@xurenxiang1219/pingcode-mcp 0.3.1

package/dist/auth/cimd-client-resolver.js

@@ -0,0 +1,293 @@
+import { createHash } from "node:crypto";
+import { lookup as dnsLookup } from "node:dns/promises";
+import { request as httpsRequest } from "node:https";
+import { BlockList, isIP } from "node:net";
+import { InvalidClientMetadataError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
+import { OAuthClientInformationFullSchema, OAuthClientMetadataSchema, } from "@modelcontextprotocol/sdk/shared/auth.js";
+import { z } from "zod";
+const DEFAULT_CACHE_TTL_SECONDS = 5 * 60;
+const MAX_CACHE_TTL_SECONDS = 10 * 60;
+const DEFAULT_TIMEOUT_MS = 5000;
+const DEFAULT_MAX_RESPONSE_BYTES = 64 * 1024;
+const cimdDocumentSchema = OAuthClientMetadataSchema.extend({
+    client_id: z.string().min(1),
+});
+const specialUseAddresses = createSpecialUseBlockLists();
+export class CimdClientResolver {
+    options;
+    cache = new Map();
+    allowedHosts;
+    timeoutMs;
+    maxResponseBytes;
+    lookup;
+    requestDocument;
+    now;
+    constructor(options) {
+        this.options = options;
+        this.allowedHosts = new Set((options.allowedHosts ?? []).map((host) => host.trim().toLowerCase()).filter(Boolean));
+        this.timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        this.maxResponseBytes = options.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES;
+        this.lookup = options.lookup ?? lookupPublicAddresses;
+        this.requestDocument = options.requestDocument ?? requestCimdDocument;
+        this.now = options.now ?? Date.now;
+    }
+    async resolve(clientId) {
+        const url = parseCimdClientId(clientId);
+        if (!url) {
+            return undefined;
+        }
+        const cached = this.cache.get(clientId);
+        if (cached && cached.expiresAtMs > this.now()) {
+            return cached.client;
+        }
+        this.cache.delete(clientId);
+        if (this.allowedHosts.size > 0 && !this.allowedHosts.has(url.hostname.toLowerCase())) {
+            throw invalidMetadata("CIMD Client host 不在允許清單中");
+        }
+        let addresses;
+        try {
+            addresses = await this.lookup(stripIpv6Brackets(url.hostname));
+        }
+        catch (error) {
+            throw invalidMetadata("無法解析 CIMD Client host", error);
+        }
+        if (addresses.length === 0 || addresses.some((entry) => isSpecialUseAddress(entry.address))) {
+            throw invalidMetadata("CIMD Client host 不得解析到特殊用途網路位址");
+        }
+        let response;
+        try {
+            response = await this.requestDocument(url, addresses, this.timeoutMs, this.maxResponseBytes);
+        }
+        catch (error) {
+            throw invalidMetadata("無法取得 CIMD Client metadata", error);
+        }
+        if (response.status !== 200) {
+            throw invalidMetadata("CIMD Client metadata 必須返回 HTTP 200");
+        }
+        if (!isJsonContentType(response.contentType)) {
+            throw invalidMetadata("CIMD Client metadata 必須返回 JSON");
+        }
+        let rawDocument;
+        try {
+            rawDocument = JSON.parse(response.body);
+        }
+        catch (error) {
+            throw invalidMetadata("CIMD Client metadata 不是有效的 JSON", error);
+        }
+        if (hasForbiddenClientSecret(rawDocument)) {
+            throw invalidMetadata("CIMD 公開 Client 不得包含 Client Secret");
+        }
+        const parsed = cimdDocumentSchema.safeParse(rawDocument);
+        if (!parsed.success) {
+            throw invalidMetadata("CIMD Client metadata 不符合預期資料結構", parsed.error);
+        }
+        if (parsed.data.client_id !== clientId) {
+            throw invalidMetadata("CIMD metadata 的 client_id 與文件 URL 不一致");
+        }
+        if (parsed.data.redirect_uris.length === 0 || parsed.data.redirect_uris.length > 20) {
+            throw invalidMetadata("CIMD metadata 必須包含 1 至 20 個 Redirect URI");
+        }
+        if (parsed.data.token_endpoint_auth_method !== undefined &&
+            parsed.data.token_endpoint_auth_method !== "none") {
+            throw invalidMetadata("CIMD 目前只支援公開 Client 的 none 認證方式");
+        }
+        if (parsed.data.grant_types !== undefined &&
+            !parsed.data.grant_types.includes("authorization_code")) {
+            throw invalidMetadata("CIMD Client 必須支援 authorization_code");
+        }
+        if (parsed.data.response_types !== undefined &&
+            !parsed.data.response_types.includes("code")) {
+            throw invalidMetadata("CIMD Client 必須支援 code response type");
+        }
+        const client = OAuthClientInformationFullSchema.parse({
