@mcp-z/oauth-microsoft 1.0.0

package/dist/cjs/providers/dcr.js

@@ -0,0 +1,600 @@
+/**
+ * DCR Provider - Stateless Dynamic Client Registration Provider
+ *
+ * Implements stateless provider pattern where provider tokens are received from
+ * token verification context rather than managed by the provider itself.
+ *
+ * Use case: MCP HTTP servers with DCR authentication where client manages tokens
+ * and provider only handles Microsoft Graph API calls with provided credentials.
+ */ "use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "DcrOAuthProvider", {
+    enumerable: true,
+    get: function() {
+        return DcrOAuthProvider;
+    }
+});
+var _types = require("@modelcontextprotocol/sdk/types.js");
+var _fetchwithtimeoutts = require("../lib/fetch-with-timeout.js");
+function _array_like_to_array(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_without_holes(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array(arr);
+}
+function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) {
+        resolve(value);
+    } else {
+        Promise.resolve(value).then(_next, _throw);
+    }
+}
+function _async_to_generator(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _class_call_check(instance, Constructor) {
+    if (!(instance instanceof Constructor)) {
+        throw new TypeError("Cannot call a class as a function");
+    }
+}
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _instanceof(left, right) {
+    if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
+        return !!right[Symbol.hasInstance](left);
+    } else {
+        return left instanceof right;
+    }
+}
+function _iterable_to_array(iter) {
+    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
+}
+function _non_iterable_spread() {
+    throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _object_spread(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property(target, key, source[key]);
+        });
+    }
+    return target;
+}
+function ownKeys(object, enumerableOnly) {
+    var keys = Object.keys(object);
+    if (Object.getOwnPropertySymbols) {
+        var symbols = Object.getOwnPropertySymbols(object);
+        if (enumerableOnly) {
+            symbols = symbols.filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(object, sym).enumerable;
+            });
+        }
+        keys.push.apply(keys, symbols);
+    }
+    return keys;
+}
+function _object_spread_props(target, source) {
+    source = source != null ? source : {};
+    if (Object.getOwnPropertyDescriptors) {
+        Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
+    } else {
+        ownKeys(Object(source)).forEach(function(key) {
+            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
+        });
+    }
+    return target;
+}
+function _to_consumable_array(arr) {
+    return _array_without_holes(arr) || _iterable_to_array(arr) || _unsupported_iterable_to_array(arr) || _non_iterable_spread();
+}
+function _type_of(obj) {
+    "@swc/helpers - typeof";
+    return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
+}
+function _unsupported_iterable_to_array(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array(o, minLen);
+}
+function _ts_generator(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype), d = Object.defineProperty;
+    return d(g, "next", {
+        value: verb(0)
+    }), d(g, "throw", {
+        value: verb(1)
+    }), d(g, "return", {
+        value: verb(2)
+    }), typeof Symbol === "function" && d(g, Symbol.iterator, {
+        value: function() {
+            return this;
+        }
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+var DcrOAuthProvider = /*#__PURE__*/ function() {
+    "use strict";
+    function DcrOAuthProvider(config) {
+        _class_call_check(this, DcrOAuthProvider);
+        this.emailCache = new Map();
+        this.config = config;
+    }
+    var _proto = DcrOAuthProvider.prototype;
+    /**
+   * Create Microsoft Graph auth provider from provider tokens
+   *
+   * This is the core stateless pattern - provider receives tokens from context
+   * (token verification, HTTP request) and creates auth provider on-demand.
+   *
+   * @param tokens - Provider tokens (Microsoft access/refresh tokens)
+   * @returns Microsoft Graph-compatible auth provider
+   */ _proto.toAuthProvider = function toAuthProvider(tokens) {
+        var _this = this;
+        // Capture tokens in closure for auth provider
+        var currentTokens = _object_spread({}, tokens);
+        return {
+            getAccessToken: function() {
+                return _async_to_generator(function() {
+                    var refreshedTokens, error;
+                    return _ts_generator(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                // Check if token is still valid
+                                if (this.isTokenValid(currentTokens)) {
+                                    return [
+                                        2,
+                                        currentTokens.accessToken
+                                    ];
+                                }
+                                if (!currentTokens.refreshToken) return [
+                                    3,
+                                    4
+                                ];
+                                _state.label = 1;
+                            case 1:
+                                _state.trys.push([
+                                    1,
+                                    3,
+                                    ,
+                                    4
+                                ]);
+                                return [
+                                    4,
+                                    this.refreshAccessToken(currentTokens.refreshToken)
+                                ];
+                            case 2:
+                                refreshedTokens = _state.sent();
+                                currentTokens = refreshedTokens;
+                                return [
+                                    2,
+                                    currentTokens.accessToken
+                                ];
+                            case 3:
+                                error = _state.sent();
+                                throw new Error("Token refresh failed: ".concat(_instanceof(error, Error) ? error.message : String(error)));
+                            case 4:
+                                // No refresh token - token expired and cannot refresh
+                                throw new Error('Access token expired and no refresh token available');
+                        }
+                    });
+                }).call(_this);
+            }
+        };
+    };
+    /**
+   * Check if token is still valid (with 1 minute buffer)
+   */ _proto.isTokenValid = function isTokenValid(tokens) {
+        if (!tokens.expiresAt) return true; // No expiry = assume valid
+        return Date.now() < tokens.expiresAt - 60000; // 1 minute buffer
+    };
+    /**
+   * Refresh Microsoft access token using refresh token
+   *
+   * @param refreshToken - Microsoft refresh token
+   * @returns New provider tokens
+   */ _proto.refreshAccessToken = function refreshAccessToken(refreshToken) {
+        return _async_to_generator(function() {
+            var _this_config, clientId, clientSecret, tenantId, scope, customTokenUrl, tokenUrl, params, body, response, errorText, tokenResponse;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        _this_config = this.config, clientId = _this_config.clientId, clientSecret = _this_config.clientSecret, tenantId = _this_config.tenantId, scope = _this_config.scope, customTokenUrl = _this_config.tokenUrl;
+                        tokenUrl = customTokenUrl !== null && customTokenUrl !== void 0 ? customTokenUrl : "https://login.microsoftonline.com/".concat(tenantId, "/oauth2/v2.0/token");
+                        params = {
+                            refresh_token: refreshToken,
+                            client_id: clientId,
+                            grant_type: 'refresh_token',
+                            scope: scope
+                        };
+                        // Only include client_secret for confidential clients
+                        if (clientSecret) {
+                            params.client_secret = clientSecret;
+                        }
+                        body = new URLSearchParams(params);
+                        return [
+                            4,
+                            (0, _fetchwithtimeoutts.fetchWithTimeout)(tokenUrl, {
+                                method: 'POST',
+                                headers: {
+                                    'Content-Type': 'application/x-www-form-urlencoded'
+                                },
+                                body: body.toString()
+                            })
+                        ];
+                    case 1:
+                        response = _state.sent();
+                        if (!!response.ok) return [
+                            3,
+                            3
+                        ];
+                        return [
+                            4,
+                            response.text()
+                        ];
+                    case 2:
+                        errorText = _state.sent();
+                        throw new Error("Token refresh failed: ".concat(response.status, " ").concat(errorText));
+                    case 3:
+                        return [
+                            4,
+                            response.json()
+                        ];
+                    case 4:
+                        tokenResponse = _state.sent();
+                        return [
+                            2,
+                            _object_spread({
+                                accessToken: tokenResponse.access_token,
+                                refreshToken: refreshToken
+                            }, tokenResponse.expires_in !== undefined && {
+                                expiresAt: Date.now() + tokenResponse.expires_in * 1000
+                            }, tokenResponse.scope !== undefined && {
+                                scope: tokenResponse.scope
+                            })
+                        ];
+                }
+            });
+        }).call(this);
+    };
+    /**
+   * Get user email from Microsoft Graph API (with caching)
+   *
+   * @param tokens - Provider tokens to use for API call
+   * @returns User's email address
+   */ _proto.getUserEmail = function getUserEmail(tokens) {
+        return _async_to_generator(function() {
+            var _userInfo_mail, _tokens_expiresAt, cacheKey, cached, auth, accessToken, response, _, _1, _2, userInfo, email;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        cacheKey = tokens.accessToken;
+                        cached = this.emailCache.get(cacheKey);
+                        // Check cache (with same expiry as access token)
+                        if (cached && Date.now() < cached.expiresAt) {
+                            return [
+                                2,
+                                cached.email
+                            ];
+                        }
+                        auth = this.toAuthProvider(tokens);
+                        return [
+                            4,
+                            auth.getAccessToken()
+                        ];
+                    case 1:
+                        accessToken = _state.sent();
+                        return [
+                            4,
+                            (0, _fetchwithtimeoutts.fetchWithTimeout)('https://graph.microsoft.com/v1.0/me', {
+                                headers: {
+                                    Authorization: "Bearer ".concat(accessToken)
+                                }
+                            })
+                        ];
+                    case 2:
+                        response = _state.sent();
+                        if (!!response.ok) return [
+                            3,
+                            4
+                        ];
+                        _ = Error.bind;
+                        _2 = (_1 = "Failed to get user info: ".concat(response.status, " ")).concat;
+                        return [
+                            4,
+                            response.text()
+                        ];
+                    case 3:
+                        throw new (_.apply(Error, [
+                            void 0,
+                            _2.apply(_1, [
+                                _state.sent()
+                            ])
+                        ]));
+                    case 4:
+                        return [
+                            4,
+                            response.json()
+                        ];
+                    case 5:
+                        userInfo = _state.sent();
+                        email = (_userInfo_mail = userInfo.mail) !== null && _userInfo_mail !== void 0 ? _userInfo_mail : userInfo.userPrincipalName;
+                        // Cache with token expiration (default 1 hour if not specified)
+                        this.emailCache.set(cacheKey, {
+                            email: email,
+                            expiresAt: (_tokens_expiresAt = tokens.expiresAt) !== null && _tokens_expiresAt !== void 0 ? _tokens_expiresAt : Date.now() + 3600000
+                        });
+                        return [
+                            2,
+                            email
+                        ];
+                }
+            });
+        }).call(this);
+    };
+    /**
+   * Auth middleware for HTTP servers with DCR bearer auth
+   * Validates bearer tokens and enriches extra with provider tokens
+   *
+   * Pattern:
+   * ```typescript
+   * const provider = new DcrOAuthProvider({ ..., verifyEndpoint: 'http://localhost:3000/oauth/verify' });
+   * const middleware = provider.authMiddleware();
+   * const tools = toolFactories.map(f => f()).map(middleware.withToolAuth);
