@onyxsecurity/mcp-gateway 1.0.68 → 1.0.69

package/dist/oauthProvidersClient-D6q0sWGK.js

@@ -0,0 +1 @@
+import"./env-BbWkec7w.js";import"./logger-fOoIHE0y.js";import"./providers-BdLw9eT-.js";import{fetchOAuthProviders as e,initializeOAuthProviders as t}from"./oauthProvidersClient-L4dF01G3.js";export{t as initializeOAuthProviders};

package/dist/{oauthProvidersClient-BLKyyoBP.js → oauthProvidersClient-L4dF01G3.js}

@@ -1,2 +1,2 @@
-import{logger as e}from"./logger-CjtkOPTS.js";import{setOAuthProviders as t}from"./providers-1NndXxjs.js";async function n(e){let t=new URL(e.url),n=t.hostname===`localhost`||t.hostname===`127.0.0.1`||t.hostname===`::1`||t.hostname===`[::1]`;if(t.protocol!==`https:`&&!n)throw Error(`OAuth providers URL must use HTTPS, got ${t.protocol}`);let r=new AbortController,i=setTimeout(()=>r.abort(),e.timeoutMs);try{let t=await fetch(e.url,{headers:{Accept:`application/json`,apikey:e.apiKey},method:`GET`,signal:r.signal});if(!t.ok)throw Error(`OAuth providers service returned ${t.status}: ${t.statusText}`);let n=await t.json();return Array.isArray(n.providers)?n.providers:[]}catch(t){throw t instanceof Error&&t.name===`AbortError`?Error(`OAuth providers fetch timed out after ${e.timeoutMs}ms`):t}finally{clearTimeout(i)}}async function r(r){if(!r.enabled||!r.url||!r.apiKey){t([]),e.debug(`OAuth providers fetch disabled (missing URL or API key); skipping`);return}try{let i=await n({apiKey:r.apiKey,timeoutMs:r.timeoutMs,url:r.url});t(i),e.info(`OAuth providers loaded`,{count:i.length,ids:i.map(e=>e.id)})}catch(n){t([]),e.warn(`OAuth providers fetch failed; falling back to DCR`,{error:String(n),url:r.url})}}export{n as fetchOAuthProviders,r as initializeOAuthProviders};
-//# sourceMappingURL=oauthProvidersClient-BLKyyoBP.js.map
+import{logger as e}from"./logger-fOoIHE0y.js";import{setOAuthProviders as t}from"./providers-BdLw9eT-.js";async function n(e){let t=new URL(e.url),n=t.hostname===`localhost`||t.hostname===`127.0.0.1`||t.hostname===`::1`||t.hostname===`[::1]`;if(t.protocol!==`https:`&&!n)throw Error(`OAuth providers URL must use HTTPS, got ${t.protocol}`);let r=new AbortController,i=setTimeout(()=>r.abort(),e.timeoutMs);try{let t=await fetch(e.url,{headers:{Accept:`application/json`,apikey:e.apiKey},method:`GET`,signal:r.signal});if(!t.ok)throw Error(`OAuth providers service returned ${t.status}: ${t.statusText}`);let n=await t.json();return Array.isArray(n.providers)?n.providers:[]}catch(t){throw t instanceof Error&&t.name===`AbortError`?Error(`OAuth providers fetch timed out after ${e.timeoutMs}ms`):t}finally{clearTimeout(i)}}async function r(r){if(!r.enabled||!r.url||!r.apiKey){t([]),e.debug(`OAuth providers fetch disabled (missing URL or API key); skipping`);return}try{let i=await n({apiKey:r.apiKey,timeoutMs:r.timeoutMs,url:r.url});t(i),e.info(`OAuth providers loaded`,{count:i.length,ids:i.map(e=>e.id)})}catch(n){t([]),e.warn(`OAuth providers fetch failed; falling back to DCR`,{error:String(n),url:r.url})}}export{n as fetchOAuthProviders,r as initializeOAuthProviders};
+//# sourceMappingURL=oauthProvidersClient-L4dF01G3.js.map

package/dist/{oauthProvidersClient-BLKyyoBP.js.map → oauthProvidersClient-L4dF01G3.js.map}

@@ -1 +1 @@
