@ni-c/mcp-hub 0.10.0 → 0.11.0

package/dist/auth/headers.js

@@ -7,7 +7,7 @@
  * sits there with no visible error, so the pages have to name the one origin
  * their flow legitimately ends on.
  */
-export function contentSecurityPolicy(formActionOrigins = []) {
+function contentSecurityPolicy(formActionOrigins = []) {
     const formAction = ["'self'", ...formActionOrigins].join(' ');
     return `default-src 'none'; style-src 'unsafe-inline'; form-action ${formAction}; frame-ancestors 'none'; base-uri 'none'`;
 }
@@ -30,4 +30,25 @@ export function allowFormActionTo(res, redirectUri) {
         return;
     res.set('Content-Security-Policy', contentSecurityPolicy([origin]));
 }
+/**
+ * The headers every page and token response of the auth surface carries.
+ *
+ * Shared rather than repeated: the mounted authorization server is a Koa app
+ * the Express router never enters, so these have to be put in front of it
+ * explicitly -- and two copies of the list would drift the moment one of them
+ * gained a header.
+ *
+ * RFC 6749 §5.1 requires `no-store` on token responses; the login form has no
+ * business being cached either. The CSP and the legacy frame header keep an
+ * attacker from clickjacking approval or password entry. This application has
+ * no legitimate framing use case.
+ */
+export const authSecurityHeaders = (_req, res, next) => {
+    res.set('Cache-Control', 'no-store');
+    res.set('Content-Security-Policy', contentSecurityPolicy());
+    res.set('X-Frame-Options', 'DENY');
+    res.set('X-Content-Type-Options', 'nosniff');
+    res.set('Referrer-Policy', 'no-referrer');
+    next();
+};
 //# sourceMappingURL=headers.js.map

package/dist/auth/headers.js.map

@@ -1 +1 @@
-{"version":3,"file":"headers.js","sourceRoot":"","sources":["../../src/auth/headers.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,iBAAiB,GAAsB,EAAE;IAC7E,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,GAAG,iBAAiB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9D,OAAO,8DAA8D,UAAU,2CAA2C,CAAC;AAC7H,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAa,EAAE,WAAmB;IAClE,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,4EAA4E;IACtF,CAAC;IACD,uEAAuE;IACvE,qEAAqE;IACrE,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO;IAC9B,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACtE,CAAC"}
+{"version":3,"file":"headers.js","sourceRoot":"","sources":["../../src/auth/headers.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AACH,SAAS,qBAAqB,CAAC,iBAAiB,GAAsB,EAAE;IACtE,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,GAAG,iBAAiB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9D,OAAO,8DAA8D,UAAU,2CAA2C,CAAC;AAC7H,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAa,EAAE,WAAmB;IAClE,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,4EAA4E;IACtF,CAAC;IACD,uEAAuE;IACvE,qEAAqE;IACrE,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO;IAC9B,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACrE,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IACrC,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAC5D,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;IACnC,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;IAC7C,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAC1C,IAAI,EAAE,CAAC;AACT,CAAC,CAAC"}

package/dist/auth/oidc/adapter.js

@@ -0,0 +1,135 @@
+import { errors } from 'oidc-provider';
+import { isClientIdMetadataUrl } from '../cimd.js';
+import { withoutPhantomSecret } from './quirks.js';
+/**
+ * oidc-provider's ten models, all backed by the one `AuthStore` the hub already
+ * serialises every other write through.
+ *
+ * The store is not replaced by this and does not shrink: API tokens, upstream
+ * credentials and the cross-process lock the admin CLI shares are mcp-hub's own
+ * concepts and have nothing to do with the authorization server. What this adds
+ * is a flat artifact slot the library owns the shape of.
+ *
+ * Two behaviours are deliberately in the store rather than here:
+ *
+ *   - the `revokedBefore` cutoff, because `find()` returning falsy IS the
+ *     revocation as far as the library is concerned (base_model.js treats any
+ *     falsy return as "not found"), and
+ *   - `consumed`, because a consumed authorization code has to be
+ *     distinguishable from an unknown one or replay detection cannot work.
