@ni-c/mcp-hub 0.9.2 → 0.11.0

package/dist/auth/rate-limit.js

@@ -0,0 +1,156 @@
+import net from 'node:net';
+/**
+ * The unit a budget is counted against.
+ *
+ * Not the address. One IPv6 address is not one caller: the smallest block
+ * handed to a single subscriber is a /64, and a residential line usually gets a
+ * /56 or /48 on top of that. A limiter keyed on the full address therefore
+ * counts a single host as billions of distinct callers, and every per-address
+ * budget in this file becomes decorative — a /64 walks around all of them
+ * without any infrastructure at all.
+ *
+ * IPv4 keeps its own address, where one address really is roughly one caller,
+ * and an IPv4-mapped form (`::ffff:1.2.3.4`, what a dual-stack listener reports
+ * for an IPv4 peer) is folded back onto it so the same client is not counted in
+ * two places depending on how the socket was opened.
+ *
+ * Only the KEY is bucketed. Log lines keep the full address — fail2ban bans
+ * what it is given, and it should be given the host that actually connected.
+ */
+export function rateLimitKey(ip) {
+    const bare = ip.replace(/^\[|\]$/g, '').split('%')[0];
+    if (net.isIPv4(bare))
+        return bare;
+    if (!net.isIPv6(bare))
+        return ip; // 'unknown', or something we cannot parse
+    const mapped = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/i.exec(bare);
+    if (mapped)
+        return mapped[1];
+    return `${expandIPv6(bare).slice(0, 4).join(':')}::/64`;
+}
+/** The eight hextets of an IPv6 address, with `::` filled back in. */
+function expandIPv6(address) {
+    const [head, tail] = address.toLowerCase().split('::');
+    const left = head ? head.split(':') : [];
+    const right = tail ? tail.split(':') : [];
+    const missing = 8 - left.length - right.length;
+    const groups = [...left, ...Array.from({ length: Math.max(0, missing) }, () => '0'), ...right];
+    // Leading zeros are not part of the value; without this `2001:0db8:…` and
+    // `2001:db8:…` would be two different keys for one network.
+    return groups.map(group => (Number.parseInt(group, 16) || 0).toString(16));
+}
+/**
+ * A per-caller request budget that rejects before any body is read.
+ *
+ * The SDK applies its own limits to the OAuth endpoints, but only after body
+ * parsing — which is the expensive part. This runs first, and refuses without
+ * inserting the offending address into its own table, so a flood of distinct
+ * source addresses cannot grow the map that is supposed to be bounding it.
+ */
+export function earlyRateLimit(windowMs, maxPerIp, maxTotal) {
+    const byIp = new Map();
+    let total = { count: 0, resetAt: 0 };
+    return (req, res, next) => {
+        const now = Date.now();
+        if (total.resetAt <= now)
+            total = { count: 0, resetAt: now + windowMs };
+        const ip = rateLimitKey(req.ip ?? 'unknown');
+        let entry = byIp.get(ip);
+        if (entry && entry.resetAt <= now) {
+            byIp.delete(ip);
+            entry = undefined;
+        }
+        // Reject before inserting anything: a flood of distinct rejected IPs must
+        // not grow the map. Accepted requests bound it at maxTotal per window.
+        if ((entry?.count ?? 0) >= maxPerIp || total.count >= maxTotal) {
+            res.set('Retry-After', String(Math.max(1, Math.ceil((Math.min(entry?.resetAt ?? Infinity, total.resetAt) - now) / 1000))));
+            res.status(429).json({ error: 'too_many_requests', error_description: 'Request rate limit exceeded' });
+            return;
+        }
+        if (!entry) {
+            if (byIp.size >= maxTotal) {
+                for (const [candidateIp, candidate] of byIp)
+                    if (candidate.resetAt <= now)
+                        byIp.delete(candidateIp);
+            }
+            entry = { count: 0, resetAt: now + windowMs };
+            byIp.set(ip, entry);
+        }
+        entry.count++;
+        total.count++;
+        next();
+    };
+}
+const LOGIN_MAX_ATTEMPTS = 10;
+const LOGIN_WINDOW_MS = 15 * 60_000;
+/** A global ceiling as well, so a distributed guess cannot spend the per-address
+ *  budget many times over. */
+const LOGIN_MAX_ATTEMPTS_TOTAL = 100;
+/**
+ * Per-caller lockout for the password form.
