@squadrules/mcp 4.8.6

package/dist/http/http-auth-callback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-auth-callback.js","sourceRoot":"","sources":["../../src/http/http-auth-callback.ts"],"names":[],"mappings":"AAKA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,qBAAqB,EACrB,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,cAAc,EACd,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,EAC3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,8BAA8B,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChG,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,0BAA0B,EAE3B,MAAM,0BAA0B,CAAC;AAElC,MAAM,UAAU,uBAAuB,CAAC,MAKvC;IACC,MAAM,EAAE,MAAM,EAAE,wBAAwB,EAAE,cAAc,EAAE,cAAc,EAAE,GAAG,MAAM,CAAC;IAEpF,MAAM,aAAa,GACjB,cAAc,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,GAAG;QACvE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC;QAC/C,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,MAAM,UAAU,GACd,cAAc,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,MAAM,GAAG,GAAG;QAChF,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;QACxD,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAElC,OAAO,wBAAwB,CAAC;AAClC,CAAC;AAED,SAAS,WAAW,CAClB,OAEC;IAED,MAAM,UAAU,GAAG,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,WAAW,CACrB,IAAI,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,CAAC,CACxF,CAAC;IACF,OAAO,GAAG,UAAU,IAAI,GAAG,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,eAAe,GAAG,sBAAsB,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AAE3F,uGAAuG;AACvG,MAAM,oBAAoB,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAc,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;AAE9G,wHAAwH;AACxH,MAAM,yBAAyB,GAAG,uBAAuB,CAAC;AAE1D,SAAS,sBAAsB,CAAC,IAAa,EAAE,GAAa;IAC1D,IAAI,YAAY,IAAI,0BAA0B,CAAC,GAAG,CAAC,EAAE,CAAC;QACpD,OAAO;IACT,CAAC;IACD,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAoB;IACpD,sDAAsD;IACtD,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QAChD,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,mFAAmF;IACnF,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QACxD,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH;;;OAGG;IACH,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACtD,MAAM,MAAM,GAAG,8BAA8B,CAAC,GAAG,CAAC,CAAC;QACnD,GAAG,CAAC,WAAW,CAAC,mBAAmB,EAAE,oBAAoB,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,sBAAsB,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/D,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,GAAG,IAAI,GAAG,yBAAyB,EAAE,CAAC;YACrD,MAAM,UAAU,GAAG,8BAA8B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAClE,IAAI,UAAU,EAAE,CAAC;gBACf,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;gBAC9B,OAAO;YACT,CAAC;QACH,CAAC;QACD,IAAI,YAAY,IAAI,0BAA0B,CAAC,GAAG,CAAC,EAAE,CAAC;YACpD,OAAO;QACT,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,sBAAsB,CAAC,CAAC;IAE3D,0EAA0E;IAC1E,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,sBAAsB,CAAC,CAAC;IAEpD,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC9D,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,IAAI,CAAC,cAAc,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACjF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,qBAAqB;gBAC5B,OAAO,EAAE,gIAAgI;aAC1I,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,KAA0C,CAAC;QACvE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACpB,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,gBAAgB,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;YACjE,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QACD,MAAM,YAAY,GAAG,CAAC,qBAAqB,IAAI,YAAY,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAChF,MAAM,WAAW,GAAG,GAAG,sBAAsB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC;QACjF,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,kBAAkB;YAC7B,IAAI;YACJ,YAAY,EAAE,WAAW;YACzB,aAAa,EAAE,KAAK,CAAC,YAAY;SAClC,CAAC,CAAC;QACH,IAAI,QAA6B,CAAC;QAClC,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,YAAY,WAAW,cAAc,gCAAgC,EAAE;gBAC/F,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;aACtB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,gBAAgB,CAAC,KAAK,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;YACnE,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,gBAAgB,CAAC,IAAI,CAAC,8BAA8B,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;YAC/G,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAIpC,CAAC;QACF,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAClF,MAAM,WAAW,GAAG,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9F,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;YAC7B,gBAAgB,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;YAChF,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QACD,MAAM,cAAc,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9H,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpE,MAAM,aAAa,GAAG,WAAW,CAAC,CAAC,CAAC,uBAAuB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAChF,IAAI,SAAS,KAAK,IAAI,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YACjD,gBAAgB,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;YACnE,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QACD,MAAM,YAAY,GAAG,0BAA0B,CAAC;YAC9C,SAAS;YACT,aAAa;YACb,aAAa,EAAE,cAAc;SAC9B,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;YACrB,gBAAgB,CAAC,IAAI,CAAC,+BAA+B,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;YAC3E,MAAM,GAAG,GACP,YAAY,CAAC,KAAK,KAAK,gBAAgB,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,mBAAmB,CAAC;YACzF,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,WAAW,GAAG,EAAE,CAAC,CAAC;YACpC,OAAO;QACT,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC;QAChC,MAAM,CAAC,MAAM,GAAG,wBAAwB,CAAC,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC7C,MAAM,cAAc,GAClB,aAAa,IAAI,OAAO,aAAa,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YAChG,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC;YACtB,CAAC,CAAC,IAAI,CAAC;QACX,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;YAC/C,MAAM;YACN,wBAAwB,EAAE,mBAAmB;YAC7C,cAAc;YACd,cAAc;SACf,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,OAAO,EAAE,CAAC;YACjF,gBAAgB,CAAC,IAAI,CACnB,8CAA8C,gBAAgB,mBAAmB,cAAc,IAAI,SAAS,mBAAmB,cAAc,IAAI,SAAS,EAAE,CAC7J,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,GAAG,gBAAgB,CAAC;QACtC,MAAM,cAAc,GAAmE;YACrF,GAAG,MAAM;YACT,GAAG;YACH,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C,CAAC;QACF,MAAM,WAAW,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;QAChD,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE;YAC1B,GAAG,mBAAmB,IAAI,kBAAkB,CAAC,WAAW,CAAC,6CAA6C,gBAAgB,GAAG,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE;SAC7J,CAAC,CAAC;QACH,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/http/http-auth-middleware.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Auth middleware: when AUTH_ENABLED, require session or Bearer for /api and /mcp.
+ * Unauthenticated browser GET -> redirect to Keycloak; otherwise 401 with login_url.
