@rudderhq/server 0.5.2-canary.2 → 0.6.0

package/dist/services/mcp/oauth-provider.js

@@ -0,0 +1,120 @@
+export function resolveMcpOAuthRedirectUri(input) {
+    if (input.deploymentMode === "local_trusted") {
+        return `http://127.0.0.1:${input.serverPort}/api/mcp/oauth/callback`;
+    }
+    let base;
+    try {
+        base = new URL(input.authPublicBaseUrl ?? "");
+    }
+    catch {
+        throw new Error("Managed MCP OAuth requires a canonical HTTPS auth public base URL");
+    }
+    if (base.protocol !== "https:"
+        || base.username
+        || base.password
+        || base.search
+        || base.hash) {
+        throw new Error("Managed MCP OAuth requires a canonical HTTPS auth public base URL");
+    }
+    return new URL("/api/mcp/oauth/callback", base.origin).href;
+}
+export class PersistentMcpOAuthClientProvider {
+    redirectUrl;
+    clientMetadata;
+    authorizationUrl = null;
+    oauthState;
+    saveMaterial;
+    material;
+    constructor(options) {
+        this.redirectUrl = options.redirectUri;
+        this.oauthState = options.state;
+        this.material = structuredClone(options.material);
+        this.saveMaterial = options.save;
+        this.clientMetadata = {
+            client_name: "Rudder",
+            redirect_uris: [options.redirectUri],
+            grant_types: ["authorization_code", "refresh_token"],
+            response_types: ["code"],
+            token_endpoint_auth_method: "none",
+        };
+    }
+    state() {
+        return this.oauthState;
+    }
+    clientInformation(_context) {
+        return this.material.clientInformation;
+    }
+    async saveClientInformation(clientInformation, _context) {
+        await this.update({ clientInformation });
+    }
+    tokens(_context) {
+        return this.material.tokens;
+    }
+    async saveTokens(tokens, _context) {
+        await this.update({
+            tokens: {
+                ...tokens,
+                ...(tokens.refresh_token
+                    ? {}
+                    : this.material.tokens?.refresh_token
+                        ? { refresh_token: this.material.tokens.refresh_token }
+                        : {}),
+            },
+        });
+    }
+    redirectToAuthorization(authorizationUrl) {
+        this.authorizationUrl = new URL(authorizationUrl);
+    }
+    async saveCodeVerifier(codeVerifier) {
+        await this.update({ codeVerifier });
+    }
+    codeVerifier() {
+        if (!this.material.codeVerifier) {
+            throw new Error("Managed MCP OAuth PKCE verifier is unavailable");
+        }
+        return this.material.codeVerifier;
+    }
+    async saveDiscoveryState(discoveryState) {
+        await this.update({ discoveryState });
+    }
+    discoveryState() {
+        return this.material.discoveryState;
+    }
+    async saveResourceUrl(resourceUrl) {
+        await this.update({ resourceUrl });
+    }
+    resourceUrl() {
+        return this.material.resourceUrl;
+    }
+    async saveAuthorizationServerUrl(authorizationServerUrl) {
+        await this.update({ authorizationServerUrl });
+    }
+    authorizationServerUrl() {
+        return this.material.authorizationServerUrl;
+    }
+    async invalidateCredentials(scope) {
+        const next = { ...this.material };
+        if (scope === "all" || scope === "client")
+            delete next.clientInformation;
+        if (scope === "all" || scope === "tokens")
+            delete next.tokens;
+        if (scope === "all" || scope === "verifier")
+            delete next.codeVerifier;
+        if (scope === "all" || scope === "discovery") {
+            delete next.discoveryState;
+            delete next.resourceUrl;
+            delete next.authorizationServerUrl;
+        }
+        await this.saveMaterial(structuredClone(next));
+        this.material = next;
+    }
+    snapshot() {
+        return structuredClone(this.material);
+    }
+    async update(patch) {
+        const next = { ...this.material, ...structuredClone(patch) };
+        await this.saveMaterial(structuredClone(next));
+        this.material = next;
+    }
+}
+//# sourceMappingURL=oauth-provider.js.map

