@softure-ai/mcp-access 0.1.6 → 0.1.8

package/dist/server/endpoint.js.map

@@ -1 +1 @@
-{"version":3,"file":"endpoint.js","sourceRoot":"","sources":["../../src/server/endpoint.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,oGAAoG;AACpG,gGAAgG;AAChG,kGAAkG;AAClG,4BAA4B;AAC5B,OAAO,EACL,2BAA2B,EAC3B,gBAAgB,EAChB,UAAU,EACV,cAAc,GAIf,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE/E,OAAO,EAAE,iBAAiB,EAAyB,MAAM,aAAa,CAAC;AAEvE,+BAA+B;AAC/B,MAAM,CAAC,MAAM,cAAc,GAAG,UAAU,CAAC;AACzC,0EAA0E;AAC1E,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC;AAE3C,8FAA8F;AAC9F,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAE3C,6FAA6F;AAC7F,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,GAAG,IAAI,CAAC;AAEjD,4EAA4E;AAC5E,MAAM,aAAa,GAAG,QAAQ,CAAC;AAC/B,MAAM,aAAa,GAAG,gBAAgB,CAAC;AACvC,MAAM,QAAQ,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AAYjD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAE,YAAY,EAAsB;IACpE,MAAM,OAAO,GAAG,gBAAgB,CAC9B,CAAC,cAAc,EAAE,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,EACvE;QACE,YAAY,EAAE,MAAM;QACpB,kBAAkB,EAAE,qBAAqB;QACzC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,qDAAqD,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;KAC/G,CACF,CAAC;IAEF,OAAO,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;QAC5B,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE3G,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,mFAAmF;YACnF,KAAK,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0FAA0F;YAC1F,OAAO,CAAC,KAAK,CAAC,sDAAsD,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC5F,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAC9B,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,EAAE,CAC1F,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;QAC/E,IAAI,QAAQ,YAAY,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAClD,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CAAC,GAAqB,EAAE,MAAqB;IACtE,MAAM,SAAS,GAAG,EAAE,cAAc,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC;IACvD,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,OAAO,2BAA2B,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,sBAAsB,CAAC,EAAE,SAAS,CAAC,CAAC;IACrH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAEvD,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,qDAAqD,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3F,OAAO,2BAA2B,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,WAAW,EAAE,uBAAuB,CAAC,EAAE,SAAS,CAAC,CAAC;IACrH,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,2BAA2B,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,sBAAsB,CAAC,EAAE,SAAS,CAAC,CAAC;IACrH,CAAC;IACD,OAAO;QACL,KAAK;QACL,8EAA8E;QAC9E,QAAQ,EAAE,QAAQ,CAAC,OAAO;QAC1B,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;QAChF,qDAAqD;QACrD,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;QAC1D,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE;KAC5C,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,SAAS,YAAY,CAAC,QAA8B;IAClD,MAAM,MAAM,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAC,aAAa,CAAC,CAAC;IAChD,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1E,4FAA4F;QAC5F,gFAAgF;QAChF,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;AACrG,CAAC;AAED,qGAAqG;AACrG,SAAS,qBAAqB,CAAC,GAAqB;IAClD,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,OAA4D,CAAC;IAChH,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC,qBAAqB,CAAC,KAAK,SAAS,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,uDAAuD,qBAAqB,oEAAoE,CACjJ,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"endpoint.js","sourceRoot":"","sources":["../../src/server/endpoint.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,oGAAoG;AACpG,gGAAgG;AAChG,kGAAkG;AAClG,4BAA4B;AAC5B,OAAO,EACL,2BAA2B,EAC3B,gBAAgB,EAChB,UAAU,EACV,cAAc,GAIf,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE/E,OAAO,EAAE,+BAA+B,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAyB,MAAM,aAAa,CAAC;AAEvE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC;AAE3C,8FAA8F;AAC9F,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAE3C,6FAA6F;AAC7F,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,GAAG,IAAI,CAAC;AAEjD,4EAA4E;AAC5E,MAAM,aAAa,GAAG,QAAQ,CAAC;AAC/B,MAAM,aAAa,GAAG,gBAAgB,CAAC;AACvC,MAAM,QAAQ,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AAYjD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAE,YAAY,EAAsB;IACpE,MAAM,OAAO,GAAG,gBAAgB,CAC9B,CAAC,cAAc,EAAE,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,EACvE;QACE,YAAY,EAAE,MAAM;QACpB,kBAAkB,EAAE,qBAAqB;QACzC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,qDAAqD,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;KAC/G,CACF,CAAC;IAEF,OAAO,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;QAC5B,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE3G,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,mFAAmF;YACnF,KAAK,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0FAA0F;YAC1F,OAAO,CAAC,KAAK,CAAC,sDAAsD,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC5F,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAC9B,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,EAAE,CAC1F,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,QAAQ,YAAY,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAClD,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,YAAY,CAAC,GAAqB,EAAE,OAAgB;IACjE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;QAC1C,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,cAAc,CAAC,EAAE,mBAAmB,EAAE,+BAA+B,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE;QAChJ,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC;IACzC,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,OAAO,2BAA2B,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,sBAAsB,CAAC,EAAE,SAAS,CAAC,CAAC;IACrH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAEvD,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,qDAAqD,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3F,OAAO,2BAA2B,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,WAAW,EAAE,uBAAuB,CAAC,EAAE,SAAS,CAAC,CAAC;IACrH,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,2BAA2B,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,sBAAsB,CAAC,EAAE,SAAS,CAAC,CAAC;IACrH,CAAC;IACD,OAAO;QACL,KAAK;QACL,8EAA8E;QAC9E,QAAQ,EAAE,QAAQ,CAAC,OAAO;QAC1B,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;QAChF,qDAAqD;QACrD,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;QAC1D,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE;KAC5C,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,SAAS,YAAY,CAAC,QAA8B;IAClD,MAAM,MAAM,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAC,aAAa,CAAC,CAAC;IAChD,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1E,4FAA4F;QAC5F,gFAAgF;QAChF,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;AACrG,CAAC;AAED,qGAAqG;AACrG,SAAS,qBAAqB,CAAC,GAAqB;IAClD,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,OAA4D,CAAC;IAChH,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC,qBAAqB,CAAC,KAAK,SAAS,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,uDAAuD,qBAAqB,oEAAoE,CACjJ,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/server/health.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../src/server/health.ts"],"names":[],"mappings":"AAEA,OAAO,EAAM,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAIxD,eAAO,MAAM,sBAAsB,EAAE,WAKpC,CAAC"}
+{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../src/server/health.ts"],"names":[],"mappings":"AAGA,OAAO,EAAM,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAIxD,eAAO,MAAM,sBAAsB,EAAE,WAMpC,CAAC"}

