@se-studio/contentful-cms 3.15.2 → 3.15.4

package/dist/hosted/oauth/cimd.d.ts

@@ -0,0 +1,17 @@
+export declare const CIMD_CLIENT_TTL_SECONDS: number;
+export interface ClientIdMetadata {
+    clientId: string;
+    redirectUris: string[];
+    clientName?: string;
+}
+export declare class CimdError extends Error {
+    constructor(message: string);
+}
+export declare function isCimdClientId(clientId: string): boolean;
+export type CimdHostResolver = (hostname: string) => Promise<readonly string[]>;
+export declare function isBlockedCimdAddress(address: string): boolean;
+export declare function parseClientIdMetadata(clientId: string, body: unknown): ClientIdMetadata;
+export declare function metadataAllowsRedirect(metadata: ClientIdMetadata, redirectUri: string): boolean;
+/** Fetch a Client ID Metadata Document. Redirects are rejected. */
+export declare function fetchClientIdMetadata(clientId: string, fetchImpl?: typeof fetch, resolveHost?: CimdHostResolver): Promise<ClientIdMetadata>;
+//# sourceMappingURL=cimd.d.ts.map

package/dist/hosted/oauth/cimd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cimd.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/cimd.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,uBAAuB,QAAU,CAAC;AAK/C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAExD;AAED,MAAM,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;AAmChF,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAoC7D;AAkED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,gBAAgB,CAoCvF;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAE/F;AAiHD,mEAAmE;AACnE,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,EAChB,SAAS,GAAE,OAAO,KAAa,EAC/B,WAAW,GAAE,gBAAqC,GACjD,OAAO,CAAC,gBAAgB,CAAC,CAyB3B"}

