@softure-ai/mcp-access 0.1.5 → 0.1.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (131) hide show
  1. package/CHANGELOG.md +23 -0
  2. package/README.md +110 -21
  3. package/adoption/move-app-tables.sql +100 -0
  4. package/dist/contract.d.ts +13 -1
  5. package/dist/contract.d.ts.map +1 -1
  6. package/dist/index.d.ts +51 -3
  7. package/dist/index.d.ts.map +1 -1
  8. package/dist/index.js +25 -5
  9. package/dist/index.js.map +1 -1
  10. package/dist/messages/en.d.ts +28 -0
  11. package/dist/messages/en.d.ts.map +1 -1
  12. package/dist/messages/en.js +28 -0
  13. package/dist/messages/en.js.map +1 -1
  14. package/dist/messages/index.d.ts +56 -0
  15. package/dist/messages/index.d.ts.map +1 -1
  16. package/dist/messages/pl.d.ts.map +1 -1
  17. package/dist/messages/pl.js +28 -0
  18. package/dist/messages/pl.js.map +1 -1
  19. package/dist/next/actions.d.ts +3 -1
  20. package/dist/next/actions.d.ts.map +1 -1
  21. package/dist/next/actions.js +19 -0
  22. package/dist/next/actions.js.map +1 -1
  23. package/dist/next/context.js +2 -2
  24. package/dist/next/context.js.map +1 -1
  25. package/dist/next/index.d.ts +3 -1
  26. package/dist/next/index.d.ts.map +1 -1
  27. package/dist/next/index.js +4 -2
  28. package/dist/next/index.js.map +1 -1
  29. package/dist/next/oauth-page.d.ts +7 -0
  30. package/dist/next/oauth-page.d.ts.map +1 -0
  31. package/dist/next/oauth-page.js +35 -0
  32. package/dist/next/oauth-page.js.map +1 -0
  33. package/dist/next/oauth-routes.d.ts +16 -0
  34. package/dist/next/oauth-routes.d.ts.map +1 -0
  35. package/dist/next/oauth-routes.js +50 -0
  36. package/dist/next/oauth-routes.js.map +1 -0
  37. package/dist/next/pages.d.ts.map +1 -1
  38. package/dist/next/pages.js +13 -2
  39. package/dist/next/pages.js.map +1 -1
  40. package/dist/options.d.ts +16 -0
  41. package/dist/options.d.ts.map +1 -1
  42. package/dist/options.js +28 -1
  43. package/dist/options.js.map +1 -1
  44. package/dist/schema.d.ts +486 -0
  45. package/dist/schema.d.ts.map +1 -1
  46. package/dist/schema.js +45 -3
  47. package/dist/schema.js.map +1 -1
  48. package/dist/server/endpoint.d.ts +2 -4
  49. package/dist/server/endpoint.d.ts.map +1 -1
  50. package/dist/server/endpoint.js +10 -7
  51. package/dist/server/endpoint.js.map +1 -1
  52. package/dist/server/health.d.ts.map +1 -1
  53. package/dist/server/health.js +5 -3
  54. package/dist/server/health.js.map +1 -1
  55. package/dist/server/index.d.ts +4 -0
  56. package/dist/server/index.d.ts.map +1 -1
  57. package/dist/server/index.js +4 -0
  58. package/dist/server/index.js.map +1 -1
  59. package/dist/server/oauth-http.d.ts +113 -0
  60. package/dist/server/oauth-http.d.ts.map +1 -0
  61. package/dist/server/oauth-http.js +374 -0
  62. package/dist/server/oauth-http.js.map +1 -0
  63. package/dist/server/oauth-validation.d.ts +28 -0
  64. package/dist/server/oauth-validation.d.ts.map +1 -0
  65. package/dist/server/oauth-validation.js +88 -0
  66. package/dist/server/oauth-validation.js.map +1 -0
  67. package/dist/server/oauth.d.ts +106 -0
  68. package/dist/server/oauth.d.ts.map +1 -0
  69. package/dist/server/oauth.js +235 -0
  70. package/dist/server/oauth.js.map +1 -0
  71. package/dist/server/options.d.ts +8 -0
  72. package/dist/server/options.d.ts.map +1 -1
  73. package/dist/server/options.js +8 -1
  74. package/dist/server/options.js.map +1 -1
  75. package/dist/server/pkce.d.ts +7 -0
  76. package/dist/server/pkce.d.ts.map +1 -0
  77. package/dist/server/pkce.js +24 -0
  78. package/dist/server/pkce.js.map +1 -0
  79. package/dist/server/privacy.d.ts +7 -0
  80. package/dist/server/privacy.d.ts.map +1 -1
  81. package/dist/server/privacy.js +19 -9
  82. package/dist/server/privacy.js.map +1 -1
  83. package/dist/server/scopes.d.ts +5 -0
  84. package/dist/server/scopes.d.ts.map +1 -0
  85. package/dist/server/scopes.js +6 -0
  86. package/dist/server/scopes.js.map +1 -0
  87. package/dist/server/tokens.d.ts +18 -6
  88. package/dist/server/tokens.d.ts.map +1 -1
  89. package/dist/server/tokens.js +60 -25
  90. package/dist/server/tokens.js.map +1 -1
  91. package/dist/ui/consent-form.d.ts +31 -0
  92. package/dist/ui/consent-form.d.ts.map +1 -0
  93. package/dist/ui/consent-form.js +24 -0
  94. package/dist/ui/consent-form.js.map +1 -0
  95. package/dist/ui/index.d.ts +2 -1
  96. package/dist/ui/index.d.ts.map +1 -1
  97. package/dist/ui/index.js +1 -0
  98. package/dist/ui/index.js.map +1 -1
  99. package/dist/ui/token-manager.d.ts +16 -2
  100. package/dist/ui/token-manager.d.ts.map +1 -1
  101. package/dist/ui/token-manager.js +6 -2
  102. package/dist/ui/token-manager.js.map +1 -1
  103. package/migrations/0002_create_oauth_grants.sql +68 -0
  104. package/module.json +18 -4
  105. package/package.json +7 -2
  106. package/src/contract.ts +16 -1
  107. package/src/index.ts +28 -4
  108. package/src/messages/en.ts +28 -0
  109. package/src/messages/pl.ts +28 -0
  110. package/src/next/actions.ts +19 -1
  111. package/src/next/context.ts +2 -2
  112. package/src/next/index.ts +11 -2
  113. package/src/next/oauth-page.tsx +67 -0
  114. package/src/next/oauth-routes.ts +65 -0
  115. package/src/next/pages.tsx +16 -3
  116. package/src/options.ts +32 -1
  117. package/src/schema.ts +51 -3
  118. package/src/server/endpoint.ts +10 -7
  119. package/src/server/health.ts +5 -3
  120. package/src/server/index.ts +50 -0
  121. package/src/server/oauth-http.ts +431 -0
  122. package/src/server/oauth-validation.ts +106 -0
  123. package/src/server/oauth.ts +315 -0
  124. package/src/server/options.ts +16 -1
  125. package/src/server/pkce.ts +27 -0
  126. package/src/server/privacy.ts +26 -9
  127. package/src/server/scopes.ts +6 -0
  128. package/src/server/tokens.ts +62 -25
  129. package/src/ui/consent-form.tsx +103 -0
  130. package/src/ui/index.ts +3 -0
  131. package/src/ui/token-manager.tsx +79 -3
package/dist/schema.d.ts CHANGED
@@ -1,4 +1,471 @@
1
1
  export declare const mcpSchema: import("drizzle-orm/pg-core").PgSchema<"mcp">;
2
+ export declare const oauthClients: import("drizzle-orm/pg-core").PgTableWithColumns<{
3
+ name: "oauth_clients";
4
+ schema: "mcp";
5
+ columns: {
6
+ id: import("drizzle-orm/pg-core").PgColumn<{
7
+ name: "id";
8
+ tableName: "oauth_clients";
9
+ dataType: "string";
10
+ columnType: "PgUUID";
11
+ data: string;
12
+ driverParam: string;
13
+ notNull: true;
14
+ hasDefault: true;
15
+ isPrimaryKey: true;
16
+ isAutoincrement: false;
17
+ hasRuntimeDefault: false;
18
+ enumValues: undefined;
19
+ baseColumn: never;
20
+ identity: undefined;
21
+ generated: undefined;
22
+ }, {}, {}>;
23
+ clientId: import("drizzle-orm/pg-core").PgColumn<{
24
+ name: "client_id";
25
+ tableName: "oauth_clients";
26
+ dataType: "string";
27
+ columnType: "PgText";
28
+ data: string;
29
+ driverParam: string;
30
+ notNull: true;
31
+ hasDefault: false;
32
+ isPrimaryKey: false;
33
+ isAutoincrement: false;
34
+ hasRuntimeDefault: false;
35
+ enumValues: [string, ...string[]];
36
+ baseColumn: never;
37
+ identity: undefined;
38
+ generated: undefined;
39
+ }, {}, {}>;
40
+ clientName: import("drizzle-orm/pg-core").PgColumn<{
41
+ name: "client_name";
42
+ tableName: "oauth_clients";
43
+ dataType: "string";
44
+ columnType: "PgText";
45
+ data: string;
46
+ driverParam: string;
47
+ notNull: true;
48
+ hasDefault: false;
49
+ isPrimaryKey: false;
50
+ isAutoincrement: false;
51
+ hasRuntimeDefault: false;
52
+ enumValues: [string, ...string[]];
53
+ baseColumn: never;
54
+ identity: undefined;
55
+ generated: undefined;
56
+ }, {}, {}>;
57
+ redirectUris: import("drizzle-orm/pg-core").PgColumn<{
58
+ name: "redirect_uris";
59
+ tableName: "oauth_clients";
60
+ dataType: "json";
61
+ columnType: "PgJsonb";
62
+ data: string[];
63
+ driverParam: unknown;
64
+ notNull: true;
65
+ hasDefault: false;
66
+ isPrimaryKey: false;
67
+ isAutoincrement: false;
68
+ hasRuntimeDefault: false;
69
+ enumValues: undefined;
70
+ baseColumn: never;
71
+ identity: undefined;
72
+ generated: undefined;
73
+ }, {}, {
74
+ $type: string[];
75
+ }>;
76
+ tokenEndpointAuthMethod: import("drizzle-orm/pg-core").PgColumn<{
77
+ name: "token_endpoint_auth_method";
78
+ tableName: "oauth_clients";
79
+ dataType: "string";
80
+ columnType: "PgText";
81
+ data: "none" | "client_secret_post" | "client_secret_basic";
82
+ driverParam: string;
83
+ notNull: true;
84
+ hasDefault: false;
85
+ isPrimaryKey: false;
86
+ isAutoincrement: false;
87
+ hasRuntimeDefault: false;
88
+ enumValues: [string, ...string[]];
89
+ baseColumn: never;
90
+ identity: undefined;
91
+ generated: undefined;
92
+ }, {}, {
93
