@samanhappy/mcphub 1.1.2 → 1.1.4

package/dist/services/oauthService.js

@@ -115,7 +115,7 @@ export const isOAuthEnabled = () => {
 export const getServerOAuthToken = async (serverName) => {
     const serverDao = getServerDao();
     const serverConfig = await serverDao.findById(serverName);
-    if (!serverConfig?.oauth) {
+    if (!serverConfig?.oauth || serverConfig.oauth.identityMode === 'personal') {
         return undefined;
     }
     // If a pre-configured access token exists, use it
@@ -187,6 +187,8 @@ export const initializeAllOAuthClients = async () => {
     logger.log('Initializing OAuth clients for explicitly configured servers...');
     const registrationPromises = [];
     for (const serverConfig of allServers) {
+        if (serverConfig.oauth?.identityMode === 'personal')
+            continue;
         const serverName = serverConfig.name;
         // Only initialize servers with explicitly enabled dynamic registration
         // Others will be auto-detected and registered on first 401 response

package/dist/services/oauthService.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauthService.js","sourceRoot":"","sources":["../../src/services/oauthService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,aAAa,EAAE,MAAM,0CAA0C,CAAC;AAEnG,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,6BAA6B;AAC7B,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC1B,8BAA8B,GAC/B,MAAM,8BAA8B,CAAC;AAEtC,IAAI,aAAa,GAAoC,IAAI,CAAC;AAC1D,IAAI,WAAW,GAA0B,IAAI,CAAC;AAE9C;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,IAAmB,EAAE;IACzD,MAAM,eAAe,GAAG,kBAAkB,EAAE,CAAC;IAC7C,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,CAAC;IACjD,MAAM,WAAW,GAAG,YAAY,EAAE,KAAK,CAAC;IAExC,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;QAC3D,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,8BAA8B;QAC9B,aAAa,GAAG,IAAI,wBAAwB,CAAC;YAC3C,SAAS,EAAE;gBACT,gBAAgB,EAAE,WAAW,CAAC,SAAS,CAAC,gBAAgB;gBACxD,QAAQ,EAAE,WAAW,CAAC,SAAS,CAAC,QAAQ;gBACxC,aAAa,EAAE,WAAW,CAAC,SAAS,CAAC,aAAa;aACnD;YACD,iBAAiB,EAAE,KAAK,EAAE,KAAa,EAAE,EAAE;gBACzC,mDAAmD;gBACnD,IAAI,WAAW,CAAC,iBAAiB,EAAE,QAAQ,EAAE,CAAC;oBAC5C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,iBAAiB,CAAC,QAAQ,EAAE;wBACnE,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE;4BACP,cAAc,EAAE,kBAAkB;4BAClC,GAAG,WAAW,CAAC,iBAAiB,CAAC,OAAO;yBACzC;wBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;qBAChC,CAAC,CAAC;oBAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;wBACjB,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;oBACvE,CAAC;oBAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;oBACrC,OAAO;wBACL,KAAK;wBACL,QAAQ,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,IAAI,SAAS;wBAC1D,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;qBACxD,CAAC;gBACJ,CAAC;gBAED,4DAA4D;gBAC5D,gFAAgF;gBAChF,OAAO;oBACL,KAAK;oBACL,QAAQ,EAAE,SAAS;oBACnB,MAAM,EAAE,WAAW,CAAC,eAAe,IAAI,EAAE;iBAC1C,CAAC;YACJ,CAAC;YACD,SAAS,EAAE,KAAK,EAAE,QAAgB,EAAE,EAAE;gBACpC,+BAA+B;gBAC/B,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC;gBAE1E,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,SAAS,CAAC;gBACnB,CAAC;gBAED,OAAO;oBACL,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;iBACpC,CAAC;YACJ,CAAC;SACF,CAAC,CAAC;QAEH,sBAAsB;QACtB,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE/E,WAAW,GAAG,aAAa,CAAC;YAC1B,QAAQ,EAAE,aAAa;YACvB,SAAS;YACT,OAAO;YACP,uBAAuB,EAAE,WAAW,CAAC,uBAAuB;gBAC1D,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,uBAAuB,CAAC;gBAC9C,CAAC,CAAC,SAAS;YACb,eAAe,EAAE,WAAW,CAAC,eAAe;SAC7C,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,qBAAqB,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;QACpD,6EAA6E;QAC7E,MAAM,CAAC,GAAG,CACR,kDAAkD;YAChD,CAAC,WAAW,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAC9D,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,aAAa,GAAG,IAAI,CAAC;QACrB,WAAW,GAAG,IAAI,CAAC;IACrB,CAAC;AACH,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,GAA0B,EAAE;IACxD,OAAO,WAAW,CAAC;AACrB,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAoC,EAAE;IACpE,OAAO,aAAa,CAAC;AACvB,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,GAAY,EAAE;IAC1C,OAAO,aAAa,KAAK,IAAI,IAAI,WAAW,KAAK,IAAI,CAAC;AACxD,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,UAAkB,EAA+B,EAAE;IAC3F,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IACjC,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAE1D,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,kDAAkD;IAClD,IAAI,YAAY,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACnC,gFAAgF;QAChF,4CAA4C;QAC5C,OAAO,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC;IACxC,CAAC;IAED,qEAAqE;IACrE,IAAI,YAAY,CAAC,KAAK,CAAC,mBAAmB,EAAE,OAAO,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,gEAAgE;YAChE,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YAE5E,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;gBACrE,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,4DAA4D;YAC5D,IAAI,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;gBACpC,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACrC,UAAU,EACV,YAAY,EACZ,UAAU,EACV,YAAY,CAAC,KAAK,CAAC,YAAY,CAChC,CAAC;oBACF,OAAO,MAAM,CAAC,WAAW,CAAC;gBAC5B,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;oBAChF,oDAAoD;oBACpD,0EAA0E;oBAC1E,OAAO,SAAS,CAAC;gBACnB,CAAC;YACH,CAAC;YAED,iDAAiD;YACjD,kDAAkD;YAClD,qFAAqF;YACrF,MAAM,CAAC,GAAG,CAAC,mDAAmD,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;YAChF,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5E,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,yDAAyD;IACzD,IAAI,YAAY,CAAC,KAAK,CAAC,QAAQ,IAAI,YAAY,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAClE,OAAO,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC;IACxC,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EACjC,UAAkB,EAClB,OAA+B,EACE,EAAE;IACnC,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAEpD,IAAI,KAAK,EAAE,CAAC;QACV,OAAO;YACL,GAAG,OAAO;YACV,aAAa,EAAE,UAAU,KAAK,EAAE;SACjC,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,IAAmB,EAAE;IACjE,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IACjC,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;IAE7C,MAAM,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;IAE9E,MAAM,oBAAoB,GAAoB,EAAE,CAAC;IAEjD,KAAK,MAAM,YAAY,IAAI,UAAU,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC;QAErC,uEAAuE;QACvE,oEAAoE;QACpE,IAAI,YAAY,CAAC,KAAK,EAAE,mBAAmB,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;YAC9D,oBAAoB,CAAC,IAAI,CACvB,wBAAwB,CAAC,UAAU,EAAE,YAAY,CAAC;iBAC/C,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE;gBACnB,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,CAAC,GAAG,CAAC,wCAAwC,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;gBACvE,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;gBAChF,CAAC;YACH,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACf,MAAM,CAAC,KAAK,CAAC,+CAA+C,EAAE;oBAC5D,UAAU;oBACV,KAAK,EAAE,KAAK,CAAC,OAAO;iBACrB,CAAC,CAAC;YACL,CAAC,CAAC,CACL,CAAC;QACJ,CAAC;IACH,CAAC;IAED,yCAAyC;IACzC,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,CACR,+CAA+C,oBAAoB,CAAC,MAAM,YAAY,CACvF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC,CAAC"}
