@mcp-z/oauth-microsoft 1.0.0

package/dist/cjs/lib/dcr-router.js

@@ -0,0 +1,1227 @@
+/**
+ * DCR Router - OAuth 2.0 Authorization Server
+ *
+ * Implements OAuth 2.0 Dynamic Client Registration Protocol (RFC 7591)
+ * and OAuth 2.0 Authorization Server endpoints (RFC 6749, RFC 8414, RFC 9728).
+ *
+ * Endpoints:
+ * - GET /.well-known/oauth-authorization-server (RFC 8414 metadata)
+ * - GET /.well-known/oauth-protected-resource (RFC 9728 metadata - root)
+ * - GET /.well-known/oauth-protected-resource/mcp (RFC 9728 metadata - sub-path)
+ * - POST /oauth/register (RFC 7591 client registration)
+ * - GET /oauth/authorize (RFC 6749 authorization endpoint)
+ * - POST /oauth/token (RFC 6749 token endpoint)
+ * - POST /oauth/revoke (RFC 7009 token revocation)
+ * - GET /oauth/verify (token verification for Resource Server)
+ */ "use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "createDcrRouter", {
+    enumerable: true,
+    get: function() {
+        return createDcrRouter;
+    }
+});
+var _crypto = require("crypto");
+var _express = /*#__PURE__*/ _interop_require_default(require("express"));
+var _dcrts = require("../providers/dcr.js");
+var _dcrutilsts = /*#__PURE__*/ _interop_require_wildcard(require("./dcr-utils.js"));
+function _array_like_to_array(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_with_holes(arr) {
+    if (Array.isArray(arr)) return arr;
+}
+function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) {
+        resolve(value);
+    } else {
+        Promise.resolve(value).then(_next, _throw);
+    }
+}
+function _async_to_generator(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _instanceof(left, right) {
+    if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
+        return !!right[Symbol.hasInstance](left);
+    } else {
+        return left instanceof right;
+    }
+}
+function _interop_require_default(obj) {
+    return obj && obj.__esModule ? obj : {
+        default: obj
+    };
+}
+function _getRequireWildcardCache(nodeInterop) {
+    if (typeof WeakMap !== "function") return null;
+    var cacheBabelInterop = new WeakMap();
+    var cacheNodeInterop = new WeakMap();
+    return (_getRequireWildcardCache = function(nodeInterop) {
+        return nodeInterop ? cacheNodeInterop : cacheBabelInterop;
+    })(nodeInterop);
+}
+function _interop_require_wildcard(obj, nodeInterop) {
+    if (!nodeInterop && obj && obj.__esModule) {
+        return obj;
+    }
+    if (obj === null || typeof obj !== "object" && typeof obj !== "function") {
+        return {
+            default: obj
+        };
+    }
+    var cache = _getRequireWildcardCache(nodeInterop);
+    if (cache && cache.has(obj)) {
+        return cache.get(obj);
+    }
+    var newObj = {
+        __proto__: null
+    };
+    var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor;
+    for(var key in obj){
+        if (key !== "default" && Object.prototype.hasOwnProperty.call(obj, key)) {
+            var desc = hasPropertyDescriptor ? Object.getOwnPropertyDescriptor(obj, key) : null;
+            if (desc && (desc.get || desc.set)) {
+                Object.defineProperty(newObj, key, desc);
+            } else {
+                newObj[key] = obj[key];
+            }
+        }
+    }
+    newObj.default = obj;
+    if (cache) {
+        cache.set(obj, newObj);
+    }
+    return newObj;
+}
+function _iterable_to_array_limit(arr, i) {
+    var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
+    if (_i == null) return;
+    var _arr = [];
+    var _n = true;
+    var _d = false;
+    var _s, _e;
+    try {
+        for(_i = _i.call(arr); !(_n = (_s = _i.next()).done); _n = true){
+            _arr.push(_s.value);
+            if (i && _arr.length === i) break;
+        }
+    } catch (err) {
+        _d = true;
+        _e = err;
+    } finally{
+        try {
+            if (!_n && _i["return"] != null) _i["return"]();
+        } finally{
+            if (_d) throw _e;
+        }
+    }
+    return _arr;
+}
+function _non_iterable_rest() {
+    throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _object_spread(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property(target, key, source[key]);
+        });
+    }
+    return target;
+}
+function ownKeys(object, enumerableOnly) {
+    var keys = Object.keys(object);
+    if (Object.getOwnPropertySymbols) {
+        var symbols = Object.getOwnPropertySymbols(object);
+        if (enumerableOnly) {
+            symbols = symbols.filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(object, sym).enumerable;
+            });
+        }
+        keys.push.apply(keys, symbols);
+    }
+    return keys;
+}
+function _object_spread_props(target, source) {
+    source = source != null ? source : {};
+    if (Object.getOwnPropertyDescriptors) {
+        Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
+    } else {
+        ownKeys(Object(source)).forEach(function(key) {
+            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
+        });
+    }
+    return target;
+}
+function _sliced_to_array(arr, i) {
+    return _array_with_holes(arr) || _iterable_to_array_limit(arr, i) || _unsupported_iterable_to_array(arr, i) || _non_iterable_rest();
+}
+function _unsupported_iterable_to_array(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array(o, minLen);
+}
+function _ts_generator(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype), d = Object.defineProperty;
+    return d(g, "next", {
+        value: verb(0)
+    }), d(g, "throw", {
+        value: verb(1)
+    }), d(g, "return", {
+        value: verb(2)
+    }), typeof Symbol === "function" && d(g, Symbol.iterator, {
+        value: function() {
+            return this;
+        }
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+function createDcrRouter(config) {
+    var router = _express.default.Router();
+    var store = config.store, issuerUrl = config.issuerUrl, baseUrl = config.baseUrl, scopesSupported = config.scopesSupported, clientConfig = config.clientConfig;
+    // Apply required middleware for OAuth 2.0 endpoints (RFC 6749)
+    router.use(_express.default.json()); // For /oauth/register (application/json)