+ */
+export function createOidcAdapter(store, cimd) {
+    return (model) => (model === 'Client' ? clientAdapter(store, cimd) : artifactAdapter(store, model));
+}
+/**
+ * Clients are NOT stored in the generic artifact slot.
+ *
+ * `mcp-hub-admin clients list|prune|revoke`, the ceiling on unapproved clients,
+ * the activity stamps behind ageing registrations out, and the approval records
+ * all read `state.clients`. Putting oidc-provider's clients anywhere else would
+ * leave the admin CLI looking at an empty hub while the authorization server
+ * happily served a full one — two stores, one truth, no error message.
+ *
+ * The shapes already agree: both are RFC 7591 metadata keyed by `client_id`.
+ */
+function clientAdapter(store, cimd) {
+    return {
+        async upsert(id, payload) {
+            // A public client's record must not carry a secret; see withoutPhantomSecret.
+            const record = { ...withoutPhantomSecret(payload), client_id: id };
+            // A NEW client goes through addClient, which is what enforces the ceiling
+            // on unapproved registrations and creates the lifecycle entry the
+            // activity stamps and `mcp-hub-admin clients prune` are built on. Writing
+            // it with saveClient would leave a client nothing ages out.
+            if (store.getClient(id)) {
+                store.updateClient(record);
+                return;
+            }
+            // False means the hub is full of clients that were all confirmed, and
+            // dropping one of those would take a connector somebody uses offline.
+            // Refusing the newcomer is the failure an operator can see and fix, so it
+            // has to surface rather than be swallowed into a successful-looking
+            // registration that stored nothing.
+            if (!store.addClient(record)) {
+                const full = new errors.OIDCProviderError(400, 'too_many_requests');
+                full.error_description = 'the hub is not accepting new client registrations right now';
+                throw full;
+            }
+        },
+        /**
+         * Client ID Metadata Documents are resolved HERE, deliberately.
+         *
+         * models/client.js consults the adapter BEFORE its own metadata-document
+         * fetcher, so returning the document from here means oidc-provider's
+         * fetcher is never reached — and the hub keeps a materially stricter
+         * policy than the library's: DNS pinning against rebinding, an origin
+         * allowlist, per-origin failure counting so distinct client_ids on one host
+         * cannot be used to hammer it, and negative caching. oidc-provider has none
+         * of those. `allowFetch` is wired to refuse, so the built-in path stays
+         * closed even if this returns nothing.
+         *
+         * Nothing is written: a CIMD client is not registered, which is the point
+         * of it — the client reinstalls and is still the same client.
+         */
+        async find(id) {
+            const registered = store.getClient(id);
+            if (registered)
+                return registered;
+            if (cimd && isClientIdMetadataUrl(id)) {
+                return (await cimd.resolve(id));
+            }
+            return undefined;
+        },
+        async findByUid() {
+            return undefined;
+        },
+        async findByUserCode() {
+            return undefined;
+        },
+        async consume() {
+            // Clients are not single-use.
+        },
+        async destroy(id) {
+            store.deleteClient(id);
+        },
+        async revokeByGrantId() {
+            // A grant belongs to a client; revoking it never deletes the client.
+        }
+    };
+}
+function artifactAdapter(store, model) {
+    return {
+        async upsert(id, payload, expiresIn) {
+            store.oidcUpsert(model, id, payload, expiresIn);
+        },
+        async find(id) {
+            return store.oidcFind(model, id);
+        },
+        async findByUid(uid) {
+            return store.oidcFindBy(model, 'uid', uid);
+        },
+        /**
+         * Device flow only, and the hub does not enable it. Returning undefined is
+         * the honest answer for a model that is never written; throwing would turn
+         * a disabled feature into a 500 if it were ever reached.
+         */
+        async findByUserCode() {
+            return undefined;
+        },
+        async consume(id) {
+            store.oidcConsume(model, id);
+        },
+        async destroy(id) {
+            store.oidcDestroy(model, id);
+        },
+        /**
+         * Crosses model boundaries by design: revoking a grant has to take the
+         * access tokens, refresh tokens and codes minted under it with it, and the
+         * library calls this on exactly one of the models.
