@platf/bridge 0.0.14 → 0.0.16

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/dist/lib/discoveryRoutes.js +70 -2
  2. package/dist/lib/discoveryRoutes.js.map +1 -1
  3. package/package.json +1 -1
  4. package/src/lib/discoveryRoutes.ts +73 -2
package/dist/lib/discoveryRoutes.js CHANGED
@@ -78,10 +78,15 @@ export function createDiscoveryRouter(auth, logger) {
78
78
  return res.status(502).json({ error: 'upstream_error' });
79
79
  }
80
80
  const metadata = (await upstream.json());
81
- // Patch registration_endpoint to point to our pseudo-DCR
81
+ // Patch all OAuth endpoints to point to our proxy
82
82
  const scheme = req.protocol;
83
83
  const host = req.get('host');
84
- metadata.registration_endpoint = `${scheme}://${host}/oauth/register`;
84
+ const bridgeOrigin = `${scheme}://${host}`;
85
+ metadata.issuer = bridgeOrigin;
86
+ metadata.authorization_endpoint = `${bridgeOrigin}/oauth/authorize`;
87
+ metadata.token_endpoint = `${bridgeOrigin}/oauth/token`;
88
+ metadata.registration_endpoint = `${bridgeOrigin}/oauth/register`;
89
+ metadata.jwks_uri = `${bridgeOrigin}/jwks`;
85
90
  res.json(metadata);
86
91
  }
87
92
  catch (err) {
@@ -109,6 +114,69 @@ export function createDiscoveryRouter(auth, logger) {
109
114
  redirect_uris: Array.isArray(body.redirect_uris) ? body.redirect_uris : [],
110
115
  });
111
116
  });
117
+ /**
118
+ * OAuth Authorization Endpoint — Redirect to upstream
119
+ *
120
+ * Since the bridge advertises itself as the authorization_server,
121
+ * clients will attempt to call /oauth/authorize here. We redirect
122
+ * to the upstream auth server, preserving all query parameters.
123
+ */
124
+ router.get('/oauth/authorize', (req, res) => {
125
+ const upstreamUrl = new URL(`${auth.issuer}/oauth/authorize`);
126
+ // Copy all query params to upstream
127
+ for (const [key, value] of Object.entries(req.query)) {
128
+ if (typeof value === 'string') {
129
+ upstreamUrl.searchParams.set(key, value);
130
+ }
131
+ }
132
+ logger.info(`[discovery] Redirecting /oauth/authorize to ${upstreamUrl.toString().slice(0, 100)}...`);
133
+ res.redirect(upstreamUrl.toString());
134
+ });
135
+ /**
136
+ * OAuth Token Endpoint — Proxy to upstream
137
+ *
138
+ * Proxies token exchange requests to the upstream auth server.
139
+ */
140
+ router.post('/oauth/token', async (req, res) => {
141
+ try {
142
+ const upstreamUrl = `${auth.issuer}/oauth/token`;
143
+ logger.info('[discovery] Proxying /oauth/token to upstream');
144
+ const upstreamRes = await fetch(upstreamUrl, {
145
+ method: 'POST',
146
+ headers: {
147
+ 'Content-Type': req.get('Content-Type') || 'application/x-www-form-urlencoded',
148
+ },
149
+ body: req.get('Content-Type')?.includes('application/json')
150
+ ? JSON.stringify(req.body)
151
+ : new URLSearchParams(req.body).toString(),
152
+ });
153
+ const data = await upstreamRes.text();
154
+ res.status(upstreamRes.status);
155
+ res.set('Content-Type', upstreamRes.headers.get('Content-Type') || 'application/json');
156
+ res.send(data);
157
+ }
158
+ catch (err) {
159
+ logger.error('[discovery] Error proxying /oauth/token:', err.message ?? err);
160
+ res.status(502).json({ error: 'upstream_error' });
161
+ }
162
+ });
163
+ /**
164
+ * JWKS Endpoint — Proxy to upstream
165
+ *
166
+ * Proxies JSON Web Key Set requests for token verification.
