@thoughtspot/mcp-auth 1.0.0

package/dist/oauth-utils.js

@@ -0,0 +1,287 @@
+import { encodeBase64Url } from "hono/utils/encode";
+const DEFAULT_MCP_LOGO_URL = "https://raw.githubusercontent.com/thoughtspot/mcp-server/refs/heads/main/static/MCP%20Server%20Logo.svg";
+const DEFAULT_INSTANCE_LOGO_URL = "https://avatars.githubusercontent.com/u/8906680?s=200&v=4";
+const DEFAULT_TERMS_URL = "https://www.thoughtspot.com/legal/thoughtspot-for-apps";
+const DEFAULT_PRIVACY_URL = "https://www.thoughtspot.com/privacy-statement";
+const DEFAULT_SIGNUP_URL = "https://www.thoughtspot.com/trial";
+export function renderApprovalDialog(request, options) {
+    const { serverInfo, state, client } = options;
+    const encodedState = btoa(JSON.stringify(state));
+    const serverName = sanitizeHtml(serverInfo.name);
+    const mcpLogoUrl = serverInfo.mcpLogoUrl ?? DEFAULT_MCP_LOGO_URL;
+    const instanceLogoUrl = serverInfo.instanceLogoUrl ?? DEFAULT_INSTANCE_LOGO_URL;
+    const termsUrl = serverInfo.termsUrl ?? DEFAULT_TERMS_URL;
+    const privacyUrl = serverInfo.privacyUrl ?? DEFAULT_PRIVACY_URL;
+    const signupUrl = serverInfo.signupUrl ?? DEFAULT_SIGNUP_URL;
+    const approvalTitle = serverInfo.approvalTitle ??
+        `${serverName} wants access<br>to your ThoughtSpot instance`;
+    const clientUrl = client?.clientUri;
+    const tsInstanceUrlMatch = clientUrl?.match(/x-ts-host:(.*)/);
+    const tsInstanceUrl = tsInstanceUrlMatch ? tsInstanceUrlMatch[1].trim() : "";
+    const htmlContent = `
+      <!DOCTYPE html>
+      <html lang="en">
+        <head>
+          <meta charset="UTF-8">
+          <meta name="viewport" content="width=device-width, initial-scale=1.0">
+          <title>${serverName} | Authorization Request</title>
+          <style>
+            html, body {
+              height: 100%;
+              margin: 0;
+              padding: 0;
+              background: #f6f7fa;
+            }
+            body {
+              min-height: 100vh;
+              display: flex;
+              align-items: center;
+              justify-content: center;
+              font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif;
+              color: #111827;
+            }
+            .approval-card {
+              background: #fff;
+              border-radius: 18px;
+              box-shadow: 0 2px 16px 0 rgba(16,30,54,0.10), 0 1.5px 4px 0 rgba(16,30,54,0.06);
+              max-width: 520px;
+              width: 100%;
+              padding: 40px 32px 32px 32px;
+              box-sizing: border-box;
+              display: flex;
+              flex-direction: column;
+              align-items: center;
+            }
+            .approval-logos {
+              display: flex;
+              align-items: center;
+              justify-content: center;
+              margin-bottom: 32px;
+              gap: 40px;
+            }
+            .approval-logo {
+              width: 64px;
+              height: 64px;
+              object-fit: contain;
+              background: #fff;
+              border-radius: 12px;
+              box-shadow: 0 2px 8px rgba(0,0,0,0.04);
+            }
+            .approval-arrow {
+              width: 56px;
+              height: 32px;
+              display: flex;
+              align-items: center;
+              justify-content: center;
+            }
+            .approval-title {
+              font-size: 1.25rem;
+              font-weight: 700;
+              text-align: center;
+              margin: 0 0 32px 0;
+              line-height: 1.3;
+            }
+            .approval-form { width: 100%; display: flex; flex-direction: column; align-items: stretch; }
+            .form-group { margin-bottom: 28px; }
+            .form-group label { display: block; margin-bottom: 8px; font-weight: 400; font-size: 0.94rem; color: #111827; transition: color 0.2s; }
+            .form-group label.label-blue { color: #2563eb; }
+            .form-group label.label-red { color: #dc2626; }
+            .form-group input { width: 100%; padding: 14px 16px; border: 1.5px solid #d1d5db; border-radius: 8px; font-size: 0.94rem; background: #fff; box-sizing: border-box; transition: border-color 0.2s; }
+            .form-group input.input-blue { border-color: #2563eb; }
+            .form-group input.input-red { border-color: #dc2626; }
+            .approval-subtitle { font-weight: 600; font-size: 0.94rem; margin-bottom: 8px; margin-top: 0; }
+            .approval-permissions { margin: 0 0 32px 0; padding: 0 0 0 18px; list-style: disc; color: #111827; font-size: 0.94rem; }
+            .approval-permissions li { margin-bottom: 8px; line-height: 1.6; }
+            .approval-actions { display: flex; justify-content: space-between; gap: 16px; margin-bottom: 18px; }
