@thoughtspot/mcp-auth 1.0.0

package/dist/bearer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer.js","sourceRoot":"","sources":["../src/bearer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAmChE,SAAS,uBAAuB,CAC/B,QAAgB,EAChB,eAAgC,EAChC,OAAe;IAEf,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,OAAO,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;IAClE,CAAC;IACD,OAAO,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;AAClE,CAAC;AAED,SAAS,kBAAkB,CAC1B,KAA+B,EAC/B,MAAc,EACd,GAAqB,EACrB,GAAY,EACZ,KAA2B;IAE3B,IAAI,CAAC,KAAK,EAAE,cAAc;QAAE,OAAO;IACnC,IAAI,CAAC;QACJ,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;IACnD,CAAC;AACF,CAAC;AAED,KAAK,UAAU,eAAe,CAC7B,GAAY,EACZ,GAAY,EACZ,GAAqB,EACrB,SAA0B,EAC1B,eAAgC,EAChC,KAA+B,EAC/B,OAAe,EACf,OAAe;IAEf,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,oBAAoB,GAAG,uBAAuB,CACnD,GAAG,CAAC,QAAQ,EACZ,eAAe,EACf,OAAO,CACP,CAAC;IAEF,IAAI,CAAC;QACJ,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3E,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;YAC3E,OAAO,QAAQ,CAAC;QACjB,CAAC;QAED,IAAI,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,MAAqB,CAAC;QAE1B,IAAI,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACP,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,CAAC,WAAW,EAAE,CAAC;YAClB,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,0BAA0B,EAAE;gBACzD,MAAM,EAAE,GAAG;aACX,CAAC,CAAC;YACH,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;YAC3E,OAAO,QAAQ,CAAC;QACjB,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAC5B,gHAAgH,EAChH,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;YACF,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;YAC3E,OAAO,QAAQ,CAAC;QACjB,CAAC;QAED,MAAM,UAAU,GACf,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,qBAAqB,CAAC;QAE9D,MAAM,SAAS,GAAc;YAC5B,WAAW,EAAE,WAAW;YACxB,WAAW,EAAE,sBAAsB,CAAC,MAAM,CAAC;YAC3C,UAAU,EAAE;gBACX,QAAQ,EAAE,UAAU;gBACpB,UAAU;gBACV,gBAAgB,EAAE,IAAI,CAAC,GAAG,EAAE;aAC5B;SACD,CAAC;QAEF,MAAM,KAAK,GAAG,KAAK,EAAE,WAAW;YAC/B,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC;YACnC,CAAC,CAAE,SAAe,CAAC;QAEnB,GAA+B,CAAC,KAAK,GAAG,KAAK,CAAC;QAE/C,IAAI,QAAkB,CAAC;QACvB,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC9B,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;aAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,QAAQ,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACnE,CAAC;aAAM,CAAC;YACP,QAAQ,GAAG,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACvD,CAAC;QAED,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;QAC3E,OAAO,QAAQ,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,kBAAkB,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;QAC/D,MAAM,KAAK,CAAC;IACb,CAAC;AACF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAKhC,GAAkB,EAClB,SAA0B,EAC1B,UAAuC,EAAE;IAEzC,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,EAAE,MAAM,IAAI,qBAAqB,CAAC,MAAM,CAAC;IAC9E,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,EAAE,KAAK,IAAI,qBAAqB,CAAC,KAAK,CAAC;IAC3E,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,EAAE,GAAG,IAAI,aAAa,CAAC,GAAG,CAAC;IAC9D,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,EAAE,GAAG,IAAI,aAAa,CAAC,GAAG,CAAC;IAE9D,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CACzC,eAAe,CACd,GAAG,EACH,GAAG,EACH,GAAG,EACH,SAAS,EACT,QAAQ,EACR,OAAO,CAAC,KAAK,EACb,OAAO,EACP,OAAO,CACP,CACD,CAAC;IAEF,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CACxC,eAAe,CACd,GAAG,EACH,GAAG,EACH,GAAG,EACH,SAAS,EACT,OAAO,EACP,OAAO,CAAC,KAAK,EACb,OAAO,EACP,OAAO,CACP,CACD,CAAC;IAEF,OAAO,GAAG,CAAC;AACZ,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,14 @@
+export declare class McpServerError extends Error {
+    readonly errorJson: unknown;
+    readonly statusCode: number;
+    constructor(errorJson: unknown, statusCode: number);
+    toJSON(): {
+        name: string;
+        message: string;
+        statusCode: number;
+        errorJson: unknown;
+        stack: string | undefined;
+    };
+    getUserMessage(): string;
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,cAAe,SAAQ,KAAK;IACxC,SAAgB,SAAS,EAAE,OAAO,CAAC;IACnC,SAAgB,UAAU,EAAE,MAAM,CAAC;gBAEvB,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM;IAmBlD,MAAM;;;;;;;IAUN,cAAc,IAAI,MAAM;CAOxB"}

