@neverinfamous/mysql-mcp 2.1.0

package/dist/auth/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/auth/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AACH,MAAM,OAAO,UAAW,SAAQ,KAAK;IACjB,IAAI,CAAS;IACb,UAAU,CAAS;IAEnC,YAAY,OAAe,EAAE,IAAY,EAAE,UAAU,GAAG,GAAG;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;IACtD,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,OAAO,iBAAkB,SAAQ,UAAU;IAC7C,YAAY,OAAO,GAAG,0BAA0B;QAC5C,KAAK,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC7D,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,OAAO,iBAAkB,SAAQ,UAAU;IAC7C,YAAY,OAAO,GAAG,sBAAsB;QACxC,KAAK,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC7D,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,OAAO,iBAAkB,SAAQ,UAAU;IAC7C,YAAY,OAAO,GAAG,0BAA0B;QAC5C,KAAK,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC7D,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,OAAO,qBAAsB,SAAQ,UAAU;IACjD,YAAY,OAAO,GAAG,yBAAyB;QAC3C,KAAK,CAAC,OAAO,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACjE,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,OAAO,sBAAuB,SAAQ,UAAU;IAClC,cAAc,CAAW;IAEzC,YAAY,cAAwB,EAAE,OAAgB;QAClD,KAAK,CACD,OAAO,IAAI,iCAAiC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACvE,oBAAoB,EACpB,GAAG,CACN,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAClE,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,OAAO,wBAAyB,SAAQ,UAAU;IACpD,YAAY,OAAO,GAAG,kDAAkD;QACpE,KAAK,CAAC,OAAO,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,wBAAwB,CAAC,SAAS,CAAC,CAAC;IACpE,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,OAAO,cAAe,SAAQ,UAAU;IAC1C,YAAY,OAAO,GAAG,sBAAsB;QACxC,KAAK,CAAC,OAAO,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,OAAO,uBAAwB,SAAQ,UAAU;IACnD,YAAY,OAAO,GAAG,4BAA4B;QAC9C,KAAK,CAAC,OAAO,EAAE,qBAAqB,EAAE,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,uBAAuB,CAAC,SAAS,CAAC,CAAC;IACnE,CAAC;CACJ"}

package/dist/auth/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * mysql-mcp - Auth Module Public Exports
+ *
+ * OAuth 2.0 authentication and authorization components.
+ */
+export type * from './types.js';
+export * from './errors.js';
+export * from './scopes.js';
+export { OAuthResourceServer, createOAuthResourceServer } from './OAuthResourceServer.js';
+export { AuthorizationServerDiscovery, createAuthServerDiscovery } from './AuthorizationServerDiscovery.js';
+export { TokenValidator, createTokenValidator } from './TokenValidator.js';
+export { extractBearerToken, createAuthContext, validateAuth, requireScope, requireAnyScope, requireToolScope, formatOAuthError, type AuthenticatedContext, type AuthMiddlewareConfig } from './middleware.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,mBAAmB,YAAY,CAAC;AAChC,cAAc,aAAa,CAAC;AAG5B,cAAc,aAAa,CAAC;AAG5B,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAC1F,OAAO,EAAE,4BAA4B,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC5G,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAG3E,OAAO,EACH,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EAC5B,MAAM,iBAAiB,CAAC"}

package/dist/auth/index.js

@@ -0,0 +1,15 @@
+/**
+ * mysql-mcp - Auth Module Public Exports
+ *
+ * OAuth 2.0 authentication and authorization components.
+ */
+export * from './errors.js';
+// Scopes
+export * from './scopes.js';
+// Core classes
+export { OAuthResourceServer, createOAuthResourceServer } from './OAuthResourceServer.js';
+export { AuthorizationServerDiscovery, createAuthServerDiscovery } from './AuthorizationServerDiscovery.js';
+export { TokenValidator, createTokenValidator } from './TokenValidator.js';
+// Middleware
+export { extractBearerToken, createAuthContext, validateAuth, requireScope, requireAnyScope, requireToolScope, formatOAuthError } from './middleware.js';
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,cAAc,aAAa,CAAC;AAE5B,SAAS;AACT,cAAc,aAAa,CAAC;AAE5B,eAAe;AACf,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAC1F,OAAO,EAAE,4BAA4B,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC5G,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE3E,aAAa;AACb,OAAO,EACH,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAGnB,MAAM,iBAAiB,CAAC"}