-{"version":3,"file":"oauthProvidersClient-BLKyyoBP.js","names":[],"sources":["../src/auth/oauthProvidersClient.ts"],"sourcesContent":["import type { OAuthProviderConfig } from \"../config/config.js\";\n\nimport { logger } from \"../lib/logger.js\";\nimport { setOAuthProviders } from \"./providers.js\";\n\nexport interface InitializeOAuthProvidersConfig {\n  apiKey: string | undefined;\n  enabled: boolean;\n  timeoutMs: number;\n  url: null | string;\n}\n\nexport interface OAuthProvidersClientConfig {\n  apiKey: string;\n  timeoutMs: number;\n  url: string;\n}\n\ninterface OAuthProvidersResponse {\n  providers?: OAuthProviderConfig[];\n}\n\n/**\n * Fetches the OAuth provider list from the web extension service.\n *\n * The endpoint is gated by Kong's key-auth plugin, which validates the\n * `apikey` header and forwards a per-tenant `x-consumer-username` header\n * (e.g. `mcp-gateway@<tenantUUID>`) to the backend.\n *\n * Throws on network error, timeout, or non-2xx response. Callers are\n * expected to handle errors and decide on a fallback (initializeOAuthProviders\n * fails open by emptying the in-memory provider list, which causes the OAuth\n * flow to fall through to Dynamic Client Registration).\n */\nexport async function fetchOAuthProviders(\n  cfg: OAuthProvidersClientConfig\n): Promise<OAuthProviderConfig[]> {\n  // Reject non-HTTPS URLs before sending the API key over the wire.\n  // Loopback addresses are allowed for local development against a non-TLS\n  // stub: \"localhost\", IPv4 (127.0.0.1), and IPv6 (::1). Node returns the\n  // bracketed form (\"[::1]\") for IPv6 hosts in URL.hostname, so match both.\n  const parsed = new URL(cfg.url);\n  const isLocal =\n    parsed.hostname === \"localhost\" ||\n    parsed.hostname === \"127.0.0.1\" ||\n    parsed.hostname === \"::1\" ||\n    parsed.hostname === \"[::1]\";\n  if (parsed.protocol !== \"https:\" && !isLocal) {\n    throw new Error(`OAuth providers URL must use HTTPS, got ${parsed.protocol}`);\n  }\n\n  const controller = new AbortController();\n  const timer = setTimeout(() => controller.abort(), cfg.timeoutMs);\n\n  try {\n    const response = await fetch(cfg.url, {\n      // GET with no body — Accept signals the desired response format,\n      // Content-Type would be misleading.\n      headers: {\n        Accept: \"application/json\",\n        apikey: cfg.apiKey,\n      },\n      method: \"GET\",\n      signal: controller.signal,\n    });\n\n    if (!response.ok) {\n      throw new Error(`OAuth providers service returned ${response.status}: ${response.statusText}`);\n    }\n\n    const body = (await response.json()) as OAuthProvidersResponse;\n    return Array.isArray(body.providers) ? body.providers : [];\n  } catch (error) {\n    if (error instanceof Error && error.name === \"AbortError\") {\n      throw new Error(`OAuth providers fetch timed out after ${cfg.timeoutMs}ms`);\n    }\n    throw error;\n  } finally {\n    clearTimeout(timer);\n  }\n}\n\n/**\n * Initializes the in-memory OAuth provider store at gateway startup.