package/dist/hosted/oauth/cimd.js

@@ -0,0 +1,300 @@
+import { lookup } from 'node:dns/promises';
+import * as https from 'node:https';
+import { isIP } from 'node:net';
+import { redirectUriMatchesRegistered } from './redirect-uri.js';
+export const CIMD_CLIENT_TTL_SECONDS = 60 * 60;
+const CIMD_MAX_BYTES = 65_536;
+const CIMD_TIMEOUT_MS = 5_000;
+export class CimdError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'CimdError';
+    }
+}
+export function isCimdClientId(clientId) {
+    return clientId.startsWith('https://');
+}
+/** Node leaves a trailing dot on the hostname (`localhost.` still resolves to loopback). */
+function canonicalHostname(hostname) {
+    return hostname.toLowerCase().replace(/\.+$/, '');
+}
+function ipv4ToInt(ip) {
+    const parts = ip.split('.');
+    if (parts.length !== 4) {
+        return null;
+    }
+    let value = 0;
+    for (const part of parts) {
+        if (!/^\d{1,3}$/.test(part)) {
+            return null;
+        }
+        const octet = Number(part);
+        if (octet > 255) {
+            return null;
+        }
+        value = (value << 8) | octet;
+    }
+    return value >>> 0;
+}
+function inIpv4Cidr(ip, base, bits) {
+    const baseInt = ipv4ToInt(base);
+    if (baseInt === null) {
+        return false;
+    }
+    const mask = bits === 0 ? 0 : (0xffffffff << (32 - bits)) >>> 0;
+    return (ip & mask) === (baseInt & mask);
+}
+export function isBlockedCimdAddress(address) {
+    const normalized = address.toLowerCase().replace(/^\[|\]$/g, '');
+    if (normalized.startsWith('::ffff:')) {
+        const mapped = normalized.slice('::ffff:'.length);
+        if (mapped.includes('.')) {
+            return isBlockedCimdAddress(mapped);
+        }
+    }
+    if (normalized.includes(':')) {
+        if (normalized === '::' || normalized === '::1') {
+            return true;
+        }
+        const head = Number.parseInt(normalized.split(':')[0] || '0', 16);
+        if (Number.isNaN(head)) {
+            return true;
+        }
+        if ((head & 0xfe00) === 0xfc00) {
+            return true;
+        }
+        if ((head & 0xffc0) === 0xfe80) {
+            return true;
+        }
+        return false;
+    }
+    const ip = ipv4ToInt(normalized);
+    if (ip === null) {
+        return false;
+    }
+    return (inIpv4Cidr(ip, '0.0.0.0', 8) ||
+        inIpv4Cidr(ip, '10.0.0.0', 8) ||
+        inIpv4Cidr(ip, '127.0.0.0', 8) ||
+        inIpv4Cidr(ip, '169.254.0.0', 16) ||
+        inIpv4Cidr(ip, '172.16.0.0', 12) ||
+        inIpv4Cidr(ip, '192.168.0.0', 16));
+}
+function assertPublicHostname(host) {
+    if (host.length === 0 ||
+        host === 'localhost' ||
+        host.endsWith('.localhost') ||
+        host.endsWith('.local') ||
+        host.endsWith('.internal') ||
+        host.includes(':') ||
+        host.includes('%')) {
+        throw new CimdError('Client ID metadata host is not public.');
+    }
+    if (isIP(host) !== 0 || /^\d+\.\d+\.\d+\.\d+$/.test(host)) {
+        throw new CimdError('Client ID metadata host is not public.');
+    }
+}
+function assertPublicHttps(clientId) {
+    let url;
+    try {
+        url = new URL(clientId);
+    }
+    catch {
+        throw new CimdError('client_id is not a URL.');
+    }
+    if (url.protocol !== 'https:') {
+        throw new CimdError('Client ID metadata must be HTTPS.');
+    }
+    if (url.username || url.password) {
+        throw new CimdError('Client ID metadata URL must not include credentials.');
+    }
+    assertPublicHostname(canonicalHostname(url.hostname));
+    return url;
+}
+async function defaultResolveHost(hostname) {
+    const records = await lookup(hostname, { all: true, verbatim: true });
+    return records.map((record) => record.address);
+}
+async function assertStablePublicDns(hostname, resolveHost) {
+    let first;
+    let second;
+    try {
+        first = await resolveHost(hostname);
+        second = await resolveHost(hostname);
+    }
+    catch (error) {
+        if (error instanceof CimdError) {
+            throw error;
+        }
+        throw new CimdError('Client ID metadata host could not be resolved.');
+    }
+    const blocked = [...first, ...second].filter((address) => isBlockedCimdAddress(address));
+    const same = first.length > 0 &&
+        second.length === first.length &&
+        second.every((address, index) => address === first[index]);
+    if (blocked.length > 0 || !same) {
+        throw new CimdError('Client ID metadata host is not public.');
+    }
+}
+export function parseClientIdMetadata(clientId, body) {
+    if (!body || typeof body !== 'object') {
+        throw new CimdError('Client ID metadata is not a JSON object.');
+    }
+    const record = body;
+    if (record.client_id !== clientId) {
+        throw new CimdError('Client ID metadata client_id does not match the requested client.');
+    }
+    const supported = Array.isArray(record.token_endpoint_auth_methods_supported)
+        ? record.token_endpoint_auth_methods_supported
+        : [];
+    const supportsNone = record.token_endpoint_auth_method === undefined ||
+        record.token_endpoint_auth_method === 'none' ||
+        supported.includes('none');
+    if (!supportsNone) {
+        throw new CimdError('Only public clients (token_endpoint_auth_method none) are supported.');
+    }
+    if (!Array.isArray(record.redirect_uris) || record.redirect_uris.length === 0) {
+        throw new CimdError('Client ID metadata is missing redirect_uris.');
