@office-ai/aioncli-core 0.2.3 → 0.18.4

package/dist/src/mcp/oauth-utils.js

@@ -4,6 +4,8 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 import { getErrorMessage } from '../utils/errors.js';
+import { debugLogger } from '../utils/debugLogger.js';
+export const FIVE_MIN_BUFFER_MS = 5 * 60 * 1000;
 /**
  * Utility class for common OAuth operations.
  */
@@ -45,7 +47,7 @@ export class OAuthUtils {
             return (await response.json());
         }
         catch (error) {
-            console.debug(`Failed to fetch protected resource metadata from ${resourceMetadataUrl}: ${getErrorMessage(error)}`);
+            debugLogger.debug(`Failed to fetch protected resource metadata from ${resourceMetadataUrl}: ${getErrorMessage(error)}`);
             return null;
         }
     }
@@ -64,7 +66,7 @@ export class OAuthUtils {
             return (await response.json());
         }
         catch (error) {
-            console.debug(`Failed to fetch authorization server metadata from ${authServerMetadataUrl}: ${getErrorMessage(error)}`);
+            debugLogger.debug(`Failed to fetch authorization server metadata from ${authServerMetadataUrl}: ${getErrorMessage(error)}`);
             return null;
         }
     }
@@ -79,8 +81,45 @@ export class OAuthUtils {
             authorizationUrl: metadata.authorization_endpoint,
             tokenUrl: metadata.token_endpoint,
             scopes: metadata.scopes_supported || [],
+            registrationUrl: metadata.registration_endpoint,
         };
     }
+    /**
+     * Discover Oauth Authorization server metadata given an Auth server URL, by
+     * trying the standard well-known endpoints.
+     *
+     * @param authServerUrl The authorization server URL
+     * @returns The authorization server metadata or null if not found
+     */
+    static async discoverAuthorizationServerMetadata(authServerUrl) {
+        const authServerUrlObj = new URL(authServerUrl);
+        const base = `${authServerUrlObj.protocol}//${authServerUrlObj.host}`;
+        const endpointsToTry = [];
+        // With issuer URLs with path components, try the following well-known
+        // endpoints in order:
+        if (authServerUrlObj.pathname !== '/') {
+            // 1. OAuth 2.0 Authorization Server Metadata with path insertion
+            endpointsToTry.push(new URL(`/.well-known/oauth-authorization-server${authServerUrlObj.pathname}`, base).toString());
+            // 2. OpenID Connect Discovery 1.0 with path insertion
+            endpointsToTry.push(new URL(`/.well-known/openid-configuration${authServerUrlObj.pathname}`, base).toString());
+            // 3. OpenID Connect Discovery 1.0 with path appending
+            endpointsToTry.push(new URL(`${authServerUrlObj.pathname}/.well-known/openid-configuration`, base).toString());
+        }
+        // With issuer URLs without path components, and those that failed previous
+        // discoveries, try the following well-known endpoints in order:
+        // 1. OAuth 2.0 Authorization Server Metadata
+        endpointsToTry.push(new URL('/.well-known/oauth-authorization-server', base).toString());
+        // 2. OpenID Connect Discovery 1.0
+        endpointsToTry.push(new URL('/.well-known/openid-configuration', base).toString());
+        for (const endpoint of endpointsToTry) {
+            const authServerMetadata = await this.fetchAuthorizationServerMetadata(endpoint);
+            if (authServerMetadata) {
+                return authServerMetadata;
+            }
+        }
+        debugLogger.debug(`Metadata discovery failed for authorization server ${authServerUrl}`);
+        return null;
+    }
     /**
      * Discover OAuth configuration using the standard well-known endpoints.
      *
@@ -104,40 +143,29 @@ export class OAuthUtils {
             if (resourceMetadata?.authorization_servers?.length) {
                 // Use the first authorization server
                 const authServerUrl = resourceMetadata.authorization_servers[0];
-                // The authorization server URL may include a path (e.g., https://github.com/login/oauth)
-                // We need to preserve this path when constructing the metadata URL
-                const authServerUrlObj = new URL(authServerUrl);
-                const authServerPath = authServerUrlObj.pathname === '/' ? '' : authServerUrlObj.pathname;
-                // Try with the authorization server's path first
-                let authServerMetadataUrl = new URL(`/.well-known/oauth-authorization-server${authServerPath}`, `${authServerUrlObj.protocol}//${authServerUrlObj.host}`).toString();
-                let authServerMetadata = await this.fetchAuthorizationServerMetadata(authServerMetadataUrl);
-                // If that fails, try root as fallback
-                if (!authServerMetadata && authServerPath) {
-                    authServerMetadataUrl = new URL('/.well-known/oauth-authorization-server', `${authServerUrlObj.protocol}//${authServerUrlObj.host}`).toString();
-                    authServerMetadata = await this.fetchAuthorizationServerMetadata(authServerMetadataUrl);
-                }
+                const authServerMetadata = await this.discoverAuthorizationServerMetadata(authServerUrl);
                 if (authServerMetadata) {
                     const config = this.metadataToOAuthConfig(authServerMetadata);
                     if (authServerMetadata.registration_endpoint) {
-                        console.log('Dynamic client registration is supported at:', authServerMetadata.registration_endpoint);
+                        debugLogger.log('Dynamic client registration is supported at:', authServerMetadata.registration_endpoint);
                     }
                     return config;
                 }
             }
-            // Fallback: try /.well-known/oauth-authorization-server at the base URL
-            console.debug(`Trying OAuth discovery fallback at ${wellKnownUrls.authorizationServer}`);
-            const authServerMetadata = await this.fetchAuthorizationServerMetadata(wellKnownUrls.authorizationServer);
+            // Fallback: try well-known endpoints at the base URL
+            debugLogger.debug(`Trying OAuth discovery fallback at ${serverUrl}`);
+            const authServerMetadata = await this.discoverAuthorizationServerMetadata(serverUrl);
             if (authServerMetadata) {
                 const config = this.metadataToOAuthConfig(authServerMetadata);
                 if (authServerMetadata.registration_endpoint) {
-                    console.log('Dynamic client registration is supported at:', authServerMetadata.registration_endpoint);
+                    debugLogger.log('Dynamic client registration is supported at:', authServerMetadata.registration_endpoint);
                 }
                 return config;
             }
             return null;
         }
         catch (error) {
-            console.debug(`Failed to discover OAuth configuration: ${getErrorMessage(error)}`);
+            debugLogger.debug(`Failed to discover OAuth configuration: ${getErrorMessage(error)}`);
             return null;
         }
     }
@@ -171,18 +199,7 @@ export class OAuthUtils {
             return null;
         }
         const authServerUrl = resourceMetadata.authorization_servers[0];
-        // The authorization server URL may include a path (e.g., https://github.com/login/oauth)
-        // We need to preserve this path when constructing the metadata URL
-        const authServerUrlObj = new URL(authServerUrl);
-        const authServerPath = authServerUrlObj.pathname === '/' ? '' : authServerUrlObj.pathname;
-        // Build auth server metadata URL with the authorization server's path
-        const authServerMetadataUrl = new URL(`/.well-known/oauth-authorization-server${authServerPath}`, `${authServerUrlObj.protocol}//${authServerUrlObj.host}`).toString();
-        let authServerMetadata = await this.fetchAuthorizationServerMetadata(authServerMetadataUrl);
-        // If that fails and we have a path, also try the root path as a fallback
-        if (!authServerMetadata && authServerPath) {
-            const rootAuthServerMetadataUrl = new URL('/.well-known/oauth-authorization-server', `${authServerUrlObj.protocol}//${authServerUrlObj.host}`).toString();
-            authServerMetadata = await this.fetchAuthorizationServerMetadata(rootAuthServerMetadataUrl);
-        }
+        const authServerMetadata = await this.discoverAuthorizationServerMetadata(authServerUrl);
         if (authServerMetadata) {
             return this.metadataToOAuthConfig(authServerMetadata);
         }
@@ -215,7 +232,25 @@ export class OAuthUtils {
      */
     static buildResourceParameter(endpointUrl) {
         const url = new URL(endpointUrl);
-        return `${url.protocol}//${url.host}`;
+        return `${url.protocol}//${url.host}${url.pathname}`;
+    }
+    /**
+     * Parses a JWT string to extract its expiry time.