+ * When AUTH_MODE=oidc_bearer, Bearer tokens are validated (issuer, audience, exp); req.auth is set from session or validated Bearer.
+ */
+import type { Request, Response, NextFunction } from 'express';
+import { type AuthPayload } from './bearer-validate.js';
+import { type SpaceContext } from '../utils/tenant-context.js';
+import { setWwwAuthenticate } from './http-www-authenticate.js';
+export { setWwwAuthenticate };
+export type { AuthPayload };
+declare const SESSION_COOKIE_NAME = "kairos_session";
+/**
+ * OIDC id_token from login callback, stored only in the httpOnly session cookie for RP-initiated logout
+ * (id_token_hint → Keycloak can skip the static logged-out confirmation screen when configured).
+ */
+export declare function peekOidcIdTokenHintFromSession(req: Request): string | null;
+declare global {
+    namespace Express {
+        interface Request {
+            auth?: AuthPayload;
+            spaceContext?: SpaceContext;
+            requestId?: string;
+        }
+    }
+}
+export declare function authMiddleware(req: Request, res: Response, next: NextFunction): Promise<void>;
+export { SESSION_COOKIE_NAME };
+//# sourceMappingURL=http-auth-middleware.d.ts.map

package/dist/http/http-auth-middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-auth-middleware.d.ts","sourceRoot":"","sources":["../../src/http/http-auth-middleware.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAoB/D,OAAO,EAAuB,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC7E,OAAO,EAAwC,KAAK,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAErG,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAE9B,YAAY,EAAE,WAAW,EAAE,CAAC;AAK5B,QAAA,MAAM,mBAAmB,mBAAmB,CAAC;AAoD7C;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAO1E;AAqED,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,IAAI,CAAC,EAAE,WAAW,CAAC;YACnB,YAAY,CAAC,EAAE,YAAY,CAAC;YAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;SACpB;KACF;CACF;AAED,wBAAsB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA2JnG;AAED,OAAO,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/http/http-auth-middleware.js

@@ -0,0 +1,285 @@
+import { METHODS } from 'node:http';
+import crypto from 'crypto';
+import { createOidcLoginUrlForApiResponse, redirectBrowserToOidcLogin, safeCreateOidcLoginUrlForApiResponse } from './http-auth-oidc-redirect.js';
+import { fromBase64url, toBase64url } from '@exodus/bytes/base64.js';
+import { utf8toString } from '@exodus/bytes/utf8.js';
+import { AUTH_ENABLED, AUTH_CALLBACK_BASE_URL, SESSION_SECRET, AUTH_MODE, AUTH_TRUSTED_ISSUERS, AUTH_ALLOWED_AUDIENCES, OIDC_GROUPS_ALLOWLIST } from '../config.js';
+import { applyOidcGroupsAllowlist } from './oidc-profile-claims.js';
+import { validateBearerToken } from './bearer-validate.js';
+import { getSpaceContext, runWithSpaceContext } from '../utils/tenant-context.js';
+import { structuredLogger } from '../utils/structured-logger.js';
+import { setWwwAuthenticate } from './http-www-authenticate.js';
+import { buildJsonRpcAuthError } from './mcp-ui-offerings-auth-jsonrpc.js';
+export { setWwwAuthenticate };
+// Cookie name retained as kairos_session for deployment compatibility.
+// Renaming requires dual-emit with matching security attributes, coordinated
+// logout clearing, and refresh handling. Deferred to a separate decision.
+const SESSION_COOKIE_NAME = 'kairos_session';
+/** Alternative cookie name accepted on read for forward-compatibility during SquadRules migration. */
+const SESSION_COOKIE_NAME_ALT = 'squadrules_session';
+const KNOWN_HTTP_METHODS = new Set(METHODS);
+function jsonInvalidTokenResponse(message) {
+    const loginUrl = safeCreateOidcLoginUrlForApiResponse();
+    return {
+        error: 'invalid_token',
+        message,
+        reauth_required: true,
+        ...(loginUrl ? { login_url: loginUrl } : {})
+    };
+}
+function getSessionCookie(req) {
+    const raw = req.get('cookie');
+    if (!raw)
+        return null;
+    const cookies = raw.split(';').map((s) => s.trim());
+    // Primary cookie takes precedence; fall back to the alternative name
+    // for clients that have already adopted squadrules_session.
+    for (const name of [SESSION_COOKIE_NAME, SESSION_COOKIE_NAME_ALT]) {
+        const match = cookies.find((s) => s.startsWith(name + '='));
+        if (match) {
+            const value = match.slice((name + '=').length).trim();
+            if (value)
+                return decodeURIComponent(value);
+        }
+    }
+    return null;
+}
+function hasValidSession(req) {
+    return getSessionPayload(req) !== null;
+}
+/** Verify HMAC and parse session cookie JSON; does not check exp/sub. */
+function parseVerifiedSessionRecord(req) {
+    const cookie = getSessionCookie(req);
+    if (!cookie || !SESSION_SECRET)
+        return null;
+    try {
+        const [payloadB64, sig] = cookie.split('.');
+        if (!payloadB64 || !sig)
+            return null;
+        const expectedSig = toBase64url(new Uint8Array(crypto.createHmac('sha256', SESSION_SECRET).update(payloadB64).digest()));
+        if (sig !== expectedSig)
+            return null;
+        return JSON.parse(utf8toString(fromBase64url(payloadB64)));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * OIDC id_token from login callback, stored only in the httpOnly session cookie for RP-initiated logout
+ * (id_token_hint → Keycloak can skip the static logged-out confirmation screen when configured).
