npm - @mcp-z/oauth-microsoft - Versions diffs - 1.0.5 → 1.0.6 - Mend

@mcp-z/oauth-microsoft 1.0.5 → 1.0.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (5) hide show

package/dist/cjs/lib/dcr-router.js +5 -3
package/dist/cjs/lib/dcr-router.js.map +1 -1
package/dist/esm/lib/dcr-router.js +4 -2
package/dist/esm/lib/dcr-router.js.map +1 -1
package/package.json +1 -1

package/dist/cjs/lib/dcr-router.js CHANGED Viewed

@@ -444,7 +444,7 @@ function createDcrRouter(config) {
    * Initiates Microsoft OAuth flow, then generates DCR authorization code
    */ router.get('/oauth/authorize', function(req, res) {
         return _async_to_generator(function() {
-            var _req_query, response_type, client_id, redirect_uri, _req_query_scope, scope, _req_query_state, state, code_challenge, code_challenge_method, client, isValidRedirect, msState, dcrRequestState, msAuthUrl;
+            var _req_query, response_type, client_id, redirect_uri, _req_query_scope, scope, _req_query_state, state, code_challenge, code_challenge_method, client, isValidRedirect, effectiveScope, msState, dcrRequestState, msAuthUrl;
             return _ts_generator(this, function(_state) {
                 switch(_state.label){
                     case 0:
@@ -507,12 +507,14 @@ function createDcrRouter(config) {
                                 })
                             ];
                         }
+                        // Use client-provided scope or fall back to server's supported scopes
+                        effectiveScope = typeof scope === 'string' && scope.trim() !== '' ? scope : scopesSupported.join(' ');
                         // Store DCR request state for Microsoft OAuth callback
                         msState = (0, _crypto.randomUUID)();
                         dcrRequestState = {
                             client_id: client_id,
                             redirect_uri: redirect_uri,
-                            scope: typeof scope === 'string' ? scope : '',
+                            scope: effectiveScope,
                             state: typeof state === 'string' ? state : undefined,
                             code_challenge: typeof code_challenge === 'string' ? code_challenge : undefined,
                             code_challenge_method: typeof code_challenge_method === 'string' ? code_challenge_method : undefined,
@@ -530,7 +532,7 @@ function createDcrRouter(config) {
                         msAuthUrl.searchParams.set('client_id', clientConfig.clientId);
                         msAuthUrl.searchParams.set('response_type', 'code');
                         msAuthUrl.searchParams.set('redirect_uri', "".concat(baseUrl, "/oauth/callback"));
-                        msAuthUrl.searchParams.set('scope', typeof scope === 'string' ? scope : '');
+                        msAuthUrl.searchParams.set('scope', effectiveScope);
                         msAuthUrl.searchParams.set('state', msState);
                         msAuthUrl.searchParams.set('response_mode', 'query');
                         // Redirect user to Microsoft for authorization

package/dist/cjs/lib/dcr-router.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["/Users/kevin/Dev/Projects/mcp-z/oauth-microsoft/src/lib/dcr-router.ts"],"sourcesContent":["/*\n DCR Router - OAuth 2.0 Authorization Server\n \n Implements OAuth 2.0 Dynamic Client Registration Protocol (RFC 7591)\n * and OAuth 2.0 Authorization Server endpoints (RFC 6749, RFC 8414, RFC 9728).\n \n Endpoints:\n * - GET /.well-known/oauth-authorization-server (RFC 8414 metadata)\n * - GET /.well-known/oauth-protected-resource (RFC 9728 metadata - root)\n * - GET /.well-known/oauth-protected-resource/mcp (RFC 9728 metadata - sub-path)\n * - POST /oauth/register (RFC 7591 client registration)\n * - GET /oauth/authorize (RFC 6749 authorization endpoint)\n * - POST /oauth/token (RFC 6749 token endpoint)\n * - POST /oauth/revoke (RFC 7009 token revocation)\n * - GET /oauth/verify (token verification for Resource Server)\n /\n\nimport type { ProviderTokens, RFC8414Metadata, RFC9728Metadata } from '@mcp-z/oauth';\nimport { createHash, randomUUID } from 'crypto';\nimport type { Request, Response } from 'express';\nimport express from 'express';\nimport type { Keyv } from 'keyv';\nimport { DcrOAuthProvider } from '../providers/dcr.ts';\nimport type { AccessToken, AuthorizationCode, OAuthClientConfig } from '../types.ts';\nimport as dcrUtils from './dcr-utils.ts';\n\n/*\n Configuration for DCR Router (self-hosted mode only)\n /\nexport interface DcrRouterConfig {\n /* Single Keyv store for all DCR data /\n store: Keyv;\n\n /* Authorization Server issuer URL /\n issuerUrl: string;\n\n /* Base URL for OAuth endpoints /\n baseUrl: string;\n\n /* Supported OAuth scopes /\n scopesSupported: string[];\n\n /* OAuth client configuration for upstream provider /\n clientConfig: OAuthClientConfig;\n}\n\n/\n Create DCR Router with OAuth 2.0 endpoints (self-hosted mode)\n \n For external mode (Auth0/Stitch), don't call this function - no router needed.\n * The server code should check DcrConfig.mode and only call this for 'self-hosted'.\n \n @param config - Router configuration\n * @returns Express router with OAuth endpoints\n /\nexport function createDcrRouter(config: DcrRouterConfig): express.Router {\n const router = express.Router();\n const { store, issuerUrl, baseUrl, scopesSupported, clientConfig } = config;\n\n router.use('/mcp', (req: Request, res: Response, next) => {\n const authHeader = req.headers.authorization \|\| req.headers.Authorization;\n const headerValue = Array.isArray(authHeader) ? authHeader[0] : authHeader;\n\n if (!headerValue \|\| !headerValue.toLowerCase().startsWith('bearer ')) {\n return res\n .status(401)\n .set('WWW-Authenticate', `Bearer resource_metadata=\"${baseUrl}/.well-known/oauth-protected-resource\"`)\n .json({\n jsonrpc: '2.0',\n error: {\n code: -32600,\n message: 'Missing Authorization header. DCR mode requires bearer token.',\n },\n id: null,\n });\n }\n\n return next();\n });\n\n // Apply required middleware for OAuth 2.0 endpoints (RFC 6749)\n router.use(express.json()); // For /oauth/register (application/json)\n router.use(express.urlencoded({ extended: true })); // For /oauth/token (application/x-www-form-urlencoded)\n\n /\n OAuth Authorization Server Metadata (RFC 8414)\n * GET /.well-known/oauth-authorization-server\n /\n router.get('/.well-known/oauth-authorization-server', (_req: Request, res: Response) => {\n const metadata: RFC8414Metadata = {\n issuer: issuerUrl,\n authorization_endpoint: `${baseUrl}/oauth/authorize`,\n token_endpoint: `${baseUrl}/oauth/token`,\n registration_endpoint: `${baseUrl}/oauth/register`,\n revocation_endpoint: `${baseUrl}/oauth/revoke`,\n scopes_supported: scopesSupported,\n response_types_supported: ['code'],\n grant_types_supported: ['authorization_code', 'refresh_token'],\n token_endpoint_auth_methods_supported: ['client_secret_basic', 'client_secret_post'],\n code_challenge_methods_supported: ['S256', 'plain'],\n service_documentation: `${baseUrl}/docs`,\n };\n res.json(metadata);\n });\n\n /\n OAuth Protected Resource Metadata (RFC 9728 - Root)\n * GET /.well-known/oauth-protected-resource\n /\n router.get('/.well-known/oauth-protected-resource', (_req: Request, res: Response) => {\n const metadata: RFC9728Metadata = {\n resource: baseUrl,\n authorization_servers: [baseUrl],\n scopes_supported: scopesSupported,\n bearer_methods_supported: ['header'],\n };\n res.json(metadata);\n });\n\n /\n OAuth Protected Resource Metadata (RFC 9728 - Sub-path /mcp)\n * GET /.well-known/oauth-protected-resource/mcp\n /\n router.get('/.well-known/oauth-protected-resource/mcp', (_req: Request, res: Response) => {\n const metadata: RFC9728Metadata = {\n resource: `${baseUrl}/mcp`,\n authorization_servers: [baseUrl],\n scopes_supported: scopesSupported,\n bearer_methods_supported: ['header'],\n };\n res.json(metadata);\n });\n\n /\n Dynamic Client Registration (RFC 7591)\n * POST /oauth/register\n /\n router.post('/oauth/register', async (req: Request, res: Response) => {\n try {\n const registrationRequest = req.body;\n\n // Register the client\n const client = await dcrUtils.registerClient(store, registrationRequest);\n\n // Return client information (RFC 7591 Section 3.2.1)\n res.status(201).json(client);\n } catch (error) {\n res.status(400).json({\n error: 'invalid_client_metadata',\n error_description: error instanceof Error ? error.message : 'Invalid registration request',\n });\n }\n });\n\n /\n OAuth Authorization Endpoint (RFC 6749 Section 3.1)\n * GET /oauth/authorize\n \n Initiates Microsoft OAuth flow, then generates DCR authorization code\n /\n router.get('/oauth/authorize', async (req: Request, res: Response) => {\n const { response_type, client_id, redirect_uri, scope = '', state = '', code_challenge, code_challenge_method } = req.query;\n\n // Validate required parameters\n if (response_type !== 'code') {\n return res.status(400).json({\n error: 'unsupported_response_type',\n error_description: 'Only response_type=code is supported',\n });\n }\n\n if (!client_id \|\| typeof client_id !== 'string') {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'client_id is required',\n });\n }\n\n if (!redirect_uri \|\| typeof redirect_uri !== 'string') {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'redirect_uri is required',\n });\n }\n\n // Validate client\n const client = await dcrUtils.getClient(store, client_id);\n if (!client) {\n return res.status(400).json({\n error: 'invalid_client',\n error_description: 'Unknown client_id',\n });\n }\n\n // Validate redirect_uri\n const isValidRedirect = await dcrUtils.validateRedirectUri(store, client_id, redirect_uri);\n if (!isValidRedirect) {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'Invalid redirect_uri',\n });\n }\n\n // Store DCR request state for Microsoft OAuth callback\n const msState = randomUUID();\n const dcrRequestState = {\n client_id,\n redirect_uri,\n scope: typeof scope === 'string' ? scope : '',\n state: typeof state === 'string' ? state : undefined,\n code_challenge: typeof code_challenge === 'string' ? code_challenge : undefined,\n code_challenge_method: typeof code_challenge_method === 'string' ? code_challenge_method : undefined,\n created_at: Date.now(),\n expires_at: Date.now() + 600000, // 10 minutes\n };\n\n await store.set(`dcr:ms-state:${msState}`, dcrRequestState, 600000); // 10 min TTL\n\n // Build Microsoft authorization URL\n const msAuthUrl = new URL(`https://login.microsoftonline.com/${clientConfig.tenantId \|\| 'common'}/oauth2/v2.0/authorize`);\n msAuthUrl.searchParams.set('client_id', clientConfig.clientId);\n msAuthUrl.searchParams.set('response_type', 'code');\n msAuthUrl.searchParams.set('redirect_uri', `${baseUrl}/oauth/callback`);\n msAuthUrl.searchParams.set('scope', typeof scope === 'string' ? scope : '');\n msAuthUrl.searchParams.set('state', msState);\n msAuthUrl.searchParams.set('response_mode', 'query');\n\n // Redirect user to Microsoft for authorization\n return res.redirect(msAuthUrl.toString());\n });\n\n /\n OAuth Callback Handler\n * GET /oauth/callback\n \n Handles callback from Microsoft after user authorization\n /\n router.get('/oauth/callback', async (req: Request, res: Response) => {\n const { code: msCode, state: msState, error, error_description } = req.query;\n\n // Handle Microsoft OAuth errors\n if (error) {\n return res.status(400).json({\n error,\n error_description: error_description \|\| 'Microsoft OAuth authorization failed',\n });\n }\n\n if (!msCode \|\| typeof msCode !== 'string') {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'Authorization code is required',\n });\n }\n\n if (!msState \|\| typeof msState !== 'string') {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'State parameter is required',\n });\n }\n\n // Retrieve original DCR request state\n const dcrRequestState = await store.get(`dcr:ms-state:${msState}`);\n if (!dcrRequestState) {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'Invalid or expired state parameter',\n });\n }\n\n // Delete state (one-time use)\n await store.delete(`dcr:ms-state:${msState}`);\n\n // Exchange Microsoft authorization code for tokens\n try {\n const tokenUrl = `https://login.microsoftonline.com/${clientConfig.tenantId \|\| 'common'}/oauth2/v2.0/token`;\n const tokenParams = new URLSearchParams({\n grant_type: 'authorization_code',\n code: msCode,\n client_id: clientConfig.clientId,\n redirect_uri: `${baseUrl}/oauth/callback`,\n scope: dcrRequestState.scope,\n });\n\n // Add client_secret if available (confidential client)\n if (clientConfig.clientSecret) {\n tokenParams.set('client_secret', clientConfig.clientSecret);\n }\n\n const tokenResponse = await fetch(tokenUrl, {\n method: 'POST',\n headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n body: tokenParams.toString(),\n });\n\n if (!tokenResponse.ok) {\n const errorData = (await tokenResponse.json()) as { error?: string; error_description?: string };\n throw new Error(`Microsoft token exchange failed: ${errorData.error_description \|\| errorData.error}`);\n }\n\n const tokenData = (await tokenResponse.json()) as {\n access_token: string;\n refresh_token?: string;\n expires_in: number;\n scope: string;\n };\n\n // Create provider tokens from Microsoft response\n const providerTokens: ProviderTokens = {\n accessToken: tokenData.access_token,\n ...(tokenData.refresh_token && { refreshToken: tokenData.refresh_token }),\n expiresAt: Date.now() + tokenData.expires_in 1000,\n scope: tokenData.scope,\n };\n\n // Generate DCR authorization code with real provider tokens\n const dcrCode = randomUUID();\n const authCode: AuthorizationCode = {\n code: dcrCode,\n client_id: dcrRequestState.client_id,\n redirect_uri: dcrRequestState.redirect_uri,\n scope: dcrRequestState.scope,\n ...(dcrRequestState.code_challenge && { code_challenge: dcrRequestState.code_challenge }),\n ...(dcrRequestState.code_challenge_method && { code_challenge_method: dcrRequestState.code_challenge_method }),\n providerTokens,\n created_at: Date.now(),\n expires_at: Date.now() + 600000, // 10 minutes\n };\n\n await dcrUtils.setAuthCode(store, dcrCode, authCode);\n\n // Redirect back to MCP client with DCR authorization code\n const clientRedirectUrl = new URL(dcrRequestState.redirect_uri);\n clientRedirectUrl.searchParams.set('code', dcrCode);\n if (dcrRequestState.state) {\n clientRedirectUrl.searchParams.set('state', dcrRequestState.state);\n }\n\n return res.redirect(clientRedirectUrl.toString());\n } catch (error) {\n return res.status(500).json({\n error: 'server_error',\n error_description: error instanceof Error ? error.message : 'Failed to exchange authorization code',\n });\n }\n });\n\n /*\n OAuth Token Endpoint (RFC 6749 Section 3.2)\n * POST /oauth/token\n /\n router.post('/oauth/token', async (req: Request, res: Response) => {\n // Extract client credentials from either body or Basic Auth header\n let client_id = req.body.client_id;\n let client_secret = req.body.client_secret;\n\n // Support client_secret_basic authentication (RFC 6749 Section 2.3.1)\n const authHeader = req.headers.authorization;\n if (authHeader && authHeader.startsWith('Basic ')) {\n const base64Credentials = authHeader.substring(6);\n const credentials = Buffer.from(base64Credentials, 'base64').toString('utf-8');\n const [id, secret] = credentials.split(':');\n client_id = id;\n client_secret = secret;\n }\n\n const { grant_type, code, redirect_uri, refresh_token, code_verifier } = req.body;\n\n // Validate grant_type\n if (!grant_type) {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'grant_type is required',\n });\n }\n\n if (grant_type === 'authorization_code') {\n // Authorization Code Grant\n if (!code \|\| !client_id \|\| !redirect_uri) {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'code, client_id, and redirect_uri are required',\n });\n }\n\n // Validate client credentials\n const isValidClient = await dcrUtils.validateClient(store, client_id, client_secret ?? '');\n if (!isValidClient) {\n return res.status(401).json({\n error: 'invalid_client',\n error_description: 'Invalid client credentials',\n });\n }\n\n // Get authorization code\n const authCode = await dcrUtils.getAuthCode(store, code);\n if (!authCode) {\n return res.status(400).json({\n error: 'invalid_grant',\n error_description: 'Invalid or expired authorization code',\n });\n }\n\n // Validate authorization code\n if (authCode.client_id !== client_id \|\| authCode.redirect_uri !== redirect_uri) {\n return res.status(400).json({\n error: 'invalid_grant',\n error_description: 'Authorization code mismatch',\n });\n }\n\n if (Date.now() > authCode.expires_at) {\n await dcrUtils.deleteAuthCode(store, code);\n return res.status(400).json({\n error: 'invalid_grant',\n error_description: 'Authorization code expired',\n });\n }\n\n // Validate PKCE if used\n if (authCode.code_challenge) {\n if (!code_verifier) {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'code_verifier is required for PKCE',\n });\n }\n\n // Validate code_verifier against code_challenge\n const method = authCode.code_challenge_method ?? 'plain';\n const computedChallenge = method === 'S256' ? createHash('sha256').update(code_verifier).digest('base64url') : code_verifier;\n\n if (computedChallenge !== authCode.code_challenge) {\n return res.status(400).json({\n error: 'invalid_grant',\n error_description: 'Invalid code_verifier',\n });\n }\n }\n\n // Delete authorization code (one-time use)\n await dcrUtils.deleteAuthCode(store, code);\n\n // Generate DCR access token\n const accessToken = randomUUID();\n const refreshTokenValue = randomUUID();\n\n const tokenData: AccessToken = {\n access_token: accessToken,\n token_type: 'Bearer',\n expires_in: 3600,\n refresh_token: refreshTokenValue,\n scope: authCode.scope,\n client_id,\n providerTokens: authCode.providerTokens,\n created_at: Date.now(),\n };\n\n await dcrUtils.setAccessToken(store, accessToken, tokenData);\n await dcrUtils.setRefreshToken(store, refreshTokenValue, tokenData);\n\n // Store provider tokens indexed by DCR access token\n await dcrUtils.setProviderTokens(store, accessToken, authCode.providerTokens);\n\n // Return token response\n return res.json({\n access_token: tokenData.access_token,\n token_type: tokenData.token_type,\n expires_in: tokenData.expires_in,\n refresh_token: tokenData.refresh_token,\n scope: tokenData.scope,\n });\n }\n if (grant_type === 'refresh_token') {\n // Refresh Token Grant\n if (!refresh_token \|\| !client_id) {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'refresh_token and client_id are required',\n });\n }\n\n // Validate client credentials\n const isValidClient = await dcrUtils.validateClient(store, client_id, client_secret ?? '');\n if (!isValidClient) {\n return res.status(401).json({\n error: 'invalid_client',\n error_description: 'Invalid client credentials',\n });\n }\n\n // Get refresh token\n const tokenData = await dcrUtils.getRefreshToken(store, refresh_token);\n if (!tokenData \|\| tokenData.client_id !