+     * @param idToken The JWT ID token.
+     * @returns The expiry time in **milliseconds**, or undefined if parsing fails.
+     */
+    static parseTokenExpiry(idToken) {
+        try {
+            const payload = JSON.parse(Buffer.from(idToken.split('.')[1], 'base64').toString());
+            if (payload && typeof payload.exp === 'number') {
+                return payload.exp * 1000; // Convert seconds to milliseconds
+            }
+        }
+        catch (e) {
+            console.error('Failed to parse ID token for expiry time with error:', e);
+        }
+        // Return undefined if try block fails or 'exp' is missing/invalid
+        return undefined;
     }
 }
 //# sourceMappingURL=oauth-utils.js.map

package/dist/src/mcp/oauth-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-utils.js","sourceRoot":"","sources":["../../../src/mcp/oauth-utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAgCrD;;GAEG;AACH,MAAM,OAAO,UAAU;IACrB;;;;OAIG;IACH,MAAM,CAAC,kBAAkB,CAAC,OAAe,EAAE,iBAAiB,GAAG,KAAK;QAClE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,GAAG,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;QAExD,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,qDAAqD;YACrD,OAAO;gBACL,iBAAiB,EAAE,IAAI,GAAG,CACxB,uCAAuC,EACvC,IAAI,CACL,CAAC,QAAQ,EAAE;gBACZ,mBAAmB,EAAE,IAAI,GAAG,CAC1B,yCAAyC,EACzC,IAAI,CACL,CAAC,QAAQ,EAAE;aACb,CAAC;QACJ,CAAC;QAED,8DAA8D;QAC9D,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,wBAAwB;QAClF,OAAO;YACL,iBAAiB,EAAE,IAAI,GAAG,CACxB,wCAAwC,UAAU,EAAE,EACpD,IAAI,CACL,CAAC,QAAQ,EAAE;YACZ,mBAAmB,EAAE,IAAI,GAAG,CAC1B,0CAA0C,UAAU,EAAE,EACtD,IAAI,CACL,CAAC,QAAQ,EAAE;SACb,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,8BAA8B,CACzC,mBAA2B;QAE3B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,CAAC;YAClD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmC,CAAC;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,oDAAoD,mBAAmB,KAAK,eAAe,CAAC,KAAK,CAAC,EAAE,CACrG,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAC3C,qBAA6B;QAE7B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACpD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAqC,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,sDAAsD,qBAAqB,KAAK,eAAe,CAAC,KAAK,CAAC,EAAE,CACzG,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,qBAAqB,CAC1B,QAA0C;QAE1C,OAAO;YACL,gBAAgB,EAAE,QAAQ,CAAC,sBAAsB;YACjD,QAAQ,EAAE,QAAQ,CAAC,cAAc;YACjC,MAAM,EAAE,QAAQ,CAAC,gBAAgB,IAAI,EAAE;SACxC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAC9B,SAAiB;QAEjB,IAAI,CAAC;YACH,0CAA0C;YAC1C,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAEhE,qDAAqD;YACrD,IAAI,gBAAgB,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAC9D,aAAa,CAAC,iBAAiB,CAChC,CAAC;YAEF,uEAAuE;YACvE,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC/B,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;oBACzC,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;oBAC/D,gBAAgB,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAC1D,aAAa,CAAC,iBAAiB,CAChC,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,IAAI,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC;gBACpD,qCAAqC;gBACrC,MAAM,aAAa,GAAG,gBAAgB,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;gBAEhE,yFAAyF;gBACzF,mEAAmE;gBACnE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;gBAChD,MAAM,cAAc,GAClB,gBAAgB,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC;gBAErE,iDAAiD;gBACjD,IAAI,qBAAqB,GAAG,IAAI,GAAG,CACjC,0CAA0C,cAAc,EAAE,EAC1D,GAAG,gBAAgB,CAAC,QAAQ,KAAK,gBAAgB,CAAC,IAAI,EAAE,CACzD,CAAC,QAAQ,EAAE,CAAC;gBAEb,IAAI,kBAAkB,GAAG,MAAM,IAAI,CAAC,gCAAgC,CAClE,qBAAqB,CACtB,CAAC;gBAEF,sCAAsC;gBACtC,IAAI,CAAC,kBAAkB,IAAI,cAAc,EAAE,CAAC;oBAC1C,qBAAqB,GAAG,IAAI,GAAG,CAC7B,yCAAyC,EACzC,GAAG,gBAAgB,CAAC,QAAQ,KAAK,gBAAgB,CAAC,IAAI,EAAE,CACzD,CAAC,QAAQ,EAAE,CAAC;oBACb,kBAAkB,GAAG,MAAM,IAAI,CAAC,gCAAgC,CAC9D,qBAAqB,CACtB,CAAC;gBACJ,CAAC;gBAED,IAAI,kBAAkB,EAAE,CAAC;oBACvB,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;oBAC9D,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;wBAC7C,OAAO,CAAC,GAAG,CACT,8CAA8C,EAC9C,kBAAkB,CAAC,qBAAqB,CACzC,CAAC;oBACJ,CAAC;oBACD,OAAO,MAAM,CAAC;gBAChB,CAAC;YACH,CAAC;YAED,wEAAwE;YACxE,OAAO,CAAC,KAAK,CACX,sCAAsC,aAAa,CAAC,mBAAmB,EAAE,CAC1E,CAAC;YACF,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,gCAAgC,CACpE,aAAa,CAAC,mBAAmB,CAClC,CAAC;YAEF,IAAI,kBAAkB,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;gBAC9D,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;oBAC7C,OAAO,CAAC,GAAG,CACT,8CAA8C,EAC9C,kBAAkB,CAAC,qBAAqB,CACzC,CAAC;gBACJ,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,2CAA2C,eAAe,CAAC,KAAK,CAAC,EAAE,CACpE,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,0BAA0B,CAAC,MAAc;QAC9C,2CAA2C;QAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC1D,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAC3C,eAAuB;QAEvB,MAAM,mBAAmB,GACvB,IAAI,CAAC,0BAA0B,CAAC,eAAe,CAAC,CAAC;QACnD,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,gBAAgB,GACpB,MAAM,IAAI,CAAC,8BAA8B,CAAC,mBAAmB,CAAC,CAAC;QACjE,IAAI,CAAC,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,aAAa,GAAG,gBAAgB,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAEhE,yFAAyF;QACzF,mEAAmE;QACnE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;QAChD,MAAM,cAAc,GAClB,gBAAgB,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC;QAErE,sEAAsE;QACtE,MAAM,qBAAqB,GAAG,IAAI,GAAG,CACnC,0CAA0C,cAAc,EAAE,EAC1D,GAAG,gBAAgB,CAAC,QAAQ,KAAK,gBAAgB,CAAC,IAAI,EAAE,CACzD,CAAC,QAAQ,EAAE,CAAC;QAEb,IAAI,kBAAkB,GAAG,MAAM,IAAI,CAAC,gCAAgC,CAClE,qBAAqB,CACtB,CAAC;QAEF,yEAAyE;QACzE,IAAI,CAAC,kBAAkB,IAAI,cAAc,EAAE,CAAC;YAC1C,MAAM,yBAAyB,GAAG,IAAI,GAAG,CACvC,yCAAyC,EACzC,GAAG,gBAAgB,CAAC,QAAQ,KAAK,gBAAgB,CAAC,IAAI,EAAE,CACzD,CAAC,QAAQ,EAAE,CAAC;YAEb,kBAAkB,GAAG,MAAM,IAAI,CAAC,gCAAgC,CAC9D,yBAAyB,CAC1B,CAAC;QACJ,CAAC;QAED,IAAI,kBAAkB,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;QACxD,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CAAC,YAAoB;QACxC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;QACxC,OAAO,GAAG,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;IACpD,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,aAAa,CAAC,GAAW;QAC9B,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,sBAAsB,CAAC,WAAmB;QAC/C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACjC,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;IACxC,CAAC;CACF"}