package/dist/errors.js

@@ -0,0 +1,34 @@
+export class McpServerError extends Error {
+    errorJson;
+    statusCode;
+    constructor(errorJson, statusCode) {
+        const message = typeof errorJson === "string"
+            ? errorJson
+            : errorJson?.message ||
+                errorJson?.error ||
+                "Unknown error occurred";
+        super(message);
+        this.name = "McpServerError";
+        this.errorJson = errorJson;
+        this.statusCode = statusCode;
+        console.error("Error:", this.message);
+        Object.setPrototypeOf(this, McpServerError.prototype);
+    }
+    toJSON() {
+        return {
+            name: this.name,
+            message: this.message,
+            statusCode: this.statusCode,
+            errorJson: this.errorJson,
+            stack: this.stack,
+        };
+    }
+    getUserMessage() {
+        const obj = this.errorJson;
+        if (typeof obj === "object" && obj?.userMessage) {
+            return obj.userMessage;
+        }
+        return this.message;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,cAAe,SAAQ,KAAK;IACxB,SAAS,CAAU;IACnB,UAAU,CAAS;IAEnC,YAAY,SAAkB,EAAE,UAAkB;QACjD,MAAM,OAAO,GACZ,OAAO,SAAS,KAAK,QAAQ;YAC5B,CAAC,CAAC,SAAS;YACX,CAAC,CAAE,SAAkD,EAAE,OAAO;gBAC5D,SAAkD,EAAE,KAAK;gBAC1D,wBAAwB,CAAC;QAE5B,KAAK,CAAC,OAAO,CAAC,CAAC;QAEf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAE7B,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAEtC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC;IACvD,CAAC;IAED,MAAM;QACL,OAAO;YACN,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;SACjB,CAAC;IACH,CAAC;IAED,cAAc;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,SAAwD,CAAC;QAC1E,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,EAAE,WAAW,EAAE,CAAC;YACjD,OAAO,GAAG,CAAC,WAAW,CAAC;QACxB,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC;IACrB,CAAC;CACD"}

package/dist/handlers.d.ts

@@ -0,0 +1,24 @@
+import type { OAuthHelpers } from "@cloudflare/workers-oauth-provider";
+import { Hono } from "hono";
+import type { AssetsFetcher, AuthHooks, BaseProps, ServerInfo } from "./types";
+export interface AuthAppEnv {
+    Bindings: {
+        OAUTH_PROVIDER: OAuthHelpers;
+        ASSETS?: AssetsFetcher;
+    } & Record<string, unknown>;
+}
+export interface CreateAuthAppOptions {
+    serverInfo: ServerInfo;
+    hooks?: AuthHooks<BaseProps>;
+    /**
+     * Custom assets fetcher. If omitted, the auth app will use `c.env.ASSETS`.
+     */
+    assetsFetcher?: AssetsFetcher;
+    /**
+     * Add extra routes to the Hono app after the auth routes are registered.
+     * Useful for consumer-specific endpoints (e.g. /hello, well-known files).
+     */
+    extraRoutes?: (app: Hono<AuthAppEnv>) => void;
+}
+export declare function createAuthApp(options: CreateAuthAppOptions): Hono<AuthAppEnv>;
+//# sourceMappingURL=handlers.d.ts.map

package/dist/handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../src/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAU5B,OAAO,KAAK,EACX,aAAa,EACb,SAAS,EAET,SAAS,EACT,UAAU,EACV,MAAM,SAAS,CAAC;AAEjB,MAAM,WAAW,UAAU;IAC1B,QAAQ,EAAE;QAAE,cAAc,EAAE,YAAY,CAAC;QAAC,MAAM,CAAC,EAAE,aAAa,CAAA;KAAE,GAAG,MAAM,CAC1E,MAAM,EACN,OAAO,CACP,CAAC;CACF;AAED,MAAM,WAAW,oBAAoB;IACpC,UAAU,EAAE,UAAU,CAAC;IACvB,KAAK,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;IAC7B;;OAEG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;OAGG;IACH,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC;CAC9C;AAyBD,wBAAgB,aAAa,CAC5B,OAAO,EAAE,oBAAoB,GAC3B,IAAI,CAAC,UAAU,CAAC,CA2UlB"}