package/dist/server/health.js

@@ -1,11 +1,13 @@
-// The module's readiness probe for `GET /api/health` of `@softure-ai/ops`: the tokens table exists
-// and answers, i.e. `softure migrate` ran. It reads no rows.
+// The module's readiness probe for `GET /api/health` of `@softure-ai/ops`: the tokens table (with
+// its grant column) and the grants table exist and answer, i.e. `softure migrate` ran every file.
+// It reads no rows.
 import { ok } from "@softure-ai/core";
 import { sql } from "drizzle-orm";
 export const checkAccessTokensTable = async (context) => {
     // Core types `db` as unknown; the health route passes the @softure-ai/db handle.
     const db = context.db;
-    await db.execute(sql `select 1 from mcp.access_tokens limit 0`);
+    await db.execute(sql `select grant_id from mcp.access_tokens limit 0`);
+    await db.execute(sql `select 1 from mcp.oauth_grants join mcp.oauth_clients on oauth_clients.id = oauth_grants.client_id limit 0`);
     return ok();
 };
 //# sourceMappingURL=health.js.map

package/dist/server/health.js.map

@@ -1 +1 @@
-{"version":3,"file":"health.js","sourceRoot":"","sources":["../../src/server/health.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,6DAA6D;AAC7D,OAAO,EAAE,EAAE,EAAoB,MAAM,kBAAkB,CAAC;AAExD,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC,MAAM,CAAC,MAAM,sBAAsB,GAAgB,KAAK,EAAE,OAAO,EAAE,EAAE;IACnE,iFAAiF;IACjF,MAAM,EAAE,GAAG,OAAO,CAAC,EAAe,CAAC;IACnC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,yCAAyC,CAAC,CAAC;IAC/D,OAAO,EAAE,EAAE,CAAC;AACd,CAAC,CAAC"}
+{"version":3,"file":"health.js","sourceRoot":"","sources":["../../src/server/health.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,kGAAkG;AAClG,oBAAoB;AACpB,OAAO,EAAE,EAAE,EAAoB,MAAM,kBAAkB,CAAC;AAExD,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC,MAAM,CAAC,MAAM,sBAAsB,GAAgB,KAAK,EAAE,OAAO,EAAE,EAAE;IACnE,iFAAiF;IACjF,MAAM,EAAE,GAAG,OAAO,CAAC,EAAe,CAAC;IACnC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,gDAAgD,CAAC,CAAC;IACtE,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,4GAA4G,CAAC,CAAC;IAClI,OAAO,EAAE,EAAE,CAAC;AACd,CAAC,CAAC"}

package/dist/server/index.d.ts

@@ -1,5 +1,13 @@
 export { createMcpEndpoint, MAX_MCP_REQUEST_BYTES, MCP_RATE_LIMIT_BUCKET, MCP_READ_SCOPE, MCP_WRITE_SCOPE, type McpEndpoint, type McpEndpointOptions, type McpServerFactory, } from "./endpoint.js";
+export { createMcpAccessContext } from "./context.js";
 export { checkAccessTokensTable } from "./health.js";
+export { CONSENT_CODE_PREFIX, CLIENT_SECRET_PREFIX, createAuthorizationCode, exchangeAuthorizationCode, findOAuthClient, isClientSecretValid, listOAuthGrants, pruneOAuthRecords, REFRESH_TOKEN_PREFIX, refreshMcpGrant, registerMcpClient, revokeOAuthGrant, type CreateAuthorizationCodeInput, type ExchangeAuthorizationCodeInput, type IssuedOAuthTokens, type OAuthClientRegistration, type PrunedOAuthRecords, type RefreshOAuthGrantInput, type RegisteredOAuthClient, type RevokeOAuthGrantInput, } from "./oauth.js";
+export { answerOAuthPreflight, AUTHORIZATION_PARAMS, AUTHORIZATION_SERVER_METADATA_PATH, buildClientRedirect, getAuthorizationServerMetadata, getConsentPath, getOAuthIssuer, getProtectedResourceMetadata, getProtectedResourceMetadataUrl, getRootProtectedResourceMetadata, handleAuthorizationDecision, handleClientRegistration, handleTokenRequest, isAcceptableResource, isOAuthEnabled, isWriteScopeRequested, MCP_OAUTH_RATE_LIMIT_BUCKET, OAUTH_SCOPES, PROTECTED_RESOURCE_METADATA_PATH, readAuthorizationParams, serveDiscoveryDocument, validateAuthorizationRequest, type AuthorizationOutcome, type AuthorizationPageError, type AuthorizationRequest, type DiscoveryDocument, } from "./oauth-http.js";
+export { findServedResourceOrigin, readRequestHost, readRequestOrigin, type McpOriginRequest, type McpOrigins } from "../origins.js";
+export { resolveMcpOrigins } from "./origins.js";
+export type { OAuthClientRow, OAuthTokenEndpointAuthMethod } from "../schema.js";
+export { describeRedirectUri, isAllowedRedirectUri, MAX_CLIENT_NAME_LENGTH, parseClientRegistration, type ClientRegistrationResult, type RegistrationError } from "./oauth-validation.js";
+export { getCodeChallenge, isPkceVerifierValid, isValidCodeChallenge, PKCE_METHOD } from "./pkce.js";
 export { getMcpAccessMessages, getMcpAccessOptions, getMcpAccessRoutes, getMcpEndpointUrl, type McpAccessRoutes } from "./options.js";
 export { deleteMcpAccessUserData, exportMcpAccessUserData, mcpAccessPrivacyContributor, type McpAccessUserData, } from "./privacy.js";
 export { ACCESS_TOKEN_PREFIX, hashAccessToken, isAccessTokenShape, issueAccessToken, listAccessTokens, pruneAccessTokens, revokeAccessToken, verifyAccessToken, type IssueAccessTokenInput, type IssueAccessTokenResult, type IssuedAccessToken, type McpAccessContext, type RevokeAccessTokenInput, type VerifiedAccessToken, } from "./tokens.js";