+            ...parsed.data,
+            token_endpoint_auth_method: "none",
+            client_id: clientId,
+            client_id_issued_at: Math.floor(this.now() / 1000),
+        });
+        const cacheTtlSeconds = parseCacheTtlSeconds(response.cacheControl);
+        if (cacheTtlSeconds > 0) {
+            this.cache.set(clientId, {
+                client,
+                expiresAtMs: this.now() + cacheTtlSeconds * 1000,
+            });
+        }
+        this.options.logger.debug("已解析 MCP CIMD Client metadata", {
+            clientReference: createHash("sha256").update(clientId).digest("hex").slice(0, 12),
+            clientHost: url.hostname,
+            redirectUriCount: client.redirect_uris.length,
+            cacheTtlSeconds,
+        });
+        return client;
+    }
+}
+function parseCimdClientId(clientId) {
+    let url;
+    try {
+        url = new URL(clientId);
+    }
+    catch {
+        return undefined;
+    }
+    if (url.protocol !== "https:") {
+        return undefined;
+    }
+    if (url.pathname === "/" ||
+        url.username ||
+        url.password ||
+        url.hash ||
+        url.search ||
+        hasDotPathSegment(clientId)) {
+        throw invalidMetadata("CIMD client_id URL 不符合安全限制");
+    }
+    return url;
+}
+async function lookupPublicAddresses(hostname) {
+    if (isIP(hostname)) {
+        return [{ address: hostname, family: isIP(hostname) }];
+    }
+    return dnsLookup(hostname, { all: true, verbatim: true });
+}
+function requestCimdDocument(url, addresses, timeoutMs, maxResponseBytes) {
+    const selected = addresses[0];
+    if (!selected) {
+        return Promise.reject(new Error("CIMD host 沒有可用位址"));
+    }
+    return new Promise((resolve, reject) => {
+        const request = httpsRequest(url, {
+            method: "GET",
+            headers: {
+                Accept: "application/json, application/*+json",
+                "User-Agent": "pingcode-mcp/0.1.0",
+            },
+            family: selected.family,
+            lookup: (_hostname, _options, callback) => {
+                callback(null, selected.address, selected.family);
+            },
+            signal: AbortSignal.timeout(timeoutMs),
+        }, (response) => {
+            const declaredLength = Number(response.headers["content-length"]);
+            if (Number.isFinite(declaredLength) && declaredLength > maxResponseBytes) {
+                response.destroy(new Error("CIMD metadata 超過大小限制"));
+                return;
+            }
+            const chunks = [];
+            let receivedBytes = 0;
+            response.on("data", (chunk) => {
+                receivedBytes += chunk.length;
+                if (receivedBytes > maxResponseBytes) {
+                    response.destroy(new Error("CIMD metadata 超過大小限制"));
+                    return;
+                }
+                chunks.push(chunk);
+            });
+            response.once("end", () => {
+                resolve({
+                    status: response.statusCode ?? 0,
+                    contentType: singleHeader(response.headers["content-type"]),
+                    cacheControl: singleHeader(response.headers["cache-control"]),
+                    body: Buffer.concat(chunks).toString("utf8"),
+                });
+            });
+            response.once("error", reject);
+        });
+        request.once("error", reject);
+        request.end();
+    });
+}
+function isJsonContentType(value) {
+    if (!value) {
+        return false;
+    }
+    const mediaType = value.split(";", 1)[0]?.trim().toLowerCase();
+    return mediaType === "application/json" || Boolean(mediaType?.match(/^application\/.+\+json$/));
+}
+function hasForbiddenClientSecret(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return false;
+    }
+    return "client_secret" in value || "client_secret_expires_at" in value;
+}
+function parseCacheTtlSeconds(value) {
+    if (!value || /(?:^|,)\s*no-store\s*(?:,|$)/i.test(value)) {
+        return value ? 0 : DEFAULT_CACHE_TTL_SECONDS;
+    }
+    const match = value.match(/(?:^|,)\s*max-age=(\d+)\s*(?:,|$)/i);
+    if (!match) {
+        return DEFAULT_CACHE_TTL_SECONDS;
+    }
+    return Math.min(Number(match[1]), MAX_CACHE_TTL_SECONDS);
+}
+function isSpecialUseAddress(address) {
+    const family = isIP(address);
+    if (family === 4) {
+        return specialUseAddresses.ipv4.check(address, "ipv4");
+    }
+    if (family === 6) {
+        return specialUseAddresses.ipv6.check(address, "ipv6");
+    }
+    return true;
+}
+function createSpecialUseBlockLists() {
