@shivaedev/mcp 0.1.11 → 0.2.1

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## 0.2.1 - 2026-10-31
+
+### Changed
+
+- Update `@shivaedev/access` from 0.3.3 to 0.3.4.
+- Update `@shivaedev/errors` from 0.3.0 to 0.4.0.
+- Update `@shivaedev/identity` from 0.12.0 to 0.13.0.
+
+## 0.2.0 - 2026-10-31
+
+### Added
+
+- Return `revokeClient(userId, clientId)` and `revokeAllClients(userId)` Effects from `betterAuthMcp` to delete consent and stored access and refresh tokens.
+- Allow provider `scopes`, including `offline_access`, and an in-process `jwks` source for token verification.
+
+### Fixed
+
+- Refuse banned users and access tokens whose client consent no longer exists with the MCP unauthorized resource challenge.
+
+### Breaking
+
+- Custom Better Auth wrappers passed to `betterAuthMcp` must expose the native context's adapter as well as its user lookup. Pass the full Better Auth instance. Custom signed tokens must identify their OAuth client and have stored consent for that user and client.
+
 ## 0.1.11 - 2026-10-31
 
 ### Changed

package/README.md

@@ -67,7 +67,7 @@ Application roles and grants come from `@shivaedev/access`; identity resolves th
 
 ### Connect OAuth to identity and the host
 
-The Better Auth adapter is an optional edge module. Add its provider to the auth instance used by identity, alongside Better Auth's JWT plugin. `mcpProvider` configures the `mcp` scope and the endpoint's OAuth resource. The application's login and consent pages implement the provider's ordinary UI flow; the provider owns authorization codes, PKCE and tokens.
+The Better Auth adapter is an optional edge module. Add its provider to the auth instance used by identity, alongside Better Auth's JWT plugin. `mcpProvider` defaults to the `mcp` scope and configures the endpoint's OAuth resource. Pass `scopes: ["mcp", "offline_access"]` to allow refresh tokens; the client must also register the `refresh_token` grant and request `offline_access` during authorization. The application's login and consent pages implement the provider's ordinary UI flow; the provider owns authorization codes, PKCE and tokens.
 
 ```ts
 import { admin, jwt } from "better-auth/plugins";
@@ -121,7 +121,36 @@ const application = Effect.gen(function* () {
 
 `authPool`, `Api` and `Handlers` are the application's existing auth database, RPC group and handlers. Run the Better Auth migrations with the OAuth and JWT plugins included. For existing role management, keep the application's existing role plugin and `RoleSet` in this configuration.
 
-The edge adapter verifies access-token signatures, issuer, endpoint audience and `mcp` scope, then loads the current user through Better Auth. Identity resolves the stored role on each request. An invalid token receives `401` with a `WWW-Authenticate` protected-resource metadata pointer. The metadata names the authorization server and its discovery endpoint, so a client can start OAuth. MCP bearer credentials are separate from browser session cookies.
+The edge adapter verifies access-token signatures, issuer, endpoint audience and `mcp` scope, then loads the current user and the token client's consent through Better Auth. Banned users and clients without consent receive the same unauthorized response as invalid tokens. Identity resolves the stored role on each request. An invalid token receives `401` with a `WWW-Authenticate` protected-resource metadata pointer. The metadata names the authorization server and its discovery endpoint, so a client can start OAuth. MCP bearer credentials are separate from browser session cookies.
+
+### Revoke client grants
+
+The adapter returns `revokeClient(userId, clientId)` and `revokeAllClients(userId)` as Effects that fail with `AuthUnavailable` when storage fails. The application authorizes these operations. Each deletes matching consent, stored access tokens and refresh tokens through Better Auth's adapter. Use the first when disconnecting a client and the second after a password reset. JWT access tokens are refused because each request requires the client's consent.
+
+```ts
+yield* oauth.revokeClient(userId, clientId);
+yield* oauth.revokeAllClients(userId);
+```
+
+Deleting consent through Better Auth also refuses MCP access immediately. Use these revocation methods to delete refresh tokens as well.
+
+### Dynamic origins and local keys
+
+When Better Auth uses a dynamic `baseURL`, give it a `fallback`, for example `{ allowedHosts: ["app.example.com"], fallback: "https://app.example.com" }`. The adapter loads OAuth metadata outside a request, so Better Auth needs that origin to determine the issuer.
+
+By default verification fetches the authorization server's JWKS URL. Pass `jwks` to use an in-process public key source instead, including on story hosts whose public origin has no HTTP route:
+
+```ts
+const oauth = yield* betterAuthMcp({
+	auth: mounted.auth,
+	resource,
+	origin,
+	roles: Roles,
+	jwks: () => mounted.auth.api.getJwks(),
+});
+```
+
+The callback returns the public JWK set from the JWT plugin. Signature, issuer, audience and `mcp` scope checks still apply. Signing keys stay with the auth instance.