+    router.use(_express.default.urlencoded({
+        extended: true
+    })); // For /oauth/token (application/x-www-form-urlencoded)
+    /**
+   * OAuth Authorization Server Metadata (RFC 8414)
+   * GET /.well-known/oauth-authorization-server
+   */ router.get('/.well-known/oauth-authorization-server', function(_req, res) {
+        var metadata = {
+            issuer: issuerUrl,
+            authorization_endpoint: "".concat(baseUrl, "/oauth/authorize"),
+            token_endpoint: "".concat(baseUrl, "/oauth/token"),
+            registration_endpoint: "".concat(baseUrl, "/oauth/register"),
+            revocation_endpoint: "".concat(baseUrl, "/oauth/revoke"),
+            scopes_supported: scopesSupported,
+            response_types_supported: [
+                'code'
+            ],
+            grant_types_supported: [
+                'authorization_code',
+                'refresh_token'
+            ],
+            token_endpoint_auth_methods_supported: [
+                'client_secret_basic',
+                'client_secret_post'
+            ],
+            code_challenge_methods_supported: [
+                'S256',
+                'plain'
+            ],
+            service_documentation: "".concat(baseUrl, "/docs")
+        };
+        res.json(metadata);
+    });
+    /**
+   * OAuth Protected Resource Metadata (RFC 9728 - Root)
+   * GET /.well-known/oauth-protected-resource
+   */ router.get('/.well-known/oauth-protected-resource', function(_req, res) {
+        var metadata = {
+            resource: baseUrl,
+            authorization_servers: [
+                baseUrl
+            ],
+            scopes_supported: scopesSupported,
+            bearer_methods_supported: [
+                'header'
+            ]
+        };
+        res.json(metadata);
+    });
+    /**
+   * OAuth Protected Resource Metadata (RFC 9728 - Sub-path /mcp)
+   * GET /.well-known/oauth-protected-resource/mcp
+   */ router.get('/.well-known/oauth-protected-resource/mcp', function(_req, res) {
+        var metadata = {
+            resource: "".concat(baseUrl, "/mcp"),
+            authorization_servers: [
+                baseUrl
+            ],
+            scopes_supported: scopesSupported,
+            bearer_methods_supported: [
+                'header'
+            ]
+        };
+        res.json(metadata);
+    });
+    /**
+   * Dynamic Client Registration (RFC 7591)
+   * POST /oauth/register
+   */ router.post('/oauth/register', function(req, res) {
+        return _async_to_generator(function() {
+            var registrationRequest, client, error;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        _state.trys.push([
+                            0,
+                            2,
+                            ,
+                            3
+                        ]);
+                        registrationRequest = req.body;
+                        return [
+                            4,
+                            _dcrutilsts.registerClient(store, registrationRequest)
+                        ];
+                    case 1:
+                        client = _state.sent();
+                        // Return client information (RFC 7591 Section 3.2.1)
+                        res.status(201).json(client);
+                        return [
+                            3,
+                            3
+                        ];
+                    case 2:
+                        error = _state.sent();
+                        res.status(400).json({
+                            error: 'invalid_client_metadata',
+                            error_description: _instanceof(error, Error) ? error.message : 'Invalid registration request'
+                        });
+                        return [
+                            3,
+                            3
+                        ];
+                    case 3:
+                        return [
+                            2
+                        ];
+                }
+            });
+        })();
+    });
+    /**
+   * OAuth Authorization Endpoint (RFC 6749 Section 3.1)
+   * GET /oauth/authorize
+   *
+   * Initiates Microsoft OAuth flow, then generates DCR authorization code
+   */ router.get('/oauth/authorize', function(req, res) {
+        return _async_to_generator(function() {
+            var _req_query, response_type, client_id, redirect_uri, _req_query_scope, scope, _req_query_state, state, code_challenge, code_challenge_method, client, isValidRedirect, msState, dcrRequestState, msAuthUrl;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        _req_query = req.query, response_type = _req_query.response_type, client_id = _req_query.client_id, redirect_uri = _req_query.redirect_uri, _req_query_scope = _req_query.scope, scope = _req_query_scope === void 0 ? '' : _req_query_scope, _req_query_state = _req_query.state, state = _req_query_state === void 0 ? '' : _req_query_state, code_challenge = _req_query.code_challenge, code_challenge_method = _req_query.code_challenge_method;
+                        // Validate required parameters
+                        if (response_type !== 'code') {
+                            return [
+                                2,
+                                res.status(400).json({
+                                    error: 'unsupported_response_type',
+                                    error_description: 'Only response_type=code is supported'
+                                })
+                            ];
+                        }
+                        if (!client_id || typeof client_id !== 'string') {
+                            return [
+                                2,
+                                res.status(400).json({
+                                    error: 'invalid_request',
+                                    error_description: 'client_id is required'
+                                })
+                            ];
+                        }
+                        if (!redirect_uri || typeof redirect_uri !== 'string') {
+                            return [
+                                2,
+                                res.status(400).json({