+    const ipv4 = new BlockList();
+    const ipv6 = new BlockList();
+    const ipv4Subnets = [
+        ["0.0.0.0", 8],
+        ["10.0.0.0", 8],
+        ["100.64.0.0", 10],
+        ["127.0.0.0", 8],
+        ["169.254.0.0", 16],
+        ["172.16.0.0", 12],
+        ["192.0.0.0", 24],
+        ["192.0.2.0", 24],
+        ["192.168.0.0", 16],
+        ["198.18.0.0", 15],
+        ["198.51.100.0", 24],
+        ["203.0.113.0", 24],
+        ["224.0.0.0", 4],
+        ["240.0.0.0", 4],
+    ];
+    const ipv6Subnets = [
+        ["::", 128],
+        ["::1", 128],
+        ["::ffff:0:0", 96],
+        ["64:ff9b::", 96],
+        ["100::", 64],
+        ["2001::", 23],
+        ["2001:db8::", 32],
+        ["fc00::", 7],
+        ["fe80::", 10],
+        ["ff00::", 8],
+    ];
+    for (const [network, prefix] of ipv4Subnets) {
+        ipv4.addSubnet(network, prefix, "ipv4");
+    }
+    for (const [network, prefix] of ipv6Subnets) {
+        ipv6.addSubnet(network, prefix, "ipv6");
+    }
+    return { ipv4, ipv6 };
+}
+function hasDotPathSegment(value) {
+    const authorityEnd = value.indexOf("/", "https://".length);
+    if (authorityEnd < 0) {
+        return false;
+    }
+    const rawPath = value.slice(authorityEnd).split(/[?#]/, 1)[0] ?? "";
+    return rawPath
+        .split("/")
+        .some((segment) => /^(?:\.|%2e|\.%2e|%2e\.|%2e%2e)$/i.test(segment));
+}
+function stripIpv6Brackets(value) {
+    return value.startsWith("[") && value.endsWith("]") ? value.slice(1, -1) : value;
+}
+function singleHeader(value) {
+    return Array.isArray(value) ? (value[0] ?? null) : (value ?? null);
+}
+function invalidMetadata(message, cause) {
+    const error = new InvalidClientMetadataError(message);
+    if (cause !== undefined) {
+        Object.defineProperty(error, "cause", { value: cause, enumerable: false });
+    }
+    return error;
+}
+//# sourceMappingURL=cimd-client-resolver.js.map

package/dist/auth/cimd-client-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cimd-client-resolver.js","sourceRoot":"","sources":["../../src/auth/cimd-client-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAC;AAC7F,OAAO,EACL,gCAAgC,EAChC,yBAAyB,GAE1B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,yBAAyB,GAAG,CAAC,GAAG,EAAE,CAAC;AACzC,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,CAAC;AACtC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAChC,MAAM,0BAA0B,GAAG,EAAE,GAAG,IAAI,CAAC;AAE7C,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,MAAM,CAAC;IAC1D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,0BAA0B,EAAE,CAAC;AAiCzD,MAAM,OAAO,kBAAkB;IASA;IARZ,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAC;IACxC,YAAY,CAAc;IAC1B,SAAS,CAAS;IAClB,gBAAgB,CAAS;IACzB,MAAM,CAAiD;IACvD,eAAe,CAA4D;IAC3E,GAAG,CAAe;IAEnC,YAA6B,OAAkC;QAAlC,YAAO,GAAP,OAAO,CAA2B;QAC7D,IAAI,CAAC,YAAY,GAAG,IAAI,GAAG,CACzB,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CACtF,CAAC;QACF,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;QACzD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,0BAA0B,CAAC;QAC/E,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,qBAAqB,CAAC;QACtD,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,mBAAmB,CAAC;QACtE,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAgB;QAC5B,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,MAAM,IAAI,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC9C,OAAO,MAAM,CAAC,MAAM,CAAC;QACvB,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAE5B,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACrF,MAAM,eAAe,CAAC,0BAA0B,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,SAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,eAAe,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAC5F,MAAM,eAAe,CAAC,gCAAgC,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,QAA8B,CAAC;QACnC,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CACnC,GAAG,EACH,SAAS,EACT,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,gBAAgB,CACtB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,eAAe,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,eAAe,CAAC,oCAAoC,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7C,MAAM,eAAe,CAAC,gCAAgC,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,WAAoB,CAAC;QACzB,IAAI,CAAC;YACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAY,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,eAAe,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,wBAAwB,CAAC,WAAW,CAAC,EAAE,CAAC;YAC1C,MAAM,eAAe,CAAC,mCAAmC,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,eAAe,CAAC,gCAAgC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YACvC,MAAM,eAAe,CAAC,uCAAuC,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACpF,MAAM,eAAe,CAAC,0CAA0C,CAAC,CAAC;QACpE,CAAC;QACD,IACE,MAAM,CAAC,IAAI,CAAC,0BAA0B,KAAK,SAAS;YACpD,MAAM,CAAC,IAAI,CAAC,0BAA0B,KAAK,MAAM,EACjD,CAAC;YACD,MAAM,eAAe,CAAC,iCAAiC,CAAC,CAAC;QAC3D,CAAC;QACD,IACE,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS;YACrC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EACvD,CAAC;YACD,MAAM,eAAe,CAAC,qCAAqC,CAAC,CAAC;QAC/D,CAAC;QACD,IACE,MAAM,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS;YACxC,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC5C,CAAC;YACD,MAAM,eAAe,CAAC,qCAAqC,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,MAAM,GAAG,gCAAgC,CAAC,KAAK,CAAC;YACpD,GAAG,MAAM,CAAC,IAAI;YACd,0BAA0B,EAAE,MAAM;YAClC,SAAS,EAAE,QAAQ;YACnB,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;SACnD,CAAC,CAAC;QACH,MAAM,eAAe,GAAG,oBAAoB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACpE,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE;gBACvB,MAAM;gBACN,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,GAAG,IAAI;aACjD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE;YACxD,eAAe,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YACjF,UAAU,EAAE,GAAG,CAAC,QAAQ;YACxB,gBAAgB,EAAE,MAAM,CAAC,aAAa,CAAC,MAAM;YAC7C,eAAe;SAChB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAED,SAAS,iBAAiB,CAAC,QAAgB;IACzC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IACE,GAAG,CAAC,QAAQ,KAAK,GAAG;QACpB,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,IAAI;QACR,GAAG,CAAC,MAAM;QACV,iBAAiB,CAAC,QAAQ,CAAC,EAC3B,CAAC;QACD,MAAM,eAAe,CAAC,4BAA4B,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,QAAgB;IACnD,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnB,OAAO,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,SAAS,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,mBAAmB,CAC1B,GAAQ,EACR,SAA0B,EAC1B,SAAiB,EACjB,gBAAwB;IAExB,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,YAAY,CAC1B,GAAG,EACH;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,MAAM,EAAE,sCAAsC;gBAC9C,YAAY,EAAE,oBAAoB;aACnC;YACD,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,MAAM,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE;gBACxC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YACpD,CAAC;YACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;SACvC,EACD,CAAC,QAAQ,EAAE,EAAE;YACX,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAClE,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,gBAAgB,EAAE,CAAC;gBACzE,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC;gBACpD,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,aAAa,GAAG,CAAC,CAAC;YACtB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBACpC,aAAa,IAAI,KAAK,CAAC,MAAM,CAAC;gBAC9B,IAAI,aAAa,GAAG,gBAAgB,EAAE,CAAC;oBACrC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC;oBACpD,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE;gBACxB,OAAO,CAAC;oBACN,MAAM,EAAE,QAAQ,CAAC,UAAU,IAAI,CAAC;oBAChC,WAAW,EAAE,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;oBAC3D,YAAY,EAAE,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;oBAC7D,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;iBAC7C,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC,CACF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAoB;IAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/D,OAAO,SAAS,KAAK,kBAAkB,IAAI,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc;IAC9C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,IAAI,KAAK,IAAI,0BAA0B,IAAI,KAAK,CAAC;AACzE,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAoB;IAChD,IAAI,CAAC,KAAK,IAAI,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,yBAAyB,CAAC;IAC/C,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAChE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,yBAAyB,CAAC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAe;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,0BAA0B;IACjC,MAAM,IAAI,GAAG,IAAI,SAAS,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,SAAS,EAAE,CAAC;IAC7B,MAAM,WAAW,GAA4B;QAC3C,CAAC,SAAS,EAAE,CAAC,CAAC;QACd,CAAC,UAAU,EAAE,CAAC,CAAC;QACf,CAAC,YAAY,EAAE,EAAE,CAAC;QAClB,CAAC,WAAW,EAAE,CAAC,CAAC;QAChB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,YAAY,EAAE,EAAE,CAAC;QAClB,CAAC,WAAW,EAAE,EAAE,CAAC;QACjB,CAAC,WAAW,EAAE,EAAE,CAAC;QACjB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,YAAY,EAAE,EAAE,CAAC;QAClB,CAAC,cAAc,EAAE,EAAE,CAAC;QACpB,CAAC,aAAa,EAAE,EAAE,CAAC;QACnB,CAAC,WAAW,EAAE,CAAC,CAAC;QAChB,CAAC,WAAW,EAAE,CAAC,CAAC;KACjB,CAAC;IACF,MAAM,WAAW,GAA4B;QAC3C,CAAC,IAAI,EAAE,GAAG,CAAC;QACX,CAAC,KAAK,EAAE,GAAG,CAAC;QACZ,CAAC,YAAY,EAAE,EAAE,CAