@noodleseed/one 0.128.0 → 0.129.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/commands/deploy-preflight.d.ts.map +1 -1
- package/dist/commands/deploy-preflight.js +5 -2
- package/dist/commands/deploy-preflight.js.map +1 -1
- package/dist/commands/deploy-version-resolution.js +26 -2
- package/dist/commands/deploy-version-resolution.js.map +1 -1
- package/node_modules/@noodle-borg/agent-kit/package.json +1 -1
- package/node_modules/@noodle-borg/assistant-gateway/package.json +1 -1
- package/node_modules/@noodle-borg/auth/dist/index.d.ts +1 -0
- package/node_modules/@noodle-borg/auth/dist/index.d.ts.map +1 -1
- package/node_modules/@noodle-borg/auth/dist/index.js +1 -0
- package/node_modules/@noodle-borg/auth/dist/index.js.map +1 -1
- package/node_modules/@noodle-borg/auth/dist/oauth-client-redirect-policy.d.ts +34 -0
- package/node_modules/@noodle-borg/auth/dist/oauth-client-redirect-policy.d.ts.map +1 -0
- package/node_modules/@noodle-borg/auth/dist/oauth-client-redirect-policy.js +230 -0
- package/node_modules/@noodle-borg/auth/dist/oauth-client-redirect-policy.js.map +1 -0
- package/node_modules/@noodle-borg/compiler/dist/compile.d.ts.map +1 -1
- package/node_modules/@noodle-borg/compiler/dist/compile.js +4 -3
- package/node_modules/@noodle-borg/compiler/dist/compile.js.map +1 -1
- package/node_modules/@noodle-borg/compiler/dist/customer-endpoint.d.ts.map +1 -1
- package/node_modules/@noodle-borg/compiler/dist/customer-endpoint.js +2 -4
- package/node_modules/@noodle-borg/compiler/dist/customer-endpoint.js.map +1 -1
- package/node_modules/@noodle-borg/compiler/dist/manifest/auth-schema.d.ts.map +1 -1
- package/node_modules/@noodle-borg/compiler/dist/manifest/auth-schema.js +1 -3
- package/node_modules/@noodle-borg/compiler/dist/manifest/auth-schema.js.map +1 -1
- package/node_modules/@noodle-borg/compiler/dist/manifest/csp-origins.d.ts.map +1 -1
- package/node_modules/@noodle-borg/compiler/dist/manifest/csp-origins.js +7 -17
- package/node_modules/@noodle-borg/compiler/dist/manifest/csp-origins.js.map +1 -1
- package/node_modules/@noodle-borg/compiler/dist/manifest/parse-document.d.ts +9 -0
- package/node_modules/@noodle-borg/compiler/dist/manifest/parse-document.d.ts.map +1 -0
- package/node_modules/@noodle-borg/compiler/dist/manifest/parse-document.js +19 -0
- package/node_modules/@noodle-borg/compiler/dist/manifest/parse-document.js.map +1 -0
- package/node_modules/@noodle-borg/compiler/package.json +0 -3
- package/node_modules/@noodle-borg/oauth-client-registry/dist/authorization-handler.d.ts +17 -0
- package/node_modules/@noodle-borg/oauth-client-registry/dist/authorization-handler.d.ts.map +1 -0
- package/node_modules/@noodle-borg/oauth-client-registry/dist/authorization-handler.js +118 -0
- package/node_modules/@noodle-borg/oauth-client-registry/dist/authorization-handler.js.map +1 -0
- package/node_modules/@noodle-borg/oauth-client-registry/dist/client-registration-handler.d.ts +18 -0
- package/node_modules/@noodle-borg/oauth-client-registry/dist/client-registration-handler.d.ts.map +1 -0
- package/node_modules/@noodle-borg/oauth-client-registry/dist/client-registration-handler.js +130 -0
- package/node_modules/@noodle-borg/oauth-client-registry/dist/client-registration-handler.js.map +1 -0
- package/node_modules/@noodle-borg/oauth-client-registry/dist/index.d.ts +5 -0
- package/node_modules/@noodle-borg/oauth-client-registry/dist/index.d.ts.map +1 -0
- package/node_modules/@noodle-borg/oauth-client-registry/dist/index.js +5 -0
- package/node_modules/@noodle-borg/oauth-client-registry/dist/index.js.map +1 -0
- package/node_modules/@noodle-borg/oauth-client-registry/dist/legacy-inventory.d.ts +54 -0
- package/node_modules/@noodle-borg/oauth-client-registry/dist/legacy-inventory.d.ts.map +1 -0
- package/node_modules/@noodle-borg/oauth-client-registry/dist/legacy-inventory.js +256 -0
- package/node_modules/@noodle-borg/oauth-client-registry/dist/legacy-inventory.js.map +1 -0
- package/node_modules/@noodle-borg/oauth-client-registry/dist/legacy-redirect-rollout.d.ts +7 -0
- package/node_modules/@noodle-borg/oauth-client-registry/dist/legacy-redirect-rollout.d.ts.map +1 -0
- package/node_modules/@noodle-borg/oauth-client-registry/dist/legacy-redirect-rollout.js +6 -0
- package/node_modules/@noodle-borg/oauth-client-registry/dist/legacy-redirect-rollout.js.map +1 -0
- package/node_modules/@noodle-borg/oauth-client-registry/package.json +36 -0
- package/node_modules/@noodle-borg/service/dist/oauth/app.d.ts +2 -1
- package/node_modules/@noodle-borg/service/dist/oauth/app.d.ts.map +1 -1
- package/node_modules/@noodle-borg/service/dist/oauth/app.js +3 -21
- package/node_modules/@noodle-borg/service/dist/oauth/app.js.map +1 -1
- package/node_modules/@noodle-borg/service/dist/oauth/service-bootstrap.d.ts.map +1 -1
- package/node_modules/@noodle-borg/service/dist/oauth/service-bootstrap.js +1 -0
- package/node_modules/@noodle-borg/service/dist/oauth/service-bootstrap.js.map +1 -1
- package/node_modules/@noodle-borg/service/dist/serve-assistant-stores.d.ts +5 -3
- package/node_modules/@noodle-borg/service/dist/serve-assistant-stores.d.ts.map +1 -1
- package/node_modules/@noodle-borg/service/dist/serve-assistant-stores.js +13 -3
- package/node_modules/@noodle-borg/service/dist/serve-assistant-stores.js.map +1 -1
- package/node_modules/@noodle-borg/service/dist/serve.d.ts.map +1 -1
- package/node_modules/@noodle-borg/service/dist/serve.js +4 -1
- package/node_modules/@noodle-borg/service/dist/serve.js.map +1 -1
- package/node_modules/@noodle-borg/service/package.json +2 -1
- package/node_modules/@noodleseed/assistant/package.json +1 -1
- package/package.json +3 -2
- package/node_modules/@noodle-borg/compiler/dist/cli.d.ts +0 -3
- package/node_modules/@noodle-borg/compiler/dist/cli.d.ts.map +0 -1
- package/node_modules/@noodle-borg/compiler/dist/cli.js +0 -19
- package/node_modules/@noodle-borg/compiler/dist/cli.js.map +0 -1
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import { isIP } from 'node:net';
|
|
2
2
|
import { parse as parseDomain } from 'tldts';
|
|
3
|
+
import { isRecord } from './manifest/parse-document.js';
|
|
3
4
|
const CUSTOMER_ENDPOINT_NAME_PATTERN = /^[a-z0-9_]+$/;
|
|
4
5
|
const CONTROL_CHARACTER_PATTERN = /\p{Cc}/u;
|
|
5
6
|
const MAX_CUSTOMER_ENDPOINT_URL_BYTES = 2_048;
|
|
@@ -11,9 +12,6 @@ const DOMAIN_PARSE_OPTIONS = {
|
|
|
11
12
|
function invalidPolicy() {
|
|
12
13
|
throw new Error('invalid customer endpoint policy');
|
|
13
14
|
}
|
|
14
|
-
function isPlainRecord(value) {
|
|
15
|
-
return typeof value === 'object' && value !== null && !Array.isArray(value);
|
|
16
|
-
}
|
|
17
15
|
function hasUnsafeAuthoredCharacters(value) {
|
|
18
16
|
return value !== value.trim() || CONTROL_CHARACTER_PATTERN.test(value);
|
|
19
17
|
}
|
|
@@ -148,7 +146,7 @@ function normalizeEntries(value, normalize) {
|
|
|
148
146
|
* never a resolved end-user claim value.