+         */
+        async revokeByGrantId(grantId) {
+            store.oidcRevokeByGrantId(grantId);
+        }
+    };
+}
+//# sourceMappingURL=adapter.js.map

package/dist/auth/oidc/adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../../../src/auth/oidc/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAGvC,OAAO,EAAqB,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAEtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAgB,EAAE,IAAmB;IACrE,OAAO,CAAC,KAAa,EAAW,EAAE,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AACvH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,aAAa,CAAC,KAAgB,EAAE,IAAmB;IAC1D,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,OAAuB;YAC9C,8EAA8E;YAC9E,MAAM,MAAM,GAAG,EAAE,GAAG,oBAAoB,CAAC,OAAkC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAW,CAAC;YACvG,0EAA0E;YAC1E,kEAAkE;YAClE,0EAA0E;YAC1E,4DAA4D;YAC5D,IAAI,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;gBACxB,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;gBAC3B,OAAO;YACT,CAAC;YACD,sEAAsE;YACtE,sEAAsE;YACtE,0EAA0E;YAC1E,oEAAoE;YACpE,oCAAoC;YACpC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,iBAAiB,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;gBACpE,IAAI,CAAC,iBAAiB,GAAG,6DAA6D,CAAC;gBACvF,MAAM,IAAI,CAAC;YACb,CAAC;QACH,CAAC;QAED;;;;;;;;;;;;;;WAcG;QACH,KAAK,CAAC,IAAI,CAAC,EAAU;YACnB,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACvC,IAAI,UAAU;gBAAE,OAAO,UAA4B,CAAC;YACpD,IAAI,IAAI,IAAI,qBAAqB,CAAC,EAAE,CAAC,EAAE,CAAC;gBACtC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAA+B,CAAC;YAChE,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,KAAK,CAAC,SAAS;YACb,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,KAAK,CAAC,cAAc;YAClB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,KAAK,CAAC,OAAO;YACX,8BAA8B;QAChC,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,EAAU;YACtB,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACzB,CAAC;QACD,KAAK,CAAC,eAAe;YACnB,qEAAqE;QACvE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAgB,EAAE,KAAa;IACtD,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,OAAuB,EAAE,SAAkB;YAClE,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,EAAE,OAAkC,EAAE,SAAS,CAAC,CAAC;QAC7E,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,EAAU;YACnB,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAA+B,CAAC;QACjE,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,GAAW;YACzB,OAAO,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAA+B,CAAC;QAC3E,CAAC;QAED;;;;WAIG;QACH,KAAK,CAAC,cAAc;YAClB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,EAAU;YACtB,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/B,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,EAAU;YACtB,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/B,CAAC;QAED;;;;WAIG;QACH,KAAK,CAAC,eAAe,CAAC,OAAe;YACnC,KAAK,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/oidc/interactions.js

@@ -0,0 +1,187 @@
+import crypto from 'node:crypto';
+import bcrypt from 'bcryptjs';
+import express, { Router } from 'express';
+import { renderConsentPage } from '../consent-page.js';
+import { allowFormActionTo, authSecurityHeaders } from '../headers.js';
+import { renderLoginPage } from '../login-page.js';
+import { earlyRateLimit, LoginRateLimiter } from '../rate-limit.js';
+import { isLoopbackOnly } from '../redirect-uri.js';
+import { createSessionCookie, csrfToken, readSessionCookie, SESSION_COOKIE, SESSION_TTL_MS, verifyCsrfToken } from '../session.js';
+import { logSafe } from '../text.js';
+import { HUB_ACCOUNT_ID } from './provider.js';
+/**
+ * The hub's own login and consent pages, driven by oidc-provider's interaction
+ * loop instead of by HubOAuthProvider's hand-rolled one.
+ *
+ * The pages themselves are unchanged. They post to a RELATIVE `login` and
+ * `consent`, and that resolves to `/interaction/<uid>/login` because the page is
+ * served from a path ending in a slash — which it has to be anyway, since
+ * oidc-provider scopes the interaction cookie to exactly that path. The
+ * interaction id still travels in the hidden `request` field too, and is checked
+ * so a form cannot be replayed against a different interaction.
+ *
+ * Two behaviours from the old flow are load-bearing and preserved here:
+ *
+ *   - **Typing the password is the consent.** A first-time client is approved
+ *     by the login itself, so the consent page is only ever shown to someone
+ *     who is already signed in and is being asked about a NEW client.
