@toolsdk.ai/registry 1.0.131 → 1.0.133

package/dist/domains/oauth/__tests__/oauth-utils.test.js

@@ -0,0 +1,284 @@
+import { describe, expect, it } from "vitest";
+import { buildAuthorizationUrl, generatePKCE, generateSessionId, generateState, getCanonicalResourceUri, parseWWWAuthenticate, verifyPKCESupport, } from "../oauth-utils";
+describe("oauth-utils", () => {
+    describe("generatePKCE", () => {
+        it("should generate valid PKCE parameters", () => {
+            // Act
+            const pkce = generatePKCE();
+            // Assert
+            expect(pkce).toHaveProperty("codeVerifier");
+            expect(pkce).toHaveProperty("codeChallenge");
+            expect(pkce).toHaveProperty("codeChallengeMethod");
+            expect(pkce.codeChallengeMethod).toBe("S256");
+        });
+        it("should generate code verifier with correct length (43 chars base64url)", () => {
+            // Act
+            const pkce = generatePKCE();
+            // Assert - 32 bytes base64url encoded = 43 characters
+            expect(pkce.codeVerifier.length).toBe(43);
+        });
+        it("should generate code challenge with correct length", () => {
+            // Act
+            const pkce = generatePKCE();
+            // Assert - SHA256 hash (32 bytes) base64url encoded = 43 characters
+            expect(pkce.codeChallenge.length).toBe(43);
+        });
+        it("should generate different values each time", () => {
+            // Act
+            const pkce1 = generatePKCE();
+            const pkce2 = generatePKCE();
+            // Assert
+            expect(pkce1.codeVerifier).not.toBe(pkce2.codeVerifier);
+            expect(pkce1.codeChallenge).not.toBe(pkce2.codeChallenge);
+        });
+        it("should generate base64url encoded values (no +, /, =)", () => {
+            // Act
+            const pkce = generatePKCE();
+            // Assert - base64url should not contain +, /, or =
+            expect(pkce.codeVerifier).not.toMatch(/[+/=]/);
+            expect(pkce.codeChallenge).not.toMatch(/[+/=]/);
+        });
+    });
+    describe("generateState", () => {
+        it("should generate a valid UUID", () => {
+            // Act
+            const state = generateState();
+            // Assert - UUID format: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+            expect(state).toMatch(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i);
+        });
+        it("should generate different values each time", () => {
+            // Act
+            const state1 = generateState();
+            const state2 = generateState();
+            // Assert
+            expect(state1).not.toBe(state2);
+        });
+    });
+    describe("generateSessionId", () => {
+        it("should generate a valid UUID", () => {
+            // Act
+            const sessionId = generateSessionId();
+            // Assert
+            expect(sessionId).toMatch(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i);
+        });
+        it("should generate different values each time", () => {
+            // Act
+            const id1 = generateSessionId();
+            const id2 = generateSessionId();
+            // Assert
+            expect(id1).not.toBe(id2);
+        });
+    });
+    describe("parseWWWAuthenticate", () => {
+        it("should parse complete WWW-Authenticate header", () => {
+            // Arrange
+            const header = 'Bearer realm="mcp", resource_metadata="http://localhost:3001/.well-known/oauth-protected-resource", scope="read write"';
+            // Act
+            const result = parseWWWAuthenticate(header);
+            // Assert
+            expect(result).toEqual({
+                realm: "mcp",
+                resourceMetadataUrl: "http://localhost:3001/.well-known/oauth-protected-resource",
+                scope: "read write",
+            });
+        });
+        it("should parse header with only realm", () => {
+            // Arrange
+            const header = 'Bearer realm="example"';
+            // Act
+            const result = parseWWWAuthenticate(header);
+            // Assert
+            expect(result).toEqual({
+                realm: "example",
+            });
+        });
+        it("should parse header with only resource_metadata", () => {
+            // Arrange
+            const header = 'Bearer resource_metadata="http://example.com/.well-known/oauth-protected-resource"';
+            // Act
+            const result = parseWWWAuthenticate(header);
+            // Assert
+            expect(result).toEqual({
+                resourceMetadataUrl: "http://example.com/.well-known/oauth-protected-resource",
+            });
+        });
+        it("should return empty object for empty header", () => {
+            // Arrange
+            const header = "Bearer";
+            // Act
+            const result = parseWWWAuthenticate(header);
+            // Assert
+            expect(result).toEqual({});
+        });
+    });
+    describe("verifyPKCESupport", () => {
+        it("should return supported=true when S256 is in supported methods", () => {
+            // Arrange
+            const metadata = {
+                issuer: "http://localhost:3001",
+                authorization_endpoint: "http://localhost:3001/authorize",
+                token_endpoint: "http://localhost:3001/token",
+                code_challenge_methods_supported: ["S256", "plain"],
+            };
+            // Act
+            const result = verifyPKCESupport(metadata);
+            // Assert
+            expect(result).toEqual({ supported: true, advertised: true });
+        });
+        it("should return supported=false when S256 is not in supported methods", () => {
+            // Arrange
+            const metadata = {
+                issuer: "http://localhost:3001",
+                authorization_endpoint: "http://localhost:3001/authorize",
+                token_endpoint: "http://localhost:3001/token",
+                code_challenge_methods_supported: ["plain"],
+            };
+            // Act
+            const result = verifyPKCESupport(metadata);
+            // Assert
+            expect(result).toEqual({ supported: false, advertised: true });
+        });