|
|
149
147
|
*/
|
|
150
148
|
export function normalizeCustomerEndpointPolicy(value) {
|
|
151
|
-
if (!
|
|
149
|
+
if (!isRecord(value))
|
|
152
150
|
return invalidPolicy();
|
|
153
151
|
const keys = Object.keys(value);
|
|
154
152
|
const hasOrigins = Object.hasOwn(value, 'allowedHttpsOrigins');
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"customer-endpoint.js","sourceRoot":"","sources":["../src/customer-endpoint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,KAAK,IAAI,WAAW,EAAE,MAAM,OAAO,CAAC;
|
|
1
|
+
{"version":3,"file":"customer-endpoint.js","sourceRoot":"","sources":["../src/customer-endpoint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,KAAK,IAAI,WAAW,EAAE,MAAM,OAAO,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAExD,MAAM,8BAA8B,GAAG,cAAc,CAAC;AACtD,MAAM,yBAAyB,GAAG,SAAS,CAAC;AAC5C,MAAM,+BAA+B,GAAG,KAAK,CAAC;AAE9C,MAAM,oBAAoB,GAAG;IAC3B,mBAAmB,EAAE,IAAI;IACzB,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,KAAK;CACd,CAAC;AAkBX,SAAS,aAAa;IACpB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,2BAA2B,CAAC,KAAa;IAChD,OAAO,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAa;IAC/C,OAAO,mCAAmC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,SAAS,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAChC,MAAM,cAAc,GAAG,SAAS,GAAG,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,cAAc,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACxF,OAAO,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,4BAA4B,CAAC,KAAa;IACjD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,SAAS,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAChC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC;IACpD,IAAI,SAAS,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAChC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACpC,OAAO,CACL,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAChG,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,SAAS,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAChC,MAAM,cAAc,GAAG,SAAS,GAAG,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IACrD,OAAO,SAAS,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC;AACzD,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,OAAO,WAAW,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB;IACpC,MAAM,WAAW,GACf,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACxF,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAgB;IAC7C,OAAO,CACL,QAAQ,CAAC,MAAM,IAAI,GAAG;QACtB,QAAQ;aACL,KAAK,CAAC,GAAG,CAAC;aACV,KAAK,CACJ,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,MAAM,GAAG,CAAC;YAChB,KAAK,CAAC,MAAM,IAAI,EAAE;YAClB,oCAAoC,CAAC,IAAI,CAAC,KAAK,CAAC,CACnD,CACJ,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,QAAgB;IAClD,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7E,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACvC,OAAO,CACL,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAC5B,MAAM,CAAC,IAAI,KAAK,KAAK;QACrB,MAAM,CAAC,YAAY,KAAK,KAAK;QAC7B,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC;QACtD,MAAM,CAAC,MAAM,KAAK,IAAI,CACvB,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,CAAC,0BAA0B,CAAC,KAAK,CAAC;QAClC,2BAA2B,CAAC,KAAK,CAAC;QAClC,iBAAiB,CAAC,KAAK,CAAC;QACxB,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAC1B,CAAC;QACD,OAAO,aAAa,EAAE,CAAC;IACzB,CAAC;IAED,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,aAAa,EAAE,CAAC;IACzB,CAAC;IAED,IACE,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACzB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,QAAQ,KAAK,GAAG;QACpB,GAAG,CAAC,MAAM,KAAK,EAAE;QACjB,GAAG,CAAC,IAAI,KAAK,EAAE;QACf,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAC1B,CAAC;QACD,OAAO,aAAa,EAAE,CAAC;IACzB,CAAC;IAED,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,aAAa,EAAE,CAAC;IACtE,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAc;IAC7C,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,2BAA2B,CAAC,KAAK,CAAC;QAClC,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EACxF,CAAC;QACD,OAAO,aAAa,EAAE,CAAC;IACzB,CAAC;IAED,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,aAAa,EAAE,CAAC;IACzB,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,aAAa,EAAE,CAAC;IAE1E,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC9B,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC;QAAE,OAAO,aAAa,EAAE,CAAC;IACvF,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACvC,IACE,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAC5B,MAAM,CAAC,IAAI,KAAK,KAAK;QACrB,MAAM,CAAC,YAAY,KAAK,KAAK;QAC7B,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC;QACtD,MAAM,CAAC,MAAM,KAAK,IAAI;QACtB,MAAM,CAAC,YAAY,KAAK,QAAQ,EAChC,CAAC;QACD,OAAO,aAAa,EAAE,CAAC;IACzB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAc,EACd,SAAqC;IAErC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,aAAa,EAAE,CAAC;IACxE,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,aAAa,EAAE,CAAC;IACpD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAAC,KAAc;IAC5D,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,aAAa,EAAE,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;IAC/D,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAAC;IACrE,IACE,UAAU,KAAK,WAAW;QAC1B,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,qBAAqB,IAAI,GAAG,KAAK,0BAA0B,CAAC,EACvF,CAAC;QACD,OAAO,aAAa,EAAE,CAAC;IACzB,CAAC;IAED,IAAI,UAAU,EAAE,CAAC;QACf,OAAO;YACL,mBAAmB,EAAE,gBAAgB,CAAC,KAAK,CAAC,mBAAmB,EAAE,oBAAoB,CAAC;SACvF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,wBAAwB,EAAE,gBAAgB,CACxC,KAAK,CAAC,wBAAwB,EAC9B,uBAAuB,CACxB;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,IAAa;IACvD,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,KAAqC,CAAC,IAAI,KAAK,kBAAkB,CACnE,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAY;IACxC,IACE,OAAO,GAAG,KAAK,QAAQ;QACvB,GAAG,CAAC,MAAM,KAAK,CAAC;QAChB,CAAC,0BAA0B,CAAC,GAAG,CAAC;QAChC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,GAAG,+BAA+B;QAC1E,2BAA2B,CAAC,GAAG,CAAC;QAChC,iBAAiB,CAAC,GAAG,CAAC;QACtB,4BAA4B,CAAC,GAAG,CAAC,EACjC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IACE,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACzB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,MAAM,KAAK,EAAE;QACjB,GAAG,CAAC,IAAI,KAAK,EAAE;QACf,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC1B,CAAC,0BAA0B,CAAC,GAAG,CAAC,QAAQ,CAAC,EACzC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAC5C,GAAY,EACZ,MAA8B;IAE9B,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IAE5C,IAAI,gBAAwC,CAAC;IAC7C,IAAI,CAAC;QACH,gBAAgB,GAAG,+BAA+B,CAAC,MAAM,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,IAAI,qBAAqB,IAAI,gBAAgB,EAAE,CAAC;QAC9C,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvF,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,gBAAgB,CAAC,wBAAwB,CAAC,IAAI,CAC5D,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC,CAC3E,CAAC;QACF,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACrC,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACnD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,GAAG,GAAG,CAAC,MAAM,GAAG,QAAQ,EAAE;KACpC,CAAC;AACJ,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth-schema.d.ts","sourceRoot":"","sources":["../../src/manifest/auth-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;
|
|
1
|
+
{"version":3,"file":"auth-schema.d.ts","sourceRoot":"","sources":["../../src/manifest/auth-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAoCxB,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AA+HD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAA0D,CAAC;AA2CxF,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAI7B,CAAC"}
|
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
import { z } from 'zod';
