@miadi/connector 0.1.0 → 0.1.1

package/dist/oauth.d.ts

@@ -60,9 +60,21 @@ export declare const emptyOAuthState: () => OAuthState;
 export declare class MiadiOAuthProvider implements OAuthServerProvider {
     private readonly state;
     private readonly identify;
+    /**
+     * The issuer as the metadata states it. It goes back on every authorization
+     * response as `iss` (RFC 9207), which ChatGPT requires to use its stable
+     * callback URL.
+     */
+    private readonly issuer?;
     private readonly confirmPath;
     private readonly direct;
-    constructor(state: JsonFile<OAuthState>, identify: Identify, confirmPath?: string);
+    constructor(state: JsonFile<OAuthState>, identify: Identify, 
+    /**
+     * The issuer as the metadata states it. It goes back on every authorization
+     * response as `iss` (RFC 9207), which ChatGPT requires to use its stable
+     * callback URL.
+     */
+    issuer?: string | undefined, confirmPath?: string);
     get clientsStore(): OAuthRegisteredClientsStore;
     authorize(client: OAuthClientInformationFull, params: AuthorizationParams, res: Response): Promise<void>;
     /** POST from the sign-in page: the person's token, or a refusal. */

package/dist/oauth.js

@@ -14,11 +14,19 @@ const now = () => Math.floor(Date.now() / 1000);
 export class MiadiOAuthProvider {
     state;
     identify;
+    issuer;
     confirmPath;
     direct = new Map();
-    constructor(state, identify, confirmPath = "/authorize/confirm") {
+    constructor(state, identify, 
+    /**
+     * The issuer as the metadata states it. It goes back on every authorization
+     * response as `iss` (RFC 9207), which ChatGPT requires to use its stable
+     * callback URL.
+     */
+    issuer, confirmPath = "/authorize/confirm") {
         this.state = state;
         this.identify = identify;
+        this.issuer = issuer;
         this.confirmPath = confirmPath;
     }
     get clientsStore() {
@@ -68,6 +76,8 @@ export class MiadiOAuthProvider {
         const redirect = new URL(pending.params.redirectUri);
         if (pending.params.state)
             redirect.searchParams.set("state", pending.params.state);
+        if (this.issuer)
+            redirect.searchParams.set("iss", this.issuer);
         if (body.decision === "deny") {
             this.state.update((st) => delete st.pending[body.request_id]);
             redirect.searchParams.set("error", "access_denied");

package/dist/server.js

@@ -12,7 +12,7 @@
 import express from "express";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
-import { mcpAuthRouter, getOAuthProtectedResourceMetadataUrl } from "@modelcontextprotocol/sdk/server/auth/router.js";
+import { mcpAuthRouter, createOAuthMetadata, getOAuthProtectedResourceMetadataUrl } from "@modelcontextprotocol/sdk/server/auth/router.js";
 import { requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
 import { MiadiOAuthProvider, SCOPES, emptyOAuthState } from "./oauth.js";
 import { registerApprovalRoutes } from "./approve.js";
@@ -26,7 +26,9 @@ export function createConnectorApp(config, deps) {
     const paths = statePaths(config.stateDir);
     const oauthState = new JsonFile(paths.oauth, emptyOAuthState);
     const ledger = new Ledger(paths.ledger);
-    const provider = new MiadiOAuthProvider(oauthState, deps.identify);
+    // The issuer string exactly as the metadata states it (URL.href, so with its trailing slash).
+    const issuer = new URL(config.publicUrl).href;
+    const provider = new MiadiOAuthProvider(oauthState, deps.identify, issuer);
     const miadi = new MiadiClient(config.miadiUrl, deps.fetchImpl);
     const reviews = new ReviewClient(config.reviewUrl, config.reviewToken, deps.fetchImpl);
     const publicUrl = new URL(config.publicUrl);
@@ -38,6 +40,21 @@ export function createConnectorApp(config, deps) {
     app.get("/health", (_req, res) => {
         res.json({ ok: true, service: "@miadi/connector", version: VERSION });
     });
+    // The SDK's metadata, plus RFC 9207: authorization responses carry `iss`.
+    // Served before the SDK router so this document is the one clients read.
+    const asMetadata = {
+        ...createOAuthMetadata({
+            provider,
+            issuerUrl: publicUrl,
+            baseUrl: publicUrl,
+            scopesSupported: SCOPES,
+            serviceDocumentationUrl: new URL("https://github.com/jgwill/Miadi/tree/main/packages/connector"),
+        }),
+        authorization_response_iss_parameter_supported: true,
+    };
+    app.get("/.well-known/oauth-authorization-server", (_req, res) => {
+        res.set("cache-control", "no-store").json(asMetadata);
+    });
     app.use(mcpAuthRouter({
         provider,
         issuerUrl: publicUrl,

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.1.0";
+export declare const VERSION = "0.1.1";

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = "0.1.0";
+export const VERSION = "0.1.1";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miadi/connector",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "The Miadi connector: one remote MCP service through which a person signed in with their Miadi person token, from ChatGPT or any MCP client, reads sessions, reviews, episodes and circles and records observations, inquiries, handoffs and proposals with their name on each record.",
   "license": "MIT",
   "author": "Miadi",