package/dist/services/mcp/oauth-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-provider.js","sourceRoot":"","sources":["../../../src/services/mcp/oauth-provider.ts"],"names":[],"mappings":"AAmBA,MAAM,UAAU,0BAA0B,CAAC,KAI1C;IACC,IAAI,KAAK,CAAC,cAAc,KAAK,eAAe,EAAE,CAAC;QAC7C,OAAO,oBAAoB,KAAK,CAAC,UAAU,yBAAyB,CAAC;IACvE,CAAC;IACD,IAAI,IAAS,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,IACE,IAAI,CAAC,QAAQ,KAAK,QAAQ;WACvB,IAAI,CAAC,QAAQ;WACb,IAAI,CAAC,QAAQ;WACb,IAAI,CAAC,MAAM;WACX,IAAI,CAAC,IAAI,EACZ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,yBAAyB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC;AASD,MAAM,OAAO,gCAAgC;IAClC,WAAW,CAAS;IACpB,cAAc,CAAsB;IAC7C,gBAAgB,GAAe,IAAI,CAAC;IACnB,UAAU,CAAS;IACnB,YAAY,CAAkD;IACvE,QAAQ,CAA0B;IAE1C,YAAY,OAAgD;QAC1D,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;QACjC,IAAI,CAAC,cAAc,GAAG;YACpB,WAAW,EAAE,QAAQ;YACrB,aAAa,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC;YACpC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,0BAA0B,EAAE,MAAM;SACnC,CAAC;IACJ,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,iBAAiB,CACf,QAAwC;QAExC,OAAO,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,iBAA+C,EAC/C,QAAwC;QAExC,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,CAAC,QAAwC;QAC7C,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,UAAU,CACd,MAAyB,EACzB,QAAwC;QAExC,MAAM,IAAI,CAAC,MAAM,CAAC;YAChB,MAAM,EAAE;gBACN,GAAG,MAAM;gBACT,GAAG,CAAC,MAAM,CAAC,aAAa;oBACtB,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,aAAa;wBACnC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE;wBACvD,CAAC,CAAC,EAAE,CAAC;aACV;SACF,CAAC,CAAC;IACL,CAAC;IAED,uBAAuB,CAAC,gBAAqB;QAC3C,IAAI,CAAC,gBAAgB,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,YAAoB;QACzC,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,YAAY;QACV,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,cAAmC;QAC1D,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,WAAmB;QACvC,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,0BAA0B,CAAC,sBAA8B;QAC7D,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,sBAAsB,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,sBAAsB;QACpB,OAAO,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,KAA6D;QAE7D,MAAM,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC;QACzE,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC;QAC9D,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC,YAAY,CAAC;QACtE,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC,cAAc,CAAC;YAC3B,OAAO,IAAI,CAAC,WAAW,CAAC;YACxB,OAAO,IAAI,CAAC,sBAAsB,CAAC;QACrC,CAAC;QACD,MAAM,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;IACvB,CAAC;IAED,QAAQ;QACN,OAAO,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,KAAuC;QAC1D,MAAM,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;IACvB,CAAC;CACF"}

package/dist/services/mcp/oauth-scope.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=oauth-scope.test.d.ts.map

package/dist/services/mcp/oauth-scope.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-scope.test.d.ts","sourceRoot":"","sources":["../../../src/services/mcp/oauth-scope.test.ts"],"names":[],"mappings":""}

