@plitzi/sdk-server 0.32.13 → 0.32.15

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # @plitzi/sdk-server
 
+## 0.32.15
+
+### Patch Changes
+
+- v0.32.15
+- Updated dependencies
+  - @plitzi/plitzi-sdk@0.32.15
+  - @plitzi/sdk-schema@0.32.15
+  - @plitzi/sdk-shared@0.32.15
+
+## 0.32.14
+
+### Patch Changes
+
+- v0.32.14
+- Updated dependencies
+  - @plitzi/plitzi-sdk@0.32.14
+  - @plitzi/sdk-schema@0.32.14
+  - @plitzi/sdk-shared@0.32.14
+
 ## 0.32.13
 
 ### Patch Changes

package/dist/core/services/oauth.js

@@ -69,20 +69,30 @@ var oauthStage = async (ctx) => {
 	sendErrorJson(res, 405, "invalid_request", `${method} is not allowed on ${path}.`);
 	return true;
 };
-/** Fail-closed on purpose: a credential this server cannot check right now — an unreachable store, an adapter that
-*  threw — is not one it may act on, and 401 is the answer a host can do something about (re-authorize) where a
-*  500 leaves it stuck. */
-var verified = async (check) => {
+var CHALLENGE_DESCRIPTIONS = {
+	"no-credential": "Authorization is required to use this server.",
+	"unknown-credential": "The access token is invalid, expired or revoked.",
+	"store-unreachable": "The access token could not be verified right now.",
+	"adapter-failed": "The access token could not be verified right now."
+};
+var challengeReason = async (oauth, ctx, token) => {
+	if (!token) return "no-credential";
 	try {
-		return await check();
+		const record = await getAccess(oauth.adapters.store, token);
+		if (record) {
+			const credential = record.credential ?? token;
+			ctx.req.headers["x-access-token"] = credential;
+			ctx.req.headers.authorization = `Bearer ${credential}`;
+			return;
+		}
 	} catch {
-		return false;
+		return "store-unreachable";
+	}
+	try {
+		return await ctx.config.adapters.getSpaceId?.(ctx.req) === void 0 ? "unknown-credential" : void 0;
+	} catch {
+		return "adapter-failed";
 	}
-};
-var isAuthorized = async (oauth, ctx, token) => {
-	if (await verified(async () => await getAccess(oauth.adapters.store, token) !== void 0)) return true;
-	const { adapters } = ctx.config;
-	return verified(async () => await adapters.getSpaceId?.(ctx.req) !== void 0);
 };
 /** The protected-resource half of OAuth: an MCP call that presents no bearer this server can verify is refused
 *  with RFC 6750's challenge instead of being served the anonymous surface. That 401 is the whole handshake — it
@@ -96,9 +106,10 @@ var isAuthorized = async (oauth, ctx, token) => {
 var oauthGuardStage = async (ctx) => {
 	const { oauth } = ctx.config;
 	if (!oauth || ctx.req.method !== "POST") return false;
-	const token = bearerOf(ctx.req);
-	if (token && await isAuthorized(oauth, ctx, token)) return false;
-	sendChallenge(oauth, ctx.req, ctx.res, token ? "The access token is invalid, expired or revoked." : "Authorization is required to use this server.");
+	const reason = await challengeReason(oauth, ctx, bearerOf(ctx.req));
+	if (!reason) return false;
+	ctx.operation = `oauth-challenge:${reason}`;
+	sendChallenge(oauth, ctx.req, ctx.res, CHALLENGE_DESCRIPTIONS[reason]);
 	return true;
 };
 //#endregion

package/dist/modules/mcp/server.js

@@ -43,7 +43,7 @@ var createMcpServer = ({ adapters, getSpaceId, preview, screenshot, logger }) =>
 	const getSpace = () => spacePromise ??= loadSpace();
 	const server = new McpServer({
 		name: "plitzi-mcp",
-		version: "0.32.13"
+		version: "0.32.15"
 	}, { instructions: serverInstructions });
 	registerResources(server, getSpace, MCP_ENV, log);
 	registerApps(server);

