@ni-c/mcp-hub 0.9.2 → 0.10.0

package/dist/auth/redirect-uri.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect-uri.js","sourceRoot":"","sources":["../../src/auth/redirect-uri.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAE/E;gEACgE;AAChE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAE3F,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,OAAO,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAYD;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,MAAyB;IACtE,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5E,OAAO,MAAM,CAAC,sBAAsB,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,YAAkC;IAC/D,IAAI,CAAC,YAAY,EAAE,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;QAC9B,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/auth/registration.js

@@ -0,0 +1,146 @@
+import express, { Router } from 'express';
+import { OAuthClientMetadataSchema } from '@modelcontextprotocol/sdk/shared/auth.js';
+import { isSafeRedirectUri } from './redirect-uri.js';
+import { earlyRateLimit } from './rate-limit.js';
+import { clampDisplayName, logSafe } from './text.js';
+/**
+ * RFC 7592, the management half of dynamic client registration: a client that
+ * registered itself can read, change and — the point of the exercise — delete
+ * its own registration, without the operator having to do it for them.
+ *
+ * None of this comes from the SDK. Its registration router accepts `POST` and
+ * nothing else (`allowedMethods(['POST'])`), and it knows nothing about
+ * `registration_access_token`. These routes therefore have to be mounted ahead
+ * of it, or the SDK answers `405` for every verb below.
+ *
+ * The credential is minted once at registration and only its hash is stored,
+ * so it is not recoverable from the state file — losing it means asking the
+ * operator to remove the registration.
+ */
+/** Where the client manages the registration it was just given. */
+export function registrationClientUri(externalUrl, clientId) {
+    return new URL(`register/${encodeURIComponent(clientId)}`, externalUrl).href;
+}
+/** The body limit is far above any real client metadata document and well
+ *  below anything that would matter to the process. */
+const MAX_METADATA_BYTES = '64kb';
+export function createRegistrationManagementRoutes(options) {
+    const { store, externalUrl } = options;
+    const router = Router();
+    const path = '/register/:clientId';
+    // Its own budget rather than the 20-per-hour one guarding POST /register.
+    // These are authenticated and cheap, and a client that reads and updates its
+    // registration should not thereby lose the ability to register again.
+    const limit = earlyRateLimit(15 * 60_000, 60, 600);
+    const present = (client) => ({
+        ...client,
+        registration_client_uri: registrationClientUri(externalUrl, client.client_id)
+    });
+    // The SDK gives POST /register an open CORS policy so browser-based clients
+    // can register; these routes sit in front of it and need their own. Opening
+    // them is safe: the credential is a bearer token in a header, never a cookie,
+    // so no browser attaches it to a cross-site request on its own.
+    const allowCrossOrigin = (res) => {
+        res.set('Access-Control-Allow-Origin', '*');
+    };
+    router.options(path, limit, (_req, res) => {
+        allowCrossOrigin(res);
+        res.set({
+            'Access-Control-Allow-Methods': 'GET, PUT, DELETE, OPTIONS',
+            'Access-Control-Allow-Headers': 'Authorization, Content-Type',
+            'Access-Control-Max-Age': '600'
+        });
+        res.status(204).end();
+    });
+    /**
+     * Authenticates before anything else runs — the body parser included, so an
+     * unauthenticated caller never gets to hand us a document to parse.
+     *
+     * An unknown client and a wrong token get the same answer. Telling them apart
+     * would turn this into a way to find out which client_ids exist.
+     */
+    const requireRegistrationToken = (req, res, next) => {
+        allowCrossOrigin(res);
+        const clientId = String(req.params.clientId);
+        const header = req.headers.authorization;
+        const token = typeof header === 'string' && header.startsWith('Bearer ') ? header.slice(7).trim() : '';
+        const client = token.length > 0 && store.verifyRegistrationToken(clientId, token) ? store.getClient(clientId) : undefined;
+        if (!client) {
+            console.warn(`mcp-hub: refused registration management for ${logSafe(clientId)}`);
+            res.set('WWW-Authenticate', 'Bearer error="invalid_token"');
+            res.status(401).json({ error: 'invalid_token', error_description: 'Invalid registration access token' });
+            return;
+        }
+        req.registrationClient = client;
+        next();
+    };
+    router.get(path, limit, requireRegistrationToken, (req, res) => {
+        res.json(present(req.registrationClient));
+    });
+    router.put(path, limit, requireRegistrationToken, express.json({ limit: MAX_METADATA_BYTES }), (req, res) => {
+        const existing = req.registrationClient;
+        const refuse = (description) => {
+            res.status(400).json({ error: 'invalid_client_metadata', error_description: description });
+        };
+        const body = (req.body ?? {});
+        // RFC 7592 §2.2: the client has to say which registration it means, and it
+        // may not use this to change its own credentials.