 
 ### Install and limits
 

package/dist/adapters/bearer.d.ts

@@ -0,0 +1,6 @@
+import { verifyJwsAccessToken } from "better-auth/oauth2";
+import { Effect, Option } from "effect";
+import { AuthUnavailable } from "@shivaedev/errors/taxonomy.ts";
+export type JwksSource = Parameters<typeof verifyJwsAccessToken>[1]["jwksFetch"];
+export declare function bearer(jwks: JwksSource, audience: string, issuer: string): (token: string | undefined) => Effect.Effect<Option.Option<never> | Option.Option<import("better-auth").JWTPayload>, AuthUnavailable, never>;
+//# sourceMappingURL=bearer.d.ts.map

package/dist/adapters/bearer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer.d.ts","sourceRoot":"","sources":["../../src/adapters/bearer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAEhE,MAAM,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;AAyBjF,wBAAgB,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,WACzD,MAAM,GAAG,SAAS,mHAejC"}

package/dist/adapters/bearer.js

@@ -0,0 +1,37 @@
+import { APIError, isAPIError } from "better-auth/api";
+import { verifyJwsAccessToken } from "better-auth/oauth2";
+import { Effect, Option } from "effect";
+import { redact } from "@shivaedev/errors/redact.ts";
+import { AuthUnavailable } from "@shivaedev/errors/taxonomy.ts";
+const INVALID_TOKEN_ERRORS = new Set([
+    "ERR_JWT_EXPIRED",
+    "ERR_JWT_CLAIM_VALIDATION_FAILED",
+    "ERR_JWT_INVALID",
+    "ERR_JWS_INVALID",
+    "ERR_JWS_SIGNATURE_VERIFICATION_FAILED",
+    "ERR_JWKS_NO_MATCHING_KEY",
+    "ERR_JOSE_ALG_NOT_ALLOWED",
+    "ERR_JOSE_NOT_SUPPORTED",
+]);
+function bearerFailure(cause) {
+    if ((isAPIError(cause) && (cause.status === "UNAUTHORIZED" || cause.status === "FORBIDDEN"))
+        || (cause instanceof Error && INVALID_TOKEN_ERRORS.has(String(Reflect.get(cause, "code"))))) {
+        return Effect.succeed(Option.none());
+    }
+    return Effect.logError("MCP authentication verification failed", redact(cause)).pipe(Effect.andThen(Effect.fail(new AuthUnavailable({ message: "Authentication is temporarily unavailable" }))));
+}
+export function bearer(jwks, audience, issuer) {
+    return (token) => {
+        if (!token) {
+            return Effect.succeed(Option.none());
+        }
+        return Effect.tryPromise(async () => {
+            const claims = await verifyJwsAccessToken(token, { jwksFetch: jwks, verifyOptions: { audience, issuer } });
+            if (typeof claims.scope !== "string" || !claims.scope.split(" ").includes("mcp") || claims.cnf !== undefined) {
+                throw new APIError("UNAUTHORIZED");
+            }
+            return claims;
+        }).pipe(Effect.map(Option.some), Effect.catch(({ cause }) => bearerFailure(cause)));
+    };
+}
+//# sourceMappingURL=bearer.js.map

package/dist/adapters/bearer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer.js","sourceRoot":"","sources":["../../src/adapters/bearer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAIhE,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACpC,iBAAiB;IACjB,iCAAiC;IACjC,iBAAiB;IACjB,iBAAiB;IACjB,uCAAuC;IACvC,0BAA0B;IAC1B,0BAA0B;IAC1B,wBAAwB;CACxB,CAAC,CAAC;AAEH,SAAS,aAAa,CAAC,KAAc;IACpC,IACC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,cAAc,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC;WACrF,CAAC,KAAK,YAAY,KAAK,IAAI,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAC1F,CAAC;QACF,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,wCAAwC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CACnF,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC,CAAC,CAC1G,CAAC;AACH,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,IAAgB,EAAE,QAAgB,EAAE,MAAc;IACxE,OAAO,CAAC,KAAyB,EAAE,EAAE;QACpC,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;YACnC,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAC3G,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;gBAC9G,MAAM,IAAI,QAAQ,CAAC,cAAc,CAAC,CAAC;YACpC,CAAC;YACD,OAAO,MAAM,CAAC;QACf,CAAC,CAAC,CAAC,IAAI,CACN,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EACvB,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CACjD,CAAC;IACH,CAAC,CAAC;AACH,CAAC"}

package/dist/adapters/betterAuth.d.ts

@@ -1,35 +1,26 @@
 import { type OAuthOptions, oauthProvider, type Scope } from "@better-auth/oauth-provider";
-import type { AuthContext, BetterAuthOptions } from "better-auth";
 import { Effect } from "effect";
 import { HttpRouter } from "effect/http";
 import type { RoleSet } from "@shivaedev/access/roleSet.ts";
 import { AuthUnavailable } from "@shivaedev/errors/taxonomy.ts";
 import type { OriginPolicy } from "@shivaedev/identity/server/origin.ts";
 import type { SessionPolicy, UserSessionShape } from "@shivaedev/identity/server/session.ts";
-export declare function mcpProvider({ resource, ...options }: Omit<OAuthOptions<Scope[]>, "resources" | "scopes" | "clientRegistrationDefaultResources"> & {
+import { type JwksSource } from "./bearer.ts";
+import { type OauthAuth } from "./oauthGrants.ts";
+export declare function mcpProvider({ resource, scopes, ...options }: Omit<OAuthOptions<Scope[]>, "resources" | "clientRegistrationDefaultResources"> & {
