@thoughtspot/mcp-auth 1.0.0

package/LICENSE

@@ -0,0 +1,127 @@
+ThoughtSpot Development Tools End User License Agreement
+
+THIS THOUGHTSPOT DEVELOPMENT TOOLS END USER LICENSE AGREEMENT ("EULA") FORMS A BINDING AGREEMENT BETWEEN YOU INDIVIDUALLY OR THE BUSINESS ENTITY OR PUBLIC AGENCY ON WHOSE BEHALF YOU ARE ACCEPTING THIS AGREEMENT ("COMPANY") AND THOUGHTSPOT, INC. ("THOUGHTSPOT").
+
+THIS EULA DESCRIBES THE RIGHTS AND OBLIGATIONS OF COMPANY AND THOUGHTSPOT GOVERNING THE USE OF ANY APPLICATION PROGRAMMING INTERFACE, CONNECTOR, SOFTWARE DEVELOPMENT KIT, CODE SNIPPET, SAMPLE CODE, FREE CUSTOM USER INTERFACE OR VISUALIZATION, SAMPLE DATA, AND THE CORRESPONDING DOCUMENTATION FOR EACH, ANY UPDATES AND UPGRADES THERETO, AND ANY MODIFICATIONS, ENHANCEMENTS, OR IMPROVEMENTS, OF ANY OF THE FOREGOING, MADE AVAILABLE BY THOUGHTSPOT TOGETHER WITH THIS EULA (EACH A "TOOL" AND COLLECTIVELY "TOOLS").
+
+THIS EULA IS ACCEPTED BY:
+(1) INDICATING ACCEPTANCE OF THESE TERMS BY CLICKING "SUBMIT," "ACCEPT" OR A SIMILAR BUTTON WHEN THIS EULA IS REFERENCED ON A WEB PAGE TO RECEIVE A TOOL; OR
+(2) DOWNLOADING, INSTALLING, OR USING, ANY PORTION OF THE TOOL.
+
+THE INDIVIDUAL ACCEPTING THIS AGREEMENT ON BEHALF OF COMPANY REPRESENTS AND WARRANTS THAT HE OR SHE:
+(A) IS AN EMPLOYEE, CONTRACTOR, OR AGENT OF, AND HAS THE AUTHORITY TO REPRESENT, COMPANY; AND
+(B) HAS READ AND UNDERSTANDS ALL THE PROVISIONS OF THIS AGREEMENT.
+
+IF COMPANY DOES NOT WISH TO ACCEPT THIS AGREEMENT, OR THE INDIVIDUAL ACCEPTING THE AGREEMENT DOES NOT HAVE AUTHORITY TO BIND COMPANY TO THIS AGREEMENT, THEN DO NOT CLICK OR SIGN TO ACCEPT THIS AGREEMENT, OR DOWNLOAD, INSTALL, OR USE, ANY TOOL.
+
+In the event of any conflict between the terms of this EULA and a signed agreement between Company and ThoughtSpot, the terms of the signed agreement will apply.
+
+ACKNOWLEDGMENT
+ThoughtSpot provides the Tool to Company "as is" and "as available" and as an accommodation to Company to more quickly connect third-party software or services with, utilize sample data or code on, or utilize sample data sets or other materials with, the search and analytics ThoughtSpot Cloud subscription service or ThoughtSpot Application licensed software, to which Company must have purchased the necessary use rights pursuant to a separate purchase agreement ("Agreement").
+
+ThoughtSpot may at any time remove Company's access to any Tool or terminate the availability of a Tool without any liability to Company or any third party. In the event of termination, Company must remove and destroy all copies of the affected Tool, including all backup copies from all devices Company owns, possesses or controls and on which the Tool is installed.
+
+LICENSE SCOPE
+Subject to Company's compliance with this EULA, ThoughtSpot hereby grants to Company a royalty-free, sub-licensable, transferable, non-exclusive, worldwide right and license to use, reproduce, display, perform, import and export, the Tool. The Tool is licensed, not sold.
+
+RESTRICTIONS
+Company will not (and has no license to):
+(a) use the Tool except as permitted in this EULA;
+(b) sell, resell, license, sublicense, rent, lease, encumber, lend, distribute, transfer, or provide a third party with access to the Tool;
+(c) modify, or create derivative works of the Tool;
+(d) circumvent or remove by any means any click-accept or copy protection used by ThoughtSpot in connection with the Tool;
+(e) use the Tool to conduct competitive research, to develop a product that is competitive with any ThoughtSpot product offering, or otherwise if Company is a competitor to ThoughtSpot, or to assert, authorize, assist, or encourage a third-party to assert, against ThoughtSpot or any of its affiliates, customers, vendors, business partners, or licensors, any patent or other intellectual property claim regarding ThoughtSpot products or services;
+(f) publicly disseminate any performance or security vulnerability test (including a penetration test) results or analysis related to or derived from the Tool;
+(g) use the Tool to create a product that converts ThoughtSpot products' file formats for use with data analysis, machine learning, or data visualization software that is not the property of ThoughtSpot;
+(h) use the Tool to access ThoughtSpot products in a manner not authorized by the Agreement or this EULA;
+(i) use the Tool in any manner that violates any applicable laws or regulations; or
+(j) to the extent that the Tool includes a third-party application programming interface, then Company will not modify, distribute, or use, the Tool with anything other than to connect the intended corresponding third-party technology to ThoughtSpot's products.
+
+Company will not cause, encourage, or permit any other person or entity under its control from taking any actions that Company is prohibited from taking under this Agreement.
+