\n *\n * On a successful fetch, populates the store with the providers returned by\n * the web extension service. On any failure (disabled config, network error,\n * timeout, malformed body), empties the store and logs a warning. The OAuth\n * flow at oauthFlow.ts then falls through to Dynamic Client Registration,\n * matching the gateway's \"fail-safe by default\" convention.\n */\nexport async function initializeOAuthProviders(cfg: InitializeOAuthProvidersConfig): Promise<void> {\n  if (!cfg.enabled || !cfg.url || !cfg.apiKey) {\n    setOAuthProviders([]);\n    logger.debug(\"OAuth providers fetch disabled (missing URL or API key); skipping\");\n    return;\n  }\n\n  try {\n    const providers = await fetchOAuthProviders({\n      apiKey: cfg.apiKey,\n      timeoutMs: cfg.timeoutMs,\n      url: cfg.url,\n    });\n    setOAuthProviders(providers);\n    logger.info(\"OAuth providers loaded\", {\n      count: providers.length,\n      ids: providers.map((p) => p.id),\n    });\n  } catch (error) {\n    setOAuthProviders([]);\n    logger.warn(\"OAuth providers fetch failed; falling back to DCR\", {\n      error: String(error),\n      url: cfg.url,\n    });\n  }\n}\n"],"mappings":"0GAkCA,eAAsB,EACpB,EACgC,CAKhC,IAAM,EAAS,IAAI,IAAI,EAAI,IAAI,CACzB,EACJ,EAAO,WAAa,aACpB,EAAO,WAAa,aACpB,EAAO,WAAa,OACpB,EAAO,WAAa,QACtB,GAAI,EAAO,WAAa,UAAY,CAAC,EACnC,MAAU,MAAM,2CAA2C,EAAO,WAAW,CAG/E,IAAM,EAAa,IAAI,gBACjB,EAAQ,eAAiB,EAAW,OAAO,CAAE,EAAI,UAAU,CAEjE,GAAI,CACF,IAAM,EAAW,MAAM,MAAM,EAAI,IAAK,CAGpC,QAAS,CACP,OAAQ,mBACR,OAAQ,EAAI,OACb,CACD,OAAQ,MACR,OAAQ,EAAW,OACpB,CAAC,CAEF,GAAI,CAAC,EAAS,GACZ,MAAU,MAAM,oCAAoC,EAAS,OAAO,IAAI,EAAS,aAAa,CAGhG,IAAM,EAAQ,MAAM,EAAS,MAAM,CACnC,OAAO,MAAM,QAAQ,EAAK,UAAU,CAAG,EAAK,UAAY,EAAE,OACnD,EAAO,CAId,MAHI,aAAiB,OAAS,EAAM,OAAS,aACjC,MAAM,yCAAyC,EAAI,UAAU,IAAI,CAEvE,SACE,CACR,aAAa,EAAM,EAavB,eAAsB,EAAyB,EAAoD,CACjG,GAAI,CAAC,EAAI,SAAW,CAAC,EAAI,KAAO,CAAC,EAAI,OAAQ,CAC3C,EAAkB,EAAE,CAAC,CACrB,EAAO,MAAM,oEAAoE,CACjF,OAGF,GAAI,CACF,IAAM,EAAY,MAAM,EAAoB,CAC1C,OAAQ,EAAI,OACZ,UAAW,EAAI,UACf,IAAK,EAAI,IACV,CAAC,CACF,EAAkB,EAAU,CAC5B,EAAO,KAAK,yBAA0B,CACpC,MAAO,EAAU,OACjB,IAAK,EAAU,IAAK,GAAM,EAAE,GAAG,CAChC,CAAC,OACK,EAAO,CACd,EAAkB,EAAE,CAAC,CACrB,EAAO,KAAK,oDAAqD,CAC/D,MAAO,OAAO,EAAM,CACpB,IAAK,EAAI,IACV,CAAC"}
+{"version":3,"file":"oauthProvidersClient-L4dF01G3.js","names":[],"sources":["../src/auth/oauthProvidersClient.ts"],"sourcesContent":["import type { OAuthProviderConfig } from \"../config/config.js\";\n\nimport { logger } from \"../lib/logger.js\";\nimport { setOAuthProviders } from \"./providers.js\";\n\nexport interface InitializeOAuthProvidersConfig {\n  apiKey: string | undefined;\n  enabled: boolean;\n  timeoutMs: number;\n  url: null | string;\n}\n\nexport interface OAuthProvidersClientConfig {\n  apiKey: string;\n  timeoutMs: number;\n  url: string;\n}\n\ninterface OAuthProvidersResponse {\n  providers?: OAuthProviderConfig[];\n}\n\n/**\n * Fetches the OAuth provider list from the web extension service.\n *\n * The endpoint is gated by Kong's key-auth plugin, which validates the\n * `apikey` header and forwards a per-tenant `x-consumer-username` header\n * (e.g. `mcp-gateway@<tenantUUID>`) to the backend.\n *\n * Throws on network error, timeout, or non-2xx response. Callers are\n * expected to handle errors and decide on a fallback (initializeOAuthProviders\n * fails open by emptying the in-memory provider list, which causes the OAuth\n * flow to fall through to Dynamic Client Registration).