+{"version":3,"file":"oauthService.js","sourceRoot":"","sources":["../../src/services/oauthService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,aAAa,EAAE,MAAM,0CAA0C,CAAC;AAEnG,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,6BAA6B;AAC7B,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC1B,8BAA8B,GAC/B,MAAM,8BAA8B,CAAC;AAEtC,IAAI,aAAa,GAAoC,IAAI,CAAC;AAC1D,IAAI,WAAW,GAA0B,IAAI,CAAC;AAE9C;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,IAAmB,EAAE;IACzD,MAAM,eAAe,GAAG,kBAAkB,EAAE,CAAC;IAC7C,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,CAAC;IACjD,MAAM,WAAW,GAAG,YAAY,EAAE,KAAK,CAAC;IAExC,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;QAC3D,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,8BAA8B;QAC9B,aAAa,GAAG,IAAI,wBAAwB,CAAC;YAC3C,SAAS,EAAE;gBACT,gBAAgB,EAAE,WAAW,CAAC,SAAS,CAAC,gBAAgB;gBACxD,QAAQ,EAAE,WAAW,CAAC,SAAS,CAAC,QAAQ;gBACxC,aAAa,EAAE,WAAW,CAAC,SAAS,CAAC,aAAa;aACnD;YACD,iBAAiB,EAAE,KAAK,EAAE,KAAa,EAAE,EAAE;gBACzC,mDAAmD;gBACnD,IAAI,WAAW,CAAC,iBAAiB,EAAE,QAAQ,EAAE,CAAC;oBAC5C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,iBAAiB,CAAC,QAAQ,EAAE;wBACnE,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE;4BACP,cAAc,EAAE,kBAAkB;4BAClC,GAAG,WAAW,CAAC,iBAAiB,CAAC,OAAO;yBACzC;wBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;qBAChC,CAAC,CAAC;oBAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;wBACjB,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;oBACvE,CAAC;oBAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;oBACrC,OAAO;wBACL,KAAK;wBACL,QAAQ,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,IAAI,SAAS;wBAC1D,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;qBACxD,CAAC;gBACJ,CAAC;gBAED,4DAA4D;gBAC5D,gFAAgF;gBAChF,OAAO;oBACL,KAAK;oBACL,QAAQ,EAAE,SAAS;oBACnB,MAAM,EAAE,WAAW,CAAC,eAAe,IAAI,EAAE;iBAC1C,CAAC;YACJ,CAAC;YACD,SAAS,EAAE,KAAK,EAAE,QAAgB,EAAE,EAAE;gBACpC,+BAA+B;gBAC/B,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC;gBAE1E,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,SAAS,CAAC;gBACnB,CAAC;gBAED,OAAO;oBACL,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;iBACpC,CAAC;YACJ,CAAC;SACF,CAAC,CAAC;QAEH,sBAAsB;QACtB,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE/E,WAAW,GAAG,aAAa,CAAC;YAC1B,QAAQ,EAAE,aAAa;YACvB,SAAS;YACT,OAAO;YACP,uBAAuB,EAAE,WAAW,CAAC,uBAAuB;gBAC1D,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,uBAAuB,CAAC;gBAC9C,CAAC,CAAC,SAAS;YACb,eAAe,EAAE,WAAW,CAAC,eAAe;SAC7C,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,qBAAqB,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;QACpD,6EAA6E;QAC7E,MAAM,CAAC,GAAG,CACR,kDAAkD;YAChD,CAAC,WAAW,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAC9D,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,aAAa,GAAG,IAAI,CAAC;QACrB,WAAW,GAAG,IAAI,CAAC;IACrB,CAAC;AACH,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,GAA0B,EAAE;IACxD,OAAO,WAAW,CAAC;AACrB,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAoC,EAAE;IACpE,OAAO,aAAa,CAAC;AACvB,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,GAAY,EAAE;IAC1C,OAAO,aAAa,KAAK,IAAI,IAAI,WAAW,KAAK,IAAI,CAAC;AACxD,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,UAAkB,EAA+B,EAAE;IAC3F,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IACjC,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAE1D,IAAI,CAAC,YAAY,EAAE,KAAK,IAAI,YAAY,CAAC,KAAK,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;QAC3E,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,kDAAkD;IAClD,IAAI,YAAY,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACnC,gFAAgF;QAChF,4CAA4C;QAC5C,OAAO,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC;IACxC,CAAC;IAED,qEAAqE;IACrE,IAAI,YAAY,CAAC,KAAK,CAAC,mBAAmB,EAAE,OAAO,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,gEAAgE;YAChE,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YAE5E,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;gBACrE,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,4DAA4D;YAC5D,IAAI,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;gBACpC,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACrC,UAAU,EACV,YAAY,EACZ,UAAU,EACV,YAAY,CAAC,KAAK,CAAC,YAAY,CAChC,CAAC;oBACF,OAAO,MAAM,CAAC,WAAW,CAAC;gBAC5B,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;oBAChF,oDAAoD;oBACpD,0EAA0E;oBAC1E,OAAO,SAAS,CAAC;gBACnB,CAAC;YACH,CAAC;YAED,iDAAiD;YACjD,kDAAkD;YAClD,qFAAqF;YACrF,MAAM,CAAC,GAAG,CAAC,mDAAmD,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;YAChF,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5E,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,yDAAyD;IACzD,IAAI,YAAY,CAAC,KAAK,CAAC,QAAQ,IAAI,YAAY,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAClE,OAAO,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC;IACxC,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EACjC,UAAkB,EAClB,OAA+B,EACE,EAAE;IACnC,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAEpD,IAAI,KAAK,EAAE,CAAC;QACV,OAAO;YACL,GAAG,OAAO;YACV,aAAa,EAAE,UAAU,KAAK,EAAE;SACjC,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,IAAmB,EAAE;IACjE,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IACjC,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;IAE7C,MAAM,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;IAE9E,MAAM,oBAAoB,GAAoB,EAAE,CAAC;IAEjD,KAAK,MAAM,YAAY,IAAI,UAAU,EAAE,CAAC;QACtC,IAAI,YAAY,CAAC,KAAK,EAAE,YAAY,KAAK,UAAU;YAAE,SAAS;QAC9D,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC;QAErC,uEAAuE;QACvE,oEAAoE;QACpE,IAAI,YAAY,CAAC,KAAK,EAAE,mBAAmB,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;YAC9D,oBAAoB,CAAC,IAAI,CACvB,wBAAwB,CAAC,UAAU,EAAE,YAAY,CAAC;iBAC/C,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE;gBACnB,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,CAAC,GAAG,CAAC,wCAAwC,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;gBACvE,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;gBAChF,CAAC;YACH,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACf,MAAM,CAAC,KAAK,CAAC,+CAA+C,EAAE;oBAC5D,UAAU;oBACV,KAAK,EAAE,KAAK,CAAC,OAAO;iBACrB,CAAC,CAAC;YACL,CAAC,CAAC,CACL,CAAC;QACJ,CAAC;IACH,CAAC;IAED,yCAAyC;IACzC,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,CACR,+CAA+C,oBAAoB,CAAC,MAAM,YAAY,CACvF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC,CAAC"}

package/dist/services/personalOAuthService.js

@@ -0,0 +1,235 @@
+import { expandServerConfig } from './serverConfigEnvironment.js';
+import { getCredentialBindingDao, getServerDao, getUserDao } from '../dao/DaoFactory.js';
+import { credentialBindingEvents, encryptCredentialValues, decryptCredentialValues, } from './credentialBindingService.js';
+import { authorizationService } from './authorizationService.js';
+import { CredentialBindingError } from '../utils/credentialTemplate.js';
+export const hasPersonalOAuth = (config) => config?.oauth?.identityMode === 'personal';
+export const personalOAuthContexts = new WeakMap();
+const queues = new Map();
+const serialize = async (key, action) => {
+    const previous = queues.get(key) || Promise.resolve();
+    const next = previous.catch(() => undefined).then(action);
+    queues.set(key, next);
+    try {
+        return await next;
+    }
+    finally {
+        if (queues.get(key) === next)
+            queues.delete(key);
+    }
+};
+export const withPersonalOAuthLock = (serverName, username, action) => serialize(JSON.stringify([serverName, username]), action);
+export const personalAuthorizationRequired = (name) => new CredentialBindingError(`Personal authorization required for '${name}'. Connect in Dashboard → Servers.`);
+// The declaration, not resolved tokens/client registration, binds a flow to its destination.
