@samanhappy/mcphub 1.0.39 → 1.0.41

package/dist/betterAuth.js

@@ -50,6 +50,18 @@ if (runtimeConfig.providers.oidc.enabled &&
                 scopes: runtimeConfig.providers.oidc.scopes,
                 pkce: runtimeConfig.providers.oidc.pkce,
                 prompt: runtimeConfig.providers.oidc.prompt,
+                // Some OIDC issuers (e.g. self-hosted GitLab < 16.0) do not include
+                // a `name` claim in the ID token; better-auth only exposes it via
+                // the userinfo endpoint, which it skips whenever an id_token is
+                // present. Synthesize a display name from the remaining claims so
+                // that sign-in succeeds for such issuers.
+                mapProfileToUser: (profile) => ({
+                    name: profile.name ||
+                        profile.nickname ||
+                        profile.preferred_username ||
+                        (typeof profile.email === 'string' && profile.email.split('@')[0]) ||
+                        `oidc-${String(profile.id ?? profile.sub ?? '')}`,
+                }),
             },
         ],
     }));
@@ -86,8 +98,19 @@ const databaseUrl = process.env.DB_URL;
 if (!databaseUrl) {
     throw new Error('DB_URL is required for Better Auth PostgreSQL storage.');
 }
+// Keep the Better Auth pool aligned with the main TypeORM pool so a DB
+// incident cannot make Better Auth requests queue forever: pg defaults have no
+// connection timeout (wait indefinitely) and a max of 10 on top of TypeORM's
+// pool. Postgres-side safety valves (0 = PostgreSQL default / disabled) stop a
+// hung query or idle-in-transaction session from holding a connection
+// indefinitely (#1205).
 const pool = new Pool({
     connectionString: databaseUrl,
+    max: parseInt(process.env.DB_POOL_SIZE || '10', 10),
+    connectionTimeoutMillis: parseInt(process.env.DB_CONNECTION_TIMEOUT || '60000', 10),
+    idleTimeoutMillis: parseInt(process.env.DB_POOL_IDLE_TIMEOUT || '30000', 10),
+    statement_timeout: parseInt(process.env.DB_STATEMENT_TIMEOUT || '0', 10),
+    idle_in_transaction_session_timeout: parseInt(process.env.DB_IDLE_IN_TRANSACTION_TIMEOUT || '0', 10),
 });
 const database = new PostgresDialect({
     pool,

package/dist/betterAuth.js.map

@@ -1 +1 @@
-{"version":3,"file":"betterAuth.js","sourceRoot":"","sources":["../src/betterAuth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAqB,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC1B,OAAO,aAAa,EAAE,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EACL,wBAAwB,EACxB,8BAA8B,GAC/B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE3C,MAAM,mBAAmB,GAAG,GAAG,EAAE;IAC/B,MAAM,kBAAkB,GAAG,qBAAqB,EAAE,CAAC;IACnD,IAAI,kBAAkB,EAAE,CAAC;QACvB,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IAED,IAAI,CAAC,qBAAqB,EAAE,EAAE,CAAC;QAC7B,OAAO,YAAY,EAAE,CAAC,YAAY,IAAI,IAAI,CAAC;IAC7C,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,mBAAmB,EAAE,CAAC;AAC3C,MAAM,aAAa,GAAG,8BAA8B,CAAC,YAAY,CAAC,CAAC;AACnE,MAAM,eAAe,GAA+D,EAAE,CAAC;AACvF,MAAM,OAAO,GAAU,EAAE,CAAC;AAC1B,IACE,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO;IACtC,OAAO,CAAC,GAAG,CAAC,gBAAgB;IAC5B,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAChC,CAAC;IACD,eAAe,CAAC,MAAM,GAAG;QACvB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;QACtC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;KAC/C,CAAC;AACJ,CAAC;AACD,IACE,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO;IACtC,OAAO,CAAC,GAAG,CAAC,gBAAgB;IAC5B,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAChC,CAAC;IACD,eAAe,CAAC,MAAM,GAAG;QACvB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;QACtC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;KAC/C,CAAC;AACJ,CAAC;AACD,IACE,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO;IACpC,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY;IACzC,OAAO,CAAC,GAAG,CAAC,cAAc;IAC1B,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAC9B,CAAC;IACD,OAAO,CAAC,IAAI,CACV,YAAY,CAAC;QACX,MAAM,EAAE;YACN;gBACE,UAAU,EAAE,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU;gBACnD,YAAY,EAAE,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY;gBACvD,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc;gBACpC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;gBAC5C,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM;gBAC3C,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI;gBACvC,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM;aAC5C;SACF;KACF,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,mBAAmB,GAAG,CAAC,KAAa,EAAU,EAAE;IACpD,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QACzC,GAAG,IAAI,CAAC,CAAC;IACX,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7B,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,OAAe,EAAE,QAAgB,EAAU,EAAE;IACnE,MAAM,cAAc,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC;IAC5E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;YAChD,GAAG,CAAC,QAAQ,GAAG,cAAc,CAAC;YAC9B,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxB,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC1C,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxB,CAAC;QACD,GAAG,CAAC,QAAQ,GAAG,GAAG,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,cAAc,EAAE,CAAC;QACvE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,WAAW,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACjD,OAAO,GAAG,WAAW,GAAG,cAAc,EAAE,CAAC;IAC3C,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,YAAY,CAAC,CAAC;AACjE,MAAM,OAAO,GAAG,cAAc,CAC5B,iBAAiB,IAAI,oBAAoB,aAAa,CAAC,IAAI,GAAG,aAAa,CAAC,QAAQ,EAAE,EACtF,aAAa,CAAC,QAAQ,CACvB,CAAC;AAEF,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;AACvC,IAAI,CAAC,WAAW,EAAE,CAAC;IACjB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;IACpB,gBAAgB,EAAE,WAAW;CAC9B,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC;IACnC,IAAI;CACL,CAAC,CAAC;AAEH,MAAM,WAAW,GAAsB;IACrC,OAAO;IACP,QAAQ;IACR,gBAAgB,EAAE;QAChB,OAAO,EAAE,KAAK;KACf;IACD,OAAO,EAAE;QACP,cAAc,EAAE;YACd,OAAO,EAAE,IAAI;YACb,gBAAgB,EAAE;gBAChB,GAAG,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,IAAI,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU;oBACjF,CAAC,CAAC,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC;oBAC3C,CAAC,CAAC,EAAE,CAAC;aACR;SACF;KACF;IACD,OAAO;IACP,eAAe;IACf,cAAc,EAAE,aAAa,CAAC,cAAc;IAC5C,MAAM,EAAE;QACN,QAAQ,EAAE,KAAK;QACf,aAAa,EAAE,KAAK;QACpB,KAAK,EAAE,MAAM;QACb,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE;YAC/B,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;QAC3D,CAAC;KACF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,IAAI,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;AAE5C,MAAM,yBAAyB,GAAG,CAAC,KAAc,EAAiB,EAAE;IAClE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC;IAClE,OAAO,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,KAAK,IAAqB,EAAE;IACvD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAqB,mCAAmC,CAAC,CAAC;QACzF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,QAAQ,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,KAAK,EAAE,MAAc,EAAE,UAAoB,EAAwB,EAAE;IAC9F,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QACvB,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,mGAAmG,EACnG,CAAC,MAAM,EAAE,UAAU,CAAC,CACrB,CAAC;IACF,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;AAC3D,CAAC,CAAC;AAEF,MAAM,4BAA4B,GAAG,CAAC,KAAc,EAAW,EAAE;IAC/D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAE,KAA8B,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IACtE,OAAO,qCAAqC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC7D,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,IAAmB,EAAE;IAC9D,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;QAC3B,OAAO;IACT,CAAC;IAED,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;IACnE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;IAEnF,IAAI,CAAC,WAAW,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QAC7C,OAAO;IACT,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,WAAW;aAC3B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC;aAChD,MAAM,CAAC,CAAC,SAAS,EAAuB,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAClE,IAAI,UAAU,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,MAAM,oBAAoB,EAAE,CAAC;YAC5C,MAAM,cAAc,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACpE,MAAM,cAAc,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;YACtF,IAAI,cAAc,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;gBACxC,MAAM,CAAC,IAAI,CACT,qDAAqD,MAAM,yBAAyB,CACrF,CAAC;gBACF,OAAO;YACT,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,aAAa,EAAE,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,4BAA4B,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC,4DAA4D,EAAE,KAAK,CAAC,CAAC;YACjF,OAAO;QACT,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AACF,OAAO,EAAE,aAAa,IAAI,uBAAuB,EAAE,CAAC"}
+{"version":3,"file":"betterAuth.js","sourceRoot":"","sources":["../src/betterAuth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAqB,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC1B,OAAO,aAAa,EAAE,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EACL,wBAAwB,EACxB,8BAA8B,GAC/B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE3C,MAAM,mBAAmB,GAAG,GAAG,EAAE;IAC/B,MAAM,kBAAkB,GAAG,qBAAqB,EAAE,CAAC;IACnD,IAAI,kBAAkB,EAAE,CAAC;QACvB,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IAED,IAAI,CAAC,qBAAqB,EAAE,EAAE,CAAC;QAC7B,OAAO,YAAY,EAAE,CAAC,YAAY,IAAI,IAAI,CAAC;IAC7C,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,mBAAmB,EAAE,CAAC;AAC3C,MAAM,aAAa,GAAG,8BAA8B,CAAC,YAAY,CAAC,CAAC;AACnE,MAAM,eAAe,GAA+D,EAAE,CAAC;AACvF,MAAM,OAAO,GAAU,EAAE,CAAC;AAC1B,IACE,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO;IACtC,OAAO,CAAC,GAAG,CAAC,gBAAgB;IAC5B,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAChC,CAAC;IACD,eAAe,CAAC,MAAM,GAAG;QACvB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;QACtC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;KAC/C,CAAC;AACJ,CAAC;AACD,IACE,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO;IACtC,OAAO,CAAC,GAAG,CAAC,gBAAgB;IAC5B,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAChC,CAAC;IACD,eAAe,CAAC,MAAM,GAAG;QACvB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;QACtC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;KAC/C,CAAC;AACJ,CAAC;AACD,IACE,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO;IACpC,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY;IACzC,OAAO,CAAC,GAAG,CAAC,cAAc;IAC1B,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAC9B,CAAC;IACD,OAAO,CAAC,IAAI,CACV,YAAY,CAAC;QACX,MAAM,EAAE;YACN;gBACE,UAAU,EAAE,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU;gBACnD,YAAY,EAAE,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY;gBACvD,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc;gBACpC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;gBAC5C,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM;gBAC3C,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI;gBACvC,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM;gBAC3C,oEAAoE;gBACpE,kEAAkE;gBAClE,gEAAgE;gBAChE,kEAAkE;gBAClE,0CAA0C;gBAC1C,gBAAgB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;oBAC9B,IAAI,EACF,OAAO,CAAC,IAAI;wBACZ,OAAO,CAAC,QAAQ;wBAChB,OAAO,CAAC,kBAAkB;wBAC1B,CAAC,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;wBAClE,QAAQ,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE;iBACpD,CAAC;aACH;SACF;KACF,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,mBAAmB,GAAG,CAAC,KAAa,EAAU,EAAE;IACpD,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QACzC,GAAG,IAAI,CAAC,CAAC;IACX,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7B,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,OAAe,EAAE,QAAgB,EAAU,EAAE;IACnE,MAAM,cAAc,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC;IAC5E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;YAChD,GAAG,CAAC,QAAQ,GAAG,cAAc,CAAC;YAC9B,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxB,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC1C,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxB,CAAC;QACD,GAAG,CAAC,QAAQ,GAAG,GAAG,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,cAAc,EAAE,CAAC;QACvE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,WAAW,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACjD,OAAO,GAAG,WAAW,GAAG,cAAc,EAAE,CAAC;IAC3C,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,YAAY,CAAC,CAAC;AACjE,MAAM,OAAO,GAAG,cAAc,CAC5B,iBAAiB,IAAI,oBAAoB,aAAa,CAAC,IAAI,GAAG,aAAa,CAAC,QAAQ,EAAE,EACtF,aAAa,CAAC,QAAQ,CACvB,CAAC;AAEF,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;AACvC,IAAI,CAAC,WAAW,EAAE,CAAC;IACjB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;AAC5E,CAAC;AAED,uEAAuE;AACvE,+EAA+E;AAC/E,6EAA6E;AAC7E,+EAA+E;AAC/E,sEAAsE;AACtE,wBAAwB;AACxB,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;IACpB,gBAAgB,EAAE,WAAW;IAC7B,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,EAAE,EAAE,CAAC;IACnD,uBAAuB,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,OAAO,EAAE,EAAE,CAAC;IACnF,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,OAAO,EAAE,EAAE,CAAC;IAC5E,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,GAAG,EAAE,EAAE,CAAC;IACxE,mCAAmC,EAAE,QAAQ,CAC3C,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,GAAG,EACjD,EAAE,CACH;CACF,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC;IACnC,IAAI;CACL,CAAC,CAAC;AAEH,MAAM,WAAW,GAAsB;IACrC,OAAO;IACP,QAAQ;IACR,gBAAgB,EAAE;QAChB,OAAO,EAAE,KAAK;KACf;IACD,OAAO,EAAE;QACP,cAAc,EAAE;YACd,OAAO,EAAE,IAAI;YACb,gBAAgB,EAAE;gBAChB,GAAG,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,IAAI,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU;oBACjF,CAAC,CAAC,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC;oBAC3C,CAAC,CAAC,EAAE,CAAC;aACR;SACF;KACF;IACD,OAAO;IACP,eAAe;IACf,cAAc,EAAE,aAAa,CAAC,cAAc;IAC5C,MAAM,EAAE;QACN,QAAQ,EAAE,KAAK;QACf,aAAa,EAAE,KAAK;QACpB,KAAK,EAAE,MAAM;QACb,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE;YAC/B,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;QAC3D,CAAC;KACF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,IAAI,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;AAE5C,MAAM,yBAAyB,GAAG,CAAC,KAAc,EAAiB,EAAE;IAClE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC;IAClE,OAAO,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,KAAK,IAAqB,EAAE;IACvD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAqB,mCAAmC,CAAC,CAAC;QACzF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,QAAQ,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,KAAK,EAAE,MAAc,EAAE,UAAoB,EAAwB,EAAE;IAC9F,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QACvB,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,mGAAmG,EACnG,CAAC,MAAM,EAAE,UAAU,CAAC,CACrB,CAAC;IACF,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;AAC3D,CAAC,CAAC;AAEF,MAAM,4BAA4B,GAAG,CAAC,KAAc,EAAW,EAAE;IAC/D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAE,KAA8B,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IACtE,OAAO,qCAAqC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC7D,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,IAAmB,EAAE;IAC9D,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;QAC3B,OAAO;IACT,CAAC;IAED,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;IACnE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;IAEnF,IAAI,CAAC,WAAW,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QAC7C,OAAO;IACT,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,WAAW;aAC3B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC;aAChD,MAAM,CAAC,CAAC,SAAS,EAAuB,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAClE,IAAI,UAAU,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,MAAM,oBAAoB,EAAE,CAAC;YAC5C,MAAM,cAAc,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACpE,MAAM,cAAc,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;YACtF,IAAI,cAAc,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;gBACxC,MAAM,CAAC,IAAI,CACT,qDAAqD,MAAM,yBAAyB,CACrF,CAAC;gBACF,OAAO;YACT,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,aAAa,EAAE,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,4BAA4B,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC,4DAA4D,EAAE,KAAK,CAAC,CAAC;YACjF,OAAO;QACT,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AACF,OAAO,EAAE,aAAa,IAAI,uBAAuB,EAAE,CAAC"}

package/dist/controllers/mcpbController.js

@@ -3,6 +3,7 @@ import path from 'path';
 import fs from 'fs';
 import AdmZip from 'adm-zip';
 import { logger } from '../utils/logger.js';
+import { requireAdmin } from '../utils/requireAdmin.js';
 import { validateServerName } from '../utils/serverNameValidation.js';
 // Configure multer for file uploads
 const storage = multer.diskStorage({
@@ -80,6 +81,13 @@ const cleanupOldMcpbServer = (serverName) => {
 };
 export const uploadMcpbFile = async (req, res) => {
     try {
+        // Defense in depth: the route already gates this endpoint behind
+        // requireAdminMiddleware (before multer stages the body). Re-check here so
+        // the handler stays safe even if it is invoked through another path, since
+        // it replaces executable code at a deterministic path that existing stdio
+        // server configurations point into (GHSA-xf2m-3c3x-53vp).