+            .terms-checkbox { margin-bottom: 24px; display: flex; align-items: flex-start; gap: 8px; }
+            .terms-checkbox input[type="checkbox"] { margin-top: 3px; }
+            .terms-checkbox label { font-size: 0.94rem; line-height: 1.4; color: #111827; }
+            .terms-checkbox a { color: #2563eb; text-decoration: none; }
+            .terms-checkbox a:hover { text-decoration: underline; }
+            .button { flex: 1 1 0; padding: 12px 0; border-radius: 8px; font-weight: 500; font-size: 0.94rem; border: none; cursor: pointer; transition: background 0.2s, color 0.2s; }
+            .button-cancel { background: #f3f4f6; color: #6b7280; border: none; }
+            .button-cancel:hover { background: #e5e7eb; }
+            .button-allow { background: #2563eb; color: #fff; border: none; }
+            .button-allow:hover { background: #1a56db; }
+            .button-allow:disabled { background: #93c5fd; cursor: not-allowed; }
+            .approval-footer { text-align: center; font-size: 0.88rem; color: #111827; margin-top: 8px; }
+            .approval-footer a { color: #2563eb; text-decoration: none; margin-left: 0.25em; font-weight: 500; }
+            .approval-footer a:hover { text-decoration: underline; }
+            @media (max-width: 600px) {
+              .approval-card { padding: 18px 4vw 18px 4vw; max-width: 98vw; }
+              .approval-logos { gap: 18px; margin-bottom: 18px; }
+              .approval-title { font-size: 1.1rem; margin-bottom: 18px; }
+            }
+          </style>
+        </head>
+        <body>
+          <div class="approval-card">
+            <div class="approval-logos">
+              <img src="${mcpLogoUrl}" alt="MCP Server Logo" class="approval-logo">
+              <span class="approval-arrow">
+                <svg width="56" height="32" viewBox="0 0 56 32" fill="none" xmlns="http://www.w3.org/2000/svg">
+                  <g opacity="0.25">
+                    <line x1="8" y1="10" x2="48" y2="10" stroke="#6B7280" stroke-width="2.5" stroke-linecap="round"/>
+                    <polyline points="44,6 48,10 44,14" fill="none" stroke="#6B7280" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"/>
+                    <line x1="48" y1="22" x2="8" y2="22" stroke="#6B7280" stroke-width="2.5" stroke-linecap="round"/>
+                    <polyline points="12,18 8,22 12,26" fill="none" stroke="#6B7280" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"/>
+                  </g>
+                </svg>
+              </span>
+              <img src="${instanceLogoUrl}" alt="Instance Logo" class="approval-logo">
+            </div>
+            <div class="approval-title">${approvalTitle}</div>
+            <form class="approval-form" method="post" action="${new URL(request.url).pathname}" id="approvalForm" autocomplete="off" novalidate>
+              <div class="form-group">
+                <label for="instanceUrl" id="instanceUrlLabel">ThoughtSpot instance URL</label>
+                <input type="text" id="instanceUrl" name="instanceUrl" value="${tsInstanceUrl}" placeholder="https://your-instance.thoughtspot.cloud" autocomplete="off">
+                <input type="hidden" name="state" value="${encodedState}">
+              </div>
+              <div class="approval-subtitle">${serverName} will be able to:</div>
+              <ul class="approval-permissions">
+                <li>Read all ThoughtSpot data and content you have access to</li>
+                <li>Send data to the client you are connecting to</li>
+              </ul>
+              <div class="terms-checkbox">
+                <input type="checkbox" id="termsCheckbox" name="termsCheckbox" required>
+                <label for="termsCheckbox">
+                  By checking this box, I acknowledge and agree that my use of this application is subject to the ThoughtSpot
+                  <a href="${termsUrl}" target="_blank" rel="noopener noreferrer">Terms of Use</a>
+                  and <a href="${privacyUrl}" target="_blank" rel="noopener noreferrer">Privacy Statement</a>.
+                </label>
+              </div>
+              <div class="approval-actions">
+                <button type="button" class="button button-cancel" onclick="window.history.back()">Cancel</button>
+                <button type="submit" class="button button-allow" id="allowButton" disabled>Allow</button>
+              </div>
+            </form>
+            <div class="approval-footer">
+              Don't have an account?
+              <a href="${signupUrl}" target="_blank" rel="noopener noreferrer">Sign up</a>
+            </div>
+          </div>
+          <script>
+            const input = document.getElementById('instanceUrl');