package/dist/auth/middleware.d.ts

@@ -0,0 +1,61 @@
+/**
+ * mysql-mcp - OAuth Middleware
+ *
+ * Authentication and authorization middleware for HTTP transport.
+ */
+import type { TokenClaims } from './types.js';
+import type { TokenValidator } from './TokenValidator.js';
+/**
+ * Authenticated request context
+ */
+export interface AuthenticatedContext {
+    /** Whether request is authenticated */
+    authenticated: boolean;
+    /** Token claims (if authenticated) */
+    claims?: TokenClaims;
+    /** Token scopes (convenience) */
+    scopes: string[];
+}
+/**
+ * Auth middleware configuration
+ */
+export interface AuthMiddlewareConfig {
+    /** Token validator instance */
+    tokenValidator: TokenValidator;
+    /** Whether to require authentication (default: true) */
+    required?: boolean;
+    /** Required scopes (any of these) */
+    requiredScopes?: string[];
+}
+/**
+ * Extract bearer token from Authorization header
+ */
+export declare function extractBearerToken(authHeader: string | undefined): string | null;
+/**
+ * Create authentication context from request
+ */
+export declare function createAuthContext(authHeader: string | undefined, tokenValidator: TokenValidator): Promise<AuthenticatedContext>;
+/**
+ * Validate authentication and authorization
+ */
+export declare function validateAuth(authHeader: string | undefined, config: AuthMiddlewareConfig): Promise<AuthenticatedContext>;
+/**
+ * Check if context has required scope
+ */
+export declare function requireScope(context: AuthenticatedContext, scope: string): void;
+/**
+ * Check if context has any of the required scopes
+ */
+export declare function requireAnyScope(context: AuthenticatedContext, scopes: string[]): void;
+/**
+ * Check if context has scope for a tool operation
+ */
+export declare function requireToolScope(context: AuthenticatedContext, requiredScopes: string[]): void;
+/**
+ * Format OAuth error for HTTP response
+ */
+export declare function formatOAuthError(error: unknown): {
+    status: number;
+    body: object;
+};
+//# sourceMappingURL=middleware.d.ts.map

package/dist/auth/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAI1D;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACjC,uCAAuC;IACvC,aAAa,EAAE,OAAO,CAAC;IAEvB,sCAAsC;IACtC,MAAM,CAAC,EAAE,WAAW,CAAC;IAErB,iCAAiC;IACjC,MAAM,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACjC,+BAA+B;IAC/B,cAAc,EAAE,cAAc,CAAC;IAE/B,wDAAwD;IACxD,QAAQ,CAAC,EAAE,OAAO,CAAC;IAEnB,qCAAqC;IACrC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAWhF;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACnC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,cAAc,EAAE,cAAc,GAC/B,OAAO,CAAC,oBAAoB,CAAC,CAkB/B;AAED;;GAEG;AACH,wBAAsB,YAAY,CAC9B,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,MAAM,EAAE,oBAAoB,GAC7B,OAAO,CAAC,oBAAoB,CAAC,CAgC/B;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAQ/E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAQrF;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,IAAI,CAkB9F;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAwCjF"}