+ */
+export function peekOidcIdTokenHintFromSession(req) {
+    const payload = parseVerifiedSessionRecord(req);
+    if (!payload)
+        return null;
+    const exp = payload['exp'];
+    if (typeof exp === 'number' && exp < Date.now() / 1000)
+        return null;
+    const t = payload['oidc_id_token'];
+    return typeof t === 'string' && t.length > 0 ? t : null;
+}
+/** Decode and verify session cookie; returns AuthPayload or null. */
+function getSessionPayload(req) {
+    const payload = parseVerifiedSessionRecord(req);
+    if (!payload)
+        return null;
+    const exp = payload['exp'];
+    if (typeof exp === 'number' && exp < Date.now() / 1000)
+        return null;
+    const sub = typeof payload['sub'] === 'string' ? payload['sub'] : '';
+    if (!sub)
+        return null;
+    const rawGroups = Array.isArray(payload['groups'])
+        ? payload['groups'].filter((g) => typeof g === 'string')
+        : [];
+    const groups = applyOidcGroupsAllowlist(rawGroups, OIDC_GROUPS_ALLOWLIST);
+    const realm = typeof payload['realm'] === 'string' ? payload['realm'] : 'default';
+    const issRaw = payload['iss'];
+    const iss = typeof issRaw === 'string' && issRaw.length > 0
+        ? issRaw
+        : `realm:${realm}`;
+    const result = { sub, groups, realm, iss };
+    const pu = payload['preferred_username'];
+    if (typeof pu === 'string' && pu.length > 0)
+        result.preferred_username = pu;
+    const name = payload['name'];
+    if (typeof name === 'string' && name.length > 0)
+        result.name = name;
+    const gn = payload['given_name'];
+    if (typeof gn === 'string' && gn.length > 0)
+        result.given_name = gn;
+    const fn = payload['family_name'];
+    if (typeof fn === 'string' && fn.length > 0)
+        result.family_name = fn;
+    const em = payload['email'];
+    if (typeof em === 'string' && em.length > 0)
+        result.email = em;
+    const ev = payload['email_verified'];
+    if (ev === true || ev === false)
+        result.email_verified = ev;
+    const idp = payload['identity_provider'];
+    if (typeof idp === 'string' && idp.length > 0)
+        result.identity_provider = idp;
+    const ak = payload['account_kind'];
+    if (ak === 'local' || ak === 'sso')
+        result.account_kind = ak;
+    const al = payload['account_label'];
+    if (typeof al === 'string' && al.length > 0)
+        result.account_label = al;
+    return result;
+}
+function getBearerToken(req) {
+    const auth = req.get('authorization');
+    if (!auth || !auth.toLowerCase().startsWith('bearer '))
+        return null;
+    return auth.slice(7).trim() || null;
+}
+function hasBearer(req) {
+    return getBearerToken(req) !== null;
+}
+/** True only when the verb is a real HTTP method and GET (avoids odd client verbs in auth branches). */
+function isRecognizedGetRequest(req) {
+    const method = req.method;
+    return typeof method === 'string' && KNOWN_HTTP_METHODS.has(method) && method === 'GET';
+}
+/** Paths that require auth when AUTH_ENABLED: /api, /api/*, /mcp, and /ui (SPA). */
+function isProtectedPath(path) {
+    return (path === '/api' ||
+        path.startsWith('/api/') ||
+        path === '/mcp' ||
+        path === '/ui' ||
+        path.startsWith('/ui/'));
+}
+export async function authMiddleware(req, res, next) {
+    if (!AUTH_ENABLED) {
+        next();
+        return;
+    }
+    if (req.path === '/auth/callback') {
+        next();
+        return;
+    }
+    if (req.method === 'OPTIONS') {
+        next();
+        return;
+    }
+    if (!isProtectedPath(req.path)) {
+        next();
+        return;
+    }
+    const hasSession = hasValidSession(req);
+    const hasBearerReq = hasBearer(req);
+    structuredLogger.debug(`[auth] protected ${req.method} ${req.path} session=${hasSession} bearer=${!!hasBearerReq}`);
+    function runNext(ctx) {
+        const requestId = req.requestId || req.get('x-request-id') || '';
+        ctx = { ...ctx, requestId };
+        const spaceParam = (req.query?.['space'] ?? req.query?.['space_id']);
+        if (spaceParam && typeof spaceParam === 'string') {
+            if (!ctx.allowedSpaceIds.includes(spaceParam)) {
+                res.status(403).json({ error: 'forbidden', message: 'Requested space is not in your allowed spaces' });
+                return;
+            }
+            const personalSnapshot = ctx.personalSpaceId && ctx.personalSpaceId.trim().length > 0
+                ? ctx.personalSpaceId
+                : ctx.defaultWriteSpaceId?.startsWith('user:')
+                    ? ctx.defaultWriteSpaceId
+                    : '';
+            ctx = {
+                ...ctx,
+                allowedSpaceIds: [spaceParam],
+                defaultWriteSpaceId: spaceParam,
+                ...(personalSnapshot && { personalSpaceId: personalSnapshot })
+            };
+        }
+        req.spaceContext = ctx;
+        runWithSpaceContext(ctx, () => next());
+    }
+    if (hasSession) {
+        const payload = getSessionPayload(req);
+        if (payload)
+            req.auth = payload;
+        structuredLogger.debug(`[auth] allowed session ${req.method} ${req.path}`);
+        runNext(getSpaceContext(req));
+        return;
+    }
+    // codeql[js/user-controlled-bypass]: Bearer is an alternate auth path; token is validated or rejected against configured issuer and audience.
+    if (hasBearerReq) {
+        if (process.env['AUTH_TRACE'] === 'true' || process.env['LOG_LEVEL'] === 'trace') {
+            structuredLogger.info(`[auth] TRACE raw call ${req.method} ${req.path} bearer=true trusted_issuers=${JSON.stringify(AUTH_TRUSTED_ISSUERS)} allowed_audiences=${JSON.stringify(AUTH_ALLOWED_AUDIENCES)}`);
+        }
+        const hasIssuerAndAudience = AUTH_TRUSTED_ISSUERS.length > 0 && AUTH_ALLOWED_AUDIENCES.length > 0;
+        const canValidateBearer = hasIssuerAndAudience && (AUTH_MODE === 'oidc_bearer' || AUTH_ENABLED);
+        structuredLogger.info(`[auth] Bearer check path=${req.path} canValidate=${canValidateBearer} AUTH_MODE=${AUTH_MODE} trusted_issuers=${AUTH_TRUSTED_ISSUERS.length} allowed_audiences=${AUTH_ALLOWED_AUDIENCES.length}`);
+        if (!canValidateBearer) {
+            structuredLogger.info(`[auth] 401 ${req.method} ${req.path} bearer_not_validated (config missing)`);
+            setWwwAuthenticate(res);
+            res.status(401).json({
+                error: 'bearer_not_validated',
+                message: 'Bearer tokens are not validated when issuer/audience are not configured. Set AUTH_TRUSTED_ISSUERS and AUTH_ALLOWED_AUDIENCES (and AUTH_MODE=oidc_bearer or AUTH_ENABLED) to use Bearer auth.'