+ $type: "none" | "client_secret_post" | "client_secret_basic";
94
+ }>;
95
+ clientSecretHash: import("drizzle-orm/pg-core").PgColumn<{
96
+ name: "client_secret_hash";
97
+ tableName: "oauth_clients";
98
+ dataType: "string";
99
+ columnType: "PgText";
100
+ data: string;
101
+ driverParam: string;
102
+ notNull: false;
103
+ hasDefault: false;
104
+ isPrimaryKey: false;
105
+ isAutoincrement: false;
106
+ hasRuntimeDefault: false;
107
+ enumValues: [string, ...string[]];
108
+ baseColumn: never;
109
+ identity: undefined;
110
+ generated: undefined;
111
+ }, {}, {}>;
112
+ createdAt: import("drizzle-orm/pg-core").PgColumn<{
113
+ name: "created_at";
114
+ tableName: "oauth_clients";
115
+ dataType: "date";
116
+ columnType: "PgTimestamp";
117
+ data: Date;
118
+ driverParam: string;
119
+ notNull: true;
120
+ hasDefault: false;
121
+ isPrimaryKey: false;
122
+ isAutoincrement: false;
123
+ hasRuntimeDefault: false;
124
+ enumValues: undefined;
125
+ baseColumn: never;
126
+ identity: undefined;
127
+ generated: undefined;
128
+ }, {}, {}>;
129
+ };
130
+ dialect: "pg";
131
+ }>;
132
+ export declare const oauthAuthorizationCodes: import("drizzle-orm/pg-core").PgTableWithColumns<{
133
+ name: "oauth_authorization_codes";
134
+ schema: "mcp";
135
+ columns: {
136
+ id: import("drizzle-orm/pg-core").PgColumn<{
137
+ name: "id";
138
+ tableName: "oauth_authorization_codes";
139
+ dataType: "string";
140
+ columnType: "PgUUID";
141
+ data: string;
142
+ driverParam: string;
143
+ notNull: true;
144
+ hasDefault: true;
145
+ isPrimaryKey: true;
146
+ isAutoincrement: false;
147
+ hasRuntimeDefault: false;
148
+ enumValues: undefined;
149
+ baseColumn: never;
150
+ identity: undefined;
151
+ generated: undefined;
152
+ }, {}, {}>;
153
+ codeHash: import("drizzle-orm/pg-core").PgColumn<{
154
+ name: "code_hash";
155
+ tableName: "oauth_authorization_codes";
156
+ dataType: "string";
157
+ columnType: "PgText";
158
+ data: string;
159
+ driverParam: string;
160
+ notNull: true;
161
+ hasDefault: false;
162
+ isPrimaryKey: false;
163
+ isAutoincrement: false;
164
+ hasRuntimeDefault: false;
165
+ enumValues: [string, ...string[]];
166
+ baseColumn: never;
167
+ identity: undefined;
168
+ generated: undefined;
169
+ }, {}, {}>;
170
+ clientId: import("drizzle-orm/pg-core").PgColumn<{
171
+ name: "client_id";
172
+ tableName: "oauth_authorization_codes";
173
+ dataType: "string";
174
+ columnType: "PgUUID";
175
+ data: string;
176
+ driverParam: string;
177
+ notNull: true;
178
+ hasDefault: false;
179
+ isPrimaryKey: false;
180
+ isAutoincrement: false;
181
+ hasRuntimeDefault: false;
182
+ enumValues: undefined;
183
+ baseColumn: never;
184
+ identity: undefined;
185
+ generated: undefined;
186
+ }, {}, {}>;
187
+ userId: import("drizzle-orm/pg-core").PgColumn<{
188
+ name: "user_id";
189
+ tableName: "oauth_authorization_codes";
190
+ dataType: "string";
191
+ columnType: "PgUUID";
192
+ data: string;
193
+ driverParam: string;
194
+ notNull: true;
195
+ hasDefault: false;
196
+ isPrimaryKey: false;
197
+ isAutoincrement: false;
198
+ hasRuntimeDefault: false;
199
+ enumValues: undefined;
200
+ baseColumn: never;
201
+ identity: undefined;
202
+ generated: undefined;
203
+ }, {}, {}>;
204
+ redirectUri: import("drizzle-orm/pg-core").PgColumn<{
205
+ name: "redirect_uri";
206
+ tableName: "oauth_authorization_codes";
207
+ dataType: "string";
208
+ columnType: "PgText";
209
+ data: string;
210
+ driverParam: string;
211
+ notNull: true;
212
+ hasDefault: false;
213
+ isPrimaryKey: false;
214
+ isAutoincrement: false;
215
+ hasRuntimeDefault: false;
216
+ enumValues: [string, ...string[]];
217
+ baseColumn: never;
218
+ identity: undefined;
219
+ generated: undefined;
220
+ }, {}, {}>;
221
+ codeChallenge: import("drizzle-orm/pg-core").PgColumn<{
222
+ name: "code_challenge";
223
+ tableName: "oauth_authorization_codes";
224
+ dataType: "string";
225
+ columnType: "PgText";
226
+ data: string;
227
+ driverParam: string;
228
+ notNull: true;
229
+ hasDefault: false;
230
+ isPrimaryKey: false;
231
+ isAutoincrement: false;
232
+ hasRuntimeDefault: false;
233
+ enumValues: [string, ...string[]];
234
+ baseColumn: never;
235
+ identity: undefined;
236
+ generated: undefined;
237
+ }, {}, {}>;
238
+ canWrite: import("drizzle-orm/pg-core").PgColumn<{
239