     readonly resource: string;
 }): ReturnType<typeof oauthProvider>;
-interface OauthAuth {
-    readonly $context: Promise<{
-        readonly internalAdapter: Pick<AuthContext["internalAdapter"], "findUserById">;
-    }>;
-    readonly api: {
-        readonly "getOAuthServerConfig": () => Promise<{
-            readonly issuer: string;
-            readonly "jwks_uri"?: string;
-        }>;
-    };
-    readonly options: BetterAuthOptions;
-}
 export declare const betterAuthMcp: (options: {
     readonly auth: OauthAuth;
     readonly resource: string;
+    readonly jwks?: JwksSource;
     readonly origin: OriginPolicy;
     readonly roles?: RoleSet;
 }) => Effect.Effect<{
+    revokeAllClients: (userId: string) => Effect.Effect<void, AuthUnavailable, never>;
+    revokeClient: (userId: string, clientId: string) => Effect.Effect<void, AuthUnavailable, never>;
     resourceMetadataUrl: string;
     routes: import("effect/Layer").Layer<never, never, HttpRouter.HttpRouter | HttpRouter.Request<"Error", import("effect/http/HttpServerError").InternalError> | HttpRouter.Request<"Error", import("effect/http/HttpServerError").RequestParseError> | HttpRouter.Request<"Error", import("effect/http/HttpServerError").RouteNotFound>>;
     sessions: SessionPolicy<UserSessionShape>;
 }, AuthUnavailable, never>;
-export {};
 //# sourceMappingURL=betterAuth.d.ts.map

package/dist/adapters/betterAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"betterAuth.d.ts","sourceRoot":"","sources":["../../src/adapters/betterAuth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAE,aAAa,EAAmC,KAAK,KAAK,EAAE,MAAM,6BAA6B,CAAC;AAE5H,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAElE,OAAO,EAAE,MAAM,EAAU,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,UAAU,EAAyC,MAAM,aAAa,CAAC;AAChF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AAE5D,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAE7F,wBAAgB,WAAW,CAAC,EAC3B,QAAQ,EACR,GAAG,OAAO,EACV,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,EAAE,WAAW,GAAG,QAAQ,GAAG,oCAAoC,CAAC,GAAG;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,UAAU,CACzI,OAAO,aAAa,CACpB,CAEA;AAED,UAAU,SAAS;IAClB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;QAAE,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,EAAE,cAAc,CAAC,CAAA;KAAE,CAAC,CAAC;IAC/G,QAAQ,CAAC,GAAG,EAAE;QAAE,QAAQ,CAAC,sBAAsB,EAAE,MAAM,OAAO,CAAC;YAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;IAC5H,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;CACpC;AAWD,eAAO,MAAM,aAAa;mBACV,SAAS;uBACL,MAAM;qBACR,YAAY;qBACZ,OAAO;;;;;0BA6DvB,CAAC"}
+{"version":3,"file":"betterAuth.d.ts","sourceRoot":"","sources":["../../src/adapters/betterAuth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAE,aAAa,EAAmC,KAAK,KAAK,EAAE,MAAM,6BAA6B,CAAC;AAC5H,OAAO,EAAE,MAAM,EAAU,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,UAAU,EAAyC,MAAM,aAAa,CAAC;AAChF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC7F,OAAO,EAAU,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAe,KAAK,SAAS,EAAe,MAAM,kBAAkB,CAAC;AAE5E,wBAAgB,WAAW,CAAC,EAC3B,QAAQ,EACR,MAAgB,EAChB,GAAG,OAAO,EACV,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,EAAE,WAAW,GAAG,oCAAoC,CAAC,GAAG;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,UAAU,CAC9H,OAAO,aAAa,CACpB,CAEA;AAED,eAAO,MAAM,aAAa;mBACV,SAAS;uBACL,MAAM;oBACT,UAAU;qBACT,YAAY;qBACZ,OAAO;;;;;;;0BAgDvB,CAAC"}

package/dist/adapters/betterAuth.js

@@ -1,18 +1,11 @@
 import { oauthProvider, oauthProviderAuthServerMetadata } from "@better-auth/oauth-provider";
-import { oauthProviderResourceClient } from "@better-auth/oauth-provider/resource-client";
-import { isAPIError } from "better-auth/api";
 import { Effect, Option } from "effect";
 import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/http";
-import { redact } from "@shivaedev/errors/redact.ts";
 import { AuthUnavailable } from "@shivaedev/errors/taxonomy.ts";
-export function mcpProvider({ resource, ...options }) {
-    return oauthProvider({ ...options, clientRegistrationDefaultResources: [resource], resources: [resource], scopes: ["mcp"] });
-}
-function bearerFailure(cause) {
-    if (isAPIError(cause) && (cause.status === "UNAUTHORIZED" || cause.status === "FORBIDDEN")) {
-        return Effect.succeed(Option.none());
-    }
-    return Effect.logError("MCP authentication verification failed", redact(cause)).pipe(Effect.andThen(Effect.fail(new AuthUnavailable({ message: "Authentication is temporarily unavailable" }))));
+import { bearer } from "./bearer.js";
+import { grantedUser, oauthGrants } from "./oauthGrants.js";
+export function mcpProvider({ resource, scopes = ["mcp"], ...options }) {
+    return oauthProvider({ ...options, clientRegistrationDefaultResources: [resource], resources: [resource], scopes });
 }
 export const betterAuthMcp = Effect.fn("Mcp.betterAuthMcp")(function* (options) {
     const config = yield* Effect.tryPromise({
@@ -23,7 +16,7 @@ export const betterAuthMcp = Effect.fn("Mcp.betterAuthMcp")(function* (options)