package/dist/services/mcp/oauth-scope.test.js

@@ -0,0 +1,69 @@
+import { describe, expect, it } from "vitest";
+import { parseProviderWorkspaceScope } from "./oauth.js";
+describe("managed MCP official provider workspace identity", () => {
+    it("uses Linear organization and Notion bot workspace without falling back to actor ids", () => {
+        expect(parseProviderWorkspaceScope("linear", {
+            id: "linear-user-id",
+            name: "Linear User",
+            organization: { id: "linear-org-id", name: "Linear Workspace" },
+        })).toMatchObject({ id: "linear-org-id", displayName: "Linear Workspace" });
+        expect(parseProviderWorkspaceScope("notion", {
+            id: "notion-bot-id",
+            name: "Rudder Bot",
+            type: "bot",
+            bot: {
+                workspace_id: "notion-workspace-id",
+                workspace_name: "Notion Workspace",
+            },
+        })).toMatchObject({ id: "notion-workspace-id", displayName: "Notion Workspace" });
+        expect(parseProviderWorkspaceScope("linear", {
+            id: "linear-user-id",
+            name: "Linear User",
+        })).toBeNull();
+        expect(parseProviderWorkspaceScope("notion", {
+            id: "notion-bot-id",
+            name: "Rudder Bot",
+        })).toBeNull();
+    });
+    it("uses an honest opaque authorization subject for Linear's official user shape", () => {
+        const selected = parseProviderWorkspaceScope("linear", {
+            id: "linear-workspace-scoped-user-id",
+            name: "Zeeland",
+            email: "owner@example.test",
+            teams: [
+                { id: "team-rudder", name: "Rudder", key: "RUD" },
+                { id: "team-zeeland", name: "Zeeland", key: "ZEE" },
+            ],
+        });
+        expect(selected).toMatchObject({
+            displayName: "Zeeland's Linear authorization",
+            metadata: { scopeKind: "authorization_subject" },
+        });
+        expect(selected?.id).toMatch(/^linear-authorization-subject-[a-f0-9]{24}$/u);
+        expect(selected?.id).not.toContain("linear-workspace-scoped-user-id");
+        expect(parseProviderWorkspaceScope("linear", {
+            id: "linear-workspace-scoped-user-id",
+            name: "Zeeland",
+            teams: [{ id: "different-team", name: "Different", key: "DIF" }],
+        })?.id).toBe(selected?.id);
+        expect(parseProviderWorkspaceScope("linear", {
+            id: "linear-workspace-scoped-user-id",
+            name: "Zeeland",
+            teams: [],
+        })).toBeNull();
+    });
+    it("reads the workspace wrapper returned by Notion notion-fetch self", () => {
+        expect(parseProviderWorkspaceScope("notion", {
+            self: {
+                workspace: {
+                    id: "notion-workspace-id",
+                    name: "Notion Workspace",
+                },
+            },
+        })).toMatchObject({
+            id: "notion-workspace-id",
+            displayName: "Notion Workspace",
+        });
+    });
+});
+//# sourceMappingURL=oauth-scope.test.js.map

