@softure-ai/mcp-access 0.2.1 → 0.2.3

package/src/server/oauth-http.ts

@@ -22,6 +22,7 @@ import {
 import { parseClientRegistration } from "./oauth-validation.js";
 import { getMcpAccessOptions, getMcpAccessRoutes, getMcpEndpointUrl } from "./options.js";
 import { resolveMcpOrigins } from "./origins.js";
+import { isClientRegistrationOpen } from "./registration-window.js";
 import { isValidCodeChallenge, PKCE_METHOD } from "./pkce.js";
 import type { McpAccessContext } from "./tokens.js";
 
@@ -172,6 +173,15 @@ export function isWriteScopeRequested(scope: string | null): boolean {
   return (scope ?? "").split(/\s+/).includes(MCP_WRITE_SCOPE);
 }
 
+/**
+ * Whether the request asks to write, where a missing or blank `scope` is the server's default
+ * (RFC 6749 §3.3): both scopes while the app allows writes, `mcp:read` otherwise.
+ */
+function isWriteRequestedOrDefault(config: SoftureConfig, scope: string | null): boolean {
+  if (scope === null || scope.trim() === "") return getMcpAccessOptions(config).allowWrites;
+  return isWriteScopeRequested(scope);
+}
+
 // ---------------------------------------------------------------------------------------------
 // Rate limit
 
@@ -221,14 +231,29 @@ function bodyTooLarge(config: SoftureConfig): Response {
 // ---------------------------------------------------------------------------------------------
 // Registration
 
+/** The answer while registration is closed, or null when it is open. A failing read closes (503). */
+async function refuseClosedRegistration(ctx: McpAccessContext): Promise<Response | null> {
+  try {
+    if (await isClientRegistrationOpen(ctx)) return null;
+  } catch (error) {
+    console.error(`@softure-ai/mcp-access: reading the client registration window failed: ${errorLogLabel(error)}`);
+    return protocolError("temporarily_unavailable", "The server is temporarily unavailable.", 503);
+  }
+  return protocolError("access_denied", "Client registration is closed.", 403);
+}
+
 /**
  * `POST` dynamic client registration (RFC 7591). Public by definition: claude.ai and ChatGPT
  * register before anyone signs in. A registration grants nothing; access needs a person's consent.
+ * With `oauth.registration: "closed"` it answers `403 access_denied` outside the window the
+ * `open-client-registration` ops script opens; the request still counts in the rate limit.
  */
 export async function handleClientRegistration(ctx: McpAccessContext, request: Request): Promise<Response> {
   if (!isOAuthEnabled(ctx.config)) return protocolError("not_found", "OAuth is not enabled.", 404);
   const limited = await limitProtocolRequest(ctx, request);
   if (limited !== null) return limited;
+  const closed = await refuseClosedRegistration(ctx);
+  if (closed !== null) return closed;
 
   const notJson = () => protocolError("invalid_client_metadata", "The request body must be a JSON object.");
   const text = await readCappedBody(ctx.config, request);
@@ -442,7 +467,7 @@ export async function validateAuthorizationRequest(
     return back("invalid_request", "PKCE is required: code_challenge with code_challenge_method S256.");
   }
   if (!isAcceptableResource(ctx.config, params.get("resource"), origins)) return back("invalid_target", "The resource parameter does not name this MCP server.");
-  return { kind: "valid", request: { client, redirectUri, state, codeChallenge, isWriteRequested: isWriteScopeRequested(params.get("scope")) } };
+  return { kind: "valid", request: { client, redirectUri, state, codeChallenge, isWriteRequested: isWriteRequestedOrDefault(ctx.config, params.get("scope")) } };
 }
 
 /** The consent page with the request's parameters: where the decision sends the person back. */

package/src/server/registration-window.ts

@@ -0,0 +1,55 @@
+// The window in which dynamic client registration is open while `oauth.registration` is "closed"
+// (#520): one stored row with its end, written by the `open-client-registration` ops script. Every
+// comparison uses the context's clock, so tests and scripts agree with the route.
+import { oauthRegistrationWindow } from "../schema.js";
+import { getMcpAccessOptions } from "./options.js";
+import type { McpAccessContext } from "./tokens.js";
+
+/** The longest window one call opens: a day. */
+export const MAX_REGISTRATION_WINDOW_MINUTES = 1440;
+
+export interface ClientRegistrationWindow {
+  readonly openedAt: Date;
+  readonly openUntil: Date;
+}
+
+export interface OpenClientRegistrationInput {
+  /** Minutes from now, 1 to 1440. */
+  readonly minutes: number;
+}
+
+/** The stored window, past or not; null when none is stored. */
+export async function findClientRegistrationWindow(ctx: McpAccessContext): Promise<ClientRegistrationWindow | null> {
+  const [row] = await ctx.db
+    .select({ openedAt: oauthRegistrationWindow.openedAt, openUntil: oauthRegistrationWindow.openUntil })
+    .from(oauthRegistrationWindow)
+    .limit(1);
+  return row ?? null;
+}
+
+/** True with `oauth.registration: "open"`; with "closed", only while a stored window has not ended. */
+export async function isClientRegistrationOpen(ctx: McpAccessContext): Promise<boolean> {
+  if (getMcpAccessOptions(ctx.config).oauth.registration === "open") return true;
+  const window = await findClientRegistrationWindow(ctx);
+  return window !== null && window.openUntil.getTime() > ctx.clock.now().getTime();
+}
+
+/** Opens registration for `minutes` from now, replacing any stored window. Throws on minutes outside 1 to 1440: a bug in the caller. */
+export async function openClientRegistration(ctx: McpAccessContext, input: OpenClientRegistrationInput): Promise<ClientRegistrationWindow> {
+  if (!Number.isInteger(input.minutes) || input.minutes < 1 || input.minutes > MAX_REGISTRATION_WINDOW_MINUTES) {
+    throw new Error(`openClientRegistration: minutes must be a whole number from 1 to ${String(MAX_REGISTRATION_WINDOW_MINUTES)}, got ${String(input.minutes)}`);
+  }
+  const openedAt = ctx.clock.now();
+  const openUntil = new Date(openedAt.getTime() + input.minutes * 60_000);
+  await ctx.db
+    .insert(oauthRegistrationWindow)
+    .values({ id: 1, openedAt, openUntil })
+    .onConflictDoUpdate({ target: oauthRegistrationWindow.id, set: { openedAt, openUntil } });
+  return { openedAt, openUntil };
+}
+
+/** Deletes the stored window. True when one was stored, ended or not. */
+export async function closeClientRegistration(ctx: McpAccessContext): Promise<boolean> {
+  const deleted = await ctx.db.delete(oauthRegistrationWindow).returning({ id: oauthRegistrationWindow.id });
+  return deleted.length > 0;
+}