+const fingerprint = (config, expanded) => {
+    // Bindings follow a plain rename; the display name does not change the destination.
+    const { name: _, ...declaration } = config;
+    return JSON.stringify([declaration, expanded.url, expanded.oauth]);
+};
+export class PersonalOAuthContext {
+    constructor(serverName, username, config, declaration) {
+        this.serverName = serverName;
+        this.username = username;
+        this.declaration = declaration;
+        const { accessToken: _, refreshToken: __, pendingAuthorization: ___, ...oauth } = config.oauth || {};
+        this.config = {
+            ...config,
+            oauth,
+            passthroughHeaders: config.passthroughHeaders?.filter((name) => name.toLowerCase() !== 'authorization'),
+        };
+    }
+    static async load(serverName, username, definition) {
+        const expanded = await expandServerConfig(definition);
+        const context = new PersonalOAuthContext(serverName, username, expanded, fingerprint(definition, expanded));
+        const binding = await getCredentialBindingDao().get(serverName, username);
+        if (binding) {
+            const values = await decryptCredentialValues(binding);
+            if (values.oauthDeclaration === context.declaration && values.oauth) {
+                context.config.oauth = { ...context.config.oauth, ...JSON.parse(values.oauth) };
+            }
+            context.revision = binding.encryptedValues;
+        }
+        personalOAuthContexts.set(context.config, context);
+        return context;
+    }
+    wrapFetch(fetchFn) {
+        return async (input, init) => {
+            const body = init?.body instanceof URLSearchParams
+                ? init.body
+                : typeof init?.body === 'string'
+                    ? new URLSearchParams(init.body)
+                    : undefined;
+            if (body?.get('grant_type') !== 'refresh_token')
+                return fetchFn(input, init);
+            const key = JSON.stringify([String(input), body.get('refresh_token')]);
+            if (this.refresh?.key !== key) {
+                const response = fetchFn(input, init);
+                this.refresh = { key, response };
+                void response.then(() => {
+                    // The SDK may reject an HTTP 200 payload without persisting tokens.
+                    // Bound coalescing so that an unusable response cannot poison retries.
+                    const timer = setTimeout(() => {
+                        if (this.refresh?.response === response)
+                            this.refresh = undefined;
+                    }, 1000);
+                    timer.unref?.();
+                }, () => {
+                    if (this.refresh?.response === response)
+                        this.refresh = undefined;
+                });
+            }
+            // Briefly share the response until token persistence completes, so concurrent
+            // SDK calls do not redeem a rotating refresh token twice.
+            const refresh = this.refresh;
+            const response = await refresh.response;
+            if (!response.ok && this.refresh === refresh)
+                this.refresh = undefined;
+            return response.clone();
+        };
+    }
+    get authorizationUrl() {
+        const pending = this.config.oauth.pendingAuthorization;
+        return pending?.state && pending.createdAt && Date.now() - pending.createdAt < 600000
+            ? pending.authorizationUrl
+            : undefined;
+    }
+    get version() {
+        return this.revision || 'unbound';
+    }
+    async assertCurrent() {
+        const definition = await getServerDao().findById(this.serverName);
+        const user = await getUserDao().findByUsername(this.username);
+        if (!definition ||
+            !user ||
+            definition.enabled === false ||
+            !hasPersonalOAuth(definition) ||
+            fingerprint(definition, await expandServerConfig(definition)) !== this.declaration ||
+            !authorizationService.can('server.invoke', definition, { ...user, username: this.username }))
+            throw new CredentialBindingError('Personal authorization or server access changed; reconnect');
+    }
+    async mutate(mutator) {
+        return withPersonalOAuthLock(this.serverName, this.username, async () => {
+            await this.assertCurrent();
+            const dao = getCredentialBindingDao();
+            const current = await dao.get(this.serverName, this.username);
+            if (current?.encryptedValues !== this.revision)
+                throw new CredentialBindingError('Personal authorization changed; reconnect');
+            const config = structuredClone(this.config);
+            mutator({ serverConfig: config, oauth: config.oauth });
+            const encryptedValues = await encryptCredentialValues(this.serverName, this.username, {
+                oauthDeclaration: this.declaration,
+                oauth: JSON.stringify(config.oauth),
+            });
+            await this.assertCurrent();
+            if (!(await dao.compareAndSave({
+                serverName: this.serverName,
+                username: this.username,
+                encryptedValues,
+                updatedAt: new Date().toISOString(),
+            }, this.revision)))
+                throw new CredentialBindingError('Personal authorization changed; reconnect');
+            this.revision = encryptedValues;
+            this.config = config;
+            personalOAuthContexts.set(config, this);
+            return config;
+        });
+    }
+    async loadServerConfig(_name) {
+        await this.assertCurrent();
+        return this.config;
+    }
+    mutateOAuthSettings(_name, mutator) {
+        return this.mutate(mutator);
+    }
+    persistClientCredentials(_name, credentials) {
+        return this.mutate(({ oauth }) => Object.assign(oauth, credentials));
+    }
+    async persistTokens(_name, tokens) {
+        const saved = await this.mutate(({ oauth }) => {
+            oauth.accessToken = tokens.accessToken;
+            if (tokens.refreshToken !== undefined)
+                oauth.refreshToken = tokens.refreshToken || undefined;
+            const metadata = oauth.pendingAuthorization?.discoveryState?.authorizationServerMetadata;
+            if (metadata &&
+                'revocation_endpoint' in metadata &&
+                typeof metadata.revocation_endpoint === 'string')
+                oauth.revocationEndpoint = metadata.revocation_endpoint;
+            if (tokens.clearPendingAuthorization)
+                delete oauth.pendingAuthorization;
+        });
+        this.refresh = undefined;
+        return saved;
+    }
+    updatePendingAuthorization(_name, pending) {
+        return this.mutate(({ oauth }) => {
+            oauth.pendingAuthorization = {
+                ...oauth.pendingAuthorization,
+                ...pending,
+                createdAt: pending.createdAt ?? Date.now(),
+            };
+        });
+    }
+    clearOAuthData(_name, scope) {
+        return this.mutate(({ oauth }) => {
+            if (scope === 'all' || scope === 'tokens') {
+                delete oauth.accessToken;
+                delete oauth.refreshToken;
+            }
+            if (scope === 'all' || scope === 'client') {
+                delete oauth.clientId;
+                delete oauth.clientSecret;
+            }
+            if (scope === 'all' || scope === 'verifier')
+                delete oauth.pendingAuthorization;
+            if (scope === 'discovery' && oauth.pendingAuthorization) {
+                delete oauth.pendingAuthorization.discoveryState;
+                delete oauth.pendingAuthorization.issuer;
+                delete oauth.pendingAuthorization.issRequired;
+            }
+        });
+    }
+}
+export const resolvePersonalOAuth = async (serverName, username, definition) => {
+    const context = await PersonalOAuthContext.load(serverName, username, definition);
+    if (!context.config.oauth.accessToken)
+        throw personalAuthorizationRequired(serverName);
+    return { config: context.config, revision: context.version };
+};
+export const findPersonalOAuthFlow = async (state) => {
+    if (!state.startsWith('personal.'))
+        return undefined;
+    for (const server of await getServerDao().findAll()) {
+        if (!hasPersonalOAuth(server))
+            continue;
+        for (const username of await getCredentialBindingDao().listUsernames(server.name)) {
+            let context;
+            try {
+                context = await PersonalOAuthContext.load(server.name, username, server);
+            }
+            catch {
+                continue;
+            } // One damaged binding must not block another user's callback.