+ name: "can_write";
240
+ tableName: "oauth_authorization_codes";
241
+ dataType: "boolean";
242
+ columnType: "PgBoolean";
243
+ data: boolean;
244
+ driverParam: boolean;
245
+ notNull: true;
246
+ hasDefault: false;
247
+ isPrimaryKey: false;
248
+ isAutoincrement: false;
249
+ hasRuntimeDefault: false;
250
+ enumValues: undefined;
251
+ baseColumn: never;
252
+ identity: undefined;
253
+ generated: undefined;
254
+ }, {}, {}>;
255
+ expiresAt: import("drizzle-orm/pg-core").PgColumn<{
256
+ name: "expires_at";
257
+ tableName: "oauth_authorization_codes";
258
+ dataType: "date";
259
+ columnType: "PgTimestamp";
260
+ data: Date;
261
+ driverParam: string;
262
+ notNull: true;
263
+ hasDefault: false;
264
+ isPrimaryKey: false;
265
+ isAutoincrement: false;
266
+ hasRuntimeDefault: false;
267
+ enumValues: undefined;
268
+ baseColumn: never;
269
+ identity: undefined;
270
+ generated: undefined;
271
+ }, {}, {}>;
272
+ usedAt: import("drizzle-orm/pg-core").PgColumn<{
273
+ name: "used_at";
274
+ tableName: "oauth_authorization_codes";
275
+ dataType: "date";
276
+ columnType: "PgTimestamp";
277
+ data: Date;
278
+ driverParam: string;
279
+ notNull: false;
280
+ hasDefault: false;
281
+ isPrimaryKey: false;
282
+ isAutoincrement: false;
283
+ hasRuntimeDefault: false;
284
+ enumValues: undefined;
285
+ baseColumn: never;
286
+ identity: undefined;
287
+ generated: undefined;
288
+ }, {}, {}>;
289
+ createdAt: import("drizzle-orm/pg-core").PgColumn<{
290
+ name: "created_at";
291
+ tableName: "oauth_authorization_codes";
292
+ dataType: "date";
293
+ columnType: "PgTimestamp";
294
+ data: Date;
295
+ driverParam: string;
296
+ notNull: true;
297
+ hasDefault: false;
298
+ isPrimaryKey: false;
299
+ isAutoincrement: false;
300
+ hasRuntimeDefault: false;
301
+ enumValues: undefined;
302
+ baseColumn: never;
303
+ identity: undefined;
304
+ generated: undefined;
305
+ }, {}, {}>;
306
+ };
307
+ dialect: "pg";
308
+ }>;
309
+ export declare const oauthGrants: import("drizzle-orm/pg-core").PgTableWithColumns<{
310
+ name: "oauth_grants";
311
+ schema: "mcp";
312
+ columns: {
313
+ id: import("drizzle-orm/pg-core").PgColumn<{
314
+ name: "id";
315
+ tableName: "oauth_grants";
316
+ dataType: "string";
317
+ columnType: "PgUUID";
318
+ data: string;
319
+ driverParam: string;
320
+ notNull: true;
321
+ hasDefault: true;
322
+ isPrimaryKey: true;
323
+ isAutoincrement: false;
324
+ hasRuntimeDefault: false;
325
+ enumValues: undefined;
326
+ baseColumn: never;
327
+ identity: undefined;
328
+ generated: undefined;
329
+ }, {}, {}>;
330
+ userId: import("drizzle-orm/pg-core").PgColumn<{
331
+ name: "user_id";
332
+ tableName: "oauth_grants";
333
+ dataType: "string";
334
+ columnType: "PgUUID";
335
+ data: string;
336
+ driverParam: string;
337
+ notNull: true;
338
+ hasDefault: false;
339
+ isPrimaryKey: false;
340
+ isAutoincrement: false;
341
+ hasRuntimeDefault: false;
342
+ enumValues: undefined;
343
+ baseColumn: never;
344
+ identity: undefined;
345
+ generated: undefined;
346
+ }, {}, {}>;
347
+ clientId: import("drizzle-orm/pg-core").PgColumn<{
348
+ name: "client_id";
349
+ tableName: "oauth_grants";
350
+ dataType: "string";
351
+ columnType: "PgUUID";
352
+ data: string;
353
+ driverParam: string;
354
+ notNull: true;
355
+ hasDefault: false;
356
+ isPrimaryKey: false;
357
+ isAutoincrement: false;
358
+ hasRuntimeDefault: false;
359
+ enumValues: undefined;
360
+ baseColumn: never;
361
+ identity: undefined;
362
+ generated: undefined;
363
+ }, {}, {}>;
364
+ canWrite: import("drizzle-orm/pg-core").PgColumn<{
365
+ name: "can_write";
366
+ tableName: "oauth_grants";
367
+ dataType: "boolean";
368
+ columnType: "PgBoolean";
369
+ data: boolean;
370
+ driverParam: boolean;
371
+ notNull: true;
372
+ hasDefault: false;
373
+ isPrimaryKey: false;
374
+ isAutoincrement: false;
375
+ hasRuntimeDefault: false;
376
+ enumValues: undefined;
377
+ baseColumn: never;
378
+ identity: undefined;
379
+ generated: undefined;
380
+ }, {}, {}>;
381
+ refreshTokenHash: import("drizzle-orm/pg-core").PgColumn<{
382
+ name: "refresh_token_hash";
383
+ tableName: "oauth_grants";
384
+ dataType: "string";
385
+ columnType: "PgText";
386
+ data: string;
387
+ driverParam: string;
388
+ notNull: true;
389
+ hasDefault: false;
390
+ isPrimaryKey: false;
391
