@neverinfamous/postgres-mcp 1.0.1

package/dist/auth/errors.d.ts

@@ -0,0 +1,63 @@
+/**
+ * postgres-mcp - OAuth Errors
+ *
+ * Error classes for OAuth 2.0 authentication and authorization.
+ */
+/**
+ * Base OAuth error class
+ */
+export declare class OAuthError extends Error {
+    readonly code: string;
+    readonly httpStatus: number;
+    constructor(message: string, code: string, httpStatus?: number);
+}
+/**
+ * Token missing from request
+ */
+export declare class TokenMissingError extends OAuthError {
+    constructor(message?: string);
+}
+/**
+ * Token is invalid (malformed, wrong signature, etc.)
+ */
+export declare class InvalidTokenError extends OAuthError {
+    constructor(message?: string);
+}
+/**
+ * Token has expired
+ */
+export declare class TokenExpiredError extends OAuthError {
+    constructor(message?: string);
+}
+/**
+ * Token signature is invalid
+ */
+export declare class InvalidSignatureError extends OAuthError {
+    constructor(message?: string);
+}
+/**
+ * Token lacks required scope
+ */
+export declare class InsufficientScopeError extends OAuthError {
+    readonly requiredScopes: string[];
+    constructor(requiredScopes: string[], message?: string);
+}
+/**
+ * Authorization server discovery failed
+ */
+export declare class AuthServerDiscoveryError extends OAuthError {
+    constructor(message?: string);
+}
+/**
+ * JWKS fetch failed
+ */
+export declare class JwksFetchError extends OAuthError {
+    constructor(message?: string);
+}
+/**
+ * Client registration failed
+ */
+export declare class ClientRegistrationError extends OAuthError {
+    constructor(message?: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/auth/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/auth/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AACH,qBAAa,UAAW,SAAQ,KAAK;IACnC,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,UAAU,EAAE,MAAM,CAAC;gBAEvB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,SAAM;CAO5D;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,UAAU;gBACnC,OAAO,SAA6B;CAKjD;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,UAAU;gBACnC,OAAO,SAAyB;CAK7C;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,UAAU;gBACnC,OAAO,SAA6B;CAKjD;AAED;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,UAAU;gBACvC,OAAO,SAA4B;CAKhD;AAED;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,UAAU;IACpD,SAAgB,cAAc,EAAE,MAAM,EAAE,CAAC;gBAE7B,cAAc,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM;CAUvD;AAED;;GAEG;AACH,qBAAa,wBAAyB,SAAQ,UAAU;gBAC1C,OAAO,SAAqD;CAKzE;AAED;;GAEG;AACH,qBAAa,cAAe,SAAQ,UAAU;gBAChC,OAAO,SAAyB;CAK7C;AAED;;GAEG;AACH,qBAAa,uBAAwB,SAAQ,UAAU;gBACzC,OAAO,SAA+B;CAKnD"}