package/dist/services/mcp/oauth-scope.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-scope.test.js","sourceRoot":"","sources":["../../../src/services/mcp/oauth-scope.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAEzD,QAAQ,CAAC,kDAAkD,EAAE,GAAG,EAAE;IAChE,EAAE,CAAC,qFAAqF,EAAE,GAAG,EAAE;QAC7F,MAAM,CAAC,2BAA2B,CAAC,QAAQ,EAAE;YAC3C,EAAE,EAAE,gBAAgB;YACpB,IAAI,EAAE,aAAa;YACnB,YAAY,EAAE,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,kBAAkB,EAAE;SAChE,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC5E,MAAM,CAAC,2BAA2B,CAAC,QAAQ,EAAE;YAC3C,EAAE,EAAE,eAAe;YACnB,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE;gBACH,YAAY,EAAE,qBAAqB;gBACnC,cAAc,EAAE,kBAAkB;aACnC;SACF,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,qBAAqB,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAClF,MAAM,CAAC,2BAA2B,CAAC,QAAQ,EAAE;YAC3C,EAAE,EAAE,gBAAgB;YACpB,IAAI,EAAE,aAAa;SACpB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACf,MAAM,CAAC,2BAA2B,CAAC,QAAQ,EAAE;YAC3C,EAAE,EAAE,eAAe;YACnB,IAAI,EAAE,YAAY;SACnB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8EAA8E,EAAE,GAAG,EAAE;QACtF,MAAM,QAAQ,GAAG,2BAA2B,CAAC,QAAQ,EAAE;YACrD,EAAE,EAAE,iCAAiC;YACrC,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,oBAAoB;YAC3B,KAAK,EAAE;gBACL,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE;gBACjD,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE;aACpD;SACF,CAAC,CAAC;QAEH,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC;YAC7B,WAAW,EAAE,gCAAgC;YAC7C,QAAQ,EAAE,EAAE,SAAS,EAAE,uBAAuB,EAAE;SACjD,CAAC,CAAC;QACH,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC;QAC7E,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;QACtE,MAAM,CAAC,2BAA2B,CAAC,QAAQ,EAAE;YAC3C,EAAE,EAAE,iCAAiC;YACrC,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;SACjE,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC3B,MAAM,CAAC,2BAA2B,CAAC,QAAQ,EAAE;YAC3C,EAAE,EAAE,iCAAiC;YACrC,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,EAAE;SACV,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,CAAC,2BAA2B,CAAC,QAAQ,EAAE;YAC3C,IAAI,EAAE;gBACJ,SAAS,EAAE;oBACT,EAAE,EAAE,qBAAqB;oBACzB,IAAI,EAAE,kBAAkB;iBACzB;aACF;SACF,CAAC,CAAC,CAAC,aAAa,CAAC;YAChB,EAAE,EAAE,qBAAqB;YACzB,WAAW,EAAE,kBAAkB;SAChC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/services/mcp/oauth-session-gc.d.ts

@@ -0,0 +1,14 @@
+export interface ManagedMcpOAuthSessionCleanup {
+    cleanupExpiredSessions(orgId?: string, limit?: number): Promise<number>;
+}
+export interface ManagedMcpOAuthSessionGcOptions {
+    intervalMs?: number;
+    batchSize?: number;
+    onError?: (error: unknown) => void;
+    setIntervalFn?: (callback: () => void, intervalMs: number) => ReturnType<typeof setInterval>;
+    clearIntervalFn?: (handle: ReturnType<typeof setInterval>) => void;
+}
+export declare function startManagedMcpOAuthSessionGc(service: ManagedMcpOAuthSessionCleanup, options?: ManagedMcpOAuthSessionGcOptions): {
+    stop(): void;
+};
+//# sourceMappingURL=oauth-session-gc.d.ts.map

package/dist/services/mcp/oauth-session-gc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-session-gc.d.ts","sourceRoot":"","sources":["../../../src/services/mcp/oauth-session-gc.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,6BAA6B;IAC5C,sBAAsB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACzE;AAED,MAAM,WAAW,+BAA+B;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IACnC,aAAa,CAAC,EAAE,CACd,QAAQ,EAAE,MAAM,IAAI,EACpB,UAAU,EAAE,MAAM,KACf,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC;IACpC,eAAe,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,WAAW,CAAC,KAAK,IAAI,CAAC;CACpE;AAKD,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,6BAA6B,EACtC,OAAO,GAAE,+BAAoC;;EAgC9C"}

