@payloadcms/plugin-mcp 4.0.0-internal.a0ef1b8 → 4.0.0-internal.a2d053c

package/dist/endpoint/oauth.js

@@ -0,0 +1,94 @@
+import { bearerAuthChallengeResponse, OAuthError, OAuthErrorCode } from '@modelcontextprotocol/server';
+import { createPayloadRequest, getPayload } from 'payload';
+import { getPluginConfig } from '../utils/getPluginConfig.js';
+/**
+ * Serves the OAuth protected resource metadata (RFC 9728) at `/api/mcp/oauth-protected-resource`.
+ * The OAuth challenge links here, so MCP clients find the authorization server without setup.
+ */ export const oauthProtectedResourceEndpoint = (req)=>getMetadataResponse({
+        req
+    });
+/**
+ * Serves the same metadata for clients that ignore the challenge's link and only look at
+ * `/.well-known/oauth-protected-resource`. Mount it at the site root, e.g. in Next.js at
+ * `app/.well-known/oauth-protected-resource/[[...path]]/route.ts`:
+ *
+ * ```ts
+ * import config from '@payload-config'
+ * import { oauthProtectedResourceHandler } from '@payloadcms/plugin-mcp'
+ *
+ * export const GET = oauthProtectedResourceHandler(config)
+ * ```
+ */ export const oauthProtectedResourceHandler = (config)=>async (request)=>getMetadataResponse({
+            req: await createPayloadRequest({
+                payload: await getPayload({
+                    config
+                }),
+                req: request
+            })
+        });
+/**
+ * Answers an unauthenticated MCP request with a challenge linking to the protected resource
+ * metadata, which starts the client's OAuth flow.
+ */ export const oauthChallenge = ({ req })=>{
+    const { oauth } = getPluginConfig({
+        config: req.payload.config
+    });
+    const response = bearerAuthChallengeResponse(new OAuthError(OAuthErrorCode.InvalidToken, req.t('error:unauthorized')), {
+        requiredScopes: oauth?.type === 'external' ? oauth.scopes : undefined,
+        resourceMetadataUrl: `${getMCPURL({
+            config: req.payload.config,
+            url: req.url
+        })}/oauth-protected-resource`
+    });
+    // Lets browser-based MCP clients read the challenge, when Payload's `cors` setting allows them
+    response.headers.set('Access-Control-Expose-Headers', 'WWW-Authenticate');
+    return response;
+};
+/**
+ * The MCP endpoint's address, as advertised in the metadata's `resource`. Clients send it when
+ * they sign in, and authorization servers that support it put it in the access token's audience.
+ */ export const getMCPResource = ({ config, url })=>getPluginConfig({
+        config
+    }).oauth?.resource ?? getMCPURL({
+        config,
+        url
+    });
+export const getMCPURL = ({ config, url })=>new URL(`${config.routes.api}/mcp`, config.serverURL || url).href;
+const getMetadataResponse = async ({ req })=>{
+    const { config } = req.payload;
+    const { oauth } = getPluginConfig({
+        config
+    });
+    if (!oauth) {
+        return new Response(null, {
+            status: 404
+        });
+    }
+    return Response.json({
+        authorization_servers: oauth.type === 'builtin' ? [
+            `${getMCPURL({
+                config,
+                url: req.url
+            })}/oauth`
+        ] : typeof oauth.authorizationServers === 'function' ? await oauth.authorizationServers({
+            req
+        }) : oauth.authorizationServers,
+        bearer_methods_supported: [
+            'header'
+        ],
+        resource: getMCPResource({
+            config,
+            url: req.url
+        }),
+        scopes_supported: oauth.type === 'external' ? oauth.scopes : undefined
+    }, // Public document, readable by browser-based MCP clients on any origin. Not cached, since
+    // without `serverURL` its URLs come from the request.
+    {
+        headers: {
+            'Access-Control-Allow-Origin': '*',
+            'Cache-Control': 'no-store'
+        }
+    });
+};
+
+//# sourceMappingURL=oauth.js.map

package/dist/endpoint/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/endpoint/oauth.ts"],"sourcesContent":["import type { OAuthProtectedResourceMetadata } from '@modelcontextprotocol/server'\nimport type { PayloadHandler, PayloadRequest, SanitizedConfig } from 'payload'\n\nimport {\n  bearerAuthChallengeResponse,\n  OAuthError,\n  OAuthErrorCode,\n} from '@modelcontextprotocol/server'\nimport { createPayloadRequest, getPayload } from 'payload'\n\nimport { getPluginConfig } from '../utils/getPluginConfig.js'\n\n/**\n * Serves the OAuth protected resource metadata (RFC 9728) at `/api/mcp/oauth-protected-resource`.\n * The OAuth challenge links here, so MCP clients find the authorization server without setup.\n */\nexport const oauthProtectedResourceEndpoint: PayloadHandler = (req) => getMetadataResponse({ req })\n\n/**\n * Serves the same metadata for clients that ignore the challenge's link and only look at\n * `/.well-known/oauth-protected-resource`. Mount it at the site root, e.g. in Next.js at\n * `app/.well-known/oauth-protected-resource/[[...path]]/route.ts`:\n *\n * ```ts\n * import config from '@payload-config'\n * import { oauthProtectedResourceHandler } from '@payloadcms/plugin-mcp'\n *\n * export const GET = oauthProtectedResourceHandler(config)\n * ```\n */\nexport const oauthProtectedResourceHandler =\n  (config: Promise<SanitizedConfig> | SanitizedConfig) =>\n  async (request: Request): Promise<Response> =>\n    getMetadataResponse({\n      req: await createPayloadRequest({ payload: await getPayload({ config }), req: request }),\n    })\n\n/**\n * Answers an unauthenticated MCP request with a challenge linking to the protected resource\n * metadata, which starts the client's OAuth flow.\n */\nexport const oauthChallenge = ({ req }: { req: PayloadRequest }): Response => {\n  const { oauth } = getPluginConfig({ config: req.payload.config })\n  const response = bearerAuthChallengeResponse(\n    new OAuthError(OAuthErrorCode.InvalidToken, req.t('error:unauthorized')),\n    {\n      requiredScopes: oauth?.type === 'external' ? oauth.scopes : undefined,\n      resourceMetadataUrl: `${getMCPURL({ config: req.payload.config, url: req.url! })}/oauth-protected-resource`,\n    },\n  )\n\n  // Lets browser-based MCP clients read the challenge, when Payload's `cors` setting allows them\n  response.headers.set('Access-Control-Expose-Headers', 'WWW-Authenticate')\n\n  return response\n}\n\n/**\n * The MCP endpoint's address, as advertised in the metadata's `resource`. Clients send it when\n * they sign in, and authorization servers that support it put it in the access token's audience.\n */\nexport const getMCPResource = ({ config, url }: { config: SanitizedConfig; url: string }): string =>\n  getPluginConfig({ config }).oauth?.resource ?? getMCPURL({ config, url })\n\nexport const getMCPURL = ({ config, url }: { config: SanitizedConfig; url: string }): string =>\n  new URL(`${config.routes.api}/mcp`, config.serverURL || url).href\n\nconst getMetadataResponse = async ({ req }: { req: PayloadRequest }): Promise<Response> => {\n  const { config } = req.payload\n  const { oauth } = getPluginConfig({ config })\n\n  if (!oauth) {\n    return new Response(null, { status: 404 })\n  }\n\n  return Response.json(\n    {\n      authorization_servers:\n        oauth.type === 'builtin'\n          ? [`${getMCPURL({ config, url: req.url! })}/oauth`]\n          : typeof oauth.authorizationServers === 'function'\n            ? await oauth.authorizationServers({ req })\n            : oauth.authorizationServers,\n      bearer_methods_supported: ['header'],\n      resource: getMCPResource({ config, url: req.url! }),\n      scopes_supported: oauth.type === 'external' ? oauth.scopes : undefined,\n    } satisfies OAuthProtectedResourceMetadata,\n    // Public document, readable by browser-based MCP clients on any origin. Not cached, since\n    // without `serverURL` its URLs come from the request.\n    { headers: { 'Access-Control-Allow-Origin': '*', 'Cache-Control': 'no-store' } },\n  )\n}\n"],"names":["bearerAuthChallengeResponse","OAuthError","OAuthErrorCode","createPayloadRequest","getPayload","getPluginConfig","oauthProtectedResourceEndpoint","req","getMetadataResponse","oauthProtectedResourceHandler","config","request","payload","oauthChallenge","oauth","response","InvalidToken","t","requiredScopes","type","scopes","undefined","resourceMetadataUrl","getMCPURL","url","headers","set","getMCPResource","resource","URL","routes","api","serverURL","href","Response","status","json","authorization_servers","authorizationServers","bearer_methods_supported","scopes_supported"],"mappings":"AAGA,SACEA,2BAA2B,EAC3BC,UAAU,EACVC,cAAc,QACT,+BAA8B;AACrC,SAASC,oBAAoB,EAAEC,UAAU,QAAQ,UAAS;AAE1D,SAASC,eAAe,QAAQ,8BAA6B;AAE7D;;;CAGC,GACD,OAAO,MAAMC,iCAAiD,CAACC,MAAQC,oBAAoB;QAAED;IAAI,GAAE;AAEnG;;;;;;;;;;;CAWC,GACD,OAAO,MAAME,gCACX,CAACC,SACD,OAAOC,UACLH,oBAAoB;YAClBD,KAAK,MAAMJ,qBAAqB;gBAAES,SAAS,MAAMR,WAAW;oBAAEM;gBAAO;gBAAIH,KAAKI;YAAQ;QACxF,GAAE;AAEN;;;CAGC,GACD,OAAO,MAAME,iBAAiB,CAAC,EAAEN,GAAG,EAA2B;IAC7D,MAAM,EAAEO,KAAK,EAAE,GAAGT,gBAAgB;QAAEK,QAAQH,IAAIK,OAAO,CAACF,MAAM;IAAC;IAC/D,MAAMK,WAAWf,4BACf,IAAIC,WAAWC,eAAec,YAAY,EAAET,IAAIU,CAAC,CAAC,wBAClD;QACEC,gBAAgBJ,OAAOK,SAAS,aAAaL,MAAMM,MAAM,GAAGC;QAC5DC,qBAAqB,GAAGC,UAAU;YAAEb,QAAQH,IAAIK,OAAO,CAACF,MAAM;YAAEc,KAAKjB,IAAIiB,GAAG;QAAE,GAAG,yBAAyB,CAAC;IAC7G;IAGF,+FAA+F;IAC/FT,SAASU,OAAO,CAACC,GAAG,CAAC,iCAAiC;IAEtD,OAAOX;AACT,EAAC;AAED;;;CAGC,GACD,OAAO,MAAMY,iBAAiB,CAAC,EAAEjB,MAAM,EAAEc,GAAG,EAA4C,GACtFnB,gBAAgB;QAAEK;IAAO,GAAGI,KAAK,EAAEc,YAAYL,UAAU;QAAEb;QAAQc;IAAI,GAAE;AAE3E,OAAO,MAAMD,YAAY,CAAC,EAAEb,MAAM,EAAEc,GAAG,EAA4C,GACjF,IAAIK,IAAI,GAAGnB,OAAOoB,MAAM,CAACC,GAAG,CAAC,IAAI,CAAC,EAAErB,OAAOsB,SAAS,IAAIR,KAAKS,IAAI,CAAA;AAEnE,MAAMzB,sBAAsB,OAAO,EAAED,GAAG,EAA2B;IACjE,MAAM,EAAEG,MAAM,EAAE,GAAGH,IAAIK,OAAO;IAC9B,MAAM,EAAEE,KAAK,EAAE,GAAGT,gBAAgB;QAAEK;IAAO;IAE3C,IAAI,CAACI,OAAO;QACV,OAAO,IAAIoB,SAAS,MAAM;YAAEC,QAAQ;QAAI;IAC1C;IAEA,OAAOD,SAASE,IAAI,CAClB;QACEC,uBACEvB,MAAMK,IAAI,KAAK,YACX;YAAC,GAAGI,UAAU;gBAAEb;gBAAQc,KAAKjB,IAAIiB,GAAG;YAAE,GAAG,MAAM,CAAC;SAAC,GACjD,OAAOV,MAAMwB,oBAAoB,KAAK,aACpC,MAAMxB,MAAMwB,oBAAoB,CAAC;YAAE/B;QAAI,KACvCO,MAAMwB,oBAAoB;QAClCC,0BAA0B;YAAC;SAAS;QACpCX,UAAUD,eAAe;YAAEjB;YAAQc,KAAKjB,IAAIiB,GAAG;QAAE;QACjDgB,kBAAkB1B,MAAMK,IAAI,KAAK,aAAaL,MAAMM,MAAM,GAAGC;IAC/D,GACA,0FAA0F;IAC1F,sDAAsD;IACtD;QAAEI,SAAS;YAAE,+BAA+B;YAAK,iBAAiB;QAAW;IAAE;AAEnF"}