+{"version":3,"file":"oauth-utils.js","sourceRoot":"","sources":["../../../src/mcp/oauth-utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAgCtD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhD;;GAEG;AACH,MAAM,OAAO,UAAU;IACrB;;;;OAIG;IACH,MAAM,CAAC,kBAAkB,CAAC,OAAe,EAAE,iBAAiB,GAAG,KAAK;QAClE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,GAAG,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;QAExD,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,qDAAqD;YACrD,OAAO;gBACL,iBAAiB,EAAE,IAAI,GAAG,CACxB,uCAAuC,EACvC,IAAI,CACL,CAAC,QAAQ,EAAE;gBACZ,mBAAmB,EAAE,IAAI,GAAG,CAC1B,yCAAyC,EACzC,IAAI,CACL,CAAC,QAAQ,EAAE;aACb,CAAC;QACJ,CAAC;QAED,8DAA8D;QAC9D,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,wBAAwB;QAClF,OAAO;YACL,iBAAiB,EAAE,IAAI,GAAG,CACxB,wCAAwC,UAAU,EAAE,EACpD,IAAI,CACL,CAAC,QAAQ,EAAE;YACZ,mBAAmB,EAAE,IAAI,GAAG,CAC1B,0CAA0C,UAAU,EAAE,EACtD,IAAI,CACL,CAAC,QAAQ,EAAE;SACb,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,8BAA8B,CACzC,mBAA2B;QAE3B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,CAAC;YAClD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmC,CAAC;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,KAAK,CACf,oDAAoD,mBAAmB,KAAK,eAAe,CAAC,KAAK,CAAC,EAAE,CACrG,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAC3C,qBAA6B;QAE7B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACpD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAqC,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,KAAK,CACf,sDAAsD,qBAAqB,KAAK,eAAe,CAAC,KAAK,CAAC,EAAE,CACzG,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,qBAAqB,CAC1B,QAA0C;QAE1C,OAAO;YACL,gBAAgB,EAAE,QAAQ,CAAC,sBAAsB;YACjD,QAAQ,EAAE,QAAQ,CAAC,cAAc;YACjC,MAAM,EAAE,QAAQ,CAAC,gBAAgB,IAAI,EAAE;YACvC,eAAe,EAAE,QAAQ,CAAC,qBAAqB;SAChD,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAC9C,aAAqB;QAErB,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,GAAG,gBAAgB,CAAC,QAAQ,KAAK,gBAAgB,CAAC,IAAI,EAAE,CAAC;QAEtE,MAAM,cAAc,GAAa,EAAE,CAAC;QAEpC,sEAAsE;QACtE,sBAAsB;QACtB,IAAI,gBAAgB,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;YACtC,iEAAiE;YACjE,cAAc,CAAC,IAAI,CACjB,IAAI,GAAG,CACL,0CAA0C,gBAAgB,CAAC,QAAQ,EAAE,EACrE,IAAI,CACL,CAAC,QAAQ,EAAE,CACb,CAAC;YAEF,sDAAsD;YACtD,cAAc,CAAC,IAAI,CACjB,IAAI,GAAG,CACL,oCAAoC,gBAAgB,CAAC,QAAQ,EAAE,EAC/D,IAAI,CACL,CAAC,QAAQ,EAAE,CACb,CAAC;YAEF,sDAAsD;YACtD,cAAc,CAAC,IAAI,CACjB,IAAI,GAAG,CACL,GAAG,gBAAgB,CAAC,QAAQ,mCAAmC,EAC/D,IAAI,CACL,CAAC,QAAQ,EAAE,CACb,CAAC;QACJ,CAAC;QAED,2EAA2E;QAC3E,gEAAgE;QAEhE,6CAA6C;QAC7C,cAAc,CAAC,IAAI,CACjB,IAAI,GAAG,CAAC,yCAAyC,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CACpE,CAAC;QAEF,kCAAkC;QAClC,cAAc,CAAC,IAAI,CACjB,IAAI,GAAG,CAAC,mCAAmC,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CAC9D,CAAC;QAEF,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;YACtC,MAAM,kBAAkB,GACtB,MAAM,IAAI,CAAC,gCAAgC,CAAC,QAAQ,CAAC,CAAC;YACxD,IAAI,kBAAkB,EAAE,CAAC;gBACvB,OAAO,kBAAkB,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,WAAW,CAAC,KAAK,CACf,sDAAsD,aAAa,EAAE,CACtE,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAC9B,SAAiB;QAEjB,IAAI,CAAC;YACH,0CAA0C;YAC1C,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAEhE,qDAAqD;YACrD,IAAI,gBAAgB,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAC9D,aAAa,CAAC,iBAAiB,CAChC,CAAC;YAEF,uEAAuE;YACvE,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC/B,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;oBACzC,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;oBAC/D,gBAAgB,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAC1D,aAAa,CAAC,iBAAiB,CAChC,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,IAAI,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC;gBACpD,qCAAqC;gBACrC,MAAM,aAAa,GAAG,gBAAgB,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;gBAChE,MAAM,kBAAkB,GACtB,MAAM,IAAI,CAAC,mCAAmC,CAAC,aAAa,CAAC,CAAC;gBAEhE,IAAI,kBAAkB,EAAE,CAAC;oBACvB,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;oBAC9D,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;wBAC7C,WAAW,CAAC,GAAG,CACb,8CAA8C,EAC9C,kBAAkB,CAAC,qBAAqB,CACzC,CAAC;oBACJ,CAAC;oBACD,OAAO,MAAM,CAAC;gBAChB,CAAC;YACH,CAAC;YAED,qDAAqD;YACrD,WAAW,CAAC,KAAK,CAAC,sCAAsC,SAAS,EAAE,CAAC,CAAC;YACrE,MAAM,kBAAkB,GACtB,MAAM,IAAI,CAAC,mCAAmC,CAAC,SAAS,CAAC,CAAC;YAE5D,IAAI,kBAAkB,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;gBAC9D,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;oBAC7C,WAAW,CAAC,GAAG,CACb,8CAA8C,EAC9C,kBAAkB,CAAC,qBAAqB,CACzC,CAAC;gBACJ,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,KAAK,CACf,2CAA2C,eAAe,CAAC,KAAK,CAAC,EAAE,CACpE,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,0BAA0B,CAAC,MAAc;QAC9C,2CAA2C;QAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC1D,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAC3C,eAAuB;QAEvB,MAAM,mBAAmB,GACvB,IAAI,CAAC,0BAA0B,CAAC,eAAe,CAAC,CAAC;QACnD,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,gBAAgB,GACpB,MAAM,IAAI,CAAC,8BAA8B,CAAC,mBAAmB,CAAC,CAAC;QACjE,IAAI,CAAC,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,aAAa,GAAG,gBAAgB,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAChE,MAAM,kBAAkB,GACtB,MAAM,IAAI,CAAC,mCAAmC,CAAC,aAAa,CAAC,CAAC;QAEhE,IAAI,kBAAkB,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;QACxD,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CAAC,YAAoB;QACxC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;QACxC,OAAO,GAAG,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;IACpD,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,aAAa,CAAC,GAAW;QAC9B,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,sBAAsB,CAAC,WAAmB;QAC/C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACjC,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IACvD,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,gBAAgB,CAAC,OAAe;QACrC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CACxD,CAAC;YAEF,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC/C,OAAO,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,kCAAkC;YAC/D,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,sDAAsD,EAAE,CAAC,CAAC,CAAC;QAC3E,CAAC;QAED,kEAAkE;QAClE,OAAO,SAAS,CAAC;IACnB,CAAC;CACF"}

package/dist/src/mcp/oauth-utils.test.js

@@ -4,7 +4,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-import { OAuthUtils, } from './oauth-utils.js';
+import { OAuthUtils } from './oauth-utils.js';
 // Mock fetch globally
 const mockFetch = vi.fn();
 global.fetch = mockFetch;
@@ -85,6 +85,46 @@ describe('OAuthUtils', () => {
             expect(result).toBeNull();
         });
     });
+    describe('discoverAuthorizationServerMetadata', () => {
+        const mockAuthServerMetadata = {
+            issuer: 'https://auth.example.com',