package/dist/auth/errors.js

@@ -0,0 +1,102 @@
+/**
+ * postgres-mcp - OAuth Errors
+ *
+ * Error classes for OAuth 2.0 authentication and authorization.
+ */
+/**
+ * Base OAuth error class
+ */
+export class OAuthError extends Error {
+    code;
+    httpStatus;
+    constructor(message, code, httpStatus = 401) {
+        super(message);
+        this.name = "OAuthError";
+        this.code = code;
+        this.httpStatus = httpStatus;
+        Object.setPrototypeOf(this, OAuthError.prototype);
+    }
+}
+/**
+ * Token missing from request
+ */
+export class TokenMissingError extends OAuthError {
+    constructor(message = "No bearer token provided") {
+        super(message, "TOKEN_MISSING", 401);
+        this.name = "TokenMissingError";
+        Object.setPrototypeOf(this, TokenMissingError.prototype);
+    }
+}
+/**
+ * Token is invalid (malformed, wrong signature, etc.)
+ */
+export class InvalidTokenError extends OAuthError {
+    constructor(message = "Invalid access token") {
+        super(message, "INVALID_TOKEN", 401);
+        this.name = "InvalidTokenError";
+        Object.setPrototypeOf(this, InvalidTokenError.prototype);
+    }
+}
+/**
+ * Token has expired
+ */
+export class TokenExpiredError extends OAuthError {
+    constructor(message = "Access token has expired") {
+        super(message, "TOKEN_EXPIRED", 401);
+        this.name = "TokenExpiredError";
+        Object.setPrototypeOf(this, TokenExpiredError.prototype);
+    }
+}
+/**
+ * Token signature is invalid
+ */
+export class InvalidSignatureError extends OAuthError {
+    constructor(message = "Invalid token signature") {
+        super(message, "INVALID_SIGNATURE", 401);
+        this.name = "InvalidSignatureError";
+        Object.setPrototypeOf(this, InvalidSignatureError.prototype);
+    }
+}
+/**
+ * Token lacks required scope
+ */
+export class InsufficientScopeError extends OAuthError {
+    requiredScopes;
+    constructor(requiredScopes, message) {
+        super(message ?? `Insufficient scope. Required: ${requiredScopes.join(", ")}`, "INSUFFICIENT_SCOPE", 403);
+        this.name = "InsufficientScopeError";
+        this.requiredScopes = requiredScopes;
+        Object.setPrototypeOf(this, InsufficientScopeError.prototype);
+    }
+}
+/**
+ * Authorization server discovery failed
+ */
+export class AuthServerDiscoveryError extends OAuthError {
+    constructor(message = "Failed to discover authorization server metadata") {
+        super(message, "DISCOVERY_FAILED", 500);
+        this.name = "AuthServerDiscoveryError";
+        Object.setPrototypeOf(this, AuthServerDiscoveryError.prototype);
+    }
+}
+/**
+ * JWKS fetch failed
+ */
+export class JwksFetchError extends OAuthError {
+    constructor(message = "Failed to fetch JWKS") {
+        super(message, "JWKS_FETCH_FAILED", 500);
+        this.name = "JwksFetchError";
+        Object.setPrototypeOf(this, JwksFetchError.prototype);
+    }
+}
+/**
+ * Client registration failed
+ */
+export class ClientRegistrationError extends OAuthError {
+    constructor(message = "Client registration failed") {
+        super(message, "REGISTRATION_FAILED", 400);
+        this.name = "ClientRegistrationError";
+        Object.setPrototypeOf(this, ClientRegistrationError.prototype);
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/auth/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/auth/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AACH,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnB,IAAI,CAAS;IACb,UAAU,CAAS;IAEnC,YAAY,OAAe,EAAE,IAAY,EAAE,UAAU,GAAG,GAAG;QACzD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,iBAAkB,SAAQ,UAAU;IAC/C,YAAY,OAAO,GAAG,0BAA0B;QAC9C,KAAK,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC3D,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,iBAAkB,SAAQ,UAAU;IAC/C,YAAY,OAAO,GAAG,sBAAsB;QAC1C,KAAK,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC3D,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,iBAAkB,SAAQ,UAAU;IAC/C,YAAY,OAAO,GAAG,0BAA0B;QAC9C,KAAK,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC3D,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,qBAAsB,SAAQ,UAAU;IACnD,YAAY,OAAO,GAAG,yBAAyB;QAC7C,KAAK,CAAC,OAAO,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC/D,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,sBAAuB,SAAQ,UAAU;IACpC,cAAc,CAAW;IAEzC,YAAY,cAAwB,EAAE,OAAgB;QACpD,KAAK,CACH,OAAO,IAAI,iCAAiC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACvE,oBAAoB,EACpB,GAAG,CACJ,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAChE,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,wBAAyB,SAAQ,UAAU;IACtD,YAAY,OAAO,GAAG,kDAAkD;QACtE,KAAK,CAAC,OAAO,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,wBAAwB,CAAC,SAAS,CAAC,CAAC;IAClE,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,cAAe,SAAQ,UAAU;IAC5C,YAAY,OAAO,GAAG,sBAAsB;QAC1C,KAAK,CAAC,OAAO,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC;IACxD,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,uBAAwB,SAAQ,UAAU;IACrD,YAAY,OAAO,GAAG,4BAA4B;QAChD,KAAK,CAAC,OAAO,EAAE,qBAAqB,EAAE,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,uBAAuB,CAAC,SAAS,CAAC,CAAC;IACjE,CAAC;CACF"}