package/dist/endpoint/oauthLoginToken.d.ts

@@ -0,0 +1,21 @@
+import type { PayloadRequest } from 'payload';
+import type { MCPOAuthTokens } from '../types.js';
+/**
+ * The default `issueToken`: a Payload login token, sealed so it only works for MCP, where
+ * `authenticateLoginToken` unseals it. Otherwise an MCP client could use it as the user's admin
+ * panel login. When the collection uses sessions, the client also gets a refresh token.
+ */
+export declare const issueLoginToken: ({ req, }: {
+    req: PayloadRequest;
+}) => Promise<MCPOAuthTokens>;
+/** The default `refreshToken`. Payload logs out the session when a refresh token is reused. */
+export declare const refreshLoginToken: ({ refreshToken, req, }: {
+    refreshToken: string;
+    req: PayloadRequest;
+}) => Promise<MCPOAuthTokens | null>;
+/** Finds the user of an MCP request's access token from `issueLoginToken`. */
+export declare const authenticateLoginToken: ({ req, token, }: {
+    req: PayloadRequest;
+    token: string;
+}) => Promise<PayloadRequest['user']>;
+//# sourceMappingURL=oauthLoginToken.d.ts.map

package/dist/endpoint/oauthLoginToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthLoginToken.d.ts","sourceRoot":"","sources":["../../src/endpoint/oauthLoginToken.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAI7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAIjD;;;;GAIG;AACH,eAAO,MAAM,eAAe,aAEzB;IACD,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,OAAO,CAAC,cAAc,CA6BzB,CAAA;AAED,+FAA+F;AAC/F,eAAO,MAAM,iBAAiB,2BAG3B;IACD,YAAY,EAAE,MAAM,CAAA;IACpB,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAUhC,CAAA;AAED,8EAA8E;AAC9E,eAAO,MAAM,sBAAsB,oBAGhC;IACD,GAAG,EAAE,cAAc,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;CACd,KAAG,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAajC,CAAA"}

package/dist/endpoint/oauthLoginToken.js

@@ -0,0 +1,79 @@
+import { APIError, createAuthToken, executeAuthStrategies, redeemRefreshToken } from 'payload';
+import { seal, unseal } from '../utils/seal.js';
+/**
+ * The default `issueToken`: a Payload login token, sealed so it only works for MCP, where
+ * `authenticateLoginToken` unseals it. Otherwise an MCP client could use it as the user's admin
+ * panel login. When the collection uses sessions, the client also gets a refresh token.
+ */ export const issueLoginToken = async ({ req })=>{
+    const collectionConfig = req.payload.collections[req.user.collection].config;
+    if (collectionConfig.auth.disableLocalStrategy) {
+        throw new APIError(`MCP clients can't get Payload login tokens for the "${collectionConfig.slug}" collection because its local strategy is disabled. Pass oauth.issueToken to the MCP plugin.`);
+    }
+    // The full document, like the one a password login starts its session on
+    const user = await req.payload.db.findOne({
+        collection: collectionConfig.slug,
+        req,
+        where: {
+            id: {
+                equals: req.user.id
+            }
+        }
+    });
+    const { refreshToken, token } = await createAuthToken({
+        collectionConfig,
+        email: user.email,
+        req,
+        shouldCreateRefreshToken: true,
+        user
+    });
+    return {
+        accessToken: sealLoginToken({
+            req,
+            token
+        }),
+        expiresIn: collectionConfig.auth.tokenExpiration,
+        refreshToken
+    };
+};
+/** The default `refreshToken`. Payload logs out the session when a refresh token is reused. */ export const refreshLoginToken = async ({ refreshToken, req })=>{
+    const refreshed = await redeemRefreshToken({
+        refreshToken,
+        req
+    });
+    return refreshed && {
+        accessToken: sealLoginToken({
+            req,
+            token: refreshed.token
+        }),
+        expiresIn: refreshed.collectionConfig.auth.tokenExpiration,
+        refreshToken: refreshed.refreshToken
+    };
+};
+/** Finds the user of an MCP request's access token from `issueLoginToken`. */ export const authenticateLoginToken = async ({ req, token })=>{
+    const loginToken = unseal({
+        type: 'access',
+        req,
+        value: token
+    });
+    if (!loginToken) {
+        return null;
+    }
+    const headers = new Headers({
+        Authorization: `JWT ${loginToken.token}`,
+        DisableAutologin: 'true'
+    });
+    return (await executeAuthStrategies({
+        headers,
+        payload: req.payload,
+        req
+    })).user;
+};
+const sealLoginToken = ({ req, token })=>seal({
+        type: 'access',
+        data: {
+            token
+        },
+        req
+    });
+
+//# sourceMappingURL=oauthLoginToken.js.map