package/dist/modules/oauth/authorize.js

@@ -6,6 +6,15 @@ import { dropPending, getClient, getPending, putCode, putPending } from "./recor
 import { redirectWithCode, redirectWithError, sendErrorPage, sendHtml } from "./respond.js";
 //#region src/modules/oauth/authorize.ts
 var DEFAULT_CODE_TTL_SECONDS = 60;
+var DEFAULT_GUEST_LABEL = "Continue without an account";
+var DEFAULT_GUEST_USER = {
+	id: "guest",
+	label: "Guest"
+};
+var guestView = (guest) => ({
+	label: guest.label ?? DEFAULT_GUEST_LABEL,
+	description: guest.target.description
+});
 var hiddenFieldsFor = (request, pendingId) => {
 	const hidden = {
 		client_id: request.clientId,
@@ -57,8 +66,8 @@ var resolveRequest = async (config, res, params) => {
 };
 /** Consent granted: mint the bearer now, park it behind a one-shot code and send the browser back. Minting here
 *  rather than at redemption keeps a failure the user can act on — no space, revoked access — on this screen. */
-var completeGrant = async (config, res, request, pending, target) => {
-	const issued = await config.adapters.issueToken(pending.user, target);
+var completeGrant = async (config, res, request, user, target) => {
+	const issued = await config.adapters.issueToken(user, target);
 	if (!issued) {
 		redirectWithError(res, request.redirectUri, "access_denied", "The account may not grant access to this resource.", request.state);
 		return;
@@ -71,7 +80,7 @@ var completeGrant = async (config, res, request, pending, target) => {
 		token: issued.token,
 		expiresInSeconds: issued.expiresInSeconds,
 		scope: request.scope,
-		user: pending.user,
+		user,
 		target
 	}, config.codeTtlSeconds ?? DEFAULT_CODE_TTL_SECONDS);
 	redirectWithCode(res, request.redirectUri, code, request.state);
@@ -85,6 +94,7 @@ var handleAuthorizeStart = async (config, res, params) => {
 		action: AUTHORIZE_PATH,
 		hidden: hiddenFieldsFor(request),
 		targets: [],
+		guest: config.guest ? guestView(config.guest) : void 0,
 		branding: config.branding ?? {}
 	});
 };
@@ -115,7 +125,12 @@ var handleAuthorizeSubmit = async (config, res, params) => {
 			return;
 		}
 		await dropPending(config.adapters.store, pendingId);
-		await completeGrant(config, res, request, pending, chosen);
+		await completeGrant(config, res, request, pending.user, chosen);
+		return;
+	}
+	const { guest } = config;
+	if (guest && optionalField(params, "guest")) {
+		await completeGrant(config, res, request, guest.user ?? DEFAULT_GUEST_USER, guest.target);
 		return;
 	}
 	const user = await config.adapters.authenticate({
@@ -128,6 +143,7 @@ var handleAuthorizeSubmit = async (config, res, params) => {
 			action: AUTHORIZE_PATH,
 			hidden: hiddenFieldsFor(request),
 			targets: [],
+			guest: guest ? guestView(guest) : void 0,
 			error: "Those credentials did not match an account.",
 			branding: config.branding ?? {}
 		});