+ *
+ * Separate from `earlyRateLimit` because it counts FAILURES, not requests: a
+ * correct login resets the counter, so someone who knows the password is never
+ * locked out by someone else guessing from the same address.
+ */
+export class LoginRateLimiter {
+    attempts = new Map();
+    total = { count: 0, resetAt: 0 };
+    /**
+     * Whether this caller has spent its budget.
+     *
+     * The global ceiling refuses the callers that are doing the guessing, and
+     * only those. It used to refuse everyone, which turned an attacker's cheapest
+     * possible traffic into a lockout of the only administrative way in: a
+     * hundred wrong passwords — under a second of work, and renewable every
+     * fifteen minutes — left the operator holding the correct password and
+     * getting 429 from an address that had never been near the form.
+     *
+     * What the ceiling is for survives the change. A caller that guesses is
+     * counted, and once the hub as a whole is under a distributed attempt that
+     * caller is refused on its FIRST failure instead of its tenth — so the total
+     * number of guesses still collapses, and it collapses hardest for exactly the
+     * addresses doing the guessing. What no longer happens is that they can spend
+     * somebody else's budget. Repeated failures remain a fail2ban matter; that is
+     * what the log line exists for.
+     */
+    isBlocked(ip) {
+        const key = rateLimitKey(ip);
+        const entry = this.attempts.get(key);
+        const live = entry && entry.resetAt >= Date.now() ? entry : undefined;
+        if (this.total.resetAt > Date.now() && this.total.count >= LOGIN_MAX_ATTEMPTS_TOTAL && live !== undefined)
+            return true;
+        return (live?.count ?? 0) >= LOGIN_MAX_ATTEMPTS;
+    }
+    recordFailure(ip) {
+        this.sweepExpired(); // entries are otherwise only dropped on a successful login from that exact caller
+        const now = Date.now();
+        // Behind a reverse proxy req.ip is the proxy for every request, and a
+        // spoofable X-Forwarded-For makes the per-caller counter meaningless — this
+        // caps the total either way.
+        if (this.total.resetAt < now)
+            this.total = { count: 1, resetAt: now + LOGIN_WINDOW_MS };
+        else
+            this.total.count++;
+        const key = rateLimitKey(ip);
+        const entry = this.attempts.get(key);
+        if (!entry || entry.resetAt < now) {
+            this.attempts.set(key, { count: 1, resetAt: now + LOGIN_WINDOW_MS });
+        }
+        else {
+            entry.count++;
+        }
+    }
+    sweepExpired() {
+        const now = Date.now();
+        for (const [ip, entry] of this.attempts) {
+            if (entry.resetAt < now)
+                this.attempts.delete(ip);
+        }
+    }
+    reset(ip) {
+        this.attempts.delete(rateLimitKey(ip));
+        this.total = { count: 0, resetAt: 0 };
+    }
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist/auth/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../src/auth/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,UAAU,CAAC;AAI3B;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,YAAY,CAAC,EAAU;IACrC,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC,CAAC,0CAA0C;IAC5E,MAAM,MAAM,GAAG,qCAAqC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;AAC1D,CAAC;AAED,sEAAsE;AACtE,SAAS,UAAU,CAAC,OAAe;IACjC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1C,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC/C,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC;IAC/F,0EAA0E;IAC1E,4DAA4D;IAC5D,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,QAAgB,EAAE,QAAgB;IACjF,MAAM,IAAI,GAAG,IAAI,GAAG,EAA8C,CAAC;IACnE,IAAI,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACrC,OAAO,CAAC,GAAoB,EAAE,GAAqB,EAAE,IAA0B,EAAQ,EAAE;QACvF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,KAAK,CAAC,OAAO,IAAI,GAAG;YAAE,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,QAAQ,EAAE,CAAC;QACxE,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC,CAAC;QAC7C,IAAI,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzB,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;YAClC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAChB,KAAK,GAAG,SAAS,CAAC;QACpB,CAAC;QACD,0EAA0E;QAC1E,uEAAuE;QACvE,IAAI,CAAC,KAAK,EAAE,KAAK,IAAI,CAAC,CAAC,IAAI,QAAQ,IAAI,KAAK,CAAC,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC/D,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,IAAI,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3H,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACvG,OAAO;QACT,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,IAAI,CAAC,IAAI,IAAI,QAAQ,EAAE,CAAC;gBAC1B,KAAK,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,IAAI;oBAAE,IAAI,SAAS,CAAC,OAAO,IAAI,GAAG;wBAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACtG,CAAC;YACD,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,QAAQ,EAAE,CAAC;YAC9C,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACtB,CAAC;QACD,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,eAAe,GAAG,EAAE,GAAG,MAAM,CAAC;AACpC;8BAC8B;AAC9B,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAErC;;;;;;GAMG;AACH,MAAM,OAAO,gBAAgB;IACV,QAAQ,GAAG,IAAI,GAAG,EAA8C,CAAC;IAC1E,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAEzC;;;;;;;;;;;;;;;;;OAiBG;IACH,SAAS,CAAC,EAAU;QAClB,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,KAAK,IAAI,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,wBAAwB,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACvH,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC,IAAI,kBAAkB,CAAC;IAClD,CAAC;IAED,aAAa,CAAC,EAAU;QACtB,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,kFAAkF;QACvG,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,sEAAsE;QACtE,4EAA4E;QAC5E,6BAA6B;QAC7B,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG;YAAE,IAAI,CAAC,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,eAAe,EAAE,CAAC;;YACnF,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC;YAClC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,eAAe,EAAE,CAAC,CAAC;QACvE,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC,OAAO,GAAG,GAAG;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,EAAU;QACd,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACxC,CAAC;CACF"}

package/dist/auth/redirect-uri.js

@@ -0,0 +1,90 @@
+/**
+ * Where an authorization code is allowed to land.
+ *
+ * Both registration mechanisms end up handing a code to a URL the client chose,
+ * so both have to agree on which URLs are acceptable — they did not before:
+ * a metadata document was held to https-or-loopback while a dynamically
+ * registered client could name any scheme the SDK's three-entry denylist did
+ * not happen to cover, plain `http://` to a remote host included.
+ */
+const LOOPBACK_HOSTNAMES = new Set(['localhost', '127.0.0.1', '[::1]', '::1']);
+/** Schemes a browser or the operating system would treat as executable content
+ *  or local file access. Never a legitimate redirect target. */
+const DANGEROUS_SCHEMES = new Set(['javascript:', 'data:', 'vbscript:', 'file:', 'blob:']);
+function isLoopbackHostname(hostname) {
+    return LOOPBACK_HOSTNAMES.has(hostname);
+}
+/**
+ * https anywhere, plain http only on this machine, and — where the policy
+ * allows it — a private-use scheme for a native client.
+ *
+ * The point of refusing remote `http://` is that the code travels in the clear
+ * on the final redirect: anyone on the path between the browser and the client
+ * reads it, and a public client has nothing else to prove itself with.