+            authorization_endpoint: 'https://auth.example.com/authorize',
+            token_endpoint: 'https://auth.example.com/token',
+            scopes_supported: ['read', 'write'],
+        };
+        it('should handle URLs without path components correctly', async () => {
+            mockFetch
+                .mockResolvedValueOnce({
+                ok: false,
+            })
+                .mockResolvedValueOnce({
+                ok: true,
+                json: () => Promise.resolve(mockAuthServerMetadata),
+            });
+            const result = await OAuthUtils.discoverAuthorizationServerMetadata('https://auth.example.com/');
+            expect(result).toEqual(mockAuthServerMetadata);
+            expect(mockFetch).nthCalledWith(1, 'https://auth.example.com/.well-known/oauth-authorization-server');
+            expect(mockFetch).nthCalledWith(2, 'https://auth.example.com/.well-known/openid-configuration');
+        });
+        it('should handle URLs with path components correctly', async () => {
+            mockFetch
+                .mockResolvedValueOnce({
+                ok: false,
+            })
+                .mockResolvedValueOnce({
+                ok: false,
+            })
+                .mockResolvedValueOnce({
+                ok: true,
+                json: () => Promise.resolve(mockAuthServerMetadata),
+            });
+            const result = await OAuthUtils.discoverAuthorizationServerMetadata('https://auth.example.com/mcp');
+            expect(result).toEqual(mockAuthServerMetadata);
+            expect(mockFetch).nthCalledWith(1, 'https://auth.example.com/.well-known/oauth-authorization-server/mcp');
+            expect(mockFetch).nthCalledWith(2, 'https://auth.example.com/.well-known/openid-configuration/mcp');
+            expect(mockFetch).nthCalledWith(3, 'https://auth.example.com/mcp/.well-known/openid-configuration');
+        });
+    });
     describe('metadataToOAuthConfig', () => {
         it('should convert metadata to OAuth config', () => {
             const metadata = {
@@ -148,11 +188,54 @@ describe('OAuthUtils', () => {
     describe('buildResourceParameter', () => {
         it('should build resource parameter from endpoint URL', () => {
             const result = OAuthUtils.buildResourceParameter('https://example.com/oauth/token');
-            expect(result).toBe('https://example.com');
+            expect(result).toBe('https://example.com/oauth/token');
         });
         it('should handle URLs with ports', () => {
             const result = OAuthUtils.buildResourceParameter('https://example.com:8080/oauth/token');
-            expect(result).toBe('https://example.com:8080');
+            expect(result).toBe('https://example.com:8080/oauth/token');
+        });
+        it('should strip query parameters from the URL', () => {
+            const result = OAuthUtils.buildResourceParameter('https://example.com/api/v1/data?user=123&scope=read');
+            expect(result).toBe('https://example.com/api/v1/data');
+        });
+        it('should strip URL fragments from the URL', () => {
+            const result = OAuthUtils.buildResourceParameter('https://example.com/api/v1/data#section-one');
+            expect(result).toBe('https://example.com/api/v1/data');
+        });
+        it('should throw an error for invalid URLs', () => {
+            expect(() => OAuthUtils.buildResourceParameter('not-a-url')).toThrow();
+        });
+    });
+    describe('parseTokenExpiry', () => {
+        it('should return the expiry time in milliseconds for a valid token', () => {
+            // Corresponds to a date of 2100-01-01T00:00:00Z
+            const expiry = 4102444800;
+            const payload = { exp: expiry };
+            const token = `header.${Buffer.from(JSON.stringify(payload)).toString('base64')}.signature`;
+            const result = OAuthUtils.parseTokenExpiry(token);
+            expect(result).toBe(expiry * 1000);
+        });
+        it('should return undefined for a token without an expiry time', () => {
+            const payload = { iat: 1678886400 };
+            const token = `header.${Buffer.from(JSON.stringify(payload)).toString('base64')}.signature`;
+            const result = OAuthUtils.parseTokenExpiry(token);
+            expect(result).toBeUndefined();
+        });
+        it('should return undefined for a token with an invalid expiry time', () => {
+            const payload = { exp: 'not-a-number' };
+            const token = `header.${Buffer.from(JSON.stringify(payload)).toString('base64')}.signature`;
+            const result = OAuthUtils.parseTokenExpiry(token);
+            expect(result).toBeUndefined();
+        });
+        it('should return undefined for a malformed token', () => {
+            const token = 'not-a-valid-token';
+            const result = OAuthUtils.parseTokenExpiry(token);
+            expect(result).toBeUndefined();
+        });
+        it('should return undefined for a token with invalid JSON in payload', () => {
+            const token = `header.${Buffer.from('{ not valid json').toString('base64')}.signature`;
+            const result = OAuthUtils.parseTokenExpiry(token);
+            expect(result).toBeUndefined();
         });
     });
 });

package/dist/src/mcp/oauth-utils.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-utils.test.js","sourceRoot":"","sources":["../../../src/mcp/oauth-utils.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EACL,UAAU,GAGX,MAAM,kBAAkB,CAAC;AAE1B,sBAAsB;AACtB,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAC1B,MAAM,CAAC,KAAK,GAAG,SAAS,CAAC;AAEzB,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACxD,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACxD,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAClC,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;YAC1D,MAAM,IAAI,GAAG,UAAU,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,CAAC;YACtE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CACjC,0DAA0D,CAC3D,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,IAAI,CACnC,4DAA4D,CAC7D,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;YACrE,MAAM,IAAI,GAAG,UAAU,CAAC,kBAAkB,CACxC,yBAAyB,EACzB,IAAI,CACL,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CACjC,8DAA8D,CAC/D,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,IAAI,CACnC,gEAAgE,CACjE,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;YAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;YACxE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