@plitzi/sdk-server 0.32.13 → 0.32.14

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @plitzi/sdk-server
 
+## 0.32.14
+
+### Patch Changes
+
+- v0.32.14
+- Updated dependencies
+  - @plitzi/plitzi-sdk@0.32.14
+  - @plitzi/sdk-schema@0.32.14
+  - @plitzi/sdk-shared@0.32.14
+
 ## 0.32.13
 
 ### Patch Changes

package/dist/core/services/oauth.js

@@ -69,20 +69,30 @@ var oauthStage = async (ctx) => {
 	sendErrorJson(res, 405, "invalid_request", `${method} is not allowed on ${path}.`);
 	return true;
 };
-/** Fail-closed on purpose: a credential this server cannot check right now — an unreachable store, an adapter that
-*  threw — is not one it may act on, and 401 is the answer a host can do something about (re-authorize) where a
-*  500 leaves it stuck. */
-var verified = async (check) => {
+var CHALLENGE_DESCRIPTIONS = {
+	"no-credential": "Authorization is required to use this server.",
+	"unknown-credential": "The access token is invalid, expired or revoked.",
+	"store-unreachable": "The access token could not be verified right now.",
+	"adapter-failed": "The access token could not be verified right now."
+};
+var challengeReason = async (oauth, ctx, token) => {
+	if (!token) return "no-credential";
 	try {
-		return await check();
+		const record = await getAccess(oauth.adapters.store, token);
+		if (record) {
+			const credential = record.credential ?? token;
+			ctx.req.headers["x-access-token"] = credential;
+			ctx.req.headers.authorization = `Bearer ${credential}`;
+			return;
+		}
 	} catch {
-		return false;
+		return "store-unreachable";
+	}
+	try {
+		return await ctx.config.adapters.getSpaceId?.(ctx.req) === void 0 ? "unknown-credential" : void 0;
+	} catch {
+		return "adapter-failed";
 	}
-};
-var isAuthorized = async (oauth, ctx, token) => {
-	if (await verified(async () => await getAccess(oauth.adapters.store, token) !== void 0)) return true;
-	const { adapters } = ctx.config;
-	return verified(async () => await adapters.getSpaceId?.(ctx.req) !== void 0);
 };
 /** The protected-resource half of OAuth: an MCP call that presents no bearer this server can verify is refused
 *  with RFC 6750's challenge instead of being served the anonymous surface. That 401 is the whole handshake — it
@@ -96,9 +106,10 @@ var isAuthorized = async (oauth, ctx, token) => {
 var oauthGuardStage = async (ctx) => {
 	const { oauth } = ctx.config;
 	if (!oauth || ctx.req.method !== "POST") return false;
-	const token = bearerOf(ctx.req);
-	if (token && await isAuthorized(oauth, ctx, token)) return false;
-	sendChallenge(oauth, ctx.req, ctx.res, token ? "The access token is invalid, expired or revoked." : "Authorization is required to use this server.");
+	const reason = await challengeReason(oauth, ctx, bearerOf(ctx.req));
+	if (!reason) return false;
+	ctx.operation = `oauth-challenge:${reason}`;
+	sendChallenge(oauth, ctx.req, ctx.res, CHALLENGE_DESCRIPTIONS[reason]);
 	return true;
 };
 //#endregion

package/dist/modules/mcp/server.js

@@ -43,7 +43,7 @@ var createMcpServer = ({ adapters, getSpaceId, preview, screenshot, logger }) =>
 	const getSpace = () => spacePromise ??= loadSpace();
 	const server = new McpServer({
 		name: "plitzi-mcp",
-		version: "0.32.13"
+		version: "0.32.14"
 	}, { instructions: serverInstructions });
 	registerResources(server, getSpace, MCP_ENV, log);
 	registerApps(server);

