@mcpfn/testing 0.0.1

package/dist/auth.cjs

@@ -0,0 +1,685 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/auth.ts
+var auth_exports = {};
+__export(auth_exports, {
+  MCPFN_OAUTH_EXTENSION_GRANTS: () => MCPFN_OAUTH_EXTENSION_GRANTS,
+  McpFnAuthAssertionError: () => McpFnAuthAssertionError,
+  McpFnMockOAuthAuthorizationServer: () => McpFnMockOAuthAuthorizationServer,
+  apiKeyCredential: () => apiKeyCredential,
+  assertAuthRegressionSuite: () => assertAuthRegressionSuite,
+  assertAuthorizationCodeClientMetadata: () => assertAuthorizationCodeClientMetadata,
+  assertBearerResourceChallenge: () => assertBearerResourceChallenge,
+  bearerCredential: () => bearerCredential,
+  createFetchAuthTarget: () => createFetchAuthTarget,
+  createOAuthClientMetadataFixture: () => createOAuthClientMetadataFixture,
+  createOAuthClientMetadataVariants: () => createOAuthClientMetadataVariants,
+  createPkcePair: () => createPkcePair,
+  parseBearerChallenge: () => parseBearerChallenge,
+  runAuthRegressionSuite: () => runAuthRegressionSuite,
+  startMockOAuthAuthorizationServer: () => startMockOAuthAuthorizationServer
+});
+module.exports = __toCommonJS(auth_exports);
+
+// src/auth-core.ts
+var McpFnAuthAssertionError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "McpFnAuthAssertionError";
+  }
+};
+function expectedStatus(response, expected, name) {
+  const statuses = Array.isArray(expected) ? expected : [expected];
+  if (!statuses.includes(response.status)) {
+    throw new McpFnAuthAssertionError(
+      `${name} expected HTTP ${statuses.join(" or ")}, received ${response.status}`
+    );
+  }
+}
+function parseBearerChallenge(header) {
+  if (!header) return void 0;
+  const matches = [...header.matchAll(/(?:^|,)\s*([A-Za-z][A-Za-z0-9_-]*)\s+/g)];
+  const selectedIndex = matches.findIndex((entry) => entry[1].toLowerCase() === "bearer");
+  if (selectedIndex < 0) return void 0;
+  const match = matches[selectedIndex];
+  const start = (match.index ?? 0) + match[0].length;
+  const end = matches[selectedIndex + 1]?.index ?? header.length;
+  const parameters = {};
+  const source = header.slice(start, end);
+  const pattern = /([A-Za-z][A-Za-z0-9_-]*)\s*=\s*(?:"((?:[^"\\]|\\.)*)"|([^,\s]+))/g;
+  for (const entry of source.matchAll(pattern)) {
+    const quoted = entry[2]?.replace(/\\(["\\])/g, "$1");
+    parameters[entry[1]] = quoted ?? entry[3] ?? "";
+  }
+  return { scheme: match[1], parameters };
+}
+function assertBearerResourceChallenge(response, expectedMetadataUrl) {
+  const challenge = parseBearerChallenge(response.headers.get("www-authenticate"));
+  if (!challenge || challenge.scheme.toLowerCase() !== "bearer") {
+    throw new McpFnAuthAssertionError("Expected a Bearer WWW-Authenticate challenge");
+  }
+  const metadataUrl = challenge.parameters.resource_metadata;
+  if (!metadataUrl) {
+    throw new McpFnAuthAssertionError(
+      "Bearer challenge is missing the resource_metadata parameter"
+    );
+  }
+  try {
+    const parsed = new URL(metadataUrl);
+    if (!parsed.protocol || !parsed.host) throw new Error("not absolute");
+  } catch {
+    throw new McpFnAuthAssertionError(
+      `Bearer challenge has an invalid resource_metadata URL: ${metadataUrl}`
+    );
+  }
+  if (expectedMetadataUrl && metadataUrl !== expectedMetadataUrl) {
+    throw new McpFnAuthAssertionError(
+      `Expected resource_metadata=${expectedMetadataUrl}, received ${metadataUrl}`
+    );
+  }
+  return challenge;
+}
+function bearerCredential(token, kind = "oauth") {
+  return {
+    kind,
+    headers: { authorization: `Bearer ${token}` }
+  };
+}
+function apiKeyCredential(apiKey, options = {}) {
+  const headerName = options.headerName ?? "authorization";
+  const value = options.scheme === "" ? apiKey : `${options.scheme ?? "Bearer"} ${apiKey}`;