package/dist/auth/middleware.js

@@ -0,0 +1,152 @@
+/**
+ * mysql-mcp - OAuth Middleware
+ *
+ * Authentication and authorization middleware for HTTP transport.
+ */
+import { TokenMissingError, InvalidTokenError, InsufficientScopeError } from './errors.js';
+import { hasScope, hasAnyScope, SCOPES } from './scopes.js';
+/**
+ * Extract bearer token from Authorization header
+ */
+export function extractBearerToken(authHeader) {
+    if (!authHeader) {
+        return null;
+    }
+    const parts = authHeader.split(' ');
+    if (parts.length !== 2 || parts[0]?.toLowerCase() !== 'bearer') {
+        return null;
+    }
+    return parts[1] ?? null;
+}
+/**
+ * Create authentication context from request
+ */
+export async function createAuthContext(authHeader, tokenValidator) {
+    const token = extractBearerToken(authHeader);
+    if (!token) {
+        return { authenticated: false, scopes: [] };
+    }
+    const result = await tokenValidator.validate(token);
+    if (!result.valid || !result.claims) {
+        return { authenticated: false, scopes: [] };
+    }
+    return {
+        authenticated: true,
+        claims: result.claims,
+        scopes: result.claims.scopes
+    };
+}
+/**
+ * Validate authentication and authorization
+ */
+export async function validateAuth(authHeader, config) {
+    const token = extractBearerToken(authHeader);
+    // Check if token is required
+    if (!token) {
+        if (config.required !== false) {
+            throw new TokenMissingError();
+        }
+        return { authenticated: false, scopes: [] };
+    }
+    // Validate the token
+    const result = await config.tokenValidator.validate(token);
+    if (!result.valid || !result.claims) {
+        throw new InvalidTokenError(result.error ?? 'Invalid token');
+    }
+    const context = {
+        authenticated: true,
+        claims: result.claims,
+        scopes: result.claims.scopes
+    };
+    // Check required scopes
+    if (config.requiredScopes && config.requiredScopes.length > 0) {
+        if (!hasAnyScope(context.scopes, config.requiredScopes)) {
+            throw new InsufficientScopeError(config.requiredScopes);
+        }
+    }
+    return context;
+}
+/**
+ * Check if context has required scope
+ */
+export function requireScope(context, scope) {
+    if (!context.authenticated) {
+        throw new TokenMissingError();
+    }
+    if (!hasScope(context.scopes, scope)) {
+        throw new InsufficientScopeError([scope]);
+    }
+}
+/**
+ * Check if context has any of the required scopes
+ */
+export function requireAnyScope(context, scopes) {
+    if (!context.authenticated) {
+        throw new TokenMissingError();
+    }
+    if (!hasAnyScope(context.scopes, scopes)) {
+        throw new InsufficientScopeError(scopes);
+    }
+}
+/**
+ * Check if context has scope for a tool operation
+ */
+export function requireToolScope(context, requiredScopes) {
+    if (!context.authenticated) {
+        throw new TokenMissingError();
+    }
+    // Map tool required scopes to actual OAuth scopes
+    const mappedScopes = requiredScopes.map(scope => {
+        switch (scope) {
+            case 'read': return SCOPES.READ;
+            case 'write': return SCOPES.WRITE;
+            case 'admin': return SCOPES.ADMIN;
+            default: return scope;
+        }
+    });
+    if (!hasAnyScope(context.scopes, mappedScopes)) {
+        throw new InsufficientScopeError(mappedScopes);
+    }
+}
+/**
+ * Format OAuth error for HTTP response
+ */
+export function formatOAuthError(error) {
+    if (error instanceof TokenMissingError) {
+        return {
+            status: 401,
+            body: {
+                error: 'invalid_token',
+                error_description: error.message
+            }
+        };
+    }
+    if (error instanceof InvalidTokenError) {
+        return {
+            status: 401,
+            body: {
+                error: 'invalid_token',
+                error_description: error.message
+            }
+        };
+    }
+    if (error instanceof InsufficientScopeError) {
+        return {
+            status: 403,
+            body: {
+                error: 'insufficient_scope',
+                error_description: error.message,
+                scope: error.requiredScopes.join(' ')
+            }
+        };
+    }
+    // Generic error
+    return {
+        status: 500,
+        body: {
+            error: 'server_error',
+            error_description: 'Internal server error'
+        }
+    };
+}
+//# sourceMappingURL=middleware.js.map