+ *   - **One session cookie.** `mcp_hub_session` is set alongside
+ *     oidc-provider's own, because `hasValidSession()` is read outside the auth
+ *     layer by the upstream OAuth callback. Without it the operator would have
+ *     to log in twice for two different things.
+ */
+export function createOidcInteractionRoutes(options) {
+    const { provider, store } = options;
+    const router = Router();
+    const rateLimiter = new LoginRateLimiter();
+    // The pages this router serves are the ones with a password field on them, so
+    // they need the anti-clickjacking and no-store headers at least as much as
+    // the token endpoint does. `allowFormActionTo` narrows the CSP afterwards for
+    // the single page that has a redirect target to allow.
+    router.use(authSecurityHeaders);
+    const secure = new URL(options.externalUrl).protocol === 'https:';
+    const checkPassword = (password) => {
+        if (options.passwordHash)
+            return bcrypt.compareSync(password, options.passwordHash);
+        const expected = Buffer.from(options.password ?? '');
+        const given = Buffer.from(password);
+        return expected.length === given.length && crypto.timingSafeEqual(expected, given);
+    };
+    /** What the page may say about who is asking, and what it must not claim. */
+    const identityOf = async (clientId, resource) => {
+        const client = await provider.Client.find(clientId);
+        const metadata = client?.metadata();
+        return {
+            clientName: typeof metadata?.client_name === 'string' ? metadata.client_name : undefined,
+            resource,
+            // A metadata-document client is identified by a URL nobody can forge, so
+            // the page can show where the self-declared name came from.
+            clientId: options.cimd && clientId.startsWith('https://') ? clientId : undefined,
+            loopbackOnly: isLoopbackOnly(metadata?.redirect_uris)
+        };
+    };
+    const expired = (res, status, message) => {
+        res.status(status).type('html').send(`<p>${message}</p>`);
+    };
+    // The two POSTs below carry a limiter and this GET did not, which is the
+    // asymmetry CodeQL noticed and it was right. The page is unauthenticated by
+    // construction — the uid is all a caller has — and rendering it costs a
+    // provider store lookup, so a flood is cheap to send and not free to serve.
+    // The same window as its siblings; a person opening a login page a hundred
+    // times in fifteen minutes has a different problem.
+    router.get('/interaction/:uid', earlyRateLimit(15 * 60_000, 100, 500), async (req, res, next) => {
+        try {
+            const details = await provider.interactionDetails(req, res);
+            const params = details.params;
+            const redirectUri = String(params.redirect_uri ?? '');
+            const identity = await identityOf(String(params.client_id), params.resource);
+            allowFormActionTo(res, redirectUri);
+            if (details.prompt.name === 'login') {
+                res.status(200).type('html').send(renderLoginPage(details.uid, redirectUri, identity));
+                return;
+            }
+            const session = readSessionCookie(req.headers.cookie, store.cookieSecret);
+            if (!session) {
+                expired(res, 401, 'Session expired. Close this window and connect again.');
+                return;
+            }
+            res
+                .status(200)
+                .type('html')
+                .send(renderConsentPage(details.uid, csrfToken(session, store.cookieSecret), redirectUri, identity));
+        }
+        catch {
+            // interactionDetails throws for an unknown or expired uid, which is not
+            // an error worth a stack trace: the window was left open too long.