+ */
+export function isSafeRedirectUri(uri, policy) {
+    let parsed;
+    try {
+        parsed = new URL(uri);
+    }
+    catch {
+        return false;
+    }
+    if (DANGEROUS_SCHEMES.has(parsed.protocol))
+        return false;
+    if (parsed.protocol === 'https:')
+        return true;
+    if (parsed.protocol === 'http:')
+        return isLoopbackHostname(parsed.hostname);
+    return policy.allowPrivateUseSchemes;
+}
+/**
+ * Whether a requested redirect URI is covered by a registered one.
+ *
+ * RFC 8252 §7.3: an authorization server MUST allow any port on a loopback
+ * redirect URI, because a native client is handed an ephemeral one by the
+ * operating system and cannot register it in advance. Everything else is an
+ * exact match — a prefix or origin comparison here is the classic open-redirect
+ * hole.
+ *
+ * Lives here rather than being imported because SDK v2 dropped it: the helper
+ * belonged to the authorization-server half, which the SDK no longer ships. It
+ * is a dozen lines, and keeping the loopback set shared with the checks above
+ * is worth more than the import was.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc8252#section-7.3
+ */
+export function redirectUriMatches(requested, registered) {
+    if (requested === registered)
+        return true;
+    let req;
+    let reg;
+    try {
+        req = new URL(requested);
+        reg = new URL(registered);
+    }
+    catch {
+        return false;
+    }
+    if (!isLoopbackHostname(req.hostname) || !isLoopbackHostname(reg.hostname))
+        return false;
+    return (req.protocol === reg.protocol && req.hostname === reg.hostname && req.pathname === reg.pathname && req.search === reg.search);
+}
+/**
+ * True when every redirect URI points at this machine — the case the MCP
+ * security considerations single out, because any local program could be the
+ * one asking. Used to warn on the login and consent pages.
+ */
+export function isLoopbackOnly(redirectUris) {
+    if (!redirectUris?.length)
+        return false;
+    return redirectUris.every(uri => {
+        try {
+            return isLoopbackHostname(new URL(uri).hostname);
+        }
+        catch {
+            return false;
+        }
+    });
+}
+//# sourceMappingURL=redirect-uri.js.map

package/dist/auth/redirect-uri.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect-uri.js","sourceRoot":"","sources":["../../src/auth/redirect-uri.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAE/E;gEACgE;AAChE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAE3F,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,OAAO,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAYD;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,MAAyB;IACtE,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5E,OAAO,MAAM,CAAC,sBAAsB,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAiB,EAAE,UAAkB;IACtE,IAAI,SAAS,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,GAAQ,CAAC;IACb,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QACzB,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACzF,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,CAC7H,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,YAAkC;IAC/D,IAAI,CAAC,YAAY,EAAE,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;QAC9B,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/auth/registration.js

@@ -0,0 +1,146 @@
+import express, { Router } from 'express';
+import { OAuthClientMetadataSchema } from '@modelcontextprotocol/core';
+import { isSafeRedirectUri } from './redirect-uri.js';
+import { earlyRateLimit } from './rate-limit.js';
+import { clampDisplayName, logSafe } from './text.js';
+/**
+ * RFC 7592, the management half of dynamic client registration: a client that
+ * registered itself can read, change and — the point of the exercise — delete
+ * its own registration, without the operator having to do it for them.
+ *
+ * None of this comes from the SDK. Its registration router accepts `POST` and
+ * nothing else (`allowedMethods(['POST'])`), and it knows nothing about
+ * `registration_access_token`. These routes therefore have to be mounted ahead
+ * of it, or the SDK answers `405` for every verb below.
+ *
+ * The credential is minted once at registration and only its hash is stored,
+ * so it is not recoverable from the state file — losing it means asking the
+ * operator to remove the registration.
+ */
+/** Where the client manages the registration it was just given. */
+export function registrationClientUri(externalUrl, clientId) {
+    return new URL(`register/${encodeURIComponent(clientId)}`, externalUrl).href;
+}
+/** The body limit is far above any real client metadata document and well
+ *  below anything that would matter to the process. */
+const MAX_METADATA_BYTES = '64kb';
+export function createRegistrationManagementRoutes(options) {
+    const { store, externalUrl } = options;
+    const router = Router();
+    const path = '/register/:clientId';
+    // Its own budget rather than the 20-per-hour one guarding POST /register.