+  return { kind: "api-key", headers: { [headerName]: value } };
+}
+function invalidHeaders(options) {
+  return new Headers(options.invalidCredentialHeaders ?? {
+    authorization: `Bearer mcpfn-invalid-${options.kind}`
+  });
+}
+async function runOne(options, scenario, prepare, expected) {
+  let credential;
+  try {
+    credential = await prepare();
+    const headers = credential ? new Headers(credential.headers) : scenario.name === "invalid-credential" ? invalidHeaders(options) : new Headers();
+    const response = await options.target.request(headers, scenario);
+    expectedStatus(response, expected, scenario.name);
+    if (options.kind === "oauth" && scenario.name !== "valid-credential") {
+      assertBearerResourceChallenge(
+        response,
+        options.protectedResourceMetadataUrl
+      );
+    }
+    if (scenario.name === "valid-credential" && credential) {
+      await options.verifyAuthenticatedResponse?.(response.clone(), credential);
+    }
+    return {
+      name: scenario.name,
+      status: "passed",
+      responseStatus: response.status
+    };
+  } catch (error) {
+    return {
+      name: scenario.name,
+      status: "failed",
+      error: error instanceof Error ? error.message : String(error)
+    };
+  } finally {
+    await credential?.dispose?.();
+  }
+}
+async function runAuthRegressionSuite(options) {
+  const issue = (overrides = {}) => options.provider.issue({
+    kind: options.kind,
+    scopes: options.requiredScopes,
+    resource: options.resource,
+    ...overrides
+  });
+  const results = [];
+  results.push(await runOne(
+    options,
+    { name: "missing-credential", kind: options.kind },
+    async () => void 0,
+    401
+  ));
+  results.push(await runOne(
+    options,
+    { name: "invalid-credential", kind: options.kind },
+    async () => void 0,
+    401
+  ));
+  results.push(await runOne(
+    options,
+    { name: "valid-credential", kind: options.kind },
+    () => issue(),
+    options.expectedAuthenticatedStatuses ?? [200, 201, 202, 204]
+  ));
+  const capabilities = options.provider.capabilities ?? {};
+  if (capabilities.scopes && options.requiredScopes?.length) {
+    results.push(await runOne(
+      options,
+      { name: "insufficient-scope", kind: options.kind },
+      () => issue({ scopes: [] }),
+      403
+    ));
+  }
+  if (capabilities.expiration) {
+    results.push(await runOne(
+      options,
+      { name: "expired-credential", kind: options.kind },
+      () => issue({ expiresInSeconds: -60 }),
+      401
+    ));
+  }
+  if (capabilities.resourceBinding && options.resource) {
+    results.push(await runOne(
+      options,
+      { name: "missing-resource", kind: options.kind },
+      () => issue({ resource: void 0 }),
+      401
+    ));
+  }
+  if (capabilities.resourceBinding && options.wrongResource) {
+    results.push(await runOne(
+      options,
+      { name: "wrong-resource", kind: options.kind },
+      () => issue({ resource: options.wrongResource }),
+      401
+    ));
+  }
+  if (capabilities.revocation && options.provider.revoke) {
+    results.push(await runOne(
+      options,
+      { name: "revoked-credential", kind: options.kind },
+      async () => {
+        const credential = await issue();
+        await options.provider.revoke?.(credential);
+        return credential;
+      },
+      401
+    ));
+  }
+  return results;
+}
+async function assertAuthRegressionSuite(options) {
+  const results = await runAuthRegressionSuite(options);
+  const failures = results.filter((result) => result.status === "failed");
+  if (failures.length) {
+    throw new McpFnAuthAssertionError(
+      failures.map((failure) => `${failure.name}: ${failure.error}`).join("\n")
+    );
+  }
+  return results;
+}
+function createFetchAuthTarget(options) {