\n */\nexport async function fetchOAuthProviders(\n  cfg: OAuthProvidersClientConfig\n): Promise<OAuthProviderConfig[]> {\n  // Reject non-HTTPS URLs before sending the API key over the wire.\n  // Loopback addresses are allowed for local development against a non-TLS\n  // stub: \"localhost\", IPv4 (127.0.0.1), and IPv6 (::1). Node returns the\n  // bracketed form (\"[::1]\") for IPv6 hosts in URL.hostname, so match both.\n  const parsed = new URL(cfg.url);\n  const isLocal =\n    parsed.hostname === \"localhost\" ||\n    parsed.hostname === \"127.0.0.1\" ||\n    parsed.hostname === \"::1\" ||\n    parsed.hostname === \"[::1]\";\n  if (parsed.protocol !== \"https:\" && !isLocal) {\n    throw new Error(`OAuth providers URL must use HTTPS, got ${parsed.protocol}`);\n  }\n\n  const controller = new AbortController();\n  const timer = setTimeout(() => controller.abort(), cfg.timeoutMs);\n\n  try {\n    const response = await fetch(cfg.url, {\n      // GET with no body — Accept signals the desired response format,\n      // Content-Type would be misleading.\n      headers: {\n        Accept: \"application/json\",\n        apikey: cfg.apiKey,\n      },\n      method: \"GET\",\n      signal: controller.signal,\n    });\n\n    if (!response.ok) {\n      throw new Error(`OAuth providers service returned ${response.status}: ${response.statusText}`);\n    }\n\n    const body = (await response.json()) as OAuthProvidersResponse;\n    return Array.isArray(body.providers) ? body.providers : [];\n  } catch (error) {\n    if (error instanceof Error && error.name === \"AbortError\") {\n      throw new Error(`OAuth providers fetch timed out after ${cfg.timeoutMs}ms`);\n    }\n    throw error;\n  } finally {\n    clearTimeout(timer);\n  }\n}\n\n/**\n * Initializes the in-memory OAuth provider store at gateway startup.\n *\n * On a successful fetch, populates the store with the providers returned by\n * the web extension service. On any failure (disabled config, network error,\n * timeout, malformed body), empties the store and logs a warning. The OAuth\n * flow at oauthFlow.ts then falls through to Dynamic Client Registration,\n * matching the gateway's \"fail-safe by default\" convention.\n */\nexport async function initializeOAuthProviders(cfg: InitializeOAuthProvidersConfig): Promise<void> {\n  if (!cfg.enabled || !cfg.url || !cfg.apiKey) {\n    setOAuthProviders([]);\n    logger.debug(\"OAuth providers fetch disabled (missing URL or API key); skipping\");\n    return;\n  }\n\n  try {\n    const providers = await fetchOAuthProviders({\n      apiKey: cfg.apiKey,\n      timeoutMs: cfg.timeoutMs,\n      url: cfg.url,\n    });\n    setOAuthProviders(providers);\n    logger.info(\"OAuth providers loaded\", {\n      count: providers.length,\n      ids: providers.map((p) => p.id),\n    });\n  } catch (error) {\n    setOAuthProviders([]);\n    logger.warn(\"OAuth providers fetch failed; falling back to DCR\", {\n      error: String(error),\n      url: cfg.url,\n    });\n  }\n}\n"],"mappings":"0GAkCA,eAAsB,EACpB,EACgC,CAKhC,IAAM,EAAS,IAAI,IAAI,EAAI,IAAI,CACzB,EACJ,EAAO,WAAa,aACpB,EAAO,WAAa,aACpB,EAAO,WAAa,OACpB,EAAO,WAAa,QACtB,GAAI,EAAO,WAAa,UAAY,CAAC,EACnC,MAAU,MAAM,2CAA2C,EAAO,WAAW,CAG/E,IAAM,EAAa,IAAI,gBACjB,EAAQ,eAAiB,EAAW,OAAO,CAAE,EAAI,UAAU,CAEjE,GAAI,CACF,IAAM,EAAW,MAAM,MAAM,EAAI,IAAK,CAGpC,QAAS,CACP,OAAQ,mBACR,OAAQ,EAAI,OACb,CACD,OAAQ,MACR,OAAQ,EAAW,OACpB,CAAC,CAEF,GAAI,CAAC,EAAS,GACZ,MAAU,MAAM,oCAAoC,EAAS,OAAO,IAAI,EAAS,aAAa,CAGhG,IAAM,EAAQ,MAAM,EAAS,MAAM,CACnC,OAAO,MAAM,QAAQ,EAAK,UAAU,CAAG,EAAK,UAAY,EAAE,OACnD,EAAO,CAId,MAHI,aAAiB,OAAS,EAAM,OAAS,aACjC,MAAM,yCAAyC,EAAI,UAAU,IAAI,CAEvE,SACE,CACR,aAAa,EAAM,EAavB,eAAsB,EAAyB,EAAoD,CACjG,GAAI,CAAC,EAAI,SAAW,CAAC,EAAI,KAAO,CAAC,EAAI,OAAQ,CAC3C,EAAkB,EAAE,CAAC,CACrB,EAAO,MAAM,oEAAoE,CACjF,OAGF,GAAI,CACF,IAAM,EAAY,MAAM,EAAoB,CAC1C,OAAQ,EAAI,OACZ,UAAW,EAAI,UACf,IAAK,EAAI,IACV,CAAC,CACF,EAAkB,EAAU,CAC5B,EAAO,KAAK,yBAA0B,CACpC,MAAO,EAAU,OACjB,IAAK,EAAU,IAAK,GAAM,EAAE,GAAG,CAChC,CAAC,OACK,EAAO,CACd,EAAkB,EAAE,CAAC,CACrB,EAAO,KAAK,oDAAqD,CAC/D,MAAO,OAAO,EAAM,CACpB,IAAK,EAAI,IACV,CAAC"}

package/dist/{providers-1NndXxjs.js → providers-BdLw9eT-.js}

@@ -1,2 +1,2 @@
-import{logger as e}from"./logger-CjtkOPTS.js";let t=[];function n(n){let r=typeof n==`string`?new URL(n):n,o=r.hostname.toLowerCase();for(let n of t)for(let t of n.urlPatterns){let r=t.toLowerCase();if(a(o,r))return e.debug(`Found matching OAuth provider for URL`,{hostname:o,pattern:t,providerId:n.id,providerName:n.name}),i(n)}e.debug(`No pre-configured OAuth provider found for URL`,{hostname:o,serverUrl:r.toString()})}function r(e){t=e.map(i)}function i(e){return{...e,scopes:e.scopes?[...e.scopes]:void 0,urlPatterns:[...e.urlPatterns]}}function a(e,t){return!!(e===t||e.endsWith(`.${t}`))}export{n as findProviderForUrl,r as setOAuthProviders};
-//# sourceMappingURL=providers-1NndXxjs.js.map
+import{logger as e}from"./logger-fOoIHE0y.js";let t=[];function n(n){let r=typeof n==`string`?new URL(n):n,o=r.hostname.toLowerCase();for(let n of t)for(let t of n.urlPatterns){let r=t.toLowerCase();if(a(o,r))return e.debug(`Found matching OAuth provider for URL`,{hostname:o,pattern:t,providerId:n.id,providerName:n.name}),i(n)}e.debug(`No pre-configured OAuth provider found for URL`,{hostname:o,serverUrl:r.toString()})}function r(e){t=e.map(i)}function i(e){return{...e,scopes:e.scopes?[...e.scopes]:void 0,urlPatterns:[...e.urlPatterns]}}function a(e,t){return!!(e===t||e.endsWith(`.${t}`))}export{n as findProviderForUrl,r as setOAuthProviders};
+//# sourceMappingURL=providers-BdLw9eT-.js.map

package/dist/{providers-1NndXxjs.js.map → providers-BdLw9eT-.js.map}

@@ -1 +1 @@
-{"version":3,"file":"providers-1NndXxjs.js","names":["oauthProviders: OAuthProviderConfig[]"],"sources":["../src/auth/providers.ts"],"sourcesContent":["import type { OAuthProviderConfig } from \"../config/config.js\";\n\nimport { logger } from \"../lib/logger.js\";\n\n// Mutable store. Populated by setOAuthProviders() during startup once the\n// gateway has fetched provider config from the web extension service.\n// Pre-startup or when the fetch fails, the array stays empty and OAuth flows\n// fall through to Dynamic Client Registration via oauthFlow.ts.\nlet oauthProviders: OAuthProviderConfig[] = [];\n\n/**\n * Finds a pre-configured OAuth provider that matches the given server URL.