package/dist/auth/index.d.ts

@@ -0,0 +1,15 @@
+/**
+ * postgres-mcp - Auth Module
+ *
+ * OAuth 2.0 authentication and authorization for PostgreSQL MCP Server.
+ */
+export type { ProtectedResourceMetadata, AuthorizationServerMetadata, ClientRegistrationRequest, ClientRegistrationResponse, JWK, JWKSDocument, TokenValidationResult, TokenClaims, ResourceServerConfig, TokenValidatorConfig, AuthServerDiscoveryConfig, } from "./types.js";
+export { OAuthError, TokenMissingError, InvalidTokenError, TokenExpiredError, InvalidSignatureError, InsufficientScopeError, AuthServerDiscoveryError, JwksFetchError, ClientRegistrationError, } from "./errors.js";
+export { SCOPES, ALL_SCOPES, TOOL_GROUP_SCOPES, parseScopes, hasScope, hasAnyScope, hasAllScopes, getScopeForToolGroup, hasDatabaseScope, hasSchemaScope, hasTableScope, getScopeDisplayName, } from "./scopes.js";
+export type { StandardScope } from "./scopes.js";
+export { TokenValidator, createTokenValidator } from "./TokenValidator.js";
+export { AuthorizationServerDiscovery, createAuthServerDiscovery, } from "./AuthorizationServerDiscovery.js";
+export { OAuthResourceServer, createOAuthResourceServer, } from "./OAuthResourceServer.js";
+export { extractBearerToken, createAuthContext, validateAuth, requireScope, requireAnyScope, requireToolScope, formatOAuthError, } from "./middleware.js";
+export type { AuthenticatedContext, AuthMiddlewareConfig, } from "./middleware.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,YAAY,EACV,yBAAyB,EACzB,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,GAAG,EACH,YAAY,EACZ,qBAAqB,EACrB,WAAW,EACX,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,wBAAwB,EACxB,cAAc,EACd,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,MAAM,EACN,UAAU,EACV,iBAAiB,EACjB,WAAW,EACX,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,mBAAmB,GACpB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGjD,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC"}

package/dist/auth/index.js

@@ -0,0 +1,16 @@
+/**
+ * postgres-mcp - Auth Module
+ *
+ * OAuth 2.0 authentication and authorization for PostgreSQL MCP Server.
+ */
+// Errors
+export { OAuthError, TokenMissingError, InvalidTokenError, TokenExpiredError, InvalidSignatureError, InsufficientScopeError, AuthServerDiscoveryError, JwksFetchError, ClientRegistrationError, } from "./errors.js";
+// Scopes
+export { SCOPES, ALL_SCOPES, TOOL_GROUP_SCOPES, parseScopes, hasScope, hasAnyScope, hasAllScopes, getScopeForToolGroup, hasDatabaseScope, hasSchemaScope, hasTableScope, getScopeDisplayName, } from "./scopes.js";
+// Components
+export { TokenValidator, createTokenValidator } from "./TokenValidator.js";
+export { AuthorizationServerDiscovery, createAuthServerDiscovery, } from "./AuthorizationServerDiscovery.js";
+export { OAuthResourceServer, createOAuthResourceServer, } from "./OAuthResourceServer.js";
+// Middleware
+export { extractBearerToken, createAuthContext, validateAuth, requireScope, requireAnyScope, requireToolScope, formatOAuthError, } from "./middleware.js";
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAiBH,SAAS;AACT,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,wBAAwB,EACxB,cAAc,EACd,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAErB,SAAS;AACT,OAAO,EACL,MAAM,EACN,UAAU,EACV,iBAAiB,EACjB,WAAW,EACX,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAGrB,aAAa;AACb,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAElC,aAAa;AACb,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,iBAAiB,CAAC"}