+        it("should return supported=true, advertised=false when code_challenge_methods_supported is missing", () => {
+            // Arrange
+            const metadata = {
+                issuer: "http://localhost:3001",
+                authorization_endpoint: "http://localhost:3001/authorize",
+                token_endpoint: "http://localhost:3001/token",
+            };
+            // Act
+            const result = verifyPKCESupport(metadata);
+            // Assert
+            expect(result).toEqual({ supported: true, advertised: false });
+        });
+        it("should return supported=true, advertised=false when code_challenge_methods_supported is empty", () => {
+            // Arrange
+            const metadata = {
+                issuer: "http://localhost:3001",
+                authorization_endpoint: "http://localhost:3001/authorize",
+                token_endpoint: "http://localhost:3001/token",
+                code_challenge_methods_supported: [],
+            };
+            // Act
+            const result = verifyPKCESupport(metadata);
+            // Assert
+            expect(result).toEqual({ supported: true, advertised: false });
+        });
+    });
+    describe("buildAuthorizationUrl", () => {
+        it("should build URL with all required parameters", () => {
+            // Arrange
+            const params = {
+                authorizationEndpoint: "http://localhost:3001/authorize",
+                clientId: "test-client",
+                redirectUri: "http://localhost:3003/callback",
+                state: "random-state",
+                codeChallenge: "test-challenge",
+                codeChallengeMethod: "S256",
+            };
+            // Act
+            const result = buildAuthorizationUrl(params);
+            // Assert
+            const url = new URL(result);
+            expect(url.origin).toBe("http://localhost:3001");
+            expect(url.pathname).toBe("/authorize");
+            expect(url.searchParams.get("response_type")).toBe("code");
+            expect(url.searchParams.get("client_id")).toBe("test-client");
+            expect(url.searchParams.get("redirect_uri")).toBe("http://localhost:3003/callback");
+            expect(url.searchParams.get("state")).toBe("random-state");
+            expect(url.searchParams.get("code_challenge")).toBe("test-challenge");
+            expect(url.searchParams.get("code_challenge_method")).toBe("S256");
+        });
+        it("should include scope when provided", () => {
+            // Arrange
+            const params = {
+                authorizationEndpoint: "http://localhost:3001/authorize",
+                clientId: "test-client",
+                redirectUri: "http://localhost:3003/callback",
+                state: "random-state",
+                codeChallenge: "test-challenge",
+                codeChallengeMethod: "S256",
+                scope: "read write",
+            };
+            // Act
+            const result = buildAuthorizationUrl(params);
+            // Assert
+            const url = new URL(result);
+            expect(url.searchParams.get("scope")).toBe("read write");
+        });
+        it("should include resource when provided", () => {
+            // Arrange
+            const params = {
+                authorizationEndpoint: "http://localhost:3001/authorize",
+                clientId: "test-client",
+                redirectUri: "http://localhost:3003/callback",
+                state: "random-state",
+                codeChallenge: "test-challenge",
+                codeChallengeMethod: "S256",
+                resource: "http://localhost:3001/mcp",
+            };
+            // Act
+            const result = buildAuthorizationUrl(params);
+            // Assert
+            const url = new URL(result);
+            expect(url.searchParams.get("resource")).toBe("http://localhost:3001/mcp");
+        });
+        it("should not include scope when not provided", () => {
+            // Arrange
+            const params = {
+                authorizationEndpoint: "http://localhost:3001/authorize",
+                clientId: "test-client",
+                redirectUri: "http://localhost:3003/callback",
+                state: "random-state",
+                codeChallenge: "test-challenge",
+                codeChallengeMethod: "S256",
+            };
+            // Act
+            const result = buildAuthorizationUrl(params);
+            // Assert
+            const url = new URL(result);
+            expect(url.searchParams.has("scope")).toBe(false);
+        });
+    });
+    describe("getCanonicalResourceUri", () => {
+        it("should return URL without trailing slash", () => {
+            // Arrange
+            const mcpServerUrl = "http://localhost:3001/mcp/";
+            // Act
+            const result = getCanonicalResourceUri(mcpServerUrl);
+            // Assert
+            expect(result).toBe("http://localhost:3001/mcp");
+        });
+        it("should keep URL without trailing slash unchanged", () => {
+            // Arrange
+            const mcpServerUrl = "http://localhost:3001/mcp";
+            // Act
+            const result = getCanonicalResourceUri(mcpServerUrl);
+            // Assert
+            expect(result).toBe("http://localhost:3001/mcp");
+        });
+        it("should handle root URL correctly", () => {
+            // Arrange
+            const mcpServerUrl = "http://localhost:3001/";
+            // Act
+            const result = getCanonicalResourceUri(mcpServerUrl);
+            // Assert
+            expect(result).toBe("http://localhost:3001/");
+        });
+        it("should strip query parameters", () => {
+            // Arrange
+            const mcpServerUrl = "http://localhost:3001/mcp?param=value";
+            // Act
+            const result = getCanonicalResourceUri(mcpServerUrl);
+            // Assert
+            expect(result).toBe("http://localhost:3001/mcp");
+        });
+        it("should strip fragment", () => {
+            // Arrange
+            const mcpServerUrl = "http://localhost:3001/mcp#section";
+            // Act
+            const result = getCanonicalResourceUri(mcpServerUrl);
+            // Assert
+            expect(result).toBe("http://localhost:3001/mcp");
+        });
+    });
+});

package/dist/domains/oauth/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * OAuth Domain Exports
+ */
+export * from "./oauth-handler";
+export * from "./oauth-route";
+export * from "./oauth-schema";
+export * from "./oauth-session";
+export * from "./oauth-types";
+export * from "./oauth-utils";

package/dist/domains/oauth/index.js

@@ -0,0 +1,9 @@
+/**
+ * OAuth Domain Exports
+ */
+export * from "./oauth-handler";
+export * from "./oauth-route";
+export * from "./oauth-schema";
+export * from "./oauth-session";
+export * from "./oauth-types";
+export * from "./oauth-utils";

package/dist/domains/oauth/oauth-handler.d.ts

@@ -0,0 +1,65 @@
+/**
+ * OAuth Handler
+ *
+ * Business logic for OAuth flow:
+ * 1. Prepare: Discovery + Registration + Build Auth URL
+ * 2. Callback: Exchange code for tokens + Notify caller
+ * 3. Refresh: Refresh access token
+ */
+import type { OAuthPrepareRequest, OAuthRefreshRequest } from "./oauth-types";
+/**
+ * Prepare OAuth flow
+ *
+ * 1. Get MCP Server URL from package config
+ * 2. Discover Protected Resource Metadata
+ * 3. Discover Authorization Server Metadata
+ * 4. Verify PKCE support
+ * 5. Register client (Dynamic Client Registration)
+ * 6. Generate PKCE + state + session
+ * 7. Build authorization URL
+ */
+export declare function prepareOAuth(request: OAuthPrepareRequest): Promise<{
+    success: boolean;
+    code: number;
+    message: string;
+}>;
+/**
+ * Handle OAuth callback
+ *
+ * 1. Find session by state
+ * 2. Exchange code for tokens
+ * 3. POST tokens + clientInfo to callbackBaseUrl
+ * 4. Delete session
+ * 5. Return HTML to close popup
+ */
+export declare function handleCallback(params: {
+    code?: string;
+    state?: string;
+    error?: string;
+    error_description?: string;
+}): Promise<{
+    success: boolean;
+    error: string;
+    error_description: string | undefined;
+    html: string;
+    sessionId?: undefined;
+} | {
+    success: boolean;
+    sessionId: string;
+    html: string;
+    error?: undefined;
+    error_description?: undefined;
+}>;
+/**
+ * Refresh access token
+ */
+export declare function handleRefresh(request: OAuthRefreshRequest): Promise<{
+    success: boolean;
+    code: number;
+    message: string;
+}>;
+export declare const oauthHandler: {
+    prepareOAuth: typeof prepareOAuth;
+    handleCallback: typeof handleCallback;
+    handleRefresh: typeof handleRefresh;
+};