\n *\n * @param serverUrl The MCP server URL to match against provider URL patterns\n * @returns The matching provider config, or undefined if no match found\n */\nexport function findProviderForUrl(serverUrl: string | URL): OAuthProviderConfig | undefined {\n  const serverUrlObj = typeof serverUrl === \"string\" ? new URL(serverUrl) : serverUrl;\n  const hostname = serverUrlObj.hostname.toLowerCase();\n\n  for (const provider of oauthProviders) {\n    for (const pattern of provider.urlPatterns) {\n      // Pattern can be a hostname or a hostname with path prefix\n      const patternLower = pattern.toLowerCase();\n\n      // Check if pattern matches hostname (with or without subdomains)\n      if (matchesHostname(hostname, patternLower)) {\n        logger.debug(\"Found matching OAuth provider for URL\", {\n          hostname,\n          pattern,\n          providerId: provider.id,\n          providerName: provider.name,\n        });\n        // Return a defensive clone — callers in oauthFlow.ts must not be\n        // able to corrupt the in-memory store via the returned reference.\n        return cloneProvider(provider);\n      }\n    }\n  }\n\n  logger.debug(\"No pre-configured OAuth provider found for URL\", {\n    hostname,\n    serverUrl: serverUrlObj.toString(),\n  });\n  return undefined;\n}\n\n/**\n * Gets a provider by its ID.\n *\n * @param providerId The provider ID (e.g., \"github\")\n * @returns The provider config, or undefined if not found\n */\nexport function getProviderById(providerId: string): OAuthProviderConfig | undefined {\n  const found = oauthProviders.find((p) => p.id === providerId);\n  return found ? cloneProvider(found) : undefined;\n}\n\n/**\n * Lists all configured OAuth providers.\n * Useful for debugging and admin interfaces.\n *\n * @returns Array of provider summaries (without secrets)\n */\nexport function listProviders(): Array<{\n  hasClientSecret: boolean;\n  id: string;\n  name: string;\n  urlPatterns: string[];\n}> {\n  return oauthProviders.map((p) => ({\n    hasClientSecret: !!p.clientSecret,\n    id: p.id,\n    name: p.name,\n    urlPatterns: [...p.urlPatterns],\n  }));\n}\n\n/**\n * Replaces the in-memory OAuth provider list. Called once at gateway startup\n * after fetching from the web extension service. Pass an empty array to clear.\n *\n * Stores defensive shallow copies of each provider so that callers cannot\n * mutate the in-memory store via the references they passed in. The\n * urlPatterns array is also cloned for the same reason.\n */\nexport function setOAuthProviders(providers: OAuthProviderConfig[]): void {\n  oauthProviders = providers.map(cloneProvider);\n}\n\n// cloneProvider returns a defensive shallow copy with array fields cloned,\n// so callers can read and even mutate the result without corrupting the\n// in-memory store. Used on every read path (findProviderForUrl,\n// getProviderById) to match the write-side contract in setOAuthProviders.\nfunction cloneProvider(p: OAuthProviderConfig): OAuthProviderConfig {\n  return {\n    ...p,\n    scopes: p.scopes ? [...p.scopes] : undefined,\n    urlPatterns: [...p.urlPatterns],\n  };\n}\n\n/**\n * Checks if a hostname matches a pattern.