+  const fetchImplementation = options.fetch ?? globalThis.fetch;
+  if (!fetchImplementation) {
+    throw new Error("A fetch implementation is required");
+  }
+  return {
+    async request(authHeaders, scenario) {
+      const configured = typeof options.requestInit === "function" ? options.requestInit(scenario) : options.requestInit ?? {};
+      const headers = new Headers(configured.headers);
+      headers.set("accept", "application/json, text/event-stream");
+      headers.set("content-type", "application/json");
+      authHeaders.forEach((value, name) => headers.set(name, value));
+      return fetchImplementation(options.url, {
+        method: "POST",
+        body: JSON.stringify({
+          jsonrpc: "2.0",
+          id: `mcpfn-auth-${scenario.name}`,
+          method: "initialize",
+          params: {
+            protocolVersion: "2025-11-25",
+            capabilities: {},
+            clientInfo: { name: "mcpfn-auth-test", version: "1.0.0" }
+          }
+        }),
+        ...configured,
+        headers
+      });
+    }
+  };
+}
+var MCPFN_OAUTH_EXTENSION_GRANTS = {
+  jwtBearer: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+  deviceCode: "urn:ietf:params:oauth:grant-type:device_code",
+  generic: "urn:example:params:oauth:grant-type:extension"
+};
+function createOAuthClientMetadataFixture(options) {
+  return {
+    ...options.extraMetadata,
+    client_id: new URL(options.clientId).toString(),
+    client_name: options.clientName ?? "McpFn OAuth test client",
+    redirect_uris: [...new Set(options.redirectUris.map((uri) => new URL(uri).toString()))],
+    response_types: ["code"],
+    grant_types: [
+      "authorization_code",
+      "refresh_token",
+      ...new Set(options.extraGrantTypes ?? [])
+    ],
+    token_endpoint_auth_method: "none"
+  };
+}
+function createOAuthClientMetadataVariants(baseUrl, redirectUri = new URL("/callback", baseUrl).toString()) {
+  const base = new URL(baseUrl);
+  const fixture = (name, extraGrantTypes = []) => createOAuthClientMetadataFixture({
+    clientId: new URL(`/client-metadata/${name}`, base).toString(),
+    redirectUris: [redirectUri],
+    clientName: `McpFn ${name} client`,
+    extraGrantTypes
+  });
+  return {
+    basic: fixture("basic"),
+    jwtBearerExtension: fixture("jwt-bearer-extension", [MCPFN_OAUTH_EXTENSION_GRANTS.jwtBearer]),
+    deviceCodeExtension: fixture("device-code-extension", [MCPFN_OAUTH_EXTENSION_GRANTS.deviceCode]),
+    genericExtension: fixture("generic-extension", [MCPFN_OAUTH_EXTENSION_GRANTS.generic])
+  };
+}
+function assertAuthorizationCodeClientMetadata(metadata, expectedClientId) {
+  if (expectedClientId && metadata.client_id !== new URL(expectedClientId).toString()) {
+    throw new McpFnAuthAssertionError("OAuth client metadata client_id does not match its document URL");
+  }
+  if (!metadata.response_types.includes("code")) {
+    throw new McpFnAuthAssertionError("OAuth client metadata does not support response_type=code");
+  }
+  if (!metadata.grant_types.includes("authorization_code")) {
+    throw new McpFnAuthAssertionError("OAuth client metadata does not support authorization_code");
+  }
+  if (!metadata.redirect_uris.length) {
+    throw new McpFnAuthAssertionError("OAuth client metadata must declare at least one redirect URI");
+  }
+  return metadata;
+}
+
+// src/mock-oauth-server.ts
+var import_node_crypto = require("crypto");
+var import_node_http = require("http");
+function base64Url(value) {
+  return value.toString("base64url");
+}
+function createPkcePair() {
+  const verifier = base64Url((0, import_node_crypto.randomBytes)(48));
+  return {
+    verifier,
+    challenge: (0, import_node_crypto.createHash)("sha256").update(verifier).digest("base64url"),
+    method: "S256"
+  };
+}
+function uniqueScopes(value) {