package/dist/endpoint/oauthLoginToken.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/endpoint/oauthLoginToken.ts"],"sourcesContent":["import type { PayloadRequest } from 'payload'\n\nimport { APIError, createAuthToken, executeAuthStrategies, redeemRefreshToken } from 'payload'\n\nimport type { MCPOAuthTokens } from '../types.js'\n\nimport { seal, unseal } from '../utils/seal.js'\n\n/**\n * The default `issueToken`: a Payload login token, sealed so it only works for MCP, where\n * `authenticateLoginToken` unseals it. Otherwise an MCP client could use it as the user's admin\n * panel login. When the collection uses sessions, the client also gets a refresh token.\n */\nexport const issueLoginToken = async ({\n  req,\n}: {\n  req: PayloadRequest\n}): Promise<MCPOAuthTokens> => {\n  const collectionConfig = req.payload.collections[req.user!.collection]!.config\n\n  if (collectionConfig.auth.disableLocalStrategy) {\n    throw new APIError(\n      `MCP clients can't get Payload login tokens for the \"${collectionConfig.slug}\" collection because its local strategy is disabled. Pass oauth.issueToken to the MCP plugin.`,\n    )\n  }\n\n  // The full document, like the one a password login starts its session on\n  const user = (await req.payload.db.findOne<NonNullable<PayloadRequest['user']>>({\n    collection: collectionConfig.slug,\n    req,\n    where: { id: { equals: req.user!.id } },\n  }))!\n\n  const { refreshToken, token } = await createAuthToken({\n    collectionConfig,\n    email: user.email!,\n    req,\n    shouldCreateRefreshToken: true,\n    user,\n  })\n\n  return {\n    accessToken: sealLoginToken({ req, token }),\n    expiresIn: collectionConfig.auth.tokenExpiration,\n    refreshToken,\n  }\n}\n\n/** The default `refreshToken`. Payload logs out the session when a refresh token is reused. */\nexport const refreshLoginToken = async ({\n  refreshToken,\n  req,\n}: {\n  refreshToken: string\n  req: PayloadRequest\n}): Promise<MCPOAuthTokens | null> => {\n  const refreshed = await redeemRefreshToken({ refreshToken, req })\n\n  return (\n    refreshed && {\n      accessToken: sealLoginToken({ req, token: refreshed.token }),\n      expiresIn: refreshed.collectionConfig.auth.tokenExpiration,\n      refreshToken: refreshed.refreshToken,\n    }\n  )\n}\n\n/** Finds the user of an MCP request's access token from `issueLoginToken`. */\nexport const authenticateLoginToken = async ({\n  req,\n  token,\n}: {\n  req: PayloadRequest\n  token: string\n}): Promise<PayloadRequest['user']> => {\n  const loginToken = unseal<{ token: string }>({ type: 'access', req, value: token })\n\n  if (!loginToken) {\n    return null\n  }\n\n  const headers = new Headers({\n    Authorization: `JWT ${loginToken.token}`,\n    DisableAutologin: 'true',\n  })\n\n  return (await executeAuthStrategies({ headers, payload: req.payload, req })).user\n}\n\nconst sealLoginToken = ({ req, token }: { req: PayloadRequest; token: string }): string =>\n  seal({ type: 'access', data: { token }, req })\n"],"names":["APIError","createAuthToken","executeAuthStrategies","redeemRefreshToken","seal","unseal","issueLoginToken","req","collectionConfig","payload","collections","user","collection","config","auth","disableLocalStrategy","slug","db","findOne","where","id","equals","refreshToken","token","email","shouldCreateRefreshToken","accessToken","sealLoginToken","expiresIn","tokenExpiration","refreshLoginToken","refreshed","authenticateLoginToken","loginToken","type","value","headers","Headers","Authorization","DisableAutologin","data"],"mappings":"AAEA,SAASA,QAAQ,EAAEC,eAAe,EAAEC,qBAAqB,EAAEC,kBAAkB,QAAQ,UAAS;AAI9F,SAASC,IAAI,EAAEC,MAAM,QAAQ,mBAAkB;AAE/C;;;;CAIC,GACD,OAAO,MAAMC,kBAAkB,OAAO,EACpCC,GAAG,EAGJ;IACC,MAAMC,mBAAmBD,IAAIE,OAAO,CAACC,WAAW,CAACH,IAAII,IAAI,CAAEC,UAAU,CAAC,CAAEC,MAAM;IAE9E,IAAIL,iBAAiBM,IAAI,CAACC,oBAAoB,EAAE;QAC9C,MAAM,IAAIf,SACR,CAAC,oDAAoD,EAAEQ,iBAAiBQ,IAAI,CAAC,6FAA6F,CAAC;IAE/K;IAEA,yEAAyE;IACzE,MAAML,OAAQ,MAAMJ,IAAIE,OAAO,CAACQ,EAAE,CAACC,OAAO,CAAsC;QAC9EN,YAAYJ,iBAAiBQ,IAAI;QACjCT;QACAY,OAAO;YAAEC,IAAI;gBAAEC,QAAQd,IAAII,IAAI,CAAES,EAAE;YAAC;QAAE;IACxC;IAEA,MAAM,EAAEE,YAAY,EAAEC,KAAK,EAAE,GAAG,MAAMtB,gBAAgB;QACpDO;QACAgB,OAAOb,KAAKa,KAAK;QACjBjB;QACAkB,0BAA0B;QAC1Bd;IACF;IAEA,OAAO;QACLe,aAAaC,eAAe;YAAEpB;YAAKgB;QAAM;QACzCK,WAAWpB,iBAAiBM,IAAI,CAACe,eAAe;QAChDP;IACF;AACF,EAAC;AAED,6FAA6F,GAC7F,OAAO,MAAMQ,oBAAoB,OAAO,EACtCR,YAAY,EACZf,GAAG,EAIJ;IACC,MAAMwB,YAAY,MAAM5B,mBAAmB;QAAEmB;QAAcf;IAAI;IAE/D,OACEwB,aAAa;QACXL,aAAaC,eAAe;YAAEpB;YAAKgB,OAAOQ,UAAUR,KAAK;QAAC;QAC1DK,WAAWG,UAAUvB,gBAAgB,CAACM,IAAI,CAACe,eAAe;QAC1DP,cAAcS,UAAUT,YAAY;IACtC;AAEJ,EAAC;AAED,4EAA4E,GAC5E,OAAO,MAAMU,yBAAyB,OAAO,EAC3CzB,GAAG,EACHgB,KAAK,EAIN;IACC,MAAMU,aAAa5B,OAA0B;QAAE6B,MAAM;QAAU3B;QAAK4B,OAAOZ;IAAM;IAEjF,IAAI,CAACU,YAAY;QACf,OAAO;IACT;IAEA,MAAMG,UAAU,IAAIC,QAAQ;QAC1BC,eAAe,CAAC,IAAI,EAAEL,WAAWV,KAAK,EAAE;QACxCgB,kBAAkB;IACpB;IAEA,OAAO,AAAC,CAAA,MAAMrC,sBAAsB;QAAEkC;QAAS3B,SAASF,IAAIE,OAAO;QAAEF;IAAI,EAAC,EAAGI,IAAI;AACnF,EAAC;AAED,MAAMgB,iBAAiB,CAAC,EAAEpB,GAAG,EAAEgB,KAAK,EAA0C,GAC5EnB,KAAK;QAAE8B,MAAM;QAAUM,MAAM;YAAEjB;QAAM;QAAGhB;IAAI"}

package/dist/endpoint/oauthServer.d.ts

@@ -0,0 +1,12 @@
+import type { Endpoint } from 'payload';
+/**
+ * Turns Payload into the OAuth authorization server for MCP clients when `oauth.type` is
+ * `'builtin'`. Clients register, the user allows them after logging in to the admin panel, and
+ * the client receives the tokens `issueToken` creates.
+ *
+ * Clients, consent forms, authorization codes, and refresh tokens are encrypted and handed to the
+ * client instead of being stored. Only the default tokens write to the database, to the user's
+ * login sessions.
+ */
+export declare const oauthServerEndpoints: Endpoint[];
+//# sourceMappingURL=oauthServer.d.ts.map

package/dist/endpoint/oauthServer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthServer.d.ts","sourceRoot":"","sources":["../../src/endpoint/oauthServer.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAkC,MAAM,SAAS,CAAA;AAoCvE;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,EAqC1C,CAAA"}