+Before Company engages in any of the foregoing acts that it believes it may be entitled to, it will provide ThoughtSpot with 30 days' prior notice to legal@thoughtspot.com, and provide reasonably requested information to allow ThoughtSpot to assess Company's claim. ThoughtSpot may, in its discretion, provide alternatives that reduce adverse impacts to ThoughtSpot's intellectual property or other rights.
+
+OPEN SOURCE COMPONENTS
+A Tool may include one or more open source software components provided under separate license terms which can be found in the open source disclosure file provided with or within a Tool download.
+
+Notwithstanding anything herein to the contrary, open source software is licensed to Company under such OSS's own applicable license terms, which can be found in the attribution file. The open source license terms are consistent with the license granted in this EULA, and may contain additional rights benefiting Company. The open source license terms shall take precedence over this EULA to the extent that this EULA imposes greater restrictions on Company than the applicable open source license terms.
+
+To the extent the license for any open source software requires ThoughtSpot to make available to Company the corresponding source code and/or modifications, Company may obtain a copy of the applicable source files by sending a written request, with Company's name and address to:
+ThoughtSpot, Inc.
+444 Castro Street, Suite 1000
+Mountain View, CA 94041
+United States of America
+
+All requests should clearly specify: Open Source Files Request, Attention: General Counsel. This offer to obtain a copy of such source files is valid for three years from the date Company acquired the applicable Tool.
+
+THIRD-PARTY COMPONENTS
+In addition to open source components, a Tool may include one or more components licensed by a third party (a "Component") (e.g., an application programming interface or a sample data set).
+
+To the extent that third-party license requirements apply to a third-party component in a Tool, such additional license terms will be provided in the open source disclosure file provided with or within a Tool download. Third-party license terms shall take precedence over this EULA to the extent that they impose additional restrictions or limitations on Company than the license provided herein for download and use of a Component.
+
+The parties agree that:
+(a) to the extent that the terms between Company and the third party for use of a third-party technology accessed by the Component are more restrictive, such terms shall apply to Company's use of the Component;
+(b) ThoughtSpot, and not the third party, is responsible for the Component including, without limitation, for any warranties, maintenance, and support thereof, and the third party does not warrant the Component's accuracy, reliability, completeness, usefulness, non-infringement, or quality of the Component, and will not be liable for any losses or damages of any kind, including lost profits or other indirect or consequential damages, relating to use of or reliance on the Component; and
+(c) the third party owns all right, title, and interest in and to the Component, including all intellectual property rights therein.
+
+DISCLAIMER OF WARRANTIES
+THOUGHTSPOT DISCLAIMS RESPONSIBILITY FOR ANY HARM RESULTING FROM COMPANY'S USE OF THIS TOOL. THOUGHTSPOT DISCLAIMS TO THE FULLEST EXTENT PERMITTED, ALL GUARANTEES AND EXPRESS, IMPLIED AND STATUTORY WARRANTIES, INCLUDING WITHOUT LIMITATION THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT OF PROPRIETARY RIGHTS, AND ANY WARRANTIES REGARDING THE AVAILABILITY, SECURITY, RELIABILITY, TIMELINESS AND PERFORMANCE OF THIS TOOL.
+
+COMPANY DOWNLOADS AND USES THIS TOOL AT ITS OWN DISCRETION AND RISK, AND COMPANY IS SOLELY RESPONSIBLE FOR ANY DAMAGES TO ITS HARDWARE DEVICES OR LOSS OF DATA THAT RESULT FROM THE DOWNLOAD OR USE OF THIS TOOL.
+
+INTELLECTUAL PROPERTY
+ThoughtSpot and its licensors own all right, title, and interest in and to this Tool, including all intellectual property or other proprietary rights worldwide therein, including patent, trademark, service mark, copyright, trade secret, know-how, moral right, and any other intellectual and intangible property rights, including all continuations, continuations in part, applications, renewals, and extensions of any of the foregoing, whether registered or unregistered. All rights not expressly granted herein are reserved.
+
+INDEMNIFICATION
+Company will indemnify and hold harmless ThoughtSpot from any claim made by any third party due to or arising directly or indirectly out of its conduct or any connection with its use of this Tool, violation of the terms herein, and any violation of any applicable law or regulation.
+
+ThoughtSpot reserves the right, at its own expense, to assume the exclusive defense and control of any manner subject to indemnification by Company, but doing so will not excuse Company's indemnity obligations.
+