+            });
+            return;
+        }
+        const token = getBearerToken(req);
+        try {
+            const payload = await validateBearerToken(token, AUTH_TRUSTED_ISSUERS, AUTH_ALLOWED_AUDIENCES);
+            if (payload) {
+                req.auth = payload;
+                structuredLogger.debug(`[auth] allowed bearer ${req.method} ${req.path}`);
+                runNext(getSpaceContext(req));
+            }
+            else {
+                structuredLogger.info(`[auth] 401 ${req.method} ${req.path} bearer invalid or expired`);
+                setWwwAuthenticate(res, {
+                    error: 'invalid_token',
+                    error_description: 'SSO session or access token rejected; sign in again and reconnect MCP if the host caches tokens'
+                });
+                res.status(401).json(jsonInvalidTokenResponse('Your SSO session or access token is no longer accepted. Sign in again and reconnect this MCP server if your host still uses old credentials.'));
+            }
+        }
+        catch {
+            structuredLogger.info(`[auth] 401 ${req.method} ${req.path} bearer validation failed`);
+            setWwwAuthenticate(res, {
+                error: 'invalid_token',
+                error_description: 'Could not validate SSO credentials; sign in again and reconnect MCP if the host caches tokens'
+            });
+            res.status(401).json(jsonInvalidTokenResponse('Your SSO credentials could not be validated. Sign in again and reconnect this MCP server if your host caches tokens.'));
+        }
+        return;
+    }
+    if (!AUTH_CALLBACK_BASE_URL) {
+        res.status(503).json({
+            error: 'Auth misconfigured',
+            message: 'AUTH_CALLBACK_BASE_URL is required when AUTH_ENABLED is true. Set it in .env (e.g. http://localhost:3500).'
+        });
+        return;
+    }
+    // MCP client must receive 401 + WWW-Authenticate to show "Needs authentication" / Connect.
+    // Redirect (302) would prevent discovery; always return 401 for /mcp.
+    const isMcp = req.path === '/mcp';
+    // codeql[js/user-controlled-bypass]: Redirect only when method is GET and listed in node:http METHODS; any other verb gets 401 JSON.
+    if (isRecognizedGetRequest(req) && !isMcp) {
+        structuredLogger.info(`[auth] 302 ${req.method} ${req.path} redirect to login`);
+        redirectBrowserToOidcLogin(res);
+        return;
+    }
+    const loginUrlForJson = createOidcLoginUrlForApiResponse();
+    structuredLogger.info(`[auth] 401 ${req.method} ${req.path}${isMcp ? ' (announcing auth need for MCP client)' : ''}`);
+    setWwwAuthenticate(res);
+    // Return a JSON-RPC 2.0 error envelope when the request is a JSON-RPC call to /mcp,
+    // so MCP clients can parse a structured error instead of a generic 401 body.
+    const body = req.body;
+    const isJsonRpc = isMcp && body?.['jsonrpc'] === '2.0';
+    if (isJsonRpc) {
+        res.status(401).json(buildJsonRpcAuthError(body?.['id'], 'Authentication required', loginUrlForJson));
+    }
+    else {
+        res.status(401).json({
+            error: 'Unauthorized',
+            message: 'Authentication required',
+            login_url: loginUrlForJson
+        });
+    }
+}
+export { SESSION_COOKIE_NAME };
+//# sourceMappingURL=http-auth-middleware.js.map

package/dist/http/http-auth-middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-auth-middleware.js","sourceRoot":"","sources":["../../src/http/http-auth-middleware.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EACL,gCAAgC,EAChC,0BAA0B,EAC1B,oCAAoC,EACrC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,cAAc,EACd,SAAS,EACT,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,EACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAoB,MAAM,sBAAsB,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAqB,MAAM,4BAA4B,CAAC;AACrG,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAI9B,uEAAuE;AACvE,6EAA6E;AAC7E,0EAA0E;AAC1E,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAC7C,sGAAsG;AACtG,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AACrD,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAS,OAAO,CAAC,CAAC;AAEpD,SAAS,wBAAwB,CAAC,OAAe;IAC/C,MAAM,QAAQ,GAAG,oCAAoC,EAAE,CAAC;IACxD,OAAO;QACL,KAAK,EAAE,eAAe;QACtB,OAAO;QACP,eAAe,EAAE,IAAI;QACrB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAY;IACpC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACpD,qEAAqE;IACrE,4DAA4D;IAC5D,KAAK,MAAM,IAAI,IAAI,CAAC,mBAAmB,EAAE,uBAAuB,CAAC,EAAE,CAAC;QAClE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC;QAC5D,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YACtD,IAAI,KAAK;gBAAE,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,OAAO,iBAAiB,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;AACzC,CAAC;AAED,yEAAyE;AACzE,SAAS,0BAA0B,CAAC,GAAY;IAC9C,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACrC,MAAM,WAAW,GAAG,WAAW,CAC7B,IAAI,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,CAAC,CACxF,CAAC;QACF,IAAI,GAAG,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC;QACrC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAA4B,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,GAAY;IACzD,MAAM,OAAO,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;QAAE,OAAO,IAAI,CAAC;IACpE,MAAM,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACnC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAED,qEAAqE;AACrE,SAAS,iBAAiB,CAAC,GAAY;IACrC,MAAM,OAAO,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;QAAE,OAAO,IAAI,CAAC;IACpE,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAChD,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACrE,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClF,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,GAAG,GACP,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAC7C,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,SAAS,KAAK,EAAE,CAAC;IACvB,MAAM,MAAM,GAAgB,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IACxD,MAAM,EAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACzC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,kBAAkB,GAAG,EAAE,CAAC;IAC5E,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