== client_id) {\n return res.status(400).json({\n error: 'invalid_grant',\n error_description: 'Invalid refresh token',\n });\n }\n\n // Refresh provider tokens if available\n let refreshedProviderTokens = tokenData.providerTokens;\n if (tokenData.providerTokens.refreshToken) {\n try {\n // Create DcrOAuthProvider instance to refresh Microsoft tokens\n const provider = new DcrOAuthProvider({\n clientId: clientConfig.clientId,\n ...(clientConfig.clientSecret && { clientSecret: clientConfig.clientSecret }),\n tenantId: clientConfig.tenantId ?? 'common',\n scope: tokenData.scope,\n verifyEndpoint: `${baseUrl}/oauth/verify`,\n logger: {\n info: console.log,\n error: console.error,\n warn: console.warn,\n debug: () => {},\n },\n });\n\n // Refresh the Microsoft access token\n refreshedProviderTokens = await provider.refreshAccessToken(tokenData.providerTokens.refreshToken);\n } catch (error) {\n // If refresh fails, continue with existing tokens (they may still be valid)\n console.warn('Provider token refresh failed, using existing tokens:', error instanceof Error ? error.message : String(error));\n }\n }\n\n // Generate new DCR access token\n const newAccessToken = randomUUID();\n const newTokenData: AccessToken = {\n ...tokenData,\n access_token: newAccessToken,\n created_at: Date.now(),\n };\n\n await dcrUtils.setAccessToken(store, newAccessToken, newTokenData);\n\n // Store refreshed provider tokens indexed by new DCR access token\n await dcrUtils.setProviderTokens(store, newAccessToken, refreshedProviderTokens);\n\n return res.json({\n access_token: newTokenData.access_token,\n token_type: newTokenData.token_type,\n expires_in: newTokenData.expires_in,\n scope: newTokenData.scope,\n });\n }\n return res.status(400).json({\n error: 'unsupported_grant_type',\n error_description: 'Only authorization_code and refresh_token grants are supported',\n });\n });\n\n /\n OAuth Token Revocation (RFC 7009)\n * POST /oauth/revoke\n /\n router.post('/oauth/revoke', async (req: Request, res: Response) => {\n const { token, token_type_hint, client_id, client_secret } = req.body;\n\n if (!token) {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'token is required',\n });\n }\n\n // Validate client if credentials provided\n if (client_id && client_secret) {\n const isValidClient = await dcrUtils.validateClient(store, client_id, client_secret);\n if (!isValidClient) {\n return res.status(401).json({\n error: 'invalid_client',\n error_description: 'Invalid client credentials',\n });\n }\n }\n\n // Revoke the token\n if (token_type_hint === 'refresh_token') {\n await dcrUtils.deleteRefreshToken(store, token);\n } else if (token_type_hint === 'access_token') {\n await dcrUtils.deleteAccessToken(store, token);\n await dcrUtils.deleteProviderTokens(store, token);\n } else {\n // No hint - try both\n await dcrUtils.deleteRefreshToken(store, token);\n await dcrUtils.deleteAccessToken(store, token);\n await dcrUtils.deleteProviderTokens(store, token);\n }\n\n // RFC 7009: Return 200 even if token not found\n return res.status(200).send();\n });\n\n /\n Token Verification Endpoint\n * GET /oauth/verify\n \n Validates bearer tokens for Resource Server.\n * Returns AuthInfo with provider tokens for stateless DCR pattern.\n /\n router.get('/oauth/verify', async (req: Request, res: Response) => {\n // Extract bearer token from Authorization header\n const authHeader = req.headers.authorization;\n\n if (!authHeader \|\| !authHeader.startsWith('Bearer ')) {\n return res.status(401).json({\n error: 'invalid_request',\n error_description: 'Missing or invalid Authorization header',\n });\n }\n\n const token = authHeader.substring(7); // Remove 'Bearer ' prefix\n\n // Validate token exists in access tokens store\n const tokenData = await dcrUtils.getAccessToken(store, token);\n\n if (!tokenData) {\n return res.status(401).json({\n error: 'invalid_token',\n error_description: 'Unknown or expired access token',\n });\n }\n\n // Check if token is expired\n const now = Date.now();\n const expiresAt = tokenData.created_at + tokenData.expires_in 1000;\n\n if (now > expiresAt) {\n // Remove expired token\n await dcrUtils.deleteAccessToken(store, token);\n await dcrUtils.deleteProviderTokens(store, token);\n return res.status(401).json({\n error: 'invalid_token',\n error_description: 'Access token has expired',\n });\n }\n\n // Return AuthInfo with provider tokens for stateless DCR\n const authInfo = {\n token,\n clientId: tokenData.client_id,\n scopes: tokenData.scope ? tokenData.scope.split(' ') : [],\n expiresAt,\n providerTokens: tokenData.providerTokens,\n };\n\n return res.json(authInfo);\n });\n\n /*\n Debug endpoint to list registered clients (development only)\n */\n router.get('/debug/clients', async (_req: Request, res: Response) => {\n const clients = await dcrUtils.listClients(store);\n res.json(clients);\n });\n\n return router;\n}\n"],"names":["createDcrRouter","config","router","express","Router","store","issuerUrl","baseUrl","scopesSupported","clientConfig","use","req","res","next","authHeader","headers","authorization","Authorization","headerValue","Array","isArray","toLowerCase","startsWith","status","set","json","jsonrpc","error","code","message","id","urlencoded","extended","get","_req","metadata","issuer","authorization_endpoint","token_endpoint","registration_endpoint","revocation_endpoint","scopes_supported","response_types_supported","grant_types_supported","token_endpoint_auth_methods_supported","code_challenge_methods_supported","service_documentation","resource","authorization_servers","bearer_methods_supported","post","registrationRequest","client","body","dcrUtils","registerClient","error_description","Error","response_type","client_id","redirect_uri","scope","state","code_challenge","code_challenge_method","isValidRedirect","msState","dcrRequestState","msAuthUrl","query","getClient","validateRedirectUri","randomUUID","undefined","created_at","Date","now","expires_at","URL","tenantId","searchParams","clientId","redirect","toString","msCode","tokenUrl","tokenParams","tokenResponse","errorData","tokenData","providerTokens","dcrCode","authCode","clientRedirectUrl","delete","URLSearchParams","grant_type","clientSecret","fetch","method","ok","accessToken","access_token","refresh_token","refreshToken","expiresAt","expires_in","setAuthCode","client_secret","base64Credentials","credentials","secret","code_verifier","isValidClient","computedChallenge","refreshTokenValue","refreshedProviderTokens","provider","newAccessToken","newTokenData","substring","Buffer","from","split","validateClient","getAuthCode","deleteAuthCode","createHash","update","digest","token_type","setAccessToken","setRefreshToken","setProviderTokens","getRefreshToken","DcrOAuthProvider","verifyEndpoint","logger","info","console","log","warn","debug","refreshAccessToken","String","token","token_type_hint","deleteRefreshToken","deleteAccessToken","deleteProviderTokens","send","authInfo","getAccessToken","scopes","clients","listClients"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;;;;+BAwCeA;;;eAAAA;;;sBArCuB;8DAEnB;qBAEa;kEAEP;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BnB,SAASA,gBAAgBC,MAAuB;IACrD,IAAMC,SAASC,gBAAO,CAACC,MAAM;IAC7B,IAAQC,QAA6DJ,OAA7DI,OAAOC,YAAsDL,OAAtDK,WAAWC,UAA2CN,OAA3CM,SAASC,kBAAkCP,OAAlCO,iBAAiBC,eAAiBR,OAAjBQ;IAEpDP,OAAOQ,GAAG,CAAC,QAAQ,SAACC,KAAcC,KAAeC;QAC/C,IAAMC,aAAaH,IAAII,OAAO,CAACC,aAAa,IAAIL,IAAII,OAAO,CAACE,aAAa;QACzE,IAAMC,cAAcC,MAAMC,OAAO,CAACN,cAAcA,UAAU,CAAC,EAAE,GAAGA;QAEhE,IAAI,CAACI,eAAe,CAACA,YAAYG,WAAW,GAAGC,UAAU,CAAC,YAAY;YACpE,OAAOV,IACJW,MAAM,CAAC,KACPC,GAAG,CAAC,oBAAoB,AAAC,6BAAoC,OAARjB,SAAQ,2CAC7DkB,IAAI,CAAC;gBACJC,SAAS;gBACTC,OAAO;oBACLC,MAAM,CAAC;oBACPC,SAAS;gBACX;gBACAC,IAAI;YACN;QACJ;QAEA,OAAOjB;IACT;IAEA,+DAA+D;IAC/DX,OAAOQ,GAAG,CAACP,gBAAO,CAACsB,IAAI,KAAK,yCAAyC;IACrEvB,OAAOQ,GAAG,CAACP,gBAAO,CAAC4B,UAAU,CAAC;QAAEC,UAAU;IAAK,KAAK,uDAAuD;IAE3G;;;GAGC,GACD9B,OAAO+B,GAAG,CAAC,2CAA2C,SAACC,MAAetB;QACpE,IAAMuB,WAA4B;YAChCC,QAAQ9B;YACR+B,wBAAwB,AAAC,GAAU,OAAR9B,SAAQ;YACnC+B,gBAAgB,AAAC,GAAU,OAAR/B,SAAQ;YAC3BgC,uBAAuB,AAAC,GAAU,OAARhC,SAAQ;YAClCiC,qBAAqB,AAAC,GAAU,OAARjC,SAAQ;YAChCkC,kBAAkBjC;YAClBkC,0BAA0B;gBAAC;aAAO;YAClCC,uBAAuB;gBAAC;gBAAsB;aAAgB;YAC9DC,uCAAuC;gBAAC;gBAAuB;aAAqB;YACpFC,kCAAkC;gBAAC;gBAAQ;aAAQ;YACnDC,uBAAuB,AAAC,GAAU,OAARvC,SAAQ;QACpC;QACAK,IAAIa,IAAI,CAACU;IACX;IAEA;;;GAGC,GACDjC,OAAO+B,GAAG,CAAC,yCAAyC,SAACC,MAAetB;QAClE,IAAMuB,WAA4B;YAChCY,UAAUxC;YACVyC,uBAAuB;gBAACzC;aAAQ;YAChCkC,kBAAkBjC;YAClByC,0BAA0B;gBAAC;aAAS;QACtC;QACArC,IAAIa,IAAI,CAACU;IACX;IAEA;;;GAGC,GACDjC,OAAO+B,GAAG,CAAC,6CAA6C,SAACC,MAAetB;QACtE,IAAMuB,WAA4B;YAChCY,UAAU,AAAC,GAAU,OAARxC,SAAQ;YACrByC,uBAAuB;gBAACzC;aAAQ;YAChCkC,kBAAkBjC;YAClByC,0BAA0B;gBAAC;aAAS;QACtC;QACArC,IAAIa,IAAI,CAACU;IACX;IAEA;;;GAGC,GACDjC,OAAOgD,IAAI,CAAC,mBAAmB,SAAOvC,KAAcC;;gBAE1CuC,qBAGAC,QAICzB;;;;;;;;;;wBAPDwB,sBAAsBxC,IAAI0C,IAAI;wBAGrB;;4BAAMC,YAASC,cAAc,CAAClD,OAAO8C;;;wBAA9CC,SAAS;wBAEf,qDAAqD;wBACrDxC,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC2B;;;;;;wBACdzB;wBACPf,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;4BACnBE,OAAO;4BACP6B,mBAAmB7B,AAAK,YAALA,OAAiB8B,SAAQ9B,MAAME,OAAO,GAAG;wBAC9D;;;;;;;;;;;QAEJ;;IAEA;;;;;GAKC,GACD3B,OAAO+B,GAAG,CAAC,oBAAoB,SAAOtB,KAAcC;;gBACgED,YAA1G+C,eAAeC,WAAWC,gCAAcC,yBAAYC,OAAYC,gBAAgBC,uBAyBlFZ,QASAa,iBASAC,SACAC,iBAcAC;;;;wBA1D4GzD,aAAAA,IAAI0D,KAAK,EAAnHX,gBAA0G/C,WAA1G+C,eAAeC,YAA2FhD,WAA3FgD,WAAWC,eAAgFjD,WAAhFiD,iCAAgFjD,WAAlEkD,OAAAA,sCAAQ,0CAA0DlD,WAAtDmD,OAAAA,sCAAQ,uBAAIC,iBAA0CpD,WAA1CoD,gBAAgBC,wBAA0BrD,WAA1BqD;wBAExF,+BAA+B;wBAC/B,IAAIN,kBAAkB,QAAQ;4BAC5B;;gCAAO9C,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;wBAEA,IAAI,CAACG,aAAa,OAAOA,cAAc,UAAU;4BAC/C;;gCAAO/C,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;wBAEA,IAAI,CAACI,gBAAgB,OAAOA,iBAAiB,UAAU;4BACrD;;gCAAOhD,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;wBAGe;;4BAAMF,YAASgB,SAAS,CAACjE,OAAOsD;;;wBAAzCP,SAAS;wBACf,IAAI,CAACA,QAAQ;4BACX;;gCAAOxC,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;wBAGwB;;4BAAMF,YAASiB,mBAAmB,CAAClE,OAAOsD,WAAWC;;;wBAAvEK,kBAAkB;wBACxB,IAAI,CAACA,iBAAiB;4BACpB;;gCAAOrD,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;wBAEA,uDAAuD;wBACjDU,UAAUM,IAAAA,kBAAU;wBACpBL,kBAAkB;4BACtBR,WAAAA;4BACAC,cAAAA;4BACAC,OAAO,OAAOA,UAAU,WAAWA,QAAQ;4BAC3CC,OAAO,OAAOA,UAAU,WAAWA,QAAQW;4BAC3CV,gBAAgB,OAAOA,mBAAmB,WAAWA,iBAAiBU;4BACtET,uBAAuB,OAAOA,0BAA0B,WAAWA,wBAAwBS;4BAC3FC,YAAYC,KAAKC,GAAG;4BACpBC,YAAYF,KAAKC,GAAG,KAAK;wBAC3B;wBAEA;;4BAAMvE,MAAMmB,GAAG,CAAC,AAAC,gBAAuB,OAAR0C,UAAWC,iBAAiB;;;wBAA5D,eAAqE,aAAa;wBAElF,oCAAoC;wBAC9BC,YAAY,IAAIU,IAAI,AAAC,qCAAsE,OAAlCrE,aAAasE,QAAQ,IAAI,UAAS;wBACjGX,UAAUY,YAAY,CAACxD,GAAG,CAAC,aAAaf,aAAawE,QAAQ;wBAC7Db,UAAUY,YAAY,CAACxD,GAAG,CAAC,iBAAiB;wBAC5C4C,UAAUY,YAAY,CAACxD,GAAG,CAAC,gBAAgB,AAAC,GAAU,OAARjB,SAAQ;wBACtD6D,UAAUY,YAAY,CAACxD,GAAG,CAAC,SAAS,OAAOqC,UAAU,WAAWA,QAAQ;wBACxEO,UAAUY,YAAY,CAACxD,GAAG,CAAC,SAAS0C;wBACpCE,UAAUY,YAAY,CAACxD,GAAG,CAAC,iBAAiB;wBAE5C,+CAA+C;wBAC/C;;4BAAOZ,IAAIsE,QAAQ,CAACd,UAAUe,QAAQ;;;;QACxC;;IAEA;;;;;GAKC,GACDjF,OAAO+B,GAAG,CAAC,mBAAmB,SAAOtB,KAAcC;;gBACkBD,YAArDyE,QAAelB,SAASvC,SAAO6B,mBAyBvCW,iBAaEkB,UACAC,aAaAC,eAOEC,WAIFC,WAQAC,gBAQAC,SACAC,UAeAC,mBAOClE;;;;wBAtG0DhB,aAAAA,IAAI0D,KAAK,EAA9De,SAAqDzE,WAA3DiB,MAAqBsC,UAAsCvD,WAA7CmD,OAAgBnC,UAA6BhB,WAA7BgB,OAAO6B,oBAAsB7C,WAAtB6C;wBAE7C,gCAAgC;wBAChC,IAAI7B,SAAO;4BACT;;gCAAOf,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAAA;oCACA6B,mBAAmBA,qBAAqB;gCAC1C;;wBACF;wBAEA,IAAI,CAAC4B,UAAU,OAAOA,WAAW,UAAU;4BACzC;;gCAAOxE,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;wBAEA,IAAI,CAACU,WAAW,OAAOA,YAAY,UAAU;4BAC3C;;gCAAOtD,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;wBAGwB;;4BAAMnD,MAAM4B,GAAG,CAAC,AAAC,gBAAuB,OAARiC;;;wBAAlDC,kBAAkB;wBACxB,IAAI,CAACA,iBAAiB;4BACpB;;gCAAOvD,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;wBAEA,8BAA8B;wBAC9B;;4BAAMnD,MAAMyF,MAAM,CAAC,AAAC,gBAAuB,OAAR5B;;;wBAAnC;;;;;;;;;wBAIQmB,WAAW,AAAC,qCAAsE,OAAlC5E,aAAasE,QAAQ,IAAI,UAAS;wBAClFO,cAAc,IAAIS,gBAAgB;4BACtCC,YAAY;4BACZpE,MAAMwD;4BACNzB,WAAWlD,aAAawE,QAAQ;4BAChCrB,cAAc,AAAC,GAAU,OAARrD,SAAQ;4BACzBsD,OAAOM,gBAAgBN,KAAK;wBAC9B;wBAEA,uDAAuD;wBACvD,IAAIpD,aAAawF,YAAY,EAAE;4BAC7BX,YAAY9D,GAAG,CAAC,iBAAiBf,aAAawF,YAAY;wBAC5D;wBAEsB;;4BAAMC,MAAMb,UAAU;gCAC1Cc,QAAQ;gCACRpF,SAAS;oCAAE,gBAAgB;gCAAoC;gCAC/DsC,MAAMiC,YAAYH,QAAQ;4BAC5B;;;wBAJMI,gBAAgB;6BAMlB,CAACA,cAAca,EAAE,EAAjB;;;;wBACiB;;4BAAMb,cAAc9D,IAAI;;;wBAArC+D,YAAa;wBACnB,MAAM,IAAI/B,MAAM,AAAC,oCAAkF,OAA/C+B,UAAUhC,iBAAiB,IAAIgC,UAAU7D,KAAK;;wBAGjF;;4BAAM4D,cAAc9D,IAAI;;;wBAArCgE,YAAa;wBAOnB,iDAAiD;wBAC3CC,iBAAiC;4BACrCW,aAAaZ,UAAUa,YAAY;2BAC/Bb,UAAUc,aAAa,IAAI;4BAAEC,cAAcf,UAAUc,aAAa;wBAAC;4BACvEE,WAAW9B,KAAKC,GAAG,KAAKa,UAAUiB,UAAU,GAAG;4BAC/C7C,OAAO4B,UAAU5B,KAAK;;wBAGxB,4DAA4D;wBACtD8B,UAAUnB,IAAAA,kBAAU;wBACpBoB,WAA8B;4BAClChE,MAAM+D;4BACNhC,WAAWQ,gBAAgBR,SAAS;4BACpCC,cAAcO,gBAAgBP,YAAY;4BAC1CC,OAAOM,gBAAgBN,KAAK;2BACxBM,gBAAgBJ,cAAc,IAAI;4BAAEA,gBAAgBI,gBAAgBJ,cAAc;wBAAC,GACnFI,gBAAgBH,qBAAqB,IAAI;4BAAEA,uBAAuBG,gBAAgBH,qBAAqB;wBAAC;4BAC5G0B,gBAAAA;4BACAhB,YAAYC,KAAKC,GAAG;4BACpBC,YAAYF,KAAKC,GAAG,KAAK;;wBAG3B;;4BAAMtB,YAASqD,WAAW,CAACtG,OAAOsF,SAASC;;;wBAA3C;wBAEA,0DAA0D;wBACpDC,oBAAoB,IAAIf,IAAIX,gBAAgBP,YAAY;wBAC9DiC,kBAAkBb,YAAY,CAACxD,GAAG,CAAC,QAAQmE;wBAC3C,IAAIxB,gBAAgBL,KAAK,EAAE;4BACzB+B,kBAAkBb,YAAY,CAACxD,GAAG,CAAC,SAAS2C,gBAAgBL,KAAK;wBACnE;wBAEA;;4BAAOlD,IAAIsE,QAAQ,CAACW,kBAAkBV,QAAQ;;;wBACvCxD;wBACP;;4BAAOf,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gCAC1BE,OAAO;gCACP6B,mBAAmB7B,AAAK,YAALA,OAAiB8B,SAAQ9B,MAAME,OAAO,GAAG;4BAC9D;;;;;;;;QAEJ;;IAEA;;;GAGC,GACD3B,OAAOgD,IAAI,CAAC,gBAAgB,SAAOvC,KAAcC;;gBAE3C+C,WACAiD,eAGE9F,YAEE+F,mBACAC,aACeA,oBAAdhF,IAAIiF,QAK4DpG,WAAjEqF,YAAYpE,MAAMgC,cAAc2C,eAAeS,eAoB/CC,eASArB,UAkCWA,iCAATO,QACAe,mBAcFb,aACAc,mBAEA1B,WAoCAwB,gBASAxB,YASF2B,yBAOY3G,wBAHN4G,UAgBC1F,OAOL2F,gBACAC;;;;wBAjLR,mEAAmE;wBAC/D5D,YAAYhD,IAAI0C,IAAI,CAACM,SAAS;wBAC9BiD,gBAAgBjG,IAAI0C,IAAI,CAACuD,aAAa;wBAE1C,sEAAsE;wBAChE9F,aAAaH,IAAII,OAAO,CAACC,aAAa;wBAC5C,IAAIF,cAAcA,WAAWQ,UAAU,CAAC,WAAW;4BAC3CuF,oBAAoB/F,WAAW0G,SAAS,CAAC;4BACzCV,cAAcW,OAAOC,IAAI,CAACb,mBAAmB,UAAU1B,QAAQ,CAAC;4BACjD2B,sCAAAA,YAAYa,KAAK,CAAC,UAAhC7F,KAAcgF,uBAAVC,SAAUD;4BACrBnD,YAAY7B;4BACZ8E,gBAAgBG;wBAClB;wBAEyEpG,YAAAA,IAAI0C,IAAI,EAAzE2C,aAAiErF,UAAjEqF,YAAYpE,OAAqDjB,UAArDiB,MAAMgC,eAA+CjD,UAA/CiD,cAAc2C,gBAAiC5F,UAAjC4F,eAAeS,gBAAkBrG,UAAlBqG;wBAEvD,sBAAsB;wBACtB,IAAI,CAAChB,YAAY;4BACf;;gCAAOpF,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;6BAEIwC,CAAAA,eAAe,oBAAmB,GAAlCA;;;;wBACF,2BAA2B;wBAC3B,IAAI,CAACpE,QAAQ,CAAC+B,aAAa,CAACC,cAAc;4BACxC;;gCAAOhD,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;wBAGsB;;4BAAMF,YAASsE,cAAc,CAACvH,OAAOsD,WAAWiD,0BAAAA,2BAAAA,gBAAiB;;;wBAAjFK,gBAAgB;wBACtB,IAAI,CAACA,eAAe;4BAClB;;gCAAOrG,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;wBAGiB;;4BAAMF,YAASuE,WAAW,CAACxH,OAAOuB;;;wBAA7CgE,WAAW;wBACjB,IAAI,CAACA,UAAU;4BACb;;gCAAOhF,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;wBAEA,8BAA8B;wBAC9B,IAAIoC,SAASjC,SAAS,KAAKA,aAAaiC,SAAShC,YAAY,KAAKA,cAAc;4BAC9E;;gCAAOhD,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;6BAEImB,CAAAA,KAAKC,GAAG,KAAKgB,SAASf,UAAU,AAAD,GAA/BF;;;;wBACF;;4BAAMrB,YAASwE,cAAc,CAACzH,OAAOuB;;;wBAArC;wBACA;;4BAAOhB,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gCAC1BE,OAAO;gCACP6B,mBAAmB;4BACrB;;;wBAGF,wBAAwB;wBACxB,IAAIoC,SAAS7B,cAAc,EAAE;;4BAC3B,IAAI,CAACiD,eAAe;gCAClB;;oCAAOpG,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;wCAC1BE,OAAO;wCACP6B,mBAAmB;oCACrB;;4BACF;4BAEA,gDAAgD;4BAC1C2C,UAASP,kCAAAA,SAAS5B,qBAAqB,cAA9B4B,6CAAAA,kCAAkC;4BAC3CsB,oBAAoBf,WAAW,SAAS4B,IAAAA,kBAAU,EAAC,UAAUC,MAAM,CAAChB,eAAeiB,MAAM,CAAC,eAAejB;4BAE/G,IAAIE,sBAAsBtB,SAAS7B,cAAc,EAAE;gCACjD;;oCAAOnD,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;wCAC1BE,OAAO;wCACP6B,mBAAmB;oCACrB;;4BACF;wBACF;wBAEA,2CAA2C;wBAC3C;;4BAAMF,YAASwE,cAAc,CAACzH,OAAOuB;;;wBAArC;wBAEA,4BAA4B;wBACtByE,cAAc7B,IAAAA,kBAAU;wBACxB2C,oBAAoB3C,IAAAA,kBAAU;wBAE9BiB,YAAyB;4BAC7Ba,cAAcD;4BACd6B,YAAY;4BACZxB,YAAY;4BACZH,eAAeY;4BACftD,OAAO+B,SAAS/B,KAAK;4BACrBF,WAAAA;4BACA+B,gBAAgBE,SAASF,cAAc;4BACvChB,YAAYC,KAAKC,GAAG;wBACtB;wBAEA;;4BAAMtB,YAAS6E,cAAc,CAAC9H,OAAOgG,aAAaZ;;;wBAAlD;wBACA;;4BAAMnC,YAAS8E,eAAe,CAAC/H,OAAO8G,mBAAmB1B;;;wBAAzD;wBAEA,oDAAoD;wBACpD;;4BAAMnC,YAAS+E,iBAAiB,CAAChI,OAAOgG,aAAaT,SAASF,cAAc;;;wBAA5E;wBAEA,wBAAwB;wBACxB;;4BAAO9E,IAAIa,IAAI,CAAC;gCACd6E,cAAcb,UAAUa,YAAY;gCACpC4B,YAAYzC,UAAUyC,UAAU;gCAChCxB,YAAYjB,UAAUiB,UAAU;gCAChCH,eAAed,UAAUc,aAAa;gCACtC1C,OAAO4B,UAAU5B,KAAK;4BACxB;;;6BAEEmC,CAAAA,eAAe,eAAc,GAA7BA;;;;wBACF,sBAAsB;wBACtB,IAAI,CAACO,iBAAiB,CAAC5C,WAAW;4BAChC;;gCAAO/C,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;wBAGsB;;4BAAMF,YAASsE,cAAc,CAACvH,OAAOsD,WAAWiD,0BAAAA,2BAAAA,gBAAiB;;;wBAAjFK,iBAAgB;wBACtB,IAAI,CAACA,gBAAe;4BAClB;;gCAAOrG,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;wBAGkB;;4BAAMF,YAASgF,eAAe,CAACjI,OAAOkG;;;wBAAlDd,aAAY;wBAClB,IAAI,CAACA,cAAaA,WAAU9B,SAAS,KAAKA,WAAW;4BACnD;;gCAAO/C,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;wBAEA,uCAAuC;wBACnC4D,0BAA0B3B,WAAUC,cAAc;6BAClDD,WAAUC,cAAc,CAACc,YAAY,EAArCf;;;;;;;;;;;;wBAEA,+DAA+D;wBACzD4B,WAAW,IAAIkB,uBAAgB,CAAC;4BACpCtD,UAAUxE,aAAawE,QAAQ;2BAC3BxE,aAAawF,YAAY,IAAI;4BAAEA,cAAcxF,aAAawF,YAAY;wBAAC;4BAC3ElB,QAAQ,GAAEtE,yBAAAA,aAAasE,QAAQ,cAArBtE,oCAAAA,yBAAyB;4BACnCoD,OAAO4B,WAAU5B,KAAK;4BACtB2E,gBAAgB,AAAC,GAAU,OAARjI,SAAQ;4BAC3BkI,QAAQ;gCACNC,MAAMC,QAAQC,GAAG;gCACjBjH,OAAOgH,QAAQhH,KAAK;gCACpBkH,MAAMF,QAAQE,IAAI;gCAClBC,OAAO,YAAO;4BAChB;;wBAIwB;;4BAAMzB,SAAS0B,kBAAkB,CAACtD,WAAUC,cAAc,CAACc,YAAY;;;wBADjG,qCAAqC;wBACrCY,0BAA0B;;;;;;wBACnBzF;wBACP,4EAA4E;wBAC5EgH,QAAQE,IAAI,CAAC,yDAAyDlH,AAAK,YAALA,OAAiB8B,SAAQ9B,MAAME,OAAO,GAAGmH,OAAOrH;;;;;;wBAI1H,gCAAgC;wBAC1B2F,iBAAiB9C,IAAAA,kBAAU;wBAC3B+C,eAA4B,wCAC7B9B;4BACHa,cAAcgB;4BACd5C,YAAYC,KAAKC,GAAG;;wBAGtB;;4BAAMtB,YAAS6E,cAAc,CAAC9H,OAAOiH,gBAAgBC;;;wBAArD;wBAEA,kEAAkE;wBAClE;;4BAAMjE,YAAS+E,iBAAiB,CAAChI,OAAOiH,gBAAgBF;;;wBAAxD;wBAEA;;4BAAOxG,IAAIa,IAAI,CAAC;gCACd6E,cAAciB,aAAajB,YAAY;gCACvC4B,YAAYX,aAAaW,UAAU;gCACnCxB,YAAYa,aAAab,UAAU;gCACnC7C,OAAO0D,aAAa1D,KAAK;4BAC3B;;;wBAEF;;4BAAOjD,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gCAC1BE,OAAO;gCACP6B,mBAAmB;4BACrB;;;;QACF;;IAEA;;;GAGC,GACDtD,OAAOgD,IAAI,CAAC,iBAAiB,SAAOvC,KAAcC;;gBACaD,WAArDsI,OAAOC,iBAAiBvF,WAAWiD,eAWnCK;;;;wBAXqDtG,YAAAA,IAAI0C,IAAI,EAA7D4F,QAAqDtI,UAArDsI,OAAOC,kBAA8CvI,UAA9CuI,iBAAiBvF,YAA6BhD,UAA7BgD,WAAWiD,gBAAkBjG,UAAlBiG;wBAE3C,IAAI,CAACqC,OAAO;4BACV;;gCAAOrI,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;6BAGIG,CAAAA,aAAaiD,aAAY,GAAzBjD;;;;wBACoB;;4BAAML,YAASsE,cAAc,CAACvH,OAAOsD,WAAWiD;;;wBAAhEK,gBAAgB;wBACtB,IAAI,CAACA,eAAe;4BAClB;;gCAAOrG,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;;;6BAIE0F,CAAAA,oBAAoB,eAAc,GAAlCA;;;;wBACF;;4BAAM5F,YAAS6F,kBAAkB,CAAC9I,OAAO4I;;;wBAAzC;;;;;;6BACSC,CAAAA,oBAAoB,cAAa,GAAjCA;;;;wBACT;;4BAAM5F,YAAS8F,iBAAiB,CAAC/I,OAAO4I;;;wBAAxC;wBACA;;4BAAM3F,YAAS+F,oBAAoB,CAAChJ,OAAO4I;;;wBAA3C;;;;;;wBAEA,qBAAqB;wBACrB;;4BAAM3F,YAAS6F,kBAAkB,CAAC9I,OAAO4I;;;wBAAzC;wBACA;;4BAAM3F,YAAS8F,iBAAiB,CAAC/I,OAAO4I;;;wBAAxC;wBACA;;4BAAM3F,YAAS+F,oBAAoB,CAAChJ,OAAO4I;;;wBAA3C;;;wBAGF,+CAA+C;wBAC/C;;4BAAOrI,IAAIW,MAAM,CAAC,KAAK+H,IAAI;;;;QAC7B;;IAEA;;;;;;GAMC,GACDpJ,OAAO+B,GAAG,CAAC,iBAAiB,SAAOtB,KAAcC;;gBAEzCE,YASAmI,OAGAxD,WAUAb,KACA6B,WAaA8C;;;;wBArCN,iDAAiD;wBAC3CzI,aAAaH,IAAII,OAAO,CAACC,aAAa;wBAE5C,IAAI,CAACF,cAAc,CAACA,WAAWQ,UAAU,CAAC,YAAY;4BACpD;;gCAAOV,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;wBAEMyF,QAAQnI,WAAW0G,SAAS,CAAC,IAAI,0BAA0B;wBAG/C;;4BAAMlE,YAASkG,cAAc,CAACnJ,OAAO4I;;;wBAAjDxD,YAAY;wBAElB,IAAI,CAACA,WAAW;4BACd;;gCAAO7E,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;wBAEA,4BAA4B;wBACtBoB,MAAMD,KAAKC,GAAG;wBACd6B,YAAYhB,UAAUf,UAAU,GAAGe,UAAUiB,UAAU,GAAG;6BAE5D9B,CAAAA,MAAM6B,SAAQ,GAAd7B;;;;wBACF,uBAAuB;wBACvB;;4BAAMtB,YAAS8F,iBAAiB,CAAC/I,OAAO4I;;;wBAAxC;wBACA;;4BAAM3F,YAAS+F,oBAAoB,CAAChJ,OAAO4I;;;wBAA3C;wBACA;;4BAAOrI,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gCAC1BE,OAAO;gCACP6B,mBAAmB;4BACrB;;;wBAGF,yDAAyD;wBACnD+F,WAAW;4BACfN,OAAAA;4BACAhE,UAAUQ,UAAU9B,SAAS;4BAC7B8F,QAAQhE,UAAU5B,KAAK,GAAG4B,UAAU5B,KAAK,CAAC8D,KAAK,CAAC;4BAChDlB,WAAAA;4BACAf,gBAAgBD,UAAUC,cAAc;wBAC1C;wBAEA;;4BAAO9E,IAAIa,IAAI,CAAC8H;;;;QAClB;;IAEA;;GAEC,GACDrJ,OAAO+B,GAAG,CAAC,kBAAkB,SAAOC,MAAetB;;gBAC3C8I;;;;wBAAU;;4BAAMpG,YAASqG,WAAW,CAACtJ;;;wBAArCqJ,UAAU;wBAChB9I,IAAIa,IAAI,CAACiI;;;;;;QACX;;IAEA,OAAOxJ;AACT"}