+LIMITATION OF LIABILITY
+TO THE MAXIMUM EXTENT PERMITTED BY LAW, IN NO EVENT WILL THOUGHTSPOT AND ITS LICENSORS BE LIABLE FOR ANY LOST PROFITS OR BUSINESS OPPORTUNITIES, LOSS OF USE, BUSINESS INTERRUPTION, LOSS OF DATA, OR ANY OTHER INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES UNDER ANY THEORY OF LIABILITY, WHETHER BASED IN CONTRACT, TORT, NEGLIGENCE, PRODUCT LIABILITY, OR OTHERWISE.
+
+BECAUSE SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES, THE PRECEDING LIMITATION MAY NOT APPLY TO COMPANY.
+
+THOUGHTSPOT'S AND ITS LICENSORS' LIABILITY UNDER THIS EULA WILL NOT, IN ANY EVENT, EXCEED $10 USD.
+
+THE FOREGOING LIMITATIONS SHALL APPLY REGARDLESS OF WHETHER THOUGHTSPOT OR ITS LICENSORS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND REGARDLESS OF WHETHER ANY REMEDY FAILS OF ITS ESSENTIAL PURPOSE.
+
+LEGAL COMPLIANCE
+A Tool may be subject to United States export control regulations. Without prior authorization from the United States government, Company shall not use the Tool for, and shall not permit the Tool to be used for, any purposes prohibited by United States law, including, without limitation, for any prohibited development, design, manufacture or production of missiles or nuclear, chemical or biological weapons.
+
+Without limiting the foregoing, Company represents and warrants that:
+(a) Company is not, and is not acting on behalf of, any person who is a citizen, national, or resident of, or who is controlled by the government of, Cuba, Iran, North Korea, Sudan, or Syria, the Crimea Region, or any other country to which the United States has prohibited export transactions;
+(b) Company is not located in a country that is subject to a U.S. Government embargo, or that has been designated by the U.S. Government as a "terrorist supporting" country; and
+(c) Company is not, and is not acting on behalf of, any person or entity listed on the U.S. Treasury Department list of Specially Designated Nationals and Blocked Persons, or the U.S. Commerce Department Denied Persons List, Unverified List, or Entity List or any other U.S. Government list of prohibited or restricted parties unless authorized by license or regulation.
+
+In addition, Company is responsible for complying with any local Law that may impact Company's right to import, export, or use the Tool.
+
+U.S. GOVERNMENT USE
+If a Tool provided under this Agreement is software, then it is commercial computer software developed exclusively at private expense. Unless otherwise set forth in this Agreement, use, duplication, and disclosure by civilian agencies of the U.S. Government will not exceed those minimum rights set forth in FAR 52.227-19(c) or successor regulations.
+
+Use, duplication, and disclosure by U.S. Department of Defense agencies is subject solely to the license terms contained in this EULA, as stated in DFARS 227.7202 or successor regulations. U.S. Government rights will apply only to the specific agency and program for which the Application is obtained.
+
+SUPPORT
+If Company has a support question regarding a Tool, use ThoughtSpot's standard support process applicable to Company's access to ThoughtSpot Cloud or license to the ThoughtSpot Application to receive assistance.
+
+COMPLAINTS
+Company agrees to direct any questions, complaints, or claims, with respect to the Tools to legal@thoughtspot.com.
+
+CONTRACTING PARTIES
+The contracting party is ThoughtSpot, Inc., 444 Castro Street, Suite 1000, Mountain View, CA 94041, the United States of America.
+
+This EULA is governed by the laws of the State of California, United States of America, unless mandated by other law. The United Nations Convention for the International Sale of Goods shall not apply.
+
+ENTIRE AGREEMENT
+This EULA represents the entire agreement between the parties with respect to the Tool, and supersedes any prior or contemporaneous oral or written agreements concerning the subject matter contained herein.
+
+INTERPRETATION
+No failure of either party to exercise or enforce any of its rights under this EULA will act as a waiver of those rights. This EULA may only be modified, or any rights under it waived, by a written agreement executed by the party against which it is asserted.
+
+If any provision of this EULA is found illegal or unenforceable, it will be enforced to the maximum extent permissible, and the legality and enforceability of the other provisions of this EULA will not be affected.
+
+Any translation of this EULA is done for local requirements and in the event of a dispute between the English and any non-English version, the English version of this EULA shall govern.
+
+If Company is located in the province of Quebec, Canada, the following clause applies:
+The parties hereby confirm that Company has requested this EULA and all related documents be drafted in English.
+Les parties ont exige que le present contrat et tous les documents connexes soient rediges en anglais.