package/dist/services/mcp/oauth-session-gc.js

@@ -0,0 +1,34 @@
+const DEFAULT_INTERVAL_MS = 60_000;
+const DEFAULT_BATCH_SIZE = 100;
+export function startManagedMcpOAuthSessionGc(service, options = {}) {
+    const intervalMs = options.intervalMs ?? DEFAULT_INTERVAL_MS;
+    const batchSize = options.batchSize ?? DEFAULT_BATCH_SIZE;
+    const setIntervalFn = options.setIntervalFn ?? setInterval;
+    const clearIntervalFn = options.clearIntervalFn ?? clearInterval;
+    let stopped = false;
+    let sweepInFlight = null;
+    const sweep = () => {
+        if (stopped || sweepInFlight)
+            return;
+        sweepInFlight = service.cleanupExpiredSessions(undefined, batchSize)
+            .then(() => undefined)
+            .catch((error) => {
+            options.onError?.(error);
+        })
+            .finally(() => {
+            sweepInFlight = null;
+        });
+    };
+    sweep();
+    const timer = setIntervalFn(sweep, intervalMs);
+    timer.unref?.();
+    return {
+        stop() {
+            if (stopped)
+                return;
+            stopped = true;
+            clearIntervalFn(timer);
+        },
+    };
+}
+//# sourceMappingURL=oauth-session-gc.js.map

package/dist/services/mcp/oauth-session-gc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-session-gc.js","sourceRoot":"","sources":["../../../src/services/mcp/oauth-session-gc.ts"],"names":[],"mappings":"AAeA,MAAM,mBAAmB,GAAG,MAAM,CAAC;AACnC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAE/B,MAAM,UAAU,6BAA6B,CAC3C,OAAsC,EACtC,UAA2C,EAAE;IAE7C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC7D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,WAAW,CAAC;IAC3D,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,aAAa,CAAC;IACjE,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,aAAa,GAAyB,IAAI,CAAC;IAE/C,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,IAAI,OAAO,IAAI,aAAa;YAAE,OAAO;QACrC,aAAa,GAAG,OAAO,CAAC,sBAAsB,CAAC,SAAS,EAAE,SAAS,CAAC;aACjE,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;aACrB,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACf,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,aAAa,GAAG,IAAI,CAAC;QACvB,CAAC,CAAC,CAAC;IACP,CAAC,CAAC;IAEF,KAAK,EAAE,CAAC;IACR,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC/C,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAEhB,OAAO;QACL,IAAI;YACF,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,eAAe,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/services/mcp/oauth-session-gc.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=oauth-session-gc.test.d.ts.map

package/dist/services/mcp/oauth-session-gc.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-session-gc.test.d.ts","sourceRoot":"","sources":["../../../src/services/mcp/oauth-session-gc.test.ts"],"names":[],"mappings":""}

package/dist/services/mcp/oauth-session-gc.test.js

@@ -0,0 +1,66 @@
+import { describe, expect, it, vi } from "vitest";
+import { startManagedMcpOAuthSessionGc } from "./oauth-session-gc.js";
+describe("managed MCP OAuth session GC", () => {
+    it("runs a bounded startup sweep, repeats, unreferences its timer, and stops cleanly", async () => {
+        const cleanupExpiredSessions = vi.fn().mockResolvedValue(3);
+        const timer = {
+            unref: vi.fn(),
+        };
+        let tick;
+        const setIntervalFn = vi.fn((callback) => {
+            tick = callback;
+            return timer;
+        });
+        const clearIntervalFn = vi.fn();
+        const gc = startManagedMcpOAuthSessionGc({ cleanupExpiredSessions }, {
+            batchSize: 25,
+            intervalMs: 1_000,
+            setIntervalFn,
+            clearIntervalFn,
+        });
+        await new Promise((resolve) => setImmediate(resolve));
+        expect(cleanupExpiredSessions).toHaveBeenCalledWith(undefined, 25);
+        expect(timer.unref).toHaveBeenCalledOnce();
+        tick?.();
+        await new Promise((resolve) => setImmediate(resolve));
+        expect(cleanupExpiredSessions).toHaveBeenCalledTimes(2);
+        gc.stop();
+        expect(clearIntervalFn).toHaveBeenCalledWith(timer);
+    });
+    it("does not overlap cleanup sweeps and reports failures without stopping the timer", async () => {
+        let release;
+        const firstSweep = new Promise((resolve) => {
+            release = () => resolve(1);
+        });
+        const cleanupError = new Error("database unavailable");
+        const cleanupExpiredSessions = vi.fn()
+            .mockReturnValueOnce(firstSweep)
+            .mockRejectedValueOnce(cleanupError)
+            .mockResolvedValue(0);
+        let tick;
+        const errors = [];
+        const gc = startManagedMcpOAuthSessionGc({ cleanupExpiredSessions }, {
+            intervalMs: 1_000,
+            setIntervalFn: (callback) => {
+                tick = callback;
+                return { unref() { } };
+            },
+            clearIntervalFn: () => { },
+            onError: (error) => errors.push(error),
+        });
+        tick?.();
+        expect(cleanupExpiredSessions).toHaveBeenCalledOnce();
+        release();
+        await firstSweep;
+        await new Promise((resolve) => setImmediate(resolve));
+        tick?.();
+        await new Promise((resolve) => setImmediate(resolve));
+        expect(cleanupExpiredSessions).toHaveBeenCalledTimes(2);
+        expect(errors).toEqual([cleanupError]);
+        tick?.();
+        await new Promise((resolve) => setImmediate(resolve));
+        expect(cleanupExpiredSessions).toHaveBeenCalledTimes(3);
+        gc.stop();
+    });
+});
+//# sourceMappingURL=oauth-session-gc.test.js.map