+   * const resources = resourceFactories.map(f => f()).map(middleware.withResourceAuth);
+   * const prompts = promptFactories.map(f => f()).map(middleware.withPromptAuth);
+   * ```
+   */ _proto.authMiddleware = function authMiddleware() {
+        var _this = this;
+        // Shared wrapper logic - extracts extra parameter from specified position
+        // Generic T captures the actual module type; handler is cast from unknown to callable
+        var wrapAtPosition = function(module, extraPosition) {
+            var _this1 = _this;
+            var originalHandler = module.handler;
+            var wrappedHandler = function() {
+                for(var _len = arguments.length, allArgs = new Array(_len), _key = 0; _key < _len; _key++){
+                    allArgs[_key] = arguments[_key];
+                }
+                return _async_to_generator(function() {
+                    var _extra_requestInfo, extra, bearerToken, _ref, authInfo, authHeader, headerValue, match, verifyResponse, verifyData, accountId, error, auth;
+                    return _ts_generator(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                // Extract extra from the correct position
+                                extra = allArgs[extraPosition];
+                                // Option 1: Token already verified by SDK's bearerAuth middleware
+                                if (extra.authInfo && _type_of(extra.authInfo) === 'object') {
+                                    ;
+                                    // authInfo contains the validated token - extract it
+                                    // The SDK's bearerAuth middleware already validated it, but we need the raw token for /oauth/verify
+                                    // Check if authInfo has the token directly, otherwise extract from headers
+                                    authInfo = extra.authInfo;
+                                    bearerToken = (_ref = typeof authInfo.accessToken === 'string' ? authInfo.accessToken : undefined) !== null && _ref !== void 0 ? _ref : typeof authInfo.token === 'string' ? authInfo.token : undefined;
+                                }
+                                // Option 2: Extract from Authorization header
+                                if (!bearerToken && ((_extra_requestInfo = extra.requestInfo) === null || _extra_requestInfo === void 0 ? void 0 : _extra_requestInfo.headers)) {
+                                    authHeader = extra.requestInfo.headers.authorization || extra.requestInfo.headers.Authorization;
+                                    if (authHeader) {
+                                        // Handle both string and string[] types
+                                        headerValue = Array.isArray(authHeader) ? authHeader[0] : authHeader;
+                                        if (headerValue) {
+                                            match = /^Bearer\s+(.+)$/i.exec(headerValue);
+                                            if (match) {
+                                                bearerToken = match[1];
+                                            }
+                                        }
+                                    }
+                                }
+                                if (!bearerToken) {
+                                    throw new _types.McpError(_types.ErrorCode.InvalidRequest, 'Missing Authorization header. DCR mode requires bearer token.');
+                                }
+                                return [
+                                    4,
+                                    (0, _fetchwithtimeoutts.fetchWithTimeout)(this.config.verifyEndpoint, {
+                                        headers: {
+                                            Authorization: "Bearer ".concat(bearerToken)
+                                        }
+                                    })
+                                ];
+                            case 1:
+                                verifyResponse = _state.sent();
+                                if (!verifyResponse.ok) {
+                                    throw new _types.McpError(_types.ErrorCode.InvalidRequest, "Token verification failed: ".concat(verifyResponse.status));
+                                }
+                                return [
+                                    4,
+                                    verifyResponse.json()
+                                ];
+                            case 2:
+                                verifyData = _state.sent();
+                                _state.label = 3;
+                            case 3:
+                                _state.trys.push([
+                                    3,
+                                    5,
+                                    ,
+                                    6
+                                ]);
+                                return [
+                                    4,
+                                    this.getUserEmail(verifyData.providerTokens)
+                                ];
+                            case 4:
+                                accountId = _state.sent();
+                                return [
+                                    3,
+                                    6
+                                ];
+                            case 5:
+                                error = _state.sent();
+                                throw new _types.McpError(_types.ErrorCode.InternalError, "Failed to get user email for DCR authentication: ".concat(_instanceof(error, Error) ? error.message : String(error)));
+                            case 6:
+                                // Create auth provider from provider tokens
+                                auth = this.toAuthProvider(verifyData.providerTokens);
+                                // Inject authContext and logger into extra
+                                extra.authContext = {
+                                    auth: auth,
+                                    accountId: accountId
+                                };
+                                extra.logger = this.config.logger;
+                                return [
+                                    4,
+                                    originalHandler.apply(void 0, _to_consumable_array(allArgs))
+                                ];
+                            case 7:
+                                // Call original handler with all args
+                                return [
+                                    2,
+                                    _state.sent()
+                                ];
+                        }
+                    });
+                }).call(_this1);
+            };
+            return _object_spread_props(_object_spread({}, module), {
+                handler: wrappedHandler
+            });
+        };
+        return {
+            // Use structural constraints to avoid contravariance check on handler type.