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,EACd,eAAe,EACf,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AACtI,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,2BAA2B,EAC3B,KAAK,iBAAiB,GACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,GACzB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,EACd,eAAe,EACf,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,yBAAyB,EACzB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,4BAA4B,EACjC,KAAK,8BAA8B,EACnC,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,GAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,kCAAkC,EAClC,mBAAmB,EACnB,8BAA8B,EAC9B,cAAc,EACd,cAAc,EACd,4BAA4B,EAC5B,+BAA+B,EAC/B,gCAAgC,EAChC,2BAA2B,EAC3B,wBAAwB,EACxB,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,qBAAqB,EACrB,2BAA2B,EAC3B,YAAY,EACZ,gCAAgC,EAChC,uBAAuB,EACvB,sBAAsB,EACtB,4BAA4B,EAC5B,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,GACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,iBAAiB,EAAE,KAAK,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AACrI,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,YAAY,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,KAAK,wBAAwB,EAAE,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1L,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACrG,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AACtI,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,2BAA2B,EAC3B,KAAK,iBAAiB,GACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,GACzB,MAAM,aAAa,CAAC"}

package/dist/server/index.js

@@ -1,7 +1,14 @@
 // Server-only API of @softure-ai/mcp-access. Every function receives the module context
 // (`{ db, clock, config }`) and never reads request scope; the endpoint takes a Web `Request`.
 export { createMcpEndpoint, MAX_MCP_REQUEST_BYTES, MCP_RATE_LIMIT_BUCKET, MCP_READ_SCOPE, MCP_WRITE_SCOPE, } from "./endpoint.js";
+export { createMcpAccessContext } from "./context.js";
 export { checkAccessTokensTable } from "./health.js";
+export { CONSENT_CODE_PREFIX, CLIENT_SECRET_PREFIX, createAuthorizationCode, exchangeAuthorizationCode, findOAuthClient, isClientSecretValid, listOAuthGrants, pruneOAuthRecords, REFRESH_TOKEN_PREFIX, refreshMcpGrant, registerMcpClient, revokeOAuthGrant, } from "./oauth.js";
+export { answerOAuthPreflight, AUTHORIZATION_PARAMS, AUTHORIZATION_SERVER_METADATA_PATH, buildClientRedirect, getAuthorizationServerMetadata, getConsentPath, getOAuthIssuer, getProtectedResourceMetadata, getProtectedResourceMetadataUrl, getRootProtectedResourceMetadata, handleAuthorizationDecision, handleClientRegistration, handleTokenRequest, isAcceptableResource, isOAuthEnabled, isWriteScopeRequested, MCP_OAUTH_RATE_LIMIT_BUCKET, OAUTH_SCOPES, PROTECTED_RESOURCE_METADATA_PATH, readAuthorizationParams, serveDiscoveryDocument, validateAuthorizationRequest, } from "./oauth-http.js";
+export { findServedResourceOrigin, readRequestHost, readRequestOrigin } from "../origins.js";
+export { resolveMcpOrigins } from "./origins.js";
+export { describeRedirectUri, isAllowedRedirectUri, MAX_CLIENT_NAME_LENGTH, parseClientRegistration } from "./oauth-validation.js";
+export { getCodeChallenge, isPkceVerifierValid, isValidCodeChallenge, PKCE_METHOD } from "./pkce.js";
 export { getMcpAccessMessages, getMcpAccessOptions, getMcpAccessRoutes, getMcpEndpointUrl } from "./options.js";
 export { deleteMcpAccessUserData, exportMcpAccessUserData, mcpAccessPrivacyContributor, } from "./privacy.js";
 export { ACCESS_TOKEN_PREFIX, hashAccessToken, isAccessTokenShape, issueAccessToken, listAccessTokens, pruneAccessTokens, revokeAccessToken, verifyAccessToken, } from "./tokens.js";

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,+FAA+F;AAC/F,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,EACd,eAAe,GAIhB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAwB,MAAM,cAAc,CAAC;AACtI,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,2BAA2B,GAE5B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,GAOlB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,+FAA+F;AAC/F,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,EACd,eAAe,GAIhB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,yBAAyB,EACzB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,gBAAgB,GASjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,kCAAkC,EAClC,mBAAmB,EACnB,8BAA8B,EAC9B,cAAc,EACd,cAAc,EACd,4BAA4B,EAC5B,+BAA+B,EAC/B,gCAAgC,EAChC,2BAA2B,EAC3B,wBAAwB,EACxB,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,qBAAqB,EACrB,2BAA2B,EAC3B,YAAY,EACZ,gCAAgC,EAChC,uBAAuB,EACvB,sBAAsB,EACtB,4BAA4B,GAK7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,iBAAiB,EAA0C,MAAM,eAAe,CAAC;AACrI,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,uBAAuB,EAAyD,MAAM,uBAAuB,CAAC;AAC1L,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACrG,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAwB,MAAM,cAAc,CAAC;AACtI,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,2BAA2B,GAE5B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,GAOlB,MAAM,aAAa,CAAC"}