+    }
+    const redirectUris = record.redirect_uris.filter((uri) => typeof uri === 'string');
+    if (redirectUris.length !== record.redirect_uris.length) {
+        throw new CimdError('Client ID metadata redirect_uris must be strings.');
+    }
+    return {
+        clientId,
+        redirectUris,
+        clientName: typeof record.client_name === 'string' ? record.client_name : undefined,
+    };
+}
+export function metadataAllowsRedirect(metadata, redirectUri) {
+    return redirectUriMatchesRegistered(metadata.redirectUris, redirectUri);
+}
+async function readCappedBody(response) {
+    const declared = response.headers.get('content-length');
+    if (declared !== null && Number(declared) > CIMD_MAX_BYTES) {
+        throw new CimdError('Client ID metadata document is too large.');
+    }
+    const reader = response.body?.getReader();
+    if (!reader) {
+        const text = await response.text();
+        if (Buffer.byteLength(text) > CIMD_MAX_BYTES) {
+            throw new CimdError('Client ID metadata document is too large.');
+        }
+        return text;
+    }
+    const chunks = [];
+    let total = 0;
+    while (true) {
+        const { done, value } = await reader.read();
+        if (done) {
+            break;
+        }
+        if (!value) {
+            continue;
+        }
+        total += value.byteLength;
+        if (total > CIMD_MAX_BYTES) {
+            await reader.cancel();
+            throw new CimdError('Client ID metadata document is too large.');
+        }
+        chunks.push(value);
+    }
+    return Buffer.concat(chunks).toString('utf8');
+}
+function httpsGetPublic(url, signal) {
+    return new Promise((resolve, reject) => {
+        const req = https.get(url, {
+            headers: { accept: 'application/json' },
+            signal,
+            lookup: (hostname, options, callback) => {
+                lookup(hostname, { all: true, verbatim: true })
+                    .then((records) => {
+                    if (records.length === 0 ||
+                        records.some((record) => isBlockedCimdAddress(record.address))) {
+                        callback(new Error('Client ID metadata host is not public.'), '', 4);
+                        return;
+                    }
+                    const first = records[0];
+                    if (!first) {
+                        callback(new Error('Client ID metadata host could not be resolved.'), '', 4);
+                        return;
+                    }
+                    if (typeof options === 'object' && options.all) {
+                        callback(null, records);
+                        return;
+                    }
+                    callback(null, first.address, first.family);
+                })
+                    .catch((error) => {
+                    callback(error instanceof Error ? error : new Error(String(error)), '', 4);
+                });
+            },
+        }, (res) => {
+            const chunks = [];
+            let total = 0;
+            const declared = res.headers['content-length'];
+            if (declared !== undefined && Number(declared) > CIMD_MAX_BYTES) {
+                req.destroy();
+                reject(new CimdError('Client ID metadata document is too large.'));
+                return;
+            }
+            res.on('data', (chunk) => {
+                total += chunk.length;
+                if (total > CIMD_MAX_BYTES) {
+                    req.destroy();
+                    reject(new CimdError('Client ID metadata document is too large.'));
+                    return;
+                }
+                chunks.push(chunk);
+            });
+            res.on('end', () => {
+                resolve({ status: res.statusCode ?? 0, body: Buffer.concat(chunks).toString('utf8') });
+            });
+        });
+        req.on('error', (error) => {
+            reject(error);
+        });
+    });
+}
+function parseFetchedMetadata(clientId, status, text) {
+    if (status < 200 || status >= 300) {
+        throw new CimdError(`Client ID metadata request failed (${String(status)}).`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        throw new CimdError('Client ID metadata is not JSON.');
+    }
+    return parseClientIdMetadata(clientId, parsed);
+}
+/** Fetch a Client ID Metadata Document. Redirects are rejected. */
+export async function fetchClientIdMetadata(clientId, fetchImpl = fetch, resolveHost = defaultResolveHost) {
+    const url = assertPublicHttps(clientId);
+    await assertStablePublicDns(canonicalHostname(url.hostname), resolveHost);
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), CIMD_TIMEOUT_MS);
+    try {
+        if (fetchImpl !== fetch) {
+            const response = await fetchImpl(clientId, {
+                method: 'GET',
+                redirect: 'error',
+                signal: controller.signal,
+                headers: { accept: 'application/json' },
+            });
+            return parseFetchedMetadata(clientId, response.status, await readCappedBody(response));
+        }
+        const result = await httpsGetPublic(clientId, controller.signal);
+        return parseFetchedMetadata(clientId, result.status, result.body);
+    }
+    catch (error) {
+        if (error instanceof CimdError) {
+            throw error;
+        }
+        throw new CimdError('Client ID metadata could not be fetched.');
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+//# sourceMappingURL=cimd.js.map