1	+ {"version":3,"sources":["/Users/kevin/Dev/Projects/mcp-z/oauth-microsoft/src/lib/dcr-router.ts"],"sourcesContent":["/*\n DCR Router - OAuth 2.0 Authorization Server\n \n Implements OAuth 2.0 Dynamic Client Registration Protocol (RFC 7591)\n * and OAuth 2.0 Authorization Server endpoints (RFC 6749, RFC 8414, RFC 9728).\n \n Endpoints:\n * - GET /.well-known/oauth-authorization-server (RFC 8414 metadata)\n * - GET /.well-known/oauth-protected-resource (RFC 9728 metadata - root)\n * - GET /.well-known/oauth-protected-resource/mcp (RFC 9728 metadata - sub-path)\n * - POST /oauth/register (RFC 7591 client registration)\n * - GET /oauth/authorize (RFC 6749 authorization endpoint)\n * - POST /oauth/token (RFC 6749 token endpoint)\n * - POST /oauth/revoke (RFC 7009 token revocation)\n * - GET /oauth/verify (token verification for Resource Server)\n /\n\nimport type { ProviderTokens, RFC8414Metadata, RFC9728Metadata } from '@mcp-z/oauth';\nimport { createHash, randomUUID } from 'crypto';\nimport type { Request, Response } from 'express';\nimport express from 'express';\nimport type { Keyv } from 'keyv';\nimport { DcrOAuthProvider } from '../providers/dcr.ts';\nimport type { AccessToken, AuthorizationCode, OAuthClientConfig } from '../types.ts';\nimport as dcrUtils from './dcr-utils.ts';\n\n/*\n Configuration for DCR Router (self-hosted mode only)\n /\nexport interface DcrRouterConfig {\n /* Single Keyv store for all DCR data /\n store: Keyv;\n\n /* Authorization Server issuer URL /\n issuerUrl: string;\n\n /* Base URL for OAuth endpoints /\n baseUrl: string;\n\n /* Supported OAuth scopes /\n scopesSupported: string[];\n\n /* OAuth client configuration for upstream provider /\n clientConfig: OAuthClientConfig;\n}\n\n/\n Create DCR Router with OAuth 2.0 endpoints (self-hosted mode)\n \n For external mode (Auth0/Stitch), don't call this function - no router needed.\n * The server code should check DcrConfig.mode and only call this for 'self-hosted'.\n \n @param config - Router configuration\n * @returns Express router with OAuth endpoints\n /\nexport function createDcrRouter(config: DcrRouterConfig): express.Router {\n const router = express.Router();\n const { store, issuerUrl, baseUrl, scopesSupported, clientConfig } = config;\n\n router.use('/mcp', (req: Request, res: Response, next) => {\n const authHeader = req.headers.authorization \|\| req.headers.Authorization;\n const headerValue = Array.isArray(authHeader) ? authHeader[0] : authHeader;\n\n if (!headerValue \|\| !headerValue.toLowerCase().startsWith('bearer ')) {\n return res\n .status(401)\n .set('WWW-Authenticate', `Bearer resource_metadata=\"${baseUrl}/.well-known/oauth-protected-resource\"`)\n .json({\n jsonrpc: '2.0',\n error: {\n code: -32600,\n message: 'Missing Authorization header. DCR mode requires bearer token.',\n },\n id: null,\n });\n }\n\n return next();\n });\n\n // Apply required middleware for OAuth 2.0 endpoints (RFC 6749)\n router.use(express.json()); // For /oauth/register (application/json)\n router.use(express.urlencoded({ extended: true })); // For /oauth/token (application/x-www-form-urlencoded)\n\n /\n OAuth Authorization Server Metadata (RFC 8414)\n * GET /.well-known/oauth-authorization-server\n /\n router.get('/.well-known/oauth-authorization-server', (_req: Request, res: Response) => {\n const metadata: RFC8414Metadata = {\n issuer: issuerUrl,\n authorization_endpoint: `${baseUrl}/oauth/authorize`,\n token_endpoint: `${baseUrl}/oauth/token`,\n registration_endpoint: `${baseUrl}/oauth/register`,\n revocation_endpoint: `${baseUrl}/oauth/revoke`,\n scopes_supported: scopesSupported,\n response_types_supported: ['code'],\n grant_types_supported: ['authorization_code', 'refresh_token'],\n token_endpoint_auth_methods_supported: ['client_secret_basic', 'client_secret_post'],\n code_challenge_methods_supported: ['S256', 'plain'],\n service_documentation: `${baseUrl}/docs`,\n };\n res.json(metadata);\n });\n\n /\n OAuth Protected Resource Metadata (RFC 9728 - Root)\n * GET /.well-known/oauth-protected-resource\n /\n router.get('/.well-known/oauth-protected-resource', (_req: Request, res: Response) => {\n const metadata: RFC9728Metadata = {\n resource: baseUrl,\n authorization_servers: [baseUrl],\n scopes_supported: scopesSupported,\n bearer_methods_supported: ['header'],\n };\n res.json(metadata);\n });\n\n /\n OAuth Protected Resource Metadata (RFC 9728 - Sub-path /mcp)\n * GET /.well-known/oauth-protected-resource/mcp\n /\n router.get('/.well-known/oauth-protected-resource/mcp', (_req: Request, res: Response) => {\n const metadata: RFC9728Metadata = {\n resource: `${baseUrl}/mcp`,\n authorization_servers: [baseUrl],\n scopes_supported: scopesSupported,\n bearer_methods_supported: ['header'],\n };\n res.json(metadata);\n });\n\n /\n Dynamic Client Registration (RFC 7591)\n * POST /oauth/register\n /\n router.post('/oauth/register', async (req: Request, res: Response) => {\n try {\n const registrationRequest = req.body;\n\n // Register the client\n const client = await dcrUtils.registerClient(store, registrationRequest);\n\n // Return client information (RFC 7591 Section 3.2.1)\n res.status(201).json(client);\n } catch (error) {\n res.status(400).json({\n error: 'invalid_client_metadata',\n error_description: error instanceof Error ? error.message : 'Invalid registration request',\n });\n }\n });\n\n /\n OAuth Authorization Endpoint (RFC 6749 Section 3.1)\n * GET /oauth/authorize\n \n Initiates Microsoft OAuth flow, then generates DCR authorization code\n /\n router.get('/oauth/authorize', async (req: Request, res: Response) => {\n const { response_type, client_id, redirect_uri, scope = '', state = '', code_challenge, code_challenge_method } = req.query;\n\n // Validate required parameters\n if (response_type !== 'code') {\n return res.status(400).json({\n error: 'unsupported_response_type',\n error_description: 'Only response_type=code is supported',\n });\n }\n\n if (!client_id \|\| typeof client_id !== 'string') {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'client_id is required',\n });\n }\n\n if (!redirect_uri \|\| typeof redirect_uri !== 'string') {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'redirect_uri is required',\n });\n }\n\n // Validate client\n const client = await dcrUtils.getClient(store, client_id);\n if (!client) {\n return res.status(400).json({\n error: 'invalid_client',\n error_description: 'Unknown client_id',\n });\n }\n\n // Validate redirect_uri\n const isValidRedirect = await dcrUtils.validateRedirectUri(store, client_id, redirect_uri);\n if (!isValidRedirect) {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'Invalid redirect_uri',\n });\n }\n\n // Use client-provided scope or fall back to server's supported scopes\n const effectiveScope = typeof scope === 'string' && scope.trim() !== '' ? scope : scopesSupported.join(' ');\n\n // Store DCR request state for Microsoft OAuth callback\n const msState = randomUUID();\n const dcrRequestState = {\n client_id,\n redirect_uri,\n scope: effectiveScope,\n state: typeof state === 'string' ? state : undefined,\n code_challenge: typeof code_challenge === 'string' ? code_challenge : undefined,\n code_challenge_method: typeof code_challenge_method === 'string' ? code_challenge_method : undefined,\n created_at: Date.now(),\n expires_at: Date.now() + 600000, // 10 minutes\n };\n\n await store.set(`dcr:ms-state:${msState}`, dcrRequestState, 600000); // 10 min TTL\n\n // Build Microsoft authorization URL\n const msAuthUrl = new URL(`https://login.microsoftonline.com/${clientConfig.tenantId \|\| 'common'}/oauth2/v2.0/authorize`);\n msAuthUrl.searchParams.set('client_id', clientConfig.clientId);\n msAuthUrl.searchParams.set('response_type', 'code');\n msAuthUrl.searchParams.set('redirect_uri', `${baseUrl}/oauth/callback`);\n msAuthUrl.searchParams.set('scope', effectiveScope);\n msAuthUrl.searchParams.set('state', msState);\n msAuthUrl.searchParams.set('response_mode', 'query');\n\n // Redirect user to Microsoft for authorization\n return res.redirect(msAuthUrl.toString());\n });\n\n /\n OAuth Callback Handler\n * GET /oauth/callback\n \n Handles callback from Microsoft after user authorization\n /\n router.get('/oauth/callback', async (req: Request, res: Response) => {\n const { code: msCode, state: msState, error, error_description } = req.query;\n\n // Handle Microsoft OAuth errors\n if (error) {\n return res.status(400).json({\n error,\n error_description: error_description \|\| 'Microsoft OAuth authorization failed',\n });\n }\n\n if (!msCode \|\| typeof msCode !== 'string') {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'Authorization code is required',\n });\n }\n\n if (!msState \|\| typeof msState !== 'string') {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'State parameter is required',\n });\n }\n\n // Retrieve original DCR request state\n const dcrRequestState = await store.get(`dcr:ms-state:${msState}`);\n if (!dcrRequestState) {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'Invalid or expired state parameter',\n });\n }\n\n // Delete state (one-time use)\n await store.delete(`dcr:ms-state:${msState}`);\n\n // Exchange Microsoft authorization code for tokens\n try {\n const tokenUrl = `https://login.microsoftonline.com/${clientConfig.tenantId \|\| 'common'}/oauth2/v2.0/token`;\n const tokenParams = new URLSearchParams({\n grant_type: 'authorization_code',\n code: msCode,\n client_id: clientConfig.clientId,\n redirect_uri: `${baseUrl}/oauth/callback`,\n scope: dcrRequestState.scope,\n });\n\n // Add client_secret if available (confidential client)\n if (clientConfig.clientSecret) {\n tokenParams.set('client_secret', clientConfig.clientSecret);\n }\n\n const tokenResponse = await fetch(tokenUrl, {\n method: 'POST',\n headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n body: tokenParams.toString(),\n });\n\n if (!tokenResponse.ok) {\n const errorData = (await tokenResponse.json()) as { error?: string; error_description?: string };\n throw new Error(`Microsoft token exchange failed: ${errorData.error_description \|\| errorData.error}`);\n }\n\n const tokenData = (await tokenResponse.json()) as {\n access_token: string;\n refresh_token?: string;\n expires_in: number;\n scope: string;\n };\n\n // Create provider tokens from Microsoft response\n const providerTokens: ProviderTokens = {\n accessToken: tokenData.access_token,\n ...(tokenData.refresh_token && { refreshToken: tokenData.refresh_token }),\n expiresAt: Date.now() + tokenData.expires_in 1000,\n scope: tokenData.scope,\n };\n\n // Generate DCR authorization code with real provider tokens\n const dcrCode = randomUUID();\n const authCode: AuthorizationCode = {\n code: dcrCode,\n client_id: dcrRequestState.client_id,\n redirect_uri: dcrRequestState.redirect_uri,\n scope: dcrRequestState.scope,\n ...(dcrRequestState.code_challenge && { code_challenge: dcrRequestState.code_challenge }),\n ...(dcrRequestState.code_challenge_method && { code_challenge_method: dcrRequestState.code_challenge_method }),\n providerTokens,\n created_at: Date.now(),\n expires_at: Date.now() + 600000, // 10 minutes\n };\n\n await dcrUtils.setAuthCode(store, dcrCode, authCode);\n\n // Redirect back to MCP client with DCR authorization code\n const clientRedirectUrl = new URL(dcrRequestState.redirect_uri);\n clientRedirectUrl.searchParams.set('code', dcrCode);\n if (dcrRequestState.state) {\n clientRedirectUrl.searchParams.set('state', dcrRequestState.state);\n }\n\n return res.redirect(clientRedirectUrl.toString());\n } catch (error) {\n return res.status(500).json({\n error: 'server_error',\n error_description: error instanceof Error ? error.message : 'Failed to exchange authorization code',\n });\n }\n });\n\n /*\n OAuth Token Endpoint (RFC 6749 Section 3.2)\n * POST /oauth/token\n /\n router.post('/oauth/token', async (req: Request, res: Response) => {\n // Extract client credentials from either body or Basic Auth header\n let client_id = req.body.client_id;\n let client_secret = req.body.client_secret;\n\n // Support client_secret_basic authentication (RFC 6749 Section 2.3.1)\n const authHeader = req.headers.authorization;\n if (authHeader && authHeader.startsWith('Basic ')) {\n const base64Credentials = authHeader.substring(6);\n const credentials = Buffer.from(base64Credentials, 'base64').toString('utf-8');\n const [id, secret] = credentials.split(':');\n client_id = id;\n client_secret = secret;\n }\n\n const { grant_type, code, redirect_uri, refresh_token, code_verifier } = req.body;\n\n // Validate grant_type\n if (!grant_type) {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'grant_type is required',\n });\n }\n\n if (grant_type === 'authorization_code') {\n // Authorization Code Grant\n if (!code \|\| !client_id \|\| !redirect_uri) {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'code, client_id, and redirect_uri are required',\n });\n }\n\n // Validate client credentials\n const isValidClient = await dcrUtils.validateClient(store, client_id, client_secret ?? '');\n if (!isValidClient) {\n return res.status(401).json({\n error: 'invalid_client',\n error_description: 'Invalid client credentials',\n });\n }\n\n // Get authorization code\n const authCode = await dcrUtils.getAuthCode(store, code);\n if (!authCode) {\n return res.status(400).json({\n error: 'invalid_grant',\n error_description: 'Invalid or expired authorization code',\n });\n }\n\n // Validate authorization code\n if (authCode.client_id !== client_id \|\| authCode.redirect_uri !== redirect_uri) {\n return res.status(400).json({\n error: 'invalid_grant',\n error_description: 'Authorization code mismatch',\n });\n }\n\n if (Date.now() > authCode.expires_at) {\n await dcrUtils.deleteAuthCode(store, code);\n return res.status(400).json({\n error: 'invalid_grant',\n error_description: 'Authorization code expired',\n });\n }\n\n // Validate PKCE if used\n if (authCode.code_challenge) {\n if (!code_verifier) {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'code_verifier is required for PKCE',\n });\n }\n\n // Validate code_verifier against code_challenge\n const method = authCode.code_challenge_method ?? 'plain';\n const computedChallenge = method === 'S256' ? createHash('sha256').update(code_verifier).digest('base64url') : code_verifier;\n\n if (computedChallenge !== authCode.code_challenge) {\n return res.status(400).json({\n error: 'invalid_grant',\n error_description: 'Invalid code_verifier',\n });\n }\n }\n\n // Delete authorization code (one-time use)\n await dcrUtils.deleteAuthCode(store, code);\n\n // Generate DCR access token\n const accessToken = randomUUID();\n const refreshTokenValue = randomUUID();\n\n const tokenData: AccessToken = {\n access_token: accessToken,\n token_type: 'Bearer',\n expires_in: 3600,\n refresh_token: refreshTokenValue,\n scope: authCode.scope,\n client_id,\n providerTokens: authCode.providerTokens,\n created_at: Date.now(),\n };\n\n await dcrUtils.setAccessToken(store, accessToken, tokenData);\n await dcrUtils.setRefreshToken(store, refreshTokenValue, tokenData);\n\n // Store provider tokens indexed by DCR access token\n await dcrUtils.setProviderTokens(store, accessToken, authCode.providerTokens);\n\n // Return token response\n return res.json({\n access_token: tokenData.access_token,\n token_type: tokenData.token_type,\n expires_in: tokenData.expires_in,\n refresh_token: tokenData.refresh_token,\n scope: tokenData.scope,\n });\n }\n if (grant_type === 'refresh_token') {\n // Refresh Token Grant\n if (!refresh_token \|\| !client_id) {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'refresh_token and client_id are required',\n });\n }\n\n // Validate client credentials\n const isValidClient = await dcrUtils.validateClient(store, client_id, client_secret ?? '');\n if (!isValidClient) {\n return res.status(401).json({\n error: 'invalid_client',\n error_description: 'Invalid client credentials',\n });\n }\n\n // Get refresh token\n const tokenData = await dcrUtils.getRefreshToken(store, refresh_token);\n if (!tokenData \|\| tokenData.client_id !== client_id) {\n return res.status(400).json({\n error: 'invalid_grant',\n error_description: 'Invalid refresh token',\n });\n }\n\n // Refresh provider tokens if available\n let refreshedProviderTokens = tokenData.providerTokens;\n if (tokenData.providerTokens.refreshToken) {\n try {\n // Create DcrOAuthProvider instance to refresh Microsoft tokens\n const provider = new DcrOAuthProvider({\n clientId: clientConfig.clientId,\n ...(clientConfig.clientSecret && { clientSecret: clientConfig.clientSecret }),\n tenantId: clientConfig.tenantId ?? 