+ isAutoincrement: false;
392
+ hasRuntimeDefault: false;
393
+ enumValues: [string, ...string[]];
394
+ baseColumn: never;
395
+ identity: undefined;
396
+ generated: undefined;
397
+ }, {}, {}>;
398
+ previousRefreshTokenHash: import("drizzle-orm/pg-core").PgColumn<{
399
+ name: "previous_refresh_token_hash";
400
+ tableName: "oauth_grants";
401
+ dataType: "string";
402
+ columnType: "PgText";
403
+ data: string;
404
+ driverParam: string;
405
+ notNull: false;
406
+ hasDefault: false;
407
+ isPrimaryKey: false;
408
+ isAutoincrement: false;
409
+ hasRuntimeDefault: false;
410
+ enumValues: [string, ...string[]];
411
+ baseColumn: never;
412
+ identity: undefined;
413
+ generated: undefined;
414
+ }, {}, {}>;
415
+ refreshExpiresAt: import("drizzle-orm/pg-core").PgColumn<{
416
+ name: "refresh_expires_at";
417
+ tableName: "oauth_grants";
418
+ dataType: "date";
419
+ columnType: "PgTimestamp";
420
+ data: Date;
421
+ driverParam: string;
422
+ notNull: true;
423
+ hasDefault: false;
424
+ isPrimaryKey: false;
425
+ isAutoincrement: false;
426
+ hasRuntimeDefault: false;
427
+ enumValues: undefined;
428
+ baseColumn: never;
429
+ identity: undefined;
430
+ generated: undefined;
431
+ }, {}, {}>;
432
+ lastUsedAt: import("drizzle-orm/pg-core").PgColumn<{
433
+ name: "last_used_at";
434
+ tableName: "oauth_grants";
435
+ dataType: "date";
436
+ columnType: "PgTimestamp";
437
+ data: Date;
438
+ driverParam: string;
439
+ notNull: false;
440
+ hasDefault: false;
441
+ isPrimaryKey: false;
442
+ isAutoincrement: false;
443
+ hasRuntimeDefault: false;
444
+ enumValues: undefined;
445
+ baseColumn: never;
446
+ identity: undefined;
447
+ generated: undefined;
448
+ }, {}, {}>;
449
+ createdAt: import("drizzle-orm/pg-core").PgColumn<{
450
+ name: "created_at";
451
+ tableName: "oauth_grants";
452
+ dataType: "date";
453
+ columnType: "PgTimestamp";
454
+ data: Date;
455
+ driverParam: string;
456
+ notNull: true;
457
+ hasDefault: false;
458
+ isPrimaryKey: false;
459
+ isAutoincrement: false;
460
+ hasRuntimeDefault: false;
461
+ enumValues: undefined;
462
+ baseColumn: never;
463
+ identity: undefined;
464
+ generated: undefined;
465
+ }, {}, {}>;
466
+ };
467
+ dialect: "pg";
468
+ }>;
2
469
  export declare const accessTokens: import("drizzle-orm/pg-core").PgTableWithColumns<{
3
470
  name: "access_tokens";
4
471
  schema: "mcp";
@@ -139,7 +606,26 @@ export declare const accessTokens: import("drizzle-orm/pg-core").PgTableWithColu
139
606
  identity: undefined;
140
607
  generated: undefined;
141
608
  }, {}, {}>;
609
+ grantId: import("drizzle-orm/pg-core").PgColumn<{
610
+ name: "grant_id";
611
+ tableName: "access_tokens";
612
+ dataType: "string";
613
+ columnType: "PgUUID";
614
+ data: string;
615
+ driverParam: string;
616
+ notNull: false;
617
+ hasDefault: false;
618
+ isPrimaryKey: false;
619
+ isAutoincrement: false;
620
+ hasRuntimeDefault: false;
621
+ enumValues: undefined;
622
+ baseColumn: never;
623
+ identity: undefined;
624
+ generated: undefined;
625
+ }, {}, {}>;
142
626
  };
143
627
  dialect: "pg";
144
628
  }>;
629
+ export type OAuthClientRow = typeof oauthClients.$inferSelect;
630
+ export type OAuthTokenEndpointAuthMethod = OAuthClientRow["tokenEndpointAuthMethod"];
145
631
  //# sourceMappingURL=schema.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,SAAS,+CAAkB,CAAC;AAEzC,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAWvB,CAAC"}
1
+ {"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,SAAS,+CAAkB,CAAC;AAEzC,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQvB,CAAC;AAEH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAelC,CAAC;AAEH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EActB,CAAC;AAEH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAYvB,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,OAAO,YAAY,CAAC,YAAY,CAAC;AAC9D,MAAM,MAAM,4BAA4B,GAAG,cAAc,CAAC,yBAAyB,CAAC,CAAC"}
package/dist/schema.js CHANGED
@@ -1,8 +1,49 @@
1
- // Drizzle view of the module's table (migrations/0001_create_access_tokens.sql). The migration is
2
- // the source of truth; this file only types the queries.
1
+ // Drizzle view of the module's tables (migrations/0001_create_access_tokens.sql and
2
+ // 0002_create_oauth_grants.sql). The migrations are the source of truth; this file only types the
3
+ // queries.