|
|
2
|
+
import { isRecord } from './parse-document.js';
|
|
2
3
|
const urlTemplateSchema = z.string().refine((value) => {
|
|
3
4
|
try {
|
|
4
5
|
new URL(value);
|
|
@@ -29,9 +30,6 @@ const oidcServerAuthSchema = z
|
|
|
29
30
|
.strict();
|
|
30
31
|
const CUSTOMER_ENDPOINT_NAME_PATTERN = /^[a-z0-9_]+$/;
|
|
31
32
|
const CUSTOMER_ENDPOINT_CLAIM_PATH_PATTERN = /^[^.]+(?:\.[^.]+)*$/u;
|
|
32
|
-
function isRecord(value) {
|
|
33
|
-
return typeof value === 'object' && value !== null && !Array.isArray(value);
|
|
34
|
-
}
|
|
35
33
|
const customerEndpointNameSchema = z.string().regex(CUSTOMER_ENDPOINT_NAME_PATTERN);
|
|
36
34
|
const customerEndpointClaimMappingSchema = z
|
|
37
35
|
.object({
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth-schema.js","sourceRoot":"","sources":["../../src/manifest/auth-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;
|
|
1
|
+
{"version":3,"file":"auth-schema.js","sourceRoot":"","sources":["../../src/manifest/auth-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE/C,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;IACpD,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,EAAE,eAAe,CAAC,CAAC;AAEpB,MAAM,sBAAsB,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,oBAAoB,GAAG,CAAC;KAC3B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;IAClC,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE;IACf,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,sBAAsB,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,8BAA8B,GAAG,cAAc,CAAC;AACtD,MAAM,oCAAoC,GAAG,sBAAsB,CAAC;AAMpE,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;AACpF,MAAM,kCAAkC,GAAG,CAAC;KACzC,MAAM,CAAC;IACN,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,KAAK,CACJ,oCAAoC,EACpC,yDAAyD,CAC1D;CACJ,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,SAAS,uBAAuB,CAC9B,KAAc;IAEd,MAAM,IAAI,GAAiD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/E,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;YAAE,SAAS;QACtE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,8BAA8B,GAAG,CAAC;KACrC,OAAO,EAAE;KACT,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAC9B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,qCAAqC;SAC/C,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,mCAAmC;SAC7C,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,OAAO,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,0BAA0B,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC9D,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC5C,OAAO,CAAC,QAAQ,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC;oBAC3B,OAAO,EAAE,KAAK,CAAC,OAAO;iBACvB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,MAAM,aAAa,GAAG,kCAAkC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5E,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;YAC3B,KAAK,MAAM,KAAK,IAAI,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC/C,OAAO,CAAC,QAAQ,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC;oBAC3B,OAAO,EAAE,KAAK,CAAC,OAAO;iBACvB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC,CAAC;KACD,SAAS,CAAC,uBAAuB,CAAC;KAClC,IAAI,CAAC;IACJ,IAAI,EAAE,QAAQ;IACd,aAAa,EAAE,CAAC;IAChB,aAAa,EAAE;QACb,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,8BAA8B,CAAC,MAAM;KAC/C;IACD,oBAAoB,EAAE;QACpB,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,oCAAoC,CAAC,MAAM;aACrD;SACF;QACD,QAAQ,EAAE,CAAC,OAAO,CAAC;QACnB,oBAAoB,EAAE,KAAK;KAC5B;CACF,CAAsE,CAAC;AAE1E,MAAM,yBAAyB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,SAAS,EAAE,8BAA8B;CAC1C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,sBAAsB,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;IAClC,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE;IACf,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IACzC,OAAO,EAAE,yBAAyB,CAAC,QAAQ,EAAE;CAC9C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,sBAAsB,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,SAAS,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACvC,YAAY,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC9C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC7C,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,KAAK,CAAC,iBAAiB,CAAC;SACxB,QAAQ,EAAE;IACb,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5E,IAAI,EAAE,sBAAsB,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,sBAAsB,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAExF,MAAM,yBAAyB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE;IACf,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IACzC,OAAO,EAAE,yBAAyB,CAAC,QAAQ,EAAE;CAC9C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,0BAA0B,GAAG,CAAC;KACjC,KAAK,CAAC,yBAAyB,CAAC;KAChC,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,WAAW,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE;QACpC,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACrD,IAAI,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC;gBACvB,OAAO,EAAE,0EAA0E;aACpF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,MAAM,6BAA6B,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IAChC,OAAO,EAAE,0BAA0B;CACpC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,6BAA6B,GAAG,sBAAsB,CAAC,MAAM,CACjE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,UAAU,IAAI,IAAI,CAAC,QAAQ,KAAK,WAAW,EACvE,EAAE,OAAO,EAAE,2EAA2E,EAAE,CACzF,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC;IACxC,sBAAsB;IACtB,6BAA6B;IAC7B,6BAA6B;CAC9B,CAAC,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"csp-origins.d.ts","sourceRoot":"","sources":["../../src/manifest/csp-origins.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"csp-origins.d.ts","sourceRoot":"","sources":["../../src/manifest/csp-origins.ts"],"names":[],"mappings":"AAUA,uGAAuG;AACvG,QAAA,MAAM,iBAAiB,gEAAiE,CAAC;AAEzF,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzD,MAAM,WAAW,QAAQ;IACvB,mCAAmC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kFAAkF;IAClF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,kDAAkD;IAClD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,8BAA8B;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,+CAA+C;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,kGAAkG;IAClG,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAW3D;AASD,UAAU,cAAc;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG,SAAS,GAC7C,SAAS,QAAQ,EAAE,CAuBrB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,QAAQ,EAAE,CASzE"}
|
|
@@ -1,17 +1,12 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* Widget CSP origin honorability — the canonical rule shared by the compiler (author-time diagnostics
|
|
3
3
|
* and the deploy gate) and mirrored by the first-party host renderer's `isSafeOrigin`
|
|
4
|
-
* (apps/console/app/lib/mcp/widget-host.ts).
|
|
5
|
-
*
|
|
6
|
-
*
|
|
7
|
-
*
|
|
8
|
-
* access it asked for with no feedback. This module lets the compiler surface that as a warning and the
|
|
9
|
-
* deploy route gate on it, so "valid" means "the host will honor exactly what you declared".
|
|
10
|
-
*
|
|
11
|
-
* SEP-1865's `baseUriDomains` is not a manifest field (ADR 0150): no supported host emits a `base-uri`
|
|
12
|
-
* directive, so the schema dropped it rather than offer a dead field. Unknown csp keys never gate.
|
|
4
|
+
* (apps/console/app/lib/mcp/widget-host.ts). The host silently drops any declared origin that is not
|
|
5
|
+
* an absolute https:// origin (http:// only for localhost), so a widget that declares one loses the
|
|
6
|
+
* access it asked for with no feedback; the compiler warns and the deploy route gates on the same
|
|
7
|
+
* rule. SEP-1865's `baseUriDomains` is not a manifest field (ADR 0150); unknown csp keys never gate.