package/dist/handlers.js

@@ -0,0 +1,242 @@
+import { Hono } from "hono";
+import { decodeBase64Url, encodeBase64Url } from "hono/utils/encode";
+import { McpServerError } from "./errors";
+import { buildSamlRedirectUrl, parseRedirectApproval, renderApprovalDialog, } from "./oauth-utils";
+import { renderTokenCallback } from "./token-utils";
+import { PUBLIC_ROUTES } from "./routes";
+function recordAuthMetric(hooks, name, status, c) {
+    if (!hooks?.onAuthMetric)
+        return;
+    try {
+        hooks.onAuthMetric(name, status, c.executionCtx, c.req.raw);
+    }
+    catch (err) {
+        console.error("onAuthMetric hook failed:", err);
+    }
+}
+async function wrap(hooks, name, fn) {
+    if (hooks?.wrapSpan)
+        return hooks.wrapSpan(name, fn);
+    return fn();
+}
+export function createAuthApp(options) {
+    const { serverInfo, hooks, assetsFetcher, extraRoutes } = options;
+    const app = new Hono();
+    const handler = {
+        async getAuthorize(request, oauthProvider) {
+            const oauthReqInfo = await oauthProvider.parseAuthRequest(request);
+            const { clientId } = oauthReqInfo;
+            if (!clientId) {
+                throw new McpServerError({ message: "Missing client ID" }, 400);
+            }
+            if (!oauthReqInfo.codeChallenge) {
+                throw new McpServerError({ message: "PKCE is required: missing code challenge" }, 400);
+            }
+            if (oauthReqInfo.codeChallengeMethod !== "S256") {
+                throw new McpServerError({ message: "PKCE code challenge method must be S256" }, 400);
+            }
+            const client = await oauthProvider.lookupClient(clientId);
+            return renderApprovalDialog(request, {
+                client,
+                serverInfo,
+                state: { oauthReqInfo },
+            });
+        },
+        async postAuthorize(request, requestUrl) {
+            try {
+                const { state, instanceUrl } = await parseRedirectApproval(request);
+                if (!state.oauthReqInfo) {
+                    throw new McpServerError({ message: "Missing OAuth request info" }, 400);
+                }
+                if (!instanceUrl) {
+                    throw new McpServerError({ message: "Missing instance URL" }, 400);
+                }
+                const origin = new URL(requestUrl).origin;
+                // Free-trial shortcut: skip SAML, assume logged in.
+                if (instanceUrl.match(/^https:\/\/(?:team|my)\d+\.thoughtspot\.cloud\/?$/)) {
+                    const callbackUrl = new URL("/callback", origin);
+                    callbackUrl.searchParams.set("instanceUrl", instanceUrl);
+                    callbackUrl.searchParams.set("oauthReqInfo", encodeBase64Url(new TextEncoder().encode(JSON.stringify(state.oauthReqInfo))
+                        .buffer));
+                    return callbackUrl.toString();
+                }
+                return buildSamlRedirectUrl(instanceUrl, state.oauthReqInfo, origin);
+            }
+            catch (error) {
+                if (error instanceof McpServerError)
+                    throw error;
+                throw new McpServerError(error, 500);
+            }
+        },
+        async handleCallback(request, assets, requestUrl) {
+            const url = new URL(request.url);
+            const instanceUrl = url.searchParams.get("instanceUrl");
+            const encodedOauthReqInfo = url.searchParams
+                .get("oauthReqInfo")
+                // Workaround for https://thoughtspot.atlassian.net/browse/SCAL-258056
+                ?.replace("/10023.html", "");
+            if (!instanceUrl) {
+                throw new McpServerError({ message: "Missing instance URL" }, 400);
+            }
+            if (!encodedOauthReqInfo) {
+                throw new McpServerError({ message: "Missing OAuth request info" }, 400);
+            }
+            let decodedOAuthReqInfo;
+            try {
+                decodedOAuthReqInfo = JSON.parse(new TextDecoder().decode(decodeBase64Url(encodedOauthReqInfo)));
+            }
+            catch (error) {
+                throw new McpServerError({ message: "Invalid OAuth request info format", details: error }, 400);
+            }
+            const origin = new URL(requestUrl).origin;
+            try {
+                return await renderTokenCallback(instanceUrl, decodedOAuthReqInfo, assets, origin);
+            }
+            catch (error) {
+                throw new McpServerError({ message: "Error rendering token callback", details: error }, 500);
+            }
+        },
+        async storeToken(request, oauthProvider) {
+            // biome-ignore lint/suspicious/noExplicitAny: payload shape is consumer-defined
+            let token;
+            // biome-ignore lint/suspicious/noExplicitAny: AuthRequest from oauth provider
+            let oauthReqInfo;
+            let instanceUrl;
+            try {
+                // biome-ignore lint/suspicious/noExplicitAny: free-form body
+                const body = (await request.json());
+                token = body.token;
+                oauthReqInfo = body.oauthReqInfo;
+                instanceUrl = body.instanceUrl;
+            }
+            catch (error) {
+                throw new McpServerError({ message: "Invalid JSON format", details: error }, 400);
+            }
+            if (!token || !oauthReqInfo || !instanceUrl) {
+                throw new McpServerError({ message: "Missing token or OAuth request info or instanceUrl" }, 400);
+            }
+            const { clientId } = oauthReqInfo;
+            if (!clientId) {
+                throw new McpServerError({ message: "Missing clientId" }, 400);