+        if (body.client_id !== existing.client_id) {
+            refuse('client_id must be present and match the registration being updated');
+            return;
+        }
+        // Only meaningful for a client that actually holds a secret. A public one
+        // was handed a throwaway secret in its registration response that was never
+        // stored (the accommodation ChatGPT needs), and echoing that back here must
+        // not be treated as an attempt to change anything.
+        if (existing.client_secret !== undefined && body.client_secret !== undefined && body.client_secret !== existing.client_secret) {
+            refuse('client_secret cannot be changed here');
+            return;
+        }
+        const parsed = OAuthClientMetadataSchema.safeParse(body);
+        if (!parsed.success) {
+            refuse('The submitted client metadata is not valid');
+            return;
+        }
+        const metadata = parsed.data;
+        for (const uri of metadata.redirect_uris ?? []) {
+            if (!isSafeRedirectUri(uri, { allowPrivateUseSchemes: true })) {
+                refuse(`redirect_uri ${uri} must be https, a loopback address or a private-use scheme`);
+                return;
+            }
+        }
+        const redirectsChanged = !sameUris(existing.redirect_uris, metadata.redirect_uris);
+        const updated = {
+            ...metadata,
+            client_name: clampDisplayName(metadata.client_name),
+            // Identity and credentials are the hub's to assign, not the client's.
+            client_id: existing.client_id,
+            client_id_issued_at: existing.client_id_issued_at,
+            ...(existing.client_secret !== undefined
+                ? { client_secret: existing.client_secret, client_secret_expires_at: existing.client_secret_expires_at }
+                : {})
+        };
+        // Consent was given for a destination. A client that moves the destination
+        // afterwards has to be asked again, or the approval would be transferable
+        // to somewhere the user never saw.
+        store.updateClient(updated, { resetApproval: redirectsChanged });
+        if (redirectsChanged) {
+            console.log(`mcp-hub: client ${logSafe(existing.client_id)} changed its redirect URIs; its approval was withdrawn`);
+        }
+        res.json(present(updated));
+    });
+    router.delete(path, limit, requireRegistrationToken, (req, res) => {
+        const clientId = req.registrationClient.client_id;
+        store.deleteClient(clientId);
+        console.log(`mcp-hub: client ${logSafe(clientId)} deleted its own registration`);
+        res.status(204).end();
+    });
+    return router;
+}
+/** Order is not part of the meaning of a redirect URI list. */
+function sameUris(before, after) {
+    const a = [...(before ?? [])].sort();
+    const b = [...(after ?? [])].sort();
+    return a.length === b.length && a.every((uri, index) => uri === b[index]);
+}
+//# sourceMappingURL=registration.js.map

package/dist/auth/registration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration.js","sourceRoot":"","sources":["../../src/auth/registration.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AAGrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEtD;;;;;;;;;;;;;GAaG;AAEH,mEAAmE;AACnE,MAAM,UAAU,qBAAqB,CAAC,WAAmB,EAAE,QAAgB;IACzE,OAAO,IAAI,GAAG,CAAC,YAAY,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC;AAC/E,CAAC;AAYD;uDACuD;AACvD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,MAAM,UAAU,kCAAkC,CAAC,OAAsC;IACvF,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,IAAI,GAAG,qBAAqB,CAAC;IACnC,0EAA0E;IAC1E,6EAA6E;IAC7E,sEAAsE;IACtE,MAAM,KAAK,GAAG,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;IAEnD,MAAM,OAAO,GAAG,CAAC,MAAkC,EAA2B,EAAE,CAAC,CAAC;QAChF,GAAG,MAAM;QACT,uBAAuB,EAAE,qBAAqB,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC;KAC9E,CAAC,CAAC;IAEH,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,gEAAgE;IAChE,MAAM,gBAAgB,GAAG,CAAC,GAAa,EAAQ,EAAE;QAC/C,GAAG,CAAC,GAAG,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC,CAAC;IAEF,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACxC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC;YACN,8BAA8B,EAAE,2BAA2B;YAC3D,8BAA8