+            const pending = context.config.oauth.pendingAuthorization;
+            if (pending?.state === state &&
+                pending.createdAt &&
+                Date.now() - pending.createdAt < 600000) {
+                await context.assertCurrent();
+                return context;
+            }
+        }
+    }
+    return undefined;
+};
+export const disconnectPersonalOAuth = async (serverName, username) => {
+    await withPersonalOAuthLock(serverName, username, async () => {
+        // Retain an encrypted tombstone so even a pre-save, unbound context becomes stale.
+        await getCredentialBindingDao().save({
+            serverName,
+            username,
+            encryptedValues: await encryptCredentialValues(serverName, username, {}),
+            updatedAt: new Date().toISOString(),
+        });
+        credentialBindingEvents.emit('invalidate', { serverName, username });
+    });
+};
+//# sourceMappingURL=personalOAuthService.js.map

package/dist/services/personalOAuthService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"personalOAuthService.js","sourceRoot":"","sources":["../../src/services/personalOAuthService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAElE,OAAO,EAAE,uBAAuB,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACzF,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAKxE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAqB,EAAW,EAAE,CACjE,MAAM,EAAE,KAAK,EAAE,YAAY,KAAK,UAAU,CAAC;AAC7C,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,OAAO,EAAsC,CAAC;AACvF,MAAM,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAC;AACnD,MAAM,SAAS,GAAG,KAAK,EAAK,GAAW,EAAE,MAAwB,EAAc,EAAE;IAC/E,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IACtD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC;IACpB,CAAC;YAAS,CAAC;QACT,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI;YAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnD,CAAC;AACH,CAAC,CAAC;AACF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,UAAkB,EAClB,QAAgB,EAChB,MAAwB,EACZ,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AAE3E,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,IAAY,EAAE,EAAE,CAC5D,IAAI,sBAAsB,CACxB,wCAAwC,IAAI,oCAAoC,CACjF,CAAC;AAEJ,6FAA6F;AAC7F,MAAM,WAAW,GAAG,CAAC,MAAoB,EAAE,QAAsB,EAAU,EAAE;IAC3E,oFAAoF;IACpF,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,WAAW,EAAE,GAAG,MAA0C,CAAC;IAC/E,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACrE,CAAC,CAAC;AACF,MAAM,OAAO,oBAAoB;IAI/B,YACW,UAAkB,EAClB,QAAgB,EACzB,MAAoB,EACpB,WAAmB;QAHV,eAAU,GAAV,UAAU,CAAQ;QAClB,aAAQ,GAAR,QAAQ,CAAQ;QAIzB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,MAAM,EACJ,WAAW,EAAE,CAAC,EACd,YAAY,EAAE,EAAE,EAChB,oBAAoB,EAAE,GAAG,EACzB,GAAG,KAAK,EACT,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG;YACZ,GAAG,MAAM;YACT,KAAK;YACL,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CACnD,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,eAAe,CACjD;SACF,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAkB,EAAE,QAAgB,EAAE,UAAwB;QAC9E,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,IAAI,oBAAoB,CACtC,UAAU,EACV,QAAQ,EACR,QAAQ,EACR,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,CAClC,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,uBAAuB,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC1E,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,CAAC;YACtD,IAAI,MAAM,CAAC,gBAAgB,KAAK,OAAO,CAAC,WAAW,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACpE,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAClF,CAAC;YACD,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,eAAe,CAAC;QAC7C,CAAC;QACD,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,SAAS,CAAC,OAAkB;QAC1B,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC3B,MAAM,IAAI,GACR,IAAI,EAAE,IAAI,YAAY,eAAe;gBACnC,CAAC,CAAC,IAAI,CAAC,IAAI;gBACX,CAAC,CAAC,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ;oBAC9B,CAAC,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;oBAChC,CAAC,CAAC,SAAS,CAAC;YAClB,IAAI,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,KAAK,eAAe;gBAAE,OAAO,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAC7E,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YACvE,IAAI,IAAI,CAAC,OAAO,EAAE,GAAG,KAAK,GAAG,EAAE,CAAC;gBAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBACtC,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;gBACjC,KAAK,QAAQ,CAAC,IAAI,CAChB,GAAG,EAAE;oBACH,oEAAoE;oBACpE,uEAAuE;oBACvE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;wBAC5B,IAAI,IAAI,CAAC,OAAO,EAAE,QAAQ,KAAK,QAAQ;4BAAE,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;oBACpE,CAAC,EAAE,IAAI,CAAC,CAAC;oBACT,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;gBAClB,CAAC,EACD,GAAG,EAAE;oBACH,IAAI,IAAI,CAAC,OAAO,EAAE,QAAQ,KAAK,QAAQ;wBAAE,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;gBACpE,CAAC,CACF,CAAC;YACJ,CAAC;YACD,8EAA8E;YAC9E,0DAA0D;YAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAQ,CAAC;YAC9B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC;YACxC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO;gBAAE,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;YACvE,OAAO,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC1B,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,gBAAgB;QAClB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC;QACvD,OAAO,OAAO,EAAE,KAAK,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,GAAG,MAAO;YACpF,CAAC,CAAC,OAAO,CAAC,gBAAgB;YAC1B,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IACD,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC;IACpC,CAAC;IACD,KAAK,CAAC,aAAa;QACjB,MAAM,UAAU,GAAG,MAAM,YAAY,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,MAAM,UAAU,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9D,IACE,CAAC,UAAU;YACX,CAAC,IAAI;YACL,UAAU,CAAC,OAAO,KAAK,KAAK;YAC5B,CAAC,gBAAgB,CAAC,UAAU,CAAC;YAC7B,WAAW,CAAC,UAAU,EAAE,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,CAAC,WAAW;YAClF,CAAC,oBAAoB,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;YAE5F,MAAM,IAAI,sBAAsB,CAC9B,4DAA4D,CAC7D,CAAC;IACN,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,OAAgD;QAC3D,OAAO,qBAAqB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YACtE,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,uBAAuB,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9D,IAAI,OAAO,EAAE,eAAe,KAAK,IAAI,CAAC,QAAQ;gBAC5C,MAAM,IAAI,sBAAsB,CAAC,2CAA2C,CAAC,CAAC;YAChF,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC5C,OAAO,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YACvD,MAAM,eAAe,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE;gBACpF,gBAAgB,EAAE,IAAI,CAAC,WAAW;gBAClC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;aACpC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;YAC3B,IACE,CAAC,CAAC,MAAM,GAAG,CAAC,cAAc,CACxB;gBACE,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,eAAe;gBACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,EACD,IAAI,CAAC,QAAQ,CACd,CAAC;gBAEF,MAAM,IAAI,sBAAsB,CAAC,2CAA2C,CAAC,CAAC;YAChF,IAAI,CAAC,QAAQ,GAAG,eAAe,CAAC;YAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;YACrB,qBAAqB,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACxC,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,gBAAgB,CAAC,KAAc;QACnC,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IACD,mBAAmB,CAAC,KAAa,EAAE,OAAgD;QACjF,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IACD,wBAAwB,CAAC,KAAa,EAAE,WAA2B;QACjE,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,KAAK,CAAC,aAAa,CACjB,KAAa,EACb,MAIC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;YAC5C,KAAK,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;YACvC,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS;gBAAE,KAAK,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,SAAS,CAAC;YAC7F,MAAM,QAAQ,GAAG,KAAK,CAAC,oBAAoB,EAAE,cAAc,EAAE,2BAA2B,CAAC;YACzF,IACE,QAAQ;gBACR,qBAAqB,IAAI,QAAQ;gBACjC,OAAO,QAAQ,CAAC,mBAAmB,KAAK,QAAQ;gBAEhD,KAAK,CAAC,kBAAkB,GAAG,QAAQ,CAAC,mBAAmB,CAAC;YAC1D,IAAI,MAAM,CAAC,yBAAyB;gBAAE,OAAO,KAAK,CAAC,oBAAoB,CAAC;QAC1E,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,0BAA0B,CACxB,KAAa,EACb,OAA4D;QAE5D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;YAC/B,KAAK,CAAC,oBAAoB,GAAG;gBAC3B,GAAG,KAAK,CAAC,oBAAoB;gBAC7B,GAAG,OAAO;gBACV,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;aAC3C,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,cAAc,CAAC,KAAa,EAAE,KAA6D;QACzF,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;YAC/B,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC1C,OAAO,KAAK,CAAC,WAAW,CAAC;gBACzB,OAAO,KAAK,CAAC,YAAY,CAAC;YAC5B,CAAC;YACD,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC1C,OAAO,KAAK,CAAC,QAAQ,CAAC;gBACtB,OAAO,KAAK,CAAC,YAAY,CAAC;YAC5B,CAAC;YACD,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAC,oBAAoB,CAAC;YAC/E,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;gBACxD,OAAO,KAAK,CAAC,oBAAoB,CAAC,cAAc,CAAC;gBACjD,OAAO,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC;gBACzC,OAAO,KAAK,CAAC,oBAAoB,CAAC,WAAW,CAAC;YAChD,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,EACvC,UAAkB,EAClB,QAAgB,EAChB,UAAwB,EACxB,EAAE;IACF,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IAClF,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW;QAAE,MAAM,6BAA6B,CAAC,UAAU,CAAC,CAAC;IACvF,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;AAC/D,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EACxC,KAAa,EAC8B,EAAE;IAC7C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,SAAS,CAAC;IACrD,KAAK,MAAM,MAAM,IAAI,MAAM,YAAY,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;QACpD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;YAAE,SAAS;QACxC,KAAK,MAAM,QAAQ,IAAI,MAAM,uBAAuB,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAClF,IAAI,OAA6B,CAAC;YAClC,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC3E,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC,CAAC,8DAA8D;YAChE,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC;YAC1D,IACE,OAAO,EAAE,KAAK,KAAK,KAAK;gBACxB,OAAO,CAAC,SAAS;gBACjB,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,GAAG,MAAO,EACxC,CAAC;gBACD,MAAM,OAAO,CAAC,aAAa,EAAE,CAAC;gBAC9B,OAAO,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,EAC1C,UAAkB,EAClB,QAAgB,EACD,EAAE;IACjB,MAAM,qBAAqB,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE;QAC3D,mFAAmF;QACnF,MAAM,uBAAuB,EAAE,CAAC,IAAI,CAAC;YACnC,UAAU;YACV,QAAQ;YACR,eAAe,EAAE,MAAM,uBAAuB,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE,CAAC;YACxE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;QACH,uBAAuB,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/services/principalRuntimeService.js

@@ -1,7 +1,8 @@
+import { hasPersonalOAuth, resolvePersonalOAuth, personalOAuthContexts, withPersonalOAuthLock, } from './personalOAuthService.js';
 import { getServerDao } from '../dao/DaoFactory.js';
 import { credentialBindingEvents, resolveCredentialBinding } from './credentialBindingService.js';
 import { authorizationService } from './authorizationService.js';
-import { CredentialBindingError, hasCredentialTemplate } from '../utils/credentialTemplate.js';
+import { CredentialBindingError, hasPersonalAuthentication } from '../utils/credentialTemplate.js';
 import { expandServerConfig } from './serverConfigEnvironment.js';
 /** Reuses children across MCP sessions, but never across authenticated principals. */
 export class PrincipalRuntimeService {
@@ -29,56 +30,77 @@ export class PrincipalRuntimeService {
         const definition = await getServerDao().findById(serverName);
         if (!definition ||
             definition.enabled === false ||
-            !hasCredentialTemplate(definition) ||
+            !hasPersonalAuthentication(definition) ||
             !authorizationService.can('server.invoke', definition, principal)) {
             throw new CredentialBindingError('Server not available');
         }
         // These snapshots only detect runtime changes in memory; they are never persisted or logged.
         const definitionSnapshot = JSON.stringify(definition);
-        const resolved = await resolveCredentialBinding(serverName, principal.username, await expandServerConfig(definition));
-        const revision = JSON.stringify([definitionSnapshot, resolved.revision]);
-        const key = JSON.stringify([serverName, principal.username]);
-        let entry = this.entries.get(key);
-        if (entry && (entry.revision !== revision || entry.info?.status === 'disconnected')) {
-            this.invalidate({ serverName, username: principal.username });
-            entry = undefined;
-        }
-        if (!entry) {
-            const created = {
-                serverName,
-                username: principal.username,
-                revision,
-                valid: true,
-                active: 0,
-                promise: undefined,
-            };
-            this.entries.set(key, created);
-            created.promise = (async () => {
-                let info;
-                try {
-                    info = await this.connect(serverName, resolved.config);
-                    // A rotation/deletion may have raced the initial read or async handshake.
-                    const latest = await resolveCredentialBinding(serverName, principal.username, definition);
-                    const currentDefinition = await getServerDao().findById(serverName);
-                    if (!created.valid ||
-                        latest.revision !== resolved.revision ||
-                        JSON.stringify(currentDefinition) !== definitionSnapshot) {
-                        throw new CredentialBindingError('Personal credentials or server configuration changed; retry the request');
+        const resolver = hasPersonalOAuth(definition) ? resolvePersonalOAuth : resolveCredentialBinding;
+        const prepare = async () => {
+            const resolved = await resolver(serverName, principal.username, hasPersonalOAuth(definition) ? definition : await expandServerConfig(definition));
+            const revision = JSON.stringify([definitionSnapshot, resolved.revision]);
+            const key = JSON.stringify([serverName, principal.username]);
+            let entry = this.entries.get(key);
+            if (entry && (entry.revision !== revision || entry.info?.status === 'disconnected')) {
+                this.invalidate({ serverName, username: principal.username });
+                entry = undefined;
+            }
+            if (!entry) {
+                const created = {
+                    serverName,
+                    username: principal.username,
+                    // This context advances only after its own successful CAS writes. External
+                    // binding changes still differ from its version and invalidate the runtime.
+                    get revision() {
+                        return JSON.stringify([
+                            definitionSnapshot,
+                            personalOAuthContexts.get(resolved.config)?.version || resolved.revision,
+                        ]);
+                    },
+                    valid: true,
+                    active: 0,
+                    promise: undefined,
+                };
+                this.entries.set(key, created);
+                created.promise = (async () => {
+                    let info;
+                    try {
+                        info = await this.connect(serverName, resolved.config);
+                        // A rotation/deletion may have raced the initial read or async handshake.