package/dist/endpoint/oauthServer.js

@@ -0,0 +1,362 @@
+import { OAuthErrorCode } from '@modelcontextprotocol/server';
+import { createHash } from 'crypto';
+import { formatAdminURL } from 'payload/shared';
+import { getPluginConfig } from '../utils/getPluginConfig.js';
+import { seal, unseal } from '../utils/seal.js';
+import { getMCPURL } from './oauth.js';
+import { issueLoginToken, refreshLoginToken } from './oauthLoginToken.js';
+/**
+ * Turns Payload into the OAuth authorization server for MCP clients when `oauth.type` is
+ * `'builtin'`. Clients register, the user allows them after logging in to the admin panel, and
+ * the client receives the tokens `issueToken` creates.
+ *
+ * Clients, consent forms, authorization codes, and refresh tokens are encrypted and handed to the
+ * client instead of being stored. Only the default tokens write to the database, to the user's
+ * login sessions.
+ */ export const oauthServerEndpoints = [
+    {
+        disableAuth: true,
+        handler: (req)=>withIssuer(req, (issuer)=>metadataResponse(issuer)),
+        method: 'get',
+        // OpenID discovery is the only metadata location MCP clients check below the issuer's path,
+        // which lets this work under /api without a route at the site root
+        path: '/mcp/oauth/.well-known/openid-configuration'
+    },
+    {
+        disableAuth: true,
+        handler: (req)=>withIssuer(req, ()=>Response.json({
+                    keys: []
+                })),
+        method: 'get',
+        path: '/mcp/oauth/jwks'
+    },
+    {
+        disableAuth: true,
+        handler: (req)=>withIssuer(req, ()=>register(req)),
+        method: 'post',
+        path: '/mcp/oauth/register'
+    },
+    {
+        handler: (req)=>withIssuer(req, ()=>authorize(req)),
+        method: 'get',
+        path: '/mcp/oauth/authorize'
+    },
+    {
+        handler: (req)=>withIssuer(req, ()=>approve(req)),
+        method: 'post',
+        path: '/mcp/oauth/authorize'
+    },
+    {
+        disableAuth: true,
+        handler: (req)=>withIssuer(req, ()=>token(req)),
+        method: 'post',
+        path: '/mcp/oauth/token'
+    }
+];
+/** The authorization server URL, or `undefined` when Payload isn't the authorization server. */ const getIssuer = (req)=>getPluginConfig({
+        config: req.payload.config
+    }).oauth?.type === 'builtin' ? `${getMCPURL({
+        config: req.payload.config,
+        url: req.url
+    })}/oauth` : undefined;
+const withIssuer = (req, handler)=>{
+    const issuer = getIssuer(req);
+    return issuer ? handler(issuer) : new Response(null, {
+        status: 404
+    });
+};
+/**
+ * The user logged in to this browser, who can allow MCP clients. Tokens and API keys in the
+ * `Authorization` header can't, or an MCP client could use its access token to approve itself a
+ * new, separate login.
+ */ const getBrowserUser = (req)=>req.headers.has('Authorization') ? null : req.user;
+const metadataResponse = (issuer)=>Response.json({
+        authorization_endpoint: `${issuer}/authorize`,
+        code_challenge_methods_supported: [
+            'S256'
+        ],
+        grant_types_supported: [
+            'authorization_code',
+            'refresh_token'
+        ],
+        // Required by OpenID discovery. No ID tokens are issued.
+        id_token_signing_alg_values_supported: [
+            'RS256'
+        ],
+        issuer,
+        jwks_uri: `${issuer}/jwks`,
+        registration_endpoint: `${issuer}/register`,
+        response_types_supported: [
+            'code'
+        ],
+        subject_types_supported: [
+            'public'
+        ],
+        token_endpoint: `${issuer}/token`,
+        token_endpoint_auth_methods_supported: [
+            'none'
+        ]
+    }, // Not cached, since without `serverURL` its URLs come from the request
+    {
+        headers: {
+            'Access-Control-Allow-Origin': '*',
+            'Cache-Control': 'no-store'
+        }
+    });
+const register = async (req)=>{
+    const { client_name, redirect_uris } = await req.json().catch(()=>({}));
+    if (!Array.isArray(redirect_uris) || !redirect_uris.length || !redirect_uris.every((uri)=>typeof uri === 'string' && URL.canParse(uri) && !uri.includes('#'))) {
+        return Response.json({
+            error: OAuthErrorCode.InvalidRedirectUri
+        }, {
+            status: 400
+        });
+    }
+    const client = {
+        name: typeof client_name === 'string' ? client_name : 'An MCP client',
+        redirectURIs: redirect_uris
+    };
+    return Response.json({
+        client_id: seal({
+            type: 'client',
+            data: client,
+            req
+        }),
+        client_name: client.name,
+        grant_types: [
+            'authorization_code',
+            'refresh_token'
+        ],
+        redirect_uris: client.redirectURIs,
+        response_types: [
+            'code'
+        ],
+        token_endpoint_auth_method: 'none'
+    }, {
+        status: 201
+    });
+};
+const authorize = (req)=>{
+    const url = new URL(req.url);
+    const params = url.searchParams;
+    const clientID = params.get('client_id');
+    const client = unseal({
+        type: 'client',
+        req,
+        value: clientID
+    });
+    const redirectURI = params.get('redirect_uri');
+    // Never redirect to an address the client didn't register
+    if (!client || !redirectURI || !client.redirectURIs.includes(redirectURI)) {
+        return page({
+            content: '<p>Start the sign-in again from your MCP client.</p>',
+            status: 400,
+            title: 'This sign-in link is invalid'
+        });
+    }
+    const state = params.get('state');
+    const codeChallenge = params.get('code_challenge');
+    if (params.get('response_type') !== 'code' || params.get('code_challenge_method') !== 'S256' || !codeChallenge) {
+        return redirect({
+            params: {
+                error: OAuthErrorCode.InvalidRequest,
+                state
+            },
+            redirectURI
+        });
+    }
+    const user = getBrowserUser(req);
+    if (!user) {
+        const loginURL = formatAdminURL({
+            adminRoute: req.payload.config.routes.admin,
+            path: '/login'
+        });
+        return new Response(null, {
+            headers: {
+                Location: `${loginURL}?redirect=${encodeURIComponent(url.pathname + url.search)}`
+            },
+            status: 302
+        });
+    }
+    const consent = {
+        clientID: clientID,
+        codeChallenge,
+        collection: user.collection,
+        redirectURI,
+        state,
+        userID: user.id
+    };
+    return page({
+        content: `<p>It will be able to use this app's MCP tools as ${escapeHTML(String(user.email ?? user.id))}, and you will return to ${escapeHTML(new URL(redirectURI).host || redirectURI)}.</p>
+<form method="post">
+<input name="consent" type="hidden" value="${seal({
+            type: 'consent',
+            data: consent,
+            expiresIn: 20 * 60 * 60,
+            req
+        })}">
+<button name="decision" type="submit" value="allow">Allow</button>
+<button name="decision" type="submit" value="deny">Deny</button>
+</form>`,
+        status: 200,
+        title: `Allow ${client.name} to use your account?`
+    });
+};
+const approve = async (req)=>{
+    const form = new URLSearchParams(await req.text());
+    const consent = unseal({
+        type: 'consent',
+        req,
+        value: form.get('consent')
+    });
+    const user = getBrowserUser(req);
+    // The form is only valid for the user it was shown to
+    if (!consent || user?.id !== consent.userID || user.collection !== consent.collection) {
+        return page({
+            content: '<p>Start the sign-in again from your MCP client.</p>',
+            status: 400,
+            title: 'This sign-in request expired'
+        });
+    }
+    const { clientID, codeChallenge, redirectURI, state } = consent;
+    if (form.get('decision') !== 'allow') {
+        return redirect({
+            params: {
+                error: OAuthErrorCode.AccessDenied,
+                state
+            },
+            redirectURI
+        });
+    }
+    const code = {
+        clientID,
+        codeChallenge,
+        redirectURI,
+        tokens: await getTokenHooks(req).issueToken({
+            req
+        })
+    };
+    return redirect({
+        params: {
+            code: seal({
+                type: 'code',
+                data: code,
+                expiresIn: 60,
+                req
+            }),
+            state
+        },
+        redirectURI
+    });
+};
+const token = async (req)=>{
+    const form = new URLSearchParams(await req.text());
+    const clientID = form.get('client_id');
+    const tokens = clientID && (form.get('grant_type') === 'refresh_token' ? await refresh({
+        clientID,
+        form,
+        req
+    }) : redeemCode({
+        clientID,
+        form,
+        req
+    }));
+    if (!clientID || !tokens) {
+        return Response.json({
+            error: OAuthErrorCode.InvalidGrant
+        }, {
+            status: 400
+        });
+    }
+    return Response.json({
+        access_token: tokens.accessToken,
+        expires_in: tokens.expiresIn,
+        refresh_token: tokens.refreshToken && seal({
+            type: 'refresh',
+            data: {
+                clientID,
+                refreshToken: tokens.refreshToken
+            },
+            req
+        }),
+        token_type: 'Bearer'
+    }, {
+        headers: {
+            'Cache-Control': 'no-store'
+        }
+    });
+};
+const redeemCode = ({ clientID, form, req })=>{
+    const code = unseal({
+        type: 'code',
+        req,
+        value: form.get('code')
+    });
+    if (form.get('grant_type') === 'authorization_code' && code?.clientID === clientID && code.redirectURI === form.get('redirect_uri') && // PKCE: only the client that started the sign-in knows the verifier
+    createHash('sha256').update(form.get('code_verifier') ?? '').digest('base64url') === code.codeChallenge) {
+        return code.tokens;
+    }
+};
+const refresh = async ({ clientID, form, req })=>{
+    const refreshToken = unseal({
+        type: 'refresh',
+        req,
+        value: form.get('refresh_token')
+    });
+    // Only the client a refresh token was issued to can use it
+    if (refreshToken?.clientID === clientID) {
+        return await getTokenHooks(req).refreshToken?.({
+            refreshToken: refreshToken.refreshToken,
+            req
+        });
+    }
+};
+/** `issueToken` and `refreshToken`, or the defaults for Payload login tokens. */ const getTokenHooks = (req)=>{
+    const oauth = getPluginConfig({
+        config: req.payload.config
+    }).oauth;
+    return oauth.issueToken ? {
+        issueToken: oauth.issueToken,
+        refreshToken: oauth.refreshToken
+    } : {
+        issueToken: issueLoginToken,
+        refreshToken: refreshLoginToken
+    };
+};
+const redirect = ({ params, redirectURI })=>{
+    const location = new URL(redirectURI);
+    for (const [key, value] of Object.entries(params)){
+        if (value) {
+            location.searchParams.set(key, value);
+        }
+    }
+    return new Response(null, {
+        headers: {
+            Location: location.href
+        },
+        status: 302
+    });
+};
+const page = ({ content, status, title })=>new Response(`<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${escapeHTML(title)}</title>
+<style>
+body { font-family: system-ui, sans-serif; margin: 4rem auto; max-width: 32rem; overflow-wrap: anywhere; padding: 0 1rem }
+button { font: inherit; margin-inline-end: 0.5rem; padding: 0.5rem 1rem }
+</style>
+</head>
+<body><h1>${escapeHTML(title)}</h1>${content}</body>
+</html>`, {
+        headers: {
+            // Stop other sites from framing the page to trick users into clicking Allow
+            'Content-Security-Policy': "frame-ancestors 'none'",
+            'Content-Type': 'text/html; charset=utf-8'
+        },
+        status
+    });
+const escapeHTML = (value)=>value.replace(/[&<>"']/g, (character)=>`&#${character.charCodeAt(0)};`);
+
+//# sourceMappingURL=oauthServer.js.map