     const url = new URL(resource);
     const metadataPath = `/.well-known/oauth-protected-resource${url.pathname}`;
     const resourceMetadataUrl = new URL(metadataPath, url).href;
-    const client = oauthProviderResourceClient(auth).getActions();
+    const verify = bearer(options.jwks ?? config.jwks_uri ?? new URL("/api/auth/jwks", url).href, resource, config.issuer);
     const sessions = {
         origin: options.origin,
         ...(options.roles === undefined ? {} : { roles: options.roles }),
@@ -31,19 +24,11 @@ export const betterAuthMcp = Effect.fn("Mcp.betterAuthMcp")(function* (options)
             get: (headers) => Effect.gen(function* () {
                 const authorization = headers.authorization;
                 const token = authorization?.startsWith("Bearer ") ? authorization.slice(7) : undefined;
-                const claims = yield* Effect.tryPromise(() => client.verifyBearerToken(token, {
-                    jwksUrl: config.jwks_uri ?? new URL("/api/auth/jwks", url).href,
-                    requiredScopes: ["mcp"],
-                    verifyOptions: { audience: resource, issuer: config.issuer },
-                })).pipe(Effect.map(Option.some), Effect.catch(({ cause }) => bearerFailure(cause)));
-                if (Option.isNone(claims) || typeof claims.value.sub !== "string") {
+                const claims = yield* verify(token);
+                if (Option.isNone(claims) || typeof claims.value.sub !== "string" || typeof claims.value.client_id !== "string") {
                     return Option.none();
                 }
-                const id = claims.value.sub;
-                const user = yield* Effect.tryPromise({
-                    catch: () => new AuthUnavailable({ message: "OAuth user lookup failed" }),
-                    try: async () => (await auth.$context).internalAdapter.findUserById(id),
-                });
+                const user = yield* grantedUser(auth, claims.value.sub, claims.value.client_id);
                 if (user === null) {
                     return Option.none();
                 }
@@ -61,6 +46,6 @@ export const betterAuthMcp = Effect.fn("Mcp.betterAuthMcp")(function* (options)
         yield* router.add("GET", metadataPath, HttpServerResponse.jsonUnsafe({ "authorization_servers": [config.issuer], resource, "scopes_supported": ["mcp"] }));
         yield* router.add("GET", "/.well-known/oauth-authorization-server/api/auth", authorizationMetadata);
     }));
-    return { resourceMetadataUrl, routes, sessions };
+    return { ...oauthGrants(auth), resourceMetadataUrl, routes, sessions };
 });
 //# sourceMappingURL=betterAuth.js.map

package/dist/adapters/betterAuth.js.map

@@ -1 +1 @@
-{"version":3,"file":"betterAuth.js","sourceRoot":"","sources":["../../src/adapters/betterAuth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,aAAa,EAAE,+BAA+B,EAAc,MAAM,6BAA6B,CAAC;AAC5H,OAAO,EAAE,2BAA2B,EAAE,MAAM,6CAA6C,CAAC;AAE1F,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEhF,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAIhE,MAAM,UAAU,WAAW,CAAC,EAC3B,QAAQ,EACR,GAAG,OAAO,EACkH;IAG5H,OAAO,aAAa,CAAC,EAAE,GAAG,OAAO,EAAE,kCAAkC,EAAE,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAC9H,CAAC;AAQD,SAAS,aAAa,CAAC,KAAc;IACpC,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,cAAc,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,EAAE,CAAC;QAC5F,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,wCAAwC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CACnF,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC,CAAC,CAC1G,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,EAAE,OAKtE;IACA,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;QACvC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC;QACpF,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE;KAClD,CAAC,CAAC;IACH,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,MAAM,YAAY,GAAG,wCAAwC,GAAG,CAAC,QAAQ,EAAW,CAAC;IACrF,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC;IAC5D,MAAM,MAAM,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;IAC9D,MAAM,QAAQ,GAAoC;QACjD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAChE,QAAQ,EAAE;YACT,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAChB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBACnB,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;gBAC5C,MAAM,KAAK,GAAG,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACxF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAC5C,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE;oBAC/B,OAAO,EAAE,MAAM,CAAC,QAAQ,IAAI,IAAI,GAAG,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,IAAI;oBAC/D,cAAc,EAAE,CAAC,KAAK,CAAC;oBACvB,aAAa,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;iBAC5D,CAAC,CACF,CAAC,IAAI,CACL,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EACvB,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CACjD,CAAC;gBACF,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;oBACnE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;gBACtB,CAAC;