+        if (!(await requireAdmin(req, res)))
+            return;
         if (!req.file) {
             res.status(400).json({
                 success: false,

package/dist/controllers/mcpbController.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcpbController.js","sourceRoot":"","sources":["../../src/controllers/mcpbController.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,MAAM,MAAM,SAAS,CAAC;AAE7B,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAEtE,oCAAoC;AACpC,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC;IACjC,WAAW,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,mBAAmB,CAAC,CAAC;QAChE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACtB,CAAC;IACD,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,mFAAmF;QACnF,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAChF,kBAAkB,EAClB,GAAG,CACJ,CAAC;QACF,EAAE,CAAC,IAAI,EAAE,GAAG,gBAAgB,IAAI,SAAS,OAAO,CAAC,CAAC;IACpD,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,MAAM,CAAC;IACpB,OAAO;IACP,UAAU,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE;QAC7B,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,MAAM,EAAE;QACN,QAAQ,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,cAAc;KAC5C;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AAE1D,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;AAE7D,MAAM,gBAAgB,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,eAAe,CAAC,CAAC;AAEjF,MAAM,sBAAsB,GAAG,CAAC,UAAmB,EAAU,EAAE;IAC7D,2EAA2E;IAC3E,iDAAiD;IACjD,MAAM,UAAU,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAClD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,UAAU,CAAC,UAAoB,CAAC;AACzC,CAAC,CAAC;AAEF,MAAM,2BAA2B,GAAG,CAAC,OAAe,EAAE,UAAkB,EAAU,EAAE;IAClF,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,UAAU,UAAU,EAAE,CAAC,CAAC;IAChF,MAAM,kBAAkB,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;IAE7E,IAAI,kBAAkB,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IAED,OAAO,iBAAiB,CAAC;AAC3B,CAAC,CAAC;AAEF,+DAA+D;AAC/D,MAAM,oBAAoB,GAAG,CAAC,UAAkB,EAAQ,EAAE;IACxD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;QACrC,MAAM,aAAa,GAAG,UAAU,UAAU,EAAE,CAAC;QAE7C,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YACxC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;gBACrB,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;oBACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;oBAC5C,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;wBACxC,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;wBACtD,MAAM,CAAC,GAAG,CAAC,yCAAyC,QAAQ,EAAE,CAAC,CAAC;oBAClE,CAAC;gBACH,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAC;QAC/D,+CAA+C;IACjD,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,GAAY,EAAE,GAAa,EAAiB,EAAE;IACjF,IAAI,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,uBAAuB;aACjC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC;QACpC,MAAM,UAAU,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACpE,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,uBAAuB;aAC/E,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,kBAAkB,SAAS,EAAE,CAAC,CAAC;QAE5F,IAAI,CAAC;YACH,gFAAgF;YAChF,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC;YACrC,GAAG,CAAC,YAAY,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;YAEvC,sCAAsC;YACtC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;YAChE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC1D,CAAC;YAED,MAAM,eAAe,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YAE7C,uCAAuC;YACvC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACvD,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,cAAc,GAAG,sBAAsB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAE7D,kFAAkF;YAClF,MAAM,eAAe,GAAG,2BAA2B,CACjD,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAC1B,cAAc,CACf,CAAC;YAEF,+CAA+C;YAC/C,oBAAoB,CAAC,cAAc,CAAC,CAAC;YACrC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBACpC,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,CAAC;YAED,qDAAqD;YACrD,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;YAC/C,MAAM,CAAC,GAAG,CAAC,6BAA6B,eAAe,EAAE,CAAC,CAAC;YAE3D,kCAAkC;YAClC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;YAE5B,MAAM,QAAQ,GAAgB;gBAC5B,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE;oBACJ,QAAQ;oBACR,UAAU,EAAE,eAAe;iBAC5B;aACF,CAAC;YAEF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACtB,0BAA0B;YAC1B,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBAChC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;YAC9B,CAAC;YACD,IAAI,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;gBAClC,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,MAAM,YAAY,CAAC;QACrB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;QAE1C,IAAI,OAAO,GAAG,6BAA6B,CAAC;QAC5C,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC1B,CAAC;QAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,OAAO;SACR,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC"}
+{"version":3,"file":"mcpbController.js","sourceRoot":"","sources":["../../src/controllers/mcpbController.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,MAAM,MAAM,SAAS,CAAC;AAE7B,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAEtE,oCAAoC;AACpC,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC;IACjC,WAAW,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,mBAAmB,CAAC,CAAC;QAChE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACtB,CAAC;IACD,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,mFAAmF;QACnF,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAChF,kBAAkB,EAClB,GAAG,CACJ,CAAC;QACF,EAAE,CAAC,IAAI,EAAE,GAAG,gBAAgB,IAAI,SAAS,OAAO,CAAC,CAAC;IACpD,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,MAAM,CAAC;IACpB,OAAO;IACP,UAAU,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE;QAC7B,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,MAAM,EAAE;QACN,QAAQ,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,cAAc;KAC5C;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AAE1D,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;AAE7D,MAAM,gBAAgB,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,eAAe,CAAC,CAAC;AAEjF,MAAM,sBAAsB,GAAG,CAAC,UAAmB,EAAU,EAAE;IAC7D,2EAA2E;IAC3E,iDAAiD;IACjD,MAAM,UAAU,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAClD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,UAAU,CAAC,UAAoB,CAAC;AACzC,CAAC,CAAC;AAEF,MAAM,2BAA2B,GAAG,CAAC,OAAe,EAAE,UAAkB,EAAU,EAAE;IAClF,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,UAAU,UAAU,EAAE,CAAC,CAAC;IAChF,MAAM,kBAAkB,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;IAE7E,IAAI,kBAAkB,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IAED,OAAO,iBAAiB,CAAC;AAC3B,CAAC,CAAC;AAEF,+DAA+D;AAC/D,MAAM,oBAAoB,GAAG,CAAC,UAAkB,EAAQ,EAAE;IACxD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;QACrC,MAAM,aAAa,GAAG,UAAU,UAAU,EAAE,CAAC;QAE7C,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YACxC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;gBACrB,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;oBACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;oBAC5C,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;wBACxC,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;wBACtD,MAAM,CAAC,GAAG,CAAC,yCAAyC,QAAQ,EAAE,CAAC,CAAC;oBAClE,CAAC;gBACH,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAC;QAC/D,+CAA+C;IACjD,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,GAAY,EAAE,GAAa,EAAiB,EAAE;IACjF,IAAI,CAAC;QACH,iEAAiE;QACjE,2EAA2E;QAC3E,2EAA2E;QAC3E,0EAA0E;QAC1E,0DAA0D;QAC1D,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAAE,OAAO;QAE5C,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,uBAAuB;aACjC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC;QACpC,MAAM,UAAU,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACpE,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,uBAAuB;aAC/E,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,kBAAkB,SAAS,EAAE,CAAC,CAAC;QAE5F,IAAI,CAAC;YACH,gFAAgF;YAChF,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC;YACrC,GAAG,CAAC,YAAY,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;YAEvC,sCAAsC;YACtC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;YAChE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC1D,CAAC;YAED,MAAM,eAAe,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YAE7C,uCAAuC;YACvC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACvD,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,cAAc,GAAG,sBAAsB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAE7D,kFAAkF;YAClF,MAAM,eAAe,GAAG,2BAA2B,CACjD,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAC1B,cAAc,CACf,CAAC;YAEF,+CAA+C;YAC/C,oBAAoB,CAAC,cAAc,CAAC,CAAC;YACrC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBACpC,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,CAAC;YAED,qDAAqD;YACrD,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;YAC/C,MAAM,CAAC,GAAG,CAAC,6BAA6B,eAAe,EAAE,CAAC,CAAC;YAE3D,kCAAkC;YAClC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;YAE5B,MAAM,QAAQ,GAAgB;gBAC5B,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE;oBACJ,QAAQ;oBACR,UAAU,EAAE,eAAe;iBAC5B;aACF,CAAC;YAEF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACtB,0BAA0B;YAC1B,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBAChC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;YAC9B,CAAC;YACD,IAAI,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;gBAClC,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,MAAM,YAAY,CAAC;QACrB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;QAE1C,IAAI,OAAO,GAAG,6BAA6B,CAAC;QAC5C,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC1B,CAAC;QAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,OAAO;SACR,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC"}

package/dist/controllers/oauthCallbackController.js

@@ -14,7 +14,7 @@
  *    - Exchange the code for tokens using PKCE
  *    - Save tokens via our OAuthClientProvider.saveTokens()
  */
-import { getServerByName, getServerByOAuthState, connectClientWithDiagnostics, createTransportFromConfig, updateServerToolsCache, } from '../services/mcpService.js';
+import { getServerByOAuthState, getServerByPendingOAuthState, connectClientWithDiagnostics, createTransportFromConfig, updateServerToolsCache, } from '../services/mcpService.js';
 import { replaceEnvVars } from '../config/index.js';
 import { loadServerConfig } from '../services/oauthSettingsStore.js';
 import { validateAuthorizationIss } from '../utils/oauthIssuer.js';
@@ -104,23 +104,82 @@ const normalizeQueryParam = (value) => {
     }
     return undefined;
 };
-const extractServerNameFromState = (stateValue) => {
-    try {
-        const normalized = stateValue.replace(/-/g, '+').replace(/_/g, '/');
-        const padding = (4 - (normalized.length % 4)) % 4;
-        const base64 = normalized + '='.repeat(padding);
-        const decoded = Buffer.from(base64, 'base64').toString('utf8');
-        const payload = JSON.parse(decoded);
-        if (payload && typeof payload.server === 'string') {
-            return payload.server;
+/**
+ * OAuth `state` is a server-generated, unguessable, single-use value bound to
+ * the in-flight authorization of exactly one server (see
+ * MCPHubOAuthProvider.generateState). The callback MUST resolve the target
+ * server only by exact match against a stored state — never by decoding the
+ * supplied value or falling back to a server name embedded in it
+ * (GHSA-vc28-27px-x492).
+ */
+const OAUTH_STATE_TTL_MS = 10 * 60 * 1000; // 10 minutes
+/** States whose authorization has already been completed (single-use). */
+const consumedOAuthStates = new Map(); // state -> consumedAt
+const pruneConsumedOAuthStates = () => {
+    const now = Date.now();
+    for (const [state, consumedAt] of consumedOAuthStates) {
+        if (now - consumedAt > OAUTH_STATE_TTL_MS) {
+            consumedOAuthStates.delete(state);
         }
     }
-    catch (error) {
-        // Ignore decoding errors and fall back to delimiter-based parsing
+};
+/**
+ * Reset the in-memory OAuth state bookkeeping (the consumed-state set). This is
+ * a no-op in production use and exists so test suites start from a clean slate
+ * between cases.
+ */
+export const resetOAuthStateTrackingForTests = () => {
+    consumedOAuthStates.clear();
+};
+/**
+ * True when `state` is the current in-flight authorization state of the server.
+ * Requires an exact match against the stored state (in-memory or persisted) and
+ * rejects states that are stale beyond the TTL.
+ */
+const isOAuthStateCurrent = (serverInfo, state) => {
+    const inMemoryState = serverInfo.oauth?.state;
+    const pendingState = serverInfo.config?.oauth?.pendingAuthorization?.state;
+    const storedStates = [inMemoryState, pendingState].filter((s) => typeof s === 'string');
+    // Exact match only. A state that does not equal the server's current
+    // in-flight authorization is rejected outright.
+    if (storedStates.length === 0 || !storedStates.includes(state)) {
+        return false;
     }
-    const separatorIndex = stateValue.indexOf(':');
-    if (separatorIndex > 0) {
-        return stateValue.slice(0, separatorIndex);
+    const createdAt = serverInfo.config?.oauth?.pendingAuthorization?.createdAt;
+    if (createdAt !== undefined && Date.now() - createdAt > OAUTH_STATE_TTL_MS) {
+        logger.warn('OAuth callback state expired; rejecting', {
+            serverName: serverInfo.name,
+        });
+        return false;
+    }
+    return true;
+};
+/**
+ * Resolve the server targeted by an OAuth callback from its `state` parameter.