package/dist/auth/middleware.d.ts

@@ -0,0 +1,61 @@
+/**
+ * postgres-mcp - OAuth Middleware
+ *
+ * Authentication and authorization middleware for HTTP transport.
+ */
+import type { TokenClaims } from "./types.js";
+import type { TokenValidator } from "./TokenValidator.js";
+/**
+ * Authenticated request context
+ */
+export interface AuthenticatedContext {
+    /** Whether request is authenticated */
+    authenticated: boolean;
+    /** Token claims (if authenticated) */
+    claims?: TokenClaims;
+    /** Token scopes (convenience) */
+    scopes: string[];
+}
+/**
+ * Auth middleware configuration
+ */
+export interface AuthMiddlewareConfig {
+    /** Token validator instance */
+    tokenValidator: TokenValidator;
+    /** Whether to require authentication (default: true) */
+    required?: boolean;
+    /** Required scopes (any of these) */
+    requiredScopes?: string[];
+}
+/**
+ * Extract bearer token from Authorization header
+ */
+export declare function extractBearerToken(authHeader: string | undefined): string | null;
+/**
+ * Create authentication context from request
+ */
+export declare function createAuthContext(authHeader: string | undefined, tokenValidator: TokenValidator): Promise<AuthenticatedContext>;
+/**
+ * Validate authentication and authorization
+ */
+export declare function validateAuth(authHeader: string | undefined, config: AuthMiddlewareConfig): Promise<AuthenticatedContext>;
+/**
+ * Check if context has required scope
+ */
+export declare function requireScope(context: AuthenticatedContext, scope: string): void;
+/**
+ * Check if context has any of the required scopes
+ */
+export declare function requireAnyScope(context: AuthenticatedContext, scopes: string[]): void;
+/**
+ * Check if context has scope for a tool operation
+ */
+export declare function requireToolScope(context: AuthenticatedContext, requiredScopes: string[]): void;
+/**
+ * Format OAuth error for HTTP response
+ */
+export declare function formatOAuthError(error: unknown): {
+    status: number;
+    body: object;
+};
+//# sourceMappingURL=middleware.d.ts.map

package/dist/auth/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAQ1D;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,uCAAuC;IACvC,aAAa,EAAE,OAAO,CAAC;IAEvB,sCAAsC;IACtC,MAAM,CAAC,EAAE,WAAW,CAAC;IAErB,iCAAiC;IACjC,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,+BAA+B;IAC/B,cAAc,EAAE,cAAc,CAAC;IAE/B,wDAAwD;IACxD,QAAQ,CAAC,EAAE,OAAO,CAAC;IAEnB,qCAAqC;IACrC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,MAAM,GAAG,IAAI,CAWf;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,cAAc,EAAE,cAAc,GAC7B,OAAO,CAAC,oBAAoB,CAAC,CAkB/B;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,oBAAoB,CAAC,CAgC/B;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,oBAAoB,EAC7B,KAAK,EAAE,MAAM,GACZ,IAAI,CAQN;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,oBAAoB,EAC7B,MAAM,EAAE,MAAM,EAAE,GACf,IAAI,CAQN;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,oBAAoB,EAC7B,cAAc,EAAE,MAAM,EAAE,GACvB,IAAI,CAsBN;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd,CAwCA"}