+    // These are authenticated and cheap, and a client that reads and updates its
+    // registration should not thereby lose the ability to register again.
+    const limit = earlyRateLimit(15 * 60_000, 60, 600);
+    const present = (client) => ({
+        ...client,
+        registration_client_uri: registrationClientUri(externalUrl, client.client_id)
+    });
+    // The SDK gives POST /register an open CORS policy so browser-based clients
+    // can register; these routes sit in front of it and need their own. Opening
+    // them is safe: the credential is a bearer token in a header, never a cookie,
+    // so no browser attaches it to a cross-site request on its own.
+    const allowCrossOrigin = (res) => {
+        res.set('Access-Control-Allow-Origin', '*');
+    };
+    router.options(path, limit, (_req, res) => {
+        allowCrossOrigin(res);
+        res.set({
+            'Access-Control-Allow-Methods': 'GET, PUT, DELETE, OPTIONS',
+            'Access-Control-Allow-Headers': 'Authorization, Content-Type',
+            'Access-Control-Max-Age': '600'
+        });
+        res.status(204).end();
+    });
+    /**
+     * Authenticates before anything else runs — the body parser included, so an
+     * unauthenticated caller never gets to hand us a document to parse.
+     *
+     * An unknown client and a wrong token get the same answer. Telling them apart
+     * would turn this into a way to find out which client_ids exist.
+     */
+    const requireRegistrationToken = (req, res, next) => {
+        allowCrossOrigin(res);
+        const clientId = String(req.params.clientId);
+        const header = req.headers.authorization;
+        const token = typeof header === 'string' && header.startsWith('Bearer ') ? header.slice(7).trim() : '';
+        const client = token.length > 0 && store.verifyRegistrationToken(clientId, token) ? store.getClient(clientId) : undefined;
+        if (!client) {
+            console.warn(`mcp-hub: refused registration management for ${logSafe(clientId)}`);
+            res.set('WWW-Authenticate', 'Bearer error="invalid_token"');
+            res.status(401).json({ error: 'invalid_token', error_description: 'Invalid registration access token' });
+            return;
+        }
+        req.registrationClient = client;
+        next();
+    };
+    router.get(path, limit, requireRegistrationToken, (req, res) => {
+        res.json(present(req.registrationClient));
+    });
+    router.put(path, limit, requireRegistrationToken, express.json({ limit: MAX_METADATA_BYTES }), (req, res) => {
+        const existing = req.registrationClient;
+        const refuse = (description) => {
+            res.status(400).json({ error: 'invalid_client_metadata', error_description: description });
+        };
+        const body = (req.body ?? {});
+        // RFC 7592 §2.2: the client has to say which registration it means, and it
+        // may not use this to change its own credentials.
+        if (body.client_id !== existing.client_id) {
+            refuse('client_id must be present and match the registration being updated');
+            return;
+        }
+        // Only meaningful for a client that actually holds a secret. A public one
+        // was handed a throwaway secret in its registration response that was never
+        // stored (the accommodation ChatGPT needs), and echoing that back here must
+        // not be treated as an attempt to change anything.
+        if (existing.client_secret !== undefined && body.client_secret !== undefined && body.client_secret !== existing.client_secret) {
+            refuse('client_secret cannot be changed here');
+            return;
+        }
+        const parsed = OAuthClientMetadataSchema.safeParse(body);
+        if (!parsed.success) {
+            refuse('The submitted client metadata is not valid');
+            return;
+        }
+        const metadata = parsed.data;
+        for (const uri of metadata.redirect_uris ?? []) {
+            if (!isSafeRedirectUri(uri, { allowPrivateUseSchemes: true })) {
+                refuse(`redirect_uri ${uri} must be https, a loopback address or a private-use scheme`);
+                return;
+            }
+        }
+        const redirectsChanged = !sameUris(existing.redirect_uris, metadata.redirect_uris);
+        const updated = {
+            ...metadata,
+            client_name: clampDisplayName(metadata.client_name),
+            // Identity and credentials are the hub's to assign, not the client's.