package/dist/hosted/oauth/cimd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cimd.js","sourceRoot":"","sources":["../../../src/hosted/oauth/cimd.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,KAAK,KAAK,MAAM,YAAY,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AAEjE,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,CAAC;AAE/C,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,eAAe,GAAG,KAAK,CAAC;AAQ9B,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,OAAO,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AACzC,CAAC;AAID,4FAA4F;AAC5F,SAAS,iBAAiB,CAAC,QAAgB;IACzC,OAAO,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,SAAS,CAAC,EAAU;IAC3B,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC;IAC/B,CAAC;IACD,OAAO,KAAK,KAAK,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,UAAU,CAAC,EAAU,EAAE,IAAY,EAAE,IAAY;IACxD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;IAChE,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACjE,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;QAClE,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,EAAE,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACjC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAChB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CACL,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAC5B,UAAU,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;QAC7B,UAAU,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;QAC9B,UAAU,CAAC,EAAE,EAAE,aAAa,EAAE,EAAE,CAAC;QACjC,UAAU,CAAC,EAAE,EAAE,YAAY,EAAE,EAAE,CAAC;QAChC,UAAU,CAAC,EAAE,EAAE,aAAa,EAAE,EAAE,CAAC,CAClC,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY;IACxC,IACE,IAAI,CAAC,MAAM,KAAK,CAAC;QACjB,IAAI,KAAK,WAAW;QACpB,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACvB,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC1B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAClB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAClB,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB;IACzC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,SAAS,CAAC,yBAAyB,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,SAAS,CAAC,mCAAmC,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,SAAS,CAAC,sDAAsD,CAAC,CAAC;IAC9E,CAAC;IACD,oBAAoB,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,QAAgB;IAChD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACtE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,QAAgB,EAChB,WAA6B;IAE7B,IAAI,KAAwB,CAAC;IAC7B,IAAI,MAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;YAC/B,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,EAAE,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC;IACzF,MAAM,IAAI,GACR,KAAK,CAAC,MAAM,GAAG,CAAC;QAChB,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAC9B,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAgB,EAAE,IAAa;IACnE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,SAAS,CAAC,0CAA0C,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,IAMd,CAAC;IACF,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,IAAI,SAAS,CAAC,mEAAmE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,qCAAqC,CAAC;QAC3E,CAAC,CAAC,MAAM,CAAC,qCAAqC;QAC9C,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,YAAY,GAChB,MAAM,CAAC,0BAA0B,KAAK,SAAS;QAC/C,MAAM,CAAC,0BAA0B,KAAK,MAAM;QAC5C,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,SAAS,CAAC,sEAAsE,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,SAAS,CAAC,8CAA8C,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC;IAClG,IAAI,YAAY,CAAC,MAAM,KAAK,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;QACxD,MAAM,IAAI,SAAS,CAAC,mDAAmD,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO;QACL,QAAQ;QACR,YAAY;QACZ,UAAU,EAAE,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;KACpF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,QAA0B,EAAE,WAAmB;IACpF,OAAO,4BAA4B,CAAC,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;AAC1E,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,QAAkB;IAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACxD,IAAI,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,cAAc,EAAE,CAAC;QAC3D,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,cAAc,EAAE,CAAC;YAC7C,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI,EAAE,CAAC;YACT,MAAM;QACR,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,SAAS;QACX,CAAC;QACD,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;QAC1B,IAAI,KAAK,GAAG,cAAc,EAAE,CAAC;YAC3B,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,cAAc,CACrB,GAAW,EACX,MAAmB;IAEnB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CACnB,GAAG,EACH;YACE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,MAAM;YACN,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;gBACtC,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;qBAC5C,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;oBAChB,IACE,OAAO,CAAC,MAAM,KAAK,CAAC;wBACpB,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAC9D,CAAC;wBACD,QAAQ,CAAC,IAAI,KAAK,CAAC,wCAAwC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;wBACrE,OAAO;oBACT,CAAC;oBACD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;oBACzB,IAAI,CAAC,KAAK,EAAE,CAAC;wBACX,QAAQ,CAAC,IAAI,KAAK,CAAC,gDAAgD,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;wBAC7E,OAAO;oBACT,CAAC;oBACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;wBAC/C,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;wBACxB,OAAO;oBACT,CAAC;oBACD,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC9C,CAAC,CAAC;qBACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;oBACxB,QAAQ,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC7E,CAAC,CAAC,CAAC;YACP,CAAC;SACF,EACD,CAAC,GAAG,EAAE,EAAE;YACN,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;YAC/C,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,cAAc,EAAE,CAAC;gBAChE,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC,CAAC;gBACnE,OAAO;YACT,CAAC;YACD,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAC/B,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;gBACtB,IAAI,KAAK,GAAG,cAAc,EAAE,CAAC;oBAC3B,GAAG,CAAC,OAAO,EAAE,CAAC;oBACd,MAAM,CAAC,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC,CAAC;oBACnE,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzF,CAAC,CAAC,CAAC;QACL,CAAC,CACF,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACxB,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAgB,EAAE,MAAc,EAAE,IAAY;IAC1E,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QAClC,MAAM,IAAI,SAAS,CAAC,sCAAsC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,SAAS,CAAC,iCAAiC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AACjD,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAAgB,EAChB,SAAS,GAAiB,KAAK,EAC/B,WAAW,GAAqB,kBAAkB;IAElD,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,qBAAqB,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAC;IAC1E,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,eAAe,CAAC,CAAC;IACpE,IAAI,CAAC;QACH,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE;gBACzC,MAAM,EAAE,KAAK;gBACb,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;aACxC,CAAC,CAAC;YACH,OAAO,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACjE,OAAO,oBAAoB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;YAC/B,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,0CAA0C,CAAC,CAAC;IAClE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC"}