package/dist/auth/middleware.js

@@ -0,0 +1,156 @@
+/**
+ * postgres-mcp - OAuth Middleware
+ *
+ * Authentication and authorization middleware for HTTP transport.
+ */
+import { TokenMissingError, InvalidTokenError, InsufficientScopeError, } from "./errors.js";
+import { hasScope, hasAnyScope, SCOPES } from "./scopes.js";
+/**
+ * Extract bearer token from Authorization header
+ */
+export function extractBearerToken(authHeader) {
+    if (!authHeader) {
+        return null;
+    }
+    const parts = authHeader.split(" ");
+    if (parts.length !== 2 || parts[0]?.toLowerCase() !== "bearer") {
+        return null;
+    }
+    return parts[1] ?? null;
+}
+/**
+ * Create authentication context from request
+ */
+export async function createAuthContext(authHeader, tokenValidator) {
+    const token = extractBearerToken(authHeader);
+    if (!token) {
+        return { authenticated: false, scopes: [] };
+    }
+    const result = await tokenValidator.validate(token);
+    if (!result.valid || !result.claims) {
+        return { authenticated: false, scopes: [] };
+    }
+    return {
+        authenticated: true,
+        claims: result.claims,
+        scopes: result.claims.scopes,
+    };
+}
+/**
+ * Validate authentication and authorization
+ */
+export async function validateAuth(authHeader, config) {
+    const token = extractBearerToken(authHeader);
+    // Check if token is required
+    if (!token) {
+        if (config.required !== false) {
+            throw new TokenMissingError();
+        }
+        return { authenticated: false, scopes: [] };
+    }
+    // Validate the token
+    const result = await config.tokenValidator.validate(token);
+    if (!result.valid || !result.claims) {
+        throw new InvalidTokenError(result.error ?? "Invalid token");
+    }
+    const context = {
+        authenticated: true,
+        claims: result.claims,
+        scopes: result.claims.scopes,
+    };
+    // Check required scopes
+    if (config.requiredScopes && config.requiredScopes.length > 0) {
+        if (!hasAnyScope(context.scopes, config.requiredScopes)) {
+            throw new InsufficientScopeError(config.requiredScopes);
+        }
+    }
+    return context;
+}
+/**
+ * Check if context has required scope
+ */
+export function requireScope(context, scope) {
+    if (!context.authenticated) {
+        throw new TokenMissingError();
+    }
+    if (!hasScope(context.scopes, scope)) {
+        throw new InsufficientScopeError([scope]);
+    }
+}
+/**
+ * Check if context has any of the required scopes
+ */
+export function requireAnyScope(context, scopes) {
+    if (!context.authenticated) {
+        throw new TokenMissingError();
+    }
+    if (!hasAnyScope(context.scopes, scopes)) {
+        throw new InsufficientScopeError(scopes);
+    }
+}
+/**
+ * Check if context has scope for a tool operation
+ */
+export function requireToolScope(context, requiredScopes) {
+    if (!context.authenticated) {
+        throw new TokenMissingError();
+    }
+    // Map tool required scopes to actual OAuth scopes
+    const mappedScopes = requiredScopes.map((scope) => {
+        switch (scope) {
+            case "read":
+                return SCOPES.READ;
+            case "write":
+                return SCOPES.WRITE;
+            case "admin":
+                return SCOPES.ADMIN;
+            default:
+                return scope;
+        }
+    });
+    if (!hasAnyScope(context.scopes, mappedScopes)) {
+        throw new InsufficientScopeError(mappedScopes);
+    }
+}
+/**
+ * Format OAuth error for HTTP response
+ */
+export function formatOAuthError(error) {
+    if (error instanceof TokenMissingError) {
+        return {
+            status: 401,
+            body: {
+                error: "invalid_token",
+                error_description: error.message,
+            },
+        };
+    }
+    if (error instanceof InvalidTokenError) {
+        return {
+            status: 401,
+            body: {
+                error: "invalid_token",
+                error_description: error.message,
+            },
+        };
+    }
+    if (error instanceof InsufficientScopeError) {
+        return {
+            status: 403,
+            body: {
+                error: "insufficient_scope",
+                error_description: error.message,
+                scope: error.requiredScopes.join(" "),
+            },
+        };
+    }
+    // Generic error
+    return {
+        status: 500,
+        body: {
+            error: "server_error",
+            error_description: "Internal server error",
+        },
+    };
+}
+//# sourceMappingURL=middleware.js.map

package/dist/auth/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AA8B5D;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAChC,UAA8B;IAE9B,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,UAA8B,EAC9B,cAA8B;IAE9B,MAAM,KAAK,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAE7C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEpD,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACpC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC9C,CAAC;IAED,OAAO;QACL,aAAa,EAAE,IAAI;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;KAC7B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,UAA8B,EAC9B,MAA4B;IAE5B,MAAM,KAAK,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAE7C,6BAA6B;IAC7B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC9B,MAAM,IAAI,iBAAiB,EAAE,CAAC;QAChC,CAAC;QACD,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC9C,CAAC;IAED,qBAAqB;IACrB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE3D,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,iBAAiB,CAAC,MAAM,CAAC,KAAK,IAAI,eAAe,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,OAAO,GAAyB;QACpC,aAAa,EAAE,IAAI;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;KAC7B,CAAC;IAEF,wBAAwB;IACxB,IAAI,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,sBAAsB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAC1B,OAA6B,EAC7B,KAAa;IAEb,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC3B,MAAM,IAAI,iBAAiB,EAAE,CAAC;IAChC,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,sBAAsB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,OAA6B,EAC7B,MAAgB;IAEhB,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC3B,MAAM,IAAI,iBAAiB,EAAE,CAAC;IAChC,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAA6B,EAC7B,cAAwB;IAExB,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC3B,MAAM,IAAI,iBAAiB,EAAE,CAAC;IAChC,CAAC;IAED,kDAAkD;IAClD,MAAM,YAAY,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAChD,QAAQ,KAAK,EAAE,CAAC;YACd,KAAK,MAAM;gBACT,OAAO,MAAM,CAAC,IAAI,CAAC;YACrB,KAAK,OAAO;gBACV,OAAO,MAAM,CAAC,KAAK,CAAC;YACtB,KAAK,OAAO;gBACV,OAAO,MAAM,CAAC,KAAK,CAAC;YACtB;gBACE,OAAO,KAAK,CAAC;QACjB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAI7C,IAAI,KAAK,YAAY,iBAAiB,EAAE,CAAC;QACvC,OAAO;YACL,MAAM,EAAE,GAAG;YACX,IAAI,EAAE;gBACJ,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EAAE,KAAK,CAAC,OAAO;aACjC;SACF,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,YAAY,iBAAiB,EAAE,CAAC;QACvC,OAAO;YACL,MAAM,EAAE,GAAG;YACX,IAAI,EAAE;gBACJ,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EAAE,KAAK,CAAC,OAAO;aACjC;SACF,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,YAAY,sBAAsB,EAAE,CAAC;QAC5C,OAAO;YACL,MAAM,EAAE,GAAG;YACX,IAAI,EAAE;gBACJ,KAAK,EAAE,oBAAoB;gBAC3B,iBAAiB,EAAE,KAAK,CAAC,OAAO;gBAChC,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;aACtC;SACF,CAAC;IACJ,CAAC;IAED,gBAAgB;IAChB,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE;YACJ,KAAK,EAAE,cAAc;YACrB,iBAAiB,EAAE,uBAAuB;SAC3C;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/scopes.d.ts