+            // wrapAtPosition is now generic and returns T directly.
+            withToolAuth: function(module) {
+                return wrapAtPosition(module, 1);
+            },
+            withResourceAuth: function(module) {
+                return wrapAtPosition(module, 2);
+            },
+            withPromptAuth: function(module) {
+                return wrapAtPosition(module, 0);
+            }
+        };
+    };
+    return DcrOAuthProvider;
+}();
+/* CJS INTEROP */ if (exports.__esModule && exports.default) { try { Object.defineProperty(exports.default, '__esModule', { value: true }); for (var key in exports) { exports.default[key] = exports[key]; } } catch (_) {}; module.exports = exports.default; }

package/dist/cjs/providers/dcr.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/Users/kevin/Dev/Projects/ai/mcp-z/oauth/oauth-microsoft/src/providers/dcr.ts"],"sourcesContent":["/**\n * DCR Provider - Stateless Dynamic Client Registration Provider\n *\n * Implements stateless provider pattern where provider tokens are received from\n * token verification context rather than managed by the provider itself.\n *\n * Use case: MCP HTTP servers with DCR authentication where client manages tokens\n * and provider only handles Microsoft Graph API calls with provided credentials.\n */\n\nimport type { ProviderTokens } from '@mcp-z/oauth';\nimport { ErrorCode, McpError } from '@modelcontextprotocol/sdk/types.js';\nimport { fetchWithTimeout } from '../lib/fetch-with-timeout.ts';\nimport type { AuthContext, EnrichedExtra, Logger, MicrosoftAuthProvider } from '../types.ts';\n\n/**\n * DCR Provider configuration\n */\nexport interface DcrOAuthProviderConfig {\n  /** Microsoft application client ID */\n  clientId: string;\n\n  /** Microsoft application client secret (optional for public clients) */\n  clientSecret?: string;\n\n  /** Azure AD tenant ID */\n  tenantId: string;\n\n  /** OAuth scopes */\n  scope: string;\n\n  /** Custom token endpoint URL (for testing, defaults to Microsoft OAuth endpoint) */\n  tokenUrl?: string;\n\n  /** DCR token verification endpoint URL (e.g., http://localhost:3000/oauth/verify) */\n  verifyEndpoint: string;\n\n  /** Logger for auth operations */\n  logger: Logger;\n}\n\n/**\n * Microsoft Graph TokenResponse\n */\ninterface TokenResponse {\n  access_token: string;\n  refresh_token?: string;\n  expires_in?: number;\n  scope?: string;\n  token_type?: string;\n}\n\n/**\n * DCR Provider - Stateless OAuth provider for Dynamic Client Registration\n *\n * Unlike LoopbackOAuthProvider which manages token storage, DcrOAuthProvider is stateless:\n * - Receives provider tokens from verification context (HTTP bearer auth)\n * - Creates auth providers on-demand from tokens\n * - Handles token refresh using Microsoft OAuth\n * - No token storage dependency\n *\n * Pattern:\n * ```typescript\n * const provider = new DcrOAuthProvider(config);\n * const auth = provider.toAuthProvider(providerTokens);\n * const accessToken = await auth.getAccessToken();\n * ```\n */\nexport class DcrOAuthProvider {\n  private config: DcrOAuthProviderConfig;\n  private emailCache = new Map<string, { email: string; expiresAt: number }>();\n\n  constructor(config: DcrOAuthProviderConfig) {\n    this.config = config;\n  }\n\n  /**\n   * Create Microsoft Graph auth provider from provider tokens\n   *\n   * This is the core stateless pattern - provider receives tokens from context\n   * (token verification, HTTP request) and creates auth provider on-demand.