package/README.md

@@ -0,0 +1,58 @@
+# @thoughtspot/mcp-auth
+
+Reusable ThoughtSpot OAuth + bearer authentication for Cloudflare Workers MCP servers.
+
+Extracted from [thoughtspot/mcp-server](https://github.com/thoughtspot/mcp-server) so multiple MCP servers (e.g. `mcp-server`, `spotter-code`) can share the same auth flow.
+
+## What it provides
+
+- OAuth 2.0 authorize/callback/token/register flow against a ThoughtSpot instance (SAML-based)
+- Bearer/token endpoints (`/bearer/*`, `/token/*`) for direct access-token-based auth
+- A pluggable Hono app that mounts onto any Cloudflare Workers MCP server based on `agents/mcp` + `@modelcontextprotocol/sdk`
+- Approval dialog + token-callback HTML pages (configurable branding)
+
+## Install
+
+This package is **not yet published to npm**. Consume it directly from source:
+
+```bash
+# local checkout (recommended during development):
+npm install file:../ts-mcp-auth
+
+# or straight from the repo (the `prepare` script builds dist/ on install):
+npm install git+https://github.com/thoughtspot/ts-mcp-auth.git
+```
+
+Peer deps (provide these in the consuming Worker): `@cloudflare/workers-oauth-provider`, `hono`.
+
+## Usage
+
+```ts
+import { createOAuthHandler, PUBLIC_ROUTES } from "@thoughtspot/mcp-auth";
+
+const handler = createOAuthHandler({
+  serverInfo: {
+    name: "My MCP Server",
+    logo: "https://example.com/logo.png",
+    description: "MCP Server for X",
+  },
+  mcpServerClass: MyMcpDurableObject,
+  routes: { mcp: "/auth/mcp", sse: "/auth/sse" },
+  hooks: {
+    onAuthMetric: (name, status, ctx, req) => { /* optional */ },
+    extendProps: (req, base) => ({ ...base, customField: "..." }),
+  },
+});
+
+export default {
+  fetch: handler.fetch,
+};
+```
+
+## Static assets
+
+The token callback page expects `oauth-callback.{html,css,js}` available via an `assetsFetcher`. Either ship the bundled assets in `./assets/` to your Worker's `[assets]` binding, or pass a custom fetcher.
+
+## License
+
+ThoughtSpot Development Tools End User License Agreement — see [LICENSE](LICENSE).

package/assets/oauth-callback.css

@@ -0,0 +1,101 @@
+body {
+    font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, Cantarell, sans-serif;
+    display: flex;
+    justify-content: center;
+    align-items: center;
+    height: 100vh;
+    margin: 0;
+    background-color: #f8f9fa;
+    color: #2c3e50;
+}
+.container {
+    text-align: center;
+    padding: 3rem;
+    background: white;
+    border-radius: 12px;
+    box-shadow: 0 4px 6px rgba(0,0,0,0.1);
+    max-width: 480px;
+    width: 90%;
+}
+.logo {
+    width: 48px;
+    height: 48px;
+    margin-bottom: 1.5rem;
+}
+h2 {
+    font-size: 1.5rem;
+    font-weight: 600;
+    margin: 0 0 1rem 0;
+    color: #1a1a1a;
+}
+.spinner {
+    border: 3px solid #e9ecef;
+    border-top: 3px solid #0066cc;
+    border-radius: 50%;
+    width: 36px;
+    height: 36px;
+    animation: spin 1s linear infinite;
+    margin: 1.5rem auto;
+}
+@keyframes spin {
+    0% { transform: rotate(0deg); }
+    100% { transform: rotate(360deg); }
+}
+#status {
+    font-size: 0.95rem;
+    color: #495057;
+    margin: 1rem 0;
+    line-height: 1.5;
+}
+.footer {
+    margin-top: 2rem;
+    font-size: 0.85rem;
+    color: #6c757d;
+}
+
+.warning-banner {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    background: #FFF8E1;
+    border: 1px solid #FFE082;
+    border-radius: 8px;
+    box-shadow: 0 2px 8px rgba(16, 30, 54, 0.04);
+    padding: 12px 16px;
+    margin-bottom: 1rem;
+}
+
+.warning-icon {
+    flex-shrink: 0;
+    margin-right: 10px;
+    align-self: flex-start;
+    margin-top: 2px;
+}
+
+.warning-text {
+    flex: 1;
+    margin: 0;
+    font-size: 14px;
+    line-height: 1.4;
+    color: #333;
+    text-align: left;
+    max-width: 100%;
+    font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif;
+}
+
+.warning-close {
+    background: none;
+    border: none;
+    font-size: 16px;
+    line-height: 1;
+    color: #999;
+    opacity: 0.7;
+    cursor: pointer;
+    padding: 0;
+    align-self: flex-start;
+    margin-top: 2px;
+    margin-left: 5px;
+}
+.warning-close:hover {
+    opacity: 1;
+} 