B,EAAE,6BAA6B;YAC7D,wBAAwB,EAAE,KAAK;SAChC,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH;;;;;;OAMG;IACH,MAAM,wBAAwB,GAAG,CAAC,GAAwB,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QACrG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,MAAM,KAAK,GAAG,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvG,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1H,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,gDAAgD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAClF,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,8BAA8B,CAAC,CAAC;YAC5D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,mCAAmC,EAAE,CAAC,CAAC;YACzG,OAAO;QACT,CAAC;QACD,GAAG,CAAC,kBAAkB,GAAG,MAAM,CAAC;QAChC,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,GAAwB,EAAE,GAAG,EAAE,EAAE;QAClF,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAmB,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,wBAAwB,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,EAAE,CAAC,GAAwB,EAAE,GAAG,EAAE,EAAE;QAC/H,MAAM,QAAQ,GAAG,GAAG,CAAC,kBAAmB,CAAC;QACzC,MAAM,MAAM,GAAG,CAAC,WAAmB,EAAQ,EAAE;YAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC;QAC7F,CAAC,CAAC;QACF,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QACzD,2EAA2E;QAC3E,kDAAkD;QAClD,IAAI,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,EAAE,CAAC;YAC1C,MAAM,CAAC,oEAAoE,CAAC,CAAC;YAC7E,OAAO;QACT,CAAC;QACD,0EAA0E;QAC1E,4EAA4E;QAC5E,4EAA4E;QAC5E,mDAAmD;QACnD,IAAI,QAAQ,CAAC,aAAa,KAAK,SAAS,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa,EAAE,CAAC;YAC9H,MAAM,CAAC,sCAAsC,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,4CAA4C,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;QAC7B,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;YAC/C,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC9D,MAAM,CAAC,gBAAgB,GAAG,4DAA4D,CAAC,CAAC;gBACxF,OAAO;YACT,CAAC;QACH,CAAC;QACD,MAAM,gBAAgB,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;QACnF,MAAM,OAAO,GAAG;YACd,GAAG,QAAQ;YACX,WAAW,EAAE,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC;YACnD,sEAAsE;YACtE,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;YACjD,GAAG,CAAC,QAAQ,CAAC,aAAa,KAAK,SAAS;gBACtC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB,EAAE;gBACxG,CAAC,CAAC,EAAE,CAAC;SACsB,CAAC;QAChC,2EAA2E;QAC3E,0EAA0E;QAC1E,mCAAmC;QACnC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACjE,IAAI,gBAAgB,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,mBAAmB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,wDAAwD,CAAC,CAAC;QACtH,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,GAAwB,EAAE,GAAG,EAAE,EAAE;QACrF,MAAM,QAAQ,GAAG,GAAG,CAAC,kBAAmB,CAAC,SAAS,CAAC;QACnD,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,mBAAmB,OAAO,CAAC,QAAQ,CAAC,+BAA+B,CAAC,CAAC;QACjF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+DAA+D;AAC/D,SAAS,QAAQ,CAAC,MAA4B,EAAE,KAA2B;IACzE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5E,CAAC"}

package/dist/auth/routes.js

@@ -5,43 +5,14 @@ import { mcpAuthRouter, createOAuthMetadata } from '@modelcontextprotocol/sdk/se
 import { SESSION_TTL_MS } from './provider.js';
 import { renderLoginPage } from './login-page.js';
 import { allowFormActionTo, contentSecurityPolicy } from './headers.js';
+import { isLoopbackOnly } from './redirect-uri.js';
+import { logSafe } from './text.js';
+import { privateKeyJwtAuth } from './private-key-jwt.js';
+import { earlyRateLimit } from './rate-limit.js';
+import { createRegistrationManagementRoutes } from './registration.js';
 const LOGIN_MAX_ATTEMPTS = 10;
 const LOGIN_WINDOW_MS = 15 * 60_000;
 const LOGIN_MAX_ATTEMPTS_TOTAL = 100;
-function earlyRateLimit(windowMs, maxPerIp, maxTotal) {
-    const byIp = new Map();
-    let total = { count: 0, resetAt: 0 };
-    return (req, res, next) => {
-        const now = Date.now();
-        if (total.resetAt <= now)
-            total = { count: 0, resetAt: now + windowMs };
-        const ip = req.ip ?? 'unknown';
-        let entry = byIp.get(ip);
-        if (entry && entry.resetAt <= now) {
-            byIp.delete(ip);
-            entry = undefined;
-        }
-        // Reject before inserting anything: a flood of distinct rejected IPs must
-        // not grow the map. Accepted requests bound it at maxTotal per window.
-        if ((entry?.count ?? 0) >= maxPerIp || total.count >= maxTotal) {
-            res.set('Retry-After', String(Math.max(1, Math.ceil((Math.min(entry?.resetAt ?? Infinity, total.resetAt) - now) / 1000))));
-            res.status(429).json({ error: 'too_many_requests', error_description: 'Request rate limit exceeded' });
-            return;
-        }
-        if (!entry) {
-            if (byIp.size >= maxTotal) {
-                for (const [candidateIp, candidate] of byIp)
-                    if (candidate.resetAt <= now)
-                        byIp.delete(candidateIp);
-            }
-            entry = { count: 0, resetAt: now + windowMs };
-            byIp.set(ip, entry);
-        }
-        entry.count++;
-        total.count++;
-        next();
-    };
-}
 export class LoginRateLimiter {
     attempts = new Map();
     total = { count: 0, resetAt: 0 };
@@ -104,6 +75,14 @@ export function createAuthRoutes(options) {
         res.set('Referrer-Policy', 'no-referrer');
         next();
     });
+    // RFC 7592 registration management. It goes first for two reasons: the SDK's
+    // registration router is mounted on the /register prefix and answers 405 to
+    // anything that is not a POST, and the registration budget below is also
+    // prefix-scoped — routine management would otherwise use up a client's
+    // ability to register at all. It brings its own, more generous limit.
+    if (provider.clientsStore.registerClient) {
+        router.use(createRegistrationManagementRoutes({ store: options.store, externalUrl: issuerUrl.href }));
+    }
     // These run before the SDK's JSON/form parsers. The SDK applies its own
     // endpoint limits too, but those otherwise happen only after body parsing.
     router.use('/register', earlyRateLimit(60 * 60_000, 20, 200));
@@ -111,13 +90,50 @@ export function createAuthRoutes(options) {
     router.use('/token', earlyRateLimit(15 * 60_000, 50, 500));
     router.use('/login', earlyRateLimit(15 * 60_000, 100, 500));
     router.use('/consent', earlyRateLimit(15 * 60_000, 100, 500));
+    // Advertised capabilities. The SDK's document knows nothing about Client ID
+    // Metadata Documents, so the two fields clients key their registration
+    // choice on are added here: client_id_metadata_document_supported is what
+    // makes a spec-compliant client prefer CIMD over dynamic registration, and
+    // private_key_jwt is how a CIMD client authenticates at the token endpoint —
+    // it can hold no shared secret.
+    const asMetadata = {
+        ...createOAuthMetadata({ provider, issuerUrl }),
+        ...(options.cimd
+            ? {
+                client_id_metadata_document_supported: true,
+                token_endpoint_auth_methods_supported: ['client_secret_post', 'none', 'private_key_jwt'],
+                token_endpoint_auth_signing_alg_values_supported: ['RS256', 'RS384', 'RS512', 'PS256', 'PS384', 'PS512', 'ES256', 'ES384', 'ES512', 'EdDSA']
+            }
+            : {})
+    };
+    if (options.cimd) {
+        // Ahead of mcpAuthRouter so it wins the route, and ahead of the SDK's own
+        // body parser — which is harmless, because body-parser leaves an
+        // already-read request alone and req.body survives into the SDK handler.
+        router.use('/token', express.urlencoded({ extended: false }), privateKeyJwtAuth({ resolver: options.cimd, externalUrl: issuerUrl.href, tokenEndpoint: asMetadata.token_endpoint }));
+        // mcpAuthRouter serves the root RFC 8414 document itself, so the enriched
+        // one has to be registered before it to take precedence.
+        router.get('/.well-known/oauth-authorization-server', (_req, res) => {
+            res.json(asMetadata);
+        });
+    }
+    if (!provider.clientsStore.registerClient) {
+        // With dynamic registration off the SDK never mounts /register, and the
+        // request would otherwise fall through to the MCP routes and come back as
+        // a 401 — telling a client to authenticate at an endpoint that no longer
+        // exists. Say what actually happened instead.