+            }
+            const clientName = await oauthProvider.lookupClient(clientId);
+            const props = {
+                accessToken: token.data.token,
+                instanceUrl: instanceUrl,
+                clientName: clientName,
+            };
+            const { redirectTo } = await oauthProvider.completeAuthorization({
+                request: oauthReqInfo,
+                userId: "default",
+                metadata: { label: "default" },
+                scope: oauthReqInfo.scope,
+                props,
+            });
+            return { redirectTo };
+        },
+    };
+    app.get(PUBLIC_ROUTES.authorize, async (c) => {
+        try {
+            const response = await wrap(hooks, "authorize-get", () => handler.getAuthorize(c.req.raw, c.env.OAUTH_PROVIDER));
+            recordAuthMetric(hooks, "oauth_authorize_requests_total", response.status, c);
+            return response;
+        }
+        catch (error) {
+            const response = c.text(`Internal Server Error ${error}`, 500);
+            recordAuthMetric(hooks, "oauth_authorize_requests_total", response.status, c);
+            return response;
+        }
+    });
+    app.post(PUBLIC_ROUTES.authorize, async (c) => {
+        try {
+            const redirectUrl = await wrap(hooks, "authorize-post", () => handler.postAuthorize(c.req.raw, c.req.url));
+            const response = Response.redirect(redirectUrl);
+            recordAuthMetric(hooks, "oauth_authorize_submit_total", response.status, c);
+            return response;
+        }
+        catch (error) {
+            if (error instanceof Error &&
+                error.message.includes("Missing instance URL")) {
+                const response = new Response("Missing instance URL", { status: 400 });
+                recordAuthMetric(hooks, "oauth_authorize_submit_total", response.status, c);
+                return response;
+            }
+            const response = new Response(`Internal Server Error ${error}`, {
+                status: 500,
+            });
+            recordAuthMetric(hooks, "oauth_authorize_submit_total", response.status, c);
+            return response;
+        }
+    });
+    app.get(PUBLIC_ROUTES.callback, async (c) => {
+        const assets = assetsFetcher ?? c.env.ASSETS;
+        if (!assets) {
+            const response = c.text("ASSETS binding required for OAuth callback rendering", 500);
+            recordAuthMetric(hooks, "oauth_callback_total", response.status, c);
+            return response;
+        }
+        try {
+            const htmlContent = await wrap(hooks, "oauth-callback", () => handler.handleCallback(c.req.raw, assets, c.req.url));
+            const response = new Response(htmlContent, {
+                headers: { "Content-Type": "text/html" },
+            });
+            recordAuthMetric(hooks, "oauth_callback_total", response.status, c);
+            return response;
+        }
+        catch (error) {
+            if (error instanceof Error) {
+                if (error.message.includes("Missing instance URL")) {
+                    const response = c.text(`Missing instance URL ${error}`, 400);
+                    recordAuthMetric(hooks, "oauth_callback_total", response.status, c);
+                    return response;
+                }
+                if (error.message.includes("Missing OAuth request info")) {
+                    const response = c.text(`Missing OAuth request info ${error}`, 400);
+                    recordAuthMetric(hooks, "oauth_callback_total", response.status, c);
+                    return response;
+                }
+                if (error.message.includes("Invalid OAuth request info format")) {
+                    const response = c.text(`Invalid OAuth request info format ${error}`, 400);
+                    recordAuthMetric(hooks, "oauth_callback_total", response.status, c);
+                    return response;
+                }
+            }
+            const response = c.text(`Internal server error ${error}`, 500);
+            recordAuthMetric(hooks, "oauth_callback_total", response.status, c);
+            return response;
+        }
+    });
+    app.post(PUBLIC_ROUTES.storeToken, async (c) => {
+        try {
+            const result = await wrap(hooks, "store-token", () => handler.storeToken(c.req.raw, c.env.OAUTH_PROVIDER));
+            const response = new Response(JSON.stringify(result), {
+                status: 200,
+                headers: { "Content-Type": "application/json" },
+            });
+            recordAuthMetric(hooks, "oauth_store_token_total", response.status, c);
+            return response;
+        }
+        catch (error) {
+            if (error instanceof Error) {
+                if (error.message.includes("Invalid JSON format")) {
+                    const response = c.text(`Invalid JSON format ${error}`, 400);
+                    recordAuthMetric(hooks, "oauth_store_token_total", response.status, c);
+                    return response;
+                }
+                if (error.message.includes("Missing token or OAuth request info or instanceUrl")) {
+                    const response = c.text(`Missing token or OAuth request info or instanceUrl ${error}`, 400);
+                    recordAuthMetric(hooks, "oauth_store_token_total", response.status, c);
+                    return response;
+                }
+            }
+            const response = c.text(`Internal server error ${error}`, 500);
+            recordAuthMetric(hooks, "oauth_store_token_total", response.status, c);
+            return response;
+        }
+    });
+    if (extraRoutes) {
+        extraRoutes(app);
+    }
+    return app;
+}
+//# sourceMappingURL=handlers.js.map