package/dist/modules/oauth/authorize.js

@@ -6,6 +6,15 @@ import { dropPending, getClient, getPending, putCode, putPending } from "./recor
 import { redirectWithCode, redirectWithError, sendErrorPage, sendHtml } from "./respond.js";
 //#region src/modules/oauth/authorize.ts
 var DEFAULT_CODE_TTL_SECONDS = 60;
+var DEFAULT_GUEST_LABEL = "Continue without an account";
+var DEFAULT_GUEST_USER = {
+	id: "guest",
+	label: "Guest"
+};
+var guestView = (guest) => ({
+	label: guest.label ?? DEFAULT_GUEST_LABEL,
+	description: guest.target.description
+});
 var hiddenFieldsFor = (request, pendingId) => {
 	const hidden = {
 		client_id: request.clientId,
@@ -57,8 +66,8 @@ var resolveRequest = async (config, res, params) => {
 };
 /** Consent granted: mint the bearer now, park it behind a one-shot code and send the browser back. Minting here
 *  rather than at redemption keeps a failure the user can act on — no space, revoked access — on this screen. */
-var completeGrant = async (config, res, request, pending, target) => {
-	const issued = await config.adapters.issueToken(pending.user, target);
+var completeGrant = async (config, res, request, user, target) => {
+	const issued = await config.adapters.issueToken(user, target);
 	if (!issued) {
 		redirectWithError(res, request.redirectUri, "access_denied", "The account may not grant access to this resource.", request.state);
 		return;
@@ -71,7 +80,7 @@ var completeGrant = async (config, res, request, pending, target) => {
 		token: issued.token,
 		expiresInSeconds: issued.expiresInSeconds,
 		scope: request.scope,
-		user: pending.user,
+		user,
 		target
 	}, config.codeTtlSeconds ?? DEFAULT_CODE_TTL_SECONDS);
 	redirectWithCode(res, request.redirectUri, code, request.state);
@@ -85,6 +94,7 @@ var handleAuthorizeStart = async (config, res, params) => {
 		action: AUTHORIZE_PATH,
 		hidden: hiddenFieldsFor(request),
 		targets: [],
+		guest: config.guest ? guestView(config.guest) : void 0,
 		branding: config.branding ?? {}
 	});
 };
@@ -115,7 +125,12 @@ var handleAuthorizeSubmit = async (config, res, params) => {
 			return;
 		}
 		await dropPending(config.adapters.store, pendingId);
-		await completeGrant(config, res, request, pending, chosen);
+		await completeGrant(config, res, request, pending.user, chosen);
+		return;
+	}
+	const { guest } = config;
+	if (guest && optionalField(params, "guest")) {
+		await completeGrant(config, res, request, guest.user ?? DEFAULT_GUEST_USER, guest.target);
 		return;
 	}
 	const user = await config.adapters.authenticate({
@@ -128,6 +143,7 @@ var handleAuthorizeSubmit = async (config, res, params) => {
 			action: AUTHORIZE_PATH,
 			hidden: hiddenFieldsFor(request),
 			targets: [],
+			guest: guest ? guestView(guest) : void 0,
 			error: "Those credentials did not match an account.",
 			branding: config.branding ?? {}
 		});

package/dist/modules/oauth/consentPage.js

@@ -35,16 +35,23 @@ var STYLES = `
   ul.targets span { color: var(--muted); font-size: 13px; }
   button { width: 100%; padding: 11px 16px; border: 0; border-radius: 8px; background: var(--accent);
     color: #fff; font: inherit; font-weight: 500; cursor: pointer; }
+  button.guest { margin-top: 10px; background: transparent; color: var(--accent);
+    border: 1px solid var(--line); }
   p.error { margin: 0 0 16px; padding: 10px 12px; border-radius: 8px; color: var(--danger);
     border: 1px solid currentColor; font-size: 14px; }
+  p.note { margin: 10px 0 0; color: var(--muted); font-size: 13px; text-align: center; }
 `;
 var hiddenFields = (hidden) => Object.entries(hidden).map(([name, value]) => `<input type="hidden" name="${escapeHtml(name)}" value="${escapeHtml(value)}">`).join("\n      ");
-var credentialsFields = () => `<label for="username">Email or username</label>
+var guestButton = (guest) => {
+	const note = guest.description ? `\n      <p class="note">${escapeHtml(guest.description)}</p>` : "";
+	return `\n      <button class="guest" type="submit" name="guest" value="1" formnovalidate>${escapeHtml(guest.label)}</button>${note}`;
+};
+var credentialsFields = (view) => `<label for="username">Email or username</label>
       <input id="username" name="username" type="text" autocomplete="username" autocapitalize="none"
         spellcheck="false" required autofocus>
       <label for="password">Password</label>
       <input id="password" name="password" type="password" autocomplete="current-password" required>
-      <button type="submit">Sign in</button>`;
+      <button type="submit">Sign in</button>${view.guest ? guestButton(view.guest) : ""}`;
 var targetFields = (view) => {
 	return `<ul class="targets">
         ${view.targets.map((target, index) => {
@@ -82,7 +89,7 @@ var renderConsentPage = (view) => {
     ${error}
     <form method="post" action="${escapeHtml(view.action)}">
       ${hiddenFields(view.hidden)}
-      ${view.step === "credentials" ? credentialsFields() : targetFields(view)}
+      ${view.step === "credentials" ? credentialsFields(view) : targetFields(view)}
     </form>
   </main>
 </body>