+  return [...new Set((value ?? "").split(/\s+/).filter(Boolean))].sort();
+}
+function json(status, body) {
+  return Response.json(body, {
+    status,
+    headers: { "cache-control": "no-store" }
+  });
+}
+function oauthError(status, error, description) {
+  return json(status, { error, error_description: description });
+}
+function escapeHtml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll('"', "&quot;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
+}
+function formValue(form, name) {
+  const value = form.get(name);
+  return value === null || value === "" ? void 0 : value;
+}
+var McpFnMockOAuthAuthorizationServer = class {
+  issuer;
+  clientId;
+  redirectUris;
+  scopesSupported;
+  clientMetadata;
+  codes = /* @__PURE__ */ new Map();
+  accessTokens = /* @__PURE__ */ new Map();
+  refreshTokens = /* @__PURE__ */ new Map();
+  callbacks = [];
+  clock;
+  accessTokenLifetimeSeconds;
+  authorizationCodeLifetimeSeconds;
+  refreshTokenLifetimeSeconds;
+  constructor(options) {
+    this.issuer = new URL(options.issuer);
+    this.issuer.pathname = this.issuer.pathname.replace(/\/?$/, "/");
+    this.clientId = options.clientId ?? "mcpfn-playwright";
+    this.redirectUris = options.redirectUris?.map((uri) => new URL(uri).toString()) ?? [
+      new URL("callback", this.issuer).toString()
+    ];
+    this.scopesSupported = [...new Set(options.scopesSupported ?? ["mcp:read", "mcp:write"])].sort();
+    this.clock = options.clock ?? Date.now;
+    this.accessTokenLifetimeSeconds = options.accessTokenLifetimeSeconds ?? 300;
+    this.authorizationCodeLifetimeSeconds = options.authorizationCodeLifetimeSeconds ?? 120;
+    this.refreshTokenLifetimeSeconds = options.refreshTokenLifetimeSeconds ?? 3600;
+    this.clientMetadata = createOAuthClientMetadataVariants(
+      this.issuer,
+      this.redirectUris[0]
+    );
+  }
+  get metadataUrl() {
+    return new URL(".well-known/oauth-authorization-server", this.issuer).toString();
+  }
+  get authorizationEndpoint() {
+    return new URL("authorize", this.issuer).toString();
+  }
+  get tokenEndpoint() {
+    return new URL("token", this.issuer).toString();
+  }
+  get revocationEndpoint() {
+    return new URL("revoke", this.issuer).toString();
+  }
+  get callbackUrl() {
+    return this.redirectUris[0];
+  }
+  clientMetadataUrl(variant) {
+    return this.clientMetadata[variant].client_id;
+  }
+  authorizationUrl(input) {
+    const url = new URL(this.authorizationEndpoint);
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("client_id", input.clientId ?? this.clientId);
+    url.searchParams.set("redirect_uri", input.redirectUri ?? this.callbackUrl);
+    url.searchParams.set("code_challenge", input.codeChallenge);
+    url.searchParams.set("code_challenge_method", "S256");
+    url.searchParams.set("scope", (input.scopes ?? ["mcp:read"]).join(" "));
+    if (input.state) url.searchParams.set("state", input.state);
+    if (input.resource) url.searchParams.set("resource", input.resource);
+    for (const [name, value] of Object.entries(input.extraParameters ?? {})) {
+      url.searchParams.set(name, value);
+    }
+    return url.toString();
+  }
+  latestCallback() {
+    return this.callbacks.at(-1);
+  }
+  expireAccessToken(token) {
+    const record = this.accessTokens.get(token);
+    if (record) record.expiresAt = this.nowSeconds() - 1;
+  }
+  revokeToken(token) {
+    const access = this.accessTokens.get(token);
+    if (access) access.revoked = true;
+    const refresh = this.refreshTokens.get(token);
+    if (refresh) refresh.revoked = true;
+  }
+  async verifyAccessToken(token) {
+    const record = this.accessTokens.get(token);
+    if (!record || record.revoked || record.expiresAt <= this.nowSeconds()) {
+      throw new Error("Invalid access token");