gBACD,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;gBAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;oBACrC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;oBACzE,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC;iBACvE,CAAC,CAAC;gBACH,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBACnB,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;gBACtB,CAAC;gBACD,MAAM,IAAI,GAAY,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAChD,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAClI,CAAC,CAAC;SACH;KACD,CAAC;IACF,MAAM,QAAQ,GAAG,+BAA+B,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,qBAAqB,GAAG,MAAM,CAAC,EAAE,CAAC,2BAA2B,CAAC,CAAC,QAAQ,CAAC,EAAE,OAA4C;QAC3H,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpD,OAAO,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACxC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAChB,KAAK,EACL,YAAY,EACZ,kBAAkB,CAAC,UAAU,CAAC,EAAE,uBAAuB,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAClH,CAAC;QACF,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,kDAAkD,EAAE,qBAAqB,CAAC,CAAC;IACrG,CAAC,CAAC,CACF,CAAC;IACF,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAClD,CAAC,CAAC,CAAC"}
+{"version":3,"file":"betterAuth.js","sourceRoot":"","sources":["../../src/adapters/betterAuth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,aAAa,EAAE,+BAA+B,EAAc,MAAM,6BAA6B,CAAC;AAC5H,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEhF,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAGhE,OAAO,EAAE,MAAM,EAAmB,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,WAAW,EAAkB,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE5E,MAAM,UAAU,WAAW,CAAC,EAC3B,QAAQ,EACR,MAAM,GAAG,CAAC,KAAK,CAAC,EAChB,GAAG,OAAO,EACuG;IAGjH,OAAO,aAAa,CAAC,EAAE,GAAG,OAAO,EAAE,kCAAkC,EAAE,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;AACrH,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,EAAE,OAMtE;IACA,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;QACvC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC;QACpF,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE;KAClD,CAAC,CAAC;IACH,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,MAAM,YAAY,GAAG,wCAAwC,GAAG,CAAC,QAAQ,EAAW,CAAC;IACrF,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI,GAAG,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACvH,MAAM,QAAQ,GAAoC;QACjD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAChE,QAAQ,EAAE;YACT,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAChB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBACnB,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;gBAC5C,MAAM,KAAK,GAAG,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACxF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACpC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,KAAK,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;oBACjH,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;gBACtB,CAAC;gBACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBAChF,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBACnB,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;gBACtB,CAAC;gBACD,MAAM,IAAI,GAAY,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAChD,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAClI,CAAC,CAAC;SACH;KACD,CAAC;IACF,MAAM,QAAQ,GAAG,+BAA+B,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,qBAAqB,GAAG,MAAM,CAAC,EAAE,CAAC,2BAA2B,CAAC,CAAC,QAAQ,CAAC,EAAE,OAA4C;QAC3H,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpD,OAAO,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACxC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAChB,KAAK,EACL,YAAY,EACZ,kBAAkB,CAAC,UAAU,CAAC,EAAE,uBAAuB,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAClH,CAAC;QACF,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,kDAAkD,EAAE,qBAAqB,CAAC,CAAC;IACrG,CAAC,CAAC,CACF,CAAC;IACF,OAAO,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,mBAAmB,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AACxE,CAAC,CAAC,CAAC"}

package/dist/adapters/oauthGrants.d.ts

@@ -0,0 +1,32 @@
+import type { AuthContext, BetterAuthOptions } from "better-auth";
+import { Effect } from "effect";
+import { AuthUnavailable } from "@shivaedev/errors/taxonomy.ts";
+export interface OauthAuth {
+    readonly $context: Promise<{
+        readonly adapter: Pick<AuthContext["adapter"], "findOne"> & {
+            readonly transaction: <A>(run: (adapter: Pick<AuthContext["adapter"], "deleteMany">) => Promise<A>) => Promise<A>;
+        };
+        readonly internalAdapter: Pick<AuthContext["internalAdapter"], "findUserById">;
+    }>;
+    readonly api: {
+        readonly "getOAuthServerConfig": () => Promise<{
+            readonly issuer: string;
+            readonly "jwks_uri"?: string;
+        }>;
+    };
+    readonly options: BetterAuthOptions;
+}
+export declare function oauthGrants(auth: OauthAuth): {
+    revokeAllClients: (userId: string) => Effect.Effect<void, AuthUnavailable, never>;
+    revokeClient: (userId: string, clientId: string) => Effect.Effect<void, AuthUnavailable, never>;
+};