package/dist/auth/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAC3F,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AA8B5D;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAA8B;IAC7D,IAAI,CAAC,UAAU,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC7D,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACnC,UAA8B,EAC9B,cAA8B;IAE9B,MAAM,KAAK,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAE7C,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAChD,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEpD,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAChD,CAAC;IAED,OAAO;QACH,aAAa,EAAE,IAAI;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;KAC/B,CAAC;AACN,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAC9B,UAA8B,EAC9B,MAA4B;IAE5B,MAAM,KAAK,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAE7C,6BAA6B;IAC7B,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC5B,MAAM,IAAI,iBAAiB,EAAE,CAAC;QAClC,CAAC;QACD,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAChD,CAAC;IAED,qBAAqB;IACrB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE3D,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,IAAI,iBAAiB,CAAC,MAAM,CAAC,KAAK,IAAI,eAAe,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,OAAO,GAAyB;QAClC,aAAa,EAAE,IAAI;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;KAC/B,CAAC;IAEF,wBAAwB;IACxB,IAAI,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,sBAAsB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC5D,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,OAA6B,EAAE,KAAa;IACrE,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACzB,MAAM,IAAI,iBAAiB,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,sBAAsB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9C,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,OAA6B,EAAE,MAAgB;IAC3E,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACzB,MAAM,IAAI,iBAAiB,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAA6B,EAAE,cAAwB;IACpF,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACzB,MAAM,IAAI,iBAAiB,EAAE,CAAC;IAClC,CAAC;IAED,kDAAkD;IAClD,MAAM,YAAY,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;QAC5C,QAAQ,KAAK,EAAE,CAAC;YACZ,KAAK,MAAM,CAAC,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC;YAChC,KAAK,OAAO,CAAC,CAAC,OAAO,MAAM,CAAC,KAAK,CAAC;YAClC,KAAK,OAAO,CAAC,CAAC,OAAO,MAAM,CAAC,KAAK,CAAC;YAClC,OAAO,CAAC,CAAC,OAAO,KAAK,CAAC;QAC1B,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACnD,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC3C,IAAI,KAAK,YAAY,iBAAiB,EAAE,CAAC;QACrC,OAAO;YACH,MAAM,EAAE,GAAG;YACX,IAAI,EAAE;gBACF,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EAAE,KAAK,CAAC,OAAO;aACnC;SACJ,CAAC;IACN,CAAC;IAED,IAAI,KAAK,YAAY,iBAAiB,EAAE,CAAC;QACrC,OAAO;YACH,MAAM,EAAE,GAAG;YACX,IAAI,EAAE;gBACF,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EAAE,KAAK,CAAC,OAAO;aACnC;SACJ,CAAC;IACN,CAAC;IAED,IAAI,KAAK,YAAY,sBAAsB,EAAE,CAAC;QAC1C,OAAO;YACH,MAAM,EAAE,GAAG;YACX,IAAI,EAAE;gBACF,KAAK,EAAE,oBAAoB;gBAC3B,iBAAiB,EAAE,KAAK,CAAC,OAAO;gBAChC,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;aACxC;SACJ,CAAC;IACN,CAAC;IAED,gBAAgB;IAChB,OAAO;QACH,MAAM,EAAE,GAAG;QACX,IAAI,EAAE;YACF,KAAK,EAAE,cAAc;YACrB,iBAAiB,EAAE,uBAAuB;SAC7C;KACJ,CAAC;AACN,CAAC"}