;IACpE,MAAM,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACjC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,UAAU,GAAG,EAAE,CAAC;IACpE,MAAM,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAClC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,WAAW,GAAG,EAAE,CAAC;IACrE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC;IAC/D,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACrC,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,KAAK;QAAE,MAAM,CAAC,cAAc,GAAG,EAAE,CAAC;IAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACzC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,iBAAiB,GAAG,GAAG,CAAC;IAC9E,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACnC,IAAI,EAAE,KAAK,OAAO,IAAI,EAAE,KAAK,KAAK;QAAE,MAAM,CAAC,YAAY,GAAG,EAAE,CAAC;IAC7D,MAAM,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACpC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,aAAa,GAAG,EAAE,CAAC;IACvE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,GAAY;IAClC,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;AACtC,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO,cAAc,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;AACtC,CAAC;AAED,wGAAwG;AACxG,SAAS,sBAAsB,CAAC,GAAY;IAC1C,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAC1B,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,KAAK,KAAK,CAAC;AAC1F,CAAC;AAED,oFAAoF;AACpF,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,CACL,IAAI,KAAK,MAAM;QACf,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QACxB,IAAI,KAAK,MAAM;QACf,IAAI,KAAK,KAAK;QACd,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CACxB,CAAC;AACJ,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IAClF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAClC,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IACpC,gBAAgB,CAAC,KAAK,CACpB,oBAAoB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,YAAY,UAAU,WAAW,CAAC,CAAC,YAAY,EAAE,CAC5F,CAAC;IAEF,SAAS,OAAO,CAAC,GAAiB;QAChC,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACjE,GAAG,GAAG,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC,UAAU,CAAC,CAAuB,CAAC;QAC3F,IAAI,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACjD,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC,CAAC;gBACvG,OAAO;YACT,CAAC;YACD,MAAM,gBAAgB,GACpB,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;gBAC1D,CAAC,CAAC,GAAG,CAAC,eAAe;gBACrB,CAAC,CAAC,GAAG,CAAC,mBAAmB,EAAE,UAAU,CAAC,OAAO,CAAC;oBAC5C,CAAC,CAAC,GAAG,CAAC,mBAAmB;oBACzB,CAAC,CAAC,EAAE,CAAC;YACX,GAAG,GAAG;gBACJ,GAAG,GAAG;gBACN,eAAe,EAAE,CAAC,UAAU,CAAC;gBAC7B,mBAAmB,EAAE,UAAU;gBAC/B,GAAG,CAAC,gBAAgB,IAAI,EAAE,eAAe,EAAE,gBAAgB,EAAE,CAAC;aAC/D,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,YAAY,GAAG,GAAG,CAAC;QACvB,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,OAAO;YAAE,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC;QAChC,gBAAgB,CAAC,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,OAAO;IACT,CAAC;IAED,8IAA8I;IAC9I,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,OAAO,EAAE,CAAC;YACjF,gBAAgB,CAAC,IAAI,CACnB,yBAAyB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,gCAAgC,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,EAAE,CAClL,CAAC;QACJ,CAAC;QACD,MAAM,oBAAoB,GAAG,oBAAoB,CAAC,MAAM,GAAG,CAAC,IAAI,sBAAsB,CAAC,MAAM,GAAG,CAAC,CAAC;QAClG,MAAM,iBAAiB,GACrB,oBAAoB,IAAI,CAAC,SAAS,KAAK,aAAa,IAAI,YAAY,CAAC,CAAC;QACxE,gBAAgB,CAAC,IAAI,CACnB,4BAA4B,GAAG,CAAC,IAAI,gBAAgB,iBAAiB,cAAc,SAAS,oBAAoB,oBAAoB,CAAC,MAAM,sBAAsB,sBAAsB,CAAC,MAAM,EAAE,CACjM,CAAC;QACF,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,gBAAgB,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,wCAAwC,CAAC,CAAC;YACpG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,sBAAsB;gBAC7B,OAAO,EACL,8LAA8L;aACjM,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,KAAM,EAAE,oBAAoB,EAAE,sBAAsB,CAAC,CAAC;YAChG,IAAI,OAAO,EAAE,CAAC;gBACZ,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC;gBACnB,gBAAgB,CAAC,KAAK,CAAC,yBAAyB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC1E,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACN,gBAAgB,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,4BAA4B,CAAC,CAAC;gBACxF,kBAAkB,CAAC,GAAG,EAAE;oBACtB,KAAK,EAAE,eAAe;oBACtB,iBAAiB,EACf,iGAAiG;iBACpG,CAAC,CAAC;gBACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAClB,wBAAwB,CACtB,8IAA8I,CAC/I,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gBAAgB,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,2BAA2B,CAAC,CAAC;YACvF,kBAAkB,CAAC,GAAG,EAAE;gBACtB,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EACf,+FAA+F;aAClG,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAClB,wBAAwB,CACtB,sHAAsH,CACvH,CACF,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC5B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,oBAAoB;YAC3B,OAAO,EAAE,4GAA4G;SACtH,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,2FAA2F;IAC3F,sEAAsE;IACtE,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC;IAClC,qIAAqI;IACrI,IAAI,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1C,gBAAgB,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,oBAAoB,CAAC,CAAC;QAChF,0BAA0B,CAAC,GAAG,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IAED,MAAM,eAAe,GAAG,gCAAgC,EAAE,CAAC;IAE3D,gBAAgB,CAAC,IAAI,CACnB,cAAc,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/F,CAAC;IACF,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAExB,oFAAoF;IACpF,6EAA6E;IAC7E,MAAM,IAAI,GAAG,GAAG,CAAC,IAA2C,CAAC;IAC7D,MAAM,SAAS,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC,SAAS,CAAC,KAAK,KAAK,CAAC;IACvD,IAAI,SAAS,EAAE,CAAC;QACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,yBAAyB,EAAE,eAAe,CAAC,CAAC,CAAC;IACxG,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,cAAc;YACrB,OAAO,EAAE,yBAAyB;YAClC,SAAS,EAAE,eAAe;SAC3B,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,OAAO,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/http/http-auth-oidc-redirect.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Browser OIDC login redirect + PKCE state shared by auth middleware and /auth/logout.
+ *
+ * OIDC state is stored via the shared oidcStateStore (Redis when configured,
+ * in-memory fallback otherwise) so that login works across instances.