package/dist/modules/oauth/consentPage.js

@@ -35,16 +35,23 @@ var STYLES = `
   ul.targets span { color: var(--muted); font-size: 13px; }
   button { width: 100%; padding: 11px 16px; border: 0; border-radius: 8px; background: var(--accent);
     color: #fff; font: inherit; font-weight: 500; cursor: pointer; }
+  button.guest { margin-top: 10px; background: transparent; color: var(--accent);
+    border: 1px solid var(--line); }
   p.error { margin: 0 0 16px; padding: 10px 12px; border-radius: 8px; color: var(--danger);
     border: 1px solid currentColor; font-size: 14px; }
+  p.note { margin: 10px 0 0; color: var(--muted); font-size: 13px; text-align: center; }
 `;
 var hiddenFields = (hidden) => Object.entries(hidden).map(([name, value]) => `<input type="hidden" name="${escapeHtml(name)}" value="${escapeHtml(value)}">`).join("\n      ");
-var credentialsFields = () => `<label for="username">Email or username</label>
+var guestButton = (guest) => {
+	const note = guest.description ? `\n      <p class="note">${escapeHtml(guest.description)}</p>` : "";
+	return `\n      <button class="guest" type="submit" name="guest" value="1" formnovalidate>${escapeHtml(guest.label)}</button>${note}`;
+};
+var credentialsFields = (view) => `<label for="username">Email or username</label>
       <input id="username" name="username" type="text" autocomplete="username" autocapitalize="none"
         spellcheck="false" required autofocus>
       <label for="password">Password</label>
       <input id="password" name="password" type="password" autocomplete="current-password" required>
-      <button type="submit">Sign in</button>`;
+      <button type="submit">Sign in</button>${view.guest ? guestButton(view.guest) : ""}`;
 var targetFields = (view) => {
 	return `<ul class="targets">
         ${view.targets.map((target, index) => {
@@ -82,7 +89,7 @@ var renderConsentPage = (view) => {
     ${error}
     <form method="post" action="${escapeHtml(view.action)}">
       ${hiddenFields(view.hidden)}
-      ${view.step === "credentials" ? credentialsFields() : targetFields(view)}
+      ${view.step === "credentials" ? credentialsFields(view) : targetFields(view)}
     </form>
   </main>
 </body>

package/dist/modules/oauth/records.js

@@ -16,6 +16,15 @@ var writeJson = async (store, kind, id, value, ttlSeconds) => {
 };
 var putClient = (store, client) => writeJson(store, "client", client.clientId, client, CLIENT_TTL_SECONDS);
 var getClient = (store, clientId) => readJson(store, "client", clientId);
+/** The id already handed out for an identical registration. Keyed by what the client asked to be registered AS,
+*  so the same request always resolves to the same client — see handleRegister for why that matters. */
+var getClientByFingerprint = async (store, fingerprint) => {
+	const clientId = await store.get(keyOf("clientfp", fingerprint));
+	return clientId ? getClient(store, clientId) : void 0;
+};
+var putClientFingerprint = async (store, fingerprint, clientId) => {
+	await store.put(keyOf("clientfp", fingerprint), clientId, CLIENT_TTL_SECONDS);
+};
 var putPending = (store, id, pending) => writeJson(store, "pending", id, pending, PENDING_TTL_SECONDS);
 var getPending = (store, id) => readJson(store, "pending", id);
 var dropPending = async (store, id) => {
@@ -34,4 +43,4 @@ var dropRefresh = async (store, token) => {
 var putAccess = (store, token, record, ttlSeconds) => writeJson(store, "access", token, record, ttlSeconds);
 var getAccess = (store, token) => readJson(store, "access", token);
 //#endregion
-export { dropCode, dropPending, dropRefresh, getAccess, getClient, getCode, getPending, getRefresh, putAccess, putClient, putCode, putPending, putRefresh };
+export { dropCode, dropPending, dropRefresh, getAccess, getClient, getClientByFingerprint, getCode, getPending, getRefresh, putAccess, putClient, putClientFingerprint, putCode, putPending, putRefresh };