'common',\n scope: tokenData.scope,\n verifyEndpoint: `${baseUrl}/oauth/verify`,\n logger: {\n info: console.log,\n error: console.error,\n warn: console.warn,\n debug: () => {},\n },\n });\n\n // Refresh the Microsoft access token\n refreshedProviderTokens = await provider.refreshAccessToken(tokenData.providerTokens.refreshToken);\n } catch (error) {\n // If refresh fails, continue with existing tokens (they may still be valid)\n console.warn('Provider token refresh failed, using existing tokens:', error instanceof Error ? error.message : String(error));\n }\n }\n\n // Generate new DCR access token\n const newAccessToken = randomUUID();\n const newTokenData: AccessToken = {\n ...tokenData,\n access_token: newAccessToken,\n created_at: Date.now(),\n };\n\n await dcrUtils.setAccessToken(store, newAccessToken, newTokenData);\n\n // Store refreshed provider tokens indexed by new DCR access token\n await dcrUtils.setProviderTokens(store, newAccessToken, refreshedProviderTokens);\n\n return res.json({\n access_token: newTokenData.access_token,\n token_type: newTokenData.token_type,\n expires_in: newTokenData.expires_in,\n scope: newTokenData.scope,\n });\n }\n return res.status(400).json({\n error: 'unsupported_grant_type',\n error_description: 'Only authorization_code and refresh_token grants are supported',\n });\n });\n\n /\n OAuth Token Revocation (RFC 7009)\n * POST /oauth/revoke\n /\n router.post('/oauth/revoke', async (req: Request, res: Response) => {\n const { token, token_type_hint, client_id, client_secret } = req.body;\n\n if (!token) {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'token is required',\n });\n }\n\n // Validate client if credentials provided\n if (client_id && client_secret) {\n const isValidClient = await dcrUtils.validateClient(store, client_id, client_secret);\n if (!isValidClient) {\n return res.status(401).json({\n error: 'invalid_client',\n error_description: 'Invalid client credentials',\n });\n }\n }\n\n // Revoke the token\n if (token_type_hint === 'refresh_token') {\n await dcrUtils.deleteRefreshToken(store, token);\n } else if (token_type_hint === 'access_token') {\n await dcrUtils.deleteAccessToken(store, token);\n await dcrUtils.deleteProviderTokens(store, token);\n } else {\n // No hint - try both\n await dcrUtils.deleteRefreshToken(store, token);\n await dcrUtils.deleteAccessToken(store, token);\n await dcrUtils.deleteProviderTokens(store, token);\n }\n\n // RFC 7009: Return 200 even if token not found\n return res.status(200).send();\n });\n\n /\n Token Verification Endpoint\n * GET /oauth/verify\n \n Validates bearer tokens for Resource Server.\n * Returns AuthInfo with provider tokens for stateless DCR pattern.\n /\n router.get('/oauth/verify', async (req: Request, res: Response) => {\n // Extract bearer token from Authorization header\n const authHeader = req.headers.authorization;\n\n if (!authHeader \|\| !authHeader.startsWith('Bearer ')) {\n return res.status(401).json({\n error: 'invalid_request',\n error_description: 'Missing or invalid Authorization header',\n });\n }\n\n const token = authHeader.substring(7); // Remove 'Bearer ' prefix\n\n // Validate token exists in access tokens store\n const tokenData = await dcrUtils.getAccessToken(store, token);\n\n if (!tokenData) {\n return res.status(401).json({\n error: 'invalid_token',\n error_description: 'Unknown or expired access token',\n });\n }\n\n // Check if token is expired\n const now = Date.now();\n const expiresAt = tokenData.created_at + tokenData.expires_in 1000;\n\n if (now > expiresAt) {\n // Remove expired token\n await dcrUtils.deleteAccessToken(store, token);\n await dcrUtils.deleteProviderTokens(store, token);\n return res.status(401).json({\n error: 'invalid_token',\n error_description: 'Access token has expired',\n });\n }\n\n // Return AuthInfo with provider tokens for stateless DCR\n const authInfo = {\n token,\n clientId: tokenData.client_id,\n scopes: tokenData.scope ? tokenData.scope.split(' ') : [],\n expiresAt,\n providerTokens: tokenData.providerTokens,\n };\n\n return res.json(authInfo);\n });\n\n /*\n Debug endpoint to list registered clients (development only)\n */\n router.get('/debug/clients', async (_req: Request, res: Response) => {\n const clients = await dcrUtils.listClients(store);\n res.json(clients);\n });\n\n return router;\n}\n"],"names":["createDcrRouter","config","router","express","Router","store","issuerUrl","baseUrl","scopesSupported","clientConfig","use","req","res","next","authHeader","headers","authorization","Authorization","headerValue","Array","isArray","toLowerCase","startsWith","status","set","json","jsonrpc","error","code","message","id","urlencoded","extended","get","_req","metadata","issuer","authorization_endpoint","token_endpoint","registration_endpoint","revocation_endpoint","scopes_supported","response_types_supported","grant_types_supported","token_endpoint_auth_methods_supported","code_challenge_methods_supported","service_documentation","resource","authorization_servers","bearer_methods_supported","post","registrationRequest","client","body","dcrUtils","registerClient","error_description","Error","response_type","client_id","redirect_uri","scope","state","code_challenge","code_challenge_method","isValidRedirect","effectiveScope","msState","dcrRequestState","msAuthUrl","query","getClient","validateRedirectUri","trim","join","randomUUID","undefined","created_at","Date","now","expires_at","URL","tenantId","searchParams","clientId","redirect","toString","msCode","tokenUrl","tokenParams","tokenResponse","errorData","tokenData","providerTokens","dcrCode","authCode","clientRedirectUrl","delete","URLSearchParams","grant_type","clientSecret","fetch","method","ok","accessToken","access_token","refresh_token","refreshToken","expiresAt","expires_in","setAuthCode","client_secret","base64Credentials","credentials","secret","code_verifier","isValidClient","computedChallenge","refreshTokenValue","refreshedProviderTokens","provider","newAccessToken","newTokenData","substring","Buffer","from","split","validateClient","getAuthCode","deleteAuthCode","createHash","update","digest","token_type","setAccessToken","setRefreshToken","setProviderTokens","getRefreshToken","DcrOAuthProvider","verifyEndpoint","logger","info","console","log","warn","debug","refreshAccessToken","String","token","token_type_hint","deleteRefreshToken","deleteAccessToken","deleteProviderTokens","send","authInfo","getAccessToken","scopes","clients","listClients"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;;;;+BAwCeA;;;eAAAA;;;sBArCuB;8DAEnB;qBAEa;kEAEP;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BnB,SAASA,gBAAgBC,MAAuB;IACrD,IAAMC,SAASC,gBAAO,CAACC,MAAM;IAC7B,IAAQC,QAA6DJ,OAA7DI,OAAOC,YAAsDL,OAAtDK,WAAWC,UAA2CN,OAA3CM,SAASC,kBAAkCP,OAAlCO,iBAAiBC,eAAiBR,OAAjBQ;IAEpDP,OAAOQ,GAAG,CAAC,QAAQ,SAACC,KAAcC,KAAeC;QAC/C,IAAMC,aAAaH,IAAII,OAAO,CAACC,aAAa,IAAIL,IAAII,OAAO,CAACE,aAAa;QACzE,IAAMC,cAAcC,MAAMC,OAAO,CAACN,cAAcA,UAAU,CAAC,EAAE,GAAGA;QAEhE,IAAI,CAACI,eAAe,CAACA,YAAYG,WAAW,GAAGC,UAAU,CAAC,YAAY;YACpE,OAAOV,IACJW,MAAM,CAAC,KACPC,GAAG,CAAC,oBAAoB,AAAC,6BAAoC,OAARjB,SAAQ,2CAC7DkB,IAAI,CAAC;gBACJC,SAAS;gBACTC,OAAO;oBACLC,MAAM,CAAC;oBACPC,SAAS;gBACX;gBACAC,IAAI;YACN;QACJ;QAEA,OAAOjB;IACT;IAEA,+DAA+D;IAC/DX,OAAOQ,GAAG,CAACP,gBAAO,CAACsB,IAAI,KAAK,yCAAyC;IACrEvB,OAAOQ,GAAG,CAACP,gBAAO,CAAC4B,UAAU,CAAC;QAAEC,UAAU;IAAK,KAAK,uDAAuD;IAE3G;;;GAGC,GACD9B,OAAO+B,GAAG,CAAC,2CAA2C,SAACC,MAAetB;QACpE,IAAMuB,WAA4B;YAChCC,QAAQ9B;YACR+B,wBAAwB,AAAC,GAAU,OAAR9B,SAAQ;YACnC+B,gBAAgB,AAAC,GAAU,OAAR/B,SAAQ;YAC3BgC,uBAAuB,AAAC,GAAU,OAARhC,SAAQ;YAClCiC,qBAAqB,AAAC,GAAU,OAARjC,SAAQ;YAChCkC,kBAAkBjC;YAClBkC,0BAA0B;gBAAC;aAAO;YAClCC,uBAAuB;gBAAC;gBAAsB;aAAgB;YAC9DC,uCAAuC;gBAAC;gBAAuB;aAAqB;YACpFC,kCAAkC;gBAAC;gBAAQ;aAAQ;YACnDC,uBAAuB,AAAC,GAAU,OAARvC,SAAQ;QACpC;QACAK,IAAIa,IAAI,CAACU;IACX;IAEA;;;GAGC,GACDjC,OAAO+B,GAAG,CAAC,yCAAyC,SAACC,MAAetB;QAClE,IAAMuB,WAA4B;YAChCY,UAAUxC;YACVyC,uBAAuB;gBAACzC;aAAQ;YAChCkC,kBAAkBjC;YAClByC,0BAA0B;gBAAC;aAAS;QACtC;QACArC,IAAIa,IAAI,CAACU;IACX;IAEA;;;GAGC,GACDjC,OAAO+B,GAAG,CAAC,6CAA6C,SAACC,MAAetB;QACtE,IAAMuB,WAA4B;YAChCY,UAAU,AAAC,GAAU,OAARxC,SAAQ;YACrByC,uBAAuB;gBAACzC;aAAQ;YAChCkC,kBAAkBjC;YAClByC,0BAA0B;gBAAC;aAAS;QACtC;QACArC,IAAIa,IAAI,CAACU;IACX;IAEA;;;GAGC,GACDjC,OAAOgD,IAAI,CAAC,mBAAmB,SAAOvC,KAAcC;;gBAE1CuC,qBAGAC,QAICzB;;;;;;;;;;wBAPDwB,sBAAsBxC,IAAI0C,IAAI;wBAGrB;;4BAAMC,YAASC,cAAc,CAAClD,OAAO8C;;;wBAA9CC,SAAS;wBAEf,qDAAqD;wBACrDxC,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC2B;;;;;;wBACdzB;wBACPf,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;4BACnBE,OAAO;4BACP6B,mBAAmB7B,AAAK,YAALA,OAAiB8B,SAAQ9B,MAAME,OAAO,GAAG;wBAC9D;;;;;;;;;;;QAEJ;;IAEA;;;;;GAKC,GACD3B,OAAO+B,GAAG,CAAC,oBAAoB,SAAOtB,KAAcC;;gBACgED,YAA1G+C,eAAeC,WAAWC,gCAAcC,yBAAYC,OAAYC,gBAAgBC,uBAyBlFZ,QASAa,iBASAC,gBAGAC,SACAC,iBAcAC;;;;wBA7D4G1D,aAAAA,IAAI2D,KAAK,EAAnHZ,gBAA0G/C,WAA1G+C,eAAeC,YAA2FhD,WAA3FgD,WAAWC,eAAgFjD,WAAhFiD,iCAAgFjD,WAAlEkD,OAAAA,sCAAQ,0CAA0DlD,WAAtDmD,OAAAA,sCAAQ,uBAAIC,iBAA0CpD,WAA1CoD,gBAAgBC,wBAA0BrD,WAA1BqD;wBAExF,+BAA+B;wBAC/B,IAAIN,kBAAkB,QAAQ;4BAC5B;;gCAAO9C,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;wBAEA,IAAI,CAACG,aAAa,OAAOA,cAAc,UAAU;4BAC/C;;gCAAO/C,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;wBAEA,IAAI,CAACI,gBAAgB,OAAOA,iBAAiB,UAAU;4BACrD;;gCAAOhD,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;wBAGe;;4BAAMF,YAASiB,SAAS,CAAClE,OAAOsD;;;wBAAzCP,SAAS;wBACf,IAAI,CAACA,QAAQ;4BACX;;gCAAOxC,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;wBAGwB;;4BAAMF,YAASkB,mBAAmB,CAACnE,OAAOsD,WAAWC;;;wBAAvEK,kBAAkB;wBACxB,IAAI,CAACA,iBAAiB;4BACpB;;gCAAOrD,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;wBAEA,sEAAsE;wBAChEU,iBAAiB,OAAOL,UAAU,YAAYA,MAAMY,IAAI,OAAO,KAAKZ,QAAQrD,gBAAgBkE,IAAI,CAAC;wBAEvG,uDAAuD;wBACjDP,UAAUQ,IAAAA,kBAAU;wBACpBP,kBAAkB;4BACtBT,WAAAA;4BACAC,cAAAA;4BACAC,OAAOK;4BACPJ,OAAO,OAAOA,UAAU,WAAWA,QAAQc;4BAC3Cb,gBAAgB,OAAOA,mBAAmB,WAAWA,iBAAiBa;4BACtEZ,uBAAuB,OAAOA,0BAA0B,WAAWA,wBAAwBY;4BAC3FC,YAAYC,KAAKC,GAAG;4BACpBC,YAAYF,KAAKC,GAAG,KAAK;wBAC3B;wBAEA;;4BAAM1E,MAAMmB,GAAG,CAAC,AAAC,gBAAuB,OAAR2C,UAAWC,iBAAiB;;;wBAA5D,eAAqE,aAAa;wBAElF,oCAAoC;wBAC9BC,YAAY,IAAIY,IAAI,AAAC,qCAAsE,OAAlCxE,aAAayE,QAAQ,IAAI,UAAS;wBACjGb,UAAUc,YAAY,CAAC3D,GAAG,CAAC,aAAaf,aAAa2E,QAAQ;wBAC7Df,UAAUc,YAAY,CAAC3D,GAAG,CAAC,iBAAiB;wBAC5C6C,UAAUc,YAAY,CAAC3D,GAAG,CAAC,gBAAgB,AAAC,GAAU,OAARjB,SAAQ;wBACtD8D,UAAUc,YAAY,CAAC3D,GAAG,CAAC,SAAS0C;wBACpCG,UAAUc,YAAY,CAAC3D,GAAG,CAAC,SAAS2C;wBACpCE,UAAUc,YAAY,CAAC3D,GAAG,CAAC,iBAAiB;wBAE5C,+CAA+C;wBAC/C;;4BAAOZ,IAAIyE,QAAQ,CAAChB,UAAUiB,QAAQ;;;;QACxC;;IAEA;;;;;GAKC,GACDpF,OAAO+B,GAAG,CAAC,mBAAmB,SAAOtB,KAAcC;;gBACkBD,YAArD4E,QAAepB,SAASxC,SAAO6B,mBAyBvCY,iBAaEoB,UACAC,aAaAC,eAOEC,WAIFC,WAQAC,gBAQAC,SACAC,UAeAC,mBAOCrE;;;;wBAtG0DhB,aAAAA,IAAI2D,KAAK,EAA9DiB,SAAqD5E,WAA3DiB,MAAqBuC,UAAsCxD,WAA7CmD,OAAgBnC,UAA6BhB,WAA7BgB,OAAO6B,oBAAsB7C,WAAtB6C;wBAE7C,gCAAgC;wBAChC,IAAI7B,SAAO;4BACT;;gCAAOf,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAAA;oCACA6B,mBAAmBA,qBAAqB;gCAC1C;;wBACF;wBAEA,IAAI,CAAC+B,UAAU,OAAOA,WAAW,UAAU;4BACzC;;gCAAO3E,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;wBAEA,IAAI,CAACW,WAAW,OAAOA,YAAY,UAAU;4BAC3C;;gCAAOvD,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;wBAGwB;;4BAAMnD,MAAM4B,GAAG,CAAC,AAAC,gBAAuB,OAARkC;;;wBAAlDC,kBAAkB;wBACxB,IAAI,CAACA,iBAAiB;4BACpB;;gCAAOxD,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;wBAEA,8BAA8B;wBAC9B;;4BAAMnD,MAAM4F,MAAM,CAAC,AAAC,gBAAuB,OAAR9B;;;wBAAnC;;;;;;;;;wBAIQqB,WAAW,AAAC,qCAAsE,OAAlC/E,aAAayE,QAAQ,IAAI,UAAS;wBAClFO,cAAc,IAAIS,gBAAgB;4BACtCC,YAAY;4BACZvE,MAAM2D;4BACN5B,WAAWlD,aAAa2E,QAAQ;4BAChCxB,cAAc,AAAC,GAAU,OAARrD,SAAQ;4BACzBsD,OAAOO,gBAAgBP,KAAK;wBAC9B;wBAEA,uDAAuD;wBACvD,IAAIpD,aAAa2F,YAAY,EAAE;4BAC7BX,YAAYjE,GAAG,CAAC,iBAAiBf,aAAa2F,YAAY;wBAC5D;wBAEsB;;4BAAMC,MAAMb,UAAU;gCAC1Cc,QAAQ;gCACRvF,SAAS;oCAAE,gBAAgB;gCAAoC;gCAC/DsC,MAAMoC,YAAYH,QAAQ;4BAC5B;;;wBAJMI,gBAAgB;6BAMlB,CAACA,cAAca,EAAE,EAAjB;;;;wBACiB;;4BAAMb,cAAcjE,IAAI;;;wBAArCkE,YAAa;wBACnB,MAAM,IAAIlC,MAAM,AAAC,oCAAkF,OAA/CkC,UAAUnC,iBAAiB,IAAImC,UAAUhE,KAAK;;wBAGjF;;4BAAM+D,cAAcjE,IAAI;;;wBAArCmE,YAAa;wBAOnB,iDAAiD;wBAC3CC,iBAAiC;4BACrCW,aAAaZ,UAAUa,YAAY;2BAC/Bb,UAAUc,aAAa,IAAI;4BAAEC,cAAcf,UAAUc,aAAa;wBAAC;4BACvEE,WAAW9B,KAAKC,GAAG,KAAKa,UAAUiB,UAAU,GAAG;4BAC/ChD,OAAO+B,UAAU/B,KAAK;;wBAGxB,4DAA4D;wBACtDiC,UAAUnB,IAAAA,kBAAU;wBACpBoB,WAA8B;4BAClCnE,MAAMkE;4BACNnC,WAAWS,gBAAgBT,SAAS;4BACpCC,cAAcQ,gBAAgBR,YAAY;4BAC1CC,OAAOO,gBAAgBP,KAAK;2BACxBO,gBAAgBL,cAAc,IAAI;4BAAEA,gBAAgBK,gBAAgBL,cAAc;wBAAC,GACnFK,gBAAgBJ,qBAAqB,IAAI;4BAAEA,uBAAuBI,gBAAgBJ,qBAAqB;wBAAC;4BAC5G6B,gBAAAA;4BACAhB,YAAYC,KAAKC,GAAG;4BACpBC,YAAYF,KAAKC,GAAG,KAAK;;wBAG3B;;4BAAMzB,YAASwD,WAAW,CAACzG,OAAOyF,SAASC;;;wBAA3C;wBAEA,0DAA0D;wBACpDC,oBAAoB,IAAIf,IAAIb,gBAAgBR,YAAY;wBAC9DoC,kBAAkBb,YAAY,CAAC3D,GAAG,CAAC,QAAQsE;wBAC3C,IAAI1B,gBAAgBN,KAAK,EAAE;4BACzBkC,kBAAkBb,YAAY,CAAC3D,GAAG,CAAC,SAAS4C,gBAAgBN,KAAK;wBACnE;wBAEA;;4BAAOlD,IAAIyE,QAAQ,CAACW,kBAAkBV,QAAQ;;;wBACvC3D;wBACP;;4BAAOf,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gCAC1BE,OAAO;gCACP6B,mBAAmB7B,AAAK,YAALA,OAAiB8B,SAAQ9B,MAAME,OAAO,GAAG;4BAC9D;;;;;;;;QAEJ;;IAEA;;;GAGC,GACD3B,OAAOgD,IAAI,CAAC,gBAAgB,SAAOvC,KAAcC;;gBAE3C+C,WACAoD,eAGEjG,YAEEkG,mBACAC,aACeA,oBAAdnF,IAAIoF,QAK4DvG,WAAjEwF,YAAYvE,MAAMgC,cAAc8C,eAAeS,eAoB/CC,eASArB,UAkCWA,iCAATO,QACAe,mBAcFb,aACAc,mBAEA1B,WAoCAwB,gBASAxB,YASF2B,yBAOY9G,wBAHN+G,UAgBC7F,OAOL8F,gBACAC;;;;wBAjLR,mEAAmE;wBAC/D/D,YAAYhD,IAAI0C,IAAI,CAACM,SAAS;wBAC9BoD,gBAAgBpG,IAAI0C,IAAI,CAAC0D,aAAa;wBAE1C,sEAAsE;wBAChEjG,aAAaH,IAAII,OAAO,CAACC,aAAa;wBAC5C,IAAIF,cAAcA,WAAWQ,UAAU,CAAC,WAAW;4BAC3C0F,oBAAoBlG,WAAW6G,SAAS,CAAC;4BACzCV,cAAcW,OAAOC,IAAI,CAACb,mBAAmB,UAAU1B,QAAQ,CAAC;4BACjD2B,sCAAAA,YAAYa,KAAK,CAAC,UAAhChG,KAAcmF,uBAAVC,SAAUD;4BACrBtD,YAAY7B;4BACZiF,gBAAgBG;wBAClB;wBAEyEvG,YAAAA,IAAI0C,IAAI,EAAzE8C,aAAiExF,UAAjEwF,YAAYvE,OAAqDjB,UAArDiB,MAAMgC,eAA+CjD,UAA/CiD,cAAc8C,gBAAiC/F,UAAjC+F,eAAeS,gBAAkBxG,UAAlBwG;wBAEvD,sBAAsB;wBACtB,IAAI,CAAChB,YAAY;4BACf;;gCAAOvF,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;6BAEI2C,CAAAA,eAAe,oBAAmB,GAAlCA;;;;wBACF,2BAA2B;wBAC3B,IAAI,CAACvE,QAAQ,CAAC+B,aAAa,CAACC,cAAc;4BACxC;;gCAAOhD,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;wBAGsB;;4BAAMF,YAASyE,cAAc,CAAC1H,OAAOsD,WAAWoD,0BAAAA,2BAAAA,gBAAiB;;;wBAAjFK,gBAAgB;wBACtB,IAAI,CAACA,eAAe;4BAClB;;gCAAOxG,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;wBAGiB;;4BAAMF,YAAS0E,WAAW,CAAC3H,OAAOuB;;;wBAA7CmE,WAAW;wBACjB,IAAI,CAACA,UAAU;4BACb;;gCAAOnF,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;wBAEA,8BAA8B;wBAC9B,IAAIuC,SAASpC,SAAS,KAAKA,aAAaoC,SAASnC,YAAY,KAAKA,cAAc;4BAC9E;;gCAAOhD,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;6BAEIsB,CAAAA,KAAKC,GAAG,KAAKgB,SAASf,UAAU,AAAD,GAA/BF;;;;wBACF;;4BAAMxB,YAAS2E,cAAc,CAAC5H,OAAOuB;;;wBAArC;wBACA;;4BAAOhB,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gCAC1BE,OAAO;gCACP6B,mBAAmB;4BACrB;;;wBAGF,wBAAwB;wBACxB,IAAIuC,SAAShC,cAAc,EAAE;;4BAC3B,IAAI,CAACoD,eAAe;gCAClB;;oCAAOvG,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;wCAC1BE,OAAO;wCACP6B,mBAAmB;oCACrB;;4BACF;4BAEA,gDAAgD;4BAC1C8C,UAASP,kCAAAA,SAAS/B,qBAAqB,cAA9B+B,6CAAAA,kCAAkC;4BAC3CsB,oBAAoBf,WAAW,SAAS4B,IAAAA,kBAAU,EAAC,UAAUC,MAAM,CAAChB,eAAeiB,MAAM,CAAC,eAAejB;4BAE/G,IAAIE,sBAAsBtB,SAAShC,cAAc,EAAE;gCACjD;;oCAAOnD,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;wCAC1BE,OAAO;wCACP6B,mBAAmB;oCACrB;;4BACF;wBACF;wBAEA,2CAA2C;wBAC3C;;4BAAMF,YAAS2E,cAAc,CAAC5H,OAAOuB;;;wBAArC;wBAEA,4BAA4B;wBACtB4E,cAAc7B,IAAAA,kBAAU;wBACxB2C,oBAAoB3C,IAAAA,kBAAU;wBAE9BiB,YAAyB;4BAC7Ba,cAAcD;4BACd6B,YAAY;4BACZxB,YAAY;4BACZH,eAAeY;4BACfzD,OAAOkC,SAASlC,KAAK;4BACrBF,WAAAA;4BACAkC,gBAAgBE,SAASF,cAAc;4BACvChB,YAAYC,KAAKC,GAAG;wBACtB;wBAEA;;4BAAMzB,YAASgF,cAAc,CAACjI,OAAOmG,aAAaZ;;;wBAAlD;wBACA;;4BAAMtC,YAASiF,eAAe,CAAClI,OAAOiH,mBAAmB1B;;;wBAAzD;wBAEA,oDAAoD;wBACpD;;4BAAMtC,YAASkF,iBAAiB,CAACnI,OAAOmG,aAAaT,SAASF,cAAc;;;wBAA5E;wBAEA,wBAAwB;wBACxB;;4BAAOjF,IAAIa,IAAI,CAAC;gCACdgF,cAAcb,UAAUa,YAAY;gCACpC4B,YAAYzC,UAAUyC,UAAU;gCAChCxB,YAAYjB,UAAUiB,UAAU;gCAChCH,eAAed,UAAUc,aAAa;gCACtC7C,OAAO+B,UAAU/B,KAAK;4BACxB;;;6BAEEsC,CAAAA,eAAe,eAAc,GAA7BA;;;;wBACF,sBAAsB;wBACtB,IAAI,CAACO,iBAAiB,CAAC/C,WAAW;4BAChC;;gCAAO/C,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;wBAGsB;;4BAAMF,YAASyE,cAAc,CAAC1H,OAAOsD,WAAWoD,0BAAAA,2BAAAA,gBAAiB;;;wBAAjFK,iBAAgB;wBACtB,IAAI,CAACA,gBAAe;4BAClB;;gCAAOxG,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;wBAGkB;;4BAAMF,YAASmF,eAAe,CAACpI,OAAOqG;;;wBAAlDd,aAAY;wBAClB,IAAI,CAACA,cAAaA,WAAUjC,SAAS,KAAKA,WAAW;4BACnD;;gCAAO/C,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;wBAEA,uCAAuC;wBACnC+D,0BAA0B3B,WAAUC,cAAc;6BAClDD,WAAUC,cAAc,CAACc,YAAY,EAArCf;;;;;;;;;;;;wBAEA,+DAA+D;wBACzD4B,WAAW,IAAIkB,uBAAgB,CAAC;4BACpCtD,UAAU3E,aAAa2E,QAAQ;2BAC3B3E,aAAa2F,YAAY,IAAI;4BAAEA,cAAc3F,aAAa2F,YAAY;wBAAC;4BAC3ElB,QAAQ,GAAEzE,yBAAAA,aAAayE,QAAQ,cAArBzE,oCAAAA,yBAAyB;4BACnCoD,OAAO+B,WAAU/B,KAAK;4BACtB8E,gBAAgB,AAAC,GAAU,OAARpI,SAAQ;4BAC3BqI,QAAQ;gCACNC,MAAMC,QAAQC,GAAG;gCACjBpH,OAAOmH,QAAQnH,KAAK;gCACpBqH,MAAMF,QAAQE,IAAI;gCAClBC,OAAO,YAAO;4BAChB;;wBAIwB;;4BAAMzB,SAAS0B,kBAAkB,CAACtD,WAAUC,cAAc,CAACc,YAAY;;;wBADjG,qCAAqC;wBACrCY,0BAA0B;;;;;;wBACnB5F;wBACP,4EAA4E;wBAC5EmH,QAAQE,IAAI,CAAC,yDAAyDrH,AAAK,YAALA,OAAiB8B,SAAQ9B,MAAME,OAAO,GAAGsH,OAAOxH;;;;;;wBAI1H,gCAAgC;wBAC1B8F,iBAAiB9C,IAAAA,kBAAU;wBAC3B+C,eAA4B,wCAC7B9B;4BACHa,cAAcgB;4BACd5C,YAAYC,KAAKC,GAAG;;wBAGtB;;4BAAMzB,YAASgF,cAAc,CAACjI,OAAOoH,gBAAgBC;;;wBAArD;wBAEA,kEAAkE;wBAClE;;4BAAMpE,YAASkF,iBAAiB,CAACnI,OAAOoH,gBAAgBF;;;wBAAxD;wBAEA;;4BAAO3G,IAAIa,IAAI,CAAC;gCACdgF,cAAciB,aAAajB,YAAY;gCACvC4B,YAAYX,aAAaW,UAAU;gCACnCxB,YAAYa,aAAab,UAAU;gCACnChD,OAAO6D,aAAa7D,KAAK;4BAC3B;;;wBAEF;;4BAAOjD,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gCAC1BE,OAAO;gCACP6B,mBAAmB;4BACrB;;;;QACF;;IAEA;;;GAGC,GACDtD,OAAOgD,IAAI,CAAC,iBAAiB,SAAOvC,KAAcC;;gBACaD,WAArDyI,OAAOC,iBAAiB1F,WAAWoD,eAWnCK;;;;wBAXqDzG,YAAAA,IAAI0C,IAAI,EAA7D+F,QAAqDzI,UAArDyI,OAAOC,kBAA8C1I,UAA9C0I,iBAAiB1F,YAA6BhD,UAA7BgD,WAAWoD,gBAAkBpG,UAAlBoG;wBAE3C,IAAI,CAACqC,OAAO;4BACV;;gCAAOxI,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;6BAGIG,CAAAA,aAAaoD,aAAY,GAAzBpD;;;;wBACoB;;4BAAML,YAASyE,cAAc,CAAC1H,OAAOsD,WAAWoD;;;wBAAhEK,gBAAgB;wBACtB,IAAI,CAACA,eAAe;4BAClB;;gCAAOxG,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;;;6BAIE6F,CAAAA,oBAAoB,eAAc,GAAlCA;;;;wBACF;;4BAAM/F,YAASgG,kBAAkB,CAACjJ,OAAO+I;;;wBAAzC;;;;;;6BACSC,CAAAA,oBAAoB,cAAa,GAAjCA;;;;wBACT;;4BAAM/F,YAASiG,iBAAiB,CAAClJ,OAAO+I;;;wBAAxC;wBACA;;4BAAM9F,YAASkG,oBAAoB,CAACnJ,OAAO+I;;;wBAA3C;;;;;;wBAEA,qBAAqB;wBACrB;;4BAAM9F,YAASgG,kBAAkB,CAACjJ,OAAO+I;;;wBAAzC;wBACA;;4BAAM9F,YAASiG,iBAAiB,CAAClJ,OAAO+I;;;wBAAxC;wBACA;;4BAAM9F,YAASkG,oBAAoB,CAACnJ,OAAO+I;;;wBAA3C;;;wBAGF,+CAA+C;wBAC/C;;4BAAOxI,IAAIW,MAAM,CAAC,KAAKkI,IAAI;;;;QAC7B;;IAEA;;;;;;GAMC,GACDvJ,OAAO+B,GAAG,CAAC,iBAAiB,SAAOtB,KAAcC;;gBAEzCE,YASAsI,OAGAxD,WAUAb,KACA6B,WAaA8C;;;;wBArCN,iDAAiD;wBAC3C5I,aAAaH,IAAII,OAAO,CAACC,aAAa;wBAE5C,IAAI,CAACF,cAAc,CAACA,WAAWQ,UAAU,CAAC,YAAY;4BACpD;;gCAAOV,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;wBAEM4F,QAAQtI,WAAW6G,SAAS,CAAC,IAAI,0BAA0B;wBAG/C;;4BAAMrE,YAASqG,cAAc,CAACtJ,OAAO+I;;;wBAAjDxD,YAAY;wBAElB,IAAI,CAACA,WAAW;4BACd;;gCAAOhF,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oCAC1BE,OAAO;oCACP6B,mBAAmB;gCACrB;;wBACF;wBAEA,4BAA4B;wBACtBuB,MAAMD,KAAKC,GAAG;wBACd6B,YAAYhB,UAAUf,UAAU,GAAGe,UAAUiB,UAAU,GAAG;6BAE5D9B,CAAAA,MAAM6B,SAAQ,GAAd7B;;;;wBACF,uBAAuB;wBACvB;;4BAAMzB,YAASiG,iBAAiB,CAAClJ,OAAO+I;;;wBAAxC;wBACA;;4BAAM9F,YAASkG,oBAAoB,CAACnJ,OAAO+I;;;wBAA3C;wBACA;;4BAAOxI,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gCAC1BE,OAAO;gCACP6B,mBAAmB;4BACrB;;;wBAGF,yDAAyD;wBACnDkG,WAAW;4BACfN,OAAAA;4BACAhE,UAAUQ,UAAUjC,SAAS;4BAC7BiG,QAAQhE,UAAU/B,KAAK,GAAG+B,UAAU/B,KAAK,CAACiE,KAAK,CAAC;4BAChDlB,WAAAA;4BACAf,gBAAgBD,UAAUC,cAAc;wBAC1C;wBAEA;;4BAAOjF,IAAIa,IAAI,CAACiI;;;;QAClB;;IAEA;;GAEC,GACDxJ,OAAO+B,GAAG,CAAC,kBAAkB,SAAOC,MAAetB;;gBAC3CiJ;;;;wBAAU;;4BAAMvG,YAASwG,WAAW,CAACzJ;;;wBAArCwJ,UAAU;wBAChBjJ,IAAIa,IAAI,CAACoI;;;;;;QACX;;IAEA,OAAO3J;AACT"}