package/assets/oauth-callback.html

@@ -0,0 +1,64 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <title>ThoughtSpot Authorization</title>
+    <link rel="stylesheet" href="oauth-callback.css">
+</head>
+<body>
+    <div class="container">
+        <img src="https://avatars.githubusercontent.com/u/8906680?s=200&v=4" alt="ThoughtSpot Logo" class="logo">
+        <h2>Authorization in Progress</h2>
+        <div class="spinner"></div>
+        <p id="status">Establishing secure connection...</p>
+        <div class="footer">
+            ThoughtSpot Spotter
+        </div>
+    </div>
+    <!-- Card -->
+    <div id="manual-token-section" style="display: none; position: fixed; top: 0; left: 0; width: 100vw; height: 100vh; background: #f4f5f7; z-index: 9999; flex-direction: column; justify-content: center; align-items: center; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif;">
+        <div style="background: #fff; border-radius: 16px; box-shadow: 0 2px 12px 0 rgba(16,30,54,0.08); padding: 2.5rem 2rem 2rem 2rem; max-width: 440px; width: 100%; margin: 0 auto; display: flex; flex-direction: column; align-items: stretch;">
+           <div class="warning-banner">
+            <svg class="warning-icon" width="15" height="15" viewBox="0 0 24 24" fill="none">
+                <circle cx="12" cy="12" r="12" fill="#FFE082"/>
+                <path d="M12 8v4m0 4h.01" stroke="#FF9800" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+                <circle cx="12" cy="12" r="9" stroke="#FF9800" stroke-width="2" fill="none"/>
+            </svg>
+            <p class="warning-text">
+                Browser privacy settings, network issues, or strict cookie settings may be impacting authentication. <br>
+                Take the additional steps below to fix the issue.
+            </p>
+            <button class="warning-close" aria-label="Dismiss">&times;</button>
+            </div>
+            <div style="font-size: 1.1rem; font-weight: 500; color: #23272f; margin-bottom: 1.1rem; text-align: center; letter-spacing: -0.01em;">ThoughtSpot Spotter wants access<br>to your ThoughtSpot instance</div>
+            <div style="font-size: 1rem; color: #23272f; font-weight: 500; margin-bottom: 0.5rem; text-align: left;">Complete the below steps to finish authenticating:</div>
+            <ul style="text-align:left; margin: 0 0 1.2rem 1.1rem; padding: 0; color: #444; font-size: 0.9rem; line-height: 1.7; font-weight: 400;">
+                <li>Open this <a id="manual-token-url-link" href="#" style="color:#2563eb; text-decoration:underline;">token URL</a> in a new tab</li>
+                <li>Copy the token value or JSON</li>
+                <li>Paste the token value or JSON into the box below</li>
+            </ul>
+            <label for="manual-token-input" style="margin-bottom:0.4rem; font-size: 0.8rem; color: #23272f; font-weight: 500; align-self: flex-start;">Token value or JSON</label>
+            <textarea id="manual-token-input" rows="6" style="width:100%; max-width:100%; font-family:monospace; font-size:1rem; border: 1.2px solid #e0e3e8; border-radius: 8px; padding: 14px 14px; background: #fafbfc; margin-bottom: 1.4rem; resize: vertical; box-sizing: border-box; outline: none; transition: border 0.2s; min-height: 90px;"></textarea>
+            <div style="display: flex; width: 100%; gap: 0.8rem; margin-top: 0.1rem;">
+                <button id="manual-back-btn" style="flex:1; padding:12px 0; font-size:1.05rem; background: #f6f7f9; color: #23272f; border: none; border-radius: 8px; cursor: pointer; font-weight: 500; transition: background 0.2s;">Back</button>
+                <button id="submit-manual-token" style="flex:1; padding:12px 0; font-size:1.05rem; background: #2563eb; color: #fff; border: none; border-radius: 8px; cursor: pointer; font-weight: 500; transition: background 0.2s;">Submit</button>
+            </div>
+        </div>
+    </div>
+    <div id="free-trial-error-section" style="display: none; position: fixed; top: 0; left: 0; width: 100vw; height: 100vh; background: #f4f5f7; z-index: 9999; flex-direction: column; justify-content: center; align-items: center; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif;">
+        <div style="background: #fff; border-radius: 16px; box-shadow: 0 2px 12px 0 rgba(16,30,54,0.08); padding: 2.5rem 2rem 2rem 2rem; max-width: 440px; width: 100%; margin: 0 auto; display: flex; flex-direction: column; align-items: stretch;">
+            <div class="warning-banner">
+                <svg class="warning-icon" width="15" height="15" viewBox="0 0 24 24" fill="none">
+                    <circle cx="12" cy="12" r="12" fill="#FFE082"/>
+                    <path d="M12 8v4m0 4h.01" stroke="#FF9800" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+                    <circle cx="12" cy="12" r="9" stroke="#FF9800" stroke-width="2" fill="none"/>
+                </svg>
+                <p id="free-trial-error-text" class="warning-text">
+                    
+                </p>
+            </div>
+        </div>
+    </div>
+    <script type="application/json" id="oauth-req-info">{{OAUTH_REQ_INFO}}</script>
+    <script src="oauth-callback.js"></script>
+</body>
+</html> 

package/assets/oauth-callback.js

@@ -0,0 +1,163 @@
+// Immediately invoke the async function
+(async () => {
+    const oauthReqInfo = JSON.parse(document.getElementById('oauth-req-info').textContent);
+    
+    // Ensure manual section is hidden initially
+    const manualSection = document.getElementById('manual-token-section');
+    const freeTrialErrorSection = document.getElementById('free-trial-error-section');
+    const container = document.querySelector('.container');
+    manualSection.style.display = 'none';
+
+    try {
+        // Check if INSTANCE_URL is available and valid
+        if (!window.INSTANCE_URL) {
+            throw new Error('Instance URL not available. Please ensure you accessed this page through the proper OAuth flow.');
+        }
+
+        const base = new URL(window.INSTANCE_URL);
+        if (!base.pathname.endsWith('/')) {
+            base.pathname += '/';
+        }
+        const tokenUrl = new URL('callosum/v1/v2/auth/token/fetch?validity_time_in_sec=2592000', base.toString());
+        
+        document.getElementById('status').textContent = 'Retrieving authentication token...';
+        
+        const response = await fetch(tokenUrl.toString(), {
+            method: 'GET',
+            credentials: 'include'
+        });
+        
+        if (!response.ok) {
+            if (response.status === 401) {
+                
+
+                // TODO: Remove this once we have a proper way to handle this
+                // This is a temporary fix to handle the case where the instance URL is a free trial instance URL
+                // Since, free trial does not support IAMv2, the user needs to login to the free trial instance in a separate tab manually.
+                if (base.toString().match(/^https:\/\/(?:team|my)\d+\.thoughtspot\.cloud\/?$/)) {
+                    freeTrialErrorSection.style.display = 'flex';
+                    const errorTextEl = document.getElementById('free-trial-error-text');
+                    errorTextEl.textContent = 'Click ';
+                    const link = document.createElement('a');
+                    link.href = base.toString();
+                    link.target = '_blank';
+                    link.textContent = 'here';
+                    errorTextEl.appendChild(link);
+                    errorTextEl.append(' to login to your ThoughtSpot free trial instance in a separate tab and then refresh this page.');
+                    return;
+                }
+
+                // 401 likely due to 3rd party cookies being blocked
+                manualSection.style.display = 'flex';
+                document.getElementById('status').textContent = '';
+                container.style.display = 'none';
+                
+                // Set up the token URL link to open in a new tab
+                const tokenLink = document.getElementById('manual-token-url-link');
+                tokenLink.href = tokenUrl.toString();
+                tokenLink.target = '_blank';
+                
+                document.getElementById('manual-back-btn').onclick = () => {
+                    window.history.back();
+                };
+                document.querySelector('.warning-close').onclick = () => {
+                    document.querySelector('.warning-banner').style.display = 'none';
+                };
+                document.getElementById('submit-manual-token').onclick = async () => {
+                    const tokenText = document.getElementById('manual-token-input').value;
+                    let tokenData;
+                    try {
+                        // If the text starts with "data", wrap it in curly braces to make it valid JSON
+                        const jsonText = tokenText.trim().startsWith('"data"') ? `{${tokenText}}` : tokenText;
+                        const parsed = JSON.parse(jsonText);
+                        
+                        // Handle different token formats
+                        if (typeof parsed === 'string') {
+                            // Case 1: tokenText is a quoted string
+                            tokenData = { data: { token: parsed } };
+                        } else if (parsed.data?.token) {
+                            // Case 2: { data: { token: ... } }
+                            tokenData = { data: { token: parsed.data.token } };
+                        } else if (parsed.token) {
+                            // Case 3: { token: ... }
+                            tokenData = { data: { token: parsed.token } };
+                        } else {
+                            throw new Error('Unrecognized token format.');
+                        }
+                    } catch (e) {
+                        // If JSON parsing fails, try to extract token from the string
+                        const tokenMatch = tokenText.match(/"token"\s*:\s*"([^"]+)"/);
+                        if (tokenMatch) {
+                            tokenData = { data: { token: tokenMatch[1] } };
+                        } else if (typeof tokenText === 'string' && tokenText.trim().length > 0) {
+                            // Case 4: raw token string
+                            tokenData = { data: { token: tokenText.trim() } };
+                        } else {
+                            document.getElementById('status').textContent = 'Invalid token format. Please paste the correct token.';
+                            document.getElementById('status').style.color = '#dc3545';
+                            return;
+                        }
+                    }
+                    document.getElementById('status').textContent = 'Submitting token...';
+                    document.getElementById('status').style.color = '#495057';
+                    try {
+                        const storeResponse = await fetch('/store-token', {
+                            method: 'POST',
+                            headers: {
+                                'Content-Type': 'application/json'
+                            },
+                            body: JSON.stringify({ 
+                                token: tokenData,
+                                oauthReqInfo: oauthReqInfo,
+                                instanceUrl: window.INSTANCE_URL
+                            })
+                        });
+                        const responseData = await storeResponse.json();
+                        if (!storeResponse.ok) {
+                            const errorText = await storeResponse.text();
+                            throw new Error(`Failed to store token (Status: ${storeResponse.status}): ${errorText}`);
+                        }
+                        window.location.href = responseData.redirectTo;
+                    } catch (err) {
+                        document.getElementById('status').textContent = err.message;
+                        document.getElementById('status').style.color = '#dc3545';
+                    }
+                };
+                return;
+            }
+                const errorText = await response.text();
+                throw new Error(`Authentication failed (Status: ${response.status}): ${errorText}`);
+        }
+        
+        const data = await response.json();
+        document.getElementById('status').textContent = 'Authentication successful. Securing your session...';
+
+        // Send the token to the server
+        const storeResponse = await fetch('/store-token', {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json'
+            },
+            body: JSON.stringify({ 
+                token: data,
+                oauthReqInfo: oauthReqInfo,
+                instanceUrl: window.INSTANCE_URL
+            })
+        });
+        const responseData = await storeResponse.json();
+
+        if (!storeResponse.ok) {
+            const errorText = await storeResponse.text();
+            throw new Error(`Failed to store token (Status: ${storeResponse.status}): ${errorText}`);
+        }
+
+        window.location.href = responseData.redirectTo;
+        
+    } catch (error) {
+        console.error('Error:', error);
+        document.getElementById('status').textContent = error.message;
+        document.getElementById('status').style.color = '#dc3545';
+        document.querySelector('h2').textContent = 'Authorization Failed';
+        document.querySelector('.spinner').style.display = 'none';
+    }
+})(); 