CACjC,0DAA0D,CAC3D,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,IAAI,CACnC,4DAA4D,CAC7D,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;YAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,kBAAkB,CACxC,0BAA0B,EAC1B,IAAI,CACL,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CACjC,8DAA8D,CAC/D,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,IAAI,CACnC,gEAAgE,CACjE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;QAC9C,MAAM,oBAAoB,GAAmC;YAC3D,QAAQ,EAAE,yBAAyB;YACnC,qBAAqB,EAAE,CAAC,0BAA0B,CAAC;YACnD,wBAAwB,EAAE,CAAC,QAAQ,CAAC;SACrC,CAAC;QAEF,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;YACrE,SAAS,CAAC,qBAAqB,CAAC;gBAC9B,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC;aAClD,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,8BAA8B,CAC5D,0DAA0D,CAC3D,CAAC;YAEF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;YACnD,SAAS,CAAC,qBAAqB,CAAC;gBAC9B,EAAE,EAAE,KAAK;aACV,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,8BAA8B,CAC5D,0DAA0D,CAC3D,CAAC;YAEF,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAChD,MAAM,sBAAsB,GAAqC;YAC/D,MAAM,EAAE,0BAA0B;YAClC,sBAAsB,EAAE,oCAAoC;YAC5D,cAAc,EAAE,gCAAgC;YAChD,gBAAgB,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;SACpC,CAAC;QAEF,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;YACvE,SAAS,CAAC,qBAAqB,CAAC;gBAC9B,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC;aACpD,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,gCAAgC,CAC9D,iEAAiE,CAClE,CAAC;YAEF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;YACnD,SAAS,CAAC,qBAAqB,CAAC;gBAC9B,EAAE,EAAE,KAAK;aACV,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,gCAAgC,CAC9D,iEAAiE,CAClE,CAAC;YAEF,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;QACrC,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,MAAM,QAAQ,GAAqC;gBACjD,MAAM,EAAE,0BAA0B;gBAClC,sBAAsB,EAAE,oCAAoC;gBAC5D,cAAc,EAAE,gCAAgC;gBAChD,gBAAgB,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;aACpC,CAAC;YAEF,MAAM,MAAM,GAAG,UAAU,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;YAE1D,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;gBACrB,gBAAgB,EAAE,oCAAoC;gBACtD,QAAQ,EAAE,gCAAgC;gBAC1C,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;aAC1B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;YACpC,MAAM,QAAQ,GAAqC;gBACjD,MAAM,EAAE,0BAA0B;gBAClC,sBAAsB,EAAE,oCAAoC;gBAC5D,cAAc,EAAE,gCAAgC;aACjD,CAAC;YAEF,MAAM,MAAM,GAAG,UAAU,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;YAE1D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;QAC1C,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;YACzE,MAAM,MAAM,GACV,sGAAsG,CAAC;YACzG,MAAM,MAAM,GAAG,UAAU,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;YAC7D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CACjB,0DAA0D,CAC3D,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;YACnE,MAAM,MAAM,GAAG,wBAAwB,CAAC;YACxC,MAAM,MAAM,GAAG,UAAU,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;YAC7D,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;YACrD,MAAM,MAAM,GAAG,UAAU,CAAC,cAAc,CAAC,4BAA4B,CAAC,CAAC;YACvE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;YACvC,MAAM,MAAM,GAAG,UAAU,CAAC,cAAc,CACtC,iCAAiC,CAClC,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC7B,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;YAC9C,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvE,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,gCAAgC,CAAC,CAAC,CAAC,IAAI,CACrE,IAAI,CACL,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAClD,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/C,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxE,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,gCAAgC,CAAC,CAAC,CAAC,IAAI,CACrE,KAAK,CACN,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;QACtC,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;YAC3D,MAAM,MAAM,GAAG,UAAU,CAAC,sBAAsB,CAC9C,iCAAiC,CAClC,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;YACvC,MAAM,MAAM,GAAG,UAAU,CAAC,sBAAsB,CAC9C,sCAAsC,CACvC,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"oauth-utils.test.js","sourceRoot":"","sources":["../../../src/mcp/oauth-utils.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAKzE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,sBAAsB;AACtB,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAC1B,MAAM,CAAC,KAAK,GAAG,SAAS,CAAC;AAEzB,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACxD,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACxD,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAClC,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;YAC1D,MAAM,IAAI,GAAG,UAAU,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,CAAC;YACtE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CACjC,0DAA0D,CAC3D,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,IAAI,CACnC,4DAA4D,CAC7D,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;YACrE,MAAM,IAAI,GAAG,UAAU,CAAC,kBAAkB,CACxC,yBAAyB,EACzB,IAAI,CACL,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CACjC,8DAA8D,CAC/D,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,IAAI,CACnC,gEAAgE,CACjE,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;YAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;YACxE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CACjC,0DAA0D,CAC3D,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,IAAI,CACnC,4DAA4D,CAC7D,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;YAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,kBAAkB,CACxC,0BAA0B,EAC1B,IAAI,CACL,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CACjC,8DAA8D,CAC/D,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,IAAI,CACnC,gEAAgE,CACjE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;QAC9C,MAAM,oBAAoB,GAAmC;YAC3D,QAAQ,EAAE,yBAAyB;YACnC,qBAAqB,EAAE,CAAC,0BAA0B,CAAC;YACnD,wBAAwB,EAAE,CAAC,QAAQ,CAAC;SACrC,CAAC;QAEF,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;YACrE,SAAS,CAAC,qBAAqB,CAAC;gBAC9B,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC;aAClD,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,8BAA8B,CAC5D,0DAA0D,CAC3D,CAAC;YAEF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;YACnD,SAAS,CAAC,qBAAqB,CAAC;gBAC9B,EAAE,EAAE,KAAK;aACV,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,8BAA8B,CAC5D,0DAA0D,CAC3D,CAAC;YAEF,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAChD,MAAM,sBAAsB,GAAqC;YAC/D,MAAM,EAAE,0BAA0B;YAClC,sBAAsB,EAAE,oCAAoC;YAC5D,cAAc,EAAE,gCAAgC;YAChD,gBAAgB,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;SACpC,CAAC;QAEF,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;YACvE,SAAS,CAAC,qBAAqB,CAAC;gBAC9B,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC;aACpD,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,gCAAgC,CAC9D,iEAAiE,CAClE,CAAC;YAEF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;YACnD,SAAS,CAAC,qBAAqB,CAAC;gBAC9B,EAAE,EAAE,KAAK;aACV,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,gCAAgC,CAC9D,iEAAiE,CAClE,CAAC;YAEF,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,qCAAqC,EAAE,GAAG,EAAE;QACnD,MAAM,sBAAsB,GAAqC;YAC/D,MAAM,EAAE,0BAA0B;YAClC,sBAAsB,EAAE,oCAAoC;YAC5D,cAAc,EAAE,gCAAgC;YAChD,gBAAgB,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;SACpC,CAAC;QAEF,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;YACpE,SAAS;iBACN,qBAAqB,CAAC;gBACrB,EAAE,EAAE,KAAK;aACV,CAAC;iBACD,qBAAqB,CAAC;gBACrB,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC;aACpD,CAAC,CAAC;YAEL,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,mCAAmC,CACjE,2BAA2B,CAC5B,CAAC;YAEF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;YAE/C,MAAM,CAAC,SAAS,CAAC,CAAC,aAAa,CAC7B,CAAC,EACD,iEAAiE,CAClE,CAAC;YACF,MAAM,CAAC,SAAS,CAAC,CAAC,aAAa,CAC7B,CAAC,EACD,2DAA2D,CAC5D,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;YACjE,SAAS;iBACN,qBAAqB,CAAC;gBACrB,EAAE,EAAE,KAAK;aACV,CAAC;iBACD,qBAAqB,CAAC;gBACrB,EAAE,EAAE,KAAK;aACV,CAAC;iBACD,qBAAqB,CAAC;gBACrB,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC;aACpD,CAAC,CAAC;YAEL,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,mCAAmC,CACjE,8BAA8B,CAC/B,CAAC;YAEF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;YAE/C,MAAM,CAAC,SAAS,CAAC,CAAC,aAAa,CAC7B,CAAC,EACD,qEAAqE,CACtE,CAAC;YACF,MAAM,CAAC,SAAS,CAAC,CAAC,aAAa,CAC7B,CAAC,EACD,+DAA+D,CAChE,CAAC;YACF,MAAM,CAAC,SAAS,CAAC,CAAC,aAAa,CAC7B,CAAC,EACD,+DAA+D,CAChE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;QACrC,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,MAAM,QAAQ,GAAqC;gBACjD,MAAM,EAAE,0BAA0B;gBAClC,sBAAsB,EAAE,oCAAoC;gBAC5D,cAAc,EAAE,gCAAgC;gBAChD,gBAAgB,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;aACpC,CAAC;YAEF,MAAM,MAAM,GAAG,UAAU,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;YAE1D,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;gBACrB,gBAAgB,EAAE,oCAAoC;gBACtD,QAAQ,EAAE,gCAAgC;gBAC1C,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;aAC1B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;YACpC,MAAM,QAAQ,GAAqC;gBACjD,MAAM,EAAE,0BAA0B;gBAClC,sBAAsB,EAAE,oCAAoC;gBAC5D,cAAc,EAAE,gCAAgC;aACjD,CAAC;YAEF,MAAM,MAAM,GAAG,UAAU,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;YAE1D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;QAC1C,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;YACzE,MAAM,MAAM,GACV,sGAAsG,CAAC;YACzG,MAAM,MAAM,GAAG,UAAU,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;YAC7D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CACjB,0DAA0D,CAC3D,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;YACnE,MAAM,MAAM,GAAG,wBAAwB,CAAC;YACxC,MAAM,MAAM,GAAG,UAAU,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;YAC7D,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;YACrD,MAAM,MAAM,GAAG,UAAU,CAAC,cAAc,CAAC,4BAA4B,CAAC,CAAC;YACvE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;YACvC,MAAM,MAAM,GAAG,UAAU,CAAC,cAAc,CACtC,iCAAiC,CAClC,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC7B,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;YAC9C,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvE,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,gCAAgC,CAAC,CAAC,CAAC,IAAI,CACrE,IAAI,CACL,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAClD,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/C,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxE,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,gCAAgC,CAAC,CAAC,CAAC,IAAI,CACrE,KAAK,CACN,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;QACtC,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;YAC3D,MAAM,MAAM,GAAG,UAAU,CAAC,sBAAsB,CAC9C,iCAAiC,CAClC,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;YACvC,MAAM,MAAM,GAAG,UAAU,CAAC,sBAAsB,CAC9C,sCAAsC,CACvC,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;YACpD,MAAM,MAAM,GAAG,UAAU,CAAC,sBAAsB,CAC9C,qDAAqD,CACtD,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,MAAM,MAAM,GAAG,UAAU,CAAC,sBAAsB,CAC9C,6CAA6C,CAC9C,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,MAAM,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACzE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAChC,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;YACzE,gDAAgD;YAChD,MAAM,MAAM,GAAG,UAAU,CAAC;YAC1B,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,UAAU,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC5F,MAAM,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;YAClD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;YACpE,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,UAAU,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC5F,MAAM,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;YAClD,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;YACzE,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,UAAU,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC5F,MAAM,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;YAClD,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;YACvD,MAAM,KAAK,GAAG,mBAAmB,CAAC;YAClC,MAAM,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;YAClD,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;YAC1E,MAAM,KAAK,GAAG,UAAU,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;YACvF,MAAM,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;YAClD,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/src/mcp/sa-impersonation-provider.d.ts

@@ -0,0 +1,27 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { OAuthClientInformation, OAuthClientInformationFull, OAuthClientMetadata, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
+import type { MCPServerConfig } from '../config/config.js';
+import type { OAuthClientProvider } from '@modelcontextprotocol/sdk/client/auth.js';
+export declare class ServiceAccountImpersonationProvider implements OAuthClientProvider {
+    private readonly config;
+    private readonly targetServiceAccount;
+    private readonly targetAudience;
+    private readonly auth;
+    private cachedToken?;
+    private tokenExpiryTime?;
+    readonly redirectUrl = "";
+    readonly clientMetadata: OAuthClientMetadata;
+    private _clientInformation?;
+    constructor(config: MCPServerConfig);