+            expired(res, 400, 'Authorization request expired. Close this window and connect again.');
+            void next;
+        }
+    });
+    router.post('/interaction/:uid/login', earlyRateLimit(15 * 60_000, 100, 500), express.urlencoded({ extended: false }), async (req, res) => {
+        const ip = req.ip ?? 'unknown';
+        const { password, request } = req.body;
+        let details;
+        try {
+            details = await provider.interactionDetails(req, res);
+        }
+        catch {
+            expired(res, 400, 'Authorization request expired. Close this window and connect again.');
+            return;
+        }
+        if (typeof request !== 'string' || request !== details.uid) {
+            expired(res, 400, 'Authorization request expired. Close this window and connect again.');
+            return;
+        }
+        if (rateLimiter.isBlocked(ip)) {
+            console.warn(`mcp-hub: login rate limit exceeded from ${logSafe(ip)}`);
+            expired(res, 429, 'Too many attempts. Try again later.');
+            return;
+        }
+        const params = details.params;
+        const redirectUri = String(params.redirect_uri ?? '');
+        if (typeof password !== 'string' || !checkPassword(password)) {
+            rateLimiter.recordFailure(ip);
+            console.warn(`mcp-hub: authentication failure from ${logSafe(ip)}`);
+            const identity = await identityOf(String(params.client_id), params.resource);
+            allowFormActionTo(res, redirectUri);
+            res.status(401).type('html').send(renderLoginPage(details.uid, redirectUri, identity, 'Wrong password'));
+            return;
+        }
+        rateLimiter.reset(ip);
+        console.log(`mcp-hub: successful login from ${logSafe(ip)}`);
+        // Typing the password is the consent for the client that triggered it.
+        const clientId = String(params.client_id);
+        const client = await provider.Client.find(clientId);
+        const clientName = client?.metadata()?.client_name;
+        store.saveApproval(clientId, redirectUri, typeof clientName === 'string' ? clientName : undefined);
+        console.log(`mcp-hub: approved OAuth client ${logSafe(clientId)} for ${logSafe(redirectUri)}`);
+        res.cookie(SESSION_COOKIE, createSessionCookie(store.cookieSecret), {
+            httpOnly: true,
+            secure,
+            sameSite: 'lax',
+            maxAge: SESSION_TTL_MS,
+            path: '/'
+        });
+        await provider.interactionFinished(req, res, { login: { accountId: HUB_ACCOUNT_ID } }, { mergeWithLastSubmission: false });
+    });
+    router.post('/interaction/:uid/consent', earlyRateLimit(15 * 60_000, 100, 500), express.urlencoded({ extended: false }), async (req, res) => {
+        const { request, csrf, action } = req.body;
+        let details;
+        try {
+            details = await provider.interactionDetails(req, res);
+        }
+        catch {
+            expired(res, 400, 'Authorization request expired. Close this window and connect again.');
+            return;
+        }
+        if (typeof request !== 'string' || request !== details.uid) {
+            expired(res, 400, 'Authorization request expired. Close this window and connect again.');
+            return;
+        }
+        const session = readSessionCookie(req.headers.cookie, store.cookieSecret);
+        if (!session) {
+            expired(res, 401, 'Session expired. Close this window and connect again.');
+            return;
+        }
+        if (!verifyCsrfToken(session, csrf, store.cookieSecret)) {
+            console.warn(`mcp-hub: consent with an invalid CSRF token from ${logSafe(req.ip ?? 'unknown')}`);
+            expired(res, 403, 'This form is no longer valid. Close this window and connect again.');
+            return;
+        }
+        if (action !== 'approve') {
+            await provider.interactionFinished(req, res, { error: 'access_denied' }, { mergeWithLastSubmission: false });
+            return;
+        }
+        const params = details.params;
+        const clientId = String(params.client_id);
+        const client = await provider.Client.find(clientId);
+        const clientName = client?.metadata()?.client_name;
+        store.saveApproval(clientId, String(params.redirect_uri ?? ''), typeof clientName === 'string' ? clientName : undefined);
+        console.log(`mcp-hub: approved OAuth client ${logSafe(clientId)} for ${logSafe(String(params.redirect_uri ?? ''))}`);
+        // The grant itself is minted by loadExistingGrant on the resumed request,
+        // which is the same code path an already-approved client takes.