package/dist/services/mcp/oauth-session-gc.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-session-gc.test.js","sourceRoot":"","sources":["../../../src/services/mcp/oauth-session-gc.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AAEtE,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QAChG,MAAM,sBAAsB,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG;YACZ,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;SAC8B,CAAC;QAC/C,IAAI,IAA8B,CAAC;QACnC,MAAM,aAAa,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,QAAoB,EAAE,EAAE;YACnD,IAAI,GAAG,QAAQ,CAAC;YAChB,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;QACH,MAAM,eAAe,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAEhC,MAAM,EAAE,GAAG,6BAA6B,CACtC,EAAE,sBAAsB,EAAE,EAC1B;YACE,SAAS,EAAE,EAAE;YACb,UAAU,EAAE,KAAK;YACjB,aAAa;YACb,eAAe;SAChB,CACF,CAAC;QACF,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QAE5D,MAAM,CAAC,sBAAsB,CAAC,CAAC,oBAAoB,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACnE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,oBAAoB,EAAE,CAAC;QAE3C,IAAI,EAAE,EAAE,CAAC;QACT,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5D,MAAM,CAAC,sBAAsB,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAExD,EAAE,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,CAAC,eAAe,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,IAAI,OAAoB,CAAC;QACzB,MAAM,UAAU,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;YACjD,OAAO,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACvD,MAAM,sBAAsB,GAAG,EAAE,CAAC,EAAE,EAAE;aACnC,mBAAmB,CAAC,UAAU,CAAC;aAC/B,qBAAqB,CAAC,YAAY,CAAC;aACnC,iBAAiB,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,IAA8B,CAAC;QACnC,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,6BAA6B,CACtC,EAAE,sBAAsB,EAAE,EAC1B;YACE,UAAU,EAAE,KAAK;YACjB,aAAa,EAAE,CAAC,QAAQ,EAAE,EAAE;gBAC1B,IAAI,GAAG,QAAQ,CAAC;gBAChB,OAAO,EAAE,KAAK,KAAI,CAAC,EAAoC,CAAC;YAC1D,CAAC;YACD,eAAe,EAAE,GAAG,EAAE,GAAE,CAAC;YACzB,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SACvC,CACF,CAAC;QAEF,IAAI,EAAE,EAAE,CAAC;QACT,MAAM,CAAC,sBAAsB,CAAC,CAAC,oBAAoB,EAAE,CAAC;QACtD,OAAO,EAAE,CAAC;QACV,MAAM,UAAU,CAAC;QACjB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5D,IAAI,EAAE,EAAE,CAAC;QACT,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5D,MAAM,CAAC,sBAAsB,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;QACvC,IAAI,EAAE,EAAE,CAAC;QACT,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5D,MAAM,CAAC,sBAAsB,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACxD,EAAE,CAAC,IAAI,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/services/mcp/oauth.d.ts