+            const label = document.getElementById('instanceUrlLabel');
+            const form = document.getElementById('approvalForm');
+            const termsCheckbox = document.getElementById('termsCheckbox');
+            const allowButton = document.getElementById('allowButton');
+
+            function setBlue() {
+              input.classList.add('input-blue');
+              input.classList.remove('input-red');
+              label.classList.add('label-blue');
+              label.classList.remove('label-red');
+            }
+            function setRed() {
+              input.classList.add('input-red');
+              input.classList.remove('input-blue');
+              label.classList.add('label-red');
+              label.classList.remove('label-blue');
+            }
+            function clearColors() {
+              input.classList.remove('input-blue', 'input-red');
+              label.classList.remove('label-blue', 'label-red');
+            }
+            function updateAllowButton() {
+              allowButton.disabled = !(input.value.trim() && termsCheckbox.checked);
+            }
+            input.addEventListener('input', function() {
+              if (input.value.trim()) { setBlue(); } else { clearColors(); }
+              updateAllowButton();
+            });
+            termsCheckbox.addEventListener('change', updateAllowButton);
+            form.addEventListener('submit', function(e) {
+              if (!input.value.trim()) {
+                e.preventDefault(); setRed(); input.focus();
+              } else if (!termsCheckbox.checked) {
+                e.preventDefault(); termsCheckbox.focus();
+              } else {
+                setBlue();
+              }
+            });
+          </script>
+        </body>
+      </html>
+    `;
+    return new Response(htmlContent, {
+        headers: { "Content-Type": "text/html; charset=utf-8" },
+    });
+}
+function decodeState(encodedState) {
+    try {
+        const decoded = atob(encodedState);
+        return JSON.parse(decoded);
+    }
+    catch (e) {
+        console.error("Error decoding state:", e);
+        throw new Error("Invalid state format");
+    }
+}
+export function validateAndSanitizeUrl(url) {
+    try {
+        const trimmedUrl = url.trim();
+        const urlWithProtocol = trimmedUrl.startsWith("http://") || trimmedUrl.startsWith("https://")
+            ? trimmedUrl
+            : `https://${trimmedUrl}`;
+        const parsedUrl = new URL(urlWithProtocol);
+        if (parsedUrl.protocol !== "https:") {
+            throw new Error(`Only HTTPS URLs are allowed, received: ${parsedUrl.protocol}`);
+        }
+        return parsedUrl.origin;
+    }
+    catch (e) {
+        if (e instanceof Error) {
+            throw new Error(`Invalid URL: ${e.message}`);
+        }
+        throw new Error("Invalid URL format");
+    }
+}
+export async function parseRedirectApproval(request) {
+    if (request.method !== "POST") {
+        throw new Error("Invalid request method. Expected POST.");
+    }
+    let state;
+    let clientId;
+    let instanceUrl;
+    try {
+        const formData = await request.formData();
+        const encodedState = formData.get("state");
+        const rawInstanceUrl = formData.get("instanceUrl");
+        if (typeof encodedState !== "string" || !encodedState) {
+            throw new Error("Missing or invalid 'state' in form data.");
+        }
+        state = decodeState(encodedState);
+        clientId = state?.oauthReqInfo?.clientId;
+        if (!clientId) {
+            throw new Error("Could not extract clientId from state object.");
+        }
+        if (!rawInstanceUrl) {
+            throw new Error("Missing instance URL");
+        }
+        instanceUrl = validateAndSanitizeUrl(rawInstanceUrl);
+    }
+    catch (e) {
+        console.error("Error processing form submission:", e);
+        throw new Error(`Failed to parse approval form: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    return { state, instanceUrl };
+}
+function sanitizeHtml(unsafe) {
+    return unsafe
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#039;");
+}
+export function buildSamlRedirectUrl(instanceUrl, oauthReqInfo, callbackOrigin) {
+    const redirectUrl = new URL("callosum/v1/saml/login", instanceUrl);
+    const targetURLPath = new URL("/callback", callbackOrigin);
+    targetURLPath.searchParams.append("instanceUrl", instanceUrl);
+    const encodedState = encodeBase64Url(new TextEncoder().encode(JSON.stringify(oauthReqInfo)).buffer);
+    targetURLPath.searchParams.append("oauthReqInfo", encodedState);
+    redirectUrl.searchParams.append("targetURLPath", targetURLPath.href);
+    return redirectUrl.toString();
+}
+//# sourceMappingURL=oauth-utils.js.map

package/dist/oauth-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-utils.js","sourceRoot":"","sources":["../src/oauth-utils.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGpD,MAAM,oBAAoB,GACzB,yGAAyG,CAAC;AAC3G,MAAM,yBAAyB,GAC9B,2DAA2D,CAAC;AAC7D,MAAM,iBAAiB,GACtB,wDAAwD,CAAC;AAC1D,MAAM,mBAAmB,GAAG,+CAA+C,CAAC;AAC5E,MAAM,kBAAkB,GAAG,mCAAmC,CAAC;AAQ/D,MAAM,UAAU,oBAAoB,CACnC,OAAgB,EAChB,OAA8B;IAE9B,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,oBAAoB,CAAC;IACjE,MAAM,eAAe,GACpB,UAAU,CAAC,eAAe,IAAI,yBAAyB,CAAC;IACzD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IAC1D,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAChE,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC7D,MAAM,aAAa,GAClB,UAAU,CAAC,aAAa;QACxB,GAAG,UAAU,+CAA+C,CAAC;IAE9D,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,CAAC;IACpC,MAAM,kBAAkB,GAAG,SAAS,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC9D,MAAM,aAAa,GAAG,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAE7E,MAAM,WAAW,GAAG;;;;;;mBAMF,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0BA6FH,UAAU;;;;;;;;;;;0BAWV,eAAe;;0CAEC,aAAa;gEACS,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ;;;gFAGb,aAAa;2DAClC,YAAY;;+CAExB,UAAU;;;;;;;;;6BAS5B,QAAQ;iCACJ,UAAU;;;;;;;;;;yBAUlB,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA8C7B,CAAC;IACL,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE;QAChC,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;KACvD,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAI,YAAoB;IAC3C,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAM,CAAC;IACjC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACzC,CAAC;AACF,CAAC;AAOD,MAAM,UAAU,sBAAsB,CAAC,GAAW;IACjD,IAAI,CAAC;QACJ,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,eAAe,GACpB,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC;YACpE,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,WAAW,UAAU,EAAE,CAAC;QAE5B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;QAE3C,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACd,0CAA0C,SAAS,CAAC,QAAQ,EAAE,CAC9D,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC,MAAM,CAAC;IACzB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACZ,IAAI,CAAC,YAAY,KAAK,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACvC,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,OAAgB;IAEhB,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,KAA+D,CAAC;IACpE,IAAI,QAA4B,CAAC;IACjC,IAAI,WAA+B,CAAC;IACpC,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC1C,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,cAAc,GAAG,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAW,CAAC;QAE7D,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC7D,CAAC;QAED,KAAK,GAAG,WAAW,CAAiC,YAAY,CAAC,CAAC;QAClE,QAAQ,GAAG,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC;QAEzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,CAAC,cAAc,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACzC,CAAC;QAED,WAAW,GAAG,sBAAsB,CAAC,cAAc,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;QACtD,MAAM,IAAI,KAAK,CACd,kCAAkC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAC9E,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IACnC,OAAO,MAAM;SACX,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,oBAAoB,CACnC,WAAmB,EACnB,YAAqB,EACrB,cAAsB;IAEtB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,wBAAwB,EAAE,WAAW,CAAC,CAAC;IACnE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAC3D,aAAa,CAAC,YAAY,CAAC,MAAM,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,eAAe,CACnC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,MAAqB,CAC5E,CAAC;IACF,aAAa,CAAC,YAAY,CAAC,MAAM,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;IAChE,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,eAAe,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC;IACrE,OAAO,WAAW,CAAC,QAAQ,EAAE,CAAC;AAC/B,CAAC"}