package/dist/auth/scopes.d.ts

@@ -0,0 +1,61 @@
+/**
+ * mysql-mcp - OAuth Scopes
+ *
+ * Scope definitions and utilities for MySQL MCP OAuth 2.0.
+ */
+import type { ToolGroup } from '../types/index.js';
+/**
+ * Standard OAuth scopes for mysql-mcp
+ */
+export declare const SCOPES: {
+    /** Read-only access to all databases */
+    readonly READ: "read";
+    /** Read and write access to all databases */
+    readonly WRITE: "write";
+    /** Administrative access (OPTIMIZE, ANALYZE, etc.) */
+    readonly ADMIN: "admin";
+    /** Full access to all operations */
+    readonly FULL: "full";
+};
+export type StandardScope = typeof SCOPES[keyof typeof SCOPES];
+/**
+ * All supported scopes including patterns
+ */
+export declare const ALL_SCOPES: readonly ["read", "write", "admin", "full"];
+/**
+ * Map tool groups to required minimum scopes
+ */
+export declare const TOOL_GROUP_SCOPES: Record<ToolGroup, StandardScope>;
+/**
+ * Parse scope string into array
+ */
+export declare function parseScopes(scopeString: string | undefined): string[];
+/**
+ * Check if granted scopes include the required scope
+ */
+export declare function hasScope(grantedScopes: string[], requiredScope: string): boolean;
+/**
+ * Check if granted scopes include any of the required scopes
+ */
+export declare function hasAnyScope(grantedScopes: string[], requiredScopes: string[]): boolean;
+/**
+ * Check if granted scopes include all of the required scopes
+ */
+export declare function hasAllScopes(grantedScopes: string[], requiredScopes: string[]): boolean;
+/**
+ * Get the required scope for a tool group
+ */
+export declare function getScopeForToolGroup(group: ToolGroup): StandardScope;
+/**
+ * Check if database-specific scope matches
+ */
+export declare function hasDatabaseScope(grantedScopes: string[], database: string): boolean;
+/**
+ * Check if table-specific scope matches
+ */
+export declare function hasTableScope(grantedScopes: string[], database: string, table: string): boolean;
+/**
+ * Get scope display name
+ */
+export declare function getScopeDisplayName(scope: string): string;
+//# sourceMappingURL=scopes.d.ts.map

package/dist/auth/scopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.d.ts","sourceRoot":"","sources":["../../src/auth/scopes.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAMnD;;GAEG;AACH,eAAO,MAAM,MAAM;IACf,wCAAwC;;IAGxC,6CAA6C;;IAG7C,sDAAsD;;IAGtD,oCAAoC;;CAE9B,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,OAAO,MAAM,CAAC,MAAM,OAAO,MAAM,CAAC,CAAC;AAE/D;;GAEG;AACH,eAAO,MAAM,UAAU,6CAMb,CAAC;AAMX;;GAEG;AACH,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,SAAS,EAAE,aAAa,CA0B9D,CAAC;AAMF;;GAEG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAGrE;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CA0BhF;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAEtF;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAEvF;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,SAAS,GAAG,aAAa,CAEpE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CASnF;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAc/F;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAezD"}