+ *
+ * The state must be an unexpired, unconsumed, exact match against a stored
+ * server-generated state. There is deliberately no fallback that interprets the
+ * state as a server name — an attacker who forges `state` cannot select which
+ * server's authorization to drive (GHSA-vc28-27px-x492).
+ */
+const resolveServerByOAuthState = (state) => {
+    pruneConsumedOAuthStates();
+    if (consumedOAuthStates.has(state)) {
+        logger.warn('OAuth callback state already consumed; rejecting', {
+            serverName: '<redacted>',
+        });
+        return undefined;
+    }
+    // In-memory match: serverInfo.oauth.state is set when redirectToAuthorization
+    // ran against a live transport in this process.
+    const serverInfo = getServerByOAuthState(state);
+    if (serverInfo && isOAuthStateCurrent(serverInfo, state)) {
+        return serverInfo;
+    }
+    // Restart recovery: match against the persisted pendingAuthorization.state.
+    const pendingServerInfo = getServerByPendingOAuthState(state);
+    if (pendingServerInfo && isOAuthStateCurrent(pendingServerInfo, state)) {
+        return pendingServerInfo;
     }
     return undefined;
 };
@@ -132,7 +191,8 @@ const extractServerNameFromState = (stateValue) => {
  *
  * Expected query parameters:
  * - code: Authorization code from OAuth provider
- * - state: Encoded server identifier used for OAuth session validation
+ * - state: Server-generated, unguessable, single-use authorization state bound
+ *   to the in-flight authorization of exactly one server
  * - error: Optional error code if authorization failed
  * - error_description: Optional error description
  */
@@ -175,38 +235,16 @@ export const handleOAuthCallback = async (req, res) => {
                 .send(generateHtmlResponse(t, 'error', t('oauthCallback.invalidRequest'), t('oauthCallback.missingCodeParameter')));
         }
         logger.log('OAuth callback received', { hasCode: true, state: stateParam });
-        // Find server by state parameter
-        let serverInfo;
-        serverInfo = getServerByOAuthState(stateParam);
-        let decodedServerName;
+        // Find the target server by the state parameter. Resolution is exact-match
+        // only against a stored, server-generated state; a forged state cannot name
+        // a server (GHSA-vc28-27px-x492).
+        const serverInfo = resolveServerByOAuthState(stateParam);
         if (!serverInfo) {
-            decodedServerName = extractServerNameFromState(stateParam);
-            if (decodedServerName) {
-                logger.log('State lookup failed; decoded server name from state', {
-                    decodedServerName,
-                });
-                serverInfo = getServerByName(decodedServerName);
-            }
-        }
-        if (!serverInfo) {
-            logger.error('No server found for OAuth callback', {
-                state: stateParam,
-                decodedServerName,
-            });
+            logger.error('No server found for OAuth callback', { state: stateParam });
             return res
                 .status(400)
                 .send(generateHtmlResponse(t, 'error', t('oauthCallback.serverNotFound'), `${t('oauthCallback.serverNotFoundMessage')}\n${t('oauthCallback.sessionExpiredMessage')}`));
         }
-        // Optional: Validate state parameter for additional security
-        if (serverInfo.oauth?.state && serverInfo.oauth.state !== stateParam) {
-            logger.warn('OAuth state mismatch detected', {
-                serverName: serverInfo.name,
-                // State values are considered sensitive and are not logged
-                expectedState: '<redacted>',
-                receivedState: '<redacted>',
-            });
-            // Note: We log a warning but don't fail the request since we have server name as primary identifier
-        }
         logger.log('Processing OAuth callback for server', { serverName: serverInfo.name });
         // RFC 9207 / SEP-2468: when the authorization response carries `iss`,
         // validate it against the issuer we sent the authorization request to
@@ -240,6 +278,10 @@ export const handleOAuthCallback = async (req, res) => {
                 logger.log('Calling transport.finishAuth for server', { serverName: serverInfo.name });
                 const currentTransport = serverInfo.transport;
                 await currentTransport.finishAuth(codeParam);
+                // The state has served its purpose: the code was exchanged and the
+                // server now holds the resulting tokens. Mark it consumed so a replayed
+                // callback with the same state is rejected (single-use, GHSA-vc28-27px-x492).
+                consumedOAuthStates.set(stateParam, Date.now());
                 logger.log('Successfully exchanged authorization code for tokens', {
                     serverName: serverInfo.name,
                 });

package/dist/controllers/oauthCallbackController.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauthCallbackController.js","sourceRoot":"","sources":["../../src/controllers/oauthCallbackController.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,4BAA4B,EAC5B,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAEnE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C;;GAEG;AACH,MAAM,UAAU,GAAG,CAAC,KAAa,EAAU,EAAE,CAC3C,KAAK;KACF,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;KACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;KACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;KACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;KACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAE5B;;;;;GAKG;AACH,MAAM,oBAAoB,GAAG,CAC3B,CAA0B,EAC1B,IAAyB,EACzB,KAAa,EACb,OAAe,EACf,OAA4C,EAC5C,YAAqB,KAAK,EAClB,EAAE;IACV,MAAM,SAAS,GAAG,IAAI,KAAK,SAAS,CAAC;IACrC,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,MAAM,aAAa,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,MAAM,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAEnC,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,yEAAyE;IACzE,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACjE,MAAM,gBAAgB,GAAG,UAAU,CACjC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,2BAA2B,CAAC,CACtE,CAAC;IACF,MAAM,eAAe,GAAG,UAAU,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC;IAExE,OAAO;;;;;;iBAMQ,SAAS;;;;;;wJAM8H,aAAa,YAAY,WAAW;;;;;;;;;;;;qCAYvJ,YAAY;;;;;;;UAOvC,SAAS,CAAC,CAAC,CAAC,+DAA+D,CAAC,CAAC,CAAC,EAAE;;;;mCAIvD,IAAI,UAAU,SAAS;YAE9C,OAAO;QACL,CAAC,CAAC,OAAO;aACJ,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,qBAAqB,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CACpJ;aACA,IAAI,CAAC,EAAE,CAAC;QACb,CAAC,CAAC,EACN;YACE,OAAO,CAAC,CAAC,CAAC,sBAAsB,WAAW,MAAM,CAAC,CAAC,CAAC,EAAE;YACtD,SAAS,CAAC,CAAC,CAAC,wBAAwB,eAAe,MAAM,CAAC,CAAC,CAAC,EAAE;+DACX,gBAAgB;;;;GAI5E,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAAC,KAAc,EAAsB,EAAE;IACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;QACtB,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,MAAM,0BAA0B,GAAG,CAAC,UAAkB,EAAsB,EAAE;IAC5E,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEpC,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAClD,OAAO,OAAO,CAAC,MAAM,CAAC;QACxB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kEAAkE;IACpE,CAAC;IAED,MAAM,cAAc,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IACvE,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;QAC5D,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAE9C,iEAAiE;QACjE,MAAM,CAAC,GAAI,GAAW,CAAC,CAAC,IAAI,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QAEnD,iCAAiC;QACjC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE;gBACzC,KAAK;gBACL,gBAAgB,EAAE,iBAAiB,IAAI,EAAE;aAC1C,CAAC,CAAC;YACH,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CACzB,oBAAoB,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,mCAAmC,CAAC,EAAE,EAAE,EAAE;gBAC3E,EAAE,KAAK,EAAE,CAAC,CAAC,wCAAwC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE;gBAC5E,GAAG,CAAC,iBAAiB;oBACnB,CAAC,CAAC;wBACE;4BACE,KAAK,EAAE,CAAC,CAAC,0CAA0C,CAAC;4BACpD,KAAK,EAAE,MAAM,CAAC,iBAAiB,CAAC;yBACjC;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CACH,CAAC;QACJ,CAAC;QAED,+BAA+B;QAC/B,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;YACvD,OAAO,GAAG;iBACP,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CACH,oBAAoB,CAClB,CAAC,EACD,OAAO,EACP,CAAC,CAAC,8BAA8B,CAAC,EACjC,CAAC,CAAC,qCAAqC,CAAC,CACzC,CACF,CAAC;QACN,CAAC;QAED,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC1D,OAAO,GAAG;iBACP,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CACH,oBAAoB,CAClB,CAAC,EACD,OAAO,EACP,CAAC,CAAC,8BAA8B,CAAC,EACjC,CAAC,CAAC,oCAAoC,CAAC,CACxC,CACF,CAAC;QACN,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,yBAAyB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAE5E,iCAAiC;QACjC,IAAI,UAAkC,CAAC;QAEvC,UAAU,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;QAE/C,IAAI,iBAAqC,CAAC;QAC1C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,iBAAiB,GAAG,0BAA0B,CAAC,UAAU,CAAC,CAAC;YAC3D,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,CAAC,GAAG,CAAC,qDAAqD,EAAE;oBAChE,iBAAiB;iBAClB,CAAC,CAAC;gBACH,UAAU,GAAG,eAAe,CAAC,iBAAiB,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE;gBACjD,KAAK,EAAE,UAAU;gBACjB,iBAAiB;aAClB,CAAC,CAAC;YACH,OAAO,GAAG;iBACP,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CACH,oBAAoB,CAClB,CAAC,EACD,OAAO,EACP,CAAC,CAAC,8BAA8B,CAAC,EACjC,GAAG,CAAC,CAAC,qCAAqC,CAAC,KAAK,CAAC,CAAC,qCAAqC,CAAC,EAAE,CAC3F,CACF,CAAC;QACN,CAAC;QAED,6DAA6D;QAC7D,IAAI,UAAU,CAAC,KAAK,EAAE,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YACrE,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;gBAC3C,UAAU,EAAE,UAAU,CAAC,IAAI;gBAC3B,2DAA2D;gBAC3D,aAAa,EAAE,YAAY;gBAC3B,aAAa,EAAE,YAAY;aAC5B,CAAC,CAAC;YACH,oGAAoG;QACtG,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,sCAAsC,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;QAEpF,sEAAsE;QACtE,sEAAsE;QACtE,uEAAuE;QACvE,uCAAuC;QACvC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,wBAAwB,CAAC;YACzC,GAAG,EAAE,QAAQ;YACb,gBAAgB,EACd,UAAU,CAAC,KAAK,EAAE,gBAAgB;gBAClC,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,oBAAoB,EAAE,gBAAgB;YAClE,gBAAgB,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM;SACxE,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE;gBACnD,UAAU,EAAE,UAAU,CAAC,IAAI;gBAC3B,MAAM,EAAE,SAAS,CAAC,MAAM;aACzB,CAAC,CAAC;YACH,OAAO,GAAG;iBACP,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CACH,oBAAoB,CAClB,CAAC,EACD,OAAO,EACP,CAAC,CAAC,mCAAmC,CAAC,EACtC,SAAS,CAAC,MAAM,CACjB,CACF,CAAC;QACN,CAAC;QACD,IAAI,QAAQ,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,uEAAuE,EAAE;gBACnF,UAAU,EAAE,UAAU,CAAC,IAAI;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,mFAAmF;QACnF,qEAAqE;QACrE,IAAI,UAAU,CAAC,SAAS,IAAI,YAAY,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;YACjE,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,CAAC,yCAAyC,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;gBACvF,MAAM,gBAAgB,GAAG,UAAU,CAAC,SAAgB,CAAC;gBACrD,MAAM,gBAAgB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;gBAE7C,MAAM,CAAC,GAAG,CAAC,sDAAsD,EAAE;oBACjE,UAAU,EAAE,UAAU,CAAC,IAAI;iBAC5B,CAAC,CAAC;gBAEH,wFAAwF;gBACxF,oFAAoF;gBACpF,qFAAqF;gBACrF,uFAAuF;gBACvF,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBAC5D,MAAM,eAAe,GAAG,WAAW;oBACjC,CAAC,CAAE,cAAc,CAAC,WAAkB,CAAwB;oBAC5D,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;gBAEtB,IAAI,CAAC,eAAe,EAAE,CAAC;oBACrB,MAAM,IAAI,KAAK,CACb,oCAAoC,UAAU,CAAC,IAAI,uBAAuB,CAC3E,CAAC;gBACJ,CAAC;gBAED,iDAAiD;gBACjD,UAAU,CAAC,MAAM,GAAG,eAAe,CAAC;gBAEpC,sEAAsE;gBACtE,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;oBACxB,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,IAAI,EAAE,CAAC;oBACpD,UAAU,CAAC,OAAO,GAAG;wBACnB,OAAO,EAAE,aAAa,CAAC,OAAO,IAAI,KAAK;wBACvC,sBAAsB,EAAE,aAAa,CAAC,sBAAsB,IAAI,IAAI;wBACpE,eAAe,EAAE,aAAa,CAAC,eAAe;qBAC/C,CAAC;gBACJ,CAAC;gBAED,sFAAsF;gBACtF,IAAI,CAAC;oBACH,IAAI,UAAU,CAAC,SAAS,IAAI,OAAO,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;wBAC5D,MAAO,UAAU,CAAC,SAAiB,CAAC,KAAK,EAAE,CAAC;oBAC9C,CAAC;gBACH,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,MAAM,CAAC,IAAI,CAAC,2DAA2D,EAAE;wBACvE,UAAU,EAAE,UAAU,CAAC,IAAI;wBAC3B,KAAK,EAAE,UAAU;qBAClB,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,CAAC,GAAG,CAAC,iDAAiD,EAAE;oBAC5D,UAAU,EAAE,UAAU,CAAC,IAAI;iBAC5B,CAAC,CAAC;gBACH,MAAM,kBAAkB,GAAG,MAAM,yBAAyB,CACxD,UAAU,CAAC,IAAI,EACf,eAAe,CAChB,CAAC;gBACF,UAAU,CAAC,SAAS,GAAG,kBAAkB,CAAC;gBAE1C,0EAA0E;gBAC1E,UAAU,CAAC,MAAM,GAAG,YAAY,CAAC;gBACjC,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;oBACrB,UAAU,CAAC,KAAK,CAAC,gBAAgB,GAAG,SAAS,CAAC;oBAC9C,UAAU,CAAC,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC;gBACrC,CAAC;gBAED,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;oBAChD,MAAM,mBAAmB,GAAG,IAAI,KAAK,CACnC,oBAAoB,UAAU,CAAC,IAAI,8DAA8D,CAClG,CAAC;oBACF,UAAU,CAAC,MAAM,GAAG,cAAc,CAAC;oBACnC,UAAU,CAAC,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC;oBAC/C,MAAM,mBAAmB,CAAC;gBAC5B,CAAC;gBAED,MAAM,CAAC,GAAG,CAAC,4CAA4C,EAAE;oBACvD,UAAU,EAAE,UAAU,CAAC,IAAI;iBAC5B,CAAC,CAAC;gBACH,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,CAAC;gBAC1C,MAAM,kBAAkB,GAAG,UAAU,CAAC,SAAS,CAAC;gBAChD,IAAI,CAAC;oBACH,MAAM,4BAA4B,CAChC,eAAe,EACf,kBAAkB,EAClB,UAAU,CAAC,OAAO,CACnB,CAAC;gBACJ,CAAC;gBAAC,OAAO,YAAY,EAAE,CAAC;oBACtB,UAAU,CAAC,MAAM,GAAG,cAAc,CAAC;oBACnC,UAAU,CAAC,KAAK,GAAG,2CACjB,YAAY,YAAY,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAC5E,EAAE,CAAC;oBACH,MAAM,CAAC,KAAK,CAAC,8CAA8C,EAAE;wBAC3D,UAAU,EAAE,UAAU,CAAC,IAAI;wBAC3B,KAAK,EAAE,YAAY;qBACpB,CAAC,CAAC;oBACH,IAAI,YAAY,YAAY,KAAK,EAAE,CAAC;wBAClC,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE;4BACzD,UAAU,EAAE,UAAU,CAAC,IAAI;4BAC3B,OAAO,EAAE,YAAY,CAAC,OAAO;4BAC7B,KAAK,EAAE,YAAY,CAAC,KAAK;yBAC1B,CAAC,CAAC;oBACL,CAAC;oBAED,IAAI,CAAC;wBACH,MAAM,eAAe,CAAC,KAAK,EAAE,CAAC;oBAChC,CAAC;oBAAC,OAAO,gBAAgB,EAAE,CAAC;wBAC1B,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE;4BAClE,UAAU,EAAE,UAAU,CAAC,IAAI;4BAC3B,KAAK,EAAE,gBAAgB;yBACxB,CAAC,CAAC;oBACL,CAAC;oBAED,IAAI,CAAC;wBACH,MAAM,kBAAkB,CAAC,KAAK,EAAE,CAAC;oBACnC,CAAC;oBAAC,OAAO,mBAAmB,EAAE,CAAC;wBAC7B,MAAM,CAAC,IAAI,CAAC,yDAAyD,EAAE;4BACrE,UAAU,EAAE,UAAU,CAAC,IAAI;4BAC3B,KAAK,EAAE,mBAAmB;yBAC3B,CAAC,CAAC;oBACL,CAAC;oBAED,IAAI,UAAU,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;wBAC1C,UAAU,CAAC,MAAM,GAAG,SAAS,CAAC;oBAChC,CAAC;oBACD,IAAI,UAAU,CAAC,SAAS,KAAK,kBAAkB,EAAE,CAAC;wBAChD,UAAU,CAAC,SAAS,GAAG,SAAS,CAAC;oBACnC,CAAC;oBAED,MAAM,YAAY,CAAC;gBACrB,CAAC;gBAED,UAAU,CAAC,MAAM,GAAG,WAAW,CAAC;gBAChC,UAAU,CAAC,KAAK,GAAG,IAAI,CAAC;gBACxB,MAAM,CAAC,GAAG,CAAC,oDAAoD,EAAE;oBAC/D,UAAU,EAAE,UAAU,CAAC,IAAI;iBAC5B,CAAC,CAAC;gBAEH,2EAA2E;gBAC3E,8DAA8D;gBAC9D,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC;gBAC/D,MAAM,CAAC,GAAG,CAAC,0CAA0C,EAAE;oBACrD,UAAU,EAAE,UAAU,CAAC,IAAI;oBAC3B,YAAY;iBACb,CAAC,CAAC;gBAEH,IAAI,YAAY,EAAE,KAAK,EAAE,CAAC;oBACxB,MAAM,CAAC,GAAG,CAAC,oCAAoC,EAAE;wBAC/C,UAAU,EAAE,UAAU,CAAC,IAAI;qBAC5B,CAAC,CAAC;oBACH,IAAI,CAAC;wBACH,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;wBAC9E,sBAAsB,CAAC,UAAU,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;wBACtD,MAAM,CAAC,GAAG,CAAC,mCAAmC,EAAE;4BAC9C,UAAU,EAAE,UAAU,CAAC,IAAI;4BAC3B,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM;yBACnC,CAAC,CAAC;oBACL,CAAC;oBAAC,OAAO,cAAc,EAAE,CAAC;wBACxB,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE;4BACxD,UAAU,EAAE,UAAU,CAAC,IAAI;4BAC3B,KAAK,EAAE,cAAc;yBACtB,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,GAAG,CAAC,+DAA+D,EAAE;wBAC1E,UAAU,EAAE,UAAU,CAAC,IAAI;qBAC5B,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,CAAC,GAAG,CAAC,8CAA8C,EAAE;oBACzD,UAAU,EAAE,UAAU,CAAC,IAAI;iBAC5B,CAAC,CAAC;gBAEH,sBAAsB;gBACtB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CACzB,oBAAoB,CAClB,CAAC,EACD,SAAS,EACT,CAAC,CAAC,uCAAuC,CAAC,EAC1C,CAAC,CAAC,8BAA8B,CAAC,EACjC;oBACE,EAAE,KAAK,EAAE,CAAC,CAAC,sBAAsB,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,EAAE;oBAC5D,EAAE,KAAK,EAAE,CAAC,CAAC,sBAAsB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,yBAAyB,CAAC,EAAE;iBAC1E,EACD,IAAI,CACL,CACF,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE;oBACvD,UAAU,EAAE,UAAU,CAAC,IAAI;oBAC3B,KAAK;iBACN,CAAC,CAAC;gBACH,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE;oBAC3C,UAAU,EAAE,UAAU,CAAC,IAAI;oBAC3B,SAAS,EAAE,OAAO,KAAK;oBACvB,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI;oBACnC,YAAY,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;oBACpE,UAAU,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB;iBACpE,CAAC,CAAC;gBAEH,OAAO,GAAG;qBACP,MAAM,CAAC,GAAG,CAAC;qBACX,IAAI,CACH,oBAAoB,CAClB,CAAC,EACD,OAAO,EACP,CAAC,CAAC,+BAA+B,CAAC,EAClC,GAAG,CAAC,CAAC,sCAAsC,CAAC,KAAK,CAAC,CAAC,gCAAgC,CAAC,EAAE,EACtF,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAC/E,CACF,CAAC;YACN,CAAC;QACH,CAAC;aAAM,CAAC;YACN,iEAAiE;YACjE,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;YACvF,OAAO,GAAG;iBACP,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CACH,oBAAoB,CAClB,CAAC,EACD,OAAO,EACP,CAAC,CAAC,kCAAkC,CAAC,EACrC,CAAC,CAAC,yCAAyC,CAAC,CAC7C,CACF,CAAC;QACN,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAEpE,iEAAiE;QACjE,MAAM,CAAC,GAAI,GAAW,CAAC,CAAC,IAAI,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QAEnD,OAAO,GAAG;aACP,MAAM,CAAC,GAAG,CAAC;aACX,IAAI,CACH,oBAAoB,CAClB,CAAC,EACD,OAAO,EACP,CAAC,CAAC,6BAA6B,CAAC,EAChC,CAAC,CAAC,oCAAoC,CAAC,CACxC,CACF,CAAC;IACN,CAAC;AACH,CAAC,CAAC"}
+{"version":3,"file":"oauthCallbackController.js","sourceRoot":"","sources":["../../src/controllers/oauthCallbackController.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,4BAA4B,EAC5B,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAEnE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C;;GAEG;AACH,MAAM,UAAU,GAAG,CAAC,KAAa,EAAU,EAAE,CAC3C,KAAK;KACF,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;KACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;KACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;KACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;KACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAE5B;;;;;GAKG;AACH,MAAM,oBAAoB,GAAG,CAC3B,CAA0B,EAC1B,IAAyB,EACzB,KAAa,EACb,OAAe,EACf,OAA4C,EAC5C,YAAqB,KAAK,EAClB,EAAE;IACV,MAAM,SAAS,GAAG,IAAI,KAAK,SAAS,CAAC;IACrC,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,MAAM,aAAa,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,MAAM,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAEnC,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,yEAAyE;IACzE,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACjE,MAAM,gBAAgB,GAAG,UAAU,CACjC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,2BAA2B,CAAC,CACtE,CAAC;IACF,MAAM,eAAe,GAAG,UAAU,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC;IAExE,OAAO;;;;;;iBAMQ,SAAS;;;;;;wJAM8H,aAAa,YAAY,WAAW;;;;;;;;;;;;qCAYvJ,YAAY;;;;;;;UAOvC,SAAS,CAAC,CAAC,CAAC,+DAA+D,CAAC,CAAC,CAAC,EAAE;;;;mCAIvD,IAAI,UAAU,SAAS;YAE9C,OAAO;QACL,CAAC,CAAC,OAAO;aACJ,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,qBAAqB,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CACpJ;aACA,IAAI,CAAC,EAAE,CAAC;QACb,CAAC,CAAC,EACN;YACE,OAAO,CAAC,CAAC,CAAC,sBAAsB,WAAW,MAAM,CAAC,CAAC,CAAC,EAAE;YACtD,SAAS,CAAC,CAAC,CAAC,wBAAwB,eAAe,MAAM,CAAC,CAAC,CAAC,EAAE;+DACX,gBAAgB;;;;GAI5E,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAAC,KAAc,EAAsB,EAAE;IACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;QACtB,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,aAAa;AAExD,0EAA0E;AAC1E,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,sBAAsB;AAE7E,MAAM,wBAAwB,GAAG,GAAS,EAAE;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,mBAAmB,EAAE,CAAC;QACtD,IAAI,GAAG,GAAG,UAAU,GAAG,kBAAkB,EAAE,CAAC;YAC1C,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAS,EAAE;IACxD,mBAAmB,CAAC,KAAK,EAAE,CAAC;AAC9B,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,CAAC,UAAsB,EAAE,KAAa,EAAW,EAAE;IAC7E,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC;IAC9C,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,oBAAoB,EAAE,KAAK,CAAC;IAC3E,MAAM,YAAY,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC,MAAM,CACvD,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAC1C,CAAC;IAEF,qEAAqE;IACrE,gDAAgD;IAChD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,oBAAoB,EAAE,SAAS,CAAC;IAC5E,IAAI,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,kBAAkB,EAAE,CAAC;QAC3E,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE;YACrD,UAAU,EAAE,UAAU,CAAC,IAAI;SAC5B,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,yBAAyB,GAAG,CAAC,KAAa,EAA0B,EAAE;IAC1E,wBAAwB,EAAE,CAAC;IAE3B,IAAI,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,kDAAkD,EAAE;YAC9D,UAAU,EAAE,YAAY;SACzB,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,8EAA8E;IAC9E,gDAAgD;IAChD,MAAM,UAAU,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,UAAU,IAAI,mBAAmB,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC;QACzD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,4EAA4E;IAC5E,MAAM,iBAAiB,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,iBAAiB,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,KAAK,CAAC,EAAE,CAAC;QACvE,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IACvE,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;QAC5D,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAE9C,iEAAiE;QACjE,MAAM,CAAC,GAAI,GAAW,CAAC,CAAC,IAAI,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QAEnD,iCAAiC;QACjC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE;gBACzC,KAAK;gBACL,gBAAgB,EAAE,iBAAiB,IAAI,EAAE;aAC1C,CAAC,CAAC;YACH,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CACzB,oBAAoB,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,mCAAmC,CAAC,EAAE,EAAE,EAAE;gBAC3E,EAAE,KAAK,EAAE,CAAC,CAAC,wCAAwC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE;gBAC5E,GAAG,CAAC,iBAAiB;oBACnB,CAAC,CAAC;wBACE;4BACE,KAAK,EAAE,CAAC,CAAC,0CAA0C,CAAC;4BACpD,KAAK,EAAE,MAAM,CAAC,iBAAiB,CAAC;yBACjC;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CACH,CAAC;QACJ,CAAC;QAED,+BAA+B;QAC/B,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;YACvD,OAAO,GAAG;iBACP,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CACH,oBAAoB,CAClB,CAAC,EACD,OAAO,EACP,CAAC,CAAC,8BAA8B,CAAC,EACjC,CAAC,CAAC,qCAAqC,CAAC,CACzC,CACF,CAAC;QACN,CAAC;QAED,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC1D,OAAO,GAAG;iBACP,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CACH,oBAAoB,CAClB,CAAC,EACD,OAAO,EACP,CAAC,CAAC,8BAA8B,CAAC,EACjC,CAAC,CAAC,oCAAoC,CAAC,CACxC,CACF,CAAC;QACN,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,yBAAyB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAE5E,2EAA2E;QAC3E,4EAA4E;QAC5E,kCAAkC;QAClC,MAAM,UAAU,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;QAEzD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;YAC1E,OAAO,GAAG;iBACP,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CACH,oBAAoB,CAClB,CAAC,EACD,OAAO,EACP,CAAC,CAAC,8BAA8B,CAAC,EACjC,GAAG,CAAC,CAAC,qCAAqC,CAAC,KAAK,CAAC,CAAC,qCAAqC,CAAC,EAAE,CAC3F,CACF,CAAC;QACN,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,sCAAsC,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;QAEpF,sEAAsE;QACtE,sEAAsE;QACtE,uEAAuE;QACvE,uCAAuC;QACvC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