+        router.all('/register', (_req, res) => {
+            res
+                .status(404)
+                .json({ error: 'not_found', error_description: 'Dynamic client registration is disabled; use a client ID metadata document' });
+        });
+    }
     // Standard AS endpoints: /.well-known/*, /authorize, /token, /register, /revoke
     router.use(mcpAuthRouter({ provider, issuerUrl, resourceName: 'mcp-hub' }));
     // Path-scoped metadata (RFC 9728 §3.1): clients connected to /<name>/mcp look
     // up /.well-known/oauth-protected-resource/<name>/mcp before falling back to
     // the root document, and RFC 8414 has an equivalent path-insertion form for
     // AS metadata. Serve both for any suffix; one AS covers all resources.
-    const asMetadata = createOAuthMetadata({ provider, issuerUrl });
     router.get('/.well-known/oauth-authorization-server/{*splat}', (_req, res) => {
         res.json(asMetadata);
     });
@@ -156,20 +172,30 @@ export function createAuthRoutes(options) {
             return;
         }
         if (rateLimiter.isBlocked(ip)) {
-            console.warn(`mcp-hub: login rate limit exceeded from ${ip}`);
+            console.warn(`mcp-hub: login rate limit exceeded from ${logSafe(ip)}`);
             res.status(429).type('html').send('<p>Too many attempts. Try again later.</p>');
             return;
         }
         if (typeof password !== 'string' || !checkPassword(password)) {
             rateLimiter.recordFailure(ip);
-            console.warn(`mcp-hub: authentication failure from ${ip}`);
-            // The retry form has to reach the same redirect as the first attempt.
+            console.warn(`mcp-hub: authentication failure from ${logSafe(ip)}`);
+            // The retry form has to reach the same redirect as the first attempt,
+            // and say the same things about who is asking.
+            const retryClient = await provider.clientsStore.getClient(pending.clientId);
             allowFormActionTo(res, pending.redirectUri);
-            res.status(401).type('html').send(renderLoginPage(request, pending.redirectUri, undefined, 'Wrong password', pending.resource));
+            res
+                .status(401)
+                .type('html')
+                .send(renderLoginPage(request, pending.redirectUri, {
+                clientName: retryClient?.client_name,
+                resource: pending.resource,
+                clientId: provider.isMetadataDocumentClient(pending.clientId) ? pending.clientId : undefined,
+                loopbackOnly: isLoopbackOnly(retryClient?.redirect_uris)
+            }, 'Wrong password'));
             return;
         }
         rateLimiter.reset(ip);
-        console.log(`mcp-hub: successful login from ${ip}`);
+        console.log(`mcp-hub: successful login from ${logSafe(ip)}`);
         res.cookie(provider.sessionCookieName, provider.createSessionCookie(), {
             httpOnly: true,
             secure: issuerUrl.protocol === 'https:',
@@ -201,7 +227,7 @@ export function createAuthRoutes(options) {
             return;
         }
         if (!provider.verifyCsrfToken(session, csrf)) {
-            console.warn(`mcp-hub: consent with an invalid CSRF token from ${req.ip ?? 'unknown'}`);
+            console.warn(`mcp-hub: consent with an invalid CSRF token from ${logSafe(req.ip ?? 'unknown')}`);
             res.status(403).type('html').send('<p>Invalid request. Close this window and connect again.</p>');
             return;
         }

package/dist/auth/routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/auth/routes.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,MAAM,MAAM,UAAU,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AACrG,OAAO,EAAoB,cAAc,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAExE,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,eAAe,GAAG,EAAE,GAAG,MAAM,CAAC;AACpC,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAErC,SAAS,cAAc,CAAC,QAAgB,EAAE,QAAgB,EAAE,QAAgB;IAC1E,MAAM,IAAI,GAAG,IAAI,GAAG,EAA8C,CAAC;IACnE,IAAI,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACrC,OAAO,CAAC,GAAoB,EAAE,GAAqB,EAAE,IAA0B,EAAQ,EAAE;QACvF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,KAAK,CAAC,OAAO,IAAI,GAAG;YAAE,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,QAAQ,EAAE,CAAC;QACxE,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC;QAC/B,IAAI,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzB,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;YAClC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAChB,KAAK,GAAG,SAAS,CAAC;QACpB,CAAC;QACD,0EAA0E;QAC1E,uEAAuE;QACvE,IAAI,CAAC,KAAK,EAAE,KAAK,IAAI,CAAC,CAAC,IAAI,QAAQ,IAAI,KAAK,CAAC,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC/D,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,IAAI,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3H,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACvG,OAAO;QACT,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,IAAI,CAAC,IAAI,IAAI,QAAQ,EAAE,CAAC;gBAC1B,KAAK,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,IAAI;oBAAE,IAAI,SAAS,CAAC,OAAO,IAAI,GAAG;wBAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACtG,CAAC;YACD,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,QAAQ,EAAE,CAAC;YAC9C,