\n   *\n   * @param tokens - Provider tokens (Microsoft access/refresh tokens)\n   * @returns Microsoft Graph-compatible auth provider\n   */\n  toAuthProvider(tokens: ProviderTokens): MicrosoftAuthProvider {\n    // Capture tokens in closure for auth provider\n    let currentTokens = { ...tokens };\n\n    return {\n      getAccessToken: async (): Promise<string> => {\n        // Check if token is still valid\n        if (this.isTokenValid(currentTokens)) {\n          return currentTokens.accessToken;\n        }\n\n        // Token expired - try refresh if available\n        if (currentTokens.refreshToken) {\n          try {\n            const refreshedTokens = await this.refreshAccessToken(currentTokens.refreshToken);\n            currentTokens = refreshedTokens;\n            return currentTokens.accessToken;\n          } catch (error) {\n            throw new Error(`Token refresh failed: ${error instanceof Error ? error.message : String(error)}`);\n          }\n        }\n\n        // No refresh token - token expired and cannot refresh\n        throw new Error('Access token expired and no refresh token available');\n      },\n    };\n  }\n\n  /**\n   * Check if token is still valid (with 1 minute buffer)\n   */\n  private isTokenValid(tokens: ProviderTokens): boolean {\n    if (!tokens.expiresAt) return true; // No expiry = assume valid\n    return Date.now() < tokens.expiresAt - 60000; // 1 minute buffer\n  }\n\n  /**\n   * Refresh Microsoft access token using refresh token\n   *\n   * @param refreshToken - Microsoft refresh token\n   * @returns New provider tokens\n   */\n  async refreshAccessToken(refreshToken: string): Promise<ProviderTokens> {\n    const { clientId, clientSecret, tenantId, scope, tokenUrl: customTokenUrl } = this.config;\n\n    const tokenUrl = customTokenUrl ?? `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`;\n    const params: Record<string, string> = {\n      refresh_token: refreshToken,\n      client_id: clientId,\n      grant_type: 'refresh_token',\n      scope,\n    };\n\n    // Only include client_secret for confidential clients\n    if (clientSecret) {\n      params.client_secret = clientSecret;\n    }\n\n    const body = new URLSearchParams(params);\n\n    const response = await fetchWithTimeout(tokenUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: body.toString(),\n    });\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      throw new Error(`Token refresh failed: ${response.status} ${errorText}`);\n    }\n\n    const tokenResponse = (await response.json()) as TokenResponse;\n\n    return {\n      accessToken: tokenResponse.access_token,\n      refreshToken: refreshToken, // Keep original refresh token\n      ...(tokenResponse.expires_in !== undefined && { expiresAt: Date.now() + tokenResponse.expires_in * 1000 }),\n      ...(tokenResponse.scope !== undefined && { scope: tokenResponse.scope }),\n    };\n  }\n\n  /**\n   * Get user email from Microsoft Graph API (with caching)\n   *\n   * @param tokens - Provider tokens to use for API call\n   * @returns User's email address\n   */\n  async getUserEmail(tokens: ProviderTokens): Promise<string> {\n    const cacheKey = tokens.accessToken;\n    const cached = this.emailCache.get(cacheKey);\n\n    // Check cache (with same expiry as access token)\n    if (cached && Date.now() < cached.expiresAt) {\n      return cached.email;\n    }\n\n    const auth = this.toAuthProvider(tokens);\n    const accessToken = await auth.getAccessToken();\n\n    const response = await fetchWithTimeout('https://graph.microsoft.com/v1.0/me', {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n      },\n    });\n\n    if (!response.ok) {\n      throw new Error(`Failed to get user info: ${response.status} ${await response.text()}`);\n    }\n\n    const userInfo = (await response.json()) as { mail?: string; userPrincipalName: string };\n    const email = userInfo.mail ?? userInfo.userPrincipalName;\n\n    // Cache with token expiration (default 1 hour if not specified)\n    this.emailCache.set(cacheKey, {\n      email,\n      expiresAt: tokens.expiresAt ?? Date.now() + 3600000,\n    });\n\n    return email;\n  }\n\n  /**\n   * Auth middleware for HTTP servers with DCR bearer auth\n   * Validates bearer tokens and enriches extra with provider tokens\n   *\n   * Pattern:\n   * ```typescript\n   * const provider = new DcrOAuthProvider({ ..., verifyEndpoint: 'http://localhost:3000/oauth/verify' });\n   * const middleware = provider.authMiddleware();\n   * const tools = toolFactories.map(f => f()).map(middleware.withToolAuth);\n   * const resources = resourceFactories.map(f => f()).map(middleware.withResourceAuth);\n   * const prompts = promptFactories.map(f => f()).map(middleware.withPromptAuth);\n   * ```\n   */\n  authMiddleware() {\n    // Shared wrapper logic - extracts extra parameter from specified position\n    // Generic T captures the actual module type; handler is cast from unknown to callable\n    const wrapAtPosition = <T extends { name: string; handler: unknown; [key: string]: unknown }>(module: T, extraPosition: number): T => {\n      const originalHandler = module.handler as (...args: unknown[]) => Promise<unknown>;\n\n      const wrappedHandler = async (...allArgs: unknown[]) => {\n        // Extract extra from the correct position\n        const extra = allArgs[extraPosition] as EnrichedExtra;\n\n        // Extract DCR bearer token from SDK's authInfo (if present) or request headers\n        let bearerToken: string | undefined;\n\n        // Option 1: Token already verified by SDK's bearerAuth middleware\n        if (extra.authInfo && typeof extra.authInfo === 'object') {\n          // authInfo contains the validated token - extract it\n          // The SDK's bearerAuth middleware already validated it, but we need the raw token for /oauth/verify\n          // Check if authInfo has the token directly, otherwise extract from headers\n          const authInfo = extra.authInfo as unknown as Record<string, unknown>;\n          bearerToken = (typeof authInfo.accessToken === 'string' ? authInfo.accessToken : undefined) ?? (typeof authInfo.token === 'string' ? authInfo.token : undefined);\n        }\n\n        // Option 2: Extract from Authorization header\n        if (!bearerToken && extra.requestInfo?.headers) {\n          const authHeader = extra.requestInfo.headers.authorization || extra.requestInfo.headers.Authorization;\n          if (authHeader) {\n            // Handle both string and string[] types\n            const headerValue = Array.isArray(authHeader) ? authHeader[0] : authHeader;\n            if (headerValue) {\n              const match = /^Bearer\\s+(.+)$/i.exec(headerValue);\n              if (match) {\n                bearerToken = match[1];\n              }\n            }\n          }\n        }\n\n        if (!bearerToken) {\n          throw new McpError(ErrorCode.InvalidRequest, 'Missing Authorization header. DCR mode requires bearer token.');\n        }\n\n        // Call /oauth/verify to validate DCR token and get provider tokens\n        const verifyResponse = await fetchWithTimeout(this.config.verifyEndpoint, {\n          headers: { Authorization: `Bearer ${bearerToken}` },\n        });\n\n        if (!verifyResponse.ok) {\n          throw new McpError(ErrorCode.InvalidRequest, `Token verification failed: ${verifyResponse.status}`);\n        }\n\n        const verifyData = (await verifyResponse.json()) as {\n          providerTokens: ProviderTokens;\n        };\n\n        // Fetch user email to use as accountId (with caching)\n        let accountId: string;\n        try {\n          accountId = await this.getUserEmail(verifyData.providerTokens);\n        } catch (error) {\n          throw new McpError(ErrorCode.InternalError, `Failed to get user email for DCR authentication: ${error instanceof Error ? error.message : String(error)}`);\n        }\n\n        // Create auth provider from provider tokens\n        const auth = this.toAuthProvider(verifyData.providerTokens);\n\n        // Inject authContext and logger into extra\n        (extra as { authContext?: AuthContext }).authContext = {\n          auth,\n          accountId, // User's email address\n        };\n        (extra as { logger?: unknown }).logger = this.config.logger;\n\n        // Call original handler with all args\n        return await originalHandler(...allArgs);\n      };\n\n      return {\n        ...module,\n        handler: wrappedHandler,\n      } as T;\n    };\n\n    return {\n      // Use structural constraints to avoid contravariance check on handler type.\n      // wrapAtPosition is now generic and returns T directly.\n      withToolAuth: <T extends { name: string; config: unknown; handler: unknown }>(module: T) => wrapAtPosition(module, 1),\n      withResourceAuth: <T extends { name: string; template?: unknown; config?: unknown; handler: unknown }>(module: T) => wrapAtPosition(module, 2),\n      withPromptAuth: <T extends { name: string; config: unknown; handler: unknown }>(module: T) => wrapAtPosition(module, 0),\n    };\n  }\n}\n"],"names":["DcrOAuthProvider","config","emailCache","Map","toAuthProvider","tokens","currentTokens","getAccessToken","refreshedTokens","error","isTokenValid","accessToken","refreshToken","refreshAccessToken","Error","message","String","expiresAt","Date","now","clientId","clientSecret","tenantId","scope","customTokenUrl","tokenUrl","params","body","response","errorText","tokenResponse","refresh_token","client_id","grant_type","client_secret","URLSearchParams","fetchWithTimeout","method","headers","toString","ok","text","status","json","access_token","expires_in","undefined","getUserEmail","userInfo","cacheKey","cached","auth","email","get","Authorization","mail","userPrincipalName","set","authMiddleware","wrapAtPosition","module","extraPosition","originalHandler","handler","wrappedHandler","allArgs","extra","bearerToken","authInfo","authHeader","headerValue","match","verifyResponse","verifyData","accountId","token","requestInfo","authorization","Array","isArray","exec","McpError","ErrorCode","InvalidRequest","verifyEndpoint","providerTokens","InternalError","authContext","logger","withToolAuth","withResourceAuth","withPromptAuth"],"mappings":"AAAA;;;;;;;;CAQC;;;;+BA4DYA;;;eAAAA;;;qBAzDuB;kCACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwD1B,IAAA,AAAMA,iCAAN;;aAAMA,iBAICC,MAA8B;gCAJ/BD;aAEHE,aAAa,IAAIC;QAGvB,IAAI,CAACF,MAAM,GAAGA;;iBALLD;IAQX;;;;;;;;GAQC,GACDI,OAAAA,cA0BC,GA1BDA,SAAAA,eAAeC,MAAsB;;QACnC,8CAA8C;QAC9C,IAAIC,gBAAgB,mBAAKD;QAEzB,OAAO;YACLE,gBAAgB;;wBASJC,iBAGCC;;;;gCAXX,gCAAgC;gCAChC,IAAI,IAAI,CAACC,YAAY,CAACJ,gBAAgB;oCACpC;;wCAAOA,cAAcK,WAAW;;gCAClC;qCAGIL,cAAcM,YAAY,EAA1BN;;;;;;;;;;;;gCAEwB;;oCAAM,IAAI,CAACO,kBAAkB,CAACP,cAAcM,YAAY;;;gCAA1EJ,kBAAkB;gCACxBF,gBAAgBE;gCAChB;;oCAAOF,cAAcK,WAAW;;;gCACzBF;gCACP,MAAM,IAAIK,MAAM,AAAC,yBAA+E,OAAvDL,AAAK,YAALA,OAAiBK,SAAQL,MAAMM,OAAO,GAAGC,OAAOP;;gCAI7F,sDAAsD;gCACtD,MAAM,IAAIK,MAAM;;;gBAClB;;QACF;IACF;IAEA;;GAEC,GACD,OAAQJ,YAGP,GAHD,SAAQA,aAAaL,MAAsB;QACzC,IAAI,CAACA,OAAOY,SAAS,EAAE,OAAO,MAAM,2BAA2B;QAC/D,OAAOC,KAAKC,GAAG,KAAKd,OAAOY,SAAS,GAAG,OAAO,kBAAkB;IAClE;IAEA;;;;;GAKC,GACD,OAAMJ,kBAuCL,GAvCD,SAAMA,mBAAmBD,YAAoB;;gBACmC,cAAtEQ,UAAUC,cAAcC,UAAUC,OAAiBC,gBAErDC,UACAC,QAYAC,MAEAC,UASEC,WAIFC;;;;wBA9BwE,eAAA,IAAI,CAAC7B,MAAM,EAAjFmB,WAAsE,aAAtEA,UAAUC,eAA4D,aAA5DA,cAAcC,WAA8C,aAA9CA,UAAUC,QAAoC,aAApCA,OAAiBC,iBAAmB,aAA7BC;wBAE3CA,WAAWD,2BAAAA,4BAAAA,iBAAkB,AAAC,qCAA6C,OAATF,UAAS;wBAC3EI,SAAiC;4BACrCK,eAAenB;4BACfoB,WAAWZ;4BACXa,YAAY;4BACZV,OAAAA;wBACF;wBAEA,sDAAsD;wBACtD,IAAIF,cAAc;4BAChBK,OAAOQ,aAAa,GAAGb;wBACzB;wBAEMM,OAAO,IAAIQ,gBAAgBT;wBAEhB;;4BAAMU,IAAAA,oCAAgB,EAACX,UAAU;gCAChDY,QAAQ;gCACRC,SAAS;oCACP,gBAAgB;gCAClB;gCACAX,MAAMA,KAAKY,QAAQ;4BACrB;;;wBANMX,WAAW;6BAQb,CAACA,SAASY,EAAE,EAAZ;;;;wBACgB;;4BAAMZ,SAASa,IAAI;;;wBAA/BZ,YAAY;wBAClB,MAAM,IAAIf,MAAM,AAAC,yBAA2Ce,OAAnBD,SAASc,MAAM,EAAC,KAAa,OAAVb;;wBAGvC;;4BAAMD,SAASe,IAAI;;;wBAApCb,gBAAiB;wBAEvB;;4BAAO;gCACLnB,aAAamB,cAAcc,YAAY;gCACvChC,cAAcA;+BACVkB,cAAce,UAAU,KAAKC,aAAa;gCAAE7B,WAAWC,KAAKC,GAAG,KAAKW,cAAce,UAAU,GAAG;4BAAK,GACpGf,cAAcP,KAAK,KAAKuB,aAAa;gCAAEvB,OAAOO,cAAcP,KAAK;4BAAC;;;;QAE1E;;IAEA;;;;;GAKC,GACD,OAAMwB,YAgCL,GAhCD,SAAMA,aAAa1C,MAAsB;;gBAuBzB2C,gBAKD3C,mBA3BP4C,UACAC,QAOAC,MACAxC,aAEAiB,qBAUAoB,UACAI;;;;wBAtBAH,WAAW5C,OAAOM,WAAW;wBAC7BuC,SAAS,IAAI,CAAChD,UAAU,CAACmD,GAAG,CAACJ;wBAEnC,iDAAiD;wBACjD,IAAIC,UAAUhC,KAAKC,GAAG,KAAK+B,OAAOjC,SAAS,EAAE;4BAC3C;;gCAAOiC,OAAOE,KAAK;;wBACrB;wBAEMD,OAAO,IAAI,CAAC/C,cAAc,CAACC;wBACb;;4BAAM8C,KAAK5C,cAAc;;;wBAAvCI,cAAc;wBAEH;;4BAAMyB,IAAAA,oCAAgB,EAAC,uCAAuC;gCAC7EE,SAAS;oCACPgB,eAAe,AAAC,UAAqB,OAAZ3C;gCAC3B;4BACF;;;wBAJMiB,WAAW;6BAMb,CAACA,SAASY,EAAE,EAAZ;;;;4BACQ1B;mCAAM,AAAC,4BAA8C,OAAnBc,SAASc,MAAM,EAAC,MAAyB;wBAAtB;;4BAAMd,SAASa,IAAI;;;wBAAlF,MAAM,IAAA,CAAA,EAAA,MAAI3B;;4BAAM;gCAA+C;;0BAAuB;;wBAGtE;;4BAAMc,SAASe,IAAI;;;wBAA/BK,WAAY;wBACZI,SAAQJ,iBAAAA,SAASO,IAAI,cAAbP,4BAAAA,iBAAiBA,SAASQ,iBAAiB;wBAEzD,gEAAgE;wBAChE,IAAI,CAACtD,UAAU,CAACuD,GAAG,CAACR,UAAU;4BAC5BG,OAAAA;4BACAnC,SAAS,GAAEZ,oBAAAA,OAAOY,SAAS,cAAhBZ,+BAAAA,oBAAoBa,KAAKC,GAAG,KAAK;wBAC9C;wBAEA;;4BAAOiC;;;;QACT;;IAEA;;;;;;;;;;;;GAYC,GACDM,OAAAA,cAyFC,GAzFDA,SAAAA;;QACE,0EAA0E;QAC1E,sFAAsF;QACtF,IAAMC,iBAAiB,SAAuEC,QAAWC;;YACvG,IAAMC,kBAAkBF,OAAOG,OAAO;YAEtC,IAAMC,iBAAiB;iDAAUC;oBAAAA;;;wBAiBXC,oBAfdA,OAGFC,aAQa,MADTC,UAMAC,YAGEC,aAEEC,OAaNC,gBAQAC,YAKFC,WAGKjE,OAKH0C;;;;gCAxDN,0CAA0C;gCACpCe,QAAQD,OAAO,CAACJ,cAAc;gCAKpC,kEAAkE;gCAClE,IAAIK,MAAME,QAAQ,IAAI,SAAOF,MAAME,QAAQ,MAAK,UAAU;;oCACxD,qDAAqD;oCACrD,oGAAoG;oCACpG,2EAA2E;oCACrEA,WAAWF,MAAME,QAAQ;oCAC/BD,eAAe,OAAA,OAAOC,SAASzD,WAAW,KAAK,WAAWyD,SAASzD,WAAW,GAAGmC,uBAAlE,kBAAA,OAAiF,OAAOsB,SAASO,KAAK,KAAK,WAAWP,SAASO,KAAK,GAAG7B;gCACxJ;gCAEA,8CAA8C;gCAC9C,IAAI,CAACqB,iBAAeD,qBAAAA,MAAMU,WAAW,cAAjBV,yCAAAA,mBAAmB5B,OAAO,GAAE;oCACxC+B,aAAaH,MAAMU,WAAW,CAACtC,OAAO,CAACuC,aAAa,IAAIX,MAAMU,WAAW,CAACtC,OAAO,CAACgB,aAAa;oCACrG,IAAIe,YAAY;wCACd,wCAAwC;wCAClCC,cAAcQ,MAAMC,OAAO,CAACV,cAAcA,UAAU,CAAC,EAAE,GAAGA;wCAChE,IAAIC,aAAa;4CACTC,QAAQ,mBAAmBS,IAAI,CAACV;4CACtC,IAAIC,OAAO;gDACTJ,cAAcI,KAAK,CAAC,EAAE;4CACxB;wCACF;oCACF;gCACF;gCAEA,IAAI,CAACJ,aAAa;oCAChB,MAAM,IAAIc,eAAQ,CAACC,gBAAS,CAACC,cAAc,EAAE;gCAC/C;gCAGuB;;oCAAM/C,IAAAA,oCAAgB,EAAC,IAAI,CAACnC,MAAM,CAACmF,cAAc,EAAE;wCACxE9C,SAAS;4CAAEgB,eAAe,AAAC,UAAqB,OAAZa;wCAAc;oCACpD;;;gCAFMK,iBAAiB;gCAIvB,IAAI,CAACA,eAAehC,EAAE,EAAE;oCACtB,MAAM,IAAIyC,eAAQ,CAACC,gBAAS,CAACC,cAAc,EAAE,AAAC,8BAAmD,OAAtBX,eAAe9B,MAAM;gCAClG;gCAEoB;;oCAAM8B,eAAe7B,IAAI;;;gCAAvC8B,aAAc;;;;;;;;;gCAON;;oCAAM,IAAI,CAAC1B,YAAY,CAAC0B,WAAWY,cAAc;;;gCAA7DX,YAAY;;;;;;gCACLjE;gCACP,MAAM,IAAIwE,eAAQ,CAACC,gBAAS,CAACI,aAAa,EAAE,AAAC,oDAA0G,OAAvD7E,AAAK,YAALA,OAAiBK,SAAQL,MAAMM,OAAO,GAAGC,OAAOP;;gCAGlJ,4CAA4C;gCACtC0C,OAAO,IAAI,CAAC/C,cAAc,CAACqE,WAAWY,cAAc;gCAE1D,2CAA2C;gCAC1CnB,MAAwCqB,WAAW,GAAG;oCACrDpC,MAAAA;oCACAuB,WAAAA;gCACF;gCACCR,MAA+BsB,MAAM,GAAG,IAAI,CAACvF,MAAM,CAACuF,MAAM;gCAGpD;;oCAAM1B,sBAAAA,KAAAA,GAAgB,qBAAGG;;;gCADhC,sCAAsC;gCACtC;;oCAAO;;;;gBACT;;YAEA,OAAO,wCACFL;gBACHG,SAASC;;QAEb;QAEA,OAAO;YACL,4EAA4E;YAC5E,wDAAwD;YACxDyB,cAAc,SAAgE7B;uBAAcD,eAAeC,QAAQ;;YACnH8B,kBAAkB,SAAqF9B;uBAAcD,eAAeC,QAAQ;;YAC5I+B,gBAAgB,SAAgE/B;uBAAcD,eAAeC,QAAQ;;QACvH;IACF;WAlPW5D"}