3
4
  import { users } from "@softure-ai/auth";
4
- import { boolean, pgSchema, text, timestamp, uuid } from "drizzle-orm/pg-core";
5
+ import { boolean, jsonb, pgSchema, text, timestamp, uuid } from "drizzle-orm/pg-core";
5
6
  export const mcpSchema = pgSchema("mcp");
7
+ export const oauthClients = mcpSchema.table("oauth_clients", {
8
+ id: uuid("id").primaryKey().defaultRandom(),
9
+ clientId: text("client_id").notNull().unique("oauth_clients_client_id_key"),
10
+ clientName: text("client_name").notNull(),
11
+ redirectUris: jsonb("redirect_uris").$type().notNull(),
12
+ tokenEndpointAuthMethod: text("token_endpoint_auth_method").$type().notNull(),
13
+ clientSecretHash: text("client_secret_hash"),
14
+ createdAt: timestamp("created_at", { withTimezone: true }).notNull(),
15
+ });
16
+ export const oauthAuthorizationCodes = mcpSchema.table("oauth_authorization_codes", {
17
+ id: uuid("id").primaryKey().defaultRandom(),
18
+ codeHash: text("code_hash").notNull().unique("oauth_authorization_codes_code_hash_key"),
19
+ clientId: uuid("client_id")
20
+ .notNull()
21
+ .references(() => oauthClients.id, { onDelete: "cascade" }),
22
+ userId: uuid("user_id")
23
+ .notNull()
24
+ .references(() => users.id, { onDelete: "cascade" }),
25
+ redirectUri: text("redirect_uri").notNull(),
26
+ codeChallenge: text("code_challenge").notNull(),
27
+ canWrite: boolean("can_write").notNull(),
28
+ expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
29
+ usedAt: timestamp("used_at", { withTimezone: true }),
30
+ createdAt: timestamp("created_at", { withTimezone: true }).notNull(),
31
+ });
32
+ export const oauthGrants = mcpSchema.table("oauth_grants", {
33
+ id: uuid("id").primaryKey().defaultRandom(),
34
+ userId: uuid("user_id")
35
+ .notNull()
36
+ .references(() => users.id, { onDelete: "cascade" }),
37
+ clientId: uuid("client_id")
38
+ .notNull()
39
+ .references(() => oauthClients.id, { onDelete: "cascade" }),
40
+ canWrite: boolean("can_write").notNull(),
41
+ refreshTokenHash: text("refresh_token_hash").notNull().unique("oauth_grants_refresh_token_hash_key"),
42
+ previousRefreshTokenHash: text("previous_refresh_token_hash"),
43
+ refreshExpiresAt: timestamp("refresh_expires_at", { withTimezone: true }).notNull(),
44
+ lastUsedAt: timestamp("last_used_at", { withTimezone: true }),
45
+ createdAt: timestamp("created_at", { withTimezone: true }).notNull(),
46
+ });
6
47
  export const accessTokens = mcpSchema.table("access_tokens", {
7
48
  id: uuid("id").primaryKey().defaultRandom(),
8
49
  userId: uuid("user_id")
@@ -14,5 +55,6 @@ export const accessTokens = mcpSchema.table("access_tokens", {
14
55
  createdAt: timestamp("created_at", { withTimezone: true }).notNull(),
15
56
  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
16
57
  lastUsedAt: timestamp("last_used_at", { withTimezone: true }),
58
+ grantId: uuid("grant_id").references(() => oauthGrants.id, { onDelete: "cascade" }),
17
59
  });
18
60
  //# sourceMappingURL=schema.js.map
@@ -1 +1 @@
1
- {"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,yDAAyD;AACzD,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAE/E,MAAM,CAAC,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;AAEzC,MAAM,CAAC,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,eAAe,EAAE;IAC3D,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IAC3C,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;SACpB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACtD,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,8BAA8B,CAAC;IAC9E,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACxC,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACpE,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACpE,UAAU,EAAE,SAAS,CAAC,cAAc,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;CAC9D,CAAC,CAAC"}
1
+ {"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,kGAAkG;AAClG,WAAW;AACX,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAoB,MAAM,qBAAqB,CAAC;AAExG,MAAM,CAAC,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;AAEzC,MAAM,CAAC,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,eAAe,EAAE;IAC3D,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IAC3C,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,6BAA6B,CAAC;IAC3E,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,YAAY,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC,KAAK,EAAY,CAAC,OAAO,EAAE;IAChE,uBAAuB,EAAE,IAAI,CAAC,4BAA4B,CAAC,CAAC,KAAK,EAAyD,CAAC,OAAO,EAAE;IACpI,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC;IAC5C,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;CACrE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,SAAS,CAAC,KAAK,CAAC,2BAA2B,EAAE;IAClF,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IAC3C,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,yCAAyC,CAAC;IACvF,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;SACxB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAC7D,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;SACpB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACtD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;IAC/C,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACxC,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACpE,MAAM,EAAE,SAAS,CAAC,SAAS,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACpD,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;CACrE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,cAAc,EAAE;IACzD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IAC3C,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;SACpB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACtD,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;SACxB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAC7D,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACxC,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,qCAAqC,CAAC;IACpG,wBAAwB,EAAE,IAAI,CAAC,6BAA6B,CAAC;IAC7D,gBAAgB,EAAE,SAAS,CAAC,oBAAoB,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACnF,UAAU,EAAE,SAAS,CAAC,cAAc,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC7D,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;CACrE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,eAAe,EAAE;IAC3D,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IAC3C,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;SACpB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACtD,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,8BAA8B,CAAC;IAC9E,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACxC,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACpE,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACpE,UAAU,EAAE,SAAS,CAAC,cAAc,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC7D,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,UAAU,CAAC,GAAgB,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;CACjG,CAAC,CAAC"}