+export declare const grantedUser: (auth: OauthAuth, userId: string, clientId: string) => Effect.Effect<{
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    email: string;
+    emailVerified: boolean;
+    name: string;
+    image?: string | null | undefined;
+} | null, AuthUnavailable, never>;
+//# sourceMappingURL=oauthGrants.d.ts.map

package/dist/adapters/oauthGrants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthGrants.d.ts","sourceRoot":"","sources":["../../src/adapters/oauthGrants.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAEhE,MAAM,WAAW,SAAS;IACzB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC1B,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,GAAG;YAC3D,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,YAAY,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;SAClH,CAAC;QACF,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,EAAE,cAAc,CAAC,CAAC;KAC/E,CAAC,CAAC;IACH,QAAQ,CAAC,GAAG,EAAE;QAAE,QAAQ,CAAC,sBAAsB,EAAE,MAAM,OAAO,CAAC;YAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;IAC5H,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;CACpC;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,SAAS;IAgBzC,gBAAgB,WAAW,MAAM;IACjC,YAAY,WAAW,MAAM,YAAY,MAAM;EAEhD;AAED,eAAO,MAAM,WAAW;;;;;;;;iCAmBtB,CAAC"}

package/dist/adapters/oauthGrants.js

@@ -0,0 +1,43 @@
+import { Effect } from "effect";
+import { AuthUnavailable } from "@shivaedev/errors/taxonomy.ts";
+export function oauthGrants(auth) {
+    const revoke = Effect.fn("Mcp.revoke")(function* (userId, clientId) {
+        yield* Effect.tryPromise({
+            catch: () => new AuthUnavailable({ message: "OAuth grant revocation failed" }),
+            try: async () => {
+                const { adapter } = await auth.$context;
+                const where = [{ field: "userId", value: userId }, ...(clientId === undefined ? [] : [{ field: "clientId", value: clientId }])];
+                await adapter.transaction(async (transaction) => {
+                    for (const model of ["oauthConsent", "oauthAccessToken", "oauthRefreshToken"]) {
+                        await transaction.deleteMany({ model, where });
+                    }
+                });
+            },
+        });
+    });
+    return {
+        revokeAllClients: (userId) => revoke(userId),
+        revokeClient: (userId, clientId) => revoke(userId, clientId),
+    };
+}
+export const grantedUser = Effect.fn("Mcp.grantedUser")(function* (auth, userId, clientId) {
+    return yield* Effect.tryPromise({
+        catch: () => new AuthUnavailable({ message: "OAuth grant lookup failed" }),
+        try: async () => {
+            const { adapter, internalAdapter } = await auth.$context;
+            const user = await internalAdapter.findUserById(userId);
+            if (user === null || Reflect.get(user, "banned") === true) {
+                return null;
+            }
+            const consent = await adapter.findOne({
+                model: "oauthConsent",
+                where: [
+                    { field: "userId", value: userId },
+                    { field: "clientId", value: clientId },
+                ],
+            });
+            return consent === null ? null : user;
+        },
+    });
+});
+//# sourceMappingURL=oauthGrants.js.map

package/dist/adapters/oauthGrants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthGrants.js","sourceRoot":"","sources":["../../src/adapters/oauthGrants.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAahE,MAAM,UAAU,WAAW,CAAC,IAAe;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,EAAE,MAAc,EAAE,QAAiB;QAClF,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;YACxB,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC;YAC9E,GAAG,EAAE,KAAK,IAAI,EAAE;gBACf,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;gBACxC,MAAM,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;gBAChI,MAAM,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE;oBAC/C,KAAK,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,kBAAkB,EAAE,mBAAmB,CAAC,EAAE,CAAC;wBAC/E,MAAM,WAAW,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;oBAChD,CAAC;gBACF,CAAC,CAAC,CAAC;YACJ,CAAC;SACD,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO;QACN,gBAAgB,EAAE,CAAC,MAAc,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;QACpD,YAAY,EAAE,CAAC,MAAc,EAAE,QAAgB,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC;KAC5E,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAe,EAAE,MAAc,EAAE,QAAgB;IACnH,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;QAC/B,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;QAC1E,GAAG,EAAE,KAAK,IAAI,EAAE;YACf,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;YACzD,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YACxD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC3D,OAAO,IAAI,CAAC;YACb,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;gBACrC,KAAK,EAAE,cAAc;gBACrB,KAAK,EAAE;oBACN,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE;oBAClC,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE;iBACtC;aACD,CAAC,CAAC;YACH,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QACvC,CAAC;KACD,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shivaedev/mcp",