+        await provider.interactionFinished(req, res, { consent: {} }, { mergeWithLastSubmission: true });
+    });
+    return router;
+}
+//# sourceMappingURL=interactions.js.map

package/dist/auth/oidc/interactions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interactions.js","sourceRoot":"","sources":["../../../src/auth/oidc/interactions.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,MAAM,MAAM,UAAU,CAAC;AAC9B,OAAO,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAI1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEnI,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAW/C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,2BAA2B,CAAC,OAA+B;IACzE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,WAAW,GAAG,IAAI,gBAAgB,EAAE,CAAC;IAE3C,8EAA8E;IAC9E,2EAA2E;IAC3E,8EAA8E;IAC9E,uDAAuD;IACvD,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAElE,MAAM,aAAa,GAAG,CAAC,QAAgB,EAAW,EAAE;QAClD,IAAI,OAAO,CAAC,YAAY;YAAE,OAAO,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QACpF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpC,OAAO,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACrF,CAAC,CAAC;IAEF,6EAA6E;IAC7E,MAAM,UAAU,GAAG,KAAK,EAAE,QAAgB,EAAE,QAAiB,EAAE,EAAE;QAC/D,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,EAAyC,CAAC;QAC3E,OAAO;YACL,UAAU,EAAE,OAAO,QAAQ,EAAE,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;YACxF,QAAQ;YACR,yEAAyE;YACzE,4DAA4D;YAC5D,QAAQ,EAAE,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;YAChF,YAAY,EAAE,cAAc,CAAC,QAAQ,EAAE,aAAqC,CAAC;SAC9E,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,CAAC,GAAqB,EAAE,MAAc,EAAE,OAAe,EAAQ,EAAE;QAC/E,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,OAAO,MAAM,CAAC,CAAC;IAC5D,CAAC,CAAC;IAEF,yEAAyE;IACzE,4EAA4E;IAC5E,wEAAwE;IACxE,4EAA4E;IAC5E,2EAA2E;IAC3E,oDAAoD;IACpD,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC9F,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,MAA0E,CAAC;YAClG,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;YACtD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC7E,iBAAiB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAEpC,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;gBACvF,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;YAC1E,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,uDAAuD,CAAC,CAAC;gBAC3E,OAAO;YACT,CAAC;YACD,GAAG;iBACA,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,MAAM,CAAC;iBACZ,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzG,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;YACxE,mEAAmE;YACnE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,qEAAqE,CAAC,CAAC;YACzF,KAAK,IAAI,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CACT,yBAAyB,EACzB,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,EACrC,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EACvC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACjB,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC;QAC/B,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,IAA+C,CAAC;QAClF,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,qEAAqE,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;YAC3D,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,qEAAqE,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,IAAI,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC,2CAA2C,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACvE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,qCAAqC,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAA0E,CAAC;QAClG,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QACtD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7D,WAAW,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC,wCAAwC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACpE,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC7E,iBAAiB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC;YACzG,OAAO;QACT,CAAC;QAED,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,kCAAkC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7D,uEAAuE;QACvE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpD,MAAM,UAAU,GAAI,MAAM,EAAE,QAAQ,EAA0C,EAAE,WAAW,CAAC;QAC5F,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACnG,OAAO,CAAC,GAAG,CAAC,kCAAkC,OAAO,CAAC,QAAQ,CAAC,QAAQ,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAE/F,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,mBAAmB,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE;YAClE,QAAQ,EAAE,IAAI;YACd,MAAM;YACN,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,cAAc;YACtB,IAAI,EAAE,GAAG;SACV,CAAC,CAAC;QACH,MAAM,QAAQ,CAAC,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7H,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,2BAA2B,EAC3B,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,EACrC,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EACvC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACjB,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAA4D,CAAC;QACnG,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,qEAAqE,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;YAC3D,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,qEAAqE,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QAC1E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,uDAAuD,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YACxD,OAAO,CAAC,IAAI,CAAC,oDAAoD,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC;YACjG,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,oEAAoE,CAAC,CAAC;YACxF,OAAO;QACT,CAAC;QAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,QAAQ,CAAC,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7G,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAuD,CAAC;QAC/E,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpD,MAAM,UAAU,GAAI,MAAM,EAAE,QAAQ,EAA0C,EAAE,WAAW,CAAC;QAC5F,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACzH,OAAO,CAAC,GAAG,CAAC,kCAAkC,OAAO,CAAC,QAAQ,CAAC,QAAQ,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QACrH,0EAA0E;QAC1E,gEAAgE;QAChE,MAAM,QAAQ,CAAC,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;IACnG,CAAC,CACF,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/auth/oidc/mount.js

@@ -0,0 +1,144 @@
+import { earlyRateLimit } from '../rate-limit.js';
+import { defaultScope, stripPhantomSecret } from './quirks.js';
+/**
+ * Every path the provider answers on, given the `routes` reconfiguration in
+ * provider.ts.