+                                    error: 'invalid_request',
+                                    error_description: 'redirect_uri is required'
+                                })
+                            ];
+                        }
+                        return [
+                            4,
+                            _dcrutilsts.getClient(store, client_id)
+                        ];
+                    case 1:
+                        client = _state.sent();
+                        if (!client) {
+                            return [
+                                2,
+                                res.status(400).json({
+                                    error: 'invalid_client',
+                                    error_description: 'Unknown client_id'
+                                })
+                            ];
+                        }
+                        return [
+                            4,
+                            _dcrutilsts.validateRedirectUri(store, client_id, redirect_uri)
+                        ];
+                    case 2:
+                        isValidRedirect = _state.sent();
+                        if (!isValidRedirect) {
+                            return [
+                                2,
+                                res.status(400).json({
+                                    error: 'invalid_request',
+                                    error_description: 'Invalid redirect_uri'
+                                })
+                            ];
+                        }
+                        // Store DCR request state for Microsoft OAuth callback
+                        msState = (0, _crypto.randomUUID)();
+                        dcrRequestState = {
+                            client_id: client_id,
+                            redirect_uri: redirect_uri,
+                            scope: typeof scope === 'string' ? scope : '',
+                            state: typeof state === 'string' ? state : undefined,
+                            code_challenge: typeof code_challenge === 'string' ? code_challenge : undefined,
+                            code_challenge_method: typeof code_challenge_method === 'string' ? code_challenge_method : undefined,
+                            created_at: Date.now(),
+                            expires_at: Date.now() + 600000
+                        };
+                        return [
+                            4,
+                            store.set("dcr:ms-state:".concat(msState), dcrRequestState, 600000)
+                        ];
+                    case 3:
+                        _state.sent(); // 10 min TTL
+                        // Build Microsoft authorization URL
+                        msAuthUrl = new URL("https://login.microsoftonline.com/".concat(clientConfig.tenantId || 'common', "/oauth2/v2.0/authorize"));
+                        msAuthUrl.searchParams.set('client_id', clientConfig.clientId);
+                        msAuthUrl.searchParams.set('response_type', 'code');
+                        msAuthUrl.searchParams.set('redirect_uri', "".concat(baseUrl, "/oauth/callback"));
+                        msAuthUrl.searchParams.set('scope', typeof scope === 'string' ? scope : '');
+                        msAuthUrl.searchParams.set('state', msState);
+                        msAuthUrl.searchParams.set('response_mode', 'query');
+                        // Redirect user to Microsoft for authorization
+                        return [
+                            2,
+                            res.redirect(msAuthUrl.toString())
+                        ];
+                }
+            });
+        })();
+    });
+    /**
+   * OAuth Callback Handler
+   * GET /oauth/callback
+   *
+   * Handles callback from Microsoft after user authorization
+   */ router.get('/oauth/callback', function(req, res) {
+        return _async_to_generator(function() {
+            var _req_query, msCode, msState, _$error, error_description, dcrRequestState, tokenUrl, tokenParams, tokenResponse, errorData, tokenData, providerTokens, dcrCode, authCode, clientRedirectUrl, error;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        _req_query = req.query, msCode = _req_query.code, msState = _req_query.state, _$error = _req_query.error, error_description = _req_query.error_description;
+                        // Handle Microsoft OAuth errors
+                        if (_$error) {
+                            return [
+                                2,
+                                res.status(400).json({
+                                    error: _$error,
+                                    error_description: error_description || 'Microsoft OAuth authorization failed'
+                                })
+                            ];
+                        }
+                        if (!msCode || typeof msCode !== 'string') {
+                            return [
+                                2,
+                                res.status(400).json({
+                                    error: 'invalid_request',
+                                    error_description: 'Authorization code is required'
+                                })
+                            ];
+                        }
+                        if (!msState || typeof msState !== 'string') {
+                            return [
+                                2,
+                                res.status(400).json({
+                                    error: 'invalid_request',
+                                    error_description: 'State parameter is required'
+                                })
+                            ];
+                        }
+                        return [
+                            4,
+                            store.get("dcr:ms-state:".concat(msState))
+                        ];
+                    case 1:
+                        dcrRequestState = _state.sent();
+                        if (!dcrRequestState) {
+                            return [
+                                2,
+                                res.status(400).json({