+            client_id: existing.client_id,
+            client_id_issued_at: existing.client_id_issued_at,
+            ...(existing.client_secret !== undefined
+                ? { client_secret: existing.client_secret, client_secret_expires_at: existing.client_secret_expires_at }
+                : {})
+        };
+        // Consent was given for a destination. A client that moves the destination
+        // afterwards has to be asked again, or the approval would be transferable
+        // to somewhere the user never saw.
+        store.updateClient(updated, { resetApproval: redirectsChanged });
+        if (redirectsChanged) {
+            console.log(`mcp-hub: client ${logSafe(existing.client_id)} changed its redirect URIs; its approval was withdrawn`);
+        }
+        res.json(present(updated));
+    });
+    router.delete(path, limit, requireRegistrationToken, (req, res) => {
+        const clientId = req.registrationClient.client_id;
+        store.deleteClient(clientId);
+        console.log(`mcp-hub: client ${logSafe(clientId)} deleted its own registration`);
+        res.status(204).end();
+    });
+    return router;
+}
+/** Order is not part of the meaning of a redirect URI list. */
+function sameUris(before, after) {
+    const a = [...(before ?? [])].sort();
+    const b = [...(after ?? [])].sort();
+    return a.length === b.length && a.every((uri, index) => uri === b[index]);
+}
+//# sourceMappingURL=registration.js.map

package/dist/auth/registration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration.js","sourceRoot":"","sources":["../../src/auth/registration.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAG1C,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAEvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEtD;;;;;;;;;;;;;GAaG;AAEH,mEAAmE;AACnE,MAAM,UAAU,qBAAqB,CAAC,WAAmB,EAAE,QAAgB;IACzE,OAAO,IAAI,GAAG,CAAC,YAAY,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC;AAC/E,CAAC;AAYD;uDACuD;AACvD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,MAAM,UAAU,kCAAkC,CAAC,OAAsC;IACvF,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,IAAI,GAAG,qBAAqB,CAAC;IACnC,0EAA0E;IAC1E,6EAA6E;IAC7E,sEAAsE;IACtE,MAAM,KAAK,GAAG,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;IAEnD,MAAM,OAAO,GAAG,CAAC,MAAkC,EAA2B,EAAE,CAAC,CAAC;QAChF,GAAG,MAAM;QACT,uBAAuB,EAAE,qBAAqB,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC;KAC9E,CAAC,CAAC;IAEH,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,gEAAgE;IAChE,MAAM,gBAAgB,GAAG,CAAC,GAAa,EAAQ,EAAE;QAC/C,GAAG,CAAC,GAAG,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC,CAAC;IAEF,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACxC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC;YACN,8BAA8B,EAAE,2BAA2B;YAC3D,8BAA8B,EAAE,6BAA6B;YAC7D,wBAAwB,EAAE,KAAK;SAChC,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH;;;;;;OAMG;IACH,MAAM,wBAAwB,GAAG,CAAC,GAAwB,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QACrG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,MAAM,KAAK,GAAG,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvG,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1H,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,gDAAgD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAClF,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