package/dist/hosted/oauth/complete.d.ts

@@ -12,5 +12,6 @@ export declare function completeAuthorizationCodeGrant(store: OAuthStore, input:
     tokenType: string;
     expiresIn: number;
     refreshToken: string;
+    scope: string;
 }>;
 //# sourceMappingURL=complete.d.ts.map

package/dist/hosted/oauth/complete.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"complete.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/complete.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEjE,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,UAAU,EACjB,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED,wBAAsB,8BAA8B,CAClD,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE;IACL,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uBAAuB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D,GACA,OAAO,CAAC;IACT,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC,CAmDD"}
+{"version":3,"file":"complete.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/complete.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEjE,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,UAAU,EACjB,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED,wBAAsB,8BAA8B,CAClD,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE;IACL,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uBAAuB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D,GACA,OAAO,CAAC;IACT,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACf,CAAC,CAsDD"}

package/dist/hosted/oauth/complete.js

@@ -3,6 +3,7 @@ import { loadAndValidateContentfulToken } from './cached-cma.js';
 import { signMcpAccessToken } from './jwt.js';
 import { generateAuthCode } from './pkce.js';
 import { redirectUrisEquivalent } from './redirect-uri.js';
+import { CMS_EDIT_OAUTH_SCOPE } from './scopes.js';
 export async function issueAuthorizationRedirect(store, authRequestId, sub, request) {
     const code = generateAuthCode();
     await store.saveAuthCode(code, { authRequestId, sub });
@@ -40,16 +41,19 @@ export async function completeAuthorizationCodeGrant(store, input) {
     }
     const { accessToken, expiresIn } = await signMcpAccessToken(codeRecord.sub, authRequest.resource);
     const refreshToken = randomUUID();
+    const scope = authRequest.scope ?? CMS_EDIT_OAUTH_SCOPE;
     await store.saveRefreshToken(refreshToken, {
         sub: codeRecord.sub,
         clientId: authRequest.clientId,
         resource: authRequest.resource,
+        scope,
     });
     return {
         accessToken,
         tokenType: 'Bearer',
         expiresIn,
         refreshToken,
+        scope,
     };
 }
 //# sourceMappingURL=complete.js.map

package/dist/hosted/oauth/complete.js.map

@@ -1 +1 @@
-{"version":3,"file":"complete.js","sourceRoot":"","sources":["../../../src/hosted/oauth/complete.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAG3D,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAiB,EACjB,aAAqB,EACrB,GAAW,EACX,OAA2B;IAE3B,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;IAEvD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9C,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,QAAQ,CAAC,QAAQ,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAiB,EACjB,KAOC;IAOD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IAChF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,WAAW,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACnF,IAAI,MAAM,KAAK,WAAW,CAAC,aAAa,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,8BAA8B,CAClC,KAAK,EACL,UAAU,CAAC,GAAG,EACd,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,uBAAuB,CAC9B,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAElG,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC;IAClC,MAAM,KAAK,CAAC,gBAAgB,CAAC,YAAY,EAAE;QACzC,GAAG,EAAE,UAAU,CAAC,GAAG;QACnB,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,QAAQ,EAAE,WAAW,CAAC,QAAQ;KAC/B,CAAC,CAAC;IAEH,OAAO;QACL,WAAW;QACX,SAAS,EAAE,QAAQ;QACnB,SAAS;QACT,YAAY;KACb,CAAC;AACJ,CAAC"}
+{"version":3,"file":"complete.js","sourceRoot":"","sources":["../../../src/hosted/oauth/complete.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAGnD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAiB,EACjB,aAAqB,EACrB,GAAW,EACX,OAA2B;IAE3B,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;IAEvD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9C,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,QAAQ,CAAC,QAAQ,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAiB,EACjB,KAOC;IAQD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IAChF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,WAAW,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACnF,IAAI,MAAM,KAAK,WAAW,CAAC,aAAa,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,8BAA8B,CAClC,KAAK,EACL,UAAU,CAAC,GAAG,EACd,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,uBAAuB,CAC9B,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAElG,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,IAAI,oBAAoB,CAAC;IACxD,MAAM,KAAK,CAAC,gBAAgB,CAAC,YAAY,EAAE;QACzC,GAAG,EAAE,UAAU,CAAC,GAAG;QACnB,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,KAAK;KACN,CAAC,CAAC;IAEH,OAAO;QACL,WAAW;QACX,SAAS,EAAE,QAAQ;QACnB,SAAS;QACT,YAAY;QACZ,KAAK;KACN,CAAC;AACJ,CAAC"}

package/dist/hosted/oauth/config.d.ts

@@ -1,5 +1,7 @@
 export declare function getPublicOrigin(): string;
 export declare function getMcpResourceUrl(): string;
+/** RFC 9728 path suffix for the MCP resource (`/.well-known/oauth-protected-resource/api/mcp`). */
+export declare function isMcpProtectedResourcePath(segments: readonly string[]): boolean;
 export declare function getContentfulOAuthClientId(): string;
 export declare function getContentfulOAuthRedirectUri(): string;
 export declare function getContentfulAuthorizeUrl(authRequestId: string): string;