+                                    error: 'invalid_request',
+                                    error_description: 'Invalid or expired state parameter'
+                                })
+                            ];
+                        }
+                        // Delete state (one-time use)
+                        return [
+                            4,
+                            store.delete("dcr:ms-state:".concat(msState))
+                        ];
+                    case 2:
+                        _state.sent();
+                        _state.label = 3;
+                    case 3:
+                        _state.trys.push([
+                            3,
+                            9,
+                            ,
+                            10
+                        ]);
+                        tokenUrl = "https://login.microsoftonline.com/".concat(clientConfig.tenantId || 'common', "/oauth2/v2.0/token");
+                        tokenParams = new URLSearchParams({
+                            grant_type: 'authorization_code',
+                            code: msCode,
+                            client_id: clientConfig.clientId,
+                            redirect_uri: "".concat(baseUrl, "/oauth/callback"),
+                            scope: dcrRequestState.scope
+                        });
+                        // Add client_secret if available (confidential client)
+                        if (clientConfig.clientSecret) {
+                            tokenParams.set('client_secret', clientConfig.clientSecret);
+                        }
+                        return [
+                            4,
+                            fetch(tokenUrl, {
+                                method: 'POST',
+                                headers: {
+                                    'Content-Type': 'application/x-www-form-urlencoded'
+                                },
+                                body: tokenParams.toString()
+                            })
+                        ];
+                    case 4:
+                        tokenResponse = _state.sent();
+                        if (!!tokenResponse.ok) return [
+                            3,
+                            6
+                        ];
+                        return [
+                            4,
+                            tokenResponse.json()
+                        ];
+                    case 5:
+                        errorData = _state.sent();
+                        throw new Error("Microsoft token exchange failed: ".concat(errorData.error_description || errorData.error));
+                    case 6:
+                        return [
+                            4,
+                            tokenResponse.json()
+                        ];
+                    case 7:
+                        tokenData = _state.sent();
+                        // Create provider tokens from Microsoft response
+                        providerTokens = _object_spread_props(_object_spread({
+                            accessToken: tokenData.access_token
+                        }, tokenData.refresh_token && {
+                            refreshToken: tokenData.refresh_token
+                        }), {
+                            expiresAt: Date.now() + tokenData.expires_in * 1000,
+                            scope: tokenData.scope
+                        });
+                        // Generate DCR authorization code with real provider tokens
+                        dcrCode = (0, _crypto.randomUUID)();
+                        authCode = _object_spread_props(_object_spread({
+                            code: dcrCode,
+                            client_id: dcrRequestState.client_id,
+                            redirect_uri: dcrRequestState.redirect_uri,
+                            scope: dcrRequestState.scope
+                        }, dcrRequestState.code_challenge && {
+                            code_challenge: dcrRequestState.code_challenge
+                        }, dcrRequestState.code_challenge_method && {
+                            code_challenge_method: dcrRequestState.code_challenge_method
+                        }), {
+                            providerTokens: providerTokens,
+                            created_at: Date.now(),
+                            expires_at: Date.now() + 600000
+                        });
+                        return [
+                            4,
+                            _dcrutilsts.setAuthCode(store, dcrCode, authCode)
+                        ];
+                    case 8:
+                        _state.sent();
+                        // Redirect back to MCP client with DCR authorization code
+                        clientRedirectUrl = new URL(dcrRequestState.redirect_uri);
+                        clientRedirectUrl.searchParams.set('code', dcrCode);
+                        if (dcrRequestState.state) {
+                            clientRedirectUrl.searchParams.set('state', dcrRequestState.state);
+                        }
+                        return [
+                            2,
+                            res.redirect(clientRedirectUrl.toString())
+                        ];
+                    case 9:
+                        error = _state.sent();
+                        return [
+                            2,
+                            res.status(500).json({
+                                error: 'server_error',
+                                error_description: _instanceof(error, Error) ? error.message : 'Failed to exchange authorization code'
+                            })
+                        ];
+                    case 10:
+                        return [
+                            2
+                        ];
+                }
+            });
+        })();
+    });
+    /**
+   * OAuth Token Endpoint (RFC 6749 Section 3.2)
+   * POST /oauth/token
+   */ router.post('/oauth/token', function(req, res) {
+        return _async_to_generator(function() {