+    clientInformation(): OAuthClientInformation | undefined;
+    saveClientInformation(clientInformation: OAuthClientInformationFull): void;
+    tokens(): Promise<OAuthTokens | undefined>;
+    saveTokens(_tokens: OAuthTokens): void;
+    redirectToAuthorization(_authorizationUrl: URL): void;
+    saveCodeVerifier(_codeVerifier: string): void;
+    codeVerifier(): string;
+}

package/dist/src/mcp/sa-impersonation-provider.js

@@ -0,0 +1,113 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { GoogleAuth } from 'google-auth-library';
+import { OAuthUtils, FIVE_MIN_BUFFER_MS } from './oauth-utils.js';
+import { coreEvents } from '../utils/events.js';
+function createIamApiUrl(targetSA) {
+    return `https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${encodeURIComponent(targetSA)}:generateIdToken`;
+}
+export class ServiceAccountImpersonationProvider {
+    config;
+    targetServiceAccount;
+    targetAudience; // OAuth Client Id
+    auth;
+    cachedToken;
+    tokenExpiryTime;
+    // Properties required by OAuthClientProvider, with no-op values
+    redirectUrl = '';
+    clientMetadata = {
+        client_name: 'Gemini CLI (Service Account Impersonation)',
+        redirect_uris: [],
+        grant_types: [],
+        response_types: [],
+        token_endpoint_auth_method: 'none',
+    };
+    _clientInformation;
+    constructor(config) {
+        this.config = config;
+        // This check is done in mcp-client.ts. This is just an additional check.
+        if (!this.config.httpUrl && !this.config.url) {
+            throw new Error('A url or httpUrl must be provided for the Service Account Impersonation provider');
+        }
+        if (!config.targetAudience) {
+            throw new Error('targetAudience must be provided for the Service Account Impersonation provider');
+        }
+        this.targetAudience = config.targetAudience;
+        if (!config.targetServiceAccount) {
+            throw new Error('targetServiceAccount must be provided for the Service Account Impersonation provider');
+        }
+        this.targetServiceAccount = config.targetServiceAccount;
+        this.auth = new GoogleAuth();
+    }
+    clientInformation() {
+        return this._clientInformation;
+    }
+    saveClientInformation(clientInformation) {
+        this._clientInformation = clientInformation;
+    }
+    async tokens() {
+        // 1. Check if we have a valid, non-expired cached token.
+        if (this.cachedToken &&
+            this.tokenExpiryTime &&
+            Date.now() < this.tokenExpiryTime - FIVE_MIN_BUFFER_MS) {
+            return this.cachedToken;
+        }
+        // 2. Clear any invalid/expired cache.
+        this.cachedToken = undefined;
+        this.tokenExpiryTime = undefined;
+        // 3. Fetch a new ID token.
+        const client = await this.auth.getClient();
+        const url = createIamApiUrl(this.targetServiceAccount);
+        let idToken;
+        try {
+            const res = await client.request({
+                url,
+                method: 'POST',
+                data: {
+                    audience: this.targetAudience,
+                    includeEmail: true,
+                },
+            });
+            idToken = res.data.token;
+            if (!idToken || idToken.length === 0) {
+                coreEvents.emitFeedback('error', 'Failed to obtain authentication token.');
+                return undefined;
+            }
+        }
+        catch (e) {
+            coreEvents.emitFeedback('error', 'Failed to obtain authentication token.', e);
+            return undefined;
+        }
+        const expiryTime = OAuthUtils.parseTokenExpiry(idToken);
+        // Note: We are placing the OIDC ID Token into the `access_token` field.
+        // This is because the CLI uses this field to construct the
+        // `Authorization: Bearer <token>` header, which is the correct way to
+        // present an ID token.
+        const newTokens = {
+            access_token: idToken,
+            token_type: 'Bearer',
+        };
+        if (expiryTime) {
+            this.tokenExpiryTime = expiryTime;
+            this.cachedToken = newTokens;
+        }
+        return newTokens;
+    }
+    saveTokens(_tokens) {
+        // No-op
+    }
+    redirectToAuthorization(_authorizationUrl) {
+        // No-op
+    }
+    saveCodeVerifier(_codeVerifier) {
+        // No-op
+    }
+    codeVerifier() {
+        // No-op
+        return '';
+    }
+}
+//# sourceMappingURL=sa-impersonation-provider.js.map

package/dist/src/mcp/sa-impersonation-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sa-impersonation-provider.js","sourceRoot":"","sources":["../../../src/mcp/sa-impersonation-provider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAGlE,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,SAAS,eAAe,CAAC,QAAgB;IACvC,OAAO,uEAAuE,kBAAkB,CAC9F,QAAQ,CACT,kBAAkB,CAAC;AACtB,CAAC;AAED,MAAM,OAAO,mCAAmC;IAoBjB;IAjBZ,oBAAoB,CAAS;IAC7B,cAAc,CAAS,CAAC,kBAAkB;IAC1C,IAAI,CAAa;IAC1B,WAAW,CAAe;IAC1B,eAAe,CAAU;IAEjC,gEAAgE;IACvD,WAAW,GAAG,EAAE,CAAC;IACjB,cAAc,GAAwB;QAC7C,WAAW,EAAE,4CAA4C;QACzD,aAAa,EAAE,EAAE;QACjB,WAAW,EAAE,EAAE;QACf,cAAc,EAAE,EAAE;QAClB,0BAA0B,EAAE,MAAM;KACnC,CAAC;IACM,kBAAkB,CAA8B;IAExD,YAA6B,MAAuB;QAAvB,WAAM,GAAN,MAAM,CAAiB;QAClD,yEAAyE;QACzE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,gFAAgF,CACjF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QAE5C,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,oBAAoB,GAAG,MAAM,CAAC,oBAAoB,CAAC;QAExD,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC;IAC/B,CAAC;IAED,iBAAiB;QACf,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED,qBAAqB,CAAC,iBAA6C;QACjE,IAAI,CAAC,kBAAkB,GAAG,iBAAiB,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,MAAM;QACV,yDAAyD;QACzD,IACE,IAAI,CAAC,WAAW;YAChB,IAAI,CAAC,eAAe;YACpB,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,eAAe,GAAG,kBAAkB,EACtD,CAAC;YACD,OAAO,IAAI,CAAC,WAAW,CAAC;QAC1B,CAAC;QAED,sCAAsC;QACtC,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC7B,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC;QAEjC,2BAA2B;QAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAEvD,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAoB;gBAClD,GAAG;gBACH,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE;oBACJ,QAAQ,EAAE,IAAI,CAAC,cAAc;oBAC7B,YAAY,EAAE,IAAI;iBACnB;aACF,CAAC,CAAC;YACH,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;YAEzB,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrC,UAAU,CAAC,YAAY,CACrB,OAAO,EACP,wCAAwC,CACzC,CAAC;gBACF,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,UAAU,CAAC,YAAY,CACrB,OAAO,EACP,wCAAwC,EACxC,CAAU,CACX,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,UAAU,GAAG,UAAU,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACxD,wEAAwE;QACxE,2DAA2D;QAC3D,sEAAsE;QACtE,uBAAuB;QACvB,MAAM,SAAS,GAAgB;YAC7B,YAAY,EAAE,OAAO;YACrB,UAAU,EAAE,QAAQ;SACrB,CAAC;QAEF,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC;YAClC,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC/B,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,UAAU,CAAC,OAAoB;QAC7B,QAAQ;IACV,CAAC;IAED,uBAAuB,CAAC,iBAAsB;QAC5C,QAAQ;IACV,CAAC;IAED,gBAAgB,CAAC,aAAqB;QACpC,QAAQ;IACV,CAAC;IAED,YAAY;QACV,QAAQ;QACR,OAAO,EAAE,CAAC;IACZ,CAAC;CACF"}