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACtB,CAAC;QACD,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AASD,MAAM,OAAO,gBAAgB;IACV,QAAQ,GAAG,IAAI,GAAG,EAA8C,CAAC;IAC1E,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAEzC,SAAS,CAAC,EAAU;QAClB,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,wBAAwB;YAAE,OAAO,IAAI,CAAC;QACjG,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,KAAK,CAAC;QACvD,OAAO,KAAK,CAAC,KAAK,IAAI,kBAAkB,CAAC;IAC3C,CAAC;IAED,aAAa,CAAC,EAAU;QACtB,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,8EAA8E;QACnG,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,sEAAsE;QACtE,wEAAwE;QACxE,6BAA6B;QAC7B,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG;YAAE,IAAI,CAAC,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,eAAe,EAAE,CAAC;;YACnF,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC;YAClC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,eAAe,EAAE,CAAC,CAAC;QACtE,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC,OAAO,GAAG,GAAG;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,EAAU;QACd,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACxC,CAAC;CACF;AAED,MAAM,UAAU,gBAAgB,CAAC,OAA0B;IACzD,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAC1C,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,WAAW,GAAG,IAAI,gBAAgB,EAAE,CAAC;IAE3C,6EAA6E;IAC7E,wEAAwE;IACxE,0EAA0E;IAC1E,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC7B,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAC5D,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACnC,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QAC7C,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;QAC1C,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,2EAA2E;IAC3E,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9D,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAClE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5D,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAE9D,gFAAgF;IAChF,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAE5E,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,uEAAuE;IACvE,MAAM,UAAU,GAAG,mBAAmB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAChE,MAAM,CAAC,GAAG,CAAC,kDAAkD,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC3E,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IACH,gEAAgE;IAChE,0EAA0E;IAC1E,wEAAwE;IACxE,oEAAoE;IACpE,MAAM,CAAC,GAAG,CAAC,mCAAmC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC5D,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,4CAA4C,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACrE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,gDAAgD,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACxE,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;QAC7E,GAAG,CAAC,IAAI,CAAC;YACP,QAAQ,EAAE,SAAS,CAAC,MAAM,GAAG,MAAM;YACnC,qBAAqB,EAAE,CAAC,WAAW,CAAC;YACpC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;YACpC,aAAa,EAAE,SAAS;SACzB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,CAAC,QAAgB,EAAW,EAAE;QAClD,IAAI,OAAO,CAAC,YAAY;YAAE,OAAO,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QACpF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAS,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpC,OAAO,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACrF,CAAC,CAAC;IAEF,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAChF,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC;QAC/B,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,IAA+C,CAAC;QAClF,MAAM,OAAO,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvG,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;YAChH,OAAO;QACT,CAAC;QACD,IAAI,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC,2CAA2C,EAAE,EAAE,CAAC,CAAC;YAC9D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7D,WAAW,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC,wCAAwC,EAAE,EAAE,CAAC,CAAC;YAC3D,sEAAsE;YACtE,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,OAAQ,EAAE,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,gBAAgB,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;YACjI,OAAO;QACT,CAAC;QACD,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,kCAAkC,EAAE,EAAE,CAAC,CAAC;QACpD,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE,QAAQ,CAAC,mBAAmB,EAAE,EAAE;YACrE,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,SAAS,CAAC,QAAQ,KAAK,QAAQ;YACvC,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,cAAc;YACtB,IAAI,EAAE,GAAG;SACV,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;YACjG,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,qCAAqC;QACpF,QAAQ,CAAC,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClF,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAA4D,CAAC;QACnG,MAAM,OAAO,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvG,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;YAChH,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;YAClG,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAC7C,OAAO,CAAC,IAAI,CAAC,oDAAoD,GAAG,CAAC,EAAE,IAAI,SAAS,EAAE,CAAC,CAAC;YACxF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;YAClG,OAAO;QACT,CAAC;QACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,4CAA4C,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC5E,QAAQ,CAAC,iBAAiB,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC;YACrF,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;YACjG,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QAC9C,QAAQ,CAAC,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/auth/routes.