-  "version": "0.1.11",
+  "version": "0.2.1",
   "description": "Identity-aware Effect MCP tools mounted on the application host",
   "keywords": [
     "effect"
@@ -43,18 +43,18 @@
     "README.md"
   ],
   "dependencies": {
-    "@shivaedev/access": "0.3.3",
-    "@shivaedev/errors": "0.3.0",
-    "@shivaedev/identity": "0.11.1"
+    "@shivaedev/access": "0.3.4",
+    "@shivaedev/errors": "0.4.0",
+    "@shivaedev/identity": "0.13.0"
   },
   "devDependencies": {
     "@better-auth/oauth-provider": "1.7.12",
     "@effect/platform-node": "4.0.6",
     "@effect/sql-pg": "4.0.6",
-    "@shivaedev/quality": "0.50.0",
-    "@shivaedev/server": "0.12.0",
-    "@shivaedev/test-sql": "0.15.0",
-    "@shivaedev/test-story": "0.30.0",
+    "@shivaedev/quality": "0.52.0",
+    "@shivaedev/server": "0.14.0",
+    "@shivaedev/test-sql": "0.15.1",
+    "@shivaedev/test-story": "0.31.1",
     "@types/node": "24.19.2",
     "better-auth": "1.7.12",
     "effect": "4.0.6",

package/src/adapters/bearer.ts

@@ -0,0 +1,48 @@
+import { APIError, isAPIError } from "better-auth/api";
+import { verifyJwsAccessToken } from "better-auth/oauth2";
+import { Effect, Option } from "effect";
+import { redact } from "@shivaedev/errors/redact.ts";
+import { AuthUnavailable } from "@shivaedev/errors/taxonomy.ts";
+
+export type JwksSource = Parameters<typeof verifyJwsAccessToken>[1]["jwksFetch"];
+
+const INVALID_TOKEN_ERRORS = new Set([
+	"ERR_JWT_EXPIRED",
+	"ERR_JWT_CLAIM_VALIDATION_FAILED",
+	"ERR_JWT_INVALID",
+	"ERR_JWS_INVALID",
+	"ERR_JWS_SIGNATURE_VERIFICATION_FAILED",
+	"ERR_JWKS_NO_MATCHING_KEY",
+	"ERR_JOSE_ALG_NOT_ALLOWED",
+	"ERR_JOSE_NOT_SUPPORTED",
+]);
+
+function bearerFailure(cause: unknown) {
+	if (
+		(isAPIError(cause) && (cause.status === "UNAUTHORIZED" || cause.status === "FORBIDDEN"))
+		|| (cause instanceof Error && INVALID_TOKEN_ERRORS.has(String(Reflect.get(cause, "code"))))
+	) {
+		return Effect.succeed(Option.none());
+	}
+	return Effect.logError("MCP authentication verification failed", redact(cause)).pipe(
+		Effect.andThen(Effect.fail(new AuthUnavailable({ message: "Authentication is temporarily unavailable" }))),
+	);
+}
+
+export function bearer(jwks: JwksSource, audience: string, issuer: string) {
+	return (token: string | undefined) => {
+		if (!token) {
+			return Effect.succeed(Option.none());
+		}
+		return Effect.tryPromise(async () => {
+			const claims = await verifyJwsAccessToken(token, { jwksFetch: jwks, verifyOptions: { audience, issuer } });
+			if (typeof claims.scope !== "string" || !claims.scope.split(" ").includes("mcp") || claims.cnf !== undefined) {
+				throw new APIError("UNAUTHORIZED");
+			}
+			return claims;
+		}).pipe(
+			Effect.map(Option.some),
+			Effect.catch(({ cause }) => bearerFailure(cause)),
+		);
+	};
+}

package/src/adapters/betterAuth.ts

@@ -1,42 +1,27 @@
 import { type OAuthOptions, oauthProvider, oauthProviderAuthServerMetadata, type Scope } from "@better-auth/oauth-provider";
-import { oauthProviderResourceClient } from "@better-auth/oauth-provider/resource-client";
-import type { AuthContext, BetterAuthOptions } from "better-auth";
-import { isAPIError } from "better-auth/api";
 import { Effect, Option } from "effect";
 import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/http";
 import type { RoleSet } from "@shivaedev/access/roleSet.ts";
-import { redact } from "@shivaedev/errors/redact.ts";
 import { AuthUnavailable } from "@shivaedev/errors/taxonomy.ts";
 import type { OriginPolicy } from "@shivaedev/identity/server/origin.ts";
 import type { SessionPolicy, UserSessionShape } from "@shivaedev/identity/server/session.ts";
+import { bearer, type JwksSource } from "./bearer.ts";
+import { grantedUser, type OauthAuth, oauthGrants } from "./oauthGrants.ts";
 
 export function mcpProvider({
 	resource,
+	scopes = ["mcp"],
 	...options
-}: Omit<OAuthOptions<Scope[]>, "resources" | "scopes" | "clientRegistrationDefaultResources"> & { readonly resource: string }): ReturnType<
+}: Omit<OAuthOptions<Scope[]>, "resources" | "clientRegistrationDefaultResources"> & { readonly resource: string }): ReturnType<
 	typeof oauthProvider
 > {
-	return oauthProvider({ ...options, clientRegistrationDefaultResources: [resource], resources: [resource], scopes: ["mcp"] });
-}
-
-interface OauthAuth {
-	readonly $context: Promise<{ readonly internalAdapter: Pick<AuthContext["internalAdapter"], "findUserById"> }>;
-	readonly api: { readonly "getOAuthServerConfig": () => Promise<{ readonly issuer: string; readonly "jwks_uri"?: string }> };
-	readonly options: BetterAuthOptions;
-}
-
-function bearerFailure(cause: unknown) {
-	if (isAPIError(cause) && (cause.status === "UNAUTHORIZED" || cause.status === "FORBIDDEN")) {
-		return Effect.succeed(Option.none());
-	}
-	return Effect.logError("MCP authentication verification failed", redact(cause)).pipe(