|
|
13
8
|
*/
|
|
14
|
-
import {
|
|
9
|
+
import { isRecord, parseManifestDocument } from './parse-document.js';
|
|
15
10
|
/** The CSP domain lists the first-party host actually enforces (and therefore the ones we gate on). */
|
|
16
11
|
const HONORED_CSP_LISTS = ['connectDomains', 'resourceDomains', 'frameDomains'];
|
|
17
12
|
/**
|
|
@@ -36,9 +31,6 @@ function suggestHttpsOrigin(value) {
|
|
|
36
31
|
const candidate = `https://${value}`;
|
|
37
32
|
return isHonorableCspOrigin(candidate) ? candidate : undefined;
|
|
38
33
|
}
|
|
39
|
-
function isRecord(value) {
|
|
40
|
-
return typeof value === 'object' && value !== null && !Array.isArray(value);
|
|
41
|
-
}
|
|
42
34
|
/**
|
|
43
35
|
* Collect every unhonorable origin across the honored CSP lists of the given widgets. Pure and shape-
|
|
44
36
|
* tolerant so it can run on Zod-parsed manifest widgets (compiler) or JSON.parsed widgets (deploy route).
|
|
@@ -79,14 +71,12 @@ export function cspOriginFaults(widgets) {
|
|
|
79
71
|
export function cspFaultsInManifest(manifest) {
|
|
80
72
|
let parsed;
|
|
81
73
|
try {
|
|
82
|
-
parsed =
|
|
74
|
+
parsed = parseManifestDocument(manifest);
|
|
83
75
|
}
|
|
84
76
|
catch {
|
|
85
77
|
return [];
|
|
86
78
|
}
|
|
87
|
-
const widgets = isRecord(parsed) ? parsed.widgets :
|
|
88
|
-
if (!Array.isArray(widgets))
|
|
89
|
-
return [];
|
|
79
|
+
const widgets = isRecord(parsed) && Array.isArray(parsed.widgets) ? parsed.widgets : [];
|
|
90
80
|
return cspOriginFaults(widgets);
|
|
91
81
|
}
|
|
92
82
|
//# sourceMappingURL=csp-origins.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"csp-origins.js","sourceRoot":"","sources":["../../src/manifest/csp-origins.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"csp-origins.js","sourceRoot":"","sources":["../../src/manifest/csp-origins.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,QAAQ,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAEtE,uGAAuG;AACvG,MAAM,iBAAiB,GAAG,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,cAAc,CAAU,CAAC;AAmBzF;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACzB,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,CAAC,CAAC,CAC7F,CAAC;AACJ,CAAC;AAED,2GAA2G;AAC3G,SAAS,kBAAkB,CAAC,KAAa;IACvC,IAAI,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC,CAAC,8CAA8C;IACxG,MAAM,SAAS,GAAG,WAAW,KAAK,EAAE,CAAC;IACrC,OAAO,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC;AAOD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,OAA8C;IAE9C,MAAM,MAAM,GAAe,EAAE,CAAC;IAC9B,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE;QAC9C,MAAM,GAAG,GAAG,MAAM,EAAE,GAAG,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO;QAC3B,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;gBAAE,SAAS;YACtC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;gBAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,oBAAoB,CAAC,KAAK,CAAC;oBAAE,OAAO;gBACrE,MAAM,UAAU,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;gBAC7C,MAAM,CAAC,IAAI,CAAC;oBACV,MAAM,EAAE,MAAM,CAAC,IAAI;oBACnB,WAAW;oBACX,IAAI;oBACJ,KAAK;oBACL,KAAK;oBACL,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpD,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACxF,OAAO,eAAe,CAAC,OAAoC,CAAC,CAAC;AAC/D,CAAC"}
|
|
@@ -0,0 +1,9 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Parse a manifest document, JSON-first: yaml.parse allocates ~50x JSON.parse's transient
|
|
3
|
+
* memory on the multi-megabyte JSON manifests the CLI sends — it OOM-killed 512MiB hosted
|
|
4
|
+
* instances (IMPLEMENTATION-LOG 2026-08-19). Non-JSON falls back to YAML, errors unchanged.
|
|
5
|
+
*/
|
|
6
|
+
export declare function parseManifestDocument(source: string): unknown;
|
|
7
|
+
/** Shared shape guard for walking parsed manifest documents. */
|
|
8
|
+
export declare function isRecord(value: unknown): value is Record<string, unknown>;
|
|
9
|
+
//# sourceMappingURL=parse-document.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"parse-document.d.ts","sourceRoot":"","sources":["../../src/manifest/parse-document.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAM7D;AAED,gEAAgE;AAChE,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE"}
|
|
@@ -0,0 +1,19 @@
|
|
|
1
|
+
import { parse as parseYaml } from 'yaml';
|
|
2
|
+
/**
|
|
3
|
+
* Parse a manifest document, JSON-first: yaml.parse allocates ~50x JSON.parse's transient
|
|
4
|
+
* memory on the multi-megabyte JSON manifests the CLI sends — it OOM-killed 512MiB hosted
|
|
5
|
+
* instances (IMPLEMENTATION-LOG 2026-08-19). Non-JSON falls back to YAML, errors unchanged.
|
|
6
|
+
*/
|
|
7
|
+
export function parseManifestDocument(source) {
|
|
8
|
+
try {
|
|
9
|
+
return JSON.parse(source);
|
|
10
|
+
}
|
|
11
|
+
catch {
|
|
12
|
+
return parseYaml(source);
|
|
13
|
+
}
|
|
14
|
+
}
|
|
15
|
+
/** Shared shape guard for walking parsed manifest documents. */
|
|
16
|
+
export function isRecord(value) {
|
|
17
|
+
return typeof value === 'object' && value !== null && !Array.isArray(value);
|
|
18
|
+
}
|
|
19
|
+
//# sourceMappingURL=parse-document.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"parse-document.js","sourceRoot":"","sources":["../../src/manifest/parse-document.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAE1C;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAY,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}
|
|
@@ -0,0 +1,17 @@
|
|
|
1
|
+
import type { OAuthServerProvider } from '@modelcontextprotocol/sdk/server/auth/provider.js';
|
|
2
|
+
import { type RequestHandler } from 'express';
|
|
3
|
+
import { type Options as RateLimitOptions } from 'express-rate-limit';
|
|
4
|
+
import { type OAuthLegacyRedirectRollout } from './legacy-redirect-rollout.js';
|
|
5
|
+
export type AuthorizationRedirectScalarFields = Readonly<Record<string, string | number | boolean>>;
|
|
6
|
+
export interface AuthorizationRedirectLogger {
|
|
7
|
+
info(event: string, scalarFields: AuthorizationRedirectScalarFields): void;
|
|
8
|
+
}
|
|
9
|
+
export interface SafeAuthorizationHandlerOptions {
|
|
10
|
+
readonly provider: OAuthServerProvider;
|
|
11
|
+
readonly logger?: AuthorizationRedirectLogger | undefined;
|
|
12
|
+
readonly rollout?: OAuthLegacyRedirectRollout;
|
|
13
|
+