package/dist/auth/scopes.js

@@ -0,0 +1,167 @@
+/**
+ * mysql-mcp - OAuth Scopes
+ *
+ * Scope definitions and utilities for MySQL MCP OAuth 2.0.
+ */
+// =============================================================================
+// Scope Definitions
+// =============================================================================
+/**
+ * Standard OAuth scopes for mysql-mcp
+ */
+export const SCOPES = {
+    /** Read-only access to all databases */
+    READ: 'read',
+    /** Read and write access to all databases */
+    WRITE: 'write',
+    /** Administrative access (OPTIMIZE, ANALYZE, etc.) */
+    ADMIN: 'admin',
+    /** Full access to all operations */
+    FULL: 'full'
+};
+/**
+ * All supported scopes including patterns
+ */
+export const ALL_SCOPES = [
+    SCOPES.READ,
+    SCOPES.WRITE,
+    SCOPES.ADMIN,
+    SCOPES.FULL,
+    // Pattern scopes: db:{name}, table:{db}:{table}
+];
+// =============================================================================
+// Tool Group to Scope Mapping
+// =============================================================================
+/**
+ * Map tool groups to required minimum scopes
+ */
+export const TOOL_GROUP_SCOPES = {
+    core: SCOPES.READ,
+    json: SCOPES.READ,
+    text: SCOPES.READ,
+    fulltext: SCOPES.READ,
+    performance: SCOPES.READ,
+    optimization: SCOPES.READ,
+    monitoring: SCOPES.READ,
+    admin: SCOPES.ADMIN,
+    backup: SCOPES.ADMIN,
+    replication: SCOPES.ADMIN,
+    partitioning: SCOPES.ADMIN,
+    transactions: SCOPES.WRITE,
+    router: SCOPES.READ,
+    proxysql: SCOPES.READ,
+    shell: SCOPES.ADMIN,
+    // New tool groups (v2.0.0)
+    schema: SCOPES.READ,
+    events: SCOPES.ADMIN,
+    sysschema: SCOPES.READ,
+    stats: SCOPES.READ,
+    spatial: SCOPES.READ,
+    security: SCOPES.ADMIN,
+    cluster: SCOPES.READ,
+    roles: SCOPES.ADMIN,
+    docstore: SCOPES.WRITE
+};
+// =============================================================================
+// Scope Utilities
+// =============================================================================
+/**
+ * Parse scope string into array
+ */
+export function parseScopes(scopeString) {
+    if (!scopeString)
+        return [];
+    return scopeString.split(' ').filter(s => s.length > 0);
+}
+/**
+ * Check if granted scopes include the required scope
+ */
+export function hasScope(grantedScopes, requiredScope) {
+    // Full scope grants everything
+    if (grantedScopes.includes(SCOPES.FULL)) {
+        return true;
+    }
+    // Direct match
+    if (grantedScopes.includes(requiredScope)) {
+        return true;
+    }
+    // Admin scope includes write and read
+    if (requiredScope === SCOPES.READ || requiredScope === SCOPES.WRITE) {
+        if (grantedScopes.includes(SCOPES.ADMIN)) {
+            return true;
+        }
+    }
+    // Write scope includes read
+    if (requiredScope === SCOPES.READ) {
+        if (grantedScopes.includes(SCOPES.WRITE)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Check if granted scopes include any of the required scopes
+ */
+export function hasAnyScope(grantedScopes, requiredScopes) {
+    return requiredScopes.some(scope => hasScope(grantedScopes, scope));
+}
+/**
+ * Check if granted scopes include all of the required scopes
+ */
+export function hasAllScopes(grantedScopes, requiredScopes) {
+    return requiredScopes.every(scope => hasScope(grantedScopes, scope));
+}
+/**
+ * Get the required scope for a tool group
+ */
+export function getScopeForToolGroup(group) {
+    return TOOL_GROUP_SCOPES[group] ?? SCOPES.READ;
+}
+/**
+ * Check if database-specific scope matches
+ */
+export function hasDatabaseScope(grantedScopes, database) {
+    // Full or admin grants all databases
+    if (grantedScopes.includes(SCOPES.FULL) || grantedScopes.includes(SCOPES.ADMIN)) {
+        return true;
+    }
+    // Check for db:{name} pattern
+    const dbScope = `db:${database}`;
+    return grantedScopes.includes(dbScope);
+}
+/**
+ * Check if table-specific scope matches
+ */
+export function hasTableScope(grantedScopes, database, table) {
+    // Full or admin grants all tables
+    if (grantedScopes.includes(SCOPES.FULL) || grantedScopes.includes(SCOPES.ADMIN)) {
+        return true;
+    }
+    // Check for db:{name} scope (grants access to all tables in db)
+    if (hasDatabaseScope(grantedScopes, database)) {
+        return true;
+    }
+    // Check for table:{db}:{table} pattern
+    const tableScope = `table:${database}:${table}`;
+    return grantedScopes.includes(tableScope);
+}
+/**
+ * Get scope display name
+ */
+export function getScopeDisplayName(scope) {
+    switch (scope) {
+        case SCOPES.READ: return 'Read Only';
+        case SCOPES.WRITE: return 'Read/Write';
+        case SCOPES.ADMIN: return 'Administrative';
+        case SCOPES.FULL: return 'Full Access';
+        default:
+            if (scope.startsWith('db:')) {
+                return `Database: ${scope.slice(3)}`;
+            }
+            if (scope.startsWith('table:')) {
+                return `Table: ${scope.slice(6)}`;
+            }
+            return scope;
+    }
+}
+//# sourceMappingURL=scopes.js.map