package/dist/src/mcp/sa-impersonation-provider.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export {};

package/dist/src/mcp/sa-impersonation-provider.test.js

@@ -0,0 +1,117 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { ServiceAccountImpersonationProvider } from './sa-impersonation-provider.js';
+const mockRequest = vi.fn();
+const mockGetClient = vi.fn(() => ({
+    request: mockRequest,
+}));
+// Mock the google-auth-library to use a shared mock function
+vi.mock('google-auth-library', async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        GoogleAuth: vi.fn().mockImplementation(() => ({
+            getClient: mockGetClient,
+        })),
+    };
+});
+const defaultSAConfig = {
+    url: 'https://my-iap-service.run.app',
+    targetAudience: 'my-audience',
+    targetServiceAccount: 'my-sa',
+};
+describe('ServiceAccountImpersonationProvider', () => {
+    beforeEach(() => {
+        // Reset mocks before each test
+        vi.clearAllMocks();
+    });
+    it('should throw an error if no URL is provided', () => {
+        const config = {};
+        expect(() => new ServiceAccountImpersonationProvider(config)).toThrow('A url or httpUrl must be provided for the Service Account Impersonation provider');
+    });
+    it('should throw an error if no targetAudience is provided', () => {
+        const config = {
+            url: 'https://my-iap-service.run.app',
+        };
+        expect(() => new ServiceAccountImpersonationProvider(config)).toThrow('targetAudience must be provided for the Service Account Impersonation provider');
+    });
+    it('should throw an error if no targetSA is provided', () => {
+        const config = {
+            url: 'https://my-iap-service.run.app',
+            targetAudience: 'my-audience',
+        };
+        expect(() => new ServiceAccountImpersonationProvider(config)).toThrow('targetServiceAccount must be provided for the Service Account Impersonation provider');
+    });
+    it('should correctly get tokens for a valid config', async () => {
+        const mockToken = 'mock-id-token-123';
+        mockRequest.mockResolvedValue({ data: { token: mockToken } });
+        const provider = new ServiceAccountImpersonationProvider(defaultSAConfig);
+        const tokens = await provider.tokens();
+        expect(tokens).toBeDefined();
+        expect(tokens?.access_token).toBe(mockToken);
+        expect(tokens?.token_type).toBe('Bearer');
+    });
+    it('should return undefined if token acquisition fails', async () => {
+        mockRequest.mockResolvedValue({ data: { token: null } });
+        const provider = new ServiceAccountImpersonationProvider(defaultSAConfig);
+        const tokens = await provider.tokens();
+        expect(tokens).toBeUndefined();
+    });
+    it('should make a request with the correct parameters', async () => {
+        mockRequest.mockResolvedValue({ data: { token: 'test-token' } });
+        const provider = new ServiceAccountImpersonationProvider(defaultSAConfig);
+        await provider.tokens();
+        expect(mockRequest).toHaveBeenCalledWith({
+            url: 'https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/my-sa:generateIdToken',
+            method: 'POST',
+            data: {
+                audience: 'my-audience',
+                includeEmail: true,
+            },
+        });
+    });
+    it('should return a cached token if it is not expired', async () => {
+        const provider = new ServiceAccountImpersonationProvider(defaultSAConfig);
+        vi.useFakeTimers();
+        // jwt payload with exp set to 1 hour from now
+        const payload = { exp: Math.floor(Date.now() / 1000) + 3600 };
+        const jwt = `header.${Buffer.from(JSON.stringify(payload)).toString('base64')}.signature`;
+        mockRequest.mockResolvedValue({ data: { token: jwt } });
+        const firstTokens = await provider.tokens();
+        expect(firstTokens?.access_token).toBe(jwt);
+        expect(mockRequest).toHaveBeenCalledTimes(1);
+        // Advance time by 30 minutes
+        vi.advanceTimersByTime(1800 * 1000);
+        // Seturn cached token
+        const secondTokens = await provider.tokens();
+        expect(secondTokens).toBe(firstTokens);
+        expect(mockRequest).toHaveBeenCalledTimes(1);
+        vi.useRealTimers();
+    });
+    it('should fetch a new token if the cached token is expired (using fake timers)', async () => {
+        const provider = new ServiceAccountImpersonationProvider(defaultSAConfig);
+        vi.useFakeTimers();
+        // Get and cache a token that expires in 1 second
+        const expiredPayload = { exp: Math.floor(Date.now() / 1000) + 1 };
+        const expiredJwt = `header.${Buffer.from(JSON.stringify(expiredPayload)).toString('base64')}.signature`;
+        mockRequest.mockResolvedValue({ data: { token: expiredJwt } });
+        const firstTokens = await provider.tokens();
+        expect(firstTokens?.access_token).toBe(expiredJwt);
+        expect(mockRequest).toHaveBeenCalledTimes(1);
+        // Prepare the mock for the *next* call
+        const newPayload = { exp: Math.floor(Date.now() / 1000) + 3600 };
+        const newJwt = `header.${Buffer.from(JSON.stringify(newPayload)).toString('base64')}.signature`;
+        mockRequest.mockResolvedValue({ data: { token: newJwt } });
+        vi.advanceTimersByTime(1001);
+        const newTokens = await provider.tokens();
+        expect(newTokens?.access_token).toBe(newJwt);
+        expect(newTokens?.access_token).not.toBe(expiredJwt);
+        expect(mockRequest).toHaveBeenCalledTimes(2); // Confirms a new fetch
+        vi.useRealTimers();
+    });
+});
+//# sourceMappingURL=sa-impersonation-provider.test.js.map