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,MAAM,MAAM,UAAU,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AACrG,OAAO,EAAoB,cAAc,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAExE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,kCAAkC,EAAE,MAAM,mBAAmB,CAAC;AAGvE,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,eAAe,GAAG,EAAE,GAAG,MAAM,CAAC;AACpC,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAarC,MAAM,OAAO,gBAAgB;IACV,QAAQ,GAAG,IAAI,GAAG,EAA8C,CAAC;IAC1E,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAEzC,SAAS,CAAC,EAAU;QAClB,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,wBAAwB;YAAE,OAAO,IAAI,CAAC;QACjG,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,KAAK,CAAC;QACvD,OAAO,KAAK,CAAC,KAAK,IAAI,kBAAkB,CAAC;IAC3C,CAAC;IAED,aAAa,CAAC,EAAU;QACtB,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,8EAA8E;QACnG,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,sEAAsE;QACtE,wEAAwE;QACxE,6BAA6B;QAC7B,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG;YAAE,IAAI,CAAC,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,eAAe,EAAE,CAAC;;YACnF,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC;YAClC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,eAAe,EAAE,CAAC,CAAC;QACtE,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC,OAAO,GAAG,GAAG;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,EAAU;QACd,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACxC,CAAC;CACF;AAED,MAAM,UAAU,gBAAgB,CAAC,OAA0B;IACzD,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAC1C,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,WAAW,GAAG,IAAI,gBAAgB,EAAE,CAAC;IAE3C,6EAA6E;IAC7E,wEAAwE;IACxE,0EAA0E;IAC1E,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC7B,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAC5D,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACnC,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QAC7C,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;QAC1C,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,4EAA4E;IAC5E,yEAAyE;IACzE,uEAAuE;IACvE,sEAAsE;IACtE,IAAI,QAAQ,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACxG,CAAC;IAED,wEAAwE;IACxE,2EAA2E;IAC3E,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9D,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAClE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5D,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAE9D,4EAA4E;IAC5E,uEAAuE;IACvE,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,gCAAgC;IAChC,MAAM,UAAU,GAAG;QACjB,GAAG,mBAAmB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;QAC/C,GAAG,CAAC,OAAO,CAAC,IAAI;YACd,CAAC,CAAC;gBACE,qCAAqC,EAAE,IAAI;gBAC3C,qCAAqC,EAAE,CAAC,oBAAoB,EAAE,MAAM,EAAE,iBAAiB,CAAC;gBACxF,gDAAgD,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;aAC7I;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,0EAA0E;QAC1E,iEAAiE;QACjE,yEAAyE;QACzE,MAAM,CAAC,GAAG,CACR,QAAQ,EACR,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EACvC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,IAAI,EAAE,aAAa,EAAE,UAAU,CAAC,cAAc,EAAE,CAAC,CACrH,CAAC;QACF,0EAA0E;QAC1E,yDAAyD;QACzD,MAAM,CAAC,GAAG,CAAC,yCAAyC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAClE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC;QAC1C,wEAAwE;QACxE,0EAA0E;QAC1E,yEAAyE;QACzE,8CAA8C;QAC9C,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YACpC,GAAG;iBACA,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,4EAA4E,EAAE,CAAC,CAAC;QACnI,CAAC,CAAC,CAAC;IACL,CAAC;IAED,gFAAgF;IAChF,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAE5E,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,uEAAuE;IACvE,MAAM,CAAC,GAAG,CAAC,kDAAkD,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC3E,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IACH,gEAAgE;IAChE,0EAA0E;IAC1E,wEAAwE;IACxE,oEAAoE;IACpE,MAAM,CAAC,GAAG,CAAC,mCAAmC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC5D,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,4CAA4C,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACrE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,gDAAgD,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACxE,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;QAC7E,GAAG,CAAC,IAAI,CAAC;YACP,QAAQ,EAAE,SAAS,CAAC,MAAM,GAAG,MAAM;YACnC,qBAAqB,EAAE,CAAC,WAAW,CAAC;YACpC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;YACpC,aAAa,EAAE,SAAS;SACzB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,CAAC,QAAgB,EAAW,EAAE;QAClD,IAAI,OAAO,CAAC,YAAY;YAAE,OAAO,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QACpF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAS,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpC,OAAO,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACrF,CAAC,CAAC;IAEF,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAChF,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC;QAC/B,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,IAA+C,CAAC;QAClF,MAAM,OAAO,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvG,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;YAChH,OAAO;QACT,CAAC;QACD,IAAI,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC,2CAA2C,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACvE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7D,WAAW,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC,wCAAwC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACpE,sEAAsE;YACtE,+CAA+C;YAC/C,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC5E,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;YAC5C,GAAG;iBACA,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,MAAM,CAAC;iBACZ,IAAI,CACH,eAAe,CACb,OAAQ,EACR,OAAO,CAAC,WAAW,EACnB;gBACE,UAAU,EAAE,WAAW,EAAE,WAAW;gBACpC,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,QAAQ,EAAE,QAAQ,CAAC,wBAAwB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;gBAC5F,YAAY,EAAE,cAAc,CAAC,WAAW,EAAE,aAAa,CAAC;aACzD,EACD,gBAAgB,CACjB,CACF,CAAC;YACJ,OAAO;QACT,CAAC;QACD,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,kCAAkC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7D,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE,QAAQ,CAAC,mBAAmB,EAAE,EAAE;YACrE,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,SAAS,CAAC,QAAQ,KAAK,QAAQ;YACvC,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,cAAc;YACtB,IAAI,EAAE,GAAG;SACV,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;YACjG,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,qCAAqC;QACpF,QAAQ,CAAC,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClF,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAA4D,CAAC;QACnG,MAAM,OAAO,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvG,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;YAChH,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;YAClG,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAC7C,OAAO,CAAC,IAAI,CAAC,oDAAoD,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC;YACjG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;YAClG,OAAO;QACT,CAAC;QACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,4CAA4C,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC5E,QAAQ,CAAC,iBAAiB,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC;YACrF,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;YACjG,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QAC9C,QAAQ,CAAC,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/auth/signed-token.js

@@ -0,0 +1,49 @@
+import crypto from 'node:crypto';
+/**
+ * Short-lived values the hub hands to a browser and expects back unchanged.
+ *
+ * Used for the login/consent form token, the session cookie, the consent CSRF
+ * token and the `state` of an outbound OAuth login. All of them share one
+ * property: the hub must recognise its own value without storing it, and must
+ * not be talked into accepting someone else's.
+ *
+ * The key throughout is `AuthStore.cookieSecret`.
+ */
+export function sign(value, secret) {
+    return crypto.createHmac('sha256', secret).update(value).digest('base64url');
+}
+/**
+ * Constant-time comparison against the expected signature.
+ *
+ * The length check is not an optimisation — `timingSafeEqual` throws on
+ * mismatched lengths, so a value of the wrong length would otherwise be an
+ * exception rather than a rejection.
+ */
+export function signatureMatches(value, signature, secret) {
+    const expected = sign(value, secret);
+    if (signature.length !== expected.length)
+        return false;
+    return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
+}
+/** `base64url(json).signature` — everything the caller needs, carried by the
+ *  browser instead of by the hub. */
+export function signPayload(payload, secret) {
+    const encoded = Buffer.from(JSON.stringify(payload)).toString('base64url');
+    return `${encoded}.${sign(encoded, secret)}`;
+}
+/** Undefined for anything that was not signed with this secret, or is not the
+ *  shape it claims. Never throws on malformed input. */
+export function readSignedPayload(token, secret) {
+    const [encoded, signature] = token.split('.');
+    if (!encoded || !signature)
+        return undefined;
+    if (!signatureMatches(encoded, signature, secret))
+        return undefined;
+    try {
+        return JSON.parse(Buffer.from(encoded, 'base64url').toString('utf8'));
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=signed-token.js.map

package/dist/auth/signed-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signed-token.js","sourceRoot":"","sources":["../../src/auth/signed-token.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC;;;;;;;;;GASG;AAEH,MAAM,UAAU,IAAI,CAAC,KAAa,EAAE,MAAc;IAChD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,SAAiB,EAAE,MAAc;IAC/E,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACrC,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACvD,OAAO,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED;qCACqC;AACrC,MAAM,UAAU,WAAW,CAAC,OAAgB,EAAE,MAAc;IAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3E,OAAO,GAAG,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED;wDACwD;AACxD,MAAM,UAAU,iBAAiB,CAAI,KAAa,EAAE,MAAc;IAChE,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IAC7C,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IACpE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAM,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}