package/dist/auth/scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.js","sourceRoot":"","sources":["../../src/auth/scopes.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG;IAClB,wCAAwC;IACxC,IAAI,EAAE,MAAM;IAEZ,6CAA6C;IAC7C,KAAK,EAAE,OAAO;IAEd,sDAAsD;IACtD,KAAK,EAAE,OAAO;IAEd,oCAAoC;IACpC,IAAI,EAAE,MAAM;CACN,CAAC;AAIX;;GAEG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG;IACtB,MAAM,CAAC,IAAI;IACX,MAAM,CAAC,KAAK;IACZ,MAAM,CAAC,KAAK;IACZ,MAAM,CAAC,IAAI;IACX,gDAAgD;CAC1C,CAAC;AAEX,gFAAgF;AAChF,8BAA8B;AAC9B,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAqC;IAC/D,IAAI,EAAE,MAAM,CAAC,IAAI;IACjB,IAAI,EAAE,MAAM,CAAC,IAAI;IACjB,IAAI,EAAE,MAAM,CAAC,IAAI;IACjB,QAAQ,EAAE,MAAM,CAAC,IAAI;IACrB,WAAW,EAAE,MAAM,CAAC,IAAI;IACxB,YAAY,EAAE,MAAM,CAAC,IAAI;IACzB,UAAU,EAAE,MAAM,CAAC,IAAI;IACvB,KAAK,EAAE,MAAM,CAAC,KAAK;IACnB,MAAM,EAAE,MAAM,CAAC,KAAK;IACpB,WAAW,EAAE,MAAM,CAAC,KAAK;IACzB,YAAY,EAAE,MAAM,CAAC,KAAK;IAC1B,YAAY,EAAE,MAAM,CAAC,KAAK;IAC1B,MAAM,EAAE,MAAM,CAAC,IAAI;IACnB,QAAQ,EAAE,MAAM,CAAC,IAAI;IACrB,KAAK,EAAE,MAAM,CAAC,KAAK;IACnB,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAC,IAAI;IACnB,MAAM,EAAE,MAAM,CAAC,KAAK;IACpB,SAAS,EAAE,MAAM,CAAC,IAAI;IACtB,KAAK,EAAE,MAAM,CAAC,IAAI;IAClB,OAAO,EAAE,MAAM,CAAC,IAAI;IACpB,QAAQ,EAAE,MAAM,CAAC,KAAK;IACtB,OAAO,EAAE,MAAM,CAAC,IAAI;IACpB,KAAK,EAAE,MAAM,CAAC,KAAK;IACnB,QAAQ,EAAE,MAAM,CAAC,KAAK;CACzB,CAAC;AAEF,gFAAgF;AAChF,kBAAkB;AAClB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,WAA+B;IACvD,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,CAAC;IAC5B,OAAO,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,aAAuB,EAAE,aAAqB;IACnE,+BAA+B;IAC/B,IAAI,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,eAAe;IACf,IAAI,aAAa,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,sCAAsC;IACtC,IAAI,aAAa,KAAK,MAAM,CAAC,IAAI,IAAI,aAAa,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;QAClE,IAAI,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IAED,4BAA4B;IAC5B,IAAI,aAAa,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,aAAuB,EAAE,cAAwB;IACzE,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC;AACxE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,aAAuB,EAAE,cAAwB;IAC1E,OAAO,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC;AACzE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAgB;IACjD,OAAO,iBAAiB,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC;AACnD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,aAAuB,EAAE,QAAgB;IACtE,qCAAqC;IACrC,IAAI,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,8BAA8B;IAC9B,MAAM,OAAO,GAAG,MAAM,QAAQ,EAAE,CAAC;IACjC,OAAO,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,aAAuB,EAAE,QAAgB,EAAE,KAAa;IAClF,kCAAkC;IAClC,IAAI,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,gEAAgE;IAChE,IAAI,gBAAgB,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,uCAAuC;IACvC,MAAM,UAAU,GAAG,SAAS,QAAQ,IAAI,KAAK,EAAE,CAAC;IAChD,OAAO,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC7C,QAAQ,KAAK,EAAE,CAAC;QACZ,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,WAAW,CAAC;QACrC,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,YAAY,CAAC;QACvC,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,gBAAgB,CAAC;QAC3C,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,aAAa,CAAC;QACvC;YACI,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,aAAa,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,CAAC;YACD,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7B,OAAO,UAAU,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACtC,CAAC;YACD,OAAO,KAAK,CAAC;IACrB,CAAC;AACL,CAAC"}