package/dist/hosted/oauth/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/config.ts"],"names":[],"mappings":"AAQA,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,wBAAgB,0BAA0B,IAAI,MAAM,CAEnD;AAED,wBAAgB,6BAA6B,IAAI,MAAM,CAEtD;AAED,wBAAgB,yBAAyB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CASvE;AAED,wBAAgB,+BAA+B,IAAI,MAAM,CAExD"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/config.ts"],"names":[],"mappings":"AAQA,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,mGAAmG;AACnG,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAE/E;AAED,wBAAgB,0BAA0B,IAAI,MAAM,CAEnD;AAED,wBAAgB,6BAA6B,IAAI,MAAM,CAEtD;AAED,wBAAgB,yBAAyB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CASvE;AAED,wBAAgB,+BAA+B,IAAI,MAAM,CAExD"}

package/dist/hosted/oauth/config.js

@@ -11,6 +11,10 @@ export function getPublicOrigin() {
 export function getMcpResourceUrl() {
     return `${getPublicOrigin()}/api/mcp`;
 }
+/** RFC 9728 path suffix for the MCP resource (`/.well-known/oauth-protected-resource/api/mcp`). */
+export function isMcpProtectedResourcePath(segments) {
+    return segments.join('/') === 'api/mcp';
+}
 export function getContentfulOAuthClientId() {
     return requireEnv('CONTENTFUL_OAUTH_CLIENT_ID');
 }

package/dist/hosted/oauth/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/hosted/oauth/config.ts"],"names":[],"mappings":"AAAA,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,UAAU,CAAC,wBAAwB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,GAAG,eAAe,EAAE,UAAU,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,OAAO,UAAU,CAAC,4BAA4B,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,6BAA6B;IAC3C,OAAO,GAAG,eAAe,EAAE,4BAA4B,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,aAAqB;IAC7D,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,aAAa,EAAE,OAAO;QACtB,SAAS,EAAE,0BAA0B,EAAE;QACvC,YAAY,EAAE,6BAA6B,EAAE;QAC7C,KAAK,EAAE,2BAA2B;QAClC,KAAK,EAAE,aAAa;KACrB,CAAC,CAAC;IACH,OAAO,6CAA6C,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,+BAA+B;IAC7C,OAAO,GAAG,eAAe,EAAE,uCAAuC,CAAC;AACrE,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/hosted/oauth/config.ts"],"names":[],"mappings":"AAAA,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,UAAU,CAAC,wBAAwB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,GAAG,eAAe,EAAE,UAAU,CAAC;AACxC,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,0BAA0B,CAAC,QAA2B;IACpE,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,OAAO,UAAU,CAAC,4BAA4B,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,6BAA6B;IAC3C,OAAO,GAAG,eAAe,EAAE,4BAA4B,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,aAAqB;IAC7D,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,aAAa,EAAE,OAAO;QACtB,SAAS,EAAE,0BAA0B,EAAE;QACvC,YAAY,EAAE,6BAA6B,EAAE;QAC7C,KAAK,EAAE,2BAA2B;QAClC,KAAK,EAAE,aAAa;KACrB,CAAC,CAAC;IACH,OAAO,6CAA6C,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,+BAA+B;IAC7C,OAAO,GAAG,eAAe,EAAE,uCAAuC,CAAC;AACrE,CAAC"}

package/dist/hosted/oauth/cors.d.ts

@@ -0,0 +1,4 @@
+export declare function corsPreflight(): Response;
+/** Copy a response and add discovery CORS headers. Body is a single read. */
+export declare function withCors(response: Response): Response;
+//# sourceMappingURL=cors.d.ts.map

package/dist/hosted/oauth/cors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/cors.ts"],"names":[],"mappings":"AASA,wBAAgB,aAAa,IAAI,QAAQ,CAExC;AAED,6EAA6E;AAC7E,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAUrD"}

package/dist/hosted/oauth/cors.js

@@ -0,0 +1,23 @@
+const CORS_HEADERS = {
+    'Access-Control-Allow-Origin': '*',
+    'Access-Control-Allow-Methods': 'GET, POST, DELETE, OPTIONS',
+    'Access-Control-Allow-Headers': 'Authorization, Content-Type, MCP-Protocol-Version, Mcp-Protocol-Version, Mcp-Session-Id, Last-Event-ID',
+    'Access-Control-Expose-Headers': 'WWW-Authenticate, MCP-Protocol-Version, Mcp-Session-Id',
+    'Access-Control-Max-Age': '86400',
+};
+export function corsPreflight() {
+    return new Response(null, { status: 204, headers: CORS_HEADERS });
+}
+/** Copy a response and add discovery CORS headers. Body is a single read. */
+export function withCors(response) {
+    const headers = new Headers(response.headers);
+    for (const [name, value] of Object.entries(CORS_HEADERS)) {
+        headers.set(name, value);
+    }
+    return new Response(response.body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers,
+    });
+}
+//# sourceMappingURL=cors.js.map