package/dist/routes.d.ts

@@ -0,0 +1,21 @@
+export declare const PUBLIC_ROUTES: {
+    readonly root: "/";
+    readonly authorize: "/authorize";
+    readonly callback: "/callback";
+    readonly storeToken: "/store-token";
+    readonly oauthToken: "/token";
+    readonly register: "/register";
+    readonly mcp: "/mcp";
+    readonly sse: "/sse";
+    readonly bearerMcp: "/bearer/mcp";
+    readonly bearerSse: "/bearer/sse";
+    readonly tokenMcp: "/token/mcp";
+    readonly tokenSse: "/token/sse";
+};
+export type PublicRoutes = typeof PUBLIC_ROUTES;
+export declare const PUBLIC_ROUTE_PREFIXES: {
+    readonly bearer: "/bearer";
+    readonly token: "/token";
+};
+export type PublicRoutePrefixes = typeof PUBLIC_ROUTE_PREFIXES;
+//# sourceMappingURL=routes.d.ts.map

package/dist/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,aAAa;;;;;;;;;;;;;CAahB,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,OAAO,aAAa,CAAC;AAEhD,eAAO,MAAM,qBAAqB;;;CAGxB,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,OAAO,qBAAqB,CAAC"}

package/dist/routes.js

@@ -0,0 +1,19 @@
+export const PUBLIC_ROUTES = {
+    root: "/",
+    authorize: "/authorize",
+    callback: "/callback",
+    storeToken: "/store-token",
+    oauthToken: "/token",
+    register: "/register",
+    mcp: "/mcp",
+    sse: "/sse",
+    bearerMcp: "/bearer/mcp",
+    bearerSse: "/bearer/sse",
+    tokenMcp: "/token/mcp",
+    tokenSse: "/token/sse",
+};
+export const PUBLIC_ROUTE_PREFIXES = {
+    bearer: "/bearer",
+    token: "/token",
+};
+//# sourceMappingURL=routes.js.map

package/dist/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,aAAa,GAAG;IAC5B,IAAI,EAAE,GAAG;IACT,SAAS,EAAE,YAAY;IACvB,QAAQ,EAAE,WAAW;IACrB,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,QAAQ;IACpB,QAAQ,EAAE,WAAW;IACrB,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,MAAM;IACX,SAAS,EAAE,aAAa;IACxB,SAAS,EAAE,aAAa;IACxB,QAAQ,EAAE,YAAY;IACtB,QAAQ,EAAE,YAAY;CACb,CAAC;AAIX,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACpC,MAAM,EAAE,SAAS;IACjB,KAAK,EAAE,QAAQ;CACN,CAAC"}

package/dist/token-utils.d.ts

@@ -0,0 +1,3 @@
+import type { AssetsFetcher } from "./types";
+export declare function renderTokenCallback(instanceUrl: string, oauthReqInfo: unknown, assets: AssetsFetcher, origin: string): Promise<string>;
+//# sourceMappingURL=token-utils.d.ts.map

package/dist/token-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-utils.d.ts","sourceRoot":"","sources":["../src/token-utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C,wBAAsB,mBAAmB,CACxC,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,OAAO,EACrB,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CAoEjB"}