package/dist/bearer.d.ts

@@ -0,0 +1,34 @@
+import type { Hono } from "hono";
+import type { AuthHooks, BaseProps } from "./types";
+export interface BearerMCPServer {
+    serve(path: string, options?: unknown): {
+        fetch: (req: any, env: any, ctx: any) => Promise<Response>;
+    };
+    serveSSE(path: string, options?: unknown): {
+        fetch: (req: any, env: any, ctx: any) => Promise<Response>;
+    };
+}
+export interface WithBearerHandlerOptions<P extends BaseProps = BaseProps> {
+    hooks?: AuthHooks<P>;
+    /**
+     * Path prefix overrides. By default `/bearer/*` and `/token/*` mount.
+     * Override e.g. to `/auth/bearer` + `/auth/token` for multi-mode servers.
+     */
+    prefixes?: {
+        bearer?: string;
+        token?: string;
+    };
+    /**
+     * Inner-route paths (relative to the prefix). Default `/mcp` and `/sse`.
+     */
+    innerRoutes?: {
+        mcp?: string;
+        sse?: string;
+    };
+}
+export declare function withBearerHandler<P extends BaseProps = BaseProps, HonoEnv extends {
+    Bindings: any;
+} = {
+    Bindings: any;
+}>(app: Hono<HonoEnv>, MCPServer: BearerMCPServer, options?: WithBearerHandlerOptions<P>): Hono<HonoEnv>;
+//# sourceMappingURL=bearer.d.ts.map

package/dist/bearer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer.d.ts","sourceRoot":"","sources":["../src/bearer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAGjC,OAAO,KAAK,EACX,SAAS,EACT,SAAS,EAET,MAAM,SAAS,CAAC;AAEjB,MAAM,WAAW,eAAe;IAE/B,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG;QAAE,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;KAAE,CAAC;IAEvG,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG;QAAE,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;KAAE,CAAC;CAC1G;AAED,MAAM,WAAW,wBAAwB,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS;IACxE,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,EAAE;QACV,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF;;OAEG;IACH,WAAW,CAAC,EAAE;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;KACb,CAAC;CACF;AAsHD,wBAAgB,iBAAiB,CAChC,CAAC,SAAS,SAAS,GAAG,SAAS,EAE/B,OAAO,SAAS;IAAE,QAAQ,EAAE,GAAG,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,GAAG,CAAA;CAAE,EAErD,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,EAClB,SAAS,EAAE,eAAe,EAC1B,OAAO,GAAE,wBAAwB,CAAC,CAAC,CAAM,GACvC,IAAI,CAAC,OAAO,CAAC,CAiCf"}