package/dist/handlers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers.js","sourceRoot":"","sources":["../src/handlers.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,EACN,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,GACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AA8BzC,SAAS,gBAAgB,CACxB,KAAuC,EACvC,IAAoB,EACpB,MAAc,EACd,CAA4D;IAE5D,IAAI,CAAC,KAAK,EAAE,YAAY;QAAE,OAAO;IACjC,IAAI,CAAC;QACJ,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;IACjD,CAAC;AACF,CAAC;AAED,KAAK,UAAU,IAAI,CAClB,KAAuC,EACvC,IAAY,EACZ,EAAoB;IAEpB,IAAI,KAAK,EAAE,QAAQ;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACrD,OAAO,EAAE,EAAE,CAAC;AACb,CAAC;AAED,MAAM,UAAU,aAAa,CAC5B,OAA6B;IAE7B,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAClE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAc,CAAC;IAEnC,MAAM,OAAO,GAAG;QACf,KAAK,CAAC,YAAY,CAAC,OAAgB,EAAE,aAA2B;YAC/D,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACnE,MAAM,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC;YAElC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACf,MAAM,IAAI,cAAc,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;YACjE,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,CAAC;gBACjC,MAAM,IAAI,cAAc,CACvB,EAAE,OAAO,EAAE,0CAA0C,EAAE,EACvD,GAAG,CACH,CAAC;YACH,CAAC;YACD,IAAI,YAAY,CAAC,mBAAmB,KAAK,MAAM,EAAE,CAAC;gBACjD,MAAM,IAAI,cAAc,CACvB,EAAE,OAAO,EAAE,yCAAyC,EAAE,EACtD,GAAG,CACH,CAAC;YACH,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YAC1D,OAAO,oBAAoB,CAAC,OAAO,EAAE;gBACpC,MAAM;gBACN,UAAU;gBACV,KAAK,EAAE,EAAE,YAAY,EAAE;aACvB,CAAC,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,OAAgB,EAAE,UAAkB;YACvD,IAAI,CAAC;gBACJ,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;gBAEpE,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;oBACzB,MAAM,IAAI,cAAc,CACvB,EAAE,OAAO,EAAE,4BAA4B,EAAE,EACzC,GAAG,CACH,CAAC;gBACH,CAAC;gBAED,IAAI,CAAC,WAAW,EAAE,CAAC;oBAClB,MAAM,IAAI,cAAc,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;gBACpE,CAAC;gBAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;gBAE1C,oDAAoD;gBACpD,IACC,WAAW,CAAC,KAAK,CAAC,mDAAmD,CAAC,EACrE,CAAC;oBACF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;oBACjD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;oBACzD,WAAW,CAAC,YAAY,CAAC,GAAG,CAC3B,cAAc,EACd,eAAe,CACd,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;yBAC1D,MAAqB,CACvB,CACD,CAAC;oBACF,OAAO,WAAW,CAAC,QAAQ,EAAE,CAAC;gBAC/B,CAAC;gBAED,OAAO,oBAAoB,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACtE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,KAAK,YAAY,cAAc;oBAAE,MAAM,KAAK,CAAC;gBACjD,MAAM,IAAI,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACtC,CAAC;QACF,CAAC;QAED,KAAK,CAAC,cAAc,CACnB,OAAgB,EAChB,MAAqB,EACrB,UAAkB;YAElB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACxD,MAAM,mBAAmB,GAAG,GAAG,CAAC,YAAY;iBAC1C,GAAG,CAAC,cAAc,CAAC;gBACpB,sEAAsE;gBACtE,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;YAE9B,IAAI,CAAC,WAAW,EAAE,CAAC;gBAClB,MAAM,IAAI,cAAc,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;YACpE,CAAC;YACD,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBAC1B,MAAM,IAAI,cAAc,CAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,EAAE,GAAG,CAAC,CAAC;YAC1E,CAAC;YAED,IAAI,mBAA4B,CAAC;YACjC,IAAI,CAAC;gBACJ,mBAAmB,GAAG,IAAI,CAAC,KAAK,CAC/B,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,mBAAmB,CAAC,CAAC,CAC9D,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,IAAI,cAAc,CACvB,EAAE,OAAO,EAAE,mCAAmC,EAAE,OAAO,EAAE,KAAK,EAAE,EAChE,GAAG,CACH,CAAC;YACH,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;YAC1C,IAAI,CAAC;gBACJ,OAAO,MAAM,mBAAmB,CAC/B,WAAW,EACX,mBAAmB,EACnB,MAAM,EACN,MAAM,CACN,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,IAAI,cAAc,CACvB,EAAE,OAAO,EAAE,gCAAgC,EAAE,OAAO,EAAE,KAAK,EAAE,EAC7D,GAAG,CACH,CAAC;YACH,CAAC;QACF,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,OAAgB,EAAE,aAA2B;YAC7D,gFAAgF;YAChF,IAAI,KAAU,CAAC;YACf,8EAA8E;YAC9E,IAAI,YAAiB,CAAC;YACtB,IAAI,WAA+B,CAAC;YAEpC,IAAI,CAAC;gBACJ,6DAA6D;gBAC7D,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAQ,CAAC;gBAC3C,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;gBACnB,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;gBACjC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;YAChC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,IAAI,cAAc,CACvB,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,KAAK,EAAE,EAClD,GAAG,CACH,CAAC;YACH,CAAC;YAED,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC7C,MAAM,IAAI,cAAc,CACvB,EAAE,OAAO,EAAE,oDAAoD,EAAE,EACjE,GAAG,CACH,CAAC;YACH,CAAC;YAED,MAAM,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC;YAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACf,MAAM,IAAI,cAAc,CAAC,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,GAAG,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YAE9D,MAAM,KAAK,GAAc;gBACxB,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK;gBAC7B,WAAW,EAAE,WAAW;gBACxB,UAAU,EAAE,UAAU;aACtB,CAAC;YAEF,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,aAAa,CAAC,qBAAqB,CAAC;gBAChE,OAAO,EAAE,YAAY;gBACrB,MAAM,EAAE,SAAS;gBACjB,QAAQ,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;gBAC9B,KAAK,EAAE,YAAY,CAAC,KAAK;gBACzB,KAAK;aACL,CAAC,CAAC;YAEH,OAAO,EAAE,UAAU,EAAE,CAAC;QACvB,CAAC;KACD,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5C,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,EAAE,CACxD,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CACrD,CAAC;YACF,gBAAgB,CACf,KAAK,EACL,gCAAgC,EAChC,QAAQ,CAAC,MAAM,EACf,CAAC,CACD,CAAC;YACF,OAAO,QAAQ,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,yBAAyB,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;YAC/D,gBAAgB,CACf,KAAK,EACL,gCAAgC,EAChC,QAAQ,CAAC,MAAM,EACf,CAAC,CACD,CAAC;YACF,OAAO,QAAQ,CAAC;QACjB,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7C,IAAI,CAAC;YACJ,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAC5D,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAC3C,CAAC;YACF,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAChD,gBAAgB,CACf,KAAK,EACL,8BAA8B,EAC9B,QAAQ,CAAC,MAAM,EACf,CAAC,CACD,CAAC;YACF,OAAO,QAAQ,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IACC,KAAK,YAAY,KAAK;gBACtB,