package/dist/server/oauth-http.d.ts

@@ -0,0 +1,127 @@
+import { type SoftureConfig } from "@softure-ai/core";
+import { type McpOriginRequest, type McpOrigins } from "../origins.js";
+import type { OAuthClientRow } from "../schema.js";
+import type { McpAccessContext } from "./tokens.js";
+/** The security bucket OAuth registration and token requests count in. */
+export declare const MCP_OAUTH_RATE_LIMIT_BUCKET = "mcp-oauth";
+/** RFC 8414 §3: the authorization server metadata, at the root of the issuer. */
+export declare const AUTHORIZATION_SERVER_METADATA_PATH = "/.well-known/oauth-authorization-server";
+/** RFC 9728 §3: protected resource metadata; the endpoint's own variant appends its path. */
+export declare const PROTECTED_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource";
+export declare const OAUTH_SCOPES: readonly ["mcp:read", "mcp:write"];
+/** The parameters the consent form carries to the decision in hidden fields. */
+export declare const AUTHORIZATION_PARAMS: readonly ["response_type", "client_id", "redirect_uri", "state", "code_challenge", "code_challenge_method", "scope", "resource"];
+/** `OPTIONS` on the registration, token and discovery routes. */
+export declare function answerOAuthPreflight(): Response;
+/**
+ * The issuer: the app's origin, without a path or a trailing slash. `origins` are the request's
+ * (`resolveMcpOrigins`); without them, the configured `appOrigin`.
+ */
+export declare function getOAuthIssuer(config: SoftureConfig, origins?: McpOrigins): string;
+/** The URL the endpoint's `401` names in `resource_metadata` (RFC 9728 §5.1). */
+export declare function getProtectedResourceMetadataUrl(config: SoftureConfig, origins?: McpOrigins): string;
+/** Whether the app turned OAuth on; the OAuth routes answer 404 otherwise. */
+export declare function isOAuthEnabled(config: SoftureConfig): boolean;
+/**
+ * Authorization server metadata (RFC 8414 §2), with the app's `oauth.metadata.authorizationServer`
+ * keys added; generated keys win. Tokens are opaque: no OpenID.
+ */
+export declare function getAuthorizationServerMetadata(config: SoftureConfig, origins?: McpOrigins): {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    registration_endpoint: string;
+    scopes_supported: ("mcp:read" | "mcp:write")[];
+    response_types_supported: string[];
+    response_modes_supported: string[];
+    grant_types_supported: string[];
+    token_endpoint_auth_methods_supported: string[];
+    code_challenge_methods_supported: string[];
+    authorization_response_iss_parameter_supported: boolean;
+};
+/**
+ * Protected resource metadata (RFC 9728 §2), with the app's `oauth.metadata.protectedResource`
+ * keys added; generated keys win, except the app's `resource_name`. At the endpoint's own path the
+ * resource is the endpoint URL; at the root it is the origin the document was asked on
+ * (`servedOrigin`, one of `resourceOrigins`) or else the app origin, because RFC 9728 §3.3 ties
+ * `resource` to the URL the metadata URL was built from.
+ */
+export declare function getProtectedResourceMetadata(config: SoftureConfig, variant: "endpoint" | "root", origins?: McpOrigins, servedOrigin?: string | null): {
+    resource: string;
+    authorization_servers: string[];
+    scopes_supported: ("mcp:read" | "mcp:write")[];
+    bearer_methods_supported: string[];
+    resource_name: string;
+};
+/** Builds a discovery document for the request's origins; the request is null outside a route. */
+export type DiscoveryDocument = (config: SoftureConfig, origins: McpOrigins, request: McpOriginRequest | null) => unknown;
+/** `GET` of a discovery document for `request` (its origins); 404 while OAuth is off. */
+export declare function serveDiscoveryDocument(config: SoftureConfig, document: DiscoveryDocument, request?: McpOriginRequest | null): Response;
+/** `serveDiscoveryDocument`'s builder for the root protected resource metadata, on the host it was asked on. */
+export declare const getRootProtectedResourceMetadata: DiscoveryDocument;
+/**
+ * Whether `resource` (RFC 8707) names this server: absent (clients from before RFC 8707), the
+ * endpoint URL, the app origin or one of `resourceOrigins`, each with or without a trailing slash.
+ */
+export declare function isAcceptableResource(config: SoftureConfig, resource: string | null, origins?: McpOrigins): boolean;
+/** Whether the client asks to write. Unknown scopes are ignored (RFC 6749 §3.3); every grant reads. */
+export declare function isWriteScopeRequested(scope: string | null): boolean;
+/**
+ * `POST` dynamic client registration (RFC 7591). Public by definition: claude.ai and ChatGPT
+ * register before anyone signs in. A registration grants nothing; access needs a person's consent.
+ */
+export declare function handleClientRegistration(ctx: McpAccessContext, request: Request): Promise<Response>;
+/**
+ * `POST` token endpoint (RFC 6749 §3.2): a code with its PKCE verifier, or a refresh token with
+ * rotation. Secrets come in the body, never in the URL.
+ */
+export declare function handleTokenRequest(ctx: McpAccessContext, request: Request): Promise<Response>;
+export interface AuthorizationRequest {
+    readonly client: OAuthClientRow;
+    readonly redirectUri: string;
+    readonly state: string | null;
+    readonly codeChallenge: string;
+    /** The client asked for `mcp:write`. */
+    readonly isWriteRequested: boolean;
+}
+/** Why the consent page shows an error instead of sending one back: the client is not confirmed. */
+export type AuthorizationPageError = "unknown_client" | "redirect_mismatch";
+export type AuthorizationOutcome = {
+    readonly kind: "show-error";
+    readonly reason: AuthorizationPageError;
+} | {
+    readonly kind: "redirect-error";
+    readonly location: string;
+    readonly redirectUri: string;
+} | {
+    readonly kind: "valid";
+    readonly request: AuthorizationRequest;
+};
+/**
+ * The client's redirect URI with parameters added, keeping the query it registered (RFC 6749
+ * §3.1.2), and always `iss` (RFC 9207), so the client knows the answer came from this server.
+ */
+export declare function buildClientRedirect(config: SoftureConfig, redirectUri: string, params: Readonly<Record<string, string | null>>, origins?: McpOrigins): string;
+/** The authorization parameters of a query string or form, each at most 2048 characters. */
+export declare function readAuthorizationParams(source: {
+    get(name: string): unknown;
+}): URLSearchParams;
+/**
+ * Validates an authorization request (RFC 6749 §4.1.1), for the consent page and the decision.
+ * Order is a security rule (RFC 6749 §4.1.2.1): until the client and its redirect URI are
+ * confirmed, an error is shown to the person, never redirected, or the server would redirect
+ * anyone anywhere. Only then do errors go back to the client. `origins` are the request's
+ * (the consent page's and the decision's must agree); without them, the configured ones.
+ */
+export declare function validateAuthorizationRequest(ctx: McpAccessContext, params: URLSearchParams, origins?: McpOrigins): Promise<AuthorizationOutcome>;
+/** The consent page with the request's parameters: where the decision sends the person back. */
+export declare function getConsentPath(config: SoftureConfig, params: URLSearchParams): string;
+/**
+ * `POST` of the consent form, answered with `303`: a plain form post, not a server action, because
+ * the answer is a redirect to the client, possibly a native app scheme, and must work without
+ * JavaScript. The form must come from the app's origin (the session cookie's `SameSite=Lax` is the
+ * first layer), and the request is validated again from the posted fields. `userId` is the
+ * session's user, or null: then the person goes back to the consent page, which asks them to sign in.
+ */
+export declare function handleAuthorizationDecision(ctx: McpAccessContext, request: Request, userId: string | null): Promise<Response>;
+//# sourceMappingURL=oauth-http.d.ts.map

package/dist/server/oauth-http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-http.d.ts","sourceRoot":"","sources":["../../src/server/oauth-http.ts"],"names":[],"mappings":"AAKA,OAAO,EAA4B,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGhF,OAAO,EAA4B,KAAK,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AACjG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAenD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,0EAA0E;AAC1E,eAAO,MAAM,2BAA2B,cAAc,CAAC;AAEvD,iFAAiF;AACjF,eAAO,MAAM,kCAAkC,4CAA4C,CAAC;AAC5F,6FAA6F;AAC7F,eAAO,MAAM,gCAAgC,0CAA0C,CAAC;AAExF,eAAO,MAAM,YAAY,oCAA6C,CAAC;AAEvE,gFAAgF;AAChF,eAAO,MAAM,oBAAoB,kIAAmI,CAAC;AA4BrK,iEAAiE;AACjE,wBAAgB,oBAAoB,IAAI,QAAQ,CAE/C;AAKD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,GAAE,UAAsC,GAAG,MAAM,CAE7G;AAED,iFAAiF;AACjF,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,GAAE,UAAsC,GAAG,MAAM,CAE9H;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAE7D;AAQD;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,GAAE,UAAsC;;;;;;;;;;;;EAkBpH;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE,UAAU,GAAG,MAAM,EAC5B,OAAO,GAAE,UAAsC,EAC/C,YAAY,GAAE,MAAM,GAAG,IAAW;;;;;;EAWnC;AAED,kGAAkG;AAClG,MAAM,MAAM,iBAAiB,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,GAAG,IAAI,KAAK,OAAO,CAAC;AAE1H,yFAAyF;AACzF,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,iBAAiB,EAAE,OAAO,GAAE,gBAAgB,GAAG,IAAW,GAAG,QAAQ,CAG5I;AAED,gHAAgH;AAChH,eAAO,MAAM,gCAAgC,EAAE,iBAC8E,CAAC;AAE9H;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,GAAE,UAAsC,GAAG,OAAO,CAI7I;AAED,uGAAuG;AACvG,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAEnE;AAuCD;;;GAGG;AACH,wBAAsB,wBAAwB,CAAC,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAiCzG;AA2CD;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAkBnG;AAmCD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,wCAAwC;IACxC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACpC;AAED,oGAAoG;AACpG,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,GAAG,mBAAmB,CAAC;AAE5E,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,GACxE;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC5F;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAEvE;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,aAAa,EACrB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,EAC/C,OAAO,GAAE,UAAsC,GAC9C,MAAM,CAMR;AAED,4FAA4F;AAC5F,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,GAAG,eAAe,CAO/F;AAED;;;;;;GAMG;AACH,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,gBAAgB,EACrB,MAAM,EAAE,eAAe,EACvB,OAAO,GAAE,UAA0C,GAClD,OAAO,CAAC,oBAAoB,CAAC,CAqB/B;AAED,gGAAgG;AAChG,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,GAAG,MAAM,CAErF;AAYD;;;;;;GAMG;AACH,wBAAsB,2BAA2B,CAAC,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,CAgCnI"}