@@ -1,10 +1,8 @@
1
1
  import { type McpServer, type Server } from "@modelcontextprotocol/server";
2
2
  import type { McpServerIdentity } from "../contract.js";
3
+ import { MCP_READ_SCOPE, MCP_WRITE_SCOPE } from "./scopes.js";
3
4
  import { type McpAccessContext } from "./tokens.js";
4
- /** Every valid token reads. */
5
- export declare const MCP_READ_SCOPE = "mcp:read";
6
- /** A token that may write: issued for writes, and the app allows them. */
7
- export declare const MCP_WRITE_SCOPE = "mcp:write";
5
+ export { MCP_READ_SCOPE, MCP_WRITE_SCOPE };
8
6
  /** The security bucket the endpoint counts in; `MCP_RATE_LIMIT_BUCKETS` holds its default. */
9
7
  export declare const MCP_RATE_LIMIT_BUCKET = "mcp";
10
8
  /** Larger bodies get 413 from the SDK before anything is parsed. No tool call needs more. */
@@ -1 +1 @@
1
- {"version":3,"file":"endpoint.d.ts","sourceRoot":"","sources":["../../src/server/endpoint.ts"],"names":[],"mappings":"AAKA,OAAO,EAML,KAAK,SAAS,EACd,KAAK,MAAM,EACZ,MAAM,8BAA8B,CAAC;AAGtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEvE,+BAA+B;AAC/B,eAAO,MAAM,cAAc,aAAa,CAAC;AACzC,0EAA0E;AAC1E,eAAO,MAAM,eAAe,cAAc,CAAC;AAE3C,8FAA8F;AAC9F,eAAO,MAAM,qBAAqB,QAAQ,CAAC;AAE3C,6FAA6F;AAC7F,eAAO,MAAM,qBAAqB,QAAc,CAAC;AAOjD,mGAAmG;AACnG,MAAM,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,iBAAiB,KAAK,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC;AAEjH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC;CACzC;AAED,8CAA8C;AAC9C,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEzF;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,YAAY,EAAE,EAAE,kBAAkB,GAAG,WAAW,CAmCnF"}
1
+ {"version":3,"file":"endpoint.d.ts","sourceRoot":"","sources":["../../src/server/endpoint.ts"],"names":[],"mappings":"AAKA,OAAO,EAML,KAAK,SAAS,EACd,KAAK,MAAM,EACZ,MAAM,8BAA8B,CAAC;AAGtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAExD,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC;AAE3C,8FAA8F;AAC9F,eAAO,MAAM,qBAAqB,QAAQ,CAAC;AAE3C,6FAA6F;AAC7F,eAAO,MAAM,qBAAqB,QAAc,CAAC;AAOjD,mGAAmG;AACnG,MAAM,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,iBAAiB,KAAK,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC;AAEjH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC;CACzC;AAED,8CAA8C;AAC9C,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEzF;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,YAAY,EAAE,EAAE,kBAAkB,GAAG,WAAW,CAmCnF"}
@@ -1,4 +1,4 @@
1
- // The MCP endpoint (FIRE_TRACKER `src/app/api/mcp/route.ts`, generalised). It takes a Web
1
+ // The MCP endpoint (an adopting app's MCP route, generalised). It takes a Web
2
2
  // `Request` and returns a `Response`, so it runs under any fetch-shaped host; the Next adapter only
3
3
  // supplies the context. Order: identify the client, count the request, verify the Bearer token,
4
4
  // then hand the request to a fresh server from the app's factory. Each refusal happens before the
@@ -6,11 +6,10 @@
6
6
  import { bearerAuthChallengeResponse, createMcpHandler, OAuthError, OAuthErrorCode, } from "@modelcontextprotocol/server";
7
7
  import { errorLogLabel, getModule } from "@softure-ai/core";
8
8
  import { consumeRateLimit, identifyClient } from "@softure-ai/security/server";
9
+ import { getProtectedResourceMetadataUrl, isOAuthEnabled } from "./oauth-http.js";
10
+ import { MCP_READ_SCOPE, MCP_WRITE_SCOPE } from "./scopes.js";
9
11
  import { verifyAccessToken } from "./tokens.js";
10
- /** Every valid token reads. */
11
- export const MCP_READ_SCOPE = "mcp:read";
12
- /** A token that may write: issued for writes, and the app allows them. */
13
- export const MCP_WRITE_SCOPE = "mcp:write";
12
+ export { MCP_READ_SCOPE, MCP_WRITE_SCOPE };
14
13
  /** The security bucket the endpoint counts in; `MCP_RATE_LIMIT_BUCKETS` holds its default. */
15
14
  export const MCP_RATE_LIMIT_BUCKET = "mcp";
16
15
  /** Larger bodies get 413 from the SDK before anything is parsed. No tool call needs more. */
@@ -58,10 +57,14 @@ export function createMcpEndpoint({ createServer }) {
58
57
  /**
59
58
  * The verified identity as the SDK's `AuthInfo`, or the challenge response. Unknown, revoked,
60
59
  * expired and malformed tokens get the same `401 invalid_token`. Expiry is decided by the query on
61
- * the module's clock, not by the SDK's own check on the wall clock.
60
+ * the module's clock, not by the SDK's own check on the wall clock. With OAuth on, the challenge
61
+ * names the protected resource metadata (RFC 9728 §5.1): that is how claude.ai and ChatGPT find
62
+ * the authorization server.
62
63
  */
63
64
  async function authenticate(ctx, header) {
64
- const challenge = { requiredScopes: [MCP_READ_SCOPE] };
65
+ const challenge = isOAuthEnabled(ctx.config)
66
+ ? { requiredScopes: [MCP_READ_SCOPE], resourceMetadataUrl: getProtectedResourceMetadataUrl(ctx.config) }
67
+ : { requiredScopes: [MCP_READ_SCOPE] };
65
68
  if (header === null || !BEARER_PREFIX.test(header)) {
66
69
  return bearerAuthChallengeResponse(new OAuthError(OAuthErrorCode.InvalidToken, "Missing Bearer token"), challenge);
67
70
  }
@@ -1 +1 @@
1
- {"version":3,"file":"endpoint.js","sourceRoot":"","sources":["../../src/server/endpoint.