,wBAAwB,CAAC;YACzC,GAAG,EAAE,QAAQ;YACb,gBAAgB,EACd,UAAU,CAAC,KAAK,EAAE,gBAAgB;gBAClC,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,oBAAoB,EAAE,gBAAgB;YAClE,gBAAgB,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM;SACxE,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE;gBACnD,UAAU,EAAE,UAAU,CAAC,IAAI;gBAC3B,MAAM,EAAE,SAAS,CAAC,MAAM;aACzB,CAAC,CAAC;YACH,OAAO,GAAG;iBACP,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CACH,oBAAoB,CAClB,CAAC,EACD,OAAO,EACP,CAAC,CAAC,mCAAmC,CAAC,EACtC,SAAS,CAAC,MAAM,CACjB,CACF,CAAC;QACN,CAAC;QACD,IAAI,QAAQ,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,uEAAuE,EAAE;gBACnF,UAAU,EAAE,UAAU,CAAC,IAAI;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,mFAAmF;QACnF,qEAAqE;QACrE,IAAI,UAAU,CAAC,SAAS,IAAI,YAAY,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;YACjE,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,CAAC,yCAAyC,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;gBACvF,MAAM,gBAAgB,GAAG,UAAU,CAAC,SAAgB,CAAC;gBACrD,MAAM,gBAAgB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;gBAE7C,mEAAmE;gBACnE,wEAAwE;gBACxE,8EAA8E;gBAC9E,mBAAmB,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBAEhD,MAAM,CAAC,GAAG,CAAC,sDAAsD,EAAE;oBACjE,UAAU,EAAE,UAAU,CAAC,IAAI;iBAC5B,CAAC,CAAC;gBAEH,wFAAwF;gBACxF,oFAAoF;gBACpF,qFAAqF;gBACrF,uFAAuF;gBACvF,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBAC5D,MAAM,eAAe,GAAG,WAAW;oBACjC,CAAC,CAAE,cAAc,CAAC,WAAkB,CAAwB;oBAC5D,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;gBAEtB,IAAI,CAAC,eAAe,EAAE,CAAC;oBACrB,MAAM,IAAI,KAAK,CACb,oCAAoC,UAAU,CAAC,IAAI,uBAAuB,CAC3E,CAAC;gBACJ,CAAC;gBAED,iDAAiD;gBACjD,UAAU,CAAC,MAAM,GAAG,eAAe,CAAC;gBAEpC,sEAAsE;gBACtE,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;oBACxB,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,IAAI,EAAE,CAAC;oBACpD,UAAU,CAAC,OAAO,GAAG;wBACnB,OAAO,EAAE,aAAa,CAAC,OAAO,IAAI,KAAK;wBACvC,sBAAsB,EAAE,aAAa,CAAC,sBAAsB,IAAI,IAAI;wBACpE,eAAe,EAAE,aAAa,CAAC,eAAe;qBAC/C,CAAC;gBACJ,CAAC;gBAED,sFAAsF;gBACtF,IAAI,CAAC;oBACH,IAAI,UAAU,CAAC,SAAS,IAAI,OAAO,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;wBAC5D,MAAO,UAAU,CAAC,SAAiB,CAAC,KAAK,EAAE,CAAC;oBAC9C,CAAC;gBACH,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,MAAM,CAAC,IAAI,CAAC,2DAA2D,EAAE;wBACvE,UAAU,EAAE,UAAU,CAAC,IAAI;wBAC3B,KAAK,EAAE,UAAU;qBAClB,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,CAAC,GAAG,CAAC,iDAAiD,EAAE;oBAC5D,UAAU,EAAE,UAAU,CAAC,IAAI;iBAC5B,CAAC,CAAC;gBACH,MAAM,kBAAkB,GAAG,MAAM,yBAAyB,CACxD,UAAU,CAAC,IAAI,EACf,eAAe,CAChB,CAAC;gBACF,UAAU,CAAC,SAAS,GAAG,kBAAkB,CAAC;gBAE1C,0EAA0E;gBAC1E,UAAU,CAAC,MAAM,GAAG,YAAY,CAAC;gBACjC,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;oBACrB,UAAU,CAAC,KAAK,CAAC,gBAAgB,GAAG,SAAS,CAAC;oBAC9C,UAAU,CAAC,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC;gBACrC,CAAC;gBAED,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;oBAChD,MAAM,mBAAmB,GAAG,IAAI,KAAK,CACnC,oBAAoB,UAAU,CAAC,IAAI,8DAA8D,CAClG,CAAC;oBACF,UAAU,CAAC,MAAM,GAAG,cAAc,CAAC;oBACnC,UAAU,CAAC,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC;oBAC/C,MAAM,mBAAmB,CAAC;gBAC5B,CAAC;gBAED,MAAM,CAAC,GAAG,CAAC,4CAA4C,EAAE;oBACvD,UAAU,EAAE,UAAU,CAAC,IAAI;iBAC5B,CAAC,CAAC;gBACH,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,CAAC;gBAC1C,MAAM,kBAAkB,GAAG,UAAU,CAAC,SAAS,CAAC;gBAChD,IAAI,CAAC;oBACH,MAAM,4BAA4B,CAChC,eAAe,EACf,kBAAkB,EAClB,UAAU,CAAC,OAAO,CACnB,CAAC;gBACJ,CAAC;gBAAC,OAAO,YAAY,EAAE,CAAC;oBACtB,UAAU,CAAC,MAAM,GAAG,cAAc,CAAC;oBACnC,UAAU,CAAC,KAAK,GAAG,2CACjB,YAAY,YAAY,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAC5E,EAAE,CAAC;oBACH,MAAM,CAAC,KAAK,CAAC,8CAA8C,EAAE;wBAC3D,UAAU,EAAE,UAAU,CAAC,IAAI;wBAC3B,KAAK,EAAE,YAAY;qBACpB,CAAC,CAAC;oBACH,IAAI,YAAY,YAAY,KAAK,EAAE,CAAC;wBAClC,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE;4BACzD,UAAU,EAAE,UAAU,CAAC,IAAI;4BAC3B,OAAO,EAAE,YAAY,CAAC,OAAO;4BAC7B,KAAK,EAAE,YAAY,CAAC,KAAK;yBAC1B,CAAC,CAAC;oBACL,CAAC;oBAED,IAAI,CAAC;wBACH,MAAM,eAAe,CAAC,KAAK,EAAE,CAAC;oBAChC,CAAC;oBAAC,OAAO,gBAAgB,EAAE,CAAC;wBAC1B,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE;4BAClE,UAAU,EAAE,UAAU,CAAC,IAAI;4BAC3B,KAAK,EAAE,gBAAgB;yBACxB,CAAC,CAAC;oBACL,CAAC;oBAED,IAAI,CAAC;wBACH,MAAM,kBAAkB,CAAC,KAAK,EAAE,CAAC;oBACnC,CAAC;oBAAC,OAAO,mBAAmB,EAAE,CAAC;wBAC7B,MAAM,CAAC,IAAI,CAAC,yDAAyD,EAAE;4BACrE,UAAU,EAAE,UAAU,CAAC,IAAI;4BAC3B,KAAK,EAAE,mBAAmB;yBAC3B,CAAC,CAAC;oBACL,CAAC;oBAED,IAAI,UAAU,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;wBAC1C,UAAU,CAAC,MAAM,GAAG,SAAS,CAAC;oBAChC,CAAC;oBACD,IAAI,UAAU,CAAC,SAAS,KAAK,kBAAkB,EAAE,CAAC;wBAChD,UAAU,CAAC,SAAS,GAAG,SAAS,CAAC;oBACnC,CAAC;oBAED,MAAM,YAAY,CAAC;gBACrB,CAAC;gBAED,UAAU,CAAC,MAAM,GAAG,WAAW,CAAC;gBAChC,UAAU,CAAC,KAAK,GAAG,IAAI,CAAC;gBACxB,MAAM,CAAC,GAAG,CAAC,oDAAoD,EAAE;oBAC/D,UAAU,EAAE,UAAU,CAAC,IAAI;iBAC5B,CAAC,CAAC;gBAEH,2EAA2E;gBAC3E,8DAA8D;gBAC9D,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC;gBAC/D,MAAM,CAAC,GAAG,CAAC,0CAA0C,EAAE;oBACrD,UAAU,EAAE,UAAU,CAAC,IAAI;oBAC3B,YAAY;iBACb,CAAC,CAAC;gBAEH,IAAI,YAAY,EAAE,KAAK,EAAE,CAAC;oBACxB,MAAM,CAAC,GAAG,CAAC,oCAAoC,EAAE;wBAC/C,UAAU,EAAE,UAAU,CAAC,IAAI;qBAC5B,CAAC,CAAC;oBACH,IAAI,CAAC;wBACH,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;wBAC9E,sBAAsB,CAAC,UAAU,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;wBACtD,MAAM,CAAC,GAAG,CAAC,mCAAmC,EAAE;4BAC9C,UAAU,EAAE,UAAU,CAAC,IAAI;4BAC3B,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM;yBACnC,CAAC,CAAC;oBACL,CAAC;oBAAC,OAAO,cAAc,EAAE,CAAC;wBACxB,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE;4BACxD,UAAU,EAAE,UAAU,CAAC,IAAI;4BAC3B,KAAK,EAAE,cAAc;yBACtB,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,GAAG,CAAC,+DAA+D,EAAE;wBAC1E,UAAU,EAAE,UAAU,CAAC,IAAI;qBAC5B,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,CAAC,GAAG,CAAC,8CAA8C,EAAE;oBACzD,UAAU,EAAE,UAAU,CAAC,IAAI;iBAC5B,CAAC,CAAC;gBAEH,sBAAsB;gBACtB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CACzB,oBAAoB,CAClB,CAAC,EACD,SAAS,EACT,CAAC,CAAC,uCAAuC,CAAC,EAC1C,CAAC,CAAC,8BAA8B,CAAC,EACjC;oBACE,EAAE,KAAK,EAAE,CAAC,CAAC,sBAAsB,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,EAAE;oBAC5D,EAAE,KAAK,EAAE,CAAC,CAAC,sBAAsB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,yBAAyB,CAAC,EAAE;iBAC1E,EACD,IAAI,CACL,CACF,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE;oBACvD,UAAU,EAAE,UAAU,CAAC,IAAI;oBAC3B,KAAK;iBACN,CAAC,CAAC;gBACH,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE;oBAC3C,UAAU,EAAE,UAAU,CAAC,IAAI;oBAC3B,SAAS,EAAE,OAAO,KAAK;oBACvB,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI;oBACnC,YAAY,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;oBACpE,UAAU,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB;iBACpE,CAAC,CAAC;gBAEH,OAAO,GAAG;qBACP,MAAM,CAAC,GAAG,CAAC;qBACX,IAAI,CACH,oBAAoB,CAClB,CAAC,EACD,OAAO,EACP,CAAC,CAAC,+BAA+B,CAAC,EAClC,GAAG,CAAC,CAAC,sCAAsC,CAAC,KAAK,CAAC,CAAC,gCAAgC,CAAC,EAAE,EACtF,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAC/E,CACF,CAAC;YACN,CAAC;QACH,CAAC;aAAM,CAAC;YACN,iEAAiE;YACjE,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;YACvF,OAAO,GAAG;iBACP,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CACH,oBAAoB,CAClB,CAAC,EACD,OAAO,EACP,CAAC,CAAC,kCAAkC,CAAC,EACrC,CAAC,CAAC,yCAAyC,CAAC,CAC7C,CACF,CAAC;QACN,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAEpE,iEAAiE;QACjE,MAAM,CAAC,GAAI,GAAW,CAAC,CAAC,IAAI,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QAEnD,OAAO,GAAG;aACP,MAAM,CAAC,GAAG,CAAC;aACX,IAAI,CACH,oBAAoB,CAClB,CAAC,EACD,OAAO,EACP,CAAC,CAAC,6BAA6B,CAAC,EAChC,CAAC,CAAC,oCAAoC,CAAC,CACxC,CACF,CAAC;IACN,CAAC;AACH,CAAC,CAAC"}

package/dist/controllers/serverController.js

@@ -17,7 +17,7 @@ import { isPrivilegedServerConfig } from '../utils/serverConfigValidation.js';
 import { validateServerName } from '../utils/serverNameValidation.js';