\n * Supports exact matches and subdomain matches.\n *\n * @param hostname The hostname to check (e.g., \"api.github.com\")\n * @param pattern The pattern to match against (e.g., \"github.com\")\n * @returns true if the hostname matches the pattern\n */\nfunction matchesHostname(hostname: string, pattern: string): boolean {\n  // Exact match\n  if (hostname === pattern) {\n    return true;\n  }\n\n  // Subdomain match: hostname ends with \".pattern\"\n  // e.g., \"api.github.com\" matches \"github.com\"\n  if (hostname.endsWith(`.${pattern}`)) {\n    return true;\n  }\n\n  return false;\n}\n"],"mappings":"8CAQA,IAAIA,EAAwC,EAAE,CAQ9C,SAAgB,EAAmB,EAA0D,CAC3F,IAAM,EAAe,OAAO,GAAc,SAAW,IAAI,IAAI,EAAU,CAAG,EACpE,EAAW,EAAa,SAAS,aAAa,CAEpD,IAAK,IAAM,KAAY,EACrB,IAAK,IAAM,KAAW,EAAS,YAAa,CAE1C,IAAM,EAAe,EAAQ,aAAa,CAG1C,GAAI,EAAgB,EAAU,EAAa,CASzC,OARA,EAAO,MAAM,wCAAyC,CACpD,WACA,UACA,WAAY,EAAS,GACrB,aAAc,EAAS,KACxB,CAAC,CAGK,EAAc,EAAS,CAKpC,EAAO,MAAM,iDAAkD,CAC7D,WACA,UAAW,EAAa,UAAU,CACnC,CAAC,CA2CJ,SAAgB,EAAkB,EAAwC,CACxE,EAAiB,EAAU,IAAI,EAAc,CAO/C,SAAS,EAAc,EAA6C,CAClE,MAAO,CACL,GAAG,EACH,OAAQ,EAAE,OAAS,CAAC,GAAG,EAAE,OAAO,CAAG,IAAA,GACnC,YAAa,CAAC,GAAG,EAAE,YAAY,CAChC,CAWH,SAAS,EAAgB,EAAkB,EAA0B,CAYnE,MAJA,GANI,IAAa,GAMb,EAAS,SAAS,IAAI,IAAU"}
+{"version":3,"file":"providers-BdLw9eT-.js","names":["oauthProviders: OAuthProviderConfig[]"],"sources":["../src/auth/providers.ts"],"sourcesContent":["import type { OAuthProviderConfig } from \"../config/config.js\";\n\nimport { logger } from \"../lib/logger.js\";\n\n// Mutable store. Populated by setOAuthProviders() during startup once the\n// gateway has fetched provider config from the web extension service.\n// Pre-startup or when the fetch fails, the array stays empty and OAuth flows\n// fall through to Dynamic Client Registration via oauthFlow.ts.\nlet oauthProviders: OAuthProviderConfig[] = [];\n\n/**\n * Finds a pre-configured OAuth provider that matches the given server URL.\n *\n * @param serverUrl The MCP server URL to match against provider URL patterns\n * @returns The matching provider config, or undefined if no match found\n */\nexport function findProviderForUrl(serverUrl: string | URL): OAuthProviderConfig | undefined {\n  const serverUrlObj = typeof serverUrl === \"string\" ? new URL(serverUrl) : serverUrl;\n  const hostname = serverUrlObj.hostname.toLowerCase();\n\n  for (const provider of oauthProviders) {\n    for (const pattern of provider.urlPatterns) {\n      // Pattern can be a hostname or a hostname with path prefix\n      const patternLower = pattern.toLowerCase();\n\n      // Check if pattern matches hostname (with or without subdomains)\n      if (matchesHostname(hostname, patternLower)) {\n        logger.debug(\"Found matching OAuth provider for URL\", {\n          hostname,\n          pattern,\n          providerId: provider.id,\n          providerName: provider.name,\n        });\n        // Return a defensive clone — callers in oauthFlow.ts must not be\n        // able to corrupt the in-memory store via the returned reference.\n        return cloneProvider(provider);\n      }\n    }\n  }\n\n  logger.debug(\"No pre-configured OAuth provider found for URL\", {\n    hostname,\n    serverUrl: serverUrlObj.toString(),\n  });\n  return undefined;\n}\n\n/**\n * Gets a provider by its ID.