package/dist/hosted/oauth/cors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../../src/hosted/oauth/cors.ts"],"names":[],"mappings":"AAAA,MAAM,YAAY,GAA2B;IAC3C,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,4BAA4B;IAC5D,8BAA8B,EAC5B,wGAAwG;IAC1G,+BAA+B,EAAE,wDAAwD;IACzF,wBAAwB,EAAE,OAAO;CAClC,CAAC;AAEF,MAAM,UAAU,aAAa;IAC3B,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;AACpE,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,QAAQ,CAAC,QAAkB;IACzC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;KACR,CAAC,CAAC;AACL,CAAC"}

package/dist/hosted/oauth/handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,sBAAsB,EAA4B,MAAM,wBAAwB,CAAC;AAW/F,OAAO,EAAgC,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAG3E,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,UAAU,CAAC;IAClB,UAAU,EAAE,sBAAsB,CAAC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAeD,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CAuDnB;AAED,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CAyBnB;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CA8FnB;AAED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CAiDnB;AAED,wBAAgB,yCAAyC,IAAI,QAAQ,CAYpE;AAED,wBAAgB,uCAAuC,IAAI,QAAQ,CAMlE;AAED,wBAAsB,sBAAsB,IAAI,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBvF"}
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,sBAAsB,EAA4B,MAAM,wBAAwB,CAAC;AAmB/F,OAAO,EAGL,KAAK,UAAU,EAChB,MAAM,YAAY,CAAC;AAGpB,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,UAAU,CAAC;IAClB,UAAU,EAAE,sBAAsB,CAAC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAmDD,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CA0EnB;AAED,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CA4BnB;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CAgGnB;AAED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CAiDnB;AAED,wBAAgB,yCAAyC,IAAI,QAAQ,CAcpE;AAED,wBAAgB,uCAAuC,IAAI,QAAQ,CAQlE;AAED,wBAAsB,sBAAsB,IAAI,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBvF"}