+                        const verify = async () => {
+                            const latest = await resolver(serverName, principal.username, definition);
+                            const currentDefinition = await getServerDao().findById(serverName);
+                            if (!created.valid ||
+                                latest.revision !==
+                                    (personalOAuthContexts.get(resolved.config)?.version || resolved.revision) ||
+                                JSON.stringify(currentDefinition) !== definitionSnapshot) {
+                                throw new CredentialBindingError('Personal credentials or server configuration changed; retry the request');
+                            }
+                        };
+                        if (hasPersonalOAuth(definition))
+                            await withPersonalOAuthLock(serverName, principal.username, verify);
+                        else
+                            await verify();
+                        created.info = info;
+                        return info;
                     }
-                    created.info = info;
-                    return info;
-                }
-                catch (error) {
-                    if (info)
-                        this.close(info);
-                    if (this.entries.get(key) === created)
-                        this.entries.delete(key);
-                    created.valid = false;
-                    throw error;
-                }
-            })();
-            entry = created;
-        }
+                    catch (error) {
+                        if (info)
+                            this.close(info);
+                        if (this.entries.get(key) === created)
+                            this.entries.delete(key);
+                        created.valid = false;
+                        throw error;
+                    }
+                })();
+                entry = created;
+            }
+            return entry;
+        };
+        const entry = hasPersonalOAuth(definition)
+            ? await withPersonalOAuthLock(serverName, principal.username, prepare)
+            : await prepare();
         clearTimeout(entry.timer);
         entry.active += 1;
         const held = entry;

package/dist/services/principalRuntimeService.js.map

@@ -1 +1 @@
-{"version":3,"file":"principalRuntimeService.js","sourceRoot":"","sources":["../../src/services/principalRuntimeService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAClG,OAAO,EAAE,oBAAoB,EAAyB,MAAM,2BAA2B,CAAC;AACxF,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC/F,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAclE,sFAAsF;AACtF,MAAM,OAAO,uBAAuB;IAGlC,YACmB,OAAoE,EACpE,KAAiC;QADjC,YAAO,GAAP,OAAO,CAA6D;QACpE,UAAK,GAAL,KAAK,CAA4B;QAJnC,YAAO,GAAG,IAAI,GAAG,EAAwB,CAAC;QAMzD,uBAAuB,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAChF,CAAC;IAED,UAAU,CAAC,SAAqD,EAAE;QAChE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACxC,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU;gBAAE,SAAS;YACxF,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;gBAAE,SAAS;YAClF,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;YACpB,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,KAAK,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CACX,UAAkB,EAClB,SAA2B;QAE3B,IAAI,SAAS,CAAC,kBAAkB,KAAK,KAAK;YACxC,MAAM,IAAI,sBAAsB,CAAC,qCAAqC,CAAC,CAAC;QAC1E,MAAM,UAAU,GAAG,MAAM,YAAY,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC7D,IACE,CAAC,UAAU;YACX,UAAU,CAAC,OAAO,KAAK,KAAK;YAC5B,CAAC,qBAAqB,CAAC,UAAU,CAAC;YAClC,CAAC,oBAAoB,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,EAAE,SAAS,CAAC,EACjE,CAAC;YACD,MAAM,IAAI,sBAAsB,CAAC,sBAAsB,CAAC,CAAC;QAC3D,CAAC;QACD,6FAA6F;QAC7F,MAAM,kBAAkB,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAC7C,UAAU,EACV,SAAS,CAAC,QAAQ,EAClB,MAAM,kBAAkB,CAAC,UAAU,CAAC,CACrC,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzE,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7D,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,MAAM,KAAK,cAAc,CAAC,EAAE,CAAC;YACpF,IAAI,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC9D,KAAK,GAAG,SAAS,CAAC;QACpB,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,OAAO,GAAiB;gBAC5B,UAAU;gBACV,QAAQ,EAAE,SAAS,CAAC,QAAQ;gBAC5B,QAAQ;gBACR,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,CAAC;gBACT,OAAO,EAAE,SAAU;aACpB,CAAC;YACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC/B,OAAO,CAAC,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;gBAC5B,IAAI,IAA4B,CAAC;gBACjC,IAAI,CAAC;oBACH,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;oBACvD,0EAA0E;oBAC1E,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,UAAU,EAAE,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;oBAC1F,MAAM,iBAAiB,GAAG,MAAM,YAAY,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;oBACpE,IACE,CAAC,OAAO,CAAC,KAAK;wBACd,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;wBACrC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,KAAK,kBAAkB,EACxD,CAAC;wBACD,MAAM,IAAI,sBAAsB,CAC9B,yEAAyE,CAC1E,CAAC;oBACJ,CAAC;oBACD,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;oBACpB,OAAO,IAAI,CAAC;gBACd,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,IAAI;wBAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAC3B,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO;wBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAChE,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;oBACtB,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;YACL,KAAK,GAAG,OAAO,CAAC;QAClB,CAAC;QACD,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;QAClB,MAAM,IAAI,GAAG,KAAK,CAAC;QACnB,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;YACjB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACpC,MAAM,MAAM,GACV,UAAU,CAAC,aAAa,IAAI,UAAU,CAAC,aAAa,GAAG,CAAC;oBACtD,CAAC,CAAC,UAAU,CAAC,aAAa;oBAC1B,CAAC,CAAC,MAAO,CAAC;gBACd,IAAI,CAAC,KAAK,GAAG,UAAU,CACrB,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,EACnE,MAAM,CACP,CAAC;gBACF,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YACvB,CAAC;QACH,CAAC,CAAC;QACF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,KAAK;gBACb,MAAM,IAAI,sBAAsB,CAAC,iDAAiD,CAAC,CAAC;YACtF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,CAAC;YACV,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"principalRuntimeService.js","sourceRoot":"","sources":["../../src/services/principalRuntimeService.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAClG,OAAO,EAAE,oBAAoB,EAAyB,MAAM,2BAA2B,CAAC;AACxF,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AACnG,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAclE,sFAAsF;AACtF,MAAM,OAAO,uBAAuB;IAGlC,YACmB,OAAoE,EACpE,KAAiC;QADjC,YAAO,GAAP,OAAO,CAA6D;QACpE,UAAK,GAAL,KAAK,CAA4B;QAJnC,YAAO,GAAG,IAAI,GAAG,EAAwB,CAAC;QAMzD,uBAAuB,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAChF,CAAC;IAED,UAAU,CAAC,SAAqD,EAAE;QAChE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACxC,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU;gBAAE,SAAS;YACxF,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;gBAAE,SAAS;YAClF,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;YACpB,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,KAAK,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CACX,UAAkB,EAClB,SAA2B;QAE3B,IAAI,SAAS,CAAC,kBAAkB,KAAK,KAAK;YACxC,MAAM,IAAI,sBAAsB,CAAC,qCAAqC,CAAC,CAAC;QAC1E,MAAM,UAAU,GAAG,MAAM,YAAY,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC7D,IACE,CAAC,UAAU;YACX,UAAU,CAAC,OAAO,KAAK,KAAK;YAC5B,CAAC,yBAAyB,CAAC,UAAU,CAAC;YACtC,CAAC,oBAAoB,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,EAAE,SAAS,CAAC,EACjE,CAAC;YACD,MAAM,IAAI,sBAAsB,CAAC,sBAAsB,CAAC,CAAC;QAC3D,CAAC;QACD,6FAA6F;QAC7F,MAAM,kBAAkB,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,wBAAwB,CAAC;QAChG,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;YACzB,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAC7B,UAAU,EACV,SAAS,CAAC,QAAQ,EAClB,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,UAAU,CAAC,CACjF,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;YACzE,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC7D,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,MAAM,KAAK,cAAc,CAAC,EAAE,CAAC;gBACpF,IAAI,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC9D,KAAK,GAAG,SAAS,CAAC;YACpB,CAAC;YACD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,OAAO,GAAiB;oBAC5B,UAAU;oBACV,QAAQ,EAAE,SAAS,CAAC,QAAQ;oBAC5B,2EAA2E;oBAC3E,4EAA4E;oBAC5E,IAAI,QAAQ;wBACV,OAAO,IAAI,CAAC,SAAS,CAAC;4BACpB,kBAAkB;4BAClB,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,IAAI,QAAQ,CAAC,QAAQ;yBACzE,CAAC,CAAC;oBACL,CAAC;oBACD,KAAK,EAAE,IAAI;oBACX,MAAM,EAAE,CAAC;oBACT,OAAO,EAAE,SAAU;iBACpB,CAAC;gBACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAC/B,OAAO,CAAC,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;oBAC5B,IAAI,IAA4B,CAAC;oBACjC,IAAI,CAAC;wBACH,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;wBACvD,0EAA0E;wBAC1E,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE;4BACxB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;4BAC1E,MAAM,iBAAiB,GAAG,MAAM,YAAY,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;4BACpE,IACE,CAAC,OAAO,CAAC,KAAK;gCACd,MAAM,CAAC,QAAQ;oCACb,CAAC,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC;gCAC5E,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,KAAK,kBAAkB,EACxD,CAAC;gCACD,MAAM,IAAI,sBAAsB,CAC9B,yEAAyE,CAC1E,CAAC;4BACJ,CAAC;wBACH,CAAC,CAAC;wBACF,IAAI,gBAAgB,CAAC,UAAU,CAAC;4BAC9B,MAAM,qBAAqB,CAAC,UAAU,EAAE,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;;4BACjE,MAAM,MAAM,EAAE,CAAC;wBACpB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;wBACpB,OAAO,IAAI,CAAC;oBACd,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,IAAI;4BAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;wBAC3B,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO;4BAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;wBAChE,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;wBACtB,MAAM,KAAK,CAAC;oBACd,CAAC;gBACH,CAAC,CAAC,EAAE,CAAC;gBACL,KAAK,GAAG,OAAO,CAAC;YAClB,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,gBAAgB,CAAC,UAAU,CAAC;YACxC,CAAC,CAAC,MAAM,qBAAqB,CAAC,UAAU,EAAE,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC;YACtE,CAAC,CAAC,MAAM,OAAO,EAAE,CAAC;QACpB,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;QAClB,MAAM,IAAI,GAAG,KAAK,CAAC;QACnB,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;YACjB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACpC,MAAM,MAAM,GACV,UAAU,CAAC,aAAa,IAAI,UAAU,CAAC,aAAa,GAAG,CAAC;oBACtD,CAAC,CAAC,UAAU,CAAC,aAAa;oBAC1B,CAAC,CAAC,MAAO,CAAC;gBACd,IAAI,CAAC,KAAK,GAAG,UAAU,CACrB,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,EACnE,MAAM,CACP,CAAC;gBACF,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YACvB,CAAC;QACH,CAAC,CAAC;QACF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,KAAK;gBACb,MAAM,IAAI,sBAAsB,CAAC,iDAAiD,CAAC,CAAC;YACtF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,CAAC;YACV,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/services/serverConfigPresenter.js

@@ -26,6 +26,8 @@ const presentSafeServerConfig = (config) => {
             safe[field] = clone(config[field]);
         }
     }
+    if (config.oauth?.identityMode === 'personal')
+        safe.oauth = { identityMode: 'personal' };
     if (Array.isArray(config.credentialTemplate)) {
         safe.credentialTemplate = config.credentialTemplate.map(({ target, name, label }) => ({ target, name, ...(label ? { label } : {}) }));
     }
@@ -75,7 +77,15 @@ export const presentServerInfoForPrincipal = (info, principal) => {
     }
     const entry = { ...info };
     if (entry.oauth && typeof entry.oauth === 'object') {
-        entry.oauth = presentSafeServerInfoOauth(entry.oauth);
+        const oauth = entry.oauth;
+        entry.oauth =
+            oauth.identityMode === 'personal'
+                ? {
+                    identityMode: 'personal',
+                    connected: oauth.connected,
+                    authorizationUrl: oauth.authorizationUrl,
+                }
+                : presentSafeServerInfoOauth(oauth);
     }
     if (entry.config && typeof entry.config === 'object') {
         entry.config = presentSafeServerConfig(entry.config);

package/dist/services/serverConfigPresenter.js.map

@@ -1 +1 @@
-{"version":3,"file":"serverConfigPresenter.js","sourceRoot":"","sources":["../../src/services/serverConfigPresenter.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAoB,MAAM,2BAA2B,CAAC;AAenF,yEAAyE;AACzE,2EAA2E;AAC3E,2CAA2C;AAC3C,MAAM,yBAAyB,GAAG;IAChC,MAAM;IACN,aAAa;IACb,MAAM;IACN,YAAY;IACZ,OAAO;IACP,SAAS;IACT,OAAO;IACP,SAAS;IACT,WAAW;CACH,CAAC;AAEX,6EAA6E;AAC7E,2EAA2E;AAC3E,MAAM,2BAA2B,GAAG,CAAC,WAAW,EAAE,oBAAoB,CAAU,CAAC;AAEjF,MAAM,KAAK,GAAG,CAAI,KAAQ,EAAK,EAAE,CAC/B,OAAO,eAAe,KAAK,UAAU;IACnC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC;IACxB,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAO,CAAC;AAE/C,MAAM,uBAAuB,GAAG,CAAC,MAAwB,EAAoB,EAAE;IAC7E,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,yBAAyB,EAAE,CAAC;QAC9C,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1D,IAAI,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAkB,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACxJ,CAAC;IACD,4EAA4E;IAC5E,yDAAyD;IACzD,OAAO,EAAE,GAAG,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;AAC7C,CAAC,CAAC;AAEF,MAAM,0BAA0B,GAAG,CACjC,KAA8B,EACL,EAAE;IAC3B,MAAM,SAAS,GAA4B,EAAE,CAAC;IAC9C,KAAK,MAAM,GAAG,IAAI,2BAA2B,EAAE,CAAC;QAC9C,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;YAC7B,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,oDAAoD;AACpD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,MAAS,EACT,SAAmC,EACf,EAAE;IACtB,IAAI,oBAAoB,CAAC,GAAG,CAAC,oBAAoB,EAAE,MAA0B,EAAE,SAAS,CAAC,EAAE,CAAC;QAC1F,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,CAAC,MAA0B,CAAM,EAAE,CAAC;AAC1F,CAAC,CAAC;AAEF,4EAA4E;AAC5E,yEAAyE;AACzE,8EAA8E;AAC9E,uEAAuE;AACvE,4EAA4E;AAC5E,yEAAyE;AACzE,MAAM,CAAC,MAAM,0BAA0B,GAAG,0BAA0B,CAAC;AAErE,MAAM,uBAAuB,GAAG,CAAC,KAAc,EAAW,EAAE;IAC1D,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,0BAA0B,CAAC;AACpC,CAAC,CAAC;AAEF,4EAA4E;AAC5E,6EAA6E;AAC7E,6EAA6E;AAC7E,iBAAiB;AACjB,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAC3C,IAAO,EACP,SAAmC,EAChC,EAAE;IACL,IAAI,oBAAoB,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAwB,EAAE,SAAS,CAAC,EAAE,CAAC;QACxF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,EAAE,GAAI,IAAyB,EAAE,CAAC;IAEhD,IAAI,KAAK,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACnD,KAAK,CAAC,KAAK,GAAG,0BAA0B,CAAC,KAAK,CAAC,KAAgC,CAAC,CAAC;IACnF,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACrD,KAAK,CAAC,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC,MAA0B,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,OAAO,IAAI,KAAK,EAAE,CAAC;QACrB,KAAK,CAAC,KAAK,GAAG,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,KAAU,CAAC;AACpB,CAAC,CAAC"}