167
+ */
168
+ router.get('/jwks', async (req, res) => {
169
+ try {
170
+ const upstreamUrl = `${auth.issuer}/jwks`;
171
+ const upstreamRes = await fetch(upstreamUrl);
172
+ const data = await upstreamRes.json();
173
+ res.json(data);
174
+ }
175
+ catch (err) {
176
+ logger.error('[discovery] Error proxying /jwks:', err.message ?? err);
177
+ res.status(502).json({ error: 'upstream_error' });
178
+ }
179
+ });
112
180
  return router;
113
181
  }
114
182
  //# sourceMappingURL=discoveryRoutes.js.map
package/dist/lib/discoveryRoutes.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"discoveryRoutes.js","sourceRoot":"","sources":["../../src/lib/discoveryRoutes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,MAAM,EAA+B,MAAM,SAAS,CAAA;AAG7D,MAAM,UAAU,qBAAqB,CAAC,IAAgB,EAAE,MAAc;IACpE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAA;IAEvB;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,CAAC,GAAG,CAAC,uCAAuC,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAClF,wDAAwD;QACxD,+CAA+C;QAC/C,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAA;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC5B,MAAM,YAAY,GAAG,GAAG,MAAM,MAAM,IAAI,EAAE,CAAA;QAC1C,MAAM,gBAAgB,GAAG;YACvB,QAAQ,EAAE,GAAG,YAAY,MAAM;YAC/B,4DAA4D;YAC5D,qBAAqB,EAAE,CAAC,YAAY,CAAC;YACrC,gBAAgB,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;YAChD,wBAAwB,EAAE,CAAC,QAAQ,CAAC;SACrC,CAAA;QACD,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,yCAAyC,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACpF,oEAAoE;QACpE,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAA;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC5B,MAAM,YAAY,GAAG,GAAG,MAAM,MAAM,IAAI,EAAE,CAAA;QAC1C,MAAM,YAAY,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QACxC,MAAM,gBAAgB,GAAG;YACvB,QAAQ,EAAE,GAAG,YAAY,GAAG,YAAY,EAAE;YAC1C,4DAA4D;YAC5D,qBAAqB,EAAE,CAAC,YAAY,CAAC;YACrC,gBAAgB,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;YAChD,wBAAwB,EAAE,CAAC,QAAQ,CAAC;SACrC,CAAA;QACD,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF;;;;;;;OAOG;IACH,MAAM,CAAC,GAAG,CAAC,0CAA0C,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC3F,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,GAAG,IAAI,CAAC,MAAM,yCAAyC,CAAA;YAC3E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,CAAA;YAEzC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,CAAC,KAAK,CAAC,4CAA4C,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;gBAC3E,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAA;YAC1D,CAAC;YAED,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAA;YAEnE,yDAAyD;YACzD,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAA;YAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YAC5B,QAAQ,CAAC,qBAAqB,GAAG,GAAG,MAAM,MAAM,IAAI,iBAAiB,CAAA;YAErE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACpB,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,MAAM,CAAC,KAAK,CAAC,yCAAyC,EAAE,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,CAAA;YAC3E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAA;QACnD,CAAC;IACH,CAAC,CAAC,CAAA;IAEF;;;;;;;OAOG;IACH,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC7D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAA;QAC3B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,WAAW,EAAE,cAAc;YAC3B,8CAA8C;YAC9C,0BAA0B,EAAE,MAAM;YAClC,WAAW,EAAE,CAAC,oBAAoB,CAAC;YACnC,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE;SAC3E,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC"}
1
+ {"version":3,"file":"discoveryRoutes.js","sourceRoot":"","sources":["../../src/lib/discoveryRoutes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,MAAM,EAA+B,MAAM,SAAS,CAAA;AAG7D,MAAM,UAAU,qBAAqB,CAAC,IAAgB,EAAE,MAAc;IACpE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAA;IAEvB;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,CAAC,GAAG,CAAC,uCAAuC,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAClF,wDAAwD;QACxD,+CAA+C;QAC/C,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAA;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC5B,MAAM,YAAY,GAAG,GAAG,MAAM,MAAM,IAAI,EAAE,CAAA;QAC1C,MAAM,gBAAgB,GAAG;YACvB,QAAQ,EAAE,GAAG,YAAY,MAAM;YAC/B,4