package/dist/endpoint/oauthServer.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/endpoint/oauthServer.ts"],"sourcesContent":["import type {\n  OAuthClientInformationFull,\n  OAuthTokens,\n  OpenIdProviderDiscoveryMetadata,\n} from '@modelcontextprotocol/server'\nimport type { Endpoint, PayloadHandler, PayloadRequest } from 'payload'\n\nimport { OAuthErrorCode } from '@modelcontextprotocol/server'\nimport { createHash } from 'crypto'\nimport { formatAdminURL } from 'payload/shared'\n\nimport type { MCPBuiltinOAuthConfig, MCPOAuthTokens } from '../types.js'\n\nimport { getPluginConfig } from '../utils/getPluginConfig.js'\nimport { seal, unseal } from '../utils/seal.js'\nimport { getMCPURL } from './oauth.js'\nimport { issueLoginToken, refreshLoginToken } from './oauthLoginToken.js'\n\ntype Client = { name: string; redirectURIs: string[] }\n\ntype Consent = {\n  clientID: string\n  codeChallenge: string\n  collection: string\n  redirectURI: string\n  state: null | string\n  userID: number | string\n}\n\ntype Code = {\n  clientID: string\n  codeChallenge: string\n  redirectURI: string\n  tokens: MCPOAuthTokens\n}\n\ntype RefreshToken = {\n  clientID: string\n  refreshToken: string\n}\n\n/**\n * Turns Payload into the OAuth authorization server for MCP clients when `oauth.type` is\n * `'builtin'`. Clients register, the user allows them after logging in to the admin panel, and\n * the client receives the tokens `issueToken` creates.\n *\n * Clients, consent forms, authorization codes, and refresh tokens are encrypted and handed to the\n * client instead of being stored. Only the default tokens write to the database, to the user's\n * login sessions.\n */\nexport const oauthServerEndpoints: Endpoint[] = [\n  {\n    disableAuth: true,\n    handler: (req) => withIssuer(req, (issuer) => metadataResponse(issuer)),\n    method: 'get',\n    // OpenID discovery is the only metadata location MCP clients check below the issuer's path,\n    // which lets this work under /api without a route at the site root\n    path: '/mcp/oauth/.well-known/openid-configuration',\n  },\n  {\n    disableAuth: true,\n    handler: (req) => withIssuer(req, () => Response.json({ keys: [] })),\n    method: 'get',\n    path: '/mcp/oauth/jwks',\n  },\n  {\n    disableAuth: true,\n    handler: (req) => withIssuer(req, () => register(req)),\n    method: 'post',\n    path: '/mcp/oauth/register',\n  },\n  {\n    handler: (req) => withIssuer(req, () => authorize(req)),\n    method: 'get',\n    path: '/mcp/oauth/authorize',\n  },\n  {\n    handler: (req) => withIssuer(req, () => approve(req)),\n    method: 'post',\n    path: '/mcp/oauth/authorize',\n  },\n  {\n    disableAuth: true,\n    handler: (req) => withIssuer(req, () => token(req)),\n    method: 'post',\n    path: '/mcp/oauth/token',\n  },\n]\n\n/** The authorization server URL, or `undefined` when Payload isn't the authorization server. */\nconst getIssuer = (req: PayloadRequest): string | undefined =>\n  getPluginConfig({ config: req.payload.config }).oauth?.type === 'builtin'\n    ? `${getMCPURL({ config: req.payload.config, url: req.url! })}/oauth`\n    : undefined\n\nconst withIssuer = (\n  req: PayloadRequest,\n  handler: (issuer: string) => Promise<Response> | Response,\n): Promise<Response> | Response => {\n  const issuer = getIssuer(req)\n  return issuer ? handler(issuer) : new Response(null, { status: 404 })\n}\n\n/**\n * The user logged in to this browser, who can allow MCP clients. Tokens and API keys in the\n * `Authorization` header can't, or an MCP client could use its access token to approve itself a\n * new, separate login.\n */\nconst getBrowserUser = (req: PayloadRequest): PayloadRequest['user'] =>\n  req.headers.has('Authorization') ? null : req.user\n\nconst metadataResponse = (issuer: string): Response =>\n  Response.json(\n    {\n      authorization_endpoint: `${issuer}/authorize`,\n      code_challenge_methods_supported: ['S256'],\n      grant_types_supported: ['authorization_code', 'refresh_token'],\n      // Required by OpenID discovery. No ID tokens are issued.\n      id_token_signing_alg_values_supported: ['RS256'],\n      issuer,\n      jwks_uri: `${issuer}/jwks`,\n      registration_endpoint: `${issuer}/register`,\n      response_types_supported: ['code'],\n      subject_types_supported: ['public'],\n      token_endpoint: `${issuer}/token`,\n      token_endpoint_auth_methods_supported: ['none'],\n    } satisfies OpenIdProviderDiscoveryMetadata,\n    // Not cached, since without `serverURL` its URLs come from the request\n    { headers: { 'Access-Control-Allow-Origin': '*', 'Cache-Control': 'no-store' } },\n  )\n\nconst register: PayloadHandler = async (req) => {\n  const { client_name, redirect_uris } = await req.json!().catch(() => ({}))\n\n  if (\n    !Array.isArray(redirect_uris) ||\n    !redirect_uris.length ||\n    !redirect_uris.every(\n      (uri) => typeof uri === 'string' && URL.canParse(uri) && !uri.includes('#'),\n    )\n  ) {\n    return Response.json({ error: OAuthErrorCode.InvalidRedirectUri }, { status: 400 })\n  }\n\n  const client: Client = {\n    name: typeof client_name === 'string' ? client_name : 'An MCP client',\n    redirectURIs: redirect_uris,\n  }\n\n  return Response.json(\n    {\n      client_id: seal({ type: 'client', data: client, req }),\n      client_name: client.name,\n      grant_types: ['authorization_code', 'refresh_token'],\n      redirect_uris: client.redirectURIs,\n      response_types: ['code'],\n      token_endpoint_auth_method: 'none',\n    } satisfies OAuthClientInformationFull,\n    { status: 201 },\n  )\n}\n\nconst authorize: PayloadHandler = (req) => {\n  const url = new URL(req.url!)