@@ -0,0 +1,65 @@
+/**
+ * postgres-mcp - OAuth Scopes
+ *
+ * Scope definitions and utilities for PostgreSQL MCP OAuth 2.0.
+ */
+import type { ToolGroup } from "../types/index.js";
+/**
+ * Standard OAuth scopes for postgres-mcp
+ */
+export declare const SCOPES: {
+    /** Read-only access to all databases */
+    readonly READ: "read";
+    /** Read and write access to all databases */
+    readonly WRITE: "write";
+    /** Administrative access (VACUUM, ANALYZE, etc.) */
+    readonly ADMIN: "admin";
+    /** Full access to all operations */
+    readonly FULL: "full";
+};
+export type StandardScope = (typeof SCOPES)[keyof typeof SCOPES];
+/**
+ * All supported scopes including patterns
+ */
+export declare const ALL_SCOPES: readonly ["read", "write", "admin", "full"];
+/**
+ * Map PostgreSQL tool groups to required minimum scopes
+ */
+export declare const TOOL_GROUP_SCOPES: Record<ToolGroup, StandardScope>;
+/**
+ * Parse scope string into array
+ */
+export declare function parseScopes(scopeString: string | undefined): string[];
+/**
+ * Check if granted scopes include the required scope
+ */
+export declare function hasScope(grantedScopes: string[], requiredScope: string): boolean;
+/**
+ * Check if granted scopes include any of the required scopes
+ */
+export declare function hasAnyScope(grantedScopes: string[], requiredScopes: string[]): boolean;
+/**
+ * Check if granted scopes include all of the required scopes
+ */
+export declare function hasAllScopes(grantedScopes: string[], requiredScopes: string[]): boolean;
+/**
+ * Get the required scope for a tool group
+ */
+export declare function getScopeForToolGroup(group: ToolGroup): StandardScope;
+/**
+ * Check if database-specific scope matches
+ */
+export declare function hasDatabaseScope(grantedScopes: string[], database: string): boolean;
+/**
+ * Check if schema-specific scope matches
+ */
+export declare function hasSchemaScope(grantedScopes: string[], schema: string): boolean;
+/**
+ * Check if table-specific scope matches
+ */
+export declare function hasTableScope(grantedScopes: string[], schema: string, table: string): boolean;
+/**
+ * Get scope display name
+ */
+export declare function getScopeDisplayName(scope: string): string;
+//# sourceMappingURL=scopes.d.ts.map

package/dist/auth/scopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.d.ts","sourceRoot":"","sources":["../../src/auth/scopes.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAMnD;;GAEG;AACH,eAAO,MAAM,MAAM;IACjB,wCAAwC;;IAGxC,6CAA6C;;IAG7C,oDAAoD;;IAGpD,oCAAoC;;CAE5B,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,MAAM,CAAC,CAAC,MAAM,OAAO,MAAM,CAAC,CAAC;AAEjE;;GAEG;AACH,eAAO,MAAM,UAAU,6CAMb,CAAC;AAMX;;GAEG;AACH,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,SAAS,EAAE,aAAa,CA8B9D,CAAC;AAMF;;GAEG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAGrE;AAED;;GAEG;AACH,wBAAgB,QAAQ,CACtB,aAAa,EAAE,MAAM,EAAE,EACvB,aAAa,EAAE,MAAM,GACpB,OAAO,CA0BT;AAED;;GAEG;AACH,wBAAgB,WAAW,CACzB,aAAa,EAAE,MAAM,EAAE,EACvB,cAAc,EAAE,MAAM,EAAE,GACvB,OAAO,CAET;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC1B,aAAa,EAAE,MAAM,EAAE,EACvB,cAAc,EAAE,MAAM,EAAE,GACvB,OAAO,CAET;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,SAAS,GAAG,aAAa,CAEpE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,aAAa,EAAE,MAAM,EAAE,EACvB,QAAQ,EAAE,MAAM,GACf,OAAO,CAYT;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,aAAa,EAAE,MAAM,EAAE,EACvB,MAAM,EAAE,MAAM,GACb,OAAO,CAYT;AAED;;GAEG;AACH,wBAAgB,aAAa,CAC3B,aAAa,EAAE,MAAM,EAAE,EACvB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAiBT;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAsBzD"}