+ *
+ * Two of these are not endpoints and are easy to miss:
+ *
+ *   - `/authorize/:uid` is the RESUME route (initialize_app.js registers it at
+ *     `${routes.authorization}/:uid`). Without it the redirect back from the
+ *     login page lands in the hub's 404 handler and the authorization flow
+ *     dead-ends silently, with a plausible-looking error.
+ *   - `/register/:id` is RFC 7592 registration management.
+ *
+ * Both `.well-known` paths are served by the provider with an identical body,
+ * which is exactly the alias the hub used to build by hand for ChatGPT.
+ */
+export const OIDC_PATHS = [
+    '/authorize',
+    '/authorize/:uid',
+    '/token',
+    '/revoke',
+    '/register',
+    '/register/:id',
+    '/jwks',
+    '/.well-known/oauth-authorization-server',
+    '/.well-known/openid-configuration'
+];
+/**
+ * Makes EXTERNAL_URL authoritative for every URL the provider publishes.
+ *
+ * oidc-provider builds endpoint URLs from the REQUEST (`urlFor` resolves against
+ * `ctx.href`), not from the issuer. Two consequences the hub cannot accept:
+ *
+ *   - behind a reverse proxy the document would advertise the internal host, and
+ *   - a request carrying `Host: evil.example` would be answered with a discovery
+ *     document pointing at evil.example.
+ *
+ * The hub already treats EXTERNAL_URL as the single source of truth and compares
+ * it byte for byte, so overwriting the request's idea of its own origin is the
+ * faithful translation rather than a workaround.
+ *
+ * It also closes the `provider.proxy` gap. That flag is a boolean — it trusts
+ * any `X-Forwarded-*` — whereas Express was configured with a CIDR list. Because
+ * all three headers are overwritten here, the client cannot influence them, and
+ * `X-Forwarded-For` is replaced with the address Express already resolved
+ * against TRUSTED_PROXIES.
+ */
+export function forceExternalOrigin(externalUrl) {
+    const url = new URL(externalUrl);
+    const proto = url.protocol.replace(':', '');
+    return (req, _res, next) => {
+        req.headers.host = url.host;
+        req.headers['x-forwarded-host'] = url.host;
+        req.headers['x-forwarded-proto'] = proto;
+        if (req.ip)
+            req.headers['x-forwarded-for'] = req.ip;
+        else
+            delete req.headers['x-forwarded-for'];
+        next();
+    };
+}
+/**
+ * The same budgets the hub applied before, per path.
+ *
+ * They belong here rather than at the call site because the mounted Koa app is
+ * never entered by the Express router: a limit that is not put in front of the
+ * mount simply does not exist, and nothing about the resulting configuration
+ * looks wrong. `/register` is the tightest — registration is open — and it also
+ * has to cover `/register/:id`, whose own budget is more generous because
+ * routine management would otherwise use up a client's ability to register.
+ */
+export function defaultRateLimits() {
+    return {
+        '/register': [earlyRateLimit(60 * 60_000, 20, 200)],
+        '/register/:id': [earlyRateLimit(60 * 60_000, 60, 600)],
+        '/authorize': [earlyRateLimit(15 * 60_000, 100, 1_000)],
+        '/authorize/:uid': [earlyRateLimit(15 * 60_000, 100, 1_000)],
+        '/token': [earlyRateLimit(15 * 60_000, 50, 500)]
+    };
+}
+/**
+ * Mounts the authorization server into the hub's Express app.
+ *
+ * `app.all(path, ...)` and NOT `app.use(path, ...)`: `use` strips the prefix
+ * from `req.url`, while oidc-provider derives its own mount path from the
+ * issuer (provider.js `#mountPath = new URL(issuer).pathname`). The hub's
+ * issuer is the origin root, so stripping would leave the router looking at
+ * paths the published URLs do not match.
+ *
+ * The mounted app is also a dead end — Koa's `handleRequest` always responds,
+ * so anything that reaches it never returns to Express. Mounting per path
+ * rather than at the root is what keeps `/livez`, `/health` and every MCP route
+ * reachable.
+ */
+export function mountOidcProvider(app, provider, store, options) {
+    const callback = provider.callback();
+    // Safe only in combination with forceExternalOrigin, which overwrites every
+    // forwarded header the client could otherwise set.