DAA4D;YAC5D,qBAAqB,EAAE,CAAC,YAAY,CAAC;YACrC,gBAAgB,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;YAChD,wBAAwB,EAAE,CAAC,QAAQ,CAAC;SACrC,CAAA;QACD,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,yCAAyC,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACpF,oEAAoE;QACpE,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAA;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC5B,MAAM,YAAY,GAAG,GAAG,MAAM,MAAM,IAAI,EAAE,CAAA;QAC1C,MAAM,YAAY,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QACxC,MAAM,gBAAgB,GAAG;YACvB,QAAQ,EAAE,GAAG,YAAY,GAAG,YAAY,EAAE;YAC1C,4DAA4D;YAC5D,qBAAqB,EAAE,CAAC,YAAY,CAAC;YACrC,gBAAgB,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;YAChD,wBAAwB,EAAE,CAAC,QAAQ,CAAC;SACrC,CAAA;QACD,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF;;;;;;;OAOG;IACH,MAAM,CAAC,GAAG,CAAC,0CAA0C,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC3F,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,GAAG,IAAI,CAAC,MAAM,yCAAyC,CAAA;YAC3E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,CAAA;YAEzC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,CAAC,KAAK,CAAC,4CAA4C,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;gBAC3E,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAA;YAC1D,CAAC;YAED,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAA;YAEnE,kDAAkD;YAClD,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAA;YAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YAC5B,MAAM,YAAY,GAAG,GAAG,MAAM,MAAM,IAAI,EAAE,CAAA;YAC1C,QAAQ,CAAC,MAAM,GAAG,YAAY,CAAA;YAC9B,QAAQ,CAAC,sBAAsB,GAAG,GAAG,YAAY,kBAAkB,CAAA;YACnE,QAAQ,CAAC,cAAc,GAAG,GAAG,YAAY,cAAc,CAAA;YACvD,QAAQ,CAAC,qBAAqB,GAAG,GAAG,YAAY,iBAAiB,CAAA;YACjE,QAAQ,CAAC,QAAQ,GAAG,GAAG,YAAY,OAAO,CAAA;YAE1C,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACpB,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,MAAM,CAAC,KAAK,CAAC,yCAAyC,EAAE,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,CAAA;YAC3E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAA;QACnD,CAAC;IACH,CAAC,CAAC,CAAA;IAEF;;;;;;;OAOG;IACH,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC7D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAA;QAC3B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,WAAW,EAAE,cAAc;YAC3B,8CAA8C;YAC9C,0BAA0B,EAAE,MAAM;YAClC,WAAW,EAAE,CAAC,oBAAoB,CAAC;YACnC,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE;SAC3E,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF;;;;;;OAMG;IACH,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC7D,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,kBAAkB,CAAC,CAAA;QAC7D,oCAAoC;QACpC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YAC1C,CAAC;QACH,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,+CAA+C,WAAW,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAA;QACrG,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAA;IACtC,CAAC,CAAC,CAAA;IAEF;;;;OAIG;IACH,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAChE,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,GAAG,IAAI,CAAC,MAAM,cAAc,CAAA;YAChD,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAA;YAE5D,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE;gBAC3C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,mCAAmC;iBAC/E;gBACD,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,kBAAkB,CAAC;oBACzD,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;oBAC1B,CAAC,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,IAA8B,CAAC,CAAC,QAAQ,EAAE;aACvE,CAAC,CAAA;YAEF,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAA;YACrC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;YAC9B,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,kBAAkB,CAAC,CAAA;YACtF,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChB,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,MAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,CAAA;YAC5E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAA;QACnD,CAAC;IACH,CAAC,CAAC,CAAA;IAEF;;;;OAIG;IACH,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACxD,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,GAAG,IAAI,CAAC,MAAM,OAAO,CAAA;YACzC,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,CAAA;YAC5C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAA;YACrC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChB,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,CAAA;YACrE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAA;QACnD,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@platf/bridge",