+ * See src/services/oidc-state-store.ts for details.
+ */
+import type { Response } from 'express';
+export declare function buildOidcAuthorizationUrl(state: string, codeChallenge: string): string;
+/**
+ * RP-initiated OIDC logout URL. After the IdP clears the SSO session it redirects to
+ * postLogoutRedirectUri (must be registered as a valid post-logout redirect for the client).
+ */
+export declare function buildOidcEndSessionRedirectUrl(postLogoutRedirectUri: string, idTokenHint: string | null): string | null;
+/** Allocate PKCE state and redirect the browser to the IdP authorization endpoint. */
+export declare function redirectBrowserToOidcLogin(res: Response): boolean;
+/** Register PKCE state and return the authorization URL (for JSON login_url). */
+export declare function createOidcLoginUrlForApiResponse(): string;
+/**
+ * Same as {@link createOidcLoginUrlForApiResponse} but returns undefined when OIDC login URLs are not
+ * configured or URL construction fails (never throws).
+ */
+export declare function safeCreateOidcLoginUrlForApiResponse(): string | undefined;
+//# sourceMappingURL=http-auth-oidc-redirect.d.ts.map

package/dist/http/http-auth-oidc-redirect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-auth-oidc-redirect.d.ts","sourceRoot":"","sources":["../../src/http/http-auth-oidc-redirect.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAOxC,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAiBtF;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,qBAAqB,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAYvH;AAED,sFAAsF;AACtF,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAcjE;AAED,iFAAiF;AACjF,wBAAgB,gCAAgC,IAAI,MAAM,CAQzD;AAED;;;GAGG;AACH,wBAAgB,oCAAoC,IAAI,MAAM,GAAG,SAAS,CAOzE"}

package/dist/http/http-auth-oidc-redirect.js

@@ -0,0 +1,80 @@
+import crypto from 'crypto';
+import { KEYCLOAK_URL, KEYCLOAK_REALM, KEYCLOAK_CLIENT_ID, AUTH_CALLBACK_BASE_URL } from '../config.js';
+import { oidcStateStore } from '../services/oidc-state-store.js';
+import { structuredLogger } from '../utils/structured-logger.js';
+export function buildOidcAuthorizationUrl(state, codeChallenge) {
+    if (!AUTH_CALLBACK_BASE_URL) {
+        throw new Error('AUTH_CALLBACK_BASE_URL is required for OIDC login URL');
+    }
+    const base = KEYCLOAK_URL.replace(/\/$/, '');
+    const redirectUri = `${AUTH_CALLBACK_BASE_URL.replace(/\/$/, '')}/auth/callback`;
+    const params = new URLSearchParams({
+        client_id: KEYCLOAK_CLIENT_ID,
+        redirect_uri: redirectUri,
+        response_type: 'code',
+        scope: 'openid profile email',
+        state,
+        code_challenge: codeChallenge,
+        code_challenge_method: 'S256',
+        prompt: 'login'
+    });
+    return `${base}/realms/${KEYCLOAK_REALM}/protocol/openid-connect/auth?${params.toString()}`;
+}
+/**
+ * RP-initiated OIDC logout URL. After the IdP clears the SSO session it redirects to
+ * postLogoutRedirectUri (must be registered as a valid post-logout redirect for the client).
+ */
+export function buildOidcEndSessionRedirectUrl(postLogoutRedirectUri, idTokenHint) {
+    if (!KEYCLOAK_URL || !KEYCLOAK_REALM || !KEYCLOAK_CLIENT_ID) {
+        return null;
+    }
+    const base = KEYCLOAK_URL.replace(/\/$/, '');
+    const u = new URL(`${base}/realms/${KEYCLOAK_REALM}/protocol/openid-connect/logout`);
+    u.searchParams.set('client_id', KEYCLOAK_CLIENT_ID);
+    u.searchParams.set('post_logout_redirect_uri', postLogoutRedirectUri);
+    if (idTokenHint) {
+        u.searchParams.set('id_token_hint', idTokenHint);
+    }
+    return u.toString();
+}
+/** Allocate PKCE state and redirect the browser to the IdP authorization endpoint. */
+export function redirectBrowserToOidcLogin(res) {
+    if (!AUTH_CALLBACK_BASE_URL) {
+        return false;
+    }
+    const state = crypto.randomBytes(16).toString('base64url');
+    const codeVerifier = crypto.randomBytes(32).toString('base64url');
+    const codeChallenge = crypto.createHash('sha256').update(codeVerifier).digest('base64url').replace(/=/g, '');
+    // Fire-and-forget: the Redis write completes well before the browser-driven
+    // redirect chain reaches the IdP and returns to /auth/callback.
+    oidcStateStore.set(state, { codeVerifier, createdAt: Date.now() }).catch(err => {
+        structuredLogger.error(`[oidc-state] Failed to store OIDC state: ${err instanceof Error ? err.message : String(err)}`);
+    });
+    res.redirect(302, buildOidcAuthorizationUrl(state, codeChallenge));
+    return true;
+}
+/** Register PKCE state and return the authorization URL (for JSON login_url). */
+export function createOidcLoginUrlForApiResponse() {
+    const state = crypto.randomBytes(16).toString('base64url');
+    const codeVerifier = crypto.randomBytes(32).toString('base64url');
+    const codeChallenge = crypto.createHash('sha256').update(codeVerifier).digest('base64url').replace(/=/g, '');
+    oidcStateStore.set(state, { codeVerifier, createdAt: Date.now() }).catch(err => {
+        structuredLogger.error(`[oidc-state] Failed to store OIDC state: ${err instanceof Error ? err.message : String(err)}`);
+    });
+    return buildOidcAuthorizationUrl(state, codeChallenge);
+}
+/**
+ * Same as {@link createOidcLoginUrlForApiResponse} but returns undefined when OIDC login URLs are not
+ * configured or URL construction fails (never throws).