+    }
+    return {
+      token,
+      clientId: record.clientId,
+      scopes: record.scopes,
+      expiresAt: record.expiresAt,
+      ...record.resource ? { resource: new URL(record.resource) } : {}
+    };
+  }
+  async handle(request) {
+    const url = new URL(request.url);
+    const path = url.pathname.replace(this.issuer.pathname.replace(/\/$/, ""), "") || "/";
+    if (request.method === "GET" && path === "/.well-known/oauth-authorization-server") {
+      return json(200, {
+        issuer: this.issuer.toString(),
+        authorization_endpoint: this.authorizationEndpoint,
+        token_endpoint: this.tokenEndpoint,
+        revocation_endpoint: this.revocationEndpoint,
+        response_types_supported: ["code"],
+        grant_types_supported: ["authorization_code", "refresh_token"],
+        code_challenge_methods_supported: ["S256"],
+        token_endpoint_auth_methods_supported: ["none"],
+        scopes_supported: this.scopesSupported
+      });
+    }
+    if (request.method === "GET" && path.startsWith("/client-metadata/")) {
+      const metadata = Object.values(this.clientMetadata).find((candidate) => new URL(candidate.client_id).pathname === url.pathname);
+      return metadata ? json(200, metadata) : json(404, { error: "not_found" });
+    }
+    if (request.method === "GET" && path === "/authorize") {
+      return this.authorize(url);
+    }
+    if (request.method === "POST" && path === "/token") {
+      return this.token(await request.text());
+    }
+    if (request.method === "POST" && path === "/revoke") {
+      return this.revoke(await request.text());
+    }
+    if (request.method === "GET" && path === "/callback") {
+      const parameters = Object.fromEntries(url.searchParams);
+      this.callbacks.push({ url: url.toString(), parameters });
+      return new Response(
+        `<!doctype html><html><body><main><h1>OAuth callback received</h1><pre>${escapeHtml(JSON.stringify(parameters, null, 2))}</pre></main></body></html>`,
+        { headers: { "content-type": "text/html; charset=utf-8" } }
+      );
+    }
+    return json(404, { error: "not_found" });
+  }
+  nowSeconds() {
+    return Math.floor(this.clock() / 1e3);
+  }
+  resolveClient(clientId) {
+    if (clientId === this.clientId) {
+      return { clientId, redirectUris: this.redirectUris };
+    }
+    const metadata = Object.values(this.clientMetadata).find((candidate) => candidate.client_id === clientId);
+    if (!metadata) return void 0;
+    assertAuthorizationCodeClientMetadata(metadata, clientId);
+    return { clientId, redirectUris: metadata.redirect_uris };
+  }
+  authorize(url) {
+    const clientId = url.searchParams.get("client_id") ?? "";
+    const redirectUri = url.searchParams.get("redirect_uri") ?? "";
+    const client = this.resolveClient(clientId);
+    if (!client) return oauthError(400, "invalid_client", "Unknown OAuth client");
+    if (!client.redirectUris.includes(redirectUri)) {
+      return oauthError(400, "invalid_request", "redirect_uri is not registered");
+    }
+    if (url.searchParams.get("response_type") !== "code") {
+      return this.authorizationRedirect(url, redirectUri, "unsupported_response_type");
+    }
+    const codeChallenge = url.searchParams.get("code_challenge");
+    if (!codeChallenge || url.searchParams.get("code_challenge_method") !== "S256") {
+      return this.authorizationRedirect(url, redirectUri, "invalid_request", "PKCE S256 is required");
+    }
+    const requestedScopes = uniqueScopes(url.searchParams.get("scope"));
+    if (requestedScopes.some((scope) => !this.scopesSupported.includes(scope))) {
+      return this.authorizationRedirect(url, redirectUri, "invalid_scope");
+    }
+    const decision = url.searchParams.get("decision");
+    if (!decision) {
+      const hidden = [...url.searchParams].filter(([name]) => name !== "decision").map(([name, value]) => `<input type="hidden" name="${escapeHtml(name)}" value="${escapeHtml(value)}">`).join("");
+      return new Response(
+        `<!doctype html><html><body><main><h1>Authorize MCP client</h1><p>${escapeHtml(clientId)}</p><form method="get" action="${escapeHtml(this.authorizationEndpoint)}">${hidden}<button name="decision" value="approve">Approve</button><button name="decision" value="deny">Deny</button></form></main></body></html>`,
+        { headers: { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" } }
+      );
+    }
+    if (decision === "deny") {
+      return this.authorizationRedirect(url, redirectUri, "access_denied");
+    }
+    if (decision !== "approve") {
+      return oauthError(400, "invalid_request", "Unknown authorization decision");
+    }
+    const code = `mcpfn_code_${(0, import_node_crypto.randomUUID)()}`;
+    this.codes.set(code, {
+      clientId,
+      redirectUri,
+      codeChallenge,
+      scopes: requestedScopes,
+      resource: url.searchParams.get("resource") ?? void 0,
+      expiresAt: this.nowSeconds() + this.authorizationCodeLifetimeSeconds,
+      used: false
+    });
+    const callback = new URL(redirectUri);
+    callback.searchParams.set("code", code);
+    const state = url.searchParams.get("state");
+    if (state) callback.searchParams.set("state", state);
+    return Response.redirect(callback, 302);
+  }
+  authorizationRedirect(requestUrl, redirectUri, error, description) {
+    const callback = new URL(redirectUri);
+    callback.searchParams.set("error", error);
+    if (description) callback.searchParams.set("error_description", description);
+    const state = requestUrl.searchParams.get("state");
+    if (state) callback.searchParams.set("state", state);
+    return Response.redirect(callback, 302);
+  }
+  token(source) {
+    const form = new URLSearchParams(source);
+    const grantType = formValue(form, "grant_type");
+    if (grantType === "authorization_code") return this.exchangeAuthorizationCode(form);
+    if (grantType === "refresh_token") return this.exchangeRefreshToken(form);
+    return oauthError(400, "unsupported_grant_type", "The grant type is not supported");
+  }
+  exchangeAuthorizationCode(form) {
+    const code = formValue(form, "code");
+    const record = code ? this.codes.get(code) : void 0;
+    if (!record || record.used || record.expiresAt <= this.nowSeconds()) {
+      return oauthError(400, "invalid_grant", "Authorization code is invalid or expired");
+    }
+    if (formValue(form, "client_id") !== record.clientId || formValue(form, "redirect_uri") !== record.redirectUri) {
+      return oauthError(400, "invalid_grant", "Authorization code binding does not match");
+    }
+    const verifier = formValue(form, "code_verifier");
+    const challenge = verifier ? (0, import_node_crypto.createHash)("sha256").update(verifier).digest("base64url") : void 0;
+    if (challenge !== record.codeChallenge) {
+      return oauthError(400, "invalid_grant", "PKCE verification failed");
+    }
+    record.used = true;
+    return json(200, this.issueTokenSet(record));
+  }
+  exchangeRefreshToken(form) {
+    const refreshToken = formValue(form, "refresh_token");
+    const record = refreshToken ? this.refreshTokens.get(refreshToken) : void 0;
+    if (!record || record.revoked || record.expiresAt <= this.nowSeconds()) {
+      return oauthError(400, "invalid_grant", "Refresh token is invalid or expired");
+    }
+    if (formValue(form, "client_id") !== record.clientId) {
+      return oauthError(400, "invalid_grant", "Refresh token client binding does not match");
+    }
+    const requestedScopes = form.has("scope") ? uniqueScopes(form.get("scope")) : record.scopes;
+    if (requestedScopes.some((scope) => !record.scopes.includes(scope))) {
+      return oauthError(400, "invalid_scope", "Refresh cannot increase granted scopes");
+    }
+    record.revoked = true;
+    return json(200, this.issueTokenSet({ ...record, scopes: requestedScopes }));
+  }
+  issueTokenSet(input) {
+    const accessToken = `mcpfn_access_${(0, import_node_crypto.randomUUID)()}`;
+    const refreshToken = `mcpfn_refresh_${(0, import_node_crypto.randomUUID)()}`;
+    this.accessTokens.set(accessToken, {
+      ...input,
+      expiresAt: this.nowSeconds() + this.accessTokenLifetimeSeconds,
+      revoked: false
+    });
+    this.refreshTokens.set(refreshToken, {
+      ...input,
+      expiresAt: this.nowSeconds() + this.refreshTokenLifetimeSeconds,
+      revoked: false
+    });
+    return {
+      access_token: accessToken,
+      token_type: "Bearer",
+      expires_in: this.accessTokenLifetimeSeconds,
+      refresh_token: refreshToken,
+      scope: input.scopes.join(" "),
+      ...input.resource ? { resource: input.resource } : {}
+    };
+  }
+  revoke(source) {
+    const token = new URLSearchParams(source).get("token");
+    if (token) this.revokeToken(token);
+    return new Response(null, { status: 200 });
+  }
+};
+async function toRequest(req, origin) {
+  const chunks = [];
+  for await (const chunk of req) chunks.push(Buffer.from(chunk));
+  const headers = new Headers();
+  for (const [name, value] of Object.entries(req.headers)) {
+    if (Array.isArray(value)) {
+      for (const entry of value) headers.append(name, entry);
+    } else if (value !== void 0) {
+      headers.set(name, value);
+    }
+  }
+  const body = chunks.length ? Buffer.concat(chunks) : void 0;
+  const init = {
+    method: req.method,
+    headers,
+    ...body ? { body, duplex: "half" } : {}
+  };
+  return new Request(new URL(req.url ?? "/", origin), init);
+}
+async function writeResponse(res, response) {
+  res.statusCode = response.status;
+  response.headers.forEach((value, name) => res.setHeader(name, value));
+  res.end(Buffer.from(await response.arrayBuffer()));
+}
+async function startMockOAuthAuthorizationServer(options = {}) {
+  let oauth;
+  let origin = "";
+  const server = (0, import_node_http.createServer)(async (req, res) => {
+    try {
+      if (!oauth) throw new Error("Mock OAuth server is not initialized");
+      await writeResponse(res, await oauth.handle(await toRequest(req, origin)));
+    } catch {
+      res.statusCode = 500;
+      res.setHeader("content-type", "application/json");
+      res.end(JSON.stringify({
+        error: "server_error",
+        error_description: "Internal Server Error"
+      }));
+    }
+  });
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(options.port ?? 0, options.hostname ?? "127.0.0.1", () => {
+      server.off("error", reject);
+      resolve();
+    });
+  });
+  const address = server.address();
+  origin = `http://${address.address.includes(":") ? `[${address.address}]` : address.address}:${address.port}`;
+  oauth = new McpFnMockOAuthAuthorizationServer({ ...options, issuer: origin });
+  return {
+    origin,
+    oauth,
+    close: () => new Promise((resolve, reject) => {
+      server.close((error) => error ? reject(error) : resolve());
+    })
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  MCPFN_OAUTH_EXTENSION_GRANTS,
+  McpFnAuthAssertionError,
+  McpFnMockOAuthAuthorizationServer,
+  apiKeyCredential,
+  assertAuthRegressionSuite,
+  assertAuthorizationCodeClientMetadata,
+  assertBearerResourceChallenge,
+  bearerCredential,
+  createFetchAuthTarget,
+  createOAuthClientMetadataFixture,
+  createOAuthClientMetadataVariants,
+  createPkcePair,
+  parseBearerChallenge,
+  runAuthRegressionSuite,
+  startMockOAuthAuthorizationServer
+});
+//# sourceMappingURL=auth.cjs.map