            }
+            // Delete authorization code (one-time use)
+            await dcrUtils.deleteAuthCode(store, code);
+            // Generate DCR access token
+            const accessToken = randomUUID();
+            const refreshTokenValue = randomUUID();
+            const tokenData = {
+                access_token: accessToken,
+                token_type: 'Bearer',
+                expires_in: 3600,
+                refresh_token: refreshTokenValue,
+                scope: authCode.scope,
+                client_id,
+                providerTokens: authCode.providerTokens,
+                created_at: Date.now()
+            };
+            await dcrUtils.setAccessToken(store, accessToken, tokenData);
+            await dcrUtils.setRefreshToken(store, refreshTokenValue, tokenData);
+            // Store provider tokens indexed by DCR access token
+            await dcrUtils.setProviderTokens(store, accessToken, authCode.providerTokens);
+            // Return token response
+            return res.json({
+                access_token: tokenData.access_token,
+                token_type: tokenData.token_type,
+                expires_in: tokenData.expires_in,
+                refresh_token: tokenData.refresh_token,
+                scope: tokenData.scope
+            });
+        }
+        if (grant_type === 'refresh_token') {
+            // Refresh Token Grant
+            if (!refresh_token || !client_id) {
+                return res.status(400).json({
+                    error: 'invalid_request',
+                    error_description: 'refresh_token and client_id are required'
+                });
+            }
+            // Validate client credentials
+            const isValidClient = await dcrUtils.validateClient(store, client_id, client_secret !== null && client_secret !== void 0 ? client_secret : '');
+            if (!isValidClient) {
+                return res.status(401).json({
+                    error: 'invalid_client',
+                    error_description: 'Invalid client credentials'
+                });
+            }
+            // Get refresh token
+            const tokenData = await dcrUtils.getRefreshToken(store, refresh_token);
+            if (!tokenData || tokenData.client_id !== client_id) {
+                return res.status(400).json({
+                    error: 'invalid_grant',
+                    error_description: 'Invalid refresh token'
+                });
+            }
+            // Refresh provider tokens if available
+            let refreshedProviderTokens = tokenData.providerTokens;
+            if (tokenData.providerTokens.refreshToken) {
+                try {
+                    var _clientConfig_tenantId;
+                    // Create DcrOAuthProvider instance to refresh Microsoft tokens
+                    const provider = new DcrOAuthProvider({
+                        clientId: clientConfig.clientId,
+                        ...clientConfig.clientSecret && {
+                            clientSecret: clientConfig.clientSecret
+                        },
+                        tenantId: (_clientConfig_tenantId = clientConfig.tenantId) !== null && _clientConfig_tenantId !== void 0 ? _clientConfig_tenantId : 'common',
+                        scope: tokenData.scope,
+                        verifyEndpoint: `${baseUrl}/oauth/verify`,
+                        logger: {
+                            info: console.log,
+                            error: console.error,
+                            warn: console.warn,
+                            debug: ()=>{}
+                        }
+                    });
+                    // Refresh the Microsoft access token
+                    refreshedProviderTokens = await provider.refreshAccessToken(tokenData.providerTokens.refreshToken);
+                } catch (error) {
+                    // If refresh fails, continue with existing tokens (they may still be valid)
+                    console.warn('Provider token refresh failed, using existing tokens:', error instanceof Error ? error.message : String(error));
+                }
+            }
+            // Generate new DCR access token
+            const newAccessToken = randomUUID();
+            const newTokenData = {
+                ...tokenData,
+                access_token: newAccessToken,
+                created_at: Date.now()
+            };
+            await dcrUtils.setAccessToken(store, newAccessToken, newTokenData);
+            // Store refreshed provider tokens indexed by new DCR access token
+            await dcrUtils.setProviderTokens(store, newAccessToken, refreshedProviderTokens);
+            return res.json({
+                access_token: newTokenData.access_token,
+                token_type: newTokenData.token_type,
+                expires_in: newTokenData.expires_in,
+                scope: newTokenData.scope
+            });
+        }
+        return res.status(400).json({
+            error: 'unsupported_grant_type',
+            error_description: 'Only authorization_code and refresh_token grants are supported'
+        });
+    });
+    /**
+   * OAuth Token Revocation (RFC 7009)
+   * POST /oauth/revoke
+   */ router.post('/oauth/revoke', async (req, res)=>{
+        const { token, token_type_hint, client_id, client_secret } = req.body;
+        if (!token) {
+            return res.status(400).json({
+                error: 'invalid_request',
+                error_description: 'token is required'
+            });
+        }
+        // Validate client if credentials provided
+        if (client_id && client_secret) {
+            const isValidClient = await dcrUtils.validateClient(store, client_id, client_secret);
+            if (!isValidClient) {
+                return res.status(401).json({
+                    error: 'invalid_client',
+                    error_description: 'Invalid client credentials'
+                });
+            }
+        }
+        // Revoke the token
+        if (token_type_hint === 'refresh_token') {
+            await dcrUtils.deleteRefreshToken(store, token);
+        } else if (token_type_hint === 'access_token') {
+            await dcrUtils.deleteAccessToken(store, token);
+            await dcrUtils.deleteProviderTokens(store, token);
+        } else {
+            // No hint - try both
+            await dcrUtils.deleteRefreshToken(store, token);
+            await dcrUtils.deleteAccessToken(store, token);
+            await dcrUtils.deleteProviderTokens(store, token);
+        }
+        // RFC 7009: Return 200 even if token not found
+        return res.status(200).send();
+    });
+    /**
+   * Token Verification Endpoint
+   * GET /oauth/verify
+   *
+   * Validates bearer tokens for Resource Server.
+   * Returns AuthInfo with provider tokens for stateless DCR pattern.
+   */ router.get('/oauth/verify', async (req, res)=>{
+        // Extract bearer token from Authorization header
+        const authHeader = req.headers.authorization;
+        if (!authHeader || !authHeader.startsWith('Bearer ')) {
+            return res.status(401).json({
+                error: 'invalid_request',
+                error_description: 'Missing or invalid Authorization header'
+            });
+        }
+        const token = authHeader.substring(7); // Remove 'Bearer ' prefix
+        // Validate token exists in access tokens store
+        const tokenData = await dcrUtils.getAccessToken(store, token);
+        if (!tokenData) {
+            return res.status(401).json({
+                error: 'invalid_token',
+                error_description: 'Unknown or expired access token'
+            });
+        }
+        // Check if token is expired
+        const now = Date.now();
+        const expiresAt = tokenData.created_at + tokenData.expires_in * 1000;
+        if (now > expiresAt) {
+            // Remove expired token
+            await dcrUtils.deleteAccessToken(store, token);
+            await dcrUtils.deleteProviderTokens(store, token);
+            return res.status(401).json({
+                error: 'invalid_token',
+                error_description: 'Access token has expired'
+            });
+        }
+        // Return AuthInfo with provider tokens for stateless DCR
+        const authInfo = {
+            token,
+            clientId: tokenData.client_id,
+            scopes: tokenData.scope ? tokenData.scope.split(' ') : [],
+            expiresAt,
+            providerTokens: tokenData.providerTokens
+        };
+        return res.json(authInfo);
+    });
+    /**
+   * Debug endpoint to list registered clients (development only)
+   */ router.get('/debug/clients', async (_req, res)=>{
+        const clients = await dcrUtils.listClients(store);
+        res.json(clients);
+    });
+    return router;
+}