,8BAA8B,CAAC,CAAC;YAC5D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,mCAAmC,EAAE,CAAC,CAAC;YACzG,OAAO;QACT,CAAC;QACD,GAAG,CAAC,kBAAkB,GAAG,MAAM,CAAC;QAChC,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,GAAwB,EAAE,GAAG,EAAE,EAAE;QAClF,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAmB,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,wBAAwB,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,EAAE,CAAC,GAAwB,EAAE,GAAG,EAAE,EAAE;QAC/H,MAAM,QAAQ,GAAG,GAAG,CAAC,kBAAmB,CAAC;QACzC,MAAM,MAAM,GAAG,CAAC,WAAmB,EAAQ,EAAE;YAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC;QAC7F,CAAC,CAAC;QACF,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QACzD,2EAA2E;QAC3E,kDAAkD;QAClD,IAAI,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,EAAE,CAAC;YAC1C,MAAM,CAAC,oEAAoE,CAAC,CAAC;YAC7E,OAAO;QACT,CAAC;QACD,0EAA0E;QAC1E,4EAA4E;QAC5E,4EAA4E;QAC5E,mDAAmD;QACnD,IAAI,QAAQ,CAAC,aAAa,KAAK,SAAS,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa,EAAE,CAAC;YAC9H,MAAM,CAAC,sCAAsC,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,4CAA4C,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;QAC7B,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;YAC/C,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC9D,MAAM,CAAC,gBAAgB,GAAG,4DAA4D,CAAC,CAAC;gBACxF,OAAO;YACT,CAAC;QACH,CAAC;QACD,MAAM,gBAAgB,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;QACnF,MAAM,OAAO,GAAG;YACd,GAAG,QAAQ;YACX,WAAW,EAAE,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC;YACnD,sEAAsE;YACtE,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;YACjD,GAAG,CAAC,QAAQ,CAAC,aAAa,KAAK,SAAS;gBACtC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB,EAAE;gBACxG,CAAC,CAAC,EAAE,CAAC;SACsB,CAAC;QAChC,2EAA2E;QAC3E,0EAA0E;QAC1E,mCAAmC;QACnC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACjE,IAAI,gBAAgB,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,mBAAmB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,wDAAwD,CAAC,CAAC;QACtH,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,GAAwB,EAAE,GAAG,EAAE,EAAE;QACrF,MAAM,QAAQ,GAAG,GAAG,CAAC,kBAAmB,CAAC,SAAS,CAAC;QACnD,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,mBAAmB,OAAO,CAAC,QAAQ,CAAC,+BAA+B,CAAC,CAAC;QACjF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+DAA+D;AAC/D,SAAS,QAAQ,CAAC,MAA4B,EAAE,KAA2B;IACzE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5E,CAAC"}

package/dist/auth/session.js

@@ -0,0 +1,43 @@
+import { sign, signatureMatches } from './signed-token.js';
+/** Deliberately short: it only has to outlive a connector's authorization. */
+export const SESSION_TTL_MS = 30 * 60_000;
+export const SESSION_COOKIE = 'mcp_hub_session';
+/**
+ * The operator's browser session, carried entirely by the client.
+ *
+ * `"<expiresMs>.<HMAC>"` and nothing else — there is no session table, which is
+ * what lets the hub stay stateless while still recognising someone who has
+ * already typed the password. The value doubles as the handle the consent
+ * form's CSRF token is bound to.
+ *
+ * Shared rather than reimplemented: `hasValidSession` is read outside the auth
+ * layer (the upstream OAuth callback in `src/upstream/routes.ts`), so two
+ * copies of this format drifting apart would break a flow that neither of them
+ * looks like it owns.