\n *\n * @param providerId The provider ID (e.g., \"github\")\n * @returns The provider config, or undefined if not found\n */\nexport function getProviderById(providerId: string): OAuthProviderConfig | undefined {\n  const found = oauthProviders.find((p) => p.id === providerId);\n  return found ? cloneProvider(found) : undefined;\n}\n\n/**\n * Lists all configured OAuth providers.\n * Useful for debugging and admin interfaces.\n *\n * @returns Array of provider summaries (without secrets)\n */\nexport function listProviders(): Array<{\n  hasClientSecret: boolean;\n  id: string;\n  name: string;\n  urlPatterns: string[];\n}> {\n  return oauthProviders.map((p) => ({\n    hasClientSecret: !!p.clientSecret,\n    id: p.id,\n    name: p.name,\n    urlPatterns: [...p.urlPatterns],\n  }));\n}\n\n/**\n * Replaces the in-memory OAuth provider list. Called once at gateway startup\n * after fetching from the web extension service. Pass an empty array to clear.\n *\n * Stores defensive shallow copies of each provider so that callers cannot\n * mutate the in-memory store via the references they passed in. The\n * urlPatterns array is also cloned for the same reason.\n */\nexport function setOAuthProviders(providers: OAuthProviderConfig[]): void {\n  oauthProviders = providers.map(cloneProvider);\n}\n\n// cloneProvider returns a defensive shallow copy with array fields cloned,\n// so callers can read and even mutate the result without corrupting the\n// in-memory store. Used on every read path (findProviderForUrl,\n// getProviderById) to match the write-side contract in setOAuthProviders.\nfunction cloneProvider(p: OAuthProviderConfig): OAuthProviderConfig {\n  return {\n    ...p,\n    scopes: p.scopes ? [...p.scopes] : undefined,\n    urlPatterns: [...p.urlPatterns],\n  };\n}\n\n/**\n * Checks if a hostname matches a pattern.\n * Supports exact matches and subdomain matches.\n *\n * @param hostname The hostname to check (e.g., \"api.github.com\")\n * @param pattern The pattern to match against (e.g., \"github.com\")\n * @returns true if the hostname matches the pattern\n */\nfunction matchesHostname(hostname: string, pattern: string): boolean {\n  // Exact match\n  if (hostname === pattern) {\n    return true;\n  }\n\n  // Subdomain match: hostname ends with \".pattern\"\n  // e.g., \"api.github.com\" matches \"github.com\"\n  if (hostname.endsWith(`.${pattern}`)) {\n    return true;\n  }\n\n  return false;\n}\n"],"mappings":"8CAQA,IAAIA,EAAwC,EAAE,CAQ9C,SAAgB,EAAmB,EAA0D,CAC3F,IAAM,EAAe,OAAO,GAAc,SAAW,IAAI,IAAI,EAAU,CAAG,EACpE,EAAW,EAAa,SAAS,aAAa,CAEpD,IAAK,IAAM,KAAY,EACrB,IAAK,IAAM,KAAW,EAAS,YAAa,CAE1C,IAAM,EAAe,EAAQ,aAAa,CAG1C,GAAI,EAAgB,EAAU,EAAa,CASzC,OARA,EAAO,MAAM,wCAAyC,CACpD,WACA,UACA,WAAY,EAAS,GACrB,aAAc,EAAS,KACxB,CAAC,CAGK,EAAc,EAAS,CAKpC,EAAO,MAAM,iDAAkD,CAC7D,WACA,UAAW,EAAa,UAAU,CACnC,CAAC,CA2CJ,SAAgB,EAAkB,EAAwC,CACxE,EAAiB,EAAU,IAAI,EAAc,CAO/C,SAAS,EAAc,EAA6C,CAClE,MAAO,CACL,GAAG,EACH,OAAQ,EAAE,OAAS,CAAC,GAAG,EAAE,OAAO,CAAG,IAAA,GACnC,YAAa,CAAC,GAAG,EAAE,YAAY,CAChC,CAWH,SAAS,EAAgB,EAAkB,EAA0B,CAYnE,MAJA,GANI,IAAa,GAMb,EAAS,SAAS,IAAI,IAAU"}