package/dist/modules/oauth/register.js

@@ -1,6 +1,7 @@
 import { randomId } from "./pkce.js";
-import { putClient } from "./records.js";
+import { getClientByFingerprint, putClient, putClientFingerprint } from "./records.js";
 import { sendErrorJson, sendJson } from "./respond.js";
+import { createHash } from "node:crypto";
 //#region src/modules/oauth/register.ts
 var isUsableRedirectUri = (value) => {
 	let url;
@@ -13,6 +14,8 @@ var isUsableRedirectUri = (value) => {
 	return url.protocol === "http:" && (url.hostname === "localhost" || url.hostname === "127.0.0.1");
 };
 var stringList = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+var nowSeconds = () => Math.floor(Date.now() / 1e3);
+var fingerprintOf = (clientName, redirectUris) => createHash("sha256").update(JSON.stringify([clientName, [...redirectUris].sort()])).digest("base64url");
 /** RFC 7591 dynamic client registration. A remote host has no way to be configured into this server ahead of
 *  time, so it registers itself on first connect; the record it gets back is only ever used to pin the redirect
 *  target, since a public client authenticates with PKCE rather than with credentials. */
@@ -28,15 +31,19 @@ var handleRegister = async (config, res, body) => {
 		return;
 	}
 	const clientName = typeof metadata["client_name"] === "string" ? metadata["client_name"] : "MCP client";
-	const clientId = randomId();
-	await putClient(config.adapters.store, {
-		clientId,
+	const { store } = config.adapters;
+	const fingerprint = fingerprintOf(clientName, redirectUris);
+	const client = await getClientByFingerprint(store, fingerprint) ?? {
+		clientId: randomId(),
 		clientName,
-		redirectUris
-	});
+		redirectUris,
+		issuedAt: nowSeconds()
+	};
+	await putClient(store, client);
+	await putClientFingerprint(store, fingerprint, client.clientId);
 	sendJson(res, 201, {
-		client_id: clientId,
-		client_id_issued_at: Math.floor(Date.now() / 1e3),
+		client_id: client.clientId,
+		client_id_issued_at: client.issuedAt,
 		client_name: clientName,
 		redirect_uris: redirectUris,
 		grant_types: config.refreshTtlSeconds === 0 ? ["authorization_code"] : ["authorization_code", "refresh_token"],

package/dist/modules/oauth/respond.js

@@ -3,13 +3,13 @@ import { renderErrorPage } from "./consentPage.js";
 var sendJson = (res, status, body) => {
 	res.setStatus(status);
 	res.setHeader("Content-Type", "application/json");
-	res.setHeader("Cache-Control", "no-store");
+	res.setHeader("Cache-Control", "no-store, no-transform");
 	res.send(JSON.stringify(body));
 };
 var sendHtml = (res, status, html) => {
 	res.setStatus(status);
 	res.setHeader("Content-Type", "text/html; charset=utf-8");
-	res.setHeader("Cache-Control", "no-store");
+	res.setHeader("Cache-Control", "no-store, no-transform");
 	res.send(html);
 };
 var sendErrorJson = (res, status, error, description) => sendJson(res, status, {
@@ -28,7 +28,7 @@ var redirectWithError = (res, redirectUri, error, description, state) => {
 	if (state !== void 0) url.searchParams.set("state", state);
 	res.setStatus(302);
 	res.setHeader("Location", url.toString());
-	res.setHeader("Cache-Control", "no-store");
+	res.setHeader("Cache-Control", "no-store, no-transform");
 	res.end();
 };
 var redirectWithCode = (res, redirectUri, code, state) => {
@@ -37,7 +37,7 @@ var redirectWithCode = (res, redirectUri, code, state) => {
 	if (state !== void 0) url.searchParams.set("state", state);
 	res.setStatus(302);
 	res.setHeader("Location", url.toString());
-	res.setHeader("Cache-Control", "no-store");
+	res.setHeader("Cache-Control", "no-store, no-transform");
 	res.end();
 };
 //#endregion

package/dist/modules/oauth/token.js

@@ -10,18 +10,20 @@ var refreshTtlOf = (config) => config.refreshTtlSeconds ?? DEFAULT_REFRESH_TTL_S
 var scopeOf = (config, requested) => requested ?? scopesOf(config).join(" ");
 /** The token response, plus a rotated refresh grant when refresh is enabled. Rotation is unconditional: a refresh
 *  token is a long-lived credential, so the one just used never stays valid. */
-var sendTokens = async (config, res, token, expiresInSeconds, grant) => {
+var sendTokens = async (config, res, credential, expiresInSeconds, grant) => {
 	const ttl = refreshTtlOf(config);
-	const body = {
-		access_token: token,
-		token_type: "Bearer",
-		scope: scopeOf(config, grant.scope)
-	};
-	await putAccess(config.adapters.store, token, {
+	const bearer = randomId();
+	await putAccess(config.adapters.store, bearer, {
+		credential,
 		clientId: grant.clientId,
 		user: grant.user,
 		target: grant.target
 	}, Math.max(expiresInSeconds ?? DEFAULT_ACCESS_TTL_SECONDS, 1));
+	const body = {
+		access_token: bearer,
+		token_type: "Bearer",
+		scope: scopeOf(config, grant.scope)
+	};
 	if (expiresInSeconds !== void 0) body["expires_in"] = expiresInSeconds;
 	if (ttl > 0) {
 		const refreshToken = randomId();