@@ -0,0 +1,61 @@
+import { type AuthOptions, type AuthResult, type OAuthClientProvider } from "@modelcontextprotocol/client";
+import type { Db } from "@rudderhq/db";
+import { mcpConnections, mcpOAuthGrants } from "@rudderhq/db";
+import { type McpConnectionSummary, type McpExternalScopeOption, type McpOAuthCallback, type McpOAuthCallbackResult, type McpOAuthGrantSummary, type McpOAuthStartResponse, type McpScopeSelection } from "@rudderhq/shared";
+import { type ManagedMcpOAuthMaterial } from "./oauth-provider.js";
+import { type McpDeploymentAllowlists, type McpDnsLookup } from "./security-policy.js";
+type McpConnectionRow = typeof mcpConnections.$inferSelect;
+type McpOAuthGrantRow = typeof mcpOAuthGrants.$inferSelect;
+type OAuthAuth = (provider: OAuthClientProvider, options: AuthOptions) => Promise<AuthResult>;
+export interface ManagedMcpOAuthActor {
+    userId?: string | null;
+    isInstanceAdmin?: boolean;
+    localImplicit?: boolean;
+}
+export interface ManagedMcpProviderScopeResult {
+    options: McpExternalScopeOption[];
+    selected?: McpExternalScopeOption;
+    providerSubject?: string | null;
+}
+export interface ManagedMcpOAuthServiceOptions {
+    deploymentMode: "local_trusted" | "authenticated";
+    serverPort: number;
+    authPublicBaseUrl?: string | null;
+    allowlists: McpDeploymentAllowlists;
+    dnsLookup?: McpDnsLookup;
+    oauthAuth?: OAuthAuth;
+    discoverProviderScope?: (input: {
+        provider: "supabase" | "linear" | "notion";
+        connection: McpConnectionRow;
+        material: ManagedMcpOAuthMaterial;
+        endpoint: string;
+    }) => Promise<ManagedMcpProviderScopeResult>;
+    refreshConnectionTools?: (orgId: string, connectionId: string, actor: {
+        userId?: string | null;
+        agentId?: string | null;
+    }) => Promise<unknown>;
+}
+/**
+ * Official identity tools return an actor plus an explicit workspace or
+ * organization. The actor id is never a valid Rudder connection scope.
+ */
+export declare function parseProviderWorkspaceScope(provider: "linear" | "notion", value: unknown): McpExternalScopeOption | null;
+export declare function managedMcpOAuthService(db: Db, options: ManagedMcpOAuthServiceOptions): {
+    start: (orgId: string, connectionId: string, actor: ManagedMcpOAuthActor) => Promise<McpOAuthStartResponse>;
+    callback: (rawInput: McpOAuthCallback) => Promise<McpOAuthCallbackResult>;
+    getGrantSummary: (orgId: string, connectionId: string) => Promise<McpOAuthGrantSummary>;
+    listScopeOptions: (orgId: string, connectionId: string) => Promise<McpExternalScopeOption[]>;
+    selectScope: (orgId: string, connectionId: string, rawSelection: McpScopeSelection, actor: ManagedMcpOAuthActor) => Promise<McpConnectionSummary>;
+    revoke: (orgId: string, connectionId: string, actor: ManagedMcpOAuthActor, reason?: string) => Promise<McpConnectionSummary>;
+    createCredential: (orgId: string, connectionId: string) => {
+        token(): Promise<string>;
+        refresh(): Promise<void>;
+        markNeedsReauth(): Promise<void>;
+    };
+    requireUsableGrant: (orgId: string, connectionId: string) => Promise<McpOAuthGrantRow>;
+    resolveProviderEndpoint: (row: McpConnectionRow) => string;
+    cleanupExpiredSessions: (orgId?: string, limit?: number) => Promise<number>;
+};
+export declare function isInvalidGrantOAuthError(error: unknown): boolean;
+export {};
+//# sourceMappingURL=oauth.d.ts.map