+ */
+export function safeCreateOidcLoginUrlForApiResponse() {
+    if (!AUTH_CALLBACK_BASE_URL)
+        return undefined;
+    try {
+        return createOidcLoginUrlForApiResponse();
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=http-auth-oidc-redirect.js.map

package/dist/http/http-auth-oidc-redirect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-auth-oidc-redirect.js","sourceRoot":"","sources":["../../src/http/http-auth-oidc-redirect.ts"],"names":[],"mappings":"AAQA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACxG,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAGjE,MAAM,UAAU,yBAAyB,CAAC,KAAa,EAAE,aAAqB;IAC5E,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,GAAG,sBAAsB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC;IACjF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,SAAS,EAAE,kBAAkB;QAC7B,YAAY,EAAE,WAAW;QACzB,aAAa,EAAE,MAAM;QACrB,KAAK,EAAE,sBAAsB;QAC7B,KAAK;QACL,cAAc,EAAE,aAAa;QAC7B,qBAAqB,EAAE,MAAM;QAC7B,MAAM,EAAE,OAAO;KAChB,CAAC,CAAC;IACH,OAAO,GAAG,IAAI,WAAW,cAAc,iCAAiC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC9F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,qBAA6B,EAAE,WAA0B;IACtG,IAAI,CAAC,YAAY,IAAI,CAAC,cAAc,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,WAAW,cAAc,iCAAiC,CAAC,CAAC;IACrF,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;IACpD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,0BAA0B,EAAE,qBAAqB,CAAC,CAAC;IACtE,IAAI,WAAW,EAAE,CAAC;QAChB,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;AACtB,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,0BAA0B,CAAC,GAAa;IACtD,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAClE,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC7G,4EAA4E;IAC5E,gEAAgE;IAChE,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;QAC7E,gBAAgB,CAAC,KAAK,CAAC,4CAA4C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACzH,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,yBAAyB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,gCAAgC;IAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAClE,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC7G,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;QAC7E,gBAAgB,CAAC,KAAK,CAAC,4CAA4C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACzH,CAAC,CAAC,CAAC;IACH,OAAO,yBAAyB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oCAAoC;IAClD,IAAI,CAAC,sBAAsB;QAAE,OAAO,SAAS,CAAC;IAC9C,IAAI,CAAC;QACH,OAAO,gCAAgC,EAAE,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/http/http-client-registration-proxy.d.ts

@@ -0,0 +1,3 @@
+import type { Express } from 'express';
+export declare function setupClientRegistrationProxy(app: Express): void;
+//# sourceMappingURL=http-client-registration-proxy.d.ts.map

package/dist/http/http-client-registration-proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-client-registration-proxy.d.ts","sourceRoot":"","sources":["../../src/http/http-client-registration-proxy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAqB,MAAM,SAAS,CAAC;AA2I1D,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAkC/D"}

package/dist/http/http-client-registration-proxy.js

@@ -0,0 +1,146 @@
+import { AUTH_CALLBACK_BASE_URL, KEYCLOAK_INTERNAL_URL, KEYCLOAK_REALM, KEYCLOAK_URL } from '../config.js';
+import { structuredLogger } from '../utils/structured-logger.js';
+function keycloakFetchBase() {
+    const external = KEYCLOAK_URL ? KEYCLOAK_URL.replace(/\/$/, '') : '';
+    if (KEYCLOAK_INTERNAL_URL && external) {
+        return KEYCLOAK_INTERNAL_URL.replace(/\/$/, '');
+    }
+    return external;
+}
+function getPublicBaseUrl() {
+    const base = AUTH_CALLBACK_BASE_URL?.trim().replace(/\/$/, '');
+    return base ? base : null;
+}
+function setCorsHeaders(req, res) {
+    const origin = req.headers.origin;
+    if (origin) {
+        res.setHeader('Access-Control-Allow-Origin', origin);
+        res.setHeader('Vary', 'Origin');
+    }
+}
+function optionsHandler(req, res) {
+    setCorsHeaders(req, res);
+    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
+    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, DPoP, MCP-Protocol-Version');
+    res.setHeader('Access-Control-Max-Age', '86400');
+    res.status(204).end();
+}
+function rewriteRegistrationUrls(json) {
+    if (!json || typeof json !== 'object')
+        return json;
+    const value = json;
+    const publicBase = getPublicBaseUrl();
+    if (!publicBase)
+        return json;
+    const regClientUri = value['registration_client_uri'];
+    if (typeof regClientUri === 'string') {
+        try {
+            const u = new URL(regClientUri);
+            const parts = u.pathname.split('/').filter(Boolean);
+            const clientId = parts[parts.length - 1];
+            if (clientId) {
+                value['registration_client_uri'] = `${publicBase}/.well-known/clients-registrations/openid-connect/${clientId}`;
+            }
+        }
+        catch {
+        }
+    }
+    return value;
+}
+async function proxyToKeycloak(req, res, upstreamUrl, method) {
+    setCorsHeaders(req, res);
+    const headers = {
+        Accept: 'application/json',
+    };
+    const auth = req.headers.authorization;
+    if (typeof auth === 'string' && auth.trim()) {
+        headers['Authorization'] = auth;
+    }
+    if (method !== 'GET' && method !== 'DELETE') {
+        headers['Content-Type'] = 'application/json';
+    }
+    let body;
+    if (method !== 'GET' && method !== 'DELETE') {
+        body = JSON.stringify(req.body ?? {});
+    }
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 10_000);
+    try {
+        const init = { method, headers, signal: controller.signal };
+        if (body !== undefined) {
+            init.body = body;
+        }
+        const upstream = await fetch(upstreamUrl, init);
+        const contentType = upstream.headers.get('content-type');
+        if (contentType) {
+            res.setHeader('Content-Type', contentType);
+        }
+        const location = upstream.headers.get('location');
+        const publicBase = getPublicBaseUrl();
+        if (location && publicBase) {
+            try {
+                const u = new URL(location);
+                const parts = u.pathname.split('/').filter(Boolean);
+                const clientId = parts[parts.length - 1];
+                if (clientId) {
+                    res.setHeader('Location', `${publicBase}/.well-known/clients-registrations/openid-connect/${clientId}`);
+                }
+            }
+            catch {
+            }
+        }
+        const raw = await upstream.text();
+        if (!raw) {
+            res.status(upstream.status).end();
+            return;
+        }
+        if (contentType && contentType.includes('application/json')) {
+            try {
+                const parsed = JSON.parse(raw);
+                const rewritten = rewriteRegistrationUrls(parsed);
+                res.status(upstream.status).send(JSON.stringify(rewritten));