package/dist/src/modules/mcp/e2e/oauthConnector.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/modules/oauth/records.d.ts

@@ -5,6 +5,8 @@ export type ClientRecord = {
     clientId: string;
     clientName: string;
     redirectUris: string[];
+    /** When this registration was first handed out, so re-registering the same client keeps reporting its real age. */
+    issuedAt: number;
 };
 /** The authorization request, parked while the user logs in. `challenge` binds the eventual code to the client
  *  that started the flow. */
@@ -36,17 +38,26 @@ export type RefreshRecord = {
     user: OAuthUser;
     target: OAuthGrantTarget;
 };
-/** A bearer this server handed out, kept so the resource side can tell one it issued from a string a client made
- *  up: the grant that carries no space mints an opaque token that resolves to nothing, and without a record there
- *  is nothing to check it against. The record expires with the token, which is what turns an expired bearer into
- *  the 401 a host answers by refreshing; dropping it early revokes the token. */
+/** A bearer this server handed out. The token a client holds is an opaque handle minted here, and this record is
+ *  what it stands for — including `credential`, the thing the deployment's own adapters understand, which never
+ *  leaves the server: a platform token is usually good against more than the MCP endpoint, and a remote host has
+ *  no business holding one. The record expires with the bearer, which is what turns an expired one into the 401 a
+ *  host answers by refreshing; dropping it early revokes the bearer outright. */
 export type AccessRecord = {
+    /** What {@link OAuthAdapters.issueToken} returned — swapped back onto the request once the bearer checks out.
+     *  Absent only in a record written before the bearer and the credential were separate things, where the bearer
+     *  WAS the credential: a live connector must survive that upgrade, so the reader falls back to the token itself. */
+    credential?: string;
     clientId: string;
     user: OAuthUser;
     target: OAuthGrantTarget;
 };
 export declare const putClient: (store: OAuthStore, client: ClientRecord) => Promise<void>;
 export declare const getClient: (store: OAuthStore, clientId: string) => Promise<ClientRecord | undefined>;
+/** The id already handed out for an identical registration. Keyed by what the client asked to be registered AS,
+ *  so the same request always resolves to the same client — see handleRegister for why that matters. */
+export declare const getClientByFingerprint: (store: OAuthStore, fingerprint: string) => Promise<ClientRecord | undefined>;
+export declare const putClientFingerprint: (store: OAuthStore, fingerprint: string, clientId: string) => Promise<void>;
 export declare const putPending: (store: OAuthStore, id: string, pending: PendingRecord) => Promise<void>;
 export declare const getPending: (store: OAuthStore, id: string) => Promise<PendingRecord | undefined>;
 export declare const dropPending: (store: OAuthStore, id: string) => Promise<void>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plitzi/sdk-server",
-  "version": "0.32.13",
+  "version": "0.32.15",
   "license": "AGPL-3.0",
   "files": [
     "dist"
@@ -29,9 +29,9 @@
   "dependencies": {
     "@modelcontextprotocol/ext-apps": "^1.7.5",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@plitzi/plitzi-sdk": "0.32.13",
-    "@plitzi/sdk-schema": "0.32.13",
-    "@plitzi/sdk-shared": "0.32.13",
+    "@plitzi/plitzi-sdk": "0.32.15",
+    "@plitzi/sdk-schema": "0.32.15",
+    "@plitzi/sdk-shared": "0.32.15",
     "ejs": "^6.0.1",
     "esbuild": "^0.28.1",
     "zod": "^4.4.3"