readonly rateLimit?: Partial<RateLimitOptions> | false;
|
|
14
|
+
}
|
|
15
|
+
/** Guard authorization redirects with Noodle policy before the SDK can redirect to a client callback. */
|
|
16
|
+
export declare function safeAuthorizationHandler({ provider, logger, rollout, rateLimit: rateLimitConfig, }: SafeAuthorizationHandlerOptions): RequestHandler;
|
|
17
|
+
//# sourceMappingURL=authorization-handler.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"authorization-handler.d.ts","sourceRoot":"","sources":["../src/authorization-handler.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mDAAmD,CAAC;AAO7F,OAAgB,EAAE,KAAK,cAAc,EAAE,MAAM,SAAS,CAAC;AACvD,OAAO,EAAE,KAAK,OAAO,IAAI,gBAAgB,EAAa,MAAM,oBAAoB,CAAC;AACjF,OAAO,EACL,KAAK,0BAA0B,EAEhC,MAAM,8BAA8B,CAAC;AAOtC,MAAM,MAAM,iCAAiC,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;AAEpG,MAAM,WAAW,2BAA2B;IAC1C,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,iCAAiC,GAAG,IAAI,CAAC;CAC5E;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,2BAA2B,GAAG,SAAS,CAAC;IAC1D,QAAQ,CAAC,OAAO,CAAC,EAAE,0BAA0B,CAAC;IAC9C,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC;CACxD;AAED,yGAAyG;AACzG,wBAAgB,wBAAwB,CAAC,EACvC,QAAQ,EACR,MAAoB,EACpB,OAAqC,EACrC,SAAS,EAAE,eAAe,GAC3B,EAAE,+BAA+B,GAAG,cAAc,CAqBlD"}
|
|
@@ -0,0 +1,118 @@
|
|
|
1
|
+
import { InvalidRequestError, ServerError, TooManyRequestsError, } from '@modelcontextprotocol/sdk/server/auth/errors.js';
|
|
2
|
+
import { authorizationHandler } from '@modelcontextprotocol/sdk/server/auth/handlers/authorize.js';
|
|
3
|
+
import { allowedMethods } from '@modelcontextprotocol/sdk/server/auth/middleware/allowedMethods.js';
|
|
4
|
+
import { classifyStoredOAuthRedirectPolicy, matchOAuthAuthorizationRedirect, } from '@noodle-borg/auth';
|
|
5
|
+
import express, {} from 'express';
|
|
6
|
+
import { rateLimit } from 'express-rate-limit';
|
|
7
|
+
import { stageALegacyRedirectRollout, } from './legacy-redirect-rollout.js';
|
|
8
|
+
const POLICY_ERROR_DESCRIPTION = 'redirect_uri is not permitted for this client';
|
|
9
|
+
const LEGACY_OBSERVATION_EVENT = 'oauth.authorization_redirect.legacy_observed';
|
|
10
|
+
/** Guard authorization redirects with Noodle policy before the SDK can redirect to a client callback. */
|
|
11
|
+
export function safeAuthorizationHandler({ provider, logger = NOOP_LOGGER, rollout = stageALegacyRedirectRollout, rateLimit: rateLimitConfig, }) {
|
|
12
|
+
const router = express.Router();
|
|
13
|
+
router.use(allowedMethods(['GET', 'POST']));
|
|
14
|
+
router.use(express.urlencoded({ extended: false }));
|
|
15
|
+
if (rateLimitConfig !== false) {
|
|
16
|
+
router.use(rateLimit({
|
|
17
|
+
windowMs: 15 * 60 * 1000,
|
|
18
|
+
max: 100,
|
|
19
|
+
standardHeaders: true,
|
|
20
|
+
legacyHeaders: false,
|
|
21
|
+
message: new TooManyRequestsError('You have exceeded the rate limit for authorization requests').toResponseObject(),
|
|
22
|
+
...rateLimitConfig,
|
|
23
|
+
}));
|
|
24
|
+
}
|
|
25
|
+
router.use(authorizationRedirectGuard(provider, logger, rollout));
|
|
26
|
+
router.use(authorizationHandler({ provider, rateLimit: false }));
|
|
27
|
+
return router;
|
|
28
|
+
}
|
|
29
|
+
function authorizationRedirectGuard(provider, logger, rollout) {
|
|
30
|
+
return async (req, res, next) => {
|
|
31
|
+
const phaseOne = phaseOneInput(req.method === 'POST' ? req.body : req.query);
|
|
32
|
+
if (phaseOne === undefined) {
|
|
33
|
+
next();
|
|
34
|
+
return;
|
|
35
|
+
}
|
|
36
|
+
let client;
|
|
37
|
+
try {
|
|
38
|
+
client = await provider.clientsStore.getClient(phaseOne.clientId);
|
|
39
|
+
}
|
|
40
|
+
catch {
|
|
41
|
+
rejectStoreFailure(res);
|
|
42
|
+
return;
|
|
43
|
+
}
|
|
44
|
+
if (client === undefined) {
|
|
45
|
+
next();
|
|
46
|
+
return;
|
|
47
|
+
}
|
|
48
|
+
const effectiveRedirectUri = phaseOne.redirectUri ?? soleRegisteredRedirectUri(client.redirect_uris);
|
|
49
|
+
if (effectiveRedirectUri === undefined) {
|
|
50
|
+
next();
|
|
51
|
+
return;
|
|
52
|
+
}
|
|
53
|
+
const policyClass = classifyStoredOAuthRedirectPolicy(client);
|
|
54
|
+
const match = matchOAuthAuthorizationRedirect({
|
|
55
|
+
client,
|
|
56
|
+
requestedRedirectUri: effectiveRedirectUri,
|
|
57
|
+
allowLegacyLoopbackPortSubstitution: rollout.loopbackPortMode === 'observe',
|
|
58
|
+
});
|
|
59
|
+
if (policyClass === 'unsafe_legacy' || policyClass === 'malformed_legacy') {
|
|
60
|
+
observeLegacy(logger, policyClass, match);
|
|
61
|
+
if (rollout.unsafeLegacyMode === 'observe') {
|
|
62
|
+
next();
|
|
63
|
+
return;
|
|
64
|
+
}
|
|
65
|
+
rejectRedirect(res);
|
|
66
|
+
return;
|
|
67
|
+
}
|
|
68
|
+
if (policyClass === 'safe_loopback_legacy' && match.usedLegacyLoopbackPortSubstitution) {
|
|
69
|
+
observeLegacy(logger, policyClass, match);
|
|
70
|
+
}
|
|
71
|
+
if (!match.allowed) {
|
|
72
|
+
rejectRedirect(res);
|
|
73
|
+
return;
|
|
74
|
+
}
|
|
75
|
+
next();
|
|
76
|
+
};
|
|
77
|
+
}
|
|
78
|
+
function soleRegisteredRedirectUri(value) {
|
|
79
|
+
if (!Array.isArray(value) || value.length !== 1)
|
|
80
|
+
return undefined;
|
|
81
|
+
const [redirectUri] = value;
|
|
82
|
+
return typeof redirectUri === 'string' && URL.canParse(redirectUri) ? redirectUri : undefined;
|
|
83
|
+
}
|
|
84
|
+
function phaseOneInput(value) {
|
|
85
|
+
if (typeof value !== 'object' || value === null)
|
|
86
|
+
return undefined;
|
|
87
|
+
const input = value;
|
|
88
|
+
if (typeof input.client_id !== 'string')
|
|
89
|
+
return undefined;
|
|
90
|
+
if (input.redirect_uri === undefined)
|
|
91
|
+
return { clientId: input.client_id };
|
|
92
|
+
if (typeof input.redirect_uri !== 'string' || !URL.canParse(input.redirect_uri))
|
|
93
|
+
return undefined;
|
|
94
|
+
return { clientId: input.client_id, redirectUri: input.redirect_uri };
|
|
95
|
+
}
|
|
96
|
+
function observeLegacy(logger, policyClass, match) {
|
|
97
|
+
try {
|
|
98
|
+
logger.info(LEGACY_OBSERVATION_EVENT, {
|
|
99
|
+
policyClass,
|
|
100
|
+
reason: match.reason,
|
|
101
|
+
allowed: match.allowed,
|
|
102
|
+
usedLegacyLoopbackPortSubstitution: match.usedLegacyLoopbackPortSubstitution,
|
|
103
|
+
});
|
|
104
|
+
}
|
|
105
|
+
catch {
|
|
106
|
+
// Observation telemetry is non-authoritative and must not change authorization behavior.