package/dist/modules/oauth/token.js

@@ -10,18 +10,20 @@ var refreshTtlOf = (config) => config.refreshTtlSeconds ?? DEFAULT_REFRESH_TTL_S
 var scopeOf = (config, requested) => requested ?? scopesOf(config).join(" ");
 /** The token response, plus a rotated refresh grant when refresh is enabled. Rotation is unconditional: a refresh
 *  token is a long-lived credential, so the one just used never stays valid. */
-var sendTokens = async (config, res, token, expiresInSeconds, grant) => {
+var sendTokens = async (config, res, credential, expiresInSeconds, grant) => {
 	const ttl = refreshTtlOf(config);
-	const body = {
-		access_token: token,
-		token_type: "Bearer",
-		scope: scopeOf(config, grant.scope)
-	};
-	await putAccess(config.adapters.store, token, {
+	const bearer = randomId();
+	await putAccess(config.adapters.store, bearer, {
+		credential,
 		clientId: grant.clientId,
 		user: grant.user,
 		target: grant.target
 	}, Math.max(expiresInSeconds ?? DEFAULT_ACCESS_TTL_SECONDS, 1));
+	const body = {
+		access_token: bearer,
+		token_type: "Bearer",
+		scope: scopeOf(config, grant.scope)
+	};
 	if (expiresInSeconds !== void 0) body["expires_in"] = expiresInSeconds;
 	if (ttl > 0) {
 		const refreshToken = randomId();

package/dist/src/modules/mcp/e2e/oauthConnector.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/modules/oauth/records.d.ts

@@ -36,11 +36,16 @@ export type RefreshRecord = {
     user: OAuthUser;
     target: OAuthGrantTarget;
 };
-/** A bearer this server handed out, kept so the resource side can tell one it issued from a string a client made
- *  up: the grant that carries no space mints an opaque token that resolves to nothing, and without a record there
- *  is nothing to check it against. The record expires with the token, which is what turns an expired bearer into
- *  the 401 a host answers by refreshing; dropping it early revokes the token. */
+/** A bearer this server handed out. The token a client holds is an opaque handle minted here, and this record is
+ *  what it stands for — including `credential`, the thing the deployment's own adapters understand, which never
+ *  leaves the server: a platform token is usually good against more than the MCP endpoint, and a remote host has
+ *  no business holding one. The record expires with the bearer, which is what turns an expired one into the 401 a
+ *  host answers by refreshing; dropping it early revokes the bearer outright. */
 export type AccessRecord = {
+    /** What {@link OAuthAdapters.issueToken} returned — swapped back onto the request once the bearer checks out.
+     *  Absent only in a record written before the bearer and the credential were separate things, where the bearer
+     *  WAS the credential: a live connector must survive that upgrade, so the reader falls back to the token itself. */
+    credential?: string;
     clientId: string;
     user: OAuthUser;
     target: OAuthGrantTarget;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plitzi/sdk-server",
-  "version": "0.32.13",
+  "version": "0.32.14",
   "license": "AGPL-3.0",
   "files": [
     "dist"
@@ -29,9 +29,9 @@
   "dependencies": {
     "@modelcontextprotocol/ext-apps": "^1.7.5",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@plitzi/plitzi-sdk": "0.32.13",
-    "@plitzi/sdk-schema": "0.32.13",
-    "@plitzi/sdk-shared": "0.32.13",
+    "@plitzi/plitzi-sdk": "0.32.14",
+    "@plitzi/sdk-schema": "0.32.14",
+    "@plitzi/sdk-shared": "0.32.14",
     "ejs": "^6.0.1",
     "esbuild": "^0.28.1",
     "zod": "^4.4.3"