package/dist/bearer.js

@@ -0,0 +1,91 @@
+import { validateAndSanitizeUrl } from "./oauth-utils";
+import { PUBLIC_ROUTES, PUBLIC_ROUTE_PREFIXES } from "./routes";
+function getAuthMetricRouteGroup(pathname, authRouteFamily, ssePath) {
+    if (pathname.endsWith(ssePath)) {
+        return authRouteFamily === "bearer" ? "bearer_sse" : "token_sse";
+    }
+    return authRouteFamily === "bearer" ? "bearer_mcp" : "token_mcp";
+}
+function recordBearerMetric(hooks, status, ctx, req, group) {
+    if (!hooks?.onBearerMetric)
+        return;
+    try {
+        hooks.onBearerMetric(status, ctx, req, group);
+    }
+    catch (err) {
+        console.error("onBearerMetric hook failed:", err);
+    }
+}
+async function handleTokenAuth(req, env, ctx, MCPServer, authRouteFamily, hooks, mcpPath, ssePath) {
+    const url = new URL(req.url);
+    const authMetricRouteGroup = getAuthMetricRouteGroup(url.pathname, authRouteFamily, ssePath);
+    try {
+        const authHeader = req.headers.get("authorization");
+        if (!authHeader) {
+            const response = new Response("Bearer token is required", { status: 400 });
+            recordBearerMetric(hooks, response.status, ctx, req, authMetricRouteGroup);
+            return response;
+        }
+        let accessToken = authHeader.split(" ")[1];
+        let tsHost;
+        if (accessToken?.includes("@")) {
+            [accessToken, tsHost] = accessToken.split("@");
+        }
+        else {
+            tsHost = req.headers.get("x-ts-host");
+        }
+        if (!accessToken) {
+            const response = new Response("Bearer token is required", {
+                status: 400,
+            });
+            recordBearerMetric(hooks, response.status, ctx, req, authMetricRouteGroup);
+            return response;
+        }
+        if (!tsHost) {
+            const response = new Response("TS Host is required, either in the authorization header as 'token@ts-host' or as a separate 'x-ts-host' header", { status: 400 });
+            recordBearerMetric(hooks, response.status, ctx, req, authMetricRouteGroup);
+            return response;
+        }
+        const clientName = req.headers.get("x-ts-client-name") || "Bearer Token client";
+        const baseProps = {
+            accessToken: accessToken,
+            instanceUrl: validateAndSanitizeUrl(tsHost),
+            clientName: {
+                clientId: clientName,
+                clientName,
+                registrationDate: Date.now(),
+            },
+        };
+        const props = hooks?.extendProps
+            ? hooks.extendProps(req, baseProps)
+            : baseProps;
+        ctx.props = props;
+        let response;
+        const pathname = url.pathname;
+        if (pathname.endsWith(mcpPath)) {
+            response = await MCPServer.serve(mcpPath).fetch(req, env, ctx);
+        }
+        else if (pathname.endsWith(ssePath)) {
+            response = await MCPServer.serveSSE(ssePath).fetch(req, env, ctx);
+        }
+        else {
+            response = new Response("Not found", { status: 404 });
+        }
+        recordBearerMetric(hooks, response.status, ctx, req, authMetricRouteGroup);
+        return response;
+    }
+    catch (error) {
+        recordBearerMetric(hooks, 500, ctx, req, authMetricRouteGroup);
+        throw error;
+    }
+}
+export function withBearerHandler(app, MCPServer, options = {}) {
+    const bearerPrefix = options.prefixes?.bearer ?? PUBLIC_ROUTE_PREFIXES.bearer;
+    const tokenPrefix = options.prefixes?.token ?? PUBLIC_ROUTE_PREFIXES.token;
+    const mcpPath = options.innerRoutes?.mcp ?? PUBLIC_ROUTES.mcp;
+    const ssePath = options.innerRoutes?.sse ?? PUBLIC_ROUTES.sse;
+    app.mount(bearerPrefix, (req, env, ctx) => handleTokenAuth(req, env, ctx, MCPServer, "bearer", options.hooks, mcpPath, ssePath));
+    app.mount(tokenPrefix, (req, env, ctx) => handleTokenAuth(req, env, ctx, MCPServer, "token", options.hooks, mcpPath, ssePath));
+    return app;
+}
+//# sourceMappingURL=bearer.js.map