\n  const params = url.searchParams\n  const clientID = params.get('client_id')\n  const client = unseal<Client>({ type: 'client', req, value: clientID })\n  const redirectURI = params.get('redirect_uri')\n\n  // Never redirect to an address the client didn't register\n  if (!client || !redirectURI || !client.redirectURIs.includes(redirectURI)) {\n    return page({\n      content: '<p>Start the sign-in again from your MCP client.</p>',\n      status: 400,\n      title: 'This sign-in link is invalid',\n    })\n  }\n\n  const state = params.get('state')\n  const codeChallenge = params.get('code_challenge')\n\n  if (\n    params.get('response_type') !== 'code' ||\n    params.get('code_challenge_method') !== 'S256' ||\n    !codeChallenge\n  ) {\n    return redirect({ params: { error: OAuthErrorCode.InvalidRequest, state }, redirectURI })\n  }\n\n  const user = getBrowserUser(req)\n\n  if (!user) {\n    const loginURL = formatAdminURL({ adminRoute: req.payload.config.routes.admin, path: '/login' })\n\n    return new Response(null, {\n      headers: {\n        Location: `${loginURL}?redirect=${encodeURIComponent(url.pathname + url.search)}`,\n      },\n      status: 302,\n    })\n  }\n\n  const consent: Consent = {\n    clientID: clientID!,\n    codeChallenge,\n    collection: user.collection,\n    redirectURI,\n    state,\n    userID: user.id,\n  }\n\n  return page({\n    content: `<p>It will be able to use this app's MCP tools as ${escapeHTML(String(user.email ?? user.id))}, and you will return to ${escapeHTML(new URL(redirectURI).host || redirectURI)}.</p>\n<form method=\"post\">\n<input name=\"consent\" type=\"hidden\" value=\"${seal({ type: 'consent', data: consent, expiresIn: 20 * 60 * 60, req })}\">\n<button name=\"decision\" type=\"submit\" value=\"allow\">Allow</button>\n<button name=\"decision\" type=\"submit\" value=\"deny\">Deny</button>\n</form>`,\n    status: 200,\n    title: `Allow ${client.name} to use your account?`,\n  })\n}\n\nconst approve: PayloadHandler = async (req) => {\n  const form = new URLSearchParams(await req.text!())\n  const consent = unseal<Consent>({ type: 'consent', req, value: form.get('consent') })\n  const user = getBrowserUser(req)\n\n  // The form is only valid for the user it was shown to\n  if (!consent || user?.id !== consent.userID || user.collection !== consent.collection) {\n    return page({\n      content: '<p>Start the sign-in again from your MCP client.</p>',\n      status: 400,\n      title: 'This sign-in request expired',\n    })\n  }\n\n  const { clientID, codeChallenge, redirectURI, state } = consent\n\n  if (form.get('decision') !== 'allow') {\n    return redirect({ params: { error: OAuthErrorCode.AccessDenied, state }, redirectURI })\n  }\n\n  const code: Code = {\n    clientID,\n    codeChallenge,\n    redirectURI,\n    tokens: await getTokenHooks(req).issueToken({ req }),\n  }\n\n  return redirect({\n    params: { code: seal({ type: 'code', data: code, expiresIn: 60, req }), state },\n    redirectURI,\n  })\n}\n\nconst token: PayloadHandler = async (req) => {\n  const form = new URLSearchParams(await req.text!())\n  const clientID = form.get('client_id')\n  const tokens =\n    clientID &&\n    (form.get('grant_type') === 'refresh_token'\n      ? await refresh({ clientID, form, req })\n      : redeemCode({ clientID, form, req }))\n\n  if (!clientID || !tokens) {\n    return Response.json({ error: OAuthErrorCode.InvalidGrant }, { status: 400 })\n  }\n\n  return Response.json(\n    {\n      access_token: tokens.accessToken,\n      expires_in: tokens.expiresIn,\n      refresh_token:\n        tokens.refreshToken &&\n        seal({\n          type: 'refresh',\n          data: { clientID, refreshToken: tokens.refreshToken } satisfies RefreshToken,\n          req,\n        }),\n      token_type: 'Bearer',\n    } satisfies OAuthTokens,\n    { headers: { 'Cache-Control': 'no-store' } },\n  )\n}\n\nconst redeemCode = ({\n  clientID,\n  form,\n  req,\n}: {\n  clientID: string\n  form: URLSearchParams\n  req: PayloadRequest\n}): MCPOAuthTokens | undefined => {\n  const code = unseal<Code>({ type: 'code', req, value: form.get('code') })\n\n  if (\n    form.get('grant_type') === 'authorization_code' &&\n    code?.clientID === clientID &&\n    code.redirectURI === form.get('redirect_uri') &&\n    // PKCE: only the client that started the sign-in knows the verifier\n    createHash('sha256')\n      .update(form.get('code_verifier') ?? '')\n      .digest('base64url') === code.codeChallenge\n  ) {\n    return code.tokens\n  }\n}\n\nconst refresh = async ({\n  clientID,\n  form,\n  req,\n}: {\n  clientID: string\n  form: URLSearchParams\n  req: PayloadRequest\n}): Promise<MCPOAuthTokens | null | undefined> => {\n  const refreshToken = unseal<RefreshToken>({\n    type: 'refresh',\n    req,\n    value: form.get('refresh_token'),\n  })\n\n  // Only the client a refresh token was issued to can use it\n  if (refreshToken?.clientID === clientID) {\n    return await getTokenHooks(req).refreshToken?.