-		Effect.andThen(Effect.fail(new AuthUnavailable({ message: "Authentication is temporarily unavailable" }))),
-	);
+	return oauthProvider({ ...options, clientRegistrationDefaultResources: [resource], resources: [resource], scopes });
 }
 
 export const betterAuthMcp = Effect.fn("Mcp.betterAuthMcp")(function* (options: {
 	readonly auth: OauthAuth;
 	readonly resource: string;
+	readonly jwks?: JwksSource;
 	readonly origin: OriginPolicy;
 	readonly roles?: RoleSet;
 }) {
@@ -48,7 +33,7 @@ export const betterAuthMcp = Effect.fn("Mcp.betterAuthMcp")(function* (options:
 	const url = new URL(resource);
 	const metadataPath = `/.well-known/oauth-protected-resource${url.pathname}` as const;
 	const resourceMetadataUrl = new URL(metadataPath, url).href;
-	const client = oauthProviderResourceClient(auth).getActions();
+	const verify = bearer(options.jwks ?? config.jwks_uri ?? new URL("/api/auth/jwks", url).href, resource, config.issuer);
 	const sessions: SessionPolicy<UserSessionShape> = {
 		origin: options.origin,
 		...(options.roles === undefined ? {} : { roles: options.roles }),
@@ -57,24 +42,11 @@ export const betterAuthMcp = Effect.fn("Mcp.betterAuthMcp")(function* (options:
 				Effect.gen(function* () {
 					const authorization = headers.authorization;
 					const token = authorization?.startsWith("Bearer ") ? authorization.slice(7) : undefined;
-					const claims = yield* Effect.tryPromise(() =>
-						client.verifyBearerToken(token, {
-							jwksUrl: config.jwks_uri ?? new URL("/api/auth/jwks", url).href,
-							requiredScopes: ["mcp"],
-							verifyOptions: { audience: resource, issuer: config.issuer },
-						}),
-					).pipe(
-						Effect.map(Option.some),
-						Effect.catch(({ cause }) => bearerFailure(cause)),
-					);
-					if (Option.isNone(claims) || typeof claims.value.sub !== "string") {
+					const claims = yield* verify(token);
+					if (Option.isNone(claims) || typeof claims.value.sub !== "string" || typeof claims.value.client_id !== "string") {
 						return Option.none();
 					}
-					const id = claims.value.sub;
-					const user = yield* Effect.tryPromise({
-						catch: () => new AuthUnavailable({ message: "OAuth user lookup failed" }),
-						try: async () => (await auth.$context).internalAdapter.findUserById(id),
-					});
+					const user = yield* grantedUser(auth, claims.value.sub, claims.value.client_id);
 					if (user === null) {
 						return Option.none();
 					}
@@ -98,5 +70,5 @@ export const betterAuthMcp = Effect.fn("Mcp.betterAuthMcp")(function* (options:
 			yield* router.add("GET", "/.well-known/oauth-authorization-server/api/auth", authorizationMetadata);
 		}),
 	);
-	return { resourceMetadataUrl, routes, sessions };
+	return { ...oauthGrants(auth), resourceMetadataUrl, routes, sessions };
 });

package/src/adapters/oauthGrants.ts

@@ -0,0 +1,56 @@
+import type { AuthContext, BetterAuthOptions } from "better-auth";
+import { Effect } from "effect";
+import { AuthUnavailable } from "@shivaedev/errors/taxonomy.ts";
+
+export interface OauthAuth {
+	readonly $context: Promise<{
+		readonly adapter: Pick<AuthContext["adapter"], "findOne"> & {
+			readonly transaction: <A>(run: (adapter: Pick<AuthContext["adapter"], "deleteMany">) => Promise<A>) => Promise<A>;
+		};
+		readonly internalAdapter: Pick<AuthContext["internalAdapter"], "findUserById">;
+	}>;
+	readonly api: { readonly "getOAuthServerConfig": () => Promise<{ readonly issuer: string; readonly "jwks_uri"?: string }> };
+	readonly options: BetterAuthOptions;
+}
+
+export function oauthGrants(auth: OauthAuth) {
+	const revoke = Effect.fn("Mcp.revoke")(function* (userId: string, clientId?: string) {
+		yield* Effect.tryPromise({
+			catch: () => new AuthUnavailable({ message: "OAuth grant revocation failed" }),
+			try: async () => {
+				const { adapter } = await auth.$context;
+				const where = [{ field: "userId", value: userId }, ...(clientId === undefined ? [] : [{ field: "clientId", value: clientId }])];
+				await adapter.transaction(async (transaction) => {
+					for (const model of ["oauthConsent", "oauthAccessToken", "oauthRefreshToken"]) {
+						await transaction.deleteMany({ model, where });
+					}
+				});
+			},
+		});
+	});
+	return {
+		revokeAllClients: (userId: string) => revoke(userId),
+		revokeClient: (userId: string, clientId: string) => revoke(userId, clientId),
+	};
+}
+
+export const grantedUser = Effect.fn("Mcp.grantedUser")(function* (auth: OauthAuth, userId: string, clientId: string) {
+	return yield* Effect.tryPromise({
+		catch: () => new AuthUnavailable({ message: "OAuth grant lookup failed" }),
+		try: async () => {
+			const { adapter, internalAdapter } = await auth.$context;
+			const user = await internalAdapter.findUserById(userId);
+			if (user === null || Reflect.get(user, "banned") === true) {
+				return null;
+			}
+			const consent = await adapter.findOne({
+				model: "oauthConsent",
+				where: [
+					{ field: "userId", value: userId },
+					{ field: "clientId", value: clientId },
+				],
+			});
+			return consent === null ? null : user;
+		},
+	});
+});