@opsee/mcp-server 0.7.2 → 0.7.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opsee/mcp-server",
-  "version": "0.7.2",
+  "version": "0.7.3",
   "description": "Opsee MCP server — manage projects, tasks, docs, and cycles from AI coding environments",
   "type": "module",
   "bin": {

package/src/auth/__tests__/oauth-provider.test.ts

@@ -59,7 +59,6 @@ describe("OpseeClientStore", () => {
 
     const registered = await clientStore.registerClient(makeClient());
     expect(registered.client_id).toBeTruthy();
-    expect(registered.client_secret).toBeTruthy();
 
     const fetched = await clientStore.getClient(registered.client_id);
     expect(fetched).toBeDefined();
@@ -68,6 +67,52 @@ describe("OpseeClientStore", () => {
     expect(fetched?.redirect_uris).toContain(REDIRECT_URI);
   });
 
+  test("public clients (auth method 'none') are not issued a client_secret", async () => {
+    const store = new InMemoryKVStore();
+    const clientStore = new OpseeClientStore(store);
+
+    // makeClient() registers with token_endpoint_auth_method "none". Issuing a
+    // secret would make the SDK's token endpoint require it and reject the
+    // PKCE-only token request with invalid_client.
+    const registered = await clientStore.registerClient(makeClient());
+    expect(registered.client_secret).toBeUndefined();
+
+    const fetched = await clientStore.getClient(registered.client_id);
+    expect(fetched?.client_secret).toBeUndefined();
+  });
+
+  test("confidential clients still receive a client_secret", async () => {
+    const store = new InMemoryKVStore();
+    const clientStore = new OpseeClientStore(store);
+
+    const confidential = {
+      ...makeClient(),
+      token_endpoint_auth_method: "client_secret_post",
+    } as unknown as Omit<
+      OAuthClientInformationFull,
+      "client_id" | "client_id_issued_at"
+    >;
+
+    const registered = await clientStore.registerClient(confidential);
+    expect(registered.client_secret).toBeTruthy();
+  });
+
+  test("registrations persist without a TTL", async () => {
+    vi.useFakeTimers();
+    try {
+      const store = new InMemoryKVStore();
+      const clientStore = new OpseeClientStore(store);
+
+      const registered = await clientStore.registerClient(makeClient());
+      // Well past any old 30-day expiry — the registration must still resolve,
+      // otherwise long-idle clients hit invalid_client at /authorize.
+      vi.advanceTimersByTime(60 * 24 * 60 * 60 * 1000);
+      expect(await clientStore.getClient(registered.client_id)).toBeDefined();
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
   test("getClient returns undefined for an unknown client (no empty-uri fallback)", async () => {
     const store = new InMemoryKVStore();
     const clientStore = new OpseeClientStore(store);

package/src/auth/oauth-provider.ts

@@ -40,7 +40,6 @@ const CODE_KEY = (code: string) => `oauth:code:${code}`;
 const REVOKED_KEY = (token: string) => `oauth:revoked:${token}`;
 
 const FLOW_TTL_SECONDS = 10 * 60; // pending auths + auth codes: 10 minutes
-const CLIENT_TTL_SECONDS = 30 * 24 * 60 * 60; // dynamic client registrations: 30 days
 const REVOKED_FALLBACK_TTL_SECONDS = 24 * 60 * 60; // if token expiry is unknown
 
 export class OpseeClientStore implements OAuthRegisteredClientsStore {
@@ -66,18 +65,26 @@ export class OpseeClientStore implements OAuthRegisteredClientsStore {
     client: Omit<OAuthClientInformationFull, "client_id" | "client_id_issued_at">,
   ): Promise<OAuthClientInformationFull> {
     const clientId = randomUUID();
-    const clientSecret = randomBytes(32).toString("hex");
     const registered: OAuthClientInformationFull = {
       ...client,
       client_id: clientId,
-      client_secret: clientSecret,
       client_id_issued_at: Math.floor(Date.now() / 1000),
     };
-    await this.store.set(
-      CLIENT_KEY(clientId),
-      JSON.stringify(registered),
-      CLIENT_TTL_SECONDS,
-    );
+
+    // Only confidential clients get a secret. A public client registers with
+    // token_endpoint_auth_method "none" and authenticates via PKCE alone. If we
+    // minted a secret for it anyway, the SDK's token endpoint would then *require*
+    // that secret (see authenticateClient) and reject the PKCE-only token request
+    // with invalid_client — breaking every public client (e.g. Claude).
+    if (client.token_endpoint_auth_method !== "none") {
+      registered.client_secret = randomBytes(32).toString("hex");
+    }
+
+    // Persist without a TTL. Clients cache their Dynamic Client Registration
+    // indefinitely and the DCR response advertises no expiry, so a server-side
+    // TTL guarantees that any client idle past the TTL comes back with a
+    // client_id we no longer recognise and gets invalid_client at /authorize.
+    await this.store.set(CLIENT_KEY(clientId), JSON.stringify(registered));
     return registered;
   }
 }