({\n      refreshToken: refreshToken.refreshToken,\n      req,\n    })\n  }\n}\n\n/** `issueToken` and `refreshToken`, or the defaults for Payload login tokens. */\nconst getTokenHooks = (req: PayloadRequest) => {\n  const oauth = getPluginConfig({ config: req.payload.config }).oauth as MCPBuiltinOAuthConfig\n\n  return oauth.issueToken\n    ? { issueToken: oauth.issueToken, refreshToken: oauth.refreshToken }\n    : { issueToken: issueLoginToken, refreshToken: refreshLoginToken }\n}\n\nconst redirect = ({\n  params,\n  redirectURI,\n}: {\n  params: Record<string, null | string>\n  redirectURI: string\n}): Response => {\n  const location = new URL(redirectURI)\n\n  for (const [key, value] of Object.entries(params)) {\n    if (value) {\n      location.searchParams.set(key, value)\n    }\n  }\n\n  return new Response(null, { headers: { Location: location.href }, status: 302 })\n}\n\nconst page = ({\n  content,\n  status,\n  title,\n}: {\n  content: string\n  status: number\n  title: string\n}): Response =>\n  new Response(\n    `<!doctype html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>${escapeHTML(title)}</title>\n<style>\nbody { font-family: system-ui, sans-serif; margin: 4rem auto; max-width: 32rem; overflow-wrap: anywhere; padding: 0 1rem }\nbutton { font: inherit; margin-inline-end: 0.5rem; padding: 0.5rem 1rem }\n</style>\n</head>\n<body><h1>${escapeHTML(title)}</h1>${content}</body>\n</html>`,\n    {\n      headers: {\n        // Stop other sites from framing the page to trick users into clicking Allow\n        'Content-Security-Policy': \"frame-ancestors 'none'\",\n        'Content-Type': 'text/html; charset=utf-8',\n      },\n      status,\n    },\n  )\n\nconst escapeHTML = (value: string): string =>\n  value.replace(/[&<>\"']/g, (character) => `&#${character.charCodeAt(0)};`)\n"],"names":["OAuthErrorCode","createHash","formatAdminURL","getPluginConfig","seal","unseal","getMCPURL","issueLoginToken","refreshLoginToken","oauthServerEndpoints","disableAuth","handler","req","withIssuer","issuer","metadataResponse","method","path","Response","json","keys","register","authorize","approve","token","getIssuer","config","payload","oauth","type","url","undefined","status","getBrowserUser","headers","has","user","authorization_endpoint","code_challenge_methods_supported","grant_types_supported","id_token_signing_alg_values_supported","jwks_uri","registration_endpoint","response_types_supported","subject_types_supported","token_endpoint","token_endpoint_auth_methods_supported","client_name","redirect_uris","catch","Array","isArray","length","every","uri","URL","canParse","includes","error","InvalidRedirectUri","client","name","redirectURIs","client_id","data","grant_types","response_types","token_endpoint_auth_method","params","searchParams","clientID","get","value","redirectURI","page","content","title","state","codeChallenge","redirect","InvalidRequest","loginURL","adminRoute","routes","admin","Location","encodeURIComponent","pathname","search","consent","collection","userID","id","escapeHTML","String","email","host","expiresIn","form","URLSearchParams","text","AccessDenied","code","tokens","getTokenHooks","issueToken","refresh","redeemCode","InvalidGrant","access_token","accessToken","expires_in","refresh_token","refreshToken","token_type","update","digest","location","key","Object","entries","set","href","replace","character","charCodeAt"],"mappings":"AAOA,SAASA,cAAc,QAAQ,+BAA8B;AAC7D,SAASC,UAAU,QAAQ,SAAQ;AACnC,SAASC,cAAc,QAAQ,iBAAgB;AAI/C,SAASC,eAAe,QAAQ,8BAA6B;AAC7D,SAASC,IAAI,EAAEC,MAAM,QAAQ,mBAAkB;AAC/C,SAASC,SAAS,QAAQ,aAAY;AACtC,SAASC,eAAe,EAAEC,iBAAiB,QAAQ,uBAAsB;AAyBzE;;;;;;;;CAQC,GACD,OAAO,MAAMC,uBAAmC;IAC9C;QACEC,aAAa;QACbC,SAAS,CAACC,MAAQC,WAAWD,KAAK,CAACE,SAAWC,iBAAiBD;QAC/DE,QAAQ;QACR,4FAA4F;QAC5F,mEAAmE;QACnEC,MAAM;IACR;IACA;QACEP,aAAa;QACbC,SAAS,CAACC,MAAQC,WAAWD,KAAK,IAAMM,SAASC,IAAI,CAAC;oBAAEC,MAAM,EAAE;gBAAC;QACjEJ,QAAQ;QACRC,MAAM;IACR;IACA;QACEP,aAAa;QACbC,SAAS,CAACC,MAAQC,WAAWD,KAAK,IAAMS,SAAST;QACjDI,QAAQ;QACRC,MAAM;IACR;IACA;QACEN,SAAS,CAACC,MAAQC,WAAWD,KAAK,IAAMU,UAAUV;QAClDI,QAAQ;QACRC,MAAM;IACR;IACA;QACEN,SAAS,CAACC,MAAQC,WAAWD,KAAK,IAAMW,QAAQX;QAChDI,QAAQ;QACRC,MAAM;IACR;IACA;QACEP,aAAa;QACbC,SAAS,CAACC,MAAQC,WAAWD,KAAK,IAAMY,MAAMZ;QAC9CI,QAAQ;QACRC,MAAM;IACR;CACD,CAAA;AAED,8FAA8F,GAC9F,MAAMQ,YAAY,CAACb,MACjBT,gBAAgB;QAAEuB,QAAQd,IAAIe,OAAO,CAACD,MAAM;IAAC,GAAGE,KAAK,EAAEC,SAAS,YAC5D,GAAGvB,UAAU;QAAEoB,QAAQd,IAAIe,OAAO,CAACD,MAAM;QAAEI,KAAKlB,IAAIkB,GAAG;IAAE,GAAG,MAAM,CAAC,GACnEC;AAEN,MAAMlB,aAAa,CACjBD,KACAD;IAEA,MAAMG,SAASW,UAAUb;IACzB,OAAOE,SAASH,QAAQG,UAAU,IAAII,SAAS,MAAM;QAAEc,QAAQ;IAAI;AACrE;AAEA;;;;CAIC,GACD,MAAMC,iBAAiB,CAACrB,MACtBA,IAAIsB,OAAO,CAACC,GAAG,CAAC,mBAAmB,OAAOvB,IAAIwB,IAAI;AAEpD,MAAMrB,mBAAmB,CAACD,SACxBI,SAASC,IAAI,CACX;QACEkB,wBAAwB,GAAGvB,OAAO,UAAU,CAAC;QAC7CwB,kCAAkC;YAAC;SAAO;QAC1CC,uBAAuB;YAAC;YAAsB;SAAgB;QAC9D,yDAAyD;QACzDC,uCAAuC;YAAC;SAAQ;QAChD1B;QACA2B,UAAU,GAAG3B,OAAO,KAAK,CAAC;QAC1B4B,uBAAuB,GAAG5B,OAAO,SAAS,CAAC;QAC3C6B,0BAA0B;YAAC;SAAO;QAClCC,yBAAyB;YAAC;SAAS;QACnCC,gBAAgB,GAAG/B,OAAO,MAAM,CAAC;QACjCgC,uCAAuC;YAAC;SAAO;IACjD,GACA,uEAAuE;IACvE;QAAEZ,SAAS;YAAE,+BAA+B;YAAK,iBAAiB;QAAW;IAAE;AAGnF,MAAMb,WAA2B,OAAOT;IACtC,MAAM,EAAEmC,WAAW,EAAEC,aAAa,EAAE,GAAG,MAAMpC,IAAIO,IAAI,GAAI8B,KAAK,CAAC,IAAO,CAAA,CAAC,CAAA;IAEvE,IACE,CAACC,MAAMC,OAAO,CAACH,kBACf,CAACA,cAAcI,MAAM,IACrB,CAACJ,cAAcK,KAAK,CAClB,CAACC,MAAQ,OAAOA,QAAQ,YAAYC,IAAIC,QAAQ,CAACF,QAAQ,CAACA,IAAIG,QAAQ,CAAC,OAEzE;QACA,OAAOvC,SAASC,IAAI,CAAC;YAAEuC,OAAO1D,eAAe2D,kBAAkB;QAAC,GAAG;YAAE3B,QAAQ;QAAI;IACnF;IAEA,MAAM4B,SAAiB;QACrBC,MAAM,OAAOd,gBAAgB,WAAWA,cAAc;QACtDe,cAAcd;IAChB;IAEA,OAAO9B,SAASC,IAAI,CAClB;QACE4C,WAAW3D,KAAK;YAAEyB,MAAM;YAAUmC,MAAMJ;YAAQhD;QAAI;QACpDmC,aAAaa,OAAOC,IAAI;QACxBI,aAAa;YAAC;YAAsB;SAAgB;QACpDjB,eAAeY,OAAOE,YAAY;QAClCI,gBAAgB;YAAC;SAAO;QACxBC,4BAA4B;IAC9B,GACA;QAAEnC,QAAQ;IAAI;AAElB;AAEA,MAAMV,YAA4B,CAACV;IACjC,MAAMkB,MAAM,IAAIyB,IAAI3C,IAAIkB,GAAG;IAC3B,MAAMsC,SAAStC,IAAIuC,YAAY;IAC/B,MAAMC,WAAWF,OAAOG,GAAG,CAAC;IAC5B,MAAMX,SAASvD,OAAe;QAAEwB,MAAM;QAAUjB;QAAK4D,OAAOF;IAAS;IACrE,MAAMG,cAAcL,OAAOG,GAAG,CAAC;IAE/B,0DAA0D;IAC1D,IAAI,CAACX,UAAU,CAACa,eAAe,CAACb,OAAOE,YAAY,CAACL,QAAQ,CAACgB,cAAc;QACzE,OAAOC,KAAK;YACVC,SAAS;YACT3C,QAAQ;YACR4C,OAAO;QACT;IACF;IAEA,MAAMC,QAAQT,OAAOG,GAAG,CAAC;IACzB,MAAMO,gBAAgBV,OAAOG,GAAG,CAAC;IAEjC,IACEH,OAAOG,GAAG,CAAC,qBAAqB,UAChCH,OAAOG,GAAG,CAAC,6BAA6B,UACxC,CAACO,eACD;QACA,OAAOC,SAAS;YAAEX,QAAQ;gBAAEV,OAAO1D,eAAegF,cAAc;gBAAEH;YAAM;YAAGJ;QAAY;IACzF;IAEA,MAAMrC,OAAOH,eAAerB;IAE5B,IAAI,CAACwB,MAAM;QACT,MAAM6C,WAAW/E,eAAe;YAAEgF,YAAYtE,IAAIe,OAAO,CAACD,MAAM,CAACyD,MAAM,CAACC,KAAK;YAAEnE,MAAM;QAAS;QAE9F,OAAO,IAAIC,SAAS,MAAM;YACxBgB,SAAS;gBACPmD,UAAU,GAAGJ,SAAS,UAAU,EAAEK,mBAAmBxD,IAAIyD,QAAQ,GAAGzD,IAAI0D,MAAM,GAAG;YACnF;YACAxD,QAAQ;QACV;IACF;IAEA,MAAMyD,UAAmB;QACvBnB,UAAUA;QACVQ;QACAY,YAAYtD,KAAKsD,UAAU;QAC3BjB;QACAI;QACAc,QAAQvD,KAAKwD,EAAE;IACjB;IAEA,OAAOlB,KAAK;QACVC,SAAS,CAAC,kDAAkD,EAAEkB,WAAWC,OAAO1D,KAAK2D,KAAK,IAAI3D,KAAKwD,EAAE,GAAG,yBAAyB,EAAEC,WAAW,IAAItC,IAAIkB,aAAauB,IAAI,IAAIvB,aAAa;;2CAEjJ,EAAErE,KAAK;YAAEyB,MAAM;YAAWmC,MAAMyB;YAASQ,WAAW,KAAK,KAAK;YAAIrF;QAAI,GAAG;;;OAG7G,CAAC;QACJoB,QAAQ;QACR4C,OAAO,CAAC,MAAM,EAAEhB,OAAOC,IAAI,CAAC,qBAAqB,CAAC;IACpD;AACF;AAEA,MAAMtC,UAA0B,OAAOX;IACrC,MAAMsF,OAAO,IAAIC,gBAAgB,MAAMvF,IAAIwF,IAAI;IAC/C,MAAMX,UAAUpF,OAAgB;QAAEwB,MAAM;QAAWjB;QAAK4D,OAAO0B,KAAK3B,GAAG,CAAC;IAAW;IACnF,MAAMnC,OAAOH,eAAerB;IAE5B,sDAAsD;IACtD,IAAI,CAAC6E,WAAWrD,MAAMwD,OAAOH,QAAQE,MAAM,IAAIvD,KAAKsD,UAAU,KAAKD,QAAQC,UAAU,EAAE;QACrF,OAAOhB,KAAK;YACVC,SAAS;YACT3C,QAAQ;YACR4C,OAAO;QACT;IACF;IAEA,MAAM,EAAEN,QAAQ,EAAEQ,aAAa,EAAEL,WAAW,EAAEI,KAAK,EAAE,GAAGY;IAExD,IAAIS,KAAK3B,GAAG,CAAC,gBAAgB,SAAS;QACpC,OAAOQ,SAAS;YAAEX,QAAQ;gBAAEV,OAAO1D,eAAeqG,YAAY;gBAAExB;YAAM;YAAGJ;QAAY;IACvF;IAEA,MAAM6B,OAAa;QACjBhC;QACAQ;QACAL;QACA8B,QAAQ,MAAMC,cAAc5F,KAAK6F,UAAU,CAAC;YAAE7F;QAAI;IACpD;IAEA,OAAOmE,SAAS;QACdX,QAAQ;YAAEkC,MAAMlG,KAAK;gBAAEyB,MAAM;gBAAQmC,MAAMsC;gBAAML,WAAW;gBAAIrF;YAAI;YAAIiE;QAAM;QAC9EJ;IACF;AACF;AAEA,MAAMjD,QAAwB,OAAOZ;IACnC,MAAMsF,OAAO,IAAIC,gBAAgB,MAAMvF,IAAIwF,IAAI;IAC/C,MAAM9B,WAAW4B,KAAK3B,GAAG,CAAC;IAC1B,MAAMgC,SACJjC,YACC4B,CAAAA,KAAK3B,GAAG,CAAC,kBAAkB,kBACxB,MAAMmC,QAAQ;QAAEpC;QAAU4B;QAAMtF;IAAI,KACpC+F,WAAW;QAAErC;QAAU4B;QAAMtF;IAAI,EAAC;IAExC,IAAI,CAAC0D,YAAY,CAACiC,QAAQ;QACxB,OAAOrF,SAASC,IAAI,CAAC;YAAEuC,OAAO1D,eAAe4G,YAAY;QAAC,GAAG;YAAE5E,QAAQ;QAAI;IAC7E;IAEA,OAAOd,SAASC,IAAI,CAClB;QACE0F,cAAcN,OAAOO,WAAW;QAChCC,YAAYR,OAAON,SAAS;QAC5Be,eACET,OAAOU,YAAY,IACnB7G,KAAK;YACHyB,MAAM;YACNmC,MAAM;gBAAEM;gBAAU2C,cAAcV,OAAOU,YAAY;YAAC;YACpDrG;QACF;QACFsG,YAAY;IACd,GACA;QAAEhF,SAAS;YAAE,iBAAiB;QAAW;IAAE;AAE/C;AAEA,MAAMyE,aAAa,CAAC,EAClBrC,QAAQ,EACR4B,IAAI,EACJtF,GAAG,EAKJ;IACC,MAAM0F,OAAOjG,OAAa;QAAEwB,MAAM;QAAQjB;QAAK4D,OAAO0B,KAAK3B,GAAG,CAAC;IAAQ;IAEvE,IACE2B,KAAK3B,GAAG,CAAC,kBAAkB,wBAC3B+B,MAAMhC,aAAaA,YACnBgC,KAAK7B,WAAW,KAAKyB,KAAK3B,GAAG,CAAC,mBAC9B,oEAAoE;IACpEtE,WAAW,UACRkH,MAAM,CAACjB,KAAK3B,GAAG,CAAC,oBAAoB,IACpC6C,MAAM,CAAC,iBAAiBd,KAAKxB,aAAa,EAC7C;QACA,OAAOwB,KAAKC,MAAM;IACpB;AACF;AAEA,MAAMG,UAAU,OAAO,EACrBpC,QAAQ,EACR4B,IAAI,EACJtF,GAAG,EAKJ;IACC,MAAMqG,eAAe5G,OAAqB;QACxCwB,MAAM;QACNjB;QACA4D,OAAO0B,KAAK3B,GAAG,CAAC;IAClB;IAEA,2DAA2D;IAC3D,IAAI0C,cAAc3C,aAAaA,UAAU;QACvC,OAAO,MAAMkC,cAAc5F,KAAKqG,YAAY,GAAG;YAC7CA,cAAcA,aAAaA,YAAY;YACvCrG;QACF;IACF;AACF;AAEA,+EAA+E,GAC/E,MAAM4F,gBAAgB,CAAC5F;IACrB,MAAMgB,QAAQzB,gBAAgB;QAAEuB,QAAQd,IAAIe,OAAO,CAACD,MAAM;IAAC,GAAGE,KAAK;IAEnE,OAAOA,MAAM6E,UAAU,GACnB;QAAEA,YAAY7E,MAAM6E,UAAU;QAAEQ,cAAcrF,MAAMqF,YAAY;IAAC,IACjE;QAAER,YAAYlG;QAAiB0G,cAAczG;IAAkB;AACrE;AAEA,MAAMuE,WAAW,CAAC,EAChBX,MAAM,EACNK,WAAW,EAIZ;IACC,MAAM4C,WAAW,IAAI9D,IAAIkB;IAEzB,KAAK,MAAM,CAAC6C,KAAK9C,MAAM,IAAI+C,OAAOC,OAAO,CAACpD,QAAS;QACjD,IAAII,OAAO;YACT6C,SAAShD,YAAY,CAACoD,GAAG,CAACH,KAAK9C;QACjC;IACF;IAEA,OAAO,IAAItD,SAAS,MAAM;QAAEgB,SAAS;YAAEmD,UAAUgC,SAASK,IAAI;QAAC;QAAG1F,QAAQ;IAAI;AAChF;AAEA,MAAM0C,OAAO,CAAC,EACZC,OAAO,EACP3C,MAAM,EACN4C,KAAK,EAKN,GACC,IAAI1D,SACF,CAAC;;;;;OAKE,EAAE2E,WAAWjB,OAAO;;;;;;UAMjB,EAAEiB,WAAWjB,OAAO,KAAK,EAAED,QAAQ;OACtC,CAAC,EACJ;QACEzC,SAAS;YACP,4EAA4E;YAC5E,2BAA2B;YAC3B,gBAAgB;QAClB;QACAF;IACF;AAGJ,MAAM6D,aAAa,CAACrB,QAClBA,MAAMmD,OAAO,CAAC,YAAY,CAACC,YAAc,CAAC,EAAE,EAAEA,UAAUC,UAAU,CAAC,GAAG,CAAC,CAAC"}

package/dist/exports/client.d.ts

@@ -1,2 +1,2 @@
-export { AccessField } from '../components/AccessField/index.client.js';
+export {};
 //# sourceMappingURL=client.d.ts.map