+    provider.proxy = true;
+    /**
+     * Errors do not cross the boundary. A throw inside the Koa app is caught by
+     * `ctx.onerror` and never reaches the hub's four-argument Express error
+     * handler, so without this an authorization-server fault would be invisible
+     * in the hub's logs.
+     */
+    provider.on('server_error', (_ctx, error) => {
+        console.error(`mcp-hub: authorization server failed: ${error.message}`);
+    });
+    /**
+     * RFC 8414 also defines a path-insertion form, and clients probing a specific
+     * resource look up `/.well-known/oauth-authorization-server/<name>/mcp` before
+     * falling back to the root document. oidc-provider registers only the exact
+     * paths, so without this the suffix form 404s — which the hub answered before.
+     * One authorization server covers every resource, so the answer is the same
+     * document.
+     */
+    for (const base of ['/.well-known/oauth-authorization-server', '/.well-known/openid-configuration']) {
+        app.get(`${base}/{*splat}`, ...(options.common ?? []), forceExternalOrigin(options.externalUrl), (req, res) => {
+            req.url = base;
+            callback(req, res);
+        });
+    }
+    // Built once: each entry holds a counter, and rebuilding per path would give
+    // every route a fresh, empty limiter on every iteration.
+    const before = options.before ?? defaultRateLimits();
+    for (const path of OIDC_PATHS) {
+        const handlers = [
+            ...(options.common ?? []),
+            ...(before[path] ?? []),
+            forceExternalOrigin(options.externalUrl)
+        ];
+        if (path === '/authorize')
+            handlers.push(defaultScope);
+        // Reads the body, so it has to BE the terminal handler rather than sit in
+        // front of one: the request stream can only be consumed once.
+        if (path === '/token')
+            handlers.push(stripPhantomSecret(store, callback));
+        else
+            handlers.push((req, res) => callback(req, res));
+        app.all(path, ...handlers);
+    }
+}
+//# sourceMappingURL=mount.js.map

package/dist/auth/oidc/mount.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mount.js","sourceRoot":"","sources":["../../../src/auth/oidc/mount.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAE/D;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,YAAY;IACZ,iBAAiB;IACjB,QAAQ;IACR,SAAS;IACT,WAAW;IACX,eAAe;IACf,OAAO;IACP,yCAAyC;IACzC,mCAAmC;CAC3B,CAAC;AAEX;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAmB;IACrD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QACzB,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QAC5B,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC;QAC3C,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,GAAG,KAAK,CAAC;QACzC,IAAI,GAAG,CAAC,EAAE;YAAE,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;;YAC/C,OAAO,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC3C,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO;QACL,WAAW,EAAE,CAAC,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACnD,eAAe,EAAE,CAAC,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,YAAY,EAAE,CAAC,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACvD,iBAAiB,EAAE,CAAC,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5D,QAAQ,EAAE,CAAC,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;KACjD,CAAC;AACJ,CAAC;AAYD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAY,EAAE,QAAkB,EAAE,KAAgB,EAAE,OAAqB;IACzG,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,EAAsD,CAAC;IACzF,4EAA4E;IAC5E,mDAAmD;IACnD,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC;IAEtB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,CAAC,cAAc,EAAE,CAAC,IAAI,EAAE,KAAY,EAAE,EAAE;QACjD,OAAO,CAAC,KAAK,CAAC,yCAAyC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH;;;;;;;OAOG;IACH,KAAK,MAAM,IAAI,IAAI,CAAC,yCAAyC,EAAE,mCAAmC,CAAC,EAAE,CAAC;QACpG,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,mBAAmB,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5G,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC;YACf,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,yDAAyD;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,iBAAiB,EAAE,CAAC;IAErD,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAqB;YACjC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;YACzB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACvB,mBAAmB,CAAC,OAAO,CAAC,WAAW,CAAC;SACzC,CAAC;QACF,IAAI,IAAI,KAAK,YAAY;YAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACvD,0EAA0E;QAC1E,8DAA8D;QAC9D,IAAI,IAAI,KAAK,QAAQ;YAAE,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;;YACrE,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QACrD,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC"}