package/dist/esm/lib/dcr-router.js CHANGED Viewed

@@ -169,12 +169,14 @@ import * as dcrUtils from './dcr-utils.js';
                 error_description: 'Invalid redirect_uri'
             });
         }
+        // Use client-provided scope or fall back to server's supported scopes
+        const effectiveScope = typeof scope === 'string' && scope.trim() !== '' ? scope : scopesSupported.join(' ');
         // Store DCR request state for Microsoft OAuth callback
         const msState = randomUUID();
         const dcrRequestState = {
             client_id,
             redirect_uri,
-            scope: typeof scope === 'string' ? scope : '',
+            scope: effectiveScope,
             state: typeof state === 'string' ? state : undefined,
             code_challenge: typeof code_challenge === 'string' ? code_challenge : undefined,
             code_challenge_method: typeof code_challenge_method === 'string' ? code_challenge_method : undefined,
@@ -187,7 +189,7 @@ import * as dcrUtils from './dcr-utils.js';
         msAuthUrl.searchParams.set('client_id', clientConfig.clientId);
         msAuthUrl.searchParams.set('response_type', 'code');
         msAuthUrl.searchParams.set('redirect_uri', `${baseUrl}/oauth/callback`);
-        msAuthUrl.searchParams.set('scope', typeof scope === 'string' ? scope : '');
+        msAuthUrl.searchParams.set('scope', effectiveScope);
         msAuthUrl.searchParams.set('state', msState);
         msAuthUrl.searchParams.set('response_mode', 'query');
         // Redirect user to Microsoft for authorization

package/dist/esm/lib/dcr-router.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["/Users/kevin/Dev/Projects/mcp-z/oauth-microsoft/src/lib/dcr-router.ts"],"sourcesContent":["/*\n DCR Router - OAuth 2.0 Authorization Server\n \n Implements OAuth 2.0 Dynamic Client Registration Protocol (RFC 7591)\n * and OAuth 2.0 Authorization Server endpoints (RFC 6749, RFC 8414, RFC 9728).\n \n Endpoints:\n * - GET /.well-known/oauth-authorization-server (RFC 8414 metadata)\n * - GET /.well-known/oauth-protected-resource (RFC 9728 metadata - root)\n * - GET /.well-known/oauth-protected-resource/mcp (RFC 9728 metadata - sub-path)\n * - POST /oauth/register (RFC 7591 client registration)\n * - GET /oauth/authorize (RFC 6749 authorization endpoint)\n * - POST /oauth/token (RFC 6749 token endpoint)\n * - POST /oauth/revoke (RFC 7009 token revocation)\n * - GET /oauth/verify (token verification for Resource Server)\n /\n\nimport type { ProviderTokens, RFC8414Metadata, RFC9728Metadata } from '@mcp-z/oauth';\nimport { createHash, randomUUID } from 'crypto';\nimport type { Request, Response } from 'express';\nimport express from 'express';\nimport type { Keyv } from 'keyv';\nimport { DcrOAuthProvider } from '../providers/dcr.ts';\nimport type { AccessToken, AuthorizationCode, OAuthClientConfig } from '../types.ts';\nimport as dcrUtils from './dcr-utils.ts';\n\n/*\n Configuration for DCR Router (self-hosted mode only)\n /\nexport interface DcrRouterConfig {\n /* Single Keyv store for all DCR data /\n store: Keyv;\n\n /* Authorization Server issuer URL /\n issuerUrl: string;\n\n /* Base URL for OAuth endpoints /\n baseUrl: string;\n\n /* Supported OAuth scopes /\n scopesSupported: string[];\n\n /* OAuth client configuration for upstream provider /\n clientConfig: OAuthClientConfig;\n}\n\n/\n Create DCR Router with OAuth 2.0 endpoints (self-hosted mode)\n \n For external mode (Auth0/Stitch), don't call this function - no router needed.\n * The server code should check DcrConfig.mode and only call this for 'self-hosted'.\n \n @param config - Router configuration\n * @returns Express router with OAuth endpoints\n /\nexport function createDcrRouter(config: DcrRouterConfig): express.Router {\n const router = express.Router();\n const { store, issuerUrl, baseUrl, scopesSupported, clientConfig } = config;\n\n router.use('/mcp', (req: Request, res: Response, next) => {\n const authHeader = req.headers.authorization \|\| req.headers.Authorization;\n const headerValue = Array.isArray(authHeader) ? authHeader[0] : authHeader;\n\n if (!headerValue \|\| !headerValue.toLowerCase().startsWith('bearer ')) {\n return res\n .status(401)\n .set('WWW-Authenticate', `Bearer resource_metadata=\"${baseUrl}/.well-known/oauth-protected-resource\"`)\n .json({\n jsonrpc: '2.0',\n error: {\n code: -32600,\n message: 'Missing Authorization header. DCR mode requires bearer token.',\n },\n id: null,\n });\n }\n\n return next();\n });\n\n // Apply required middleware for OAuth 2.0 endpoints (RFC 6749)\n router.use(express.json()); // For /oauth/register (application/json)\n router.use(express.urlencoded({ extended: true })); // For /oauth/token (application/x-www-form-urlencoded)\n\n /\n OAuth Authorization Server Metadata (RFC 8414)\n * GET /.well-known/oauth-authorization-server\n /\n router.get('/.well-known/oauth-authorization-server', (_req: Request, res: Response) => {\n const metadata: RFC8414Metadata = {\n issuer: issuerUrl,\n authorization_endpoint: `${baseUrl}/oauth/authorize`,\n token_endpoint: `${baseUrl}/oauth/token`,\n registration_endpoint: `${baseUrl}/oauth/register`,\n revocation_endpoint: `${baseUrl}/oauth/revoke`,\n scopes_supported: scopesSupported,\n response_types_supported: ['code'],\n grant_types_supported: ['authorization_code', 'refresh_token'],\n token_endpoint_auth_methods_supported: ['client_secret_basic', 'client_secret_post'],\n code_challenge_methods_supported: ['S256', 'plain'],\n service_documentation: `${baseUrl}/docs`,\n };\n res.json(metadata);\n });\n\n /\n OAuth Protected Resource Metadata (RFC 9728 - Root)\n * GET /.well-known/oauth-protected-resource\n /\n router.get('/.well-known/oauth-protected-resource', (_req: Request, res: Response) => {\n const metadata: RFC9728Metadata = {\n resource: baseUrl,\n authorization_servers: [baseUrl],\n scopes_supported: scopesSupported,\n bearer_methods_supported: ['header'],\n };\n res.json(metadata);\n });\n\n /\n OAuth Protected Resource Metadata (RFC 9728 - Sub-path /mcp)\n * GET /.well-known/oauth-protected-resource/mcp\n /\n router.get('/.well-known/oauth-protected-resource/mcp', (_req: Request, res: Response) => {\n const metadata: RFC9728Metadata = {\n resource: `${baseUrl}/mcp`,\n authorization_servers: [baseUrl],\n scopes_supported: scopesSupported,\n bearer_methods_supported: ['header'],\n };\n res.json(metadata);\n });\n\n /\n Dynamic Client Registration (RFC 7591)\n * POST /oauth/register\n /\n router.post('/oauth/register', async (req: Request, res: Response) => {\n try {\n const registrationRequest = req.body;\n\n // Register the client\n const client = await dcrUtils.registerClient(store, registrationRequest);\n\n // Return client information (RFC 7591 Section 3.2.1)\n res.status(201).json(client);\n } catch (error) {\n res.status(400).json({\n error: 'invalid_client_metadata',\n error_description: error instanceof Error ? error.message : 'Invalid registration request',\n });\n }\n });\n\n /\n OAuth Authorization Endpoint (RFC 6749 Section 3.1)\n * GET /oauth/authorize\n \n Initiates Microsoft OAuth flow, then generates DCR authorization code\n /\n router.get('/oauth/authorize', async (req: Request, res: Response) => {\n const { response_type, client_id, redirect_uri, scope = '', state = '', code_challenge, code_challenge_method } = req.query;\n\n // Validate required parameters\n if (response_type !== 'code') {\n return res.status(400).json({\n error: 'unsupported_response_type',\n error_description: 'Only response_type=code is supported',\n });\n }\n\n if (!client_id \|\| typeof client_id !== 'string') {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'client_id is required',\n });\n }\n\n if (!redirect_uri \|\| typeof redirect_uri !== 'string') {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'redirect_uri is required',\n });\n }\n\n // Validate client\n const client = await dcrUtils.getClient(store, client_id);\n if (!client) {\n return res.status(400).json({\n error: 'invalid_client',\n error_description: 'Unknown client_id',\n });\n }\n\n // Validate redirect_uri\n const isValidRedirect = await dcrUtils.validateRedirectUri(store, client_id, redirect_uri);\n if (!isValidRedirect) {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'Invalid redirect_uri',\n });\n }\n\n // Store DCR request state for Microsoft OAuth callback\n const msState = randomUUID();\n const dcrRequestState = {\n client_id,\n redirect_uri,\n scope: typeof scope === 'string' ? scope : '',\n state: typeof state === 'string' ? state : undefined,\n code_challenge: typeof code_challenge === 'string' ? code_challenge : undefined,\n code_challenge_method: typeof code_challenge_method === 'string' ? code_challenge_method : undefined,\n created_at: Date.now(),\n expires_at: Date.now() + 600000, // 10 minutes\n };\n\n await store.set(`dcr:ms-state:${msState}`, dcrRequestState, 600000); // 10 min TTL\n\n // Build Microsoft authorization URL\n const msAuthUrl = new URL(`https://login.microsoftonline.com/${clientConfig.tenantId \|\| 'common'}/oauth2/v2.0/authorize`);\n msAuthUrl.searchParams.set('client_id', clientConfig.clientId);\n msAuthUrl.searchParams.set('response_type', 'code');\n msAuthUrl.searchParams.set('redirect_uri', `${baseUrl}/oauth/callback`);\n msAuthUrl.searchParams.set('scope', typeof scope === 'string' ? scope : '');\n msAuthUrl.searchParams.set('state', msState);\n msAuthUrl.searchParams.set('response_mode', 'query');\n\n // Redirect user to Microsoft for authorization\n return res.redirect(msAuthUrl.toString());\n });\n\n /\n OAuth Callback Handler\n * GET /oauth/callback\n \n Handles callback from Microsoft after user authorization\n /\n router.get('/oauth/callback', async (req: Request, res: Response) => {\n const { code: msCode, state: msState, error, error_description } = req.query;\n\n // Handle Microsoft OAuth errors\n if (error) {\n return res.status(400).json({\n error,\n error_description: error_description \|\| 'Microsoft OAuth authorization failed',\n });\n }\n\n if (!msCode \|\| typeof msCode !== 'string') {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'Authorization code is required',\n });\n }\n\n if (!msState \|\| typeof msState !== 'string') {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'State parameter is required',\n });\n }\n\n // Retrieve original DCR request state\n const dcrRequestState = await store.get(`dcr:ms-state:${msState}`);\n if (!dcrRequestState) {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'Invalid or expired state parameter',\n });\n }\n\n // Delete state (one-time use)\n await store.delete(`dcr:ms-state:${msState}`);\n\n // Exchange Microsoft authorization code for tokens\n try {\n const tokenUrl = `https://login.microsoftonline.com/${clientConfig.tenantId \|\| 'common'}/oauth2/v2.0/token`;\n const tokenParams = new URLSearchParams({\n grant_type: 'authorization_code',\n code: msCode,\n client_id: clientConfig.clientId,\n redirect_uri: `${baseUrl}/oauth/callback`,\n scope: dcrRequestState.scope,\n });\n\n // Add client_secret if available (confidential client)\n if (clientConfig.clientSecret) {\n tokenParams.set('client_secret', clientConfig.clientSecret);\n }\n\n const tokenResponse = await fetch(tokenUrl, {\n method: 'POST',\n headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n body: tokenParams.toString(),\n });\n\n if (!tokenResponse.ok) {\n const errorData = (await tokenResponse.json()) as { error?: string; error_description?: string };\n throw new Error(`Microsoft token exchange failed: ${errorData.error_description \|\| errorData.error}`);\n }\n\n const tokenData = (await tokenResponse.json()) as {\n access_token: string;\n refresh_token?: string;\n expires_in: number;\n scope: string;\n };\n\n // Create provider tokens from Microsoft response\n const providerTokens: ProviderTokens = {\n accessToken: tokenData.access_token,\n ...(tokenData.refresh_token && { refreshToken: tokenData.refresh_token }),\n expiresAt: Date.now() + tokenData.expires_in 1000,\n scope: tokenData.scope,\n };\n\n // Generate DCR authorization code with real provider tokens\n const dcrCode = randomUUID();\n const authCode: AuthorizationCode = {\n code: dcrCode,\n client_id: dcrRequestState.client_id,\n redirect_uri: dcrRequestState.redirect_uri,\n scope: dcrRequestState.scope,\n ...(dcrRequestState.code_challenge && { code_challenge: dcrRequestState.code_challenge }),\n ...(dcrRequestState.code_challenge_method && { code_challenge_method: dcrRequestState.code_challenge_method }),\n providerTokens,\n created_at: Date.now(),\n expires_at: Date.now() + 600000, // 10 minutes\n };\n\n await dcrUtils.setAuthCode(store, dcrCode, authCode);\n\n // Redirect back to MCP client with DCR authorization code\n const clientRedirectUrl = new URL(dcrRequestState.redirect_uri);\n clientRedirectUrl.searchParams.set('code', dcrCode);\n if (dcrRequestState.state) {\n clientRedirectUrl.searchParams.set('state', dcrRequestState.state);\n }\n\n return res.redirect(clientRedirectUrl.toString());\n } catch (error) {\n return res.status(500).json({\n error: 'server_error',\n error_description: error instanceof Error ? error.message : 'Failed to exchange authorization code',\n });\n }\n });\n\n /*\n OAuth Token Endpoint (RFC 6749 Section 3.2)\n * POST /oauth/token\n /\n router.post('/oauth/token', async (req: Request, res: Response) => {\n // Extract client credentials from either body or Basic Auth header\n let client_id = req.body.client_id;\n let client_secret = req.body.client_secret;\n\n // Support client_secret_basic authentication (RFC 6749 Section 2.3.1)\n const authHeader = req.headers.authorization;\n if (authHeader && authHeader.startsWith('Basic ')) {\n const base64Credentials = authHeader.substring(6);\n const credentials = Buffer.from(base64Credentials, 'base64').toString('utf-8');\n const [id, secret] = credentials.split(':');\n client_id = id;\n client_secret = secret;\n }\n\n const { grant_type, code, redirect_uri, refresh_token, code_verifier } = req.body;\n\n // Validate grant_type\n if (!grant_type) {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'grant_type is required',\n });\n }\n\n if (grant_type === 'authorization_code') {\n // Authorization Code Grant\n if (!code \|\| !client_id \|\| !redirect_uri) {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'code, client_id, and redirect_uri are required',\n });\n }\n\n // Validate client credentials\n const isValidClient = await dcrUtils.validateClient(store, client_id, client_secret ?? '');\n if (!isValidClient) {\n return res.status(401).json({\n error: 'invalid_client',\n error_description: 'Invalid client credentials',\n });\n }\n\n // Get authorization code\n const authCode = await dcrUtils.getAuthCode(store, code);\n if (!authCode) {\n return res.status(400).json({\n error: 'invalid_grant',\n error_description: 'Invalid or expired authorization code',\n });\n }\n\n // Validate authorization code\n if (authCode.client_id !== client_id \|\| authCode.redirect_uri !== redirect_uri) {\n return res.status(400).json({\n error: 'invalid_grant',\n error_description: 'Authorization code mismatch',\n });\n }\n\n if (Date.now() > authCode.expires_at) {\n await dcrUtils.deleteAuthCode(store, code);\n return res.status(400).json({\n error: 'invalid_grant',\n error_description: 'Authorization code expired',\n });\n }\n\n // Validate PKCE if used\n if (authCode.code_challenge) {\n if (!code_verifier) {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'code_verifier is required for PKCE',\n });\n }\n\n // Validate code_verifier against code_challenge\n const method = authCode.code_challenge_method ?? 'plain';\n const computedChallenge = method === 'S256' ? createHash('sha256').update(code_verifier).digest('base64url') : code_verifier;\n\n if (computedChallenge !== authCode.code_challenge) {\n return res.status(400).json({\n error: 'invalid_grant',\n error_description: 'Invalid code_verifier',\n });\n }\n }\n\n // Delete authorization code (one-time use)\n await dcrUtils.deleteAuthCode(store, code);\n\n // Generate DCR access token\n const accessToken = randomUUID();\n const refreshTokenValue = randomUUID();\n\n const tokenData: AccessToken = {\n access_token: accessToken,\n token_type: 'Bearer',\n expires_in: 3600,\n refresh_token: refreshTokenValue,\n scope: authCode.scope,\n client_id,\n providerTokens: authCode.providerTokens,\n created_at: Date.now(),\n };\n\n await dcrUtils.setAccessToken(store, accessToken, tokenData);\n await dcrUtils.setRefreshToken(store, refreshTokenValue, tokenData);\n\n // Store provider tokens indexed by DCR access token\n await dcrUtils.setProviderTokens(store, accessToken, authCode.providerTokens);\n\n // Return token response\n return res.json({\n access_token: tokenData.access_token,\n token_type: tokenData.token_type,\n expires_in: tokenData.expires_in,\n refresh_token: tokenData.refresh_token,\n scope: tokenData.scope,\n });\n }\n if (grant_type === 'refresh_token') {\n // Refresh Token Grant\n if (!refresh_token \|\| !client_id) {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'refresh_token and client_id are required',\n });\n }\n\n // Validate client credentials\n const isValidClient = await dcrUtils.validateClient(store, client_id, client_secret ?? '');\n if (!isValidClient) {\n return res.status(401).json({\n error: 'invalid_client',\n error_description: 'Invalid client credentials',\n });\n }\n\n // Get refresh token\n const tokenData = await dcrUtils.getRefreshToken(store, refresh_token);\n if (!tokenData \|\| tokenData.client_id !== client_id) {\n return res.status(400).json({\n error: 'invalid_grant',\n error_description: 'Invalid refresh token',\n });\n }\n\n // Refresh provider tokens if available\n let refreshedProviderTokens = tokenData.providerTokens;\n if (tokenData.providerTokens.refreshToken) {\n try {\n // Create DcrOAuthProvider instance to refresh Microsoft tokens\n const provider = new DcrOAuthProvider({\n clientId: clientConfig.clientId,\n ...