package/dist/hosted/oauth/handlers.js

@@ -1,18 +1,48 @@
 import { validatePatForDeployment } from '../../config/hosted.js';
 import { flushTelemetry, recordOAuthTelemetryFailure, recordOAuthTelemetrySuccess, } from '../../telemetry/index.js';
+import { CIMD_CLIENT_TTL_SECONDS, fetchClientIdMetadata, isCimdClientId, metadataAllowsRedirect, } from './cimd.js';
 import { completeAuthorizationCodeGrant, issueAuthorizationRedirect } from './complete.js';
 import { getContentfulAuthorizeUrl, getMcpResourceUrl, getPublicOrigin } from './config.js';
 import { oauthLogAuthFailure, oauthLogVerbose, patValidationFailureReason } from './log.js';
+import { noteOauthRedirect } from './redirect-hosts.js';
 import { normalizeLoopbackRedirectUri, redirectUriMatchesRegistered } from './redirect-uri.js';
 import { completeRefreshTokenGrant } from './refresh.js';
-import { CONTENTFUL_TOKEN_TTL_SECONDS } from './store.js';
+import { CMS_EDIT_OAUTH_SCOPES, resolveGrantedScope } from './scopes.js';
+import { CONTENTFUL_TOKEN_TTL_SECONDS, } from './store.js';
 import { oauthTokenGrantFailureResponse } from './token-grant-response.js';
-function errorRedirect(redirectUri, message, state) {
+async function resolveAuthorizeClient(ctx, clientId, redirectUri) {
+    const existing = await ctx.store.getOAuthClient(clientId);
+    if (existing) {
+        return existing;
+    }
+    if (!isCimdClientId(clientId)) {
+        return null;
+    }
+    try {
+        const metadata = await fetchClientIdMetadata(clientId);
+        if (!metadataAllowsRedirect(metadata, redirectUri)) {
+            return 'redirect_mismatch';
+        }
+        const record = {
+            clientId: metadata.clientId,
+            redirectUris: metadata.redirectUris,
+            clientName: metadata.clientName,
+        };
+        await ctx.store.saveOAuthClient(record, CIMD_CLIENT_TTL_SECONDS);
+        return record;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : 'Invalid client metadata';
+        oauthLogAuthFailure('authorize', 'cimd', { message });
+        return null;
+    }
+}
+function errorRedirect(redirectUri, message, state, error = 'access_denied') {
     if (!redirectUri) {
         return new Response(message, { status: 400 });
     }
     const url = new URL(redirectUri);
-    url.searchParams.set('error', 'access_denied');
+    url.searchParams.set('error', error);
     url.searchParams.set('error_description', message);
     if (state) {
         url.searchParams.set('state', state);
@@ -40,18 +70,28 @@ export async function handleOAuthAuthorizeGet(request, ctx) {
         const redirect = await issueAuthorizationRedirect(ctx.store, resumeAuthRequestId, linkedSub, pending);
         return Response.redirect(redirect, 302);
     }
+    if (!clientId || !redirectUri) {
+        return new Response('Missing required OAuth parameters', { status: 400 });
+    }
+    const client = await resolveAuthorizeClient(ctx, clientId, redirectUri);
+    if (client === 'redirect_mismatch' ||
+        !client ||
+        !redirectUriMatchesRegistered(client.redirectUris, redirectUri)) {
+        return new Response('redirect_uri is not registered for this client', { status: 400 });
+    }
+    noteOauthRedirect(clientId, redirectUri);
     if (responseType !== 'code') {
         return errorRedirect(redirectUri, 'Unsupported response_type', state);
     }
-    if (!clientId || !redirectUri || !codeChallenge || !resource) {
+    if (!codeChallenge || !resource) {
         return errorRedirect(redirectUri, 'Missing required OAuth parameters', state);
     }
     if (codeChallengeMethod && codeChallengeMethod !== 'S256') {
         return errorRedirect(redirectUri, 'Only S256 code challenge is supported', state);
     }
-    const client = await ctx.store.getOAuthClient(clientId);
-    if (!client || !redirectUriMatchesRegistered(client.redirectUris, redirectUri)) {
-        return errorRedirect(redirectUri, 'Invalid client or redirect_uri', state);
+    const granted = resolveGrantedScope(url.searchParams.get('scope'));
+    if (!granted.ok) {
+        return errorRedirect(redirectUri, `Unknown scope: ${granted.unknown.join(' ')}`, state, 'invalid_scope');
     }
     const normalizedRedirectUri = normalizeLoopbackRedirectUri(redirectUri);
     const { authRequestId } = await ctx.store.savePendingAuthRequest({
@@ -60,6 +100,7 @@ export async function handleOAuthAuthorizeGet(request, ctx) {
         codeChallenge,
         state,
         resource,
+        scope: granted.scope,
     });
     const contentfulAuthorizeUrl = getContentfulAuthorizeUrl(authRequestId);
     return Response.redirect(contentfulAuthorizeUrl, 302);
@@ -80,6 +121,9 @@ export async function handleOAuthRegisterPost(request, ctx) {
         redirectUris,
         clientName: body.client_name,
     });
+    for (const uri of client.redirectUris) {
+        noteOauthRedirect(client.clientId, uri);
+    }
     return Response.json({
         client_id: client.clientId,
         client_id_issued_at: Math.floor(Date.now() / 1000),
@@ -129,6 +173,7 @@ export async function handleOAuthTokenPost(request, ctx) {
                 expires_in: token.expiresIn,
                 refresh_token: token.refreshToken,
                 refresh_token_expires_in: CONTENTFUL_TOKEN_TTL_SECONDS,
+                scope: token.scope,
             });
         }
         catch (error) {
@@ -165,6 +210,7 @@ export async function handleOAuthTokenPost(request, ctx) {
                 expires_in: token.expiresIn,
                 refresh_token: token.refreshToken,
                 refresh_token_expires_in: CONTENTFUL_TOKEN_TTL_SECONDS,
+                scope: token.scope,
             });
         }
         catch (error) {
@@ -232,6 +278,8 @@ export function handleOAuthAuthorizationServerMetadataGet() {
         grant_types_supported: ['authorization_code', 'refresh_token'],
         code_challenge_methods_supported: ['S256'],
         token_endpoint_auth_methods_supported: ['none'],
+        scopes_supported: [...CMS_EDIT_OAUTH_SCOPES],
+        client_id_metadata_document_supported: true,
     });
 }
 export function handleOAuthProtectedResourceMetadataGet() {
@@ -239,6 +287,8 @@ export function handleOAuthProtectedResourceMetadataGet() {
     return Response.json({
         resource: getMcpResourceUrl(),
         authorization_servers: [origin],
+        scopes_supported: [...CMS_EDIT_OAUTH_SCOPES],
+        bearer_methods_supported: ['header'],
     });
 }
 export async function handleOAuthHealthCheck() {