+            var client_id, client_secret, authHeader, base64Credentials, credentials, _credentials_split, id, secret, _req_body, grant_type, code, redirect_uri, refresh_token, code_verifier, isValidClient, authCode, _authCode_code_challenge_method, method, computedChallenge, accessToken, refreshTokenValue, tokenData, isValidClient1, tokenData1, refreshedProviderTokens, _clientConfig_tenantId, provider, error, newAccessToken, newTokenData;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        // Extract client credentials from either body or Basic Auth header
+                        client_id = req.body.client_id;
+                        client_secret = req.body.client_secret;
+                        // Support client_secret_basic authentication (RFC 6749 Section 2.3.1)
+                        authHeader = req.headers.authorization;
+                        if (authHeader && authHeader.startsWith('Basic ')) {
+                            base64Credentials = authHeader.substring(6);
+                            credentials = Buffer.from(base64Credentials, 'base64').toString('utf-8');
+                            _credentials_split = _sliced_to_array(credentials.split(':'), 2), id = _credentials_split[0], secret = _credentials_split[1];
+                            client_id = id;
+                            client_secret = secret;
+                        }
+                        _req_body = req.body, grant_type = _req_body.grant_type, code = _req_body.code, redirect_uri = _req_body.redirect_uri, refresh_token = _req_body.refresh_token, code_verifier = _req_body.code_verifier;
+                        // Validate grant_type
+                        if (!grant_type) {
+                            return [
+                                2,
+                                res.status(400).json({
+                                    error: 'invalid_request',
+                                    error_description: 'grant_type is required'
+                                })
+                            ];
+                        }
+                        if (!(grant_type === 'authorization_code')) return [
+                            3,
+                            9
+                        ];
+                        // Authorization Code Grant
+                        if (!code || !client_id || !redirect_uri) {
+                            return [
+                                2,
+                                res.status(400).json({
+                                    error: 'invalid_request',
+                                    error_description: 'code, client_id, and redirect_uri are required'
+                                })
+                            ];
+                        }
+                        return [
+                            4,
+                            _dcrutilsts.validateClient(store, client_id, client_secret !== null && client_secret !== void 0 ? client_secret : '')
+                        ];
+                    case 1:
+                        isValidClient = _state.sent();
+                        if (!isValidClient) {
+                            return [
+                                2,
+                                res.status(401).json({
+                                    error: 'invalid_client',
+                                    error_description: 'Invalid client credentials'
+                                })
+                            ];
+                        }
+                        return [
+                            4,
+                            _dcrutilsts.getAuthCode(store, code)
+                        ];
+                    case 2:
+                        authCode = _state.sent();
+                        if (!authCode) {
+                            return [
+                                2,
+                                res.status(400).json({
+                                    error: 'invalid_grant',
+                                    error_description: 'Invalid or expired authorization code'
+                                })
+                            ];
+                        }
+                        // Validate authorization code
+                        if (authCode.client_id !== client_id || authCode.redirect_uri !== redirect_uri) {
+                            return [
+                                2,
+                                res.status(400).json({
+                                    error: 'invalid_grant',
+                                    error_description: 'Authorization code mismatch'
+                                })
+                            ];
+                        }
+                        if (!(Date.now() > authCode.expires_at)) return [
+                            3,
+                            4
+                        ];
+                        return [
+                            4,
+                            _dcrutilsts.deleteAuthCode(store, code)
+                        ];
+                    case 3:
+                        _state.sent();
+                        return [
+                            2,
+                            res.status(400).json({
+                                error: 'invalid_grant',
+                                error_description: 'Authorization code expired'
+                            })
+                        ];
+                    case 4:
+                        // Validate PKCE if used
+                        if (authCode.code_challenge) {
+                            ;
+                            if (!code_verifier) {
+                                return [
+                                    2,
+                                    res.status(400).json({
+                                        error: 'invalid_request',
+                                        error_description: 'code_verifier is required for PKCE'
+                                    })
+                                ];
+                            }
+                            // Validate code_verifier against code_challenge
+                            method = (_authCode_code_challenge_method = authCode.code_challenge_method) !== null && _authCode_code_challenge_method !== void 0 ? _authCode_code_challenge_method : 'plain';