|
|
107
|
+
}
|
|
108
|
+
}
|
|
109
|
+
function rejectRedirect(res) {
|
|
110
|
+
res.setHeader('Cache-Control', 'no-store');
|
|
111
|
+
res.status(400).json(new InvalidRequestError(POLICY_ERROR_DESCRIPTION).toResponseObject());
|
|
112
|
+
}
|
|
113
|
+
function rejectStoreFailure(res) {
|
|
114
|
+
res.setHeader('Cache-Control', 'no-store');
|
|
115
|
+
res.status(500).json(new ServerError('Internal Server Error').toResponseObject());
|
|
116
|
+
}
|
|
117
|
+
const NOOP_LOGGER = { info: () => undefined };
|
|
118
|
+
//# sourceMappingURL=authorization-handler.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"authorization-handler.js","sourceRoot":"","sources":["../src/authorization-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,WAAW,EACX,oBAAoB,GACrB,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,cAAc,EAAE,MAAM,oEAAoE,CAAC;AAGpG,OAAO,EACL,iCAAiC,EACjC,+BAA+B,GAEhC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,OAAO,EAAE,EAAuB,MAAM,SAAS,CAAC;AACvD,OAAO,EAAoC,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAEL,2BAA2B,GAC5B,MAAM,8BAA8B,CAAC;AAEtC,MAAM,wBAAwB,GAAG,+CAA+C,CAAC;AACjF,MAAM,wBAAwB,GAAG,8CAA8C,CAAC;AAiBhF,yGAAyG;AACzG,MAAM,UAAU,wBAAwB,CAAC,EACvC,QAAQ,EACR,MAAM,GAAG,WAAW,EACpB,OAAO,GAAG,2BAA2B,EACrC,SAAS,EAAE,eAAe,GACM;IAChC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAChC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACpD,IAAI,eAAe,KAAK,KAAK,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CACR,SAAS,CAAC;YACR,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;YACxB,GAAG,EAAE,GAAG;YACR,eAAe,EAAE,IAAI;YACrB,aAAa,EAAE,KAAK;YACpB,OAAO,EAAE,IAAI,oBAAoB,CAC/B,6DAA6D,CAC9D,CAAC,gBAAgB,EAAE;YACpB,GAAG,eAAe;SACnB,CAAC,CACH,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAClE,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACjE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,0BAA0B,CACjC,QAA6B,EAC7B,MAAmC,EACnC,OAAmC;IAEnC,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC9B,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC7E,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,MAA8C,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACxB,OAAO;QACT,CAAC;QACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,oBAAoB,GACxB,QAAQ,CAAC,WAAW,IAAI,yBAAyB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC1E,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACvC,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,iCAAiC,CAAC,MAAM,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,+BAA+B,CAAC;YAC5C,MAAM;YACN,oBAAoB,EAAE,oBAAoB;YAC1C,mCAAmC,EAAE,OAAO,CAAC,gBAAgB,KAAK,SAAS;SAC5E,CAAC,CAAC;QAEH,IAAI,WAAW,KAAK,eAAe,IAAI,WAAW,KAAK,kBAAkB,EAAE,CAAC;YAC1E,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;YAC1C,IAAI,OAAO,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;gBAC3C,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YACD,cAAc,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QAED,IAAI,WAAW,KAAK,sBAAsB,IAAI,KAAK,CAAC,kCAAkC,EAAE,CAAC;YACvF,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,cAAc,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc;IAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC;IAC5B,OAAO,OAAO,WAAW,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;AAChG,CAAC;AAED,SAAS,aAAa,CACpB,KAAc;IAEd,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;IAC3E,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC;QAAE,OAAO,SAAS,CAAC;IAClG,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;AACxE,CAAC;AAED,SAAS,aAAa,CACpB,MAAmC,EACnC,WAAsC,EACtC,KAA+B;IAE/B,IAAI,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE;YACpC,WAAW;YACX,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,kCAAkC,EAAE,KAAK,CAAC,kCAAkC;SAC7E,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,yFAAyF;IAC3F,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAkC;IACxD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,wBAAwB,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAkC;IAC5D,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,uBAAuB,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,WAAW,GAAgC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC"}
|
|
@@ -0,0 +1,18 @@
|
|
|
1
|
+
import type { OAuthRegisteredClientsStore } from '@modelcontextprotocol/sdk/server/auth/clients.js';
|
|
2
|
+
import { type OAuthClientInformationFull } from '@modelcontextprotocol/sdk/shared/auth.js';
|
|
3
|
+
import { type NormalizedOAuthRedirectClientMetadata } from '@noodle-borg/auth';
|
|
4
|
+
import { type RequestHandler } from 'express';
|
|
5
|
+
import { type Options as RateLimitOptions } from 'express-rate-limit';
|
|
6
|
+
export type RegisteredOAuthClient = OAuthClientInformationFull & Omit<NormalizedOAuthRedirectClientMetadata, 'redirect_uris'> & {
|
|
7
|
+
readonly redirect_uris: string[];
|
|
8
|
+
};
|
|
9
|
+
export interface SafeClientRegistrationHandlerOptions {
|
|
10
|
+
readonly clientsStore: OAuthRegisteredClientsStore;
|
|
11
|
+
readonly clientSecretExpirySeconds?: number;
|
|
12
|
+
readonly rateLimit?: Partial<RateLimitOptions> | false;
|
|
13
|
+
}
|
|
14
|
+
/**
|
|
15
|
+
* Preserve the MCP SDK's DCR transport while retaining Noodle's normalized redirect-policy metadata.
|
|
16
|
+
*/
|
|
17
|
+
export declare function safeClientRegistrationHandler({ clientsStore, clientSecretExpirySeconds, rateLimit: rateLimitConfig, }: SafeClientRegistrationHandlerOptions): RequestHandler;
|
|
18
|
+
//# sourceMappingURL=client-registration-handler.d.ts.map
|
package/node_modules/@noodle-borg/oauth-client-registry/dist/client-registration-handler.d.ts.map
ADDED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"client-registration-handler.d.ts","sourceRoot":"","sources":["../src/client-registration-handler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAQpG,OAAO,EACL,KAAK,0BAA0B,EAGhC,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACL,KAAK,qCAAqC,EAI3C,MAAM,mBAAmB,CAAC;AAE3B,OAAgB,EAA4B,KAAK,cAAc,EAAE,MAAM,SAAS,CAAC;AACjF,OAAO,EAAE,KAAK,OAAO,IAAI,gBAAgB,EAAa,MAAM,oBAAoB,CAAC;AAIjF,MAAM,MAAM,qBAAqB,GAAG,0BAA0B,GAC5D,IAAI,CAAC,qCAAqC,EAAE,eAAe,CAAC,GAAG;IAC7D,QAAQ,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC;CAClC,CAAC;AAEJ,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,YAAY,EAAE,2BAA2B,CAAC;IACnD,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAC5C,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC;CACxD;AAED;;GAEG;AACH,wBAAgB,6BAA6B,CAAC,EAC5C,YAAY,EACZ,yBAAgE,EAChE,SAAS,EAAE,eAAe,GAC3B,EAAE,oCAAoC,GAAG,cAAc,CAuEvD"}
|
|
@@ -0,0 +1,130 @@
|
|
|
1
|
+
import crypto from 'node:crypto';
|
|
2
|
+
import { InvalidClientMetadataError, OAuthError, ServerError, TooManyRequestsError, } from '@modelcontextprotocol/sdk/server/auth/errors.js';
|
|
3
|
+
import { allowedMethods } from '@modelcontextprotocol/sdk/server/auth/middleware/allowedMethods.js';
|
|
4
|
+
import { OAuthClientInformationFullSchema, OAuthClientMetadataSchema, } from '@modelcontextprotocol/sdk/shared/auth.js';
|
|
5
|
+
import { normalizeOAuthClientMetadata, OAuthRedirectPolicyError, } from '@noodle-borg/auth';
|
|
6
|
+
import cors from 'cors';
|
|
7
|
+
import express, {} from 'express';
|
|
8
|
+
import { rateLimit } from 'express-rate-limit';
|
|
9
|
+
const DEFAULT_CLIENT_SECRET_EXPIRY_SECONDS = 30 * 24 * 60 * 60;
|
|
10
|
+
/**
|
|
11
|
+
* Preserve the MCP SDK's DCR transport while retaining Noodle's normalized redirect-policy metadata.
|
|
12
|
+
*/
|
|
13
|
+
export function safeClientRegistrationHandler({ clientsStore, clientSecretExpirySeconds = DEFAULT_CLIENT_SECRET_EXPIRY_SECONDS, rateLimit: rateLimitConfig, }) {
|
|
14
|
+
if (!clientsStore.registerClient) {
|
|
15
|
+
throw new Error('Client registration store does not support registering clients');
|
|
16
|
+
}
|
|
17
|
+
const registerClient = clientsStore.registerClient.bind(clientsStore);
|
|
18
|
+
const router = express.Router();
|
|
19
|
+
router.use(cors());
|
|
20
|
+
router.use(allowedMethods(['POST']));
|
|
21
|
+
router.use(express.json());
|
|
22
|
+
router.use(invalidJsonHandler);
|
|
23
|
+
if (rateLimitConfig !== false) {
|
|
24
|
+
router.use(rateLimit({
|
|
25
|
+
windowMs: 60 * 60 * 1000,
|
|
26
|
+
max: 20,
|
|
27
|
+
standardHeaders: true,
|
|
28
|
+
legacyHeaders: false,
|
|
29
|
+
message: new TooManyRequestsError('You have exceeded the rate limit for client registration requests').toResponseObject(),
|
|
30
|
+
...rateLimitConfig,
|
|
31
|
+
}));
|
|
32
|
+
}
|
|
33
|
+
router.post('/', async (req, res) => {
|
|
34
|
+
res.setHeader('Cache-Control', 'no-store');
|
|
35
|
+
try {
|
|
36
|
+
const parseResult = OAuthClientMetadataSchema.safeParse(req.body);
|
|
37
|
+
if (!parseResult.success) {
|
|
38
|
+
throw new InvalidClientMetadataError(parseResult.error.message);
|
|
39
|
+
}
|
|
40
|
+
const submitted = requestObject(req.body);
|
|
41
|
+
const normalized = normalizeOAuthClientMetadata({
|
|
42
|
+
application_type: submitted.application_type,
|
|
43
|
+
redirect_uris: parseResult.data.redirect_uris,
|
|
44
|
+
token_endpoint_auth_method: submitted.token_endpoint_auth_method,
|
|
45
|
+
noodle_redirect_policy_version: submitted.noodle_redirect_policy_version,
|
|
46
|
+
});
|
|
47
|
+
const persistedPolicy = { ...normalized, redirect_uris: [...normalized.redirect_uris] };
|
|
48
|
+
const issuedAt = Math.floor(Date.now() / 1000);
|
|
49
|
+
const hasSecret = normalized.token_endpoint_auth_method === 'client_secret_post';
|
|
50
|
+
const credentials = hasSecret
|
|
51
|
+
? {
|
|
52
|
+
client_secret: crypto.randomBytes(32).toString('hex'),
|
|
53
|
+
client_secret_expires_at: clientSecretExpirySeconds > 0 ? issuedAt + clientSecretExpirySeconds : 0,
|
|
54
|
+
}
|
|
55
|
+
: {};
|
|
56
|
+
const client = {
|
|
57
|
+
...parseResult.data,
|
|
58
|
+
...persistedPolicy,
|
|
59
|
+
...credentials,
|
|
60
|
+
client_id: crypto.randomUUID(),
|
|
61
|
+
client_id_issued_at: issuedAt,
|
|
62
|
+
};
|
|
63
|
+
const stored = await registerClient(client);
|
|
64
|
+
res.status(201).json(validatedStoredClient(stored, persistedPolicy));
|
|
65
|
+
}
|
|
66
|
+
catch (error) {
|
|
67
|
+
const oauthError = registrationError(error);
|
|
68
|
+
const status = oauthError instanceof ServerError ? 500 : 400;
|
|
69
|
+
res.status(status).json(oauthError.toResponseObject());
|
|
70
|
+
}
|
|
71
|
+
});
|
|
72
|
+
return router;
|
|
73
|
+
}
|
|
74
|
+
const invalidJsonHandler = (error, _req, res, next) => {
|
|
75
|
+
if (!isInvalidJson(error)) {
|
|
76
|
+
next(error);
|
|
77
|
+
return;
|
|
78
|
+
}
|
|
79
|
+
res.setHeader('Cache-Control', 'no-store');
|
|
80
|
+
res
|
|
81
|
+
.status(400)
|
|
82
|
+
.json(new InvalidClientMetadataError('client metadata must be valid JSON').toResponseObject());
|
|
83
|
+
};
|
|
84
|
+
function isInvalidJson(error) {
|
|
85
|
+
if (!(error instanceof SyntaxError))
|
|
86
|
+
return false;
|
|
87
|
+
const parseError = error;
|
|
88
|
+
return parseError.status === 400 && parseError.type === 'entity.parse.failed';
|
|
89
|
+
}
|
|
90
|
+
function requestObject(value) {
|
|
91
|
+
return typeof value === 'object' && value !== null ? value : {};
|
|
92
|
+
}
|
|
93
|
+
function validatedStoredClient(value, normalized) {
|
|
94
|
+
const sdkRecord = OAuthClientInformationFullSchema.safeParse(value);
|
|
95
|
+
const stored = requestObject(value);
|
|
96
|
+
if (!sdkRecord.success ||
|
|
97
|
+
stored.application_type !== normalized.application_type ||
|
|
98
|
+
stored.token_endpoint_auth_method !== normalized.token_endpoint_auth_method ||
|
|
99
|
+
stored.noodle_redirect_policy_version !== normalized.noodle_redirect_policy_version ||
|
|
100
|
+
!sameRedirectUris(stored.redirect_uris, normalized.redirect_uris)) {
|
|
101
|
+
throw new ServerError('Internal Server Error');
|
|
102
|
+
}
|
|
103
|
+
return value;
|
|
104
|
+
}
|
|
105
|
+
function sameRedirectUris(actual, expected) {
|
|
106
|
+
return (Array.isArray(actual) &&
|
|
107
|
+
actual.length === expected.length &&
|
|
108
|
+
actual.every((value, index) => value === expected[index]));
|
|
109
|
+
}
|
|
110
|
+
function registrationError(error) {
|
|
111
|
+
if (error instanceof OAuthRedirectPolicyError) {
|
|
112
|
+
return new InvalidClientMetadataError(policyErrorDescription(error.reason));
|
|
113
|
+
}
|
|
114
|
+
if (error instanceof OAuthError)
|
|
115
|
+
return error;
|
|
116
|
+
return new ServerError('Internal Server Error');
|
|
117
|
+
}
|
|
118
|
+
function policyErrorDescription(reason) {
|
|
119
|
+
switch (reason) {
|
|
120
|
+
case 'invalid_application_type':
|
|
121
|
+
return 'application_type must be web or native';
|
|
122
|
+
case 'invalid_redirect_uris':
|
|
123
|
+
return 'redirect_uris must be a non-empty list of URI strings';
|
|
124
|
+
case 'unsafe_redirect_uri':
|
|
125
|
+
return 'redirect_uris must use HTTPS or a permitted loopback HTTP redirect without credentials or fragments';
|
|
126
|
+
case 'unsupported_token_endpoint_auth_method':
|
|
127
|
+
return 'token_endpoint_auth_method must be none or client_secret_post';
|
|
128
|
+
}
|
|
129
|
+
}
|
|
130
|
+
//# sourceMappingURL=client-registration-handler.js.map
|
package/node_modules/@noodle-borg/oauth-client-registry/dist/client-registration-handler.js.map