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAC7C,CAAC;gBACF,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBACvE,gBAAgB,CACf,KAAK,EACL,8BAA8B,EAC9B,QAAQ,CAAC,MAAM,EACf,CAAC,CACD,CAAC;gBACF,OAAO,QAAQ,CAAC;YACjB,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,yBAAyB,KAAK,EAAE,EAAE;gBAC/D,MAAM,EAAE,GAAG;aACX,CAAC,CAAC;YACH,gBAAgB,CACf,KAAK,EACL,8BAA8B,EAC9B,QAAQ,CAAC,MAAM,EACf,CAAC,CACD,CAAC;YACF,OAAO,QAAQ,CAAC;QACjB,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3C,MAAM,MAAM,GAAG,aAAa,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;QAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CACtB,sDAAsD,EACtD,GAAG,CACH,CAAC;YACF,gBAAgB,CAAC,KAAK,EAAE,sBAAsB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACpE,OAAO,QAAQ,CAAC;QACjB,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAC5D,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CACpD,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,WAAW,EAAE;gBAC1C,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE;aACxC,CAAC,CAAC;YACH,gBAAgB,CAAC,KAAK,EAAE,sBAAsB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACpE,OAAO,QAAQ,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;gBAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;oBACpD,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,wBAAwB,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;oBAC9D,gBAAgB,CAAC,KAAK,EAAE,sBAAsB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;oBACpE,OAAO,QAAQ,CAAC;gBACjB,CAAC;gBACD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAC,EAAE,CAAC;oBAC1D,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,8BAA8B,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;oBACpE,gBAAgB,CAAC,KAAK,EAAE,sBAAsB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;oBACpE,OAAO,QAAQ,CAAC;gBACjB,CAAC;gBACD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,mCAAmC,CAAC,EAAE,CAAC;oBACjE,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CACtB,qCAAqC,KAAK,EAAE,EAC5C,GAAG,CACH,CAAC;oBACF,gBAAgB,CAAC,KAAK,EAAE,sBAAsB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;oBACpE,OAAO,QAAQ,CAAC;gBACjB,CAAC;YACF,CAAC;YACD,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,yBAAyB,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;YAC/D,gBAAgB,CAAC,KAAK,EAAE,sBAAsB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACpE,OAAO,QAAQ,CAAC;QACjB,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9C,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,CACpD,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CACnD,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;gBACrD,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAC/C,CAAC,CAAC;YACH,gBAAgB,CAAC,KAAK,EAAE,yBAAyB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACvE,OAAO,QAAQ,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;gBAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;oBACnD,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,uBAAuB,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;oBAC7D,gBAAgB,CACf,KAAK,EACL,yBAAyB,EACzB,QAAQ,CAAC,MAAM,EACf,CAAC,CACD,CAAC;oBACF,OAAO,QAAQ,CAAC;gBACjB,CAAC;gBACD,IACC,KAAK,CAAC,OAAO,CAAC,QAAQ,CACrB,oDAAoD,CACpD,EACA,CAAC;oBACF,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CACtB,sDAAsD,KAAK,EAAE,EAC7D,GAAG,CACH,CAAC;oBACF,gBAAgB,CACf,KAAK,EACL,yBAAyB,EACzB,QAAQ,CAAC,MAAM,EACf,CAAC,CACD,CAAC;oBACF,OAAO,QAAQ,CAAC;gBACjB,CAAC;YACF,CAAC;YACD,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,yBAAyB,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;YAC/D,gBAAgB,CAAC,KAAK,EAAE,yBAAyB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACvE,OAAO,QAAQ,CAAC;QACjB,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,IAAI,WAAW,EAAE,CAAC;QACjB,WAAW,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,GAAG,CAAC;AACZ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,9 @@
+export { PUBLIC_ROUTES, PUBLIC_ROUTE_PREFIXES, type PublicRoutes, type PublicRoutePrefixes, } from "./routes";
+export { McpServerError } from "./errors";
+export type { BaseProps, ServerInfo, AuthHooks, AuthMetricName, BearerAuthRouteGroup, AssetsFetcher, } from "./types";
+export { renderApprovalDialog, parseRedirectApproval, buildSamlRedirectUrl, validateAndSanitizeUrl, type ApprovalDialogOptions, type ParsedApprovalResult, } from "./oauth-utils";
+export { renderTokenCallback } from "./token-utils";
+export { createAuthApp, type CreateAuthAppOptions, type AuthAppEnv, } from "./handlers";
+export { withBearerHandler, type WithBearerHandlerOptions, type BearerMCPServer, } from "./bearer";
+export { createOAuthHandler, type CreateOAuthHandlerOptions, type MCPServerForOAuth, } from "./oauth-provider";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,aAAa,EACb,qBAAqB,EACrB,KAAK,YAAY,EACjB,KAAK,mBAAmB,GACxB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC1C,YAAY,EACX,SAAS,EACT,UAAU,EACV,SAAS,EACT,cAAc,EACd,oBAAoB,EACpB,aAAa,GACb,MAAM,SAAS,CAAC;AACjB,OAAO,EACN,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,GACzB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EACN,aAAa,EACb,KAAK,oBAAoB,EACzB,KAAK,UAAU,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EACN,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,eAAe,GACpB,MAAM,UAAU,CAAC;AAClB,OAAO,EACN,kBAAkB,EAClB,KAAK,yBAAyB,EAC9B,KAAK,iBAAiB,GACtB,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -0,0 +1,8 @@
+export { PUBLIC_ROUTES, PUBLIC_ROUTE_PREFIXES, } from "./routes";
+export { McpServerError } from "./errors";
+export { renderApprovalDialog, parseRedirectApproval, buildSamlRedirectUrl, validateAndSanitizeUrl, } from "./oauth-utils";
+export { renderTokenCallback } from "./token-utils";
+export { createAuthApp, } from "./handlers";
+export { withBearerHandler, } from "./bearer";
+export { createOAuthHandler, } from "./oauth-provider";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,aAAa,EACb,qBAAqB,GAGrB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAS1C,OAAO,EACN,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,GAGtB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EACN,aAAa,GAGb,MAAM,YAAY,CAAC;AACpB,OAAO,EACN,iBAAiB,GAGjB,MAAM,UAAU,CAAC;AAClB,OAAO,EACN,kBAAkB,GAGlB,MAAM,kBAAkB,CAAC"}