+                            computedChallenge = method === 'S256' ? (0, _crypto.createHash)('sha256').update(code_verifier).digest('base64url') : code_verifier;
+                            if (computedChallenge !== authCode.code_challenge) {
+                                return [
+                                    2,
+                                    res.status(400).json({
+                                        error: 'invalid_grant',
+                                        error_description: 'Invalid code_verifier'
+                                    })
+                                ];
+                            }
+                        }
+                        // Delete authorization code (one-time use)
+                        return [
+                            4,
+                            _dcrutilsts.deleteAuthCode(store, code)
+                        ];
+                    case 5:
+                        _state.sent();
+                        // Generate DCR access token
+                        accessToken = (0, _crypto.randomUUID)();
+                        refreshTokenValue = (0, _crypto.randomUUID)();
+                        tokenData = {
+                            access_token: accessToken,
+                            token_type: 'Bearer',
+                            expires_in: 3600,
+                            refresh_token: refreshTokenValue,
+                            scope: authCode.scope,
+                            client_id: client_id,
+                            providerTokens: authCode.providerTokens,
+                            created_at: Date.now()
+                        };
+                        return [
+                            4,
+                            _dcrutilsts.setAccessToken(store, accessToken, tokenData)
+                        ];
+                    case 6:
+                        _state.sent();
+                        return [
+                            4,
+                            _dcrutilsts.setRefreshToken(store, refreshTokenValue, tokenData)
+                        ];
+                    case 7:
+                        _state.sent();
+                        // Store provider tokens indexed by DCR access token
+                        return [
+                            4,
+                            _dcrutilsts.setProviderTokens(store, accessToken, authCode.providerTokens)
+                        ];
+                    case 8:
+                        _state.sent();
+                        // Return token response
+                        return [
+                            2,
+                            res.json({
+                                access_token: tokenData.access_token,
+                                token_type: tokenData.token_type,
+                                expires_in: tokenData.expires_in,
+                                refresh_token: tokenData.refresh_token,
+                                scope: tokenData.scope
+                            })
+                        ];
+                    case 9:
+                        if (!(grant_type === 'refresh_token')) return [
+                            3,
+                            18
+                        ];
+                        // Refresh Token Grant
+                        if (!refresh_token || !client_id) {
+                            return [
+                                2,
+                                res.status(400).json({
+                                    error: 'invalid_request',
+                                    error_description: 'refresh_token and client_id are required'
+                                })
+                            ];
+                        }
+                        return [
+                            4,
+                            _dcrutilsts.validateClient(store, client_id, client_secret !== null && client_secret !== void 0 ? client_secret : '')
+                        ];
+                    case 10:
+                        isValidClient1 = _state.sent();
+                        if (!isValidClient1) {
+                            return [
+                                2,
+                                res.status(401).json({
+                                    error: 'invalid_client',
+                                    error_description: 'Invalid client credentials'
+                                })
+                            ];
+                        }
+                        return [
+                            4,
+                            _dcrutilsts.getRefreshToken(store, refresh_token)
+                        ];
+                    case 11:
+                        tokenData1 = _state.sent();
+                        if (!tokenData1 || tokenData1.client_id !== client_id) {
+                            return [
+                                2,
+                                res.status(400).json({
+                                    error: 'invalid_grant',
+                                    error_description: 'Invalid refresh token'
+                                })
+                            ];
+                        }
+                        // Refresh provider tokens if available
+                        refreshedProviderTokens = tokenData1.providerTokens;
+                        if (!tokenData1.providerTokens.refreshToken) return [
+                            3,
+                            15
+                        ];
+                        _state.label = 12;
+                    case 12:
+                        _state.trys.push([
+                            12,
+                            14,
+                            ,
+                            15
+                        ]);
+                        // Create DcrOAuthProvider instance to refresh Microsoft tokens
+                        provider = new _dcrts.DcrOAuthProvider(_object_spread_props(_object_spread({
+                            clientId: clientConfig.clientId
+                        }, clientConfig.clientSecret && {
+                            clientSecret: clientConfig.clientSecret
+                        }), {
+                            tenantId: (_clientConfig_tenantId = clientConfig.tenantId) !== null && _clientConfig_tenantId !== void 0 ? _clientConfig_tenantId : 'common',
+                            scope: tokenData1.scope,
+                            verifyEndpoint: "".concat(baseUrl, "/oauth/verify"),
+                            logger: {
+                                info: console.log,
+                                error: console.error,
+                                warn: console.warn,
+                                debug: function() {}
+                            }
+                        }));
+                        return [
+                            4,
+                            provider.refreshAccessToken(tokenData1.providerTokens.refreshToken)
+                        ];
+                    case 13:
+                        // Refresh the Microsoft access token
+                        refreshedProviderTokens = _state.sent();
+                        return [
+                            3,
+                            15
+                        ];
+                    case 14:
+                        error = _state.sent();
+                        // If refresh fails, continue with existing tokens (they may still be valid)
+                        console.warn('Provider token refresh failed, using existing tokens:', _instanceof(error, Error) ? error.message : String(error));
+                        return [
+                            3,
+                            15
+                        ];
+                    case 15:
+                        // Generate new DCR access token
+                        newAccessToken = (0, _crypto.randomUUID)();
+                        newTokenData = _object_spread_props(_object_spread({}, tokenData1), {
+                            access_token: newAccessToken,
+                            created_at: Date.now()
+                        });
+                        return [
+                            4,
+                            _dcrutilsts.setAccessToken(store, newAccessToken, newTokenData)
+                        ];
+                    case 16:
+                        _state.sent();
+                        // Store refreshed provider tokens indexed by new DCR access token
+                        return [
+                            4,
+                            _dcrutilsts.setProviderTokens(store, newAccessToken, refreshedProviderTokens)
+                        ];
+                    case 17:
+                        _state.sent();
+                        return [
+                            2,
+                            res.json({
+                                access_token: newTokenData.access_token,
+                                token_type: newTokenData.token_type,
+                                expires_in: newTokenData.expires_in,
+                                scope: newTokenData.scope
+                            })
+                        ];
+                    case 18:
+                        return [
+                            2,
+                            res.status(400).json({
+                                error: 'unsupported_grant_type',
+                                error_description: 'Only authorization_code and refresh_token grants are supported'
+                            })
+                        ];
+                }
+            });
+        })();
+    });
+    /**
+   * OAuth Token Revocation (RFC 7009)
+   * POST /oauth/revoke
+   */ router.post('/oauth/revoke', function(req, res) {
+        return _async_to_generator(function() {
+            var _req_body, token, token_type_hint, client_id, client_secret, isValidClient;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        _req_body = req.body, token = _req_body.token, token_type_hint = _req_body.token_type_hint, client_id = _req_body.client_id, client_secret = _req_body.client_secret;
+                        if (!token) {
+                            return [
+                                2,
+                                res.status(400).json({
+                                    error: 'invalid_request',
+                                    error_description: 'token is required'
+                                })
+                            ];
+                        }
+                        if (!(client_id && client_secret)) return [
+                            3,
+                            2
+                        ];
+                        return [
+                            4,
+                            _dcrutilsts.validateClient(store, client_id, client_secret)
+                        ];
+                    case 1:
+                        isValidClient = _state.sent();
+                        if (!isValidClient) {
+                            return [
+                                2,
+                                res.status(401).json({
+                                    error: 'invalid_client',
+                                    error_description: 'Invalid client credentials'
+                                })
+                            ];
+                        }
+                        _state.label = 2;
+                    case 2:
+                        if (!(token_type_hint === 'refresh_token')) return [
+                            3,
+                            4
+                        ];
+                        return [
+                            4,
+                            _dcrutilsts.deleteRefreshToken(store, token)
+                        ];
+                    case 3:
+                        _state.sent();
+                        return [
+                            3,
+                            11
+                        ];
+                    case 4:
+                        if (!(token_type_hint === 'access_token')) return [
+                            3,
+                            7
+                        ];
+                        return [
+                            4,
+                            _dcrutilsts.deleteAccessToken(store, token)