+ */
+export function createSessionCookie(secret) {
+    const expires = String(Date.now() + SESSION_TTL_MS);
+    return `${expires}.${sign(expires, secret)}`;
+}
+/** The verified cookie value, or undefined when absent, forged or expired. */
+export function readSessionCookie(cookieHeader, secret) {
+    const match = cookieHeader?.match(new RegExp(`(?:^|;\\s*)${SESSION_COOKIE}=([^;]+)`));
+    if (!match)
+        return undefined;
+    const value = decodeURIComponent(match[1]);
+    const [expires, signature] = value.split('.');
+    if (!expires || !signature)
+        return undefined;
+    if (!signatureMatches(expires, signature, secret))
+        return undefined;
+    return Number(expires) > Date.now() ? value : undefined;
+}
+export function csrfToken(sessionValue, secret) {
+    return sign(`csrf:${sessionValue}`, secret);
+}
+export function verifyCsrfToken(sessionValue, token, secret) {
+    if (typeof token !== 'string')
+        return false;
+    return signatureMatches(`csrf:${sessionValue}`, token, secret);
+}
+//# sourceMappingURL=session.js.map

package/dist/auth/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,8EAA8E;AAC9E,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,MAAM,CAAC;AAC1C,MAAM,CAAC,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAEhD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC;IACpD,OAAO,GAAG,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,iBAAiB,CAAC,YAAgC,EAAE,MAAc;IAChF,MAAM,KAAK,GAAG,YAAY,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,cAAc,cAAc,UAAU,CAAC,CAAC,CAAC;IACtF,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IAC7C,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IACpE,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,YAAoB,EAAE,MAAc;IAC5D,OAAO,IAAI,CAAC,QAAQ,YAAY,EAAE,EAAE,MAAM,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,YAAoB,EAAE,KAAc,EAAE,MAAc;IAClF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,gBAAgB,CAAC,QAAQ,YAAY,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AACjE,CAAC"}

package/dist/auth/signed-token.js

@@ -0,0 +1,49 @@
+import crypto from 'node:crypto';
+/**
+ * Short-lived values the hub hands to a browser and expects back unchanged.
+ *
+ * Used for the login/consent form token, the session cookie, the consent CSRF
+ * token and the `state` of an outbound OAuth login. All of them share one
+ * property: the hub must recognise its own value without storing it, and must
+ * not be talked into accepting someone else's.
+ *
+ * The key throughout is `AuthStore.cookieSecret`.
+ */
+export function sign(value, secret) {
+    return crypto.createHmac('sha256', secret).update(value).digest('base64url');
+}
+/**
+ * Constant-time comparison against the expected signature.
+ *
+ * The length check is not an optimisation — `timingSafeEqual` throws on
+ * mismatched lengths, so a value of the wrong length would otherwise be an
+ * exception rather than a rejection.
+ */
+export function signatureMatches(value, signature, secret) {
+    const expected = sign(value, secret);
+    if (signature.length !== expected.length)
+        return false;
+    return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
+}
+/** `base64url(json).signature` — everything the caller needs, carried by the
+ *  browser instead of by the hub. */
+export function signPayload(payload, secret) {
+    const encoded = Buffer.from(JSON.stringify(payload)).toString('base64url');
+    return `${encoded}.${sign(encoded, secret)}`;
+}
+/** Undefined for anything that was not signed with this secret, or is not the
+ *  shape it claims. Never throws on malformed input. */
+export function readSignedPayload(token, secret) {
+    const [encoded, signature] = token.split('.');
+    if (!encoded || !signature)
+        return undefined;
+    if (!signatureMatches(encoded, signature, secret))
+        return undefined;
+    try {
+        return JSON.parse(Buffer.from(encoded, 'base64url').toString('utf8'));
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=signed-token.js.map

package/dist/auth/signed-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signed-token.js","sourceRoot":"","sources":["../../src/auth/signed-token.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC;;;;;;;;;GASG;AAEH,MAAM,UAAU,IAAI,CAAC,KAAa,EAAE,MAAc;IAChD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,SAAiB,EAAE,MAAc;IAC/E,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACrC,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACvD,OAAO,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED;qCACqC;AACrC,MAAM,UAAU,WAAW,CAAC,OAAgB,EAAE,MAAc;IAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3E,OAAO,GAAG,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED;wDACwD;AACxD,MAAM,UAAU,iBAAiB,CAAI,KAAa,EAAE,MAAc;IAChE,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IAC7C,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IACpE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAM,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}