package/dist/services/mcp/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/services/mcp/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,WAAW,EAChB,KAAK,UAAU,EAEf,KAAK,mBAAmB,EAEzB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAGL,cAAc,EACd,cAAc,EAKf,MAAM,cAAc,CAAC;AACtB,OAAO,EAIL,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACvB,MAAM,kBAAkB,CAAC;AAuB1B,OAAO,EAGL,KAAK,uBAAuB,EAC7B,MAAM,qBAAqB,CAAC;AAM7B,OAAO,EAAwB,KAAK,uBAAuB,EAAE,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAE7G,KAAK,gBAAgB,GAAG,OAAO,cAAc,CAAC,YAAY,CAAC;AAC3D,KAAK,gBAAgB,GAAG,OAAO,cAAc,CAAC,YAAY,CAAC;AAG3D,KAAK,SAAS,GAAG,CACf,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,EAAE,WAAW,KACjB,OAAO,CAAC,UAAU,CAAC,CAAC;AAEzB,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAClC,QAAQ,CAAC,EAAE,sBAAsB,CAAC;IAClC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,6BAA6B;IAC5C,cAAc,EAAE,eAAe,GAAG,eAAe,CAAC;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,UAAU,EAAE,uBAAuB,CAAC;IACpC,SAAS,CAAC,EAAE,YAAY,CAAC;IACzB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,qBAAqB,CAAC,EAAE,CAAC,KAAK,EAAE;QAC9B,QAAQ,EAAE,UAAU,GAAG,QAAQ,GAAG,QAAQ,CAAC;QAC3C,UAAU,EAAE,gBAAgB,CAAC;QAC7B,QAAQ,EAAE,uBAAuB,CAAC;QAClC,QAAQ,EAAE,MAAM,CAAC;KAClB,KAAK,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAC7C,sBAAsB,CAAC,EAAE,CACvB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,KACvD,OAAO,CAAC,OAAO,CAAC,CAAC;CACvB;AA8RD;;;GAGG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,EAC7B,KAAK,EAAE,OAAO,GACb,sBAAsB,GAAG,IAAI,CA+C/B;AAmHD,wBAAgB,sBAAsB,CACpC,EAAE,EAAE,EAAE,EACN,OAAO,EAAE,6BAA6B;mBAoX7B,MAAM,gBACC,MAAM,SACb,oBAAoB,KAC1B,OAAO,CAAC,qBAAqB,CAAC;yBAoJC,gBAAgB,KAAG,OAAO,CAAC,sBAAsB,CAAC;6BA6a3E,MAAM,gBACC,MAAM,KACnB,OAAO,CAAC,oBAAoB,CAAC;8BAKvB,MAAM,gBACC,MAAM,KACnB,OAAO,CAAC,sBAAsB,EAAE,CAAC;yBAoB3B,MAAM,gBACC,MAAM,gBACN,iBAAiB,SACxB,oBAAoB,KAC1B,OAAO,CAAC,oBAAoB,CAAC;oBAmIvB,MAAM,gBACC,MAAM,SACb,oBAAoB,sBAE1B,OAAO,CAAC,oBAAoB,CAAC;8BAmdC,MAAM,gBAAgB,MAAM;iBAE1C,OAAO,CAAC,MAAM,CAAC;mBAGb,OAAO,CAAC,IAAI,CAAC;2BAeL,OAAO,CAAC,IAAI,CAAC;;gCAr9CjC,MAAM,gBACC,MAAM,KACnB,OAAO,CAAC,gBAAgB,CAAC;mCA4+CU,gBAAgB,KAAG,MAAM;qCA31CrD,MAAM,qBAEb,OAAO,CAAC,MAAM,CAAC;EA82CnB;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEhE"}