package/dist/oauth-provider.d.ts

@@ -0,0 +1,49 @@
+import { createAuthApp } from "./handlers";
+import type { AssetsFetcher, AuthHooks, BaseProps, ServerInfo } from "./types";
+export interface MCPServerForOAuth {
+    serve(path: string, options?: unknown): {
+        fetch: (req: any, env: any, ctx: any) => Promise<Response>;
+    };
+    serveSSE(path: string, options?: unknown): {
+        fetch: (req: any, env: any, ctx: any) => Promise<Response>;
+    };
+}
+export interface CreateOAuthHandlerOptions<P extends BaseProps = BaseProps> {
+    serverInfo: ServerInfo;
+    mcpServerClass: MCPServerForOAuth;
+    /**
+     * Override the MCP/SSE paths handled by the OAuth provider.
+     * Default: { mcp: "/mcp", sse: "/sse" }.
+     * spotter-code mixed-mode usage: { mcp: "/auth/mcp", sse: "/auth/sse" }.
+     */
+    routes?: {
+        mcp?: string;
+        sse?: string;
+        authorize?: string;
+        oauthToken?: string;
+        register?: string;
+    };
+    hooks?: AuthHooks<P>;
+    assetsFetcher?: AssetsFetcher;
+    /**
+     * Hook to wrap the inner MCP fetch (e.g. apply per-request prop injection
+     * outside the bearer flow). Receives the request + injects props.
+     */
+    enrichMcpRequestProps?: (req: Request, ctx: ExecutionContext, baseProps: BaseProps) => P;
+    /**
+     * Mount extra Hono routes onto the default handler (e.g. `/hello`, well-known files).
+     * Runs after auth routes are registered.
+     */
+    extraRoutes?: Parameters<typeof createAuthApp>[0]["extraRoutes"];
+}
+/**
+ * Builds a Cloudflare Worker fetch handler that wraps an MCP DO with
+ * OAuth 2.0 + bearer/token authentication.
+ *
+ * Returns the OAuthProvider's `fetch` directly (consumers wrap with their own
+ * tracing/metrics/middleware).
+ */
+export declare function createOAuthHandler<P extends BaseProps = BaseProps>(options: CreateOAuthHandlerOptions<P>): {
+    fetch: ExportedHandlerFetchHandler;
+};
+//# sourceMappingURL=oauth-provider.d.ts.map

package/dist/oauth-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-provider.d.ts","sourceRoot":"","sources":["../src/oauth-provider.ts"],"names":[],"mappings":"AACA,OAAO,EAAmB,aAAa,EAAE,MAAM,YAAY,CAAC;AAG5D,OAAO,KAAK,EACX,aAAa,EACb,SAAS,EACT,SAAS,EACT,UAAU,EACV,MAAM,SAAS,CAAC;AAEjB,MAAM,WAAW,iBAAiB;IAEjC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG;QAAE,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;KAAE,CAAC;IAEvG,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG;QAAE,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;KAAE,CAAC;CAC1G;AAED,MAAM,WAAW,yBAAyB,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS;IACzE,UAAU,EAAE,UAAU,CAAC;IACvB,cAAc,EAAE,iBAAiB,CAAC;IAClC;;;;OAIG;IACH,MAAM,CAAC,EAAE;QACR,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IACrB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;OAGG;IACH,qBAAqB,CAAC,EAAE,CACvB,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,gBAAgB,EACrB,SAAS,EAAE,SAAS,KAChB,CAAC,CAAC;IACP;;;OAGG;IACH,WAAW,CAAC,EAAE,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;CACjE;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,EACjE,OAAO,EAAE,yBAAyB,CAAC,CAAC,CAAC,GACnC;IAAE,KAAK,EAAE,2BAA2B,CAAA;CAAE,CAyDxC"}

package/dist/oauth-provider.js

@@ -0,0 +1,55 @@
+import OAuthProvider from "@cloudflare/workers-oauth-provider";
+import { createAuthApp } from "./handlers";
+import { withBearerHandler } from "./bearer";
+import { PUBLIC_ROUTES } from "./routes";
+/**
+ * Builds a Cloudflare Worker fetch handler that wraps an MCP DO with
+ * OAuth 2.0 + bearer/token authentication.
+ *
+ * Returns the OAuthProvider's `fetch` directly (consumers wrap with their own
+ * tracing/metrics/middleware).
+ */
+export function createOAuthHandler(options) {
+    const mcpPath = options.routes?.mcp ?? PUBLIC_ROUTES.mcp;
+    const ssePath = options.routes?.sse ?? PUBLIC_ROUTES.sse;
+    const authorizeEndpoint = options.routes?.authorize ?? PUBLIC_ROUTES.authorize;
+    const tokenEndpoint = options.routes?.oauthToken ?? PUBLIC_ROUTES.oauthToken;
+    const registerEndpoint = options.routes?.register ?? PUBLIC_ROUTES.register;
+    const honoApp = createAuthApp({
+        serverInfo: options.serverInfo,
+        hooks: options.hooks,
+        assetsFetcher: options.assetsFetcher,
+        extraRoutes: options.extraRoutes,
+    });
+    withBearerHandler(honoApp, options.mcpServerClass, {
+        hooks: options.hooks,
+    });
+    // Builds the per-route MCP serve router with optional props enrichment.
+    function buildMcpRouter(path, method) {
+        return {
+            async fetch(request, env, ctx) {
+                if (options.enrichMcpRequestProps) {
+                    const originalProps = ctx.props ?? {};
+                    ctx.props =
+                        options.enrichMcpRequestProps(request, ctx, originalProps);
+                }
+                return options.mcpServerClass[method](path).fetch(request, env, ctx);
+            },
+        };
+    }
+    const oauthProvider = new OAuthProvider({
+        apiHandlers: {
+            [mcpPath]: buildMcpRouter(mcpPath, "serve"),
+            [ssePath]: buildMcpRouter(ssePath, "serveSSE"),
+        },
+        // biome-ignore lint/suspicious/noExplicitAny: OAuthProvider types are loose
+        defaultHandler: honoApp,
+        authorizeEndpoint,
+        tokenEndpoint,
+        clientRegistrationEndpoint: registerEndpoint,
+    });
+    return {
+        fetch: ((request, env, ctx) => oauthProvider.fetch(request, env, ctx)),
+    };
+}
+//# sourceMappingURL=oauth-provider.js.map