package/dist/token-utils.js

@@ -0,0 +1,57 @@
+export async function renderTokenCallback(instanceUrl, oauthReqInfo, assets, origin) {
+    const parsedOAuthReqInfo = typeof oauthReqInfo === "string" ? JSON.parse(oauthReqInfo) : oauthReqInfo;
+    const oauthReqInfoJson = JSON.stringify(parsedOAuthReqInfo);
+    try {
+        const htmlResponse = await assets.fetch(`${origin}/oauth-callback.html`);
+        if (!htmlResponse.ok) {
+            throw new Error("Failed to load oauth-callback.html");
+        }
+        let htmlContent = await htmlResponse.text();
+        const cssResponse = await assets.fetch(`${origin}/oauth-callback.css`);
+        if (!cssResponse.ok) {
+            throw new Error("Failed to load oauth-callback.css");
+        }
+        const css = await cssResponse.text();
+        const jsResponse = await assets.fetch(`${origin}/oauth-callback.js`);
+        if (!jsResponse.ok) {
+            throw new Error("Failed to load oauth-callback.js");
+        }
+        const js = await jsResponse.text();
+        htmlContent = htmlContent.replace("{{OAUTH_REQ_INFO}}", oauthReqInfoJson);
+        htmlContent = htmlContent.replace('<link rel="stylesheet" href="oauth-callback.css">', `<style>${css}</style>`);
+        htmlContent = htmlContent.replace('<script src="oauth-callback.js"></script>', `<script>window.INSTANCE_URL = '${instanceUrl}';</script>\n    <script>${js}</script>`);
+        return htmlContent;
+    }
+    catch (error) {
+        console.error("Error loading static files:", error);
+        return `
+        <!DOCTYPE html>
+        <html>
+        <head>
+            <title>Error - Authorization</title>
+            <style>
+                body {
+                    font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
+                    display: flex; justify-content: center; align-items: center;
+                    height: 100vh; margin: 0; background-color: #f8f9fa; color: #2c3e50;
+                }
+                .container {
+                    text-align: center; padding: 3rem; background: white;
+                    border-radius: 12px; box-shadow: 0 4px 6px rgba(0,0,0,0.1);
+                    max-width: 480px; width: 90%;
+                }
+                h2 { color: #dc3545; margin-bottom: 1rem; }
+            </style>
+        </head>
+        <body>
+            <div class="container">
+                <h2>Authorization Error</h2>
+                <p>Failed to load authorization page. Please try again or contact support.</p>
+                <p>Error: ${error instanceof Error ? error.message : "Unknown error"}</p>
+            </div>
+        </body>
+        </html>
+        `;
+    }
+}
+//# sourceMappingURL=token-utils.js.map