(clientConfig.clientSecret && { clientSecret: clientConfig.clientSecret }),\n tenantId: clientConfig.tenantId ?? 'common',\n scope: tokenData.scope,\n verifyEndpoint: `${baseUrl}/oauth/verify`,\n logger: {\n info: console.log,\n error: console.error,\n warn: console.warn,\n debug: () => {},\n },\n });\n\n // Refresh the Microsoft access token\n refreshedProviderTokens = await provider.refreshAccessToken(tokenData.providerTokens.refreshToken);\n } catch (error) {\n // If refresh fails, continue with existing tokens (they may still be valid)\n console.warn('Provider token refresh failed, using existing tokens:', error instanceof Error ? error.message : String(error));\n }\n }\n\n // Generate new DCR access token\n const newAccessToken = randomUUID();\n const newTokenData: AccessToken = {\n ...tokenData,\n access_token: newAccessToken,\n created_at: Date.now(),\n };\n\n await dcrUtils.setAccessToken(store, newAccessToken, newTokenData);\n\n // Store refreshed provider tokens indexed by new DCR access token\n await dcrUtils.setProviderTokens(store, newAccessToken, refreshedProviderTokens);\n\n return res.json({\n access_token: newTokenData.access_token,\n token_type: newTokenData.token_type,\n expires_in: newTokenData.expires_in,\n scope: newTokenData.scope,\n });\n }\n return res.status(400).json({\n error: 'unsupported_grant_type',\n error_description: 'Only authorization_code and refresh_token grants are supported',\n });\n });\n\n /\n OAuth Token Revocation (RFC 7009)\n * POST /oauth/revoke\n /\n router.post('/oauth/revoke', async (req: Request, res: Response) => {\n const { token, token_type_hint, client_id, client_secret } = req.body;\n\n if (!token) {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'token is required',\n });\n }\n\n // Validate client if credentials provided\n if (client_id && client_secret) {\n const isValidClient = await dcrUtils.validateClient(store, client_id, client_secret);\n if (!isValidClient) {\n return res.status(401).json({\n error: 'invalid_client',\n error_description: 'Invalid client credentials',\n });\n }\n }\n\n // Revoke the token\n if (token_type_hint === 'refresh_token') {\n await dcrUtils.deleteRefreshToken(store, token);\n } else if (token_type_hint === 'access_token') {\n await dcrUtils.deleteAccessToken(store, token);\n await dcrUtils.deleteProviderTokens(store, token);\n } else {\n // No hint - try both\n await dcrUtils.deleteRefreshToken(store, token);\n await dcrUtils.deleteAccessToken(store, token);\n await dcrUtils.deleteProviderTokens(store, token);\n }\n\n // RFC 7009: Return 200 even if token not found\n return res.status(200).send();\n });\n\n /\n Token Verification Endpoint\n * GET /oauth/verify\n \n Validates bearer tokens for Resource Server.\n * Returns AuthInfo with provider tokens for stateless DCR pattern.\n /\n router.get('/oauth/verify', async (req: Request, res: Response) => {\n // Extract bearer token from Authorization header\n const authHeader = req.headers.authorization;\n\n if (!authHeader \|\| !authHeader.startsWith('Bearer ')) {\n return res.status(401).json({\n error: 'invalid_request',\n error_description: 'Missing or invalid Authorization header',\n });\n }\n\n const token = authHeader.substring(7); // Remove 'Bearer ' prefix\n\n // Validate token exists in access tokens store\n const tokenData = await dcrUtils.getAccessToken(store, token);\n\n if (!tokenData) {\n return res.status(401).json({\n error: 'invalid_token',\n error_description: 'Unknown or expired access token',\n });\n }\n\n // Check if token is expired\n const now = Date.now();\n const expiresAt = tokenData.created_at + tokenData.expires_in 1000;\n\n if (now > expiresAt) {\n // Remove expired token\n await dcrUtils.deleteAccessToken(store, token);\n await dcrUtils.deleteProviderTokens(store, token);\n return res.status(401).json({\n error: 'invalid_token',\n error_description: 'Access token has expired',\n });\n }\n\n // Return AuthInfo with provider tokens for stateless DCR\n const authInfo = {\n token,\n clientId: tokenData.client_id,\n scopes: tokenData.scope ? tokenData.scope.split(' ') : [],\n expiresAt,\n providerTokens: tokenData.providerTokens,\n };\n\n return res.json(authInfo);\n });\n\n /*\n Debug endpoint to list registered clients (development only)\n */\n router.get('/debug/clients', async (_req: Request, res: Response) => {\n const clients = await dcrUtils.listClients(store);\n res.json(clients);\n });\n\n return router;\n}\n"],"names":["createHash","randomUUID","express","DcrOAuthProvider","dcrUtils","createDcrRouter","config","router","Router","store","issuerUrl","baseUrl","scopesSupported","clientConfig","use","req","res","next","authHeader","headers","authorization","Authorization","headerValue","Array","isArray","toLowerCase","startsWith","status","set","json","jsonrpc","error","code","message","id","urlencoded","extended","get","_req","metadata","issuer","authorization_endpoint","token_endpoint","registration_endpoint","revocation_endpoint","scopes_supported","response_types_supported","grant_types_supported","token_endpoint_auth_methods_supported","code_challenge_methods_supported","service_documentation","resource","authorization_servers","bearer_methods_supported","post","registrationRequest","body","client","registerClient","error_description","Error","response_type","client_id","redirect_uri","scope","state","code_challenge","code_challenge_method","query","getClient","isValidRedirect","validateRedirectUri","msState","dcrRequestState","undefined","created_at","Date","now","expires_at","msAuthUrl","URL","tenantId","searchParams","clientId","redirect","toString","msCode","delete","tokenUrl","tokenParams","URLSearchParams","grant_type","clientSecret","tokenResponse","fetch","method","ok","errorData","tokenData","providerTokens","accessToken","access_token","refresh_token","refreshToken","expiresAt","expires_in","dcrCode","authCode","setAuthCode","clientRedirectUrl","client_secret","base64Credentials","substring","credentials","Buffer","from","secret","split","code_verifier","isValidClient","validateClient","getAuthCode","deleteAuthCode","computedChallenge","update","digest","refreshTokenValue","token_type","setAccessToken","setRefreshToken","setProviderTokens","getRefreshToken","refreshedProviderTokens","provider","verifyEndpoint","logger","info","console","log","warn","debug","refreshAccessToken","String","newAccessToken","newTokenData","token","token_type_hint","deleteRefreshToken","deleteAccessToken","deleteProviderTokens","send","getAccessToken","authInfo","scopes","clients","listClients"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAGD,SAASA,UAAU,EAAEC,UAAU,QAAQ,SAAS;AAEhD,OAAOC,aAAa,UAAU;AAE9B,SAASC,gBAAgB,QAAQ,sBAAsB;AAEvD,YAAYC,cAAc,iBAAiB;AAsB3C;;;;;;;;CAQC,GACD,OAAO,SAASC,gBAAgBC,MAAuB;IACrD,MAAMC,SAASL,QAAQM,MAAM;IAC7B,MAAM,EAAEC,KAAK,EAAEC,SAAS,EAAEC,OAAO,EAAEC,eAAe,EAAEC,YAAY,EAAE,GAAGP;IAErEC,OAAOO,GAAG,CAAC,QAAQ,CAACC,KAAcC,KAAeC;QAC/C,MAAMC,aAAaH,IAAII,OAAO,CAACC,aAAa,IAAIL,IAAII,OAAO,CAACE,aAAa;QACzE,MAAMC,cAAcC,MAAMC,OAAO,CAACN,cAAcA,UAAU,CAAC,EAAE,GAAGA;QAEhE,IAAI,CAACI,eAAe,CAACA,YAAYG,WAAW,GAAGC,UAAU,CAAC,YAAY;YACpE,OAAOV,IACJW,MAAM,CAAC,KACPC,GAAG,CAAC,oBAAoB,CAAC,0BAA0B,EAAEjB,QAAQ,sCAAsC,CAAC,EACpGkB,IAAI,CAAC;gBACJC,SAAS;gBACTC,OAAO;oBACLC,MAAM,CAAC;oBACPC,SAAS;gBACX;gBACAC,IAAI;YACN;QACJ;QAEA,OAAOjB;IACT;IAEA,+DAA+D;IAC/DV,OAAOO,GAAG,CAACZ,QAAQ2B,IAAI,KAAK,yCAAyC;IACrEtB,OAAOO,GAAG,CAACZ,QAAQiC,UAAU,CAAC;QAAEC,UAAU;IAAK,KAAK,uDAAuD;IAE3G;;;GAGC,GACD7B,OAAO8B,GAAG,CAAC,2CAA2C,CAACC,MAAetB;QACpE,MAAMuB,WAA4B;YAChCC,QAAQ9B;YACR+B,wBAAwB,GAAG9B,QAAQ,gBAAgB,CAAC;YACpD+B,gBAAgB,GAAG/B,QAAQ,YAAY,CAAC;YACxCgC,uBAAuB,GAAGhC,QAAQ,eAAe,CAAC;YAClDiC,qBAAqB,GAAGjC,QAAQ,aAAa,CAAC;YAC9CkC,kBAAkBjC;YAClBkC,0BAA0B;gBAAC;aAAO;YAClCC,uBAAuB;gBAAC;gBAAsB;aAAgB;YAC9DC,uCAAuC;gBAAC;gBAAuB;aAAqB;YACpFC,kCAAkC;gBAAC;gBAAQ;aAAQ;YACnDC,uBAAuB,GAAGvC,QAAQ,KAAK,CAAC;QAC1C;QACAK,IAAIa,IAAI,CAACU;IACX;IAEA;;;GAGC,GACDhC,OAAO8B,GAAG,CAAC,yCAAyC,CAACC,MAAetB;QAClE,MAAMuB,WAA4B;YAChCY,UAAUxC;YACVyC,uBAAuB;gBAACzC;aAAQ;YAChCkC,kBAAkBjC;YAClByC,0BAA0B;gBAAC;aAAS;QACtC;QACArC,IAAIa,IAAI,CAACU;IACX;IAEA;;;GAGC,GACDhC,OAAO8B,GAAG,CAAC,6CAA6C,CAACC,MAAetB;QACtE,MAAMuB,WAA4B;YAChCY,UAAU,GAAGxC,QAAQ,IAAI,CAAC;YAC1ByC,uBAAuB;gBAACzC;aAAQ;YAChCkC,kBAAkBjC;YAClByC,0BAA0B;gBAAC;aAAS;QACtC;QACArC,IAAIa,IAAI,CAACU;IACX;IAEA;;;GAGC,GACDhC,OAAO+C,IAAI,CAAC,mBAAmB,OAAOvC,KAAcC;QAClD,IAAI;YACF,MAAMuC,sBAAsBxC,IAAIyC,IAAI;YAEpC,sBAAsB;YACtB,MAAMC,SAAS,MAAMrD,SAASsD,cAAc,CAACjD,OAAO8C;YAEpD,qDAAqD;YACrDvC,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC4B;QACvB,EAAE,OAAO1B,OAAO;YACdf,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gBACnBE,OAAO;gBACP4B,mBAAmB5B,iBAAiB6B,QAAQ7B,MAAME,OAAO,GAAG;YAC9D;QACF;IACF;IAEA;;;;;GAKC,GACD1B,OAAO8B,GAAG,CAAC,oBAAoB,OAAOtB,KAAcC;QAClD,MAAM,EAAE6C,aAAa,EAAEC,SAAS,EAAEC,YAAY,EAAEC,QAAQ,EAAE,EAAEC,QAAQ,EAAE,EAAEC,cAAc,EAAEC,qBAAqB,EAAE,GAAGpD,IAAIqD,KAAK;QAE3H,+BAA+B;QAC/B,IAAIP,kBAAkB,QAAQ;YAC5B,OAAO7C,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gBAC1BE,OAAO;gBACP4B,mBAAmB;YACrB;QACF;QAEA,IAAI,CAACG,aAAa,OAAOA,cAAc,UAAU;YAC/C,OAAO9C,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gBAC1BE,OAAO;gBACP4B,mBAAmB;YACrB;QACF;QAEA,IAAI,CAACI,gBAAgB,OAAOA,iBAAiB,UAAU;YACrD,OAAO/C,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gBAC1BE,OAAO;gBACP4B,mBAAmB;YACrB;QACF;QAEA,kBAAkB;QAClB,MAAMF,SAAS,MAAMrD,SAASiE,SAAS,CAAC5D,OAAOqD;QAC/C,IAAI,CAACL,QAAQ;YACX,OAAOzC,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gBAC1BE,OAAO;gBACP4B,mBAAmB;YACrB;QACF;QAEA,wBAAwB;QACxB,MAAMW,kBAAkB,MAAMlE,SAASmE,mBAAmB,CAAC9D,OAAOqD,WAAWC;QAC7E,IAAI,CAACO,iBAAiB;YACpB,OAAOtD,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gBAC1BE,OAAO;gBACP4B,mBAAmB;YACrB;QACF;QAEA,uDAAuD;QACvD,MAAMa,UAAUvE;QAChB,MAAMwE,kBAAkB;YACtBX;YACAC;YACAC,OAAO,OAAOA,UAAU,WAAWA,QAAQ;YAC3CC,OAAO,OAAOA,UAAU,WAAWA,QAAQS;YAC3CR,gBAAgB,OAAOA,mBAAmB,WAAWA,iBAAiBQ;YACtEP,uBAAuB,OAAOA,0BAA0B,WAAWA,wBAAwBO;YAC3FC,YAAYC,KAAKC,GAAG;YACpBC,YAAYF,KAAKC,GAAG,KAAK;QAC3B;QAEA,MAAMpE,MAAMmB,GAAG,CAAC,CAAC,aAAa,EAAE4C,SAAS,EAAEC,iBAAiB,SAAS,aAAa;QAElF,oCAAoC;QACpC,MAAMM,YAAY,IAAIC,IAAI,CAAC,kCAAkC,EAAEnE,aAAaoE,QAAQ,IAAI,SAAS,sBAAsB,CAAC;QACxHF,UAAUG,YAAY,CAACtD,GAAG,CAAC,aAAaf,aAAasE,QAAQ;QAC7DJ,UAAUG,YAAY,CAACtD,GAAG,CAAC,iBAAiB;QAC5CmD,UAAUG,YAAY,CAACtD,GAAG,CAAC,gBAAgB,GAAGjB,QAAQ,eAAe,CAAC;QACtEoE,UAAUG,YAAY,CAACtD,GAAG,CAAC,SAAS,OAAOoC,UAAU,WAAWA,QAAQ;QACxEe,UAAUG,YAAY,CAACtD,GAAG,CAAC,SAAS4C;QACpCO,UAAUG,YAAY,CAACtD,GAAG,CAAC,iBAAiB;QAE5C,+CAA+C;QAC/C,OAAOZ,IAAIoE,QAAQ,CAACL,UAAUM,QAAQ;IACxC;IAEA;;;;;GAKC,GACD9E,OAAO8B,GAAG,CAAC,mBAAmB,OAAOtB,KAAcC;QACjD,MAAM,EAAEgB,MAAMsD,MAAM,EAAErB,OAAOO,OAAO,EAAEzC,KAAK,EAAE4B,iBAAiB,EAAE,GAAG5C,IAAIqD,KAAK;QAE5E,gCAAgC;QAChC,IAAIrC,OAAO;YACT,OAAOf,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gBAC1BE;gBACA4B,mBAAmBA,qBAAqB;YAC1C;QACF;QAEA,IAAI,CAAC2B,UAAU,OAAOA,WAAW,UAAU;YACzC,OAAOtE,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gBAC1BE,OAAO;gBACP4B,mBAAmB;YACrB;QACF;QAEA,IAAI,CAACa,WAAW,OAAOA,YAAY,UAAU;YAC3C,OAAOxD,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gBAC1BE,OAAO;gBACP4B,mBAAmB;YACrB;QACF;QAEA,sCAAsC;QACtC,MAAMc,kBAAkB,MAAMhE,MAAM4B,GAAG,CAAC,CAAC,aAAa,EAAEmC,SAAS;QACjE,IAAI,CAACC,iBAAiB;YACpB,OAAOzD,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gBAC1BE,OAAO;gBACP4B,mBAAmB;YACrB;QACF;QAEA,8BAA8B;QAC9B,MAAMlD,MAAM8E,MAAM,CAAC,CAAC,aAAa,EAAEf,SAAS;QAE5C,mDAAmD;QACnD,IAAI;YACF,MAAMgB,WAAW,CAAC,kCAAkC,EAAE3E,aAAaoE,QAAQ,IAAI,SAAS,kBAAkB,CAAC;YAC3G,MAAMQ,cAAc,IAAIC,gBAAgB;gBACtCC,YAAY;gBACZ3D,MAAMsD;gBACNxB,WAAWjD,aAAasE,QAAQ;gBAChCpB,cAAc,GAAGpD,QAAQ,eAAe,CAAC;gBACzCqD,OAAOS,gBAAgBT,KAAK;YAC9B;YAEA,uDAAuD;YACvD,IAAInD,aAAa+E,YAAY,EAAE;gBAC7BH,YAAY7D,GAAG,CAAC,iBAAiBf,aAAa+E,YAAY;YAC5D;YAEA,MAAMC,gBAAgB,MAAMC,MAAMN,UAAU;gBAC1CO,QAAQ;gBACR5E,SAAS;oBAAE,gBAAgB;gBAAoC;gBAC/DqC,MAAMiC,YAAYJ,QAAQ;YAC5B;YAEA,IAAI,CAACQ,cAAcG,EAAE,EAAE;gBACrB,MAAMC,YAAa,MAAMJ,cAAchE,IAAI;gBAC3C,MAAM,IAAI+B,MAAM,CAAC,iCAAiC,EAAEqC,UAAUtC,iBAAiB,IAAIsC,UAAUlE,KAAK,EAAE;YACtG;YAEA,MAAMmE,YAAa,MAAML,cAAchE,IAAI;YAO3C,iDAAiD;YACjD,MAAMsE,iBAAiC;gBACrCC,aAAaF,UAAUG,YAAY;gBACnC,GAAIH,UAAUI,aAAa,IAAI;oBAAEC,cAAcL,UAAUI,aAAa;gBAAC,CAAC;gBACxEE,WAAW5B,KAAKC,GAAG,KAAKqB,UAAUO,UAAU,GAAG;gBAC/CzC,OAAOkC,UAAUlC,KAAK;YACxB;YAEA,4DAA4D;YAC5D,MAAM0C,UAAUzG;YAChB,MAAM0G,WAA8B;gBAClC3E,MAAM0E;gBACN5C,WAAWW,gBAAgBX,SAAS;gBACpCC,cAAcU,gBAAgBV,YAAY;gBAC1CC,OAAOS,gBAAgBT,KAAK;gBAC5B,GAAIS,gBAAgBP,cAAc,IAAI;oBAAEA,gBAAgBO,gBAAgBP,cAAc;gBAAC,CAAC;gBACxF,GAAIO,gBAAgBN,qBAAqB,IAAI;oBAAEA,uBAAuBM,gBAAgBN,qBAAqB;gBAAC,CAAC;gBAC7GgC;gBACAxB,YAAYC,KAAKC,GAAG;gBACpBC,YAAYF,KAAKC,GAAG,KAAK;YAC3B;YAEA,MAAMzE,SAASwG,WAAW,CAACnG,OAAOiG,SAASC;YAE3C,0DAA0D;YAC1D,MAAME,oBAAoB,IAAI7B,IAAIP,gBAAgBV,YAAY;YAC9D8C,kBAAkB3B,YAAY,CAACtD,GAAG,CAAC,QAAQ8E;YAC3C,IAAIjC,gBAAgBR,KAAK,EAAE;gBACzB4C,kBAAkB3B,YAAY,CAACtD,GAAG,CAAC,SAAS6C,gBAAgBR,KAAK;YACnE;YAEA,OAAOjD,IAAIoE,QAAQ,CAACyB,kBAAkBxB,QAAQ;QAChD,EAAE,OAAOtD,OAAO;YACd,OAAOf,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gBAC1BE,OAAO;gBACP4B,mBAAmB5B,iBAAiB6B,QAAQ7B,MAAME,OAAO,GAAG;YAC9D;QACF;IACF;IAEA;;;GAGC,GACD1B,OAAO+C,IAAI,CAAC,gBAAgB,OAAOvC,KAAcC;QAC/C,mEAAmE;QACnE,IAAI8C,YAAY/C,IAAIyC,IAAI,CAACM,SAAS;QAClC,IAAIgD,gBAAgB/F,IAAIyC,IAAI,CAACsD,aAAa;QAE1C,sEAAsE;QACtE,MAAM5F,aAAaH,IAAII,OAAO,CAACC,aAAa;QAC5C,IAAIF,cAAcA,WAAWQ,UAAU,CAAC,WAAW;YACjD,MAAMqF,oBAAoB7F,WAAW8F,SAAS,CAAC;YAC/C,MAAMC,cAAcC,OAAOC,IAAI,CAACJ,mBAAmB,UAAU1B,QAAQ,CAAC;YACtE,MAAM,CAACnD,IAAIkF,OAAO,GAAGH,YAAYI,KAAK,CAAC;YACvCvD,YAAY5B;YACZ4E,gBAAgBM;QAClB;QAEA,MAAM,EAAEzB,UAAU,EAAE3D,IAAI,EAAE+B,YAAY,EAAEuC,aAAa,EAAEgB,aAAa,EAAE,GAAGvG,IAAIyC,IAAI;QAEjF,sBAAsB;QACtB,IAAI,CAACmC,YAAY;YACf,OAAO3E,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gBAC1BE,OAAO;gBACP4B,mBAAmB;YACrB;QACF;QAEA,IAAIgC,eAAe,sBAAsB;YACvC,2BAA2B;YAC3B,IAAI,CAAC3D,QAAQ,CAAC8B,aAAa,CAACC,cAAc;gBACxC,OAAO/C,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oBAC1BE,OAAO;oBACP4B,mBAAmB;gBACrB;YACF;YAEA,8BAA8B;YAC9B,MAAM4D,gBAAgB,MAAMnH,SAASoH,cAAc,CAAC/G,OAAOqD,WAAWgD,0BAAAA,2BAAAA,gBAAiB;YACvF,IAAI,CAACS,eAAe;gBAClB,OAAOvG,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oBAC1BE,OAAO;oBACP4B,mBAAmB;gBACrB;YACF;YAEA,yBAAyB;YACzB,MAAMgD,WAAW,MAAMvG,SAASqH,WAAW,CAAChH,OAAOuB;YACnD,IAAI,CAAC2E,UAAU;gBACb,OAAO3F,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oBAC1BE,OAAO;oBACP4B,mBAAmB;gBACrB;YACF;YAEA,8BAA8B;YAC9B,IAAIgD,SAAS7C,SAAS,KAAKA,aAAa6C,SAAS5C,YAAY,KAAKA,cAAc;gBAC9E,OAAO/C,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oBAC1BE,OAAO;oBACP4B,mBAAmB;gBACrB;YACF;YAEA,IAAIiB,KAAKC,GAAG,KAAK8B,SAAS7B,UAAU,EAAE;gBACpC,MAAM1E,SAASsH,cAAc,CAACjH,OAAOuB;gBACrC,OAAOhB,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oBAC1BE,OAAO;oBACP4B,mBAAmB;gBACrB;YACF;YAEA,wBAAwB;YACxB,IAAIgD,SAASzC,cAAc,EAAE;oBASZyC;gBARf,IAAI,CAACW,eAAe;oBAClB,OAAOtG,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;wBAC1BE,OAAO;wBACP4B,mBAAmB;oBACrB;gBACF;gBAEA,gDAAgD;gBAChD,MAAMoC,UAASY,kCAAAA,SAASxC,qBAAqB,cAA9BwC,6CAAAA,kCAAkC;gBACjD,MAAMgB,oBAAoB5B,WAAW,SAAS/F,WAAW,UAAU4H,MAAM,CAACN,eAAeO,MAAM,CAAC,eAAeP;gBAE/G,IAAIK,sBAAsBhB,SAASzC,cAAc,EAAE;oBACjD,OAAOlD,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;wBAC1BE,OAAO;wBACP4B,mBAAmB;oBACrB;gBACF;YACF;YAEA,2CAA2C;YAC3C,MAAMvD,SAASsH,cAAc,CAACjH,OAAOuB;YAErC,4BAA4B;YAC5B,MAAMoE,cAAcnG;YACpB,MAAM6H,oBAAoB7H;YAE1B,MAAMiG,YAAyB;gBAC7BG,cAAcD;gBACd2B,YAAY;gBACZtB,YAAY;gBACZH,eAAewB;gBACf9D,OAAO2C,SAAS3C,KAAK;gBACrBF;gBACAqC,gBAAgBQ,SAASR,cAAc;gBACvCxB,YAAYC,KAAKC,GAAG;YACtB;YAEA,MAAMzE,SAAS4H,cAAc,CAACvH,OAAO2F,aAAaF;YAClD,MAAM9F,SAAS6H,eAAe,CAACxH,OAAOqH,mBAAmB5B;YAEzD,oDAAoD;YACpD,MAAM9F,SAAS8H,iBAAiB,CAACzH,OAAO2F,aAAaO,SAASR,cAAc;YAE5E,wBAAwB;YACxB,OAAOnF,IAAIa,IAAI,CAAC;gBACdwE,cAAcH,UAAUG,YAAY;gBACpC0B,YAAY7B,UAAU6B,UAAU;gBAChCtB,YAAYP,UAAUO,UAAU;gBAChCH,eAAeJ,UAAUI,aAAa;gBACtCtC,OAAOkC,UAAUlC,KAAK;YACxB;QACF;QACA,IAAI2B,eAAe,iBAAiB;YAClC,sBAAsB;YACtB,IAAI,CAACW,iBAAiB,CAACxC,WAAW;gBAChC,OAAO9C,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oBAC1BE,OAAO;oBACP4B,mBAAmB;gBACrB;YACF;YAEA,8BAA8B;YAC9B,MAAM4D,gBAAgB,MAAMnH,SAASoH,cAAc,CAAC/G,OAAOqD,WAAWgD,0BAAAA,2BAAAA,gBAAiB;YACvF,IAAI,CAACS,eAAe;gBAClB,OAAOvG,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oBAC1BE,OAAO;oBACP4B,mBAAmB;gBACrB;YACF;YAEA,oBAAoB;YACpB,MAAMuC,YAAY,MAAM9F,SAAS+H,eAAe,CAAC1H,OAAO6F;YACxD,IAAI,CAACJ,aAAaA,UAAUpC,SAAS,KAAKA,WAAW;gBACnD,OAAO9C,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oBAC1BE,OAAO;oBACP4B,mBAAmB;gBACrB;YACF;YAEA,uCAAuC;YACvC,IAAIyE,0BAA0BlC,UAAUC,cAAc;YACtD,IAAID,UAAUC,cAAc,CAACI,YAAY,EAAE;gBACzC,IAAI;wBAKU1F;oBAJZ,+DAA+D;oBAC/D,MAAMwH,WAAW,IAAIlI,iBAAiB;wBACpCgF,UAAUtE,aAAasE,QAAQ;wBAC/B,GAAItE,aAAa+E,YAAY,IAAI;4BAAEA,cAAc/E,aAAa+E,YAAY;wBAAC,CAAC;wBAC5EX,QAAQ,GAAEpE,yBAAAA,aAAaoE,QAAQ,cAArBpE,oCAAAA,yBAAyB;wBACnCmD,OAAOkC,UAAUlC,KAAK;wBACtBsE,gBAAgB,GAAG3H,QAAQ,aAAa,CAAC;wBACzC4H,QAAQ;4BACNC,MAAMC,QAAQC,GAAG;4BACjB3G,OAAO0G,QAAQ1G,KAAK;4BACpB4G,MAAMF,QAAQE,IAAI;4BAClBC,OAAO,KAAO;wBAChB;oBACF;oBAEA,qCAAqC;oBACrCR,0BAA0B,MAAMC,SAASQ,kBAAkB,CAAC3C,UAAUC,cAAc,CAACI,YAAY;gBACnG,EAAE,OAAOxE,OAAO;oBACd,4EAA4E;oBAC5E0G,QAAQE,IAAI,CAAC,yDAAyD5G,iBAAiB6B,QAAQ7B,MAAME,OAAO,GAAG6G,OAAO/G;gBACxH;YACF;YAEA,gCAAgC;YAChC,MAAMgH,iBAAiB9I;YACvB,MAAM+I,eAA4B;gBAChC,GAAG9C,SAAS;gBACZG,cAAc0C;gBACdpE,YAAYC,KAAKC,GAAG;YACtB;YAEA,MAAMzE,SAAS4H,cAAc,CAACvH,OAAOsI,gBAAgBC;YAErD,kEAAkE;YAClE,MAAM5I,SAAS8H,iBAAiB,CAACzH,OAAOsI,gBAAgBX;YAExD,OAAOpH,IAAIa,IAAI,CAAC;gBACdwE,cAAc2C,aAAa3C,YAAY;gBACvC0B,YAAYiB,aAAajB,UAAU;gBACnCtB,YAAYuC,aAAavC,UAAU;gBACnCzC,OAAOgF,aAAahF,KAAK;YAC3B;QACF;QACA,OAAOhD,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;YAC1BE,OAAO;YACP4B,mBAAmB;QACrB;IACF;IAEA;;;GAGC,GACDpD,OAAO+C,IAAI,CAAC,iBAAiB,OAAOvC,KAAcC;QAChD,MAAM,EAAEiI,KAAK,EAAEC,eAAe,EAAEpF,SAAS,EAAEgD,aAAa,EAAE,GAAG/F,IAAIyC,IAAI;QAErE,IAAI,CAACyF,OAAO;YACV,OAAOjI,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gBAC1BE,OAAO;gBACP4B,mBAAmB;YACrB;QACF;QAEA,0CAA0C;QAC1C,IAAIG,aAAagD,eAAe;YAC9B,MAAMS,gBAAgB,MAAMnH,SAASoH,cAAc,CAAC/G,OAAOqD,WAAWgD;YACtE,IAAI,CAACS,eAAe;gBAClB,OAAOvG,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oBAC1BE,OAAO;oBACP4B,mBAAmB;gBACrB;YACF;QACF;QAEA,mBAAmB;QACnB,IAAIuF,oBAAoB,iBAAiB;YACvC,MAAM9I,SAAS+I,kBAAkB,CAAC1I,OAAOwI;QAC3C,OAAO,IAAIC,oBAAoB,gBAAgB;YAC7C,MAAM9I,SAASgJ,iBAAiB,CAAC3I,OAAOwI;YACxC,MAAM7I,SAASiJ,oBAAoB,CAAC5I,OAAOwI;QAC7C,OAAO;YACL,qBAAqB;YACrB,MAAM7I,SAAS+I,kBAAkB,CAAC1I,OAAOwI;YACzC,MAAM7I,SAASgJ,iBAAiB,CAAC3I,OAAOwI;YACxC,MAAM7I,SAASiJ,oBAAoB,CAAC5I,OAAOwI;QAC7C;QAEA,+CAA+C;QAC/C,OAAOjI,IAAIW,MAAM,CAAC,KAAK2H,IAAI;IAC7B;IAEA;;;;;;GAMC,GACD/I,OAAO8B,GAAG,CAAC,iBAAiB,OAAOtB,KAAcC;QAC/C,iDAAiD;QACjD,MAAME,aAAaH,IAAII,OAAO,CAACC,aAAa;QAE5C,IAAI,CAACF,cAAc,CAACA,WAAWQ,UAAU,CAAC,YAAY;YACpD,OAAOV,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gBAC1BE,OAAO;gBACP4B,mBAAmB;YACrB;QACF;QAEA,MAAMsF,QAAQ/H,WAAW8F,SAAS,CAAC,IAAI,0BAA0B;QAEjE,+CAA+C;QAC/C,MAAMd,YAAY,MAAM9F,SAASmJ,cAAc,CAAC9I,OAAOwI;QAEvD,IAAI,CAAC/C,WAAW;YACd,OAAOlF,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gBAC1BE,OAAO;gBACP4B,mBAAmB;YACrB;QACF;QAEA,4BAA4B;QAC5B,MAAMkB,MAAMD,KAAKC,GAAG;QACpB,MAAM2B,YAAYN,UAAUvB,UAAU,GAAGuB,UAAUO,UAAU,GAAG;QAEhE,IAAI5B,MAAM2B,WAAW;YACnB,uBAAuB;YACvB,MAAMpG,SAASgJ,iBAAiB,CAAC3I,OAAOwI;YACxC,MAAM7I,SAASiJ,oBAAoB,CAAC5I,OAAOwI;YAC3C,OAAOjI,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gBAC1BE,OAAO;gBACP4B,mBAAmB;YACrB;QACF;QAEA,yDAAyD;QACzD,MAAM6F,WAAW;YACfP;YACA9D,UAAUe,UAAUpC,SAAS;YAC7B2F,QAAQvD,UAAUlC,KAAK,GAAGkC,UAAUlC,KAAK,CAACqD,KAAK,CAAC,OAAO,EAAE;YACzDb;YACAL,gBAAgBD,UAAUC,cAAc;QAC1C;QAEA,OAAOnF,IAAIa,IAAI,CAAC2H;IAClB;IAEA;;GAEC,GACDjJ,OAAO8B,GAAG,CAAC,kBAAkB,OAAOC,MAAetB;QACjD,MAAM0I,UAAU,MAAMtJ,SAASuJ,WAAW,CAAClJ;QAC3CO,IAAIa,IAAI,CAAC6H;IACX;IAEA,OAAOnJ;AACT"}