+{"version":3,"file":"serverConfigPresenter.js","sourceRoot":"","sources":["../../src/services/serverConfigPresenter.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAoB,MAAM,2BAA2B,CAAC;AAenF,yEAAyE;AACzE,2EAA2E;AAC3E,2CAA2C;AAC3C,MAAM,yBAAyB,GAAG;IAChC,MAAM;IACN,aAAa;IACb,MAAM;IACN,YAAY;IACZ,OAAO;IACP,SAAS;IACT,OAAO;IACP,SAAS;IACT,WAAW;CACH,CAAC;AAEX,6EAA6E;AAC7E,2EAA2E;AAC3E,MAAM,2BAA2B,GAAG,CAAC,WAAW,EAAE,oBAAoB,CAAU,CAAC;AAEjF,MAAM,KAAK,GAAG,CAAI,KAAQ,EAAK,EAAE,CAC/B,OAAO,eAAe,KAAK,UAAU;IACnC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC;IACxB,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAO,CAAC;AAE/C,MAAM,uBAAuB,GAAG,CAAC,MAAwB,EAAoB,EAAE;IAC7E,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,yBAAyB,EAAE,CAAC;QAC9C,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1D,IAAI,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,IAAK,MAAM,CAAC,KAA+C,EAAE,YAAY,KAAK,UAAU;QACtF,IAAI,CAAC,KAAK,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;IAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC,GAAG,CACrD,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAkB,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAC7F,CAAC;IACJ,CAAC;IACD,4EAA4E;IAC5E,yDAAyD;IACzD,OAAO,EAAE,GAAG,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;AAC7C,CAAC,CAAC;AAEF,MAAM,0BAA0B,GAAG,CAAC,KAA8B,EAA2B,EAAE;IAC7F,MAAM,SAAS,GAA4B,EAAE,CAAC;IAC9C,KAAK,MAAM,GAAG,IAAI,2BAA2B,EAAE,CAAC;QAC9C,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;YAC7B,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,oDAAoD;AACpD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,MAAS,EACT,SAAmC,EACf,EAAE;IACtB,IAAI,oBAAoB,CAAC,GAAG,CAAC,oBAAoB,EAAE,MAA0B,EAAE,SAAS,CAAC,EAAE,CAAC;QAC1F,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,CAAC,MAA0B,CAAM,EAAE,CAAC;AAC1F,CAAC,CAAC;AAEF,4EAA4E;AAC5E,yEAAyE;AACzE,8EAA8E;AAC9E,uEAAuE;AACvE,4EAA4E;AAC5E,yEAAyE;AACzE,MAAM,CAAC,MAAM,0BAA0B,GAAG,0BAA0B,CAAC;AAErE,MAAM,uBAAuB,GAAG,CAAC,KAAc,EAAW,EAAE;IAC1D,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,0BAA0B,CAAC;AACpC,CAAC,CAAC;AAEF,4EAA4E;AAC5E,6EAA6E;AAC7E,6EAA6E;AAC7E,iBAAiB;AACjB,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAC3C,IAAO,EACP,SAAmC,EAChC,EAAE;IACL,IAAI,oBAAoB,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAwB,EAAE,SAAS,CAAC,EAAE,CAAC;QACxF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,EAAE,GAAI,IAAyB,EAAE,CAAC;IAEhD,IAAI,KAAK,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAgC,CAAC;QACrD,KAAK,CAAC,KAAK;YACT,KAAK,CAAC,YAAY,KAAK,UAAU;gBAC/B,CAAC,CAAC;oBACE,YAAY,EAAE,UAAU;oBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;iBACzC;gBACH,CAAC,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACrD,KAAK,CAAC,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC,MAA0B,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,OAAO,IAAI,KAAK,EAAE,CAAC;QACrB,KAAK,CAAC,KAAK,GAAG,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,KAAU,CAAC;AACpB,CAAC,CAAC"}

package/dist/services/sseService.js

@@ -14,6 +14,7 @@ import { getBearerAuthHeaderValue, getBearerTokenFromHeaders } from '../utils/be
 import { HostedAuthUnavailableError, isHostedApiKey, validateHostedBearer, } from './hostedAuthService.js';
 import { isHostedModeEnabled } from './hostedMode.js';
 import { authenticateForwardAuthToken } from './forwardAuthService.js';
+import { getPublicResourceUrl, getResourceMetadataUrl } from '../utils/protectedResource.js';
 import { logger } from '../utils/logger.js';
 export const transports = {};
 const SESSION_NOT_FOUND_CODE = -32001;
@@ -435,29 +436,7 @@ const attachUserContextFromBearer = (result, res) => {
 const escapeHeaderValue = (value) => {
     return value.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
 };
-const buildResourceMetadataUrl = (req) => {
-    const forwardedProto = req.headers['x-forwarded-proto']
-        ?.split(',')[0]
-        ?.trim();
-    const protocol = forwardedProto || req.protocol || 'http';
-    const forwardedHost = req.headers['x-forwarded-host']
-        ?.split(',')[0]
-        ?.trim();
-    const host = forwardedHost ||
-        req.headers.host ||
-        req.headers[':authority'];
-    if (!host) {
-        return undefined;
-    }
-    const origin = `${protocol}://${host}`;
-    const basePath = config.basePath || '';
-    if (!basePath || basePath === '/') {
-        return `${origin}/.well-known/oauth-protected-resource`;
-    }
-    const normalizedBasePath = `${basePath.startsWith('/') ? '' : '/'}${basePath}`.replace(/\/+$/, '');
-    return `${origin}/.well-known/oauth-protected-resource${normalizedBasePath}`;
-};
-const sendBearerAuthError = (req, res, reason) => {
+const sendBearerAuthError = async (req, res, reason) => {
     if (reason === 'forbidden') {
         res.status(403).json({
             error: 'forbidden',
@@ -474,7 +453,8 @@ const sendBearerAuthError = (req, res, reason) => {
         return;
     }
     const errorDescription = reason === 'missing' ? 'No authorization provided' : 'Invalid bearer token';
-    const resourceMetadataUrl = buildResourceMetadataUrl(req);
+    const systemConfig = await getSystemConfigDao().get();
+    const resourceMetadataUrl = getResourceMetadataUrl(getPublicResourceUrl(req, systemConfig));
     const headerParts = [
         'error="invalid_token"',
         `error_description="${escapeHeaderValue(errorDescription)}"`,
@@ -501,7 +481,7 @@ export const handleSseConnection = async (req, res) => {
     // Check bearer auth using filtered settings
     const bearerAuthResult = await validateBearerAuth(req);
     if (!bearerAuthResult.valid) {
-        sendBearerAuthError(req, res, bearerAuthResult.reason);
+        await sendBearerAuthError(req, res, bearerAuthResult.reason);
         return;
     }
     attachUserContextFromBearer(bearerAuthResult, res);
@@ -564,7 +544,7 @@ export const handleSseMessage = async (req, res) => {
     // Check bearer auth using filtered settings
     const bearerAuthResult = await validateBearerAuth(req);
     if (!bearerAuthResult.valid) {
-        sendBearerAuthError(req, res, bearerAuthResult.reason);
+        await sendBearerAuthError(req, res, bearerAuthResult.reason);
         return;
     }
     attachUserContextFromBearer(bearerAuthResult, res);
@@ -674,7 +654,7 @@ export const handleMcpPostRequest = async (req, res) => {
     // Check bearer auth using filtered settings
     const bearerAuthResult = await validateBearerAuth(req);
     if (!bearerAuthResult.valid) {
-        sendBearerAuthError(req, res, bearerAuthResult.reason);
+        await sendBearerAuthError(req, res, bearerAuthResult.reason);
         return;
     }
     attachUserContextFromBearer(bearerAuthResult, res);
@@ -714,8 +694,8 @@ export const handleMcpPostRequest = async (req, res) => {
             context.sessionId = undefined;
             const requestMeta = (Array.isArray(req.body) ? req.body[0] : req.body)?.params?._meta;
             context.clientCapabilities = requestMeta?.['io.modelcontextprotocol/clientCapabilities'];
-            // Bind explicit state to the authenticated credential, user and route.
-            // Never treat an arbitrary header or an unauthenticated token as identity.
+            // Bind application state to the authenticated credential, user and route.
+            // Never treat caller-provided correlation metadata as identity.
             const token = getBearerTokenFromHeaders(req.headers, systemConfig);
             if (token && (systemConfig?.routing?.enableBearerAuth ?? true)) {
                 context.clientStateScope = createHash('sha256')
@@ -843,7 +823,7 @@ export const handleMcpOtherRequest = async (req, res) => {
     // Check bearer auth using filtered settings
     const bearerAuthResult = await validateBearerAuth(req);
     if (!bearerAuthResult.valid) {
-        sendBearerAuthError(req, res, bearerAuthResult.reason);
+        await sendBearerAuthError(req, res, bearerAuthResult.reason);
         return;
     }
     attachUserContextFromBearer(bearerAuthResult, res);