package/dist/server/oauth-http.js

@@ -0,0 +1,397 @@
+// The OAuth 2.1 authorization server's HTTP layer: discovery metadata (RFC 8414, RFC 9728),
+// dynamic client registration (RFC 7591), the authorization request and the consent decision
+// (RFC 6749 §4.1, PKCE, RFC 9207 `iss`), and the token endpoint with rotated refresh tokens. Each
+// handler takes a Web `Request` and returns a `Response`, so any fetch-shaped host can mount it;
+// the Next adapter only supplies the context and the session.
+import { errorLogLabel, getModule } from "@softure-ai/core";
+import { consumeRateLimit, identifyClient } from "@softure-ai/security/server";
+import { findServedResourceOrigin } from "../origins.js";
+import { MCP_READ_SCOPE, MCP_WRITE_SCOPE } from "./scopes.js";
+import { createAuthorizationCode, exchangeAuthorizationCode, findOAuthClient, isClientSecretValid, refreshMcpGrant, registerMcpClient, } from "./oauth.js";
+import { parseClientRegistration } from "./oauth-validation.js";
+import { getMcpAccessOptions, getMcpAccessRoutes, getMcpEndpointUrl } from "./options.js";
+import { resolveMcpOrigins } from "./origins.js";
+import { isValidCodeChallenge, PKCE_METHOD } from "./pkce.js";
+/** The security bucket OAuth registration and token requests count in. */
+export const MCP_OAUTH_RATE_LIMIT_BUCKET = "mcp-oauth";
+/** RFC 8414 §3: the authorization server metadata, at the root of the issuer. */
+export const AUTHORIZATION_SERVER_METADATA_PATH = "/.well-known/oauth-authorization-server";
+/** RFC 9728 §3: protected resource metadata; the endpoint's own variant appends its path. */
+export const PROTECTED_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource";
+export const OAUTH_SCOPES = [MCP_READ_SCOPE, MCP_WRITE_SCOPE];
+/** The parameters the consent form carries to the decision in hidden fields. */
+export const AUTHORIZATION_PARAMS = ["response_type", "client_id", "redirect_uri", "state", "code_challenge", "code_challenge_method", "scope", "resource"];
+/** Values longer than this are not echoed into a form or a redirect. */
+const MAX_PARAM_LENGTH = 2048;
+/**
+ * CORS `*` is safe on these routes because none reads a cookie: registration and token
+ * authenticate the client by what it sent. A browser-based MCP client cannot sign in without it.
+ */
+const CORS_HEADERS = {
+    "access-control-allow-origin": "*",
+    "access-control-allow-methods": "GET, POST, OPTIONS",
+    "access-control-allow-headers": "authorization, content-type, mcp-protocol-version",
+};
+/** Responses that carry credentials must not be stored (RFC 6749 §5.1). */
+const NO_STORE = { "cache-control": "no-store", pragma: "no-cache" };
+/** Discovery documents change only with a deploy, and with the host they were asked on. */
+const DISCOVERY_CACHE = { "cache-control": "public, max-age=300", vary: "host, x-forwarded-proto" };
+function protocolJson(body, status = 200, extra = {}) {
+    return Response.json(body, { status, headers: { ...CORS_HEADERS, ...NO_STORE, ...extra } });
+}
+/** An error in the shape of RFC 6749 §5.2 / RFC 7591 §3.2.2. */
+function protocolError(error, description, status = 400, extra = {}) {
+    return protocolJson({ error, error_description: description }, status, extra);
+}
+/** `OPTIONS` on the registration, token and discovery routes. */
+export function answerOAuthPreflight() {
+    return new Response(null, { status: 204, headers: CORS_HEADERS });
+}
+// ---------------------------------------------------------------------------------------------
+// Discovery
+/**
+ * The issuer: the app's origin, without a path or a trailing slash. `origins` are the request's
+ * (`resolveMcpOrigins`); without them, the configured `appOrigin`.
+ */
+export function getOAuthIssuer(config, origins = resolveMcpOrigins(config)) {
+    return origins.appOrigin;
+}
+/** The URL the endpoint's `401` names in `resource_metadata` (RFC 9728 §5.1). */
+export function getProtectedResourceMetadataUrl(config, origins = resolveMcpOrigins(config)) {
+    return `${getOAuthIssuer(config, origins)}${PROTECTED_RESOURCE_METADATA_PATH}${new URL(getMcpEndpointUrl(config, origins)).pathname}`;
+}
+/** Whether the app turned OAuth on; the OAuth routes answer 404 otherwise. */
+export function isOAuthEnabled(config) {
+    return getMcpAccessOptions(config).oauth.enabled;
+}
+/** The app's extra keys under the generated ones (`oauth.metadata`). */
+function readExtension(extension, origins) {
+    if (extension === undefined)
+        return {};
+    return typeof extension === "function" ? extension(origins) : extension;
+}
+/**
+ * Authorization server metadata (RFC 8414 §2), with the app's `oauth.metadata.authorizationServer`
+ * keys added; generated keys win. Tokens are opaque: no OpenID.
+ */
+export function getAuthorizationServerMetadata(config, origins = resolveMcpOrigins(config)) {
+    const issuer = getOAuthIssuer(config, origins);
+    const routes = getMcpAccessRoutes(config);
+    return {
+        ...readExtension(getMcpAccessOptions(config).oauth.metadata.authorizationServer, origins),
+        issuer,
+        authorization_endpoint: `${issuer}${routes.oauthConsent}`,
+        token_endpoint: `${issuer}${routes.oauthToken}`,
+        registration_endpoint: `${issuer}${routes.oauthRegister}`,
+        scopes_supported: [...OAUTH_SCOPES],
+        response_types_supported: ["code"],
+        response_modes_supported: ["query"],
+        grant_types_supported: ["authorization_code", "refresh_token"],
+        token_endpoint_auth_methods_supported: ["none", "client_secret_post", "client_secret_basic"],
+        // MCP clients refuse an authorization server that does not list S256.
+        code_challenge_methods_supported: [PKCE_METHOD],
+        authorization_response_iss_parameter_supported: true,
+    };
+}
+/**
+ * Protected resource metadata (RFC 9728 §2), with the app's `oauth.metadata.protectedResource`
+ * keys added; generated keys win, except the app's `resource_name`. At the endpoint's own path the
+ * resource is the endpoint URL; at the root it is the origin the document was asked on
+ * (`servedOrigin`, one of `resourceOrigins`) or else the app origin, because RFC 9728 §3.3 ties
+ * `resource` to the URL the metadata URL was built from.
+ */
+export function getProtectedResourceMetadata(config, variant, origins = resolveMcpOrigins(config), servedOrigin = null) {
+    const issuer = getOAuthIssuer(config, origins);
+    return {
+        resource_name: getMcpAccessOptions(config).serverName,
+        ...readExtension(getMcpAccessOptions(config).oauth.metadata.protectedResource, origins),
+        resource: variant === "endpoint" ? getMcpEndpointUrl(config, origins) : (servedOrigin ?? issuer),
+        authorization_servers: [issuer],
+        scopes_supported: [...OAUTH_SCOPES],
+        bearer_methods_supported: ["header"],
+    };
+}
+/** `GET` of a discovery document for `request` (its origins); 404 while OAuth is off. */
+export function serveDiscoveryDocument(config, document, request = null) {
+    if (!isOAuthEnabled(config))
+        return Response.json({ error: "not_found" }, { status: 404, headers: CORS_HEADERS });
+    return Response.json(document(config, resolveMcpOrigins(config, request), request), { headers: { ...CORS_HEADERS, ...DISCOVERY_CACHE } });
+}
+/** `serveDiscoveryDocument`'s builder for the root protected resource metadata, on the host it was asked on. */
+export const getRootProtectedResourceMetadata = (config, origins, request) => getProtectedResourceMetadata(config, "root", origins, request === null ? null : findServedResourceOrigin(origins, request));
+/**
+ * Whether `resource` (RFC 8707) names this server: absent (clients from before RFC 8707), the
+ * endpoint URL, the app origin or one of `resourceOrigins`, each with or without a trailing slash.
+ */
+export function isAcceptableResource(config, resource, origins = resolveMcpOrigins(config)) {
+    if (resource === null || resource === "")
+        return true;
+    const endpoint = getMcpEndpointUrl(config, origins).replace(/\/+$/, "");
+    return [endpoint, getOAuthIssuer(config, origins), ...origins.resourceOrigins].some((accepted) => resource === accepted || resource === `${accepted}/`);
+}
+/** Whether the client asks to write. Unknown scopes are ignored (RFC 6749 §3.3); every grant reads. */
+export function isWriteScopeRequested(scope) {
+    return (scope ?? "").split(/\s+/).includes(MCP_WRITE_SCOPE);
+}
+// ---------------------------------------------------------------------------------------------
+// Rate limit
+/** A missing bucket is a setup bug: thrown, so it reaches the log by name instead of a quiet 503. */
+function assertOAuthRateLimitBucket(config) {
+    const options = getModule(config, "security")?.options;
+    if (options?.buckets?.[MCP_OAUTH_RATE_LIMIT_BUCKET] === undefined) {
+        throw new Error(`@softure-ai/mcp-access: the security module has no "${MCP_OAUTH_RATE_LIMIT_BUCKET}" bucket; spread MCP_RATE_LIMIT_BUCKETS into security({ buckets })`);
+    }
+}
+/**
+ * Counts the request in the OAuth bucket before any work: per client address, and for the token
+ * endpoint per address and client id (an assistant platform refreshes the tokens of all its users
+ * from a few shared addresses, and each connection registers its own client). A failing counter
+ * closes (503) and says nothing.
+ */
+async function limitProtocolRequest(ctx, request, clientId = null) {
+    assertOAuthRateLimitBucket(ctx.config);
+    const client = identifyClient(ctx, request.headers);
+    if (!client.ok)
+        return protocolError("invalid_request", "The client address could not be identified.", 400);
+    const key = clientId === null ? client.value : `${client.value}|${clientId.slice(0, 64)}`;
+    try {
+        const limit = await consumeRateLimit(ctx, { bucket: MCP_OAUTH_RATE_LIMIT_BUCKET, key });
+        if (limit.ok)
+            return null;
+        return protocolError("too_many_requests", "Too many requests; try again later.", 429, { "retry-after": String(limit.retryAfterSeconds) });
+    }
+    catch (error) {
+        console.error(`@softure-ai/mcp-access: counting an OAuth request failed: ${errorLogLabel(error)}`);
+        return protocolError("temporarily_unavailable", "The server is temporarily unavailable.", 503);
+    }
+}
+// ---------------------------------------------------------------------------------------------
+// Registration
+/**
+ * `POST` dynamic client registration (RFC 7591). Public by definition: claude.ai and ChatGPT
+ * register before anyone signs in. A registration grants nothing; access needs a person's consent.
+ */
+export async function handleClientRegistration(ctx, request) {
+    if (!isOAuthEnabled(ctx.config))
+        return protocolError("not_found", "OAuth is not enabled.", 404);
+    const limited = await limitProtocolRequest(ctx, request);
+    if (limited !== null)
+        return limited;
+    let body;
+    try {
+        body = await request.json();
+    }
+    catch {
+        return protocolError("invalid_client_metadata", "The request body must be a JSON object.");
+    }
+    const parsed = parseClientRegistration(body);
+    if (!parsed.ok)
+        return protocolError(parsed.error.error, parsed.error.description);
+    try {
+        const { client, clientSecret } = await registerMcpClient(ctx, parsed.value);
+        return protocolJson({
+            client_id: client.clientId,
+            client_id_issued_at: Math.floor(client.createdAt.getTime() / 1000),
+            client_name: client.clientName,
+            redirect_uris: client.redirectUris,
+            token_endpoint_auth_method: client.tokenEndpointAuthMethod,
+            grant_types: ["authorization_code", "refresh_token"],
+            response_types: ["code"],
+            ...(clientSecret === null ? {} : { client_secret: clientSecret, client_secret_expires_at: 0 }),
+        }, 201);
+    }
+    catch (error) {
+        console.error(`@softure-ai/mcp-access: registering an OAuth client failed: ${errorLogLabel(error)}`);
+        return protocolError("server_error", "The client could not be registered.", 500);
+    }
+}
+/** `Basic` (RFC 6749 §2.3.1: both parts form-urlencoded) or the body fields; a public client sends its id only. */
+function readClientCredentials(request, form) {
+    const header = request.headers.get("authorization");
+    if (header?.toLowerCase().startsWith("basic ") === true) {
+        try {
+            const decoded = Buffer.from(header.slice(6).trim(), "base64").toString("utf8");
+            const separator = decoded.indexOf(":");
+            if (separator > 0) {
+                const decode = (part) => decodeURIComponent(part.replace(/\+/g, " "));
+                return { clientId: decode(decoded.slice(0, separator)), clientSecret: decode(decoded.slice(separator + 1)), isBasic: true };
+            }
+        }
+        catch {
+            // A broken header is no credentials; the caller refuses.
+        }
+        return { clientId: null, clientSecret: null, isBasic: true };
+    }
+    return { clientId: form.get("client_id"), clientSecret: form.get("client_secret"), isBasic: false };
+}
+function tokenResponse(tokens) {
+    return protocolJson({
+        access_token: tokens.accessToken,
+        token_type: "Bearer",
+        expires_in: tokens.expiresIn,
+        refresh_token: tokens.refreshToken,
+        scope: tokens.canWrite ? `${MCP_READ_SCOPE} ${MCP_WRITE_SCOPE}` : MCP_READ_SCOPE,
+    });
+}
+/** One answer for every refused code or refresh token: the client restarts either way. */
+const INVALID_GRANT = "The code or refresh token is invalid, expired, used or issued to another client.";
+/**
+ * `POST` token endpoint (RFC 6749 §3.2): a code with its PKCE verifier, or a refresh token with
+ * rotation. Secrets come in the body, never in the URL.
+ */
+export async function handleTokenRequest(ctx, request) {
+    if (!isOAuthEnabled(ctx.config))
+        return protocolError("not_found", "OAuth is not enabled.", 404);
+    const origins = resolveMcpOrigins(ctx.config, request);
+    const form = new URLSearchParams(await request.text().catch(() => ""));
+    const credentials = readClientCredentials(request, form);
+    const limited = await limitProtocolRequest(ctx, request, credentials.clientId);
+    if (limited !== null)
+        return limited;
+    try {
+        const client = credentials.clientId === null ? null : await findOAuthClient(ctx, credentials.clientId);
+        if (client === null || !isClientSecretValid(client, credentials.clientSecret === "" ? null : credentials.clientSecret)) {
+            return protocolError("invalid_client", "Unknown client or wrong client credentials.", 401, credentials.isBasic ? { "www-authenticate": 'Basic realm="mcp"' } : {});
+        }
+        return await answerGrant(ctx, { form, client, origins });
+    }
+    catch (error) {
+        console.error(`@softure-ai/mcp-access: the OAuth token endpoint failed: ${errorLogLabel(error)}`);
+        return protocolError("server_error", "The token could not be issued.", 500);
+    }
+}
+async function answerGrant(ctx, { form, client, origins }) {
+    if (!isAcceptableResource(ctx.config, form.get("resource"), origins)) {
+        return protocolError("invalid_target", "The resource parameter does not name this MCP server.");