+                return;
+            }
+            catch {
+            }
+        }
+        res.status(upstream.status).send(raw);
+    }
+    catch (err) {
+        structuredLogger.warn(`[client-registration-proxy] upstream request failed url=${upstreamUrl} err=${err instanceof Error ? err.message : String(err)}`);
+        res.status(502).json({ error: 'authorization_server_unavailable' });
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+export function setupClientRegistrationProxy(app) {
+    const realm = KEYCLOAK_REALM?.trim();
+    const base = keycloakFetchBase();
+    if (!realm || !base) {
+        return;
+    }
+    const rootPath = '/.well-known/clients-registrations/openid-connect';
+    app.options(rootPath, optionsHandler);
+    app.options(`${rootPath}/:clientId`, optionsHandler);
+    app.post(rootPath, async (req, res) => {
+        const upstreamUrl = `${base}/realms/${encodeURIComponent(realm)}/clients-registrations/openid-connect`;
+        await proxyToKeycloak(req, res, upstreamUrl, 'POST');
+    });
+    app.get(`${rootPath}/:clientId`, async (req, res) => {
+        const clientId = req.params.clientId;
+        const upstreamUrl = `${base}/realms/${encodeURIComponent(realm)}/clients-registrations/openid-connect/${encodeURIComponent(clientId)}`;
+        await proxyToKeycloak(req, res, upstreamUrl, 'GET');
+    });
+    app.put(`${rootPath}/:clientId`, async (req, res) => {
+        const clientId = req.params.clientId;
+        const upstreamUrl = `${base}/realms/${encodeURIComponent(realm)}/clients-registrations/openid-connect/${encodeURIComponent(clientId)}`;
+        await proxyToKeycloak(req, res, upstreamUrl, 'PUT');
+    });
+    app.delete(`${rootPath}/:clientId`, async (req, res) => {
+        const clientId = req.params.clientId;
+        const upstreamUrl = `${base}/realms/${encodeURIComponent(realm)}/clients-registrations/openid-connect/${encodeURIComponent(clientId)}`;
+        await proxyToKeycloak(req, res, upstreamUrl, 'DELETE');
+    });
+}
+//# sourceMappingURL=http-client-registration-proxy.js.map

package/dist/http/http-client-registration-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-client-registration-proxy.js","sourceRoot":"","sources":["../../src/http/http-client-registration-proxy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC3G,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjE,SAAS,iBAAiB;IACxB,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,IAAI,qBAAqB,IAAI,QAAQ,EAAE,CAAC;QACtC,OAAO,qBAAqB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,gBAAgB;IACvB,MAAM,IAAI,GAAG,sBAAsB,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/D,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5B,CAAC;AAED,SAAS,cAAc,CAAC,GAAY,EAAE,GAAa;IACjD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAClC,IAAI,MAAM,EAAE,CAAC;QACX,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;QACrD,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAY,EAAE,GAAa;IACjD,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACzB,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,iCAAiC,CAAC,CAAC;IACjF,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,yDAAyD,CAAC,CAAC;IACzG,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC;IACjD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAa;IAC5C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,KAAK,GAAG,IAA+B,CAAC;IAC9C,MAAM,UAAU,GAAG,gBAAgB,EAAE,CAAC;IACtC,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAE7B,MAAM,YAAY,GAAG,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACtD,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;YAChC,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACzC,IAAI,QAAQ,EAAE,CAAC;gBACb,KAAK,CAAC,yBAAyB,CAAC,GAAG,GAAG,UAAU,qDAAqD,QAAQ,EAAE,CAAC;YAClH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;QACT,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,GAAY,EACZ,GAAa,EACb,WAAmB,EACnB,MAAc;IAEd,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAEzB,MAAM,OAAO,GAA2B;QACtC,MAAM,EAAE,kBAAkB;KAC3B,CAAC;IAEF,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACvC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5C,OAAO,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC;IAClC,CAAC;IAED,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;IAC/C,CAAC;IAED,IAAI,IAAwB,CAAC;IAC7B,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC5C,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,IAAI,GAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;QACzE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAEhD,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACzD,IAAI,WAAW,EAAE,CAAC;YAChB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,gBAAgB,EAAE,CAAC;QACtC,IAAI,QAAQ,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC5B,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBACzC,IAAI,QAAQ,EAAE,CAAC;oBACb,GAAG,CAAC,SAAS,CACX,UAAU,EACV,GAAG,UAAU,qDAAqD,QAAQ,EAAE,CAC7E,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;YACT,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC;YAClC,OAAO;QACT,CAAC;QAED,IAAI,WAAW,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC5D,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC/B,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;gBAClD,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;gBAC5D,OAAO;YACT,CAAC;YAAC,MAAM,CAAC;YACT,CAAC;QACH,CAAC;QAED,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,gBAAgB,CAAC,IAAI,CACnB,2DAA2D,WAAW,QAAQ,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACjI,CAAC;QACF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAC;IACtE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,GAAY;IACvD,MAAM,KAAK,GAAG,cAAc,EAAE,IAAI,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,iBAAiB,EAAE,CAAC;IACjC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,mDAAmD,CAAC;IAErE,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACtC,GAAG,CAAC,OAAO,CAAC,GAAG,QAAQ,YAAY,EAAE,cAAc,CAAC,CAAC;IAErD,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACpC,MAAM,WAAW,GAAG,GAAG,IAAI,WAAW,kBAAkB,CAAC,KAAK,CAAC,uCAAuC,CAAC;QACvG,MAAM,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClD,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC;QACrC,MAAM,WAAW,GAAG,GAAG,IAAI,WAAW,kBAAkB,CAAC,KAAK,CAAC,yCAAyC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvI,MAAM,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClD,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC;QACrC,MAAM,WAAW,GAAG,GAAG,IAAI,WAAW,kBAAkB,CAAC,KAAK,CAAC,yCAAyC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvI,MAAM,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,GAAG,QAAQ,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACrD,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC;QACrC,MAAM,WAAW,GAAG,GAAG,IAAI,WAAW,kBAAkB,CAAC,KAAK,CAAC,yCAAyC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvI,MAAM,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC"}