1	+ {"version":3,"sources":["/Users/kevin/Dev/Projects/mcp-z/oauth-microsoft/src/lib/dcr-router.ts"],"sourcesContent":["/*\n DCR Router - OAuth 2.0 Authorization Server\n \n Implements OAuth 2.0 Dynamic Client Registration Protocol (RFC 7591)\n * and OAuth 2.0 Authorization Server endpoints (RFC 6749, RFC 8414, RFC 9728).\n \n Endpoints:\n * - GET /.well-known/oauth-authorization-server (RFC 8414 metadata)\n * - GET /.well-known/oauth-protected-resource (RFC 9728 metadata - root)\n * - GET /.well-known/oauth-protected-resource/mcp (RFC 9728 metadata - sub-path)\n * - POST /oauth/register (RFC 7591 client registration)\n * - GET /oauth/authorize (RFC 6749 authorization endpoint)\n * - POST /oauth/token (RFC 6749 token endpoint)\n * - POST /oauth/revoke (RFC 7009 token revocation)\n * - GET /oauth/verify (token verification for Resource Server)\n /\n\nimport type { ProviderTokens, RFC8414Metadata, RFC9728Metadata } from '@mcp-z/oauth';\nimport { createHash, randomUUID } from 'crypto';\nimport type { Request, Response } from 'express';\nimport express from 'express';\nimport type { Keyv } from 'keyv';\nimport { DcrOAuthProvider } from '../providers/dcr.ts';\nimport type { AccessToken, AuthorizationCode, OAuthClientConfig } from '../types.ts';\nimport as dcrUtils from './dcr-utils.ts';\n\n/*\n Configuration for DCR Router (self-hosted mode only)\n /\nexport interface DcrRouterConfig {\n /* Single Keyv store for all DCR data /\n store: Keyv;\n\n /* Authorization Server issuer URL /\n issuerUrl: string;\n\n /* Base URL for OAuth endpoints /\n baseUrl: string;\n\n /* Supported OAuth scopes /\n scopesSupported: string[];\n\n /* OAuth client configuration for upstream provider /\n clientConfig: OAuthClientConfig;\n}\n\n/\n Create DCR Router with OAuth 2.0 endpoints (self-hosted mode)\n \n For external mode (Auth0/Stitch), don't call this function - no router needed.\n * The server code should check DcrConfig.mode and only call this for 'self-hosted'.\n \n @param config - Router configuration\n * @returns Express router with OAuth endpoints\n /\nexport function createDcrRouter(config: DcrRouterConfig): express.Router {\n const router = express.Router();\n const { store, issuerUrl, baseUrl, scopesSupported, clientConfig } = config;\n\n router.use('/mcp', (req: Request, res: Response, next) => {\n const authHeader = req.headers.authorization \|\| req.headers.Authorization;\n const headerValue = Array.isArray(authHeader) ? authHeader[0] : authHeader;\n\n if (!headerValue \|\| !headerValue.toLowerCase().startsWith('bearer ')) {\n return res\n .status(401)\n .set('WWW-Authenticate', `Bearer resource_metadata=\"${baseUrl}/.well-known/oauth-protected-resource\"`)\n .json({\n jsonrpc: '2.0',\n error: {\n code: -32600,\n message: 'Missing Authorization header. DCR mode requires bearer token.',\n },\n id: null,\n });\n }\n\n return next();\n });\n\n // Apply required middleware for OAuth 2.0 endpoints (RFC 6749)\n router.use(express.json()); // For /oauth/register (application/json)\n router.use(express.urlencoded({ extended: true })); // For /oauth/token (application/x-www-form-urlencoded)\n\n /\n OAuth Authorization Server Metadata (RFC 8414)\n * GET /.well-known/oauth-authorization-server\n /\n router.get('/.well-known/oauth-authorization-server', (_req: Request, res: Response) => {\n const metadata: RFC8414Metadata = {\n issuer: issuerUrl,\n authorization_endpoint: `${baseUrl}/oauth/authorize`,\n token_endpoint: `${baseUrl}/oauth/token`,\n registration_endpoint: `${baseUrl}/oauth/register`,\n revocation_endpoint: `${baseUrl}/oauth/revoke`,\n scopes_supported: scopesSupported,\n response_types_supported: ['code'],\n grant_types_supported: ['authorization_code', 'refresh_token'],\n token_endpoint_auth_methods_supported: ['client_secret_basic', 'client_secret_post'],\n code_challenge_methods_supported: ['S256', 'plain'],\n service_documentation: `${baseUrl}/docs`,\n };\n res.json(metadata);\n });\n\n /\n OAuth Protected Resource Metadata (RFC 9728 - Root)\n * GET /.well-known/oauth-protected-resource\n /\n router.get('/.well-known/oauth-protected-resource', (_req: Request, res: Response) => {\n const metadata: RFC9728Metadata = {\n resource: baseUrl,\n authorization_servers: [baseUrl],\n scopes_supported: scopesSupported,\n bearer_methods_supported: ['header'],\n };\n res.json(metadata);\n });\n\n /\n OAuth Protected Resource Metadata (RFC 9728 - Sub-path /mcp)\n * GET /.well-known/oauth-protected-resource/mcp\n /\n router.get('/.well-known/oauth-protected-resource/mcp', (_req: Request, res: Response) => {\n const metadata: RFC9728Metadata = {\n resource: `${baseUrl}/mcp`,\n authorization_servers: [baseUrl],\n scopes_supported: scopesSupported,\n bearer_methods_supported: ['header'],\n };\n res.json(metadata);\n });\n\n /\n Dynamic Client Registration (RFC 7591)\n * POST /oauth/register\n /\n router.post('/oauth/register', async (req: Request, res: Response) => {\n try {\n const registrationRequest = req.body;\n\n // Register the client\n const client = await dcrUtils.registerClient(store, registrationRequest);\n\n // Return client information (RFC 7591 Section 3.2.1)\n res.status(201).json(client);\n } catch (error) {\n res.status(400).json({\n error: 'invalid_client_metadata',\n error_description: error instanceof Error ? error.message : 'Invalid registration request',\n });\n }\n });\n\n /\n OAuth Authorization Endpoint (RFC 6749 Section 3.1)\n * GET /oauth/authorize\n \n Initiates Microsoft OAuth flow, then generates DCR authorization code\n /\n router.get('/oauth/authorize', async (req: Request, res: Response) => {\n const { response_type, client_id, redirect_uri, scope = '', state = '', code_challenge, code_challenge_method } = req.query;\n\n // Validate required parameters\n if (response_type !== 'code') {\n return res.status(400).json({\n error: 'unsupported_response_type',\n error_description: 'Only response_type=code is supported',\n });\n }\n\n if (!client_id \|\| typeof client_id !== 'string') {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'client_id is required',\n });\n }\n\n if (!redirect_uri \|\| typeof redirect_uri !== 'string') {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'redirect_uri is required',\n });\n }\n\n // Validate client\n const client = await dcrUtils.getClient(store, client_id);\n if (!client) {\n return res.status(400).json({\n error: 'invalid_client',\n error_description: 'Unknown client_id',\n });\n }\n\n // Validate redirect_uri\n const isValidRedirect = await dcrUtils.validateRedirectUri(store, client_id, redirect_uri);\n if (!isValidRedirect) {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'Invalid redirect_uri',\n });\n }\n\n // Use client-provided scope or fall back to server's supported scopes\n const effectiveScope = typeof scope === 'string' && scope.trim() !== '' ? scope : scopesSupported.join(' ');\n\n // Store DCR request state for Microsoft OAuth callback\n const msState = randomUUID();\n const dcrRequestState = {\n client_id,\n redirect_uri,\n scope: effectiveScope,\n state: typeof state === 'string' ? state : undefined,\n code_challenge: typeof code_challenge === 'string' ? code_challenge : undefined,\n code_challenge_method: typeof code_challenge_method === 'string' ? code_challenge_method : undefined,\n created_at: Date.now(),\n expires_at: Date.now() + 600000, // 10 minutes\n };\n\n await store.set(`dcr:ms-state:${msState}`, dcrRequestState, 600000); // 10 min TTL\n\n // Build Microsoft authorization URL\n const msAuthUrl = new URL(`https://login.microsoftonline.com/${clientConfig.tenantId \|\| 'common'}/oauth2/v2.0/authorize`);\n msAuthUrl.searchParams.set('client_id', clientConfig.clientId);\n msAuthUrl.searchParams.set('response_type', 'code');\n msAuthUrl.searchParams.set('redirect_uri', `${baseUrl}/oauth/callback`);\n msAuthUrl.searchParams.set('scope', effectiveScope);\n msAuthUrl.searchParams.set('state', msState);\n msAuthUrl.searchParams.set('response_mode', 'query');\n\n // Redirect user to Microsoft for authorization\n return res.redirect(msAuthUrl.toString());\n });\n\n /\n OAuth Callback Handler\n * GET /oauth/callback\n \n Handles callback from Microsoft after user authorization\n /\n router.get('/oauth/callback', async (req: Request, res: Response) => {\n const { code: msCode, state: msState, error, error_description } = req.query;\n\n // Handle Microsoft OAuth errors\n if (error) {\n return res.status(400).json({\n error,\n error_description: error_description \|\| 'Microsoft OAuth authorization failed',\n });\n }\n\n if (!msCode \|\| typeof msCode !== 'string') {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'Authorization code is required',\n });\n }\n\n if (!msState \|\| typeof msState !== 'string') {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'State parameter is required',\n });\n }\n\n // Retrieve original DCR request state\n const dcrRequestState = await store.get(`dcr:ms-state:${msState}`);\n if (!dcrRequestState) {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'Invalid or expired state parameter',\n });\n }\n\n // Delete state (one-time use)\n await store.delete(`dcr:ms-state:${msState}`);\n\n // Exchange Microsoft authorization code for tokens\n try {\n const tokenUrl = `https://login.microsoftonline.com/${clientConfig.tenantId \|\| 'common'}/oauth2/v2.0/token`;\n const tokenParams = new URLSearchParams({\n grant_type: 'authorization_code',\n code: msCode,\n client_id: clientConfig.clientId,\n redirect_uri: `${baseUrl}/oauth/callback`,\n scope: dcrRequestState.scope,\n });\n\n // Add client_secret if available (confidential client)\n if (clientConfig.clientSecret) {\n tokenParams.set('client_secret', clientConfig.clientSecret);\n }\n\n const tokenResponse = await fetch(tokenUrl, {\n method: 'POST',\n headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n body: tokenParams.toString(),\n });\n\n if (!tokenResponse.ok) {\n const errorData = (await tokenResponse.json()) as { error?: string; error_description?: string };\n throw new Error(`Microsoft token exchange failed: ${errorData.error_description \|\| errorData.error}`);\n }\n\n const tokenData = (await tokenResponse.json()) as {\n access_token: string;\n refresh_token?: string;\n expires_in: number;\n scope: string;\n };\n\n // Create provider tokens from Microsoft response\n const providerTokens: ProviderTokens = {\n accessToken: tokenData.access_token,\n ...(tokenData.refresh_token && { refreshToken: tokenData.refresh_token }),\n expiresAt: Date.now() + tokenData.expires_in 1000,\n scope: tokenData.scope,\n };\n\n // Generate DCR authorization code with real provider tokens\n const dcrCode = randomUUID();\n const authCode: AuthorizationCode = {\n code: dcrCode,\n client_id: dcrRequestState.client_id,\n redirect_uri: dcrRequestState.redirect_uri,\n scope: dcrRequestState.scope,\n ...(dcrRequestState.code_challenge && { code_challenge: dcrRequestState.code_challenge }),\n ...(dcrRequestState.code_challenge_method && { code_challenge_method: dcrRequestState.code_challenge_method }),\n providerTokens,\n created_at: Date.now(),\n expires_at: Date.now() + 600000, // 10 minutes\n };\n\n await dcrUtils.setAuthCode(store, dcrCode, authCode);\n\n // Redirect back to MCP client with DCR authorization code\n const clientRedirectUrl = new URL(dcrRequestState.redirect_uri);\n clientRedirectUrl.searchParams.set('code', dcrCode);\n if (dcrRequestState.state) {\n clientRedirectUrl.searchParams.set('state', dcrRequestState.state);\n }\n\n return res.redirect(clientRedirectUrl.toString());\n } catch (error) {\n return res.status(500).json({\n error: 'server_error',\n error_description: error instanceof Error ? error.message : 'Failed to exchange authorization code',\n });\n }\n });\n\n /*\n OAuth Token Endpoint (RFC 6749 Section 3.2)\n * POST /oauth/token\n /\n router.post('/oauth/token', async (req: Request, res: Response) => {\n // Extract client credentials from either body or Basic Auth header\n let client_id = req.body.client_id;\n let client_secret = req.body.client_secret;\n\n // Support client_secret_basic authentication (RFC 6749 Section 2.3.1)\n const authHeader = req.headers.authorization;\n if (authHeader && authHeader.startsWith('Basic ')) {\n const base64Credentials = authHeader.substring(6);\n const credentials = Buffer.from(base64Credentials, 'base64').toString('utf-8');\n const [id, secret] = credentials.split(':');\n client_id = id;\n client_secret = secret;\n }\n\n const { grant_type, code, redirect_uri, refresh_token, code_verifier } = req.body;\n\n // Validate grant_type\n if (!grant_type) {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'grant_type is required',\n });\n }\n\n if (grant_type === 'authorization_code') {\n // Authorization Code Grant\n if (!code \|\| !client_id \|\| !redirect_uri) {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'code, client_id, and redirect_uri are required',\n });\n }\n\n // Validate client credentials\n const isValidClient = await dcrUtils.validateClient(store, client_id, client_secret ?? '');\n if (!isValidClient) {\n return res.status(401).json({\n error: 'invalid_client',\n error_description: 'Invalid client credentials',\n });\n }\n\n // Get authorization code\n const authCode = await dcrUtils.getAuthCode(store, code);\n if (!authCode) {\n return res.status(400).json({\n error: 'invalid_grant',\n error_description: 'Invalid or expired authorization code',\n });\n }\n\n // Validate authorization code\n if (authCode.client_id !== client_id \|\| authCode.redirect_uri !== redirect_uri) {\n return res.status(400).json({\n error: 'invalid_grant',\n error_description: 'Authorization code mismatch',\n });\n }\n\n if (Date.now() > authCode.expires_at) {\n await dcrUtils.deleteAuthCode(store, code);\n return res.status(400).json({\n error: 'invalid_grant',\n error_description: 'Authorization code expired',\n });\n }\n\n // Validate PKCE if used\n if (authCode.code_challenge) {\n if (!code_verifier) {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'code_verifier is required for PKCE',\n });\n }\n\n // Validate code_verifier against code_challenge\n const method = authCode.code_challenge_method ?? 'plain';\n const computedChallenge = method === 'S256' ? createHash('sha256').update(code_verifier).digest('base64url') : code_verifier;\n\n if (computedChallenge !== authCode.code_challenge) {\n return res.status(400).json({\n error: 'invalid_grant',\n error_description: 'Invalid code_verifier',\n });\n }\n }\n\n // Delete authorization code (one-time use)\n await dcrUtils.deleteAuthCode(store, code);\n\n // Generate DCR access token\n const accessToken = randomUUID();\n const refreshTokenValue = randomUUID();\n\n const tokenData: AccessToken = {\n access_token: accessToken,\n token_type: 'Bearer',\n expires_in: 3600,\n refresh_token: refreshTokenValue,\n scope: authCode.scope,\n client_id,\n providerTokens: authCode.providerTokens,\n created_at: Date.now(),\n };\n\n await dcrUtils.setAccessToken(store, accessToken, tokenData);\n await dcrUtils.setRefreshToken(store, refreshTokenValue, tokenData);\n\n // Store provider tokens indexed by DCR access token\n await dcrUtils.setProviderTokens(store, accessToken, authCode.providerTokens);\n\n // Return token response\n return res.json({\n access_token: tokenData.access_token,\n token_type: tokenData.token_type,\n expires_in: tokenData.expires_in,\n refresh_token: tokenData.refresh_token,\n scope: tokenData.scope,\n });\n }\n if (grant_type === 'refresh_token') {\n // Refresh Token Grant\n if (!refresh_token \|\| !client_id) {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'refresh_token and client_id are required',\n });\n }\n\n // Validate client credentials\n const isValidClient = await dcrUtils.validateClient(store, client_id, client_secret ?? '');\n if (!isValidClient) {\n return res.status(401).json({\n error: 'invalid_client',\n error_description: 'Invalid client credentials',\n });\n }\n\n // Get refresh token\n const tokenData = await dcrUtils.getRefreshToken(store, refresh_token);\n if (!tokenData \|\| tokenData.client_id !== client_id) {\n return res.status(400).json({\n error: 'invalid_grant',\n error_description: 'Invalid refresh token',\n });\n }\n\n // Refresh provider tokens if available\n let refreshedProviderTokens = tokenData.providerTokens;\n if (tokenData.providerTokens.refreshToken) {\n try {\n // Create DcrOAuthProvider instance to refresh Microsoft tokens\n const provider = new DcrOAuthProvider({\n clientId: clientConfig.clientId,\n ...(clientConfig.clientSecret && { clientSecret: clientConfig.clientSecret }),\n tenantId: clientConfig.tenantId ?? 