+                        ];
+                    case 5:
+                        _state.sent();
+                        return [
+                            4,
+                            _dcrutilsts.deleteProviderTokens(store, token)
+                        ];
+                    case 6:
+                        _state.sent();
+                        return [
+                            3,
+                            11
+                        ];
+                    case 7:
+                        // No hint - try both
+                        return [
+                            4,
+                            _dcrutilsts.deleteRefreshToken(store, token)
+                        ];
+                    case 8:
+                        _state.sent();
+                        return [
+                            4,
+                            _dcrutilsts.deleteAccessToken(store, token)
+                        ];
+                    case 9:
+                        _state.sent();
+                        return [
+                            4,
+                            _dcrutilsts.deleteProviderTokens(store, token)
+                        ];
+                    case 10:
+                        _state.sent();
+                        _state.label = 11;
+                    case 11:
+                        // RFC 7009: Return 200 even if token not found
+                        return [
+                            2,
+                            res.status(200).send()
+                        ];
+                }
+            });
+        })();
+    });
+    /**
+   * Token Verification Endpoint
+   * GET /oauth/verify
+   *
+   * Validates bearer tokens for Resource Server.
+   * Returns AuthInfo with provider tokens for stateless DCR pattern.
+   */ router.get('/oauth/verify', function(req, res) {
+        return _async_to_generator(function() {
+            var authHeader, token, tokenData, now, expiresAt, authInfo;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        // Extract bearer token from Authorization header
+                        authHeader = req.headers.authorization;
+                        if (!authHeader || !authHeader.startsWith('Bearer ')) {
+                            return [
+                                2,
+                                res.status(401).json({
+                                    error: 'invalid_request',
+                                    error_description: 'Missing or invalid Authorization header'
+                                })
+                            ];
+                        }
+                        token = authHeader.substring(7); // Remove 'Bearer ' prefix
+                        return [
+                            4,
+                            _dcrutilsts.getAccessToken(store, token)
+                        ];
+                    case 1:
+                        tokenData = _state.sent();
+                        if (!tokenData) {
+                            return [
+                                2,
+                                res.status(401).json({
+                                    error: 'invalid_token',
+                                    error_description: 'Unknown or expired access token'
+                                })
+                            ];
+                        }
+                        // Check if token is expired
+                        now = Date.now();
+                        expiresAt = tokenData.created_at + tokenData.expires_in * 1000;
+                        if (!(now > expiresAt)) return [
+                            3,
+                            4
+                        ];
+                        // Remove expired token
+                        return [
+                            4,
+                            _dcrutilsts.deleteAccessToken(store, token)
+                        ];
+                    case 2:
+                        _state.sent();
+                        return [
+                            4,
+                            _dcrutilsts.deleteProviderTokens(store, token)
+                        ];
+                    case 3:
+                        _state.sent();
+                        return [
+                            2,
+                            res.status(401).json({
+                                error: 'invalid_token',
+                                error_description: 'Access token has expired'
+                            })
+                        ];
+                    case 4:
+                        // Return AuthInfo with provider tokens for stateless DCR
+                        authInfo = {
+                            token: token,
+                            clientId: tokenData.client_id,
+                            scopes: tokenData.scope ? tokenData.scope.split(' ') : [],
+                            expiresAt: expiresAt,
+                            providerTokens: tokenData.providerTokens
+                        };
+                        return [
+                            2,
+                            res.json(authInfo)
+                        ];
+                }
+            });
+        })();
+    });
+    /**
+   * Debug endpoint to list registered clients (development only)
+   */ router.get('/debug/clients', function(_req, res) {
+        return _async_to_generator(function() {
+            var clients;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        return [
+                            4,
+                            _dcrutilsts.listClients(store)
+                        ];
+                    case 1:
+                        clients = _state.sent();
+                        res.json(clients);
+                        return [
+                            2
+                        ];
+                }
+            });
+        })();
+    });
+    return router;
+}
+/* CJS INTEROP */ if (exports.__esModule && exports.default) { try { Object.defineProperty(exports.default, '__esModule', { value: true }); for (var key in exports) { exports.default[key] = exports[key]; } } catch (_) {}; module.exports = exports.default; }