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,oGAAoG;AACpG,gGAAgG;AAChG,kGAAkG;AAClG,4BAA4B;AAC5B,OAAO,EACL,2BAA2B,EAC3B,gBAAgB,EAChB,UAAU,EACV,cAAc,GAIf,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE/E,OAAO,EAAE,iBAAiB,EAAyB,MAAM,aAAa,CAAC;AAEvE,+BAA+B;AAC/B,MAAM,CAAC,MAAM,cAAc,GAAG,UAAU,CAAC;AACzC,0EAA0E;AAC1E,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC;AAE3C,8FAA8F;AAC9F,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAE3C,6FAA6F;AAC7F,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,GAAG,IAAI,CAAC;AAEjD,4EAA4E;AAC5E,MAAM,aAAa,GAAG,QAAQ,CAAC;AAC/B,MAAM,aAAa,GAAG,gBAAgB,CAAC;AACvC,MAAM,QAAQ,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AAYjD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAE,YAAY,EAAsB;IACpE,MAAM,OAAO,GAAG,gBAAgB,CAC9B,CAAC,cAAc,EAAE,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,EACvE;QACE,YAAY,EAAE,MAAM;QACpB,kBAAkB,EAAE,qBAAqB;QACzC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,qDAAqD,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;KAC/G,CACF,CAAC;IAEF,OAAO,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;QAC5B,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE3G,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,mFAAmF;YACnF,KAAK,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0FAA0F;YAC1F,OAAO,CAAC,KAAK,CAAC,sDAAsD,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC5F,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAC9B,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,EAAE,CAC1F,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;QAC/E,IAAI,QAAQ,YAAY,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAClD,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CAAC,GAAqB,EAAE,MAAqB;IACtE,MAAM,SAAS,GAAG,EAAE,cAAc,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC;IACvD,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,OAAO,2BAA2B,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,sBAAsB,CAAC,EAAE,SAAS,CAAC,CAAC;IACrH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAEvD,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,qDAAqD,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3F,OAAO,2BAA2B,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,WAAW,EAAE,uBAAuB,CAAC,EAAE,SAAS,CAAC,CAAC;IACrH,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,2BAA2B,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,sBAAsB,CAAC,EAAE,SAAS,CAAC,CAAC;IACrH,CAAC;IACD,OAAO;QACL,KAAK;QACL,8EAA8E;QAC9E,QAAQ,EAAE,QAAQ,CAAC,OAAO;QAC1B,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;QAChF,qDAAqD;QACrD,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;QAC1D,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE;KAC5C,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,SAAS,YAAY,CAAC,QAA8B;IAClD,MAAM,MAAM,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAC,aAAa,CAAC,CAAC;IAChD,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1E,4FAA4F;QAC5F,gFAAgF;QAChF,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;AACrG,CAAC;AAED,qGAAqG;AACrG,SAAS,qBAAqB,CAAC,GAAqB;IAClD,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,OAA4D,CAAC;IAChH,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC,qBAAqB,CAAC,KAAK,SAAS,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,uDAAuD,qBAAqB,oEAAoE,CACjJ,CAAC;IACJ,CAAC;AACH,CAAC"}
1
+ {"version":3,"file":"endpoint.js","sourceRoot":"","sources":["../../src/server/endpoint.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,oGAAoG;AACpG,gGAAgG;AAChG,kGAAkG;AAClG,4BAA4B;AAC5B,OAAO,EACL,2BAA2B,EAC3B,gBAAgB,EAChB,UAAU,EACV,cAAc,GAIf,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE/E,OAAO,EAAE,+BAA+B,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAClF,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAyB,MAAM,aAAa,CAAC;AAEvE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC;AAE3C,8FAA8F;AAC9F,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAE3C,6FAA6F;AAC7F,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,GAAG,IAAI,CAAC;AAEjD,4EAA4E;AAC5E,MAAM,aAAa,GAAG,QAAQ,CAAC;AAC/B,MAAM,aAAa,GAAG,gBAAgB,CAAC;AACvC,MAAM,QAAQ,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AAYjD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAE,YAAY,EAAsB;IACpE,MAAM,OAAO,GAAG,gBAAgB,CAC9B,CAAC,cAAc,EAAE,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,EACvE;QACE,YAAY,EAAE,MAAM;QACpB,kBAAkB,EAAE,qBAAqB;QACzC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,qDAAqD,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;KAC/G,CACF,CAAC;IAEF,OAAO,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;QAC5B,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE3G,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,mFAAmF;YACnF,KAAK,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0FAA0F;YAC1F,OAAO,CAAC,KAAK,CAAC,sDAAsD,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC5F,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAC9B,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,EAAE,CAC1F,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;QAC/E,IAAI,QAAQ,YAAY,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAClD,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,YAAY,CAAC,GAAqB,EAAE,MAAqB;IACtE,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;QAC1C,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,cAAc,CAAC,EAAE,mBAAmB,EAAE,+BAA+B,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;QACxG,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC;IACzC,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,OAAO,2BAA2B,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,sBAAsB,CAAC,EAAE,SAAS,CAAC,CAAC;IACrH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAEvD,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,qDAAqD,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3F,OAAO,2BAA2B,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,WAAW,EAAE,uBAAuB,CAAC,EAAE,SAAS,CAAC,CAAC;IACrH,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,2BAA2B,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,sBAAsB,CAAC,EAAE,SAAS,CAAC,CAAC;IACrH,CAAC;IACD,OAAO;QACL,KAAK;QACL,8EAA8E;QAC9E,QAAQ,EAAE,QAAQ,CAAC,OAAO;QAC1B,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;QAChF,qDAAqD;QACrD,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;QAC1D,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE;KAC5C,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,SAAS,YAAY,CAAC,QAA8B;IAClD,MAAM,MAAM,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAC,aAAa,CAAC,CAAC;IAChD,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1E,4FAA4F;QAC5F,gFAAgF;QAChF,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;AACrG,CAAC;AAED,qGAAqG;AACrG,SAAS,qBAAqB,CAAC,GAAqB;IAClD,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,OAA4D,CAAC;IAChH,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC,qBAAqB,CAAC,KAAK,SAAS,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,uDAAuD,qBAAqB,oEAAoE,CACjJ,CAAC;IACJ,CAAC;AACH,CAAC"}
@@ -1 +1 @@
1
- {"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../src/server/health.ts"],"names":[],"mappings":"AAEA,OAAO,EAAM,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAIxD,eAAO,MAAM,sBAAsB,EAAE,WAKpC,CAAC"}
1
+ {"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../src/server/health.ts"],"names":[],"mappings":"AAGA,OAAO,EAAM,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAIxD,eAAO,MAAM,sBAAsB,EAAE,WAMpC,CAAC"}