ADDED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"client-registration-handler.js","sourceRoot":"","sources":["../src/client-registration-handler.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EACL,0BAA0B,EAC1B,UAAU,EACV,WAAW,EACX,oBAAoB,GACrB,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,oEAAoE,CAAC;AACpG,OAAO,EAEL,gCAAgC,EAChC,yBAAyB,GAC1B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAEL,4BAA4B,EAC5B,wBAAwB,GAEzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,OAAO,EAAE,EAAiD,MAAM,SAAS,CAAC;AACjF,OAAO,EAAoC,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEjF,MAAM,oCAAoC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAa/D;;GAEG;AACH,MAAM,UAAU,6BAA6B,CAAC,EAC5C,YAAY,EACZ,yBAAyB,GAAG,oCAAoC,EAChE,SAAS,EAAE,eAAe,GACW;IACrC,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,cAAc,GAAG,YAAY,CAAC,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAChC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3B,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAE/B,IAAI,eAAe,KAAK,KAAK,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CACR,SAAS,CAAC;YACR,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;YACxB,GAAG,EAAE,EAAE;YACP,eAAe,EAAE,IAAI;YACrB,aAAa,EAAE,KAAK;YACpB,OAAO,EAAE,IAAI,oBAAoB,CAC/B,mEAAmE,CACpE,CAAC,gBAAgB,EAAE;YACpB,GAAG,eAAe;SACnB,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,yBAAyB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClE,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;gBACzB,MAAM,IAAI,0BAA0B,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC1C,MAAM,UAAU,GAAG,4BAA4B,CAAC;gBAC9C,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;gBAC5C,aAAa,EAAE,WAAW,CAAC,IAAI,CAAC,aAAa;gBAC7C,0BAA0B,EAAE,SAAS,CAAC,0BAA0B;gBAChE,8BAA8B,EAAE,SAAS,CAAC,8BAA8B;aACzE,CAAC,CAAC;YACH,MAAM,eAAe,GAAG,EAAE,GAAG,UAAU,EAAE,aAAa,EAAE,CAAC,GAAG,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACxF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC/C,MAAM,SAAS,GAAG,UAAU,CAAC,0BAA0B,KAAK,oBAAoB,CAAC;YACjF,MAAM,WAAW,GAAG,SAAS;gBAC3B,CAAC,CAAC;oBACE,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;oBACrD,wBAAwB,EACtB,yBAAyB,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,yBAAyB,CAAC,CAAC,CAAC,CAAC;iBAC3E;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,MAAM,GAA0B;gBACpC,GAAG,WAAW,CAAC,IAAI;gBACnB,GAAG,eAAe;gBAClB,GAAG,WAAW;gBACd,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE;gBAC9B,mBAAmB,EAAE,QAAQ;aAC9B,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,MAA+E,CAChF,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,UAAU,YAAY,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAC7D,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,kBAAkB,GAAwB,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACzE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,CAAC;QACZ,OAAO;IACT,CAAC;IACD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAC3C,GAAG;SACA,MAAM,CAAC,GAAG,CAAC;SACX,IAAI,CAAC,IAAI,0BAA0B,CAAC,oCAAoC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;AACnG,CAAC,CAAC;AAEF,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,CAAC,KAAK,YAAY,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,UAAU,GAAG,KAA+D,CAAC;IACnF,OAAO,UAAU,CAAC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,KAAK,qBAAqB,CAAC;AAChF,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/F,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAAc,EACd,UAAiD;IAEjD,MAAM,SAAS,GAAG,gCAAgC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACpC,IACE,CAAC,SAAS,CAAC,OAAO;QAClB,MAAM,CAAC,gBAAgB,KAAK,UAAU,CAAC,gBAAgB;QACvD,MAAM,CAAC,0BAA0B,KAAK,UAAU,CAAC,0BAA0B;QAC3E,MAAM,CAAC,8BAA8B,KAAK,UAAU,CAAC,8BAA8B;QACnF,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,EAAE,UAAU,CAAC,aAAa,CAAC,EACjE,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,uBAAuB,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,KAA8B,CAAC;AACxC,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAe,EAAE,QAA2B;IACpE,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACrB,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QACjC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,KAAK,YAAY,wBAAwB,EAAE,CAAC;QAC9C,OAAO,IAAI,0BAA0B,CAAC,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,KAAK,YAAY,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,IAAI,WAAW,CAAC,uBAAuB,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAsC;IACpE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,0BAA0B;YAC7B,OAAO,wCAAwC,CAAC;QAClD,KAAK,uBAAuB;YAC1B,OAAO,uDAAuD,CAAC;QACjE,KAAK,qBAAqB;YACxB,OAAO,qGAAqG,CAAC;QAC/G,KAAK,wCAAwC;YAC3C,OAAO,+DAA+D,CAAC;IAC3E,CAAC;AACH,CAAC"}
|
|
@@ -0,0 +1,5 @@
|
|
|
1
|
+
export { type AuthorizationRedirectLogger, type AuthorizationRedirectScalarFields, type SafeAuthorizationHandlerOptions, safeAuthorizationHandler, } from './authorization-handler.js';
|
|
2
|
+
export { type RegisteredOAuthClient, type SafeClientRegistrationHandlerOptions, safeClientRegistrationHandler, } from './client-registration-handler.js';
|
|
3
|
+
export { type LegacyOAuthRedirectInventoryCommandOptions, runLegacyOAuthRedirectInventoryCommand, } from './legacy-inventory.js';
|
|
4
|
+
export { type OAuthLegacyRedirectRollout, stageALegacyRedirectRollout, } from './legacy-redirect-rollout.js';
|
|
5
|
+
//# sourceMappingURL=index.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,iCAAiC,EACtC,KAAK,+BAA+B,EACpC,wBAAwB,GACzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,oCAAoC,EACzC,6BAA6B,GAC9B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,KAAK,0CAA0C,EAC/C,sCAAsC,GACvC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,KAAK,0BAA0B,EAC/B,2BAA2B,GAC5B,MAAM,8BAA8B,CAAC"}
|
|
@@ -0,0 +1,5 @@
|
|
|
1
|
+
export { safeAuthorizationHandler, } from './authorization-handler.js';
|
|
2
|
+
export { safeClientRegistrationHandler, } from './client-registration-handler.js';
|
|
3
|
+
export { runLegacyOAuthRedirectInventoryCommand, } from './legacy-inventory.js';
|
|
4
|
+
export { stageALegacyRedirectRollout, } from './legacy-redirect-rollout.js';
|
|
5
|
+
//# sourceMappingURL=index.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,wBAAwB,GACzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAGL,6BAA6B,GAC9B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAEL,sCAAsC,GACvC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,2BAA2B,GAC5B,MAAM,8BAA8B,CAAC"}
|