package/dist/oauth-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-provider.js","sourceRoot":"","sources":["../src/oauth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,MAAM,oCAAoC,CAAC;AAC/D,OAAO,EAAmB,aAAa,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAgDzC;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CACjC,OAAqC;IAErC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,aAAa,CAAC,GAAG,CAAC;IACzD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,aAAa,CAAC,GAAG,CAAC;IACzD,MAAM,iBAAiB,GAAG,OAAO,CAAC,MAAM,EAAE,SAAS,IAAI,aAAa,CAAC,SAAS,CAAC;IAC/E,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,EAAE,UAAU,IAAI,aAAa,CAAC,UAAU,CAAC;IAC7E,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,IAAI,aAAa,CAAC,QAAQ,CAAC;IAE5E,MAAM,OAAO,GAAG,aAAa,CAAC;QAC7B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,KAAK,EAAE,OAAO,CAAC,KAAyC;QACxD,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,WAAW,EAAE,OAAO,CAAC,WAAW;KAChC,CAAC,CAAC;IAEH,iBAAiB,CAAgB,OAAO,EAAE,OAAO,CAAC,cAAc,EAAE;QACjE,KAAK,EAAE,OAAO,CAAC,KAAK;KACpB,CAAC,CAAC;IAEH,wEAAwE;IACxE,SAAS,cAAc,CAAC,IAAY,EAAE,MAA4B;QACjE,OAAO;YACN,KAAK,CAAC,KAAK,CACV,OAAgB,EAChB,GAAY,EACZ,GAAqB;gBAErB,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC;oBACnC,MAAM,aAAa,GACjB,GAAwC,CAAC,KAAK,IAAK,EAAgB,CAAC;oBACrE,GAA+B,CAAC,KAAK;wBACrC,OAAO,CAAC,qBAAqB,CAAC,OAAO,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;gBAC7D,CAAC;gBACD,OAAO,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YACtE,CAAC;SACD,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC;QACvC,WAAW,EAAE;YACZ,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,OAAO,EAAE,OAAO,CAAU;YACpD,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,OAAO,EAAE,UAAU,CAAU;SACvD;QACD,4EAA4E;QAC5E,cAAc,EAAE,OAAc;QAC9B,iBAAiB;QACjB,aAAa;QACb,0BAA0B,EAAE,gBAAgB;KAC5C,CAAC,CAAC;IAEH,OAAO;QACN,KAAK,EAAE,CAAC,CAAC,OAAgB,EAAE,GAAY,EAAE,GAAqB,EAAE,EAAE,CACjE,aAAa,CAAC,KAAK,CAClB,OAAO,EACP,GAAY,EACZ,GAAG,CACH,CAA2C;KAC7C,CAAC;AACH,CAAC"}

package/dist/oauth-utils.d.ts

@@ -0,0 +1,18 @@
+import type { AuthRequest, ClientInfo } from "@cloudflare/workers-oauth-provider";
+import type { ServerInfo } from "./types";
+export interface ApprovalDialogOptions {
+    client: ClientInfo | null;
+    serverInfo: ServerInfo;
+    state: Record<string, unknown>;
+}
+export declare function renderApprovalDialog(request: Request, options: ApprovalDialogOptions): Response;
+export interface ParsedApprovalResult {
+    state: {
+        oauthReqInfo?: AuthRequest;
+    } & Record<string, unknown>;
+    instanceUrl: string;
+}
+export declare function validateAndSanitizeUrl(url: string): string;
+export declare function parseRedirectApproval(request: Request): Promise<ParsedApprovalResult>;
+export declare function buildSamlRedirectUrl(instanceUrl: string, oauthReqInfo: unknown, callbackOrigin: string): string;
+//# sourceMappingURL=oauth-utils.d.ts.map

package/dist/oauth-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-utils.d.ts","sourceRoot":"","sources":["../src/oauth-utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,WAAW,EACX,UAAU,EACV,MAAM,oCAAoC,CAAC;AAE5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAW1C,MAAM,WAAW,qBAAqB;IACrC,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,UAAU,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,wBAAgB,oBAAoB,CACnC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,qBAAqB,GAC5B,QAAQ,CA+MV;AAYD,MAAM,WAAW,oBAAoB;IACpC,KAAK,EAAE;QAAE,YAAY,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChE,WAAW,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAuB1D;AAED,wBAAsB,qBAAqB,CAC1C,OAAO,EAAE,OAAO,GACd,OAAO,CAAC,oBAAoB,CAAC,CAqC/B;AAWD,wBAAgB,oBAAoB,CACnC,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,OAAO,EACrB,cAAc,EAAE,MAAM,GACpB,MAAM,CAUR"}