3
- "version": "0.0.14",
3
+ "version": "0.0.16",
4
4
  "description": "Stdio-to-Streamable HTTP bridge for MCP servers — Platf AI Hub",
5
5
  "module": "src/index.ts",
6
6
  "main": "dist/index.js",
package/src/lib/discoveryRoutes.ts CHANGED
@@ -87,10 +87,15 @@ export function createDiscoveryRouter(auth: AuthConfig, logger: Logger): Router
87
87
 
88
88
  const metadata = (await upstream.json()) as Record<string, unknown>
89
89
 
90
- // Patch registration_endpoint to point to our pseudo-DCR
90
+ // Patch all OAuth endpoints to point to our proxy
91
91
  const scheme = req.protocol
92
92
  const host = req.get('host')
93
- metadata.registration_endpoint = `${scheme}://${host}/oauth/register`
93
+ const bridgeOrigin = `${scheme}://${host}`
94
+ metadata.issuer = bridgeOrigin
95
+ metadata.authorization_endpoint = `${bridgeOrigin}/oauth/authorize`
96
+ metadata.token_endpoint = `${bridgeOrigin}/oauth/token`
97
+ metadata.registration_endpoint = `${bridgeOrigin}/oauth/register`
98
+ metadata.jwks_uri = `${bridgeOrigin}/jwks`
94
99
 
95
100
  res.json(metadata)
96
101
  } catch (err: any) {
@@ -120,5 +125,71 @@ export function createDiscoveryRouter(auth: AuthConfig, logger: Logger): Router
120
125
  })
121
126
  })
122
127
 
128
+ /**
129
+ * OAuth Authorization Endpoint — Redirect to upstream
130
+ *
131
+ * Since the bridge advertises itself as the authorization_server,
132
+ * clients will attempt to call /oauth/authorize here. We redirect
133
+ * to the upstream auth server, preserving all query parameters.
134
+ */
135
+ router.get('/oauth/authorize', (req: Request, res: Response) => {
136
+ const upstreamUrl = new URL(`${auth.issuer}/oauth/authorize`)
137
+ // Copy all query params to upstream
138
+ for (const [key, value] of Object.entries(req.query)) {
139
+ if (typeof value === 'string') {
140
+ upstreamUrl.searchParams.set(key, value)
141
+ }
142
+ }
143
+ logger.info(`[discovery] Redirecting /oauth/authorize to ${upstreamUrl.toString().slice(0, 100)}...`)
144
+ res.redirect(upstreamUrl.toString())
145
+ })
146
+
147
+ /**
148
+ * OAuth Token Endpoint — Proxy to upstream
149
+ *
150
+ * Proxies token exchange requests to the upstream auth server.
151
+ */
152
+ router.post('/oauth/token', async (req: Request, res: Response) => {
153
+ try {
154
+ const upstreamUrl = `${auth.issuer}/oauth/token`
155
+ logger.info('[discovery] Proxying /oauth/token to upstream')
156
+
157
+ const upstreamRes = await fetch(upstreamUrl, {
158
+ method: 'POST',
159
+ headers: {
160
+ 'Content-Type': req.get('Content-Type') || 'application/x-www-form-urlencoded',
161
+ },
162
+ body: req.get('Content-Type')?.includes('application/json')
163
+ ? JSON.stringify(req.body)
164
+ : new URLSearchParams(req.body as Record<string, string>).toString(),
165
+ })
166
+
167
+ const data = await upstreamRes.text()
168
+ res.status(upstreamRes.status)
169
+ res.set('Content-Type', upstreamRes.headers.get('Content-Type') || 'application/json')
170
+ res.send(data)
171
+ } catch (err: any) {
172
+ logger.error('[discovery] Error proxying /oauth/token:', err.message ?? err)
173
+ res.status(502).json({ error: 'upstream_error' })
174
+ }
175
+ })
176
+
177
+ /**
178
+ * JWKS Endpoint — Proxy to upstream
179
+ *
180
+ * Proxies JSON Web Key Set requests for token verification.
181
+ */
182
+ router.get('/jwks', async (req: Request, res: Response) => {
183
+ try {
184
+ const upstreamUrl = `${auth.issuer}/jwks`
185
+ const upstreamRes = await fetch(upstreamUrl)
186
+ const data = await upstreamRes.json()
187
+ res.json(data)
188
+ } catch (err: any) {
189
+ logger.error('[discovery] Error proxying /jwks:', err.message ?? err)
190
+ res.status(502).json({ error: 'upstream_error' })
191
+ }
192
+ })
193
+
123
194
  return router
124
195
  }