'common',\n scope: tokenData.scope,\n verifyEndpoint: `${baseUrl}/oauth/verify`,\n logger: {\n info: console.log,\n error: console.error,\n warn: console.warn,\n debug: () => {},\n },\n });\n\n // Refresh the Microsoft access token\n refreshedProviderTokens = await provider.refreshAccessToken(tokenData.providerTokens.refreshToken);\n } catch (error) {\n // If refresh fails, continue with existing tokens (they may still be valid)\n console.warn('Provider token refresh failed, using existing tokens:', error instanceof Error ? error.message : String(error));\n }\n }\n\n // Generate new DCR access token\n const newAccessToken = randomUUID();\n const newTokenData: AccessToken = {\n ...tokenData,\n access_token: newAccessToken,\n created_at: Date.now(),\n };\n\n await dcrUtils.setAccessToken(store, newAccessToken, newTokenData);\n\n // Store refreshed provider tokens indexed by new DCR access token\n await dcrUtils.setProviderTokens(store, newAccessToken, refreshedProviderTokens);\n\n return res.json({\n access_token: newTokenData.access_token,\n token_type: newTokenData.token_type,\n expires_in: newTokenData.expires_in,\n scope: newTokenData.scope,\n });\n }\n return res.status(400).json({\n error: 'unsupported_grant_type',\n error_description: 'Only authorization_code and refresh_token grants are supported',\n });\n });\n\n /\n OAuth Token Revocation (RFC 7009)\n * POST /oauth/revoke\n /\n router.post('/oauth/revoke', async (req: Request, res: Response) => {\n const { token, token_type_hint, client_id, client_secret } = req.body;\n\n if (!token) {\n return res.status(400).json({\n error: 'invalid_request',\n error_description: 'token is required',\n });\n }\n\n // Validate client if credentials provided\n if (client_id && client_secret) {\n const isValidClient = await dcrUtils.validateClient(store, client_id, client_secret);\n if (!isValidClient) {\n return res.status(401).json({\n error: 'invalid_client',\n error_description: 'Invalid client credentials',\n });\n }\n }\n\n // Revoke the token\n if (token_type_hint === 'refresh_token') {\n await dcrUtils.deleteRefreshToken(store, token);\n } else if (token_type_hint === 'access_token') {\n await dcrUtils.deleteAccessToken(store, token);\n await dcrUtils.deleteProviderTokens(store, token);\n } else {\n // No hint - try both\n await dcrUtils.deleteRefreshToken(store, token);\n await dcrUtils.deleteAccessToken(store, token);\n await dcrUtils.deleteProviderTokens(store, token);\n }\n\n // RFC 7009: Return 200 even if token not found\n return res.status(200).send();\n });\n\n /\n Token Verification Endpoint\n * GET /oauth/verify\n \n Validates bearer tokens for Resource Server.\n * Returns AuthInfo with provider tokens for stateless DCR pattern.\n /\n router.get('/oauth/verify', async (req: Request, res: Response) => {\n // Extract bearer token from Authorization header\n const authHeader = req.headers.authorization;\n\n if (!authHeader \|\| !authHeader.startsWith('Bearer ')) {\n return res.status(401).json({\n error: 'invalid_request',\n error_description: 'Missing or invalid Authorization header',\n });\n }\n\n const token = authHeader.substring(7); // Remove 'Bearer ' prefix\n\n // Validate token exists in access tokens store\n const tokenData = await dcrUtils.getAccessToken(store, token);\n\n if (!tokenData) {\n return res.status(401).json({\n error: 'invalid_token',\n error_description: 'Unknown or expired access token',\n });\n }\n\n // Check if token is expired\n const now = Date.now();\n const expiresAt = tokenData.created_at + tokenData.expires_in 1000;\n\n if (now > expiresAt) {\n // Remove expired token\n await dcrUtils.deleteAccessToken(store, token);\n await dcrUtils.deleteProviderTokens(store, token);\n return res.status(401).json({\n error: 'invalid_token',\n error_description: 'Access token has expired',\n });\n }\n\n // Return AuthInfo with provider tokens for stateless DCR\n const authInfo = {\n token,\n clientId: tokenData.client_id,\n scopes: tokenData.scope ? tokenData.scope.split(' ') : [],\n expiresAt,\n providerTokens: tokenData.providerTokens,\n };\n\n return res.json(authInfo);\n });\n\n /*\n Debug endpoint to list registered clients (development only)\n */\n router.get('/debug/clients', async (_req: Request, res: Response) => {\n const clients = await dcrUtils.listClients(store);\n res.json(clients);\n });\n\n return router;\n}\n"],"names":["createHash","randomUUID","express","DcrOAuthProvider","dcrUtils","createDcrRouter","config","router","Router","store","issuerUrl","baseUrl","scopesSupported","clientConfig","use","req","res","next","authHeader","headers","authorization","Authorization","headerValue","Array","isArray","toLowerCase","startsWith","status","set","json","jsonrpc","error","code","message","id","urlencoded","extended","get","_req","metadata","issuer","authorization_endpoint","token_endpoint","registration_endpoint","revocation_endpoint","scopes_supported","response_types_supported","grant_types_supported","token_endpoint_auth_methods_supported","code_challenge_methods_supported","service_documentation","resource","authorization_servers","bearer_methods_supported","post","registrationRequest","body","client","registerClient","error_description","Error","response_type","client_id","redirect_uri","scope","state","code_challenge","code_challenge_method","query","getClient","isValidRedirect","validateRedirectUri","effectiveScope","trim","join","msState","dcrRequestState","undefined","created_at","Date","now","expires_at","msAuthUrl","URL","tenantId","searchParams","clientId","redirect","toString","msCode","delete","tokenUrl","tokenParams","URLSearchParams","grant_type","clientSecret","tokenResponse","fetch","method","ok","errorData","tokenData","providerTokens","accessToken","access_token","refresh_token","refreshToken","expiresAt","expires_in","dcrCode","authCode","setAuthCode","clientRedirectUrl","client_secret","base64Credentials","substring","credentials","Buffer","from","secret","split","code_verifier","isValidClient","validateClient","getAuthCode","deleteAuthCode","computedChallenge","update","digest","refreshTokenValue","token_type","setAccessToken","setRefreshToken","setProviderTokens","getRefreshToken","refreshedProviderTokens","provider","verifyEndpoint","logger","info","console","log","warn","debug","refreshAccessToken","String","newAccessToken","newTokenData","token","token_type_hint","deleteRefreshToken","deleteAccessToken","deleteProviderTokens","send","getAccessToken","authInfo","scopes","clients","listClients"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAGD,SAASA,UAAU,EAAEC,UAAU,QAAQ,SAAS;AAEhD,OAAOC,aAAa,UAAU;AAE9B,SAASC,gBAAgB,QAAQ,sBAAsB;AAEvD,YAAYC,cAAc,iBAAiB;AAsB3C;;;;;;;;CAQC,GACD,OAAO,SAASC,gBAAgBC,MAAuB;IACrD,MAAMC,SAASL,QAAQM,MAAM;IAC7B,MAAM,EAAEC,KAAK,EAAEC,SAAS,EAAEC,OAAO,EAAEC,eAAe,EAAEC,YAAY,EAAE,GAAGP;IAErEC,OAAOO,GAAG,CAAC,QAAQ,CAACC,KAAcC,KAAeC;QAC/C,MAAMC,aAAaH,IAAII,OAAO,CAACC,aAAa,IAAIL,IAAII,OAAO,CAACE,aAAa;QACzE,MAAMC,cAAcC,MAAMC,OAAO,CAACN,cAAcA,UAAU,CAAC,EAAE,GAAGA;QAEhE,IAAI,CAACI,eAAe,CAACA,YAAYG,WAAW,GAAGC,UAAU,CAAC,YAAY;YACpE,OAAOV,IACJW,MAAM,CAAC,KACPC,GAAG,CAAC,oBAAoB,CAAC,0BAA0B,EAAEjB,QAAQ,sCAAsC,CAAC,EACpGkB,IAAI,CAAC;gBACJC,SAAS;gBACTC,OAAO;oBACLC,MAAM,CAAC;oBACPC,SAAS;gBACX;gBACAC,IAAI;YACN;QACJ;QAEA,OAAOjB;IACT;IAEA,+DAA+D;IAC/DV,OAAOO,GAAG,CAACZ,QAAQ2B,IAAI,KAAK,yCAAyC;IACrEtB,OAAOO,GAAG,CAACZ,QAAQiC,UAAU,CAAC;QAAEC,UAAU;IAAK,KAAK,uDAAuD;IAE3G;;;GAGC,GACD7B,OAAO8B,GAAG,CAAC,2CAA2C,CAACC,MAAetB;QACpE,MAAMuB,WAA4B;YAChCC,QAAQ9B;YACR+B,wBAAwB,GAAG9B,QAAQ,gBAAgB,CAAC;YACpD+B,gBAAgB,GAAG/B,QAAQ,YAAY,CAAC;YACxCgC,uBAAuB,GAAGhC,QAAQ,eAAe,CAAC;YAClDiC,qBAAqB,GAAGjC,QAAQ,aAAa,CAAC;YAC9CkC,kBAAkBjC;YAClBkC,0BAA0B;gBAAC;aAAO;YAClCC,uBAAuB;gBAAC;gBAAsB;aAAgB;YAC9DC,uCAAuC;gBAAC;gBAAuB;aAAqB;YACpFC,kCAAkC;gBAAC;gBAAQ;aAAQ;YACnDC,uBAAuB,GAAGvC,QAAQ,KAAK,CAAC;QAC1C;QACAK,IAAIa,IAAI,CAACU;IACX;IAEA;;;GAGC,GACDhC,OAAO8B,GAAG,CAAC,yCAAyC,CAACC,MAAetB;QAClE,MAAMuB,WAA4B;YAChCY,UAAUxC;YACVyC,uBAAuB;gBAACzC;aAAQ;YAChCkC,kBAAkBjC;YAClByC,0BAA0B;gBAAC;aAAS;QACtC;QACArC,IAAIa,IAAI,CAACU;IACX;IAEA;;;GAGC,GACDhC,OAAO8B,GAAG,CAAC,6CAA6C,CAACC,MAAetB;QACtE,MAAMuB,WAA4B;YAChCY,UAAU,GAAGxC,QAAQ,IAAI,CAAC;YAC1ByC,uBAAuB;gBAACzC;aAAQ;YAChCkC,kBAAkBjC;YAClByC,0BAA0B;gBAAC;aAAS;QACtC;QACArC,IAAIa,IAAI,CAACU;IACX;IAEA;;;GAGC,GACDhC,OAAO+C,IAAI,CAAC,mBAAmB,OAAOvC,KAAcC;QAClD,IAAI;YACF,MAAMuC,sBAAsBxC,IAAIyC,IAAI;YAEpC,sBAAsB;YACtB,MAAMC,SAAS,MAAMrD,SAASsD,cAAc,CAACjD,OAAO8C;YAEpD,qDAAqD;YACrDvC,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC4B;QACvB,EAAE,OAAO1B,OAAO;YACdf,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gBACnBE,OAAO;gBACP4B,mBAAmB5B,iBAAiB6B,QAAQ7B,MAAME,OAAO,GAAG;YAC9D;QACF;IACF;IAEA;;;;;GAKC,GACD1B,OAAO8B,GAAG,CAAC,oBAAoB,OAAOtB,KAAcC;QAClD,MAAM,EAAE6C,aAAa,EAAEC,SAAS,EAAEC,YAAY,EAAEC,QAAQ,EAAE,EAAEC,QAAQ,EAAE,EAAEC,cAAc,EAAEC,qBAAqB,EAAE,GAAGpD,IAAIqD,KAAK;QAE3H,+BAA+B;QAC/B,IAAIP,kBAAkB,QAAQ;YAC5B,OAAO7C,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gBAC1BE,OAAO;gBACP4B,mBAAmB;YACrB;QACF;QAEA,IAAI,CAACG,aAAa,OAAOA,cAAc,UAAU;YAC/C,OAAO9C,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gBAC1BE,OAAO;gBACP4B,mBAAmB;YACrB;QACF;QAEA,IAAI,CAACI,gBAAgB,OAAOA,iBAAiB,UAAU;YACrD,OAAO/C,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gBAC1BE,OAAO;gBACP4B,mBAAmB;YACrB;QACF;QAEA,kBAAkB;QAClB,MAAMF,SAAS,MAAMrD,SAASiE,SAAS,CAAC5D,OAAOqD;QAC/C,IAAI,CAACL,QAAQ;YACX,OAAOzC,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gBAC1BE,OAAO;gBACP4B,mBAAmB;YACrB;QACF;QAEA,wBAAwB;QACxB,MAAMW,kBAAkB,MAAMlE,SAASmE,mBAAmB,CAAC9D,OAAOqD,WAAWC;QAC7E,IAAI,CAACO,iBAAiB;YACpB,OAAOtD,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gBAC1BE,OAAO;gBACP4B,mBAAmB;YACrB;QACF;QAEA,sEAAsE;QACtE,MAAMa,iBAAiB,OAAOR,UAAU,YAAYA,MAAMS,IAAI,OAAO,KAAKT,QAAQpD,gBAAgB8D,IAAI,CAAC;QAEvG,uDAAuD;QACvD,MAAMC,UAAU1E;QAChB,MAAM2E,kBAAkB;YACtBd;YACAC;YACAC,OAAOQ;YACPP,OAAO,OAAOA,UAAU,WAAWA,QAAQY;YAC3CX,gBAAgB,OAAOA,mBAAmB,WAAWA,iBAAiBW;YACtEV,uBAAuB,OAAOA,0BAA0B,WAAWA,wBAAwBU;YAC3FC,YAAYC,KAAKC,GAAG;YACpBC,YAAYF,KAAKC,GAAG,KAAK;QAC3B;QAEA,MAAMvE,MAAMmB,GAAG,CAAC,CAAC,aAAa,EAAE+C,SAAS,EAAEC,iBAAiB,SAAS,aAAa;QAElF,oCAAoC;QACpC,MAAMM,YAAY,IAAIC,IAAI,CAAC,kCAAkC,EAAEtE,aAAauE,QAAQ,IAAI,SAAS,sBAAsB,CAAC;QACxHF,UAAUG,YAAY,CAACzD,GAAG,CAAC,aAAaf,aAAayE,QAAQ;QAC7DJ,UAAUG,YAAY,CAACzD,GAAG,CAAC,iBAAiB;QAC5CsD,UAAUG,YAAY,CAACzD,GAAG,CAAC,gBAAgB,GAAGjB,QAAQ,eAAe,CAAC;QACtEuE,UAAUG,YAAY,CAACzD,GAAG,CAAC,SAAS4C;QACpCU,UAAUG,YAAY,CAACzD,GAAG,CAAC,SAAS+C;QACpCO,UAAUG,YAAY,CAACzD,GAAG,CAAC,iBAAiB;QAE5C,+CAA+C;QAC/C,OAAOZ,IAAIuE,QAAQ,CAACL,UAAUM,QAAQ;IACxC;IAEA;;;;;GAKC,GACDjF,OAAO8B,GAAG,CAAC,mBAAmB,OAAOtB,KAAcC;QACjD,MAAM,EAAEgB,MAAMyD,MAAM,EAAExB,OAAOU,OAAO,EAAE5C,KAAK,EAAE4B,iBAAiB,EAAE,GAAG5C,IAAIqD,KAAK;QAE5E,gCAAgC;QAChC,IAAIrC,OAAO;YACT,OAAOf,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gBAC1BE;gBACA4B,mBAAmBA,qBAAqB;YAC1C;QACF;QAEA,IAAI,CAAC8B,UAAU,OAAOA,WAAW,UAAU;YACzC,OAAOzE,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gBAC1BE,OAAO;gBACP4B,mBAAmB;YACrB;QACF;QAEA,IAAI,CAACgB,WAAW,OAAOA,YAAY,UAAU;YAC3C,OAAO3D,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gBAC1BE,OAAO;gBACP4B,mBAAmB;YACrB;QACF;QAEA,sCAAsC;QACtC,MAAMiB,kBAAkB,MAAMnE,MAAM4B,GAAG,CAAC,CAAC,aAAa,EAAEsC,SAAS;QACjE,IAAI,CAACC,iBAAiB;YACpB,OAAO5D,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gBAC1BE,OAAO;gBACP4B,mBAAmB;YACrB;QACF;QAEA,8BAA8B;QAC9B,MAAMlD,MAAMiF,MAAM,CAAC,CAAC,aAAa,EAAEf,SAAS;QAE5C,mDAAmD;QACnD,IAAI;YACF,MAAMgB,WAAW,CAAC,kCAAkC,EAAE9E,aAAauE,QAAQ,IAAI,SAAS,kBAAkB,CAAC;YAC3G,MAAMQ,cAAc,IAAIC,gBAAgB;gBACtCC,YAAY;gBACZ9D,MAAMyD;gBACN3B,WAAWjD,aAAayE,QAAQ;gBAChCvB,cAAc,GAAGpD,QAAQ,eAAe,CAAC;gBACzCqD,OAAOY,gBAAgBZ,KAAK;YAC9B;YAEA,uDAAuD;YACvD,IAAInD,aAAakF,YAAY,EAAE;gBAC7BH,YAAYhE,GAAG,CAAC,iBAAiBf,aAAakF,YAAY;YAC5D;YAEA,MAAMC,gBAAgB,MAAMC,MAAMN,UAAU;gBAC1CO,QAAQ;gBACR/E,SAAS;oBAAE,gBAAgB;gBAAoC;gBAC/DqC,MAAMoC,YAAYJ,QAAQ;YAC5B;YAEA,IAAI,CAACQ,cAAcG,EAAE,EAAE;gBACrB,MAAMC,YAAa,MAAMJ,cAAcnE,IAAI;gBAC3C,MAAM,IAAI+B,MAAM,CAAC,iCAAiC,EAAEwC,UAAUzC,iBAAiB,IAAIyC,UAAUrE,KAAK,EAAE;YACtG;YAEA,MAAMsE,YAAa,MAAML,cAAcnE,IAAI;YAO3C,iDAAiD;YACjD,MAAMyE,iBAAiC;gBACrCC,aAAaF,UAAUG,YAAY;gBACnC,GAAIH,UAAUI,aAAa,IAAI;oBAAEC,cAAcL,UAAUI,aAAa;gBAAC,CAAC;gBACxEE,WAAW5B,KAAKC,GAAG,KAAKqB,UAAUO,UAAU,GAAG;gBAC/C5C,OAAOqC,UAAUrC,KAAK;YACxB;YAEA,4DAA4D;YAC5D,MAAM6C,UAAU5G;YAChB,MAAM6G,WAA8B;gBAClC9E,MAAM6E;gBACN/C,WAAWc,gBAAgBd,SAAS;gBACpCC,cAAca,gBAAgBb,YAAY;gBAC1CC,OAAOY,gBAAgBZ,KAAK;gBAC5B,GAAIY,gBAAgBV,cAAc,IAAI;oBAAEA,gBAAgBU,gBAAgBV,cAAc;gBAAC,CAAC;gBACxF,GAAIU,gBAAgBT,qBAAqB,IAAI;oBAAEA,uBAAuBS,gBAAgBT,qBAAqB;gBAAC,CAAC;gBAC7GmC;gBACAxB,YAAYC,KAAKC,GAAG;gBACpBC,YAAYF,KAAKC,GAAG,KAAK;YAC3B;YAEA,MAAM5E,SAAS2G,WAAW,CAACtG,OAAOoG,SAASC;YAE3C,0DAA0D;YAC1D,MAAME,oBAAoB,IAAI7B,IAAIP,gBAAgBb,YAAY;YAC9DiD,kBAAkB3B,YAAY,CAACzD,GAAG,CAAC,QAAQiF;YAC3C,IAAIjC,gBAAgBX,KAAK,EAAE;gBACzB+C,kBAAkB3B,YAAY,CAACzD,GAAG,CAAC,SAASgD,gBAAgBX,KAAK;YACnE;YAEA,OAAOjD,IAAIuE,QAAQ,CAACyB,kBAAkBxB,QAAQ;QAChD,EAAE,OAAOzD,OAAO;YACd,OAAOf,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gBAC1BE,OAAO;gBACP4B,mBAAmB5B,iBAAiB6B,QAAQ7B,MAAME,OAAO,GAAG;YAC9D;QACF;IACF;IAEA;;;GAGC,GACD1B,OAAO+C,IAAI,CAAC,gBAAgB,OAAOvC,KAAcC;QAC/C,mEAAmE;QACnE,IAAI8C,YAAY/C,IAAIyC,IAAI,CAACM,SAAS;QAClC,IAAImD,gBAAgBlG,IAAIyC,IAAI,CAACyD,aAAa;QAE1C,sEAAsE;QACtE,MAAM/F,aAAaH,IAAII,OAAO,CAACC,aAAa;QAC5C,IAAIF,cAAcA,WAAWQ,UAAU,CAAC,WAAW;YACjD,MAAMwF,oBAAoBhG,WAAWiG,SAAS,CAAC;YAC/C,MAAMC,cAAcC,OAAOC,IAAI,CAACJ,mBAAmB,UAAU1B,QAAQ,CAAC;YACtE,MAAM,CAACtD,IAAIqF,OAAO,GAAGH,YAAYI,KAAK,CAAC;YACvC1D,YAAY5B;YACZ+E,gBAAgBM;QAClB;QAEA,MAAM,EAAEzB,UAAU,EAAE9D,IAAI,EAAE+B,YAAY,EAAE0C,aAAa,EAAEgB,aAAa,EAAE,GAAG1G,IAAIyC,IAAI;QAEjF,sBAAsB;QACtB,IAAI,CAACsC,YAAY;YACf,OAAO9E,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gBAC1BE,OAAO;gBACP4B,mBAAmB;YACrB;QACF;QAEA,IAAImC,eAAe,sBAAsB;YACvC,2BAA2B;YAC3B,IAAI,CAAC9D,QAAQ,CAAC8B,aAAa,CAACC,cAAc;gBACxC,OAAO/C,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oBAC1BE,OAAO;oBACP4B,mBAAmB;gBACrB;YACF;YAEA,8BAA8B;YAC9B,MAAM+D,gBAAgB,MAAMtH,SAASuH,cAAc,CAAClH,OAAOqD,WAAWmD,0BAAAA,2BAAAA,gBAAiB;YACvF,IAAI,CAACS,eAAe;gBAClB,OAAO1G,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oBAC1BE,OAAO;oBACP4B,mBAAmB;gBACrB;YACF;YAEA,yBAAyB;YACzB,MAAMmD,WAAW,MAAM1G,SAASwH,WAAW,CAACnH,OAAOuB;YACnD,IAAI,CAAC8E,UAAU;gBACb,OAAO9F,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oBAC1BE,OAAO;oBACP4B,mBAAmB;gBACrB;YACF;YAEA,8BAA8B;YAC9B,IAAImD,SAAShD,SAAS,KAAKA,aAAagD,SAAS/C,YAAY,KAAKA,cAAc;gBAC9E,OAAO/C,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oBAC1BE,OAAO;oBACP4B,mBAAmB;gBACrB;YACF;YAEA,IAAIoB,KAAKC,GAAG,KAAK8B,SAAS7B,UAAU,EAAE;gBACpC,MAAM7E,SAASyH,cAAc,CAACpH,OAAOuB;gBACrC,OAAOhB,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oBAC1BE,OAAO;oBACP4B,mBAAmB;gBACrB;YACF;YAEA,wBAAwB;YACxB,IAAImD,SAAS5C,cAAc,EAAE;oBASZ4C;gBARf,IAAI,CAACW,eAAe;oBAClB,OAAOzG,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;wBAC1BE,OAAO;wBACP4B,mBAAmB;oBACrB;gBACF;gBAEA,gDAAgD;gBAChD,MAAMuC,UAASY,kCAAAA,SAAS3C,qBAAqB,cAA9B2C,6CAAAA,kCAAkC;gBACjD,MAAMgB,oBAAoB5B,WAAW,SAASlG,WAAW,UAAU+H,MAAM,CAACN,eAAeO,MAAM,CAAC,eAAeP;gBAE/G,IAAIK,sBAAsBhB,SAAS5C,cAAc,EAAE;oBACjD,OAAOlD,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;wBAC1BE,OAAO;wBACP4B,mBAAmB;oBACrB;gBACF;YACF;YAEA,2CAA2C;YAC3C,MAAMvD,SAASyH,cAAc,CAACpH,OAAOuB;YAErC,4BAA4B;YAC5B,MAAMuE,cAActG;YACpB,MAAMgI,oBAAoBhI;YAE1B,MAAMoG,YAAyB;gBAC7BG,cAAcD;gBACd2B,YAAY;gBACZtB,YAAY;gBACZH,eAAewB;gBACfjE,OAAO8C,SAAS9C,KAAK;gBACrBF;gBACAwC,gBAAgBQ,SAASR,cAAc;gBACvCxB,YAAYC,KAAKC,GAAG;YACtB;YAEA,MAAM5E,SAAS+H,cAAc,CAAC1H,OAAO8F,aAAaF;YAClD,MAAMjG,SAASgI,eAAe,CAAC3H,OAAOwH,mBAAmB5B;YAEzD,oDAAoD;YACpD,MAAMjG,SAASiI,iBAAiB,CAAC5H,OAAO8F,aAAaO,SAASR,cAAc;YAE5E,wBAAwB;YACxB,OAAOtF,IAAIa,IAAI,CAAC;gBACd2E,cAAcH,UAAUG,YAAY;gBACpC0B,YAAY7B,UAAU6B,UAAU;gBAChCtB,YAAYP,UAAUO,UAAU;gBAChCH,eAAeJ,UAAUI,aAAa;gBACtCzC,OAAOqC,UAAUrC,KAAK;YACxB;QACF;QACA,IAAI8B,eAAe,iBAAiB;YAClC,sBAAsB;YACtB,IAAI,CAACW,iBAAiB,CAAC3C,WAAW;gBAChC,OAAO9C,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oBAC1BE,OAAO;oBACP4B,mBAAmB;gBACrB;YACF;YAEA,8BAA8B;YAC9B,MAAM+D,gBAAgB,MAAMtH,SAASuH,cAAc,CAAClH,OAAOqD,WAAWmD,0BAAAA,2BAAAA,gBAAiB;YACvF,IAAI,CAACS,eAAe;gBAClB,OAAO1G,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oBAC1BE,OAAO;oBACP4B,mBAAmB;gBACrB;YACF;YAEA,oBAAoB;YACpB,MAAM0C,YAAY,MAAMjG,SAASkI,eAAe,CAAC7H,OAAOgG;YACxD,IAAI,CAACJ,aAAaA,UAAUvC,SAAS,KAAKA,WAAW;gBACnD,OAAO9C,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oBAC1BE,OAAO;oBACP4B,mBAAmB;gBACrB;YACF;YAEA,uCAAuC;YACvC,IAAI4E,0BAA0BlC,UAAUC,cAAc;YACtD,IAAID,UAAUC,cAAc,CAACI,YAAY,EAAE;gBACzC,IAAI;wBAKU7F;oBAJZ,+DAA+D;oBAC/D,MAAM2H,WAAW,IAAIrI,iBAAiB;wBACpCmF,UAAUzE,aAAayE,QAAQ;wBAC/B,GAAIzE,aAAakF,YAAY,IAAI;4BAAEA,cAAclF,aAAakF,YAAY;wBAAC,CAAC;wBAC5EX,QAAQ,GAAEvE,yBAAAA,aAAauE,QAAQ,cAArBvE,oCAAAA,yBAAyB;wBACnCmD,OAAOqC,UAAUrC,KAAK;wBACtByE,gBAAgB,GAAG9H,QAAQ,aAAa,CAAC;wBACzC+H,QAAQ;4BACNC,MAAMC,QAAQC,GAAG;4BACjB9G,OAAO6G,QAAQ7G,KAAK;4BACpB+G,MAAMF,QAAQE,IAAI;4BAClBC,OAAO,KAAO;wBAChB;oBACF;oBAEA,qCAAqC;oBACrCR,0BAA0B,MAAMC,SAASQ,kBAAkB,CAAC3C,UAAUC,cAAc,CAACI,YAAY;gBACnG,EAAE,OAAO3E,OAAO;oBACd,4EAA4E;oBAC5E6G,QAAQE,IAAI,CAAC,yDAAyD/G,iBAAiB6B,QAAQ7B,MAAME,OAAO,GAAGgH,OAAOlH;gBACxH;YACF;YAEA,gCAAgC;YAChC,MAAMmH,iBAAiBjJ;YACvB,MAAMkJ,eAA4B;gBAChC,GAAG9C,SAAS;gBACZG,cAAc0C;gBACdpE,YAAYC,KAAKC,GAAG;YACtB;YAEA,MAAM5E,SAAS+H,cAAc,CAAC1H,OAAOyI,gBAAgBC;YAErD,kEAAkE;YAClE,MAAM/I,SAASiI,iBAAiB,CAAC5H,OAAOyI,gBAAgBX;YAExD,OAAOvH,IAAIa,IAAI,CAAC;gBACd2E,cAAc2C,aAAa3C,YAAY;gBACvC0B,YAAYiB,aAAajB,UAAU;gBACnCtB,YAAYuC,aAAavC,UAAU;gBACnC5C,OAAOmF,aAAanF,KAAK;YAC3B;QACF;QACA,OAAOhD,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;YAC1BE,OAAO;YACP4B,mBAAmB;QACrB;IACF;IAEA;;;GAGC,GACDpD,OAAO+C,IAAI,CAAC,iBAAiB,OAAOvC,KAAcC;QAChD,MAAM,EAAEoI,KAAK,EAAEC,eAAe,EAAEvF,SAAS,EAAEmD,aAAa,EAAE,GAAGlG,IAAIyC,IAAI;QAErE,IAAI,CAAC4F,OAAO;YACV,OAAOpI,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gBAC1BE,OAAO;gBACP4B,mBAAmB;YACrB;QACF;QAEA,0CAA0C;QAC1C,IAAIG,aAAamD,eAAe;YAC9B,MAAMS,gBAAgB,MAAMtH,SAASuH,cAAc,CAAClH,OAAOqD,WAAWmD;YACtE,IAAI,CAACS,eAAe;gBAClB,OAAO1G,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;oBAC1BE,OAAO;oBACP4B,mBAAmB;gBACrB;YACF;QACF;QAEA,mBAAmB;QACnB,IAAI0F,oBAAoB,iBAAiB;YACvC,MAAMjJ,SAASkJ,kBAAkB,CAAC7I,OAAO2I;QAC3C,OAAO,IAAIC,oBAAoB,gBAAgB;YAC7C,MAAMjJ,SAASmJ,iBAAiB,CAAC9I,OAAO2I;YACxC,MAAMhJ,SAASoJ,oBAAoB,CAAC/I,OAAO2I;QAC7C,OAAO;YACL,qBAAqB;YACrB,MAAMhJ,SAASkJ,kBAAkB,CAAC7I,OAAO2I;YACzC,MAAMhJ,SAASmJ,iBAAiB,CAAC9I,OAAO2I;YACxC,MAAMhJ,SAASoJ,oBAAoB,CAAC/I,OAAO2I;QAC7C;QAEA,+CAA+C;QAC/C,OAAOpI,IAAIW,MAAM,CAAC,KAAK8H,IAAI;IAC7B;IAEA;;;;;;GAMC,GACDlJ,OAAO8B,GAAG,CAAC,iBAAiB,OAAOtB,KAAcC;QAC/C,iDAAiD;QACjD,MAAME,aAAaH,IAAII,OAAO,CAACC,aAAa;QAE5C,IAAI,CAACF,cAAc,CAACA,WAAWQ,UAAU,CAAC,YAAY;YACpD,OAAOV,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gBAC1BE,OAAO;gBACP4B,mBAAmB;YACrB;QACF;QAEA,MAAMyF,QAAQlI,WAAWiG,SAAS,CAAC,IAAI,0BAA0B;QAEjE,+CAA+C;QAC/C,MAAMd,YAAY,MAAMjG,SAASsJ,cAAc,CAACjJ,OAAO2I;QAEvD,IAAI,CAAC/C,WAAW;YACd,OAAOrF,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gBAC1BE,OAAO;gBACP4B,mBAAmB;YACrB;QACF;QAEA,4BAA4B;QAC5B,MAAMqB,MAAMD,KAAKC,GAAG;QACpB,MAAM2B,YAAYN,UAAUvB,UAAU,GAAGuB,UAAUO,UAAU,GAAG;QAEhE,IAAI5B,MAAM2B,WAAW;YACnB,uBAAuB;YACvB,MAAMvG,SAASmJ,iBAAiB,CAAC9I,OAAO2I;YACxC,MAAMhJ,SAASoJ,oBAAoB,CAAC/I,OAAO2I;YAC3C,OAAOpI,IAAIW,MAAM,CAAC,KAAKE,IAAI,CAAC;gBAC1BE,OAAO;gBACP4B,mBAAmB;YACrB;QACF;QAEA,yDAAyD;QACzD,MAAMgG,WAAW;YACfP;YACA9D,UAAUe,UAAUvC,SAAS;YAC7B8F,QAAQvD,UAAUrC,KAAK,GAAGqC,UAAUrC,KAAK,CAACwD,KAAK,CAAC,OAAO,EAAE;YACzDb;YACAL,gBAAgBD,UAAUC,cAAc;QAC1C;QAEA,OAAOtF,IAAIa,IAAI,CAAC8H;IAClB;IAEA;;GAEC,GACDpJ,OAAO8B,GAAG,CAAC,kBAAkB,OAAOC,MAAetB;QACjD,MAAM6I,UAAU,MAAMzJ,SAAS0J,WAAW,CAACrJ;QAC3CO,IAAIa,IAAI,CAACgI;IACX;IAEA,OAAOtJ;AACT"}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-z/oauth-microsoft",
-  "version": "1.0.5",
+  "version": "1.0.6",
   "description": "OAuth 2.0 client for Microsoft Graph with multi-account support, PKCE security, and swappable storage backends",
   "keywords": [
     "oauth2",