 import { setCachedSystemConfig } from '../utils/systemConfigCache.js';
 import { DEFAULT_INSTALL_BASE_URL, withResolvedInstallBaseUrl } from '../utils/installBaseUrl.js';
-import { parseBooleanEnvVar } from '../utils/smartRouting.js';
+import { getSmartRoutingConfig, parseBooleanEnvVar } from '../utils/smartRouting.js';
 import { previewOpenApiToolStats } from '../services/openApiToolStatsService.js';
 import { logger } from '../utils/logger.js';
 const getRequestUser = (req) => {
@@ -296,6 +296,14 @@ export const getAllSettings = async (req, res) => {
                 systemConfig.smartRouting.dbUrl = dbUrlEnv ? '${DB_URL}' : '';
             }
         }
+        // Same idea one level down (issue #642): an env var silently outranks the
+        // value the user typed into the dashboard — e.g. a stale OPENAI_API_KEY in
+        // .env shadows a freshly pasted valid key, and embeddings fail with 401 while
+        // the form happily shows the new key. Reuse getSmartRoutingConfig() so the
+        // field→env-var mapping lives in exactly one place instead of being repeated
+        // here; this endpoint is admin-only and low-traffic, so the extra DAO read is
+        // not worth optimising away.
+        const smartRoutingEnvOverriddenFields = (await getSmartRoutingConfig()).envOverriddenFields ?? [];
         if (!systemConfig.toolResultCompression) {
             systemConfig.toolResultCompression = {
                 enabled: false,
@@ -304,7 +312,21 @@ export const getAllSettings = async (req, res) => {
                 strategy: 'auto',
             };
         }
-        const systemConfigForResponse = withResolvedInstallBaseUrl(systemConfig, DEFAULT_INSTALL_BASE_URL);
+        const systemConfigForResponse = withResolvedInstallBaseUrl({
+            ...systemConfig,
+            // Response-only copy: `envOverriddenFields` is display metadata, not part
+            // of the persisted schema. The file-backed DAO returns its cached settings
+            // object by reference, so attaching the field to systemConfig.smartRouting
+            // directly would leak it into mcp_settings.json on the next write.
+            ...(systemConfig.smartRouting
+                ? {
+                    smartRouting: {
+                        ...systemConfig.smartRouting,
+                        envOverriddenFields: smartRoutingEnvOverriddenFields,
+                    },
+                }
+                : {}),
+        }, DEFAULT_INSTALL_BASE_URL);
         const settings = {
             users,
             mcpServers,
@@ -1357,6 +1379,10 @@ export const updateSystemConfig = async (req, res) => {
                 typeof smartRouting.azureOpenaiApiVersion === 'string' ||
                 typeof smartRouting.azureOpenaiEmbeddingDeployment === 'string' ||
                 typeof smartRouting.progressiveDisclosure === 'boolean' ||
+                typeof smartRouting.azureOpenaiEmbeddingModel === 'string' ||
+                typeof smartRouting.serverDescriptionMode === 'string' ||
+                typeof smartRouting.embeddingQueryPrefix === 'string' ||
+                typeof smartRouting.embeddingDocumentPrefix === 'string' ||
                 typeof smartRouting.embeddingMaxTokens === 'number' ||
                 smartRouting.embeddingMaxTokens === null);
         const hasToolResultCompressionUpdate = toolResultCompression &&
@@ -1673,8 +1699,7 @@ export const updateSystemConfig = async (req, res) => {
                 systemConfig.smartRouting.llmProviderApiKey = smartRouting.llmProviderApiKey?.trim();
             }
             if (typeof smartRouting.embeddingModel === 'string') {
-                systemConfig.smartRouting.embeddingModel =
-                    smartRouting.embeddingModel?.trim();
+                systemConfig.smartRouting.embeddingModel = smartRouting.embeddingModel?.trim();
             }
             if (typeof smartRouting.azureOpenaiEndpoint === 'string') {
                 systemConfig.smartRouting.azureOpenaiEndpoint = smartRouting.azureOpenaiEndpoint?.trim();
@@ -1690,9 +1715,25 @@ export const updateSystemConfig = async (req, res) => {
                 systemConfig.smartRouting.azureOpenaiEmbeddingDeployment =
                     smartRouting.azureOpenaiEmbeddingDeployment?.trim();
             }
+            if (typeof smartRouting.azureOpenaiEmbeddingModel === 'string') {
+                systemConfig.smartRouting.azureOpenaiEmbeddingModel =
+                    smartRouting.azureOpenaiEmbeddingModel.trim();
+            }
             if (typeof smartRouting.progressiveDisclosure === 'boolean') {
                 systemConfig.smartRouting.progressiveDisclosure = smartRouting.progressiveDisclosure;
             }
+            if (typeof smartRouting.serverDescriptionMode === 'string') {
+                // Same normalization as getSmartRoutingConfig(), so the API and the env var agree
+                const normalized = smartRouting.serverDescriptionMode.trim().toLowerCase();
+                systemConfig.smartRouting.serverDescriptionMode = normalized === 'full' ? 'full' : 'names';
+            }
+            // Stored verbatim, not trimmed: the trailing space is part of a task prefix
+            if (typeof smartRouting.embeddingQueryPrefix === 'string') {
+                systemConfig.smartRouting.embeddingQueryPrefix = smartRouting.embeddingQueryPrefix;
+            }
+            if (typeof smartRouting.embeddingDocumentPrefix === 'string') {
+                systemConfig.smartRouting.embeddingDocumentPrefix = smartRouting.embeddingDocumentPrefix;
+            }
             if (typeof smartRouting.embeddingMaxTokens === 'number' &&
                 !isNaN(smartRouting.embeddingMaxTokens)) {
                 systemConfig.smartRouting.embeddingMaxTokens = smartRouting.embeddingMaxTokens;
@@ -1714,9 +1755,9 @@ export const updateSystemConfig = async (req, res) => {
                     systemConfig.smartRouting.embeddingDimensionsApiPassthrough ||
                 previousSmartRoutingConfig.llmProviderBaseUrl !==
                     systemConfig.smartRouting.llmProviderBaseUrl ||
-                previousSmartRoutingConfig.llmProviderApiKey !== systemConfig.smartRouting.llmProviderApiKey ||
-                previousSmartRoutingConfig.embeddingModel !==
-                    systemConfig.smartRouting.embeddingModel ||
+                previousSmartRoutingConfig.llmProviderApiKey !==
+                    systemConfig.smartRouting.llmProviderApiKey ||
+                previousSmartRoutingConfig.embeddingModel !== systemConfig.smartRouting.embeddingModel ||
                 previousSmartRoutingConfig.azureOpenaiEndpoint !==
                     systemConfig.smartRouting.azureOpenaiEndpoint ||
                 previousSmartRoutingConfig.azureOpenaiApiKey !==
@@ -1725,6 +1766,10 @@ export const updateSystemConfig = async (req, res) => {
                     systemConfig.smartRouting.azureOpenaiApiVersion ||
                 previousSmartRoutingConfig.azureOpenaiEmbeddingDeployment !==
                     systemConfig.smartRouting.azureOpenaiEmbeddingDeployment ||
+                previousSmartRoutingConfig.azureOpenaiEmbeddingModel !==
+                    systemConfig.smartRouting.azureOpenaiEmbeddingModel ||
+                (previousSmartRoutingConfig.embeddingDocumentPrefix ?? '') !==
+                    (systemConfig.smartRouting.embeddingDocumentPrefix ?? '') ||
                 previousSmartRoutingConfig.embeddingMaxTokens !==
                     systemConfig.smartRouting.embeddingMaxTokens;
             // Sync if: first time enabling OR smart routing is enabled and any config changed