+    }
+    const grantType = form.get("grant_type");
+    if (grantType === "authorization_code") {
+        const code = form.get("code");
+        const codeVerifier = form.get("code_verifier");
+        if (code === null || code === "" || codeVerifier === null || codeVerifier === "") {
+            return protocolError("invalid_request", "code and code_verifier (PKCE) are required.");
+        }
+        // A missing redirect_uri is allowed when the client registered exactly one (RFC 6749 §4.1.3).
+        const tokens = await exchangeAuthorizationCode(ctx, { code, client, redirectUri: form.get("redirect_uri"), codeVerifier });
+        return tokens === null ? protocolError("invalid_grant", INVALID_GRANT) : tokenResponse(tokens);
+    }
+    if (grantType === "refresh_token") {
+        const refreshToken = form.get("refresh_token");
+        if (refreshToken === null || refreshToken === "")
+            return protocolError("invalid_request", "refresh_token is required.");
+        const tokens = await refreshMcpGrant(ctx, { refreshToken, client });
+        return tokens === null ? protocolError("invalid_grant", INVALID_GRANT) : tokenResponse(tokens);
+    }
+    return protocolError("unsupported_grant_type", "Supported grant types: authorization_code and refresh_token.");
+}
+/**
+ * The client's redirect URI with parameters added, keeping the query it registered (RFC 6749
+ * §3.1.2), and always `iss` (RFC 9207), so the client knows the answer came from this server.
+ */
+export function buildClientRedirect(config, redirectUri, params, origins = resolveMcpOrigins(config)) {
+    const url = new URL(redirectUri);
+    for (const [key, value] of Object.entries({ ...params, iss: getOAuthIssuer(config, origins) })) {
+        if (value !== null)
+            url.searchParams.set(key, value);
+    }
+    return url.toString();
+}
+/** The authorization parameters of a query string or form, each at most 2048 characters. */
+export function readAuthorizationParams(source) {
+    const params = new URLSearchParams();
+    for (const name of AUTHORIZATION_PARAMS) {
+        const value = source.get(name);
+        if (typeof value === "string" && value.length <= MAX_PARAM_LENGTH)
+            params.set(name, value);
+    }
+    return params;
+}
+/**
+ * Validates an authorization request (RFC 6749 §4.1.1), for the consent page and the decision.
+ * Order is a security rule (RFC 6749 §4.1.2.1): until the client and its redirect URI are
+ * confirmed, an error is shown to the person, never redirected, or the server would redirect
+ * anyone anywhere. Only then do errors go back to the client. `origins` are the request's
+ * (the consent page's and the decision's must agree); without them, the configured ones.
+ */
+export async function validateAuthorizationRequest(ctx, params, origins = resolveMcpOrigins(ctx.config)) {
+    const clientId = params.get("client_id");
+    const client = clientId === null ? null : await findOAuthClient(ctx, clientId);
+    if (client === null)
+        return { kind: "show-error", reason: "unknown_client" };
+    const redirectUri = params.get("redirect_uri") ?? (client.redirectUris.length === 1 ? (client.redirectUris[0] ?? null) : null);
+    if (redirectUri === null || !client.redirectUris.includes(redirectUri))
+        return { kind: "show-error", reason: "redirect_mismatch" };
+    const state = params.get("state");
+    const back = (error, description) => ({
+        kind: "redirect-error",
+        redirectUri,
+        location: buildClientRedirect(ctx.config, redirectUri, { error, error_description: description, state }, origins),
+    });
+    if (params.get("response_type") !== "code")
+        return back("unsupported_response_type", "Only response_type=code is supported.");
+    const codeChallenge = params.get("code_challenge");
+    if (codeChallenge === null || !isValidCodeChallenge(codeChallenge) || params.get("code_challenge_method") !== PKCE_METHOD) {
+        return back("invalid_request", "PKCE is required: code_challenge with code_challenge_method S256.");
+    }
+    if (!isAcceptableResource(ctx.config, params.get("resource"), origins))
+        return back("invalid_target", "The resource parameter does not name this MCP server.");
+    return { kind: "valid", request: { client, redirectUri, state, codeChallenge, isWriteRequested: isWriteScopeRequested(params.get("scope")) } };
+}
+/** The consent page with the request's parameters: where the decision sends the person back. */
+export function getConsentPath(config, params) {
+    return `${getMcpAccessRoutes(config).oauthConsent}?${params.toString()}`;
+}
+function seeOther(location) {
+    return new Response(null, { status: 303, headers: { location, "cache-control": "no-store" } });
+}
+/** Whether the form was posted from this app: `Origin` must be the request's app origin. */
+function isSameOrigin(request, origins) {
+    const origin = request.headers.get("origin");
+    return origin !== null && origin === origins.appOrigin;
+}
+/**
+ * `POST` of the consent form, answered with `303`: a plain form post, not a server action, because
+ * the answer is a redirect to the client, possibly a native app scheme, and must work without
+ * JavaScript. The form must come from the app's origin (the session cookie's `SameSite=Lax` is the
+ * first layer), and the request is validated again from the posted fields. `userId` is the
+ * session's user, or null: then the person goes back to the consent page, which asks them to sign in.
+ */
+export async function handleAuthorizationDecision(ctx, request, userId) {
+    if (!isOAuthEnabled(ctx.config))
+        return new Response(null, { status: 404 });
+    const origins = resolveMcpOrigins(ctx.config, request);
+    if (!isSameOrigin(request, origins))
+        return new Response(null, { status: 403, headers: { "cache-control": "no-store" } });
+    const form = await request.formData().catch(() => null);
+    if (form === null)
+        return new Response(null, { status: 400, headers: { "cache-control": "no-store" } });
+    const params = readAuthorizationParams(form);
+    const consent = getConsentPath(ctx.config, params);
+    if (userId === null)
+        return seeOther(consent);
+    try {
+        const outcome = await validateAuthorizationRequest(ctx, params, origins);
+        if (outcome.kind === "show-error")
+            return seeOther(consent);
+        if (outcome.kind === "redirect-error")
+            return seeOther(outcome.location);
+        const { client, redirectUri, state, codeChallenge, isWriteRequested } = outcome.request;
+        if (form.get("decision") !== "allow") {
+            return seeOther(buildClientRedirect(ctx.config, redirectUri, { error: "access_denied", error_description: "The person denied access.", state }, origins));
+        }
+        const code = await createAuthorizationCode(ctx, {
+            clientRowId: client.id,
+            userId,
+            redirectUri,
+            codeChallenge,
+            // Writes need the client's request, the app's allowWrites and the person's tick.
+            canWrite: isWriteRequested && getMcpAccessOptions(ctx.config).allowWrites && form.get("canWrite") !== null,
+        });
+        return seeOther(buildClientRedirect(ctx.config, redirectUri, { code, state }, origins));
+    }
+    catch (error) {
+        console.error(`@softure-ai/mcp-access: recording an OAuth decision failed: ${errorLogLabel(error)}`);
+        return new Response(null, { status: 500, headers: { "cache-control": "no-store" } });
+    }
+}
+//# sourceMappingURL=oauth-http.js.map