package/dist/token-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-utils.js","sourceRoot":"","sources":["../src/token-utils.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,WAAmB,EACnB,YAAqB,EACrB,MAAqB,EACrB,MAAc;IAEd,MAAM,kBAAkB,GACvB,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IAC5E,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAE5D,IAAI,CAAC;QACJ,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,sBAAsB,CAAC,CAAC;QACzE,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,WAAW,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;QAE5C,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,qBAAqB,CAAC,CAAC;QACvE,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC;QAErC,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,oBAAoB,CAAC,CAAC;QACrE,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC;QAEnC,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,CAAC;QAE1E,WAAW,GAAG,WAAW,CAAC,OAAO,CAChC,mDAAmD,EACnD,UAAU,GAAG,UAAU,CACvB,CAAC;QAEF,WAAW,GAAG,WAAW,CAAC,OAAO,CAChC,2CAA2C,EAC3C,kCAAkC,WAAW,4BAA4B,EAAE,WAAW,CACtF,CAAC;QAEF,OAAO,WAAW,CAAC;IACpB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;QACpD,OAAO;;;;;;;;;;;;;;;;;;;;;;;4BAuBmB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;;;;SAI3E,CAAC;IACT,CAAC;AACF,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,56 @@
+import type { ClientInfo } from "@cloudflare/workers-oauth-provider";
+/**
+ * Minimum props injected into the MCP server context after successful auth.
+ * Consumers can extend via `extendProps` hook.
+ */
+export interface BaseProps {
+    accessToken: string;
+    instanceUrl: string;
+    clientName: ClientInfo | {
+        clientId: string;
+        clientName: string;
+        registrationDate: number;
+    } | null;
+}
+/**
+ * Branding for approval dialog + token callback pages.
+ */
+export interface ServerInfo {
+    name: string;
+    logo?: string;
+    description?: string;
+    /** Logo for the approval dialog (left side). Defaults to MCP logo. */
+    mcpLogoUrl?: string;
+    /** Logo for the right side (target service). Defaults to ThoughtSpot logo. */
+    instanceLogoUrl?: string;
+    termsUrl?: string;
+    privacyUrl?: string;
+    signupUrl?: string;
+    /** Approval dialog title. Defaults to "<name> wants access to your ThoughtSpot instance". */
+    approvalTitle?: string;
+}
+export type AuthMetricName = "oauth_authorize_requests_total" | "oauth_authorize_submit_total" | "oauth_callback_total" | "oauth_store_token_total";
+export type BearerAuthRouteGroup = "bearer_mcp" | "bearer_sse" | "token_mcp" | "token_sse";
+export interface AuthHooks<P extends BaseProps = BaseProps> {
+    /** Called on each OAuth flow request with the response status. Use to record metrics. */
+    onAuthMetric?: (name: AuthMetricName, status: number, ctx: ExecutionContext, req: Request) => void;
+    /** Called on each bearer/token MCP request. */
+    onBearerMetric?: (status: number, ctx: ExecutionContext, req: Request, group: BearerAuthRouteGroup) => void;
+    /**
+     * Extend the props object set onto the execution context before MCP handler runs.
+     * Use to stamp custom fields (e.g. api version) from request headers/query params.
+     */
+    extendProps?: (req: Request, base: BaseProps) => P;
+    /**
+     * Optional span wrapper for tracing each auth handler invocation.
+     * Defaults to identity (no tracing).
+     */
+    wrapSpan?: <T>(name: string, fn: () => Promise<T>) => Promise<T>;
+}
+/**
+ * Pluggable static asset fetcher. Cloudflare Workers `env.ASSETS` satisfies this shape.
+ */
+export interface AssetsFetcher {
+    fetch(input: string | URL | Request): Promise<Response>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AAErE;;;GAGG;AACH,MAAM,WAAW,SAAS;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EACP,UAAU,GACV;QACA,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,gBAAgB,EAAE,MAAM,CAAC;KACxB,GACD,IAAI,CAAC;CACR;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6FAA6F;IAC7F,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,cAAc,GACvB,gCAAgC,GAChC,8BAA8B,GAC9B,sBAAsB,GACtB,yBAAyB,CAAC;AAE7B,MAAM,MAAM,oBAAoB,GAC7B,YAAY,GACZ,YAAY,GACZ,WAAW,GACX,WAAW,CAAC;AAEf,MAAM,WAAW,SAAS,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS;IACzD,yFAAyF;IACzF,YAAY,CAAC,EAAE,CACd,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,gBAAgB,EACrB,GAAG,EAAE,OAAO,KACR,IAAI,CAAC;IACV,+CAA+C;IAC/C,cAAc,CAAC,EAAE,CAChB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,gBAAgB,EACrB,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,oBAAoB,KACvB,IAAI,CAAC;IACV;;;OAGG;IACH,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,KAAK,CAAC,CAAC;IACnD;;;OAGG;IACH,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;CACjE;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC7B,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACxD"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,58 @@
+{
+  "name": "@thoughtspot/mcp-auth",
+  "version": "1.0.0",
+  "description": "Reusable ThoughtSpot OAuth + bearer auth layer for Cloudflare Workers MCP servers",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./assets/*": "./assets/*"
+  },
+  "files": [
+    "dist",
+    "assets",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "clean": "rm -rf dist",
+    "test": "vitest run",
+    "format": "biome format --write",
+    "lint": "biome lint",
+    "prepare": "npm run build"
+  },
+  "keywords": [
+    "thoughtspot",
+    "mcp",
+    "oauth",
+    "cloudflare",
+    "workers"
+  ],
+  "author": "ThoughtSpot",
+  "license": "ThoughtSpot End user license agreement",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/thoughtspot/ts-mcp-auth.git"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "peerDependencies": {
+    "@cloudflare/workers-oauth-provider": "^0.0.5",
+    "hono": "^4.12.21"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "^1.9.4",
+    "@cloudflare/workers-oauth-provider": "^0.0.5",
+    "@cloudflare/workers-types": "^4.20250612.0",
+    "@types/node": "^22.15.3",
+    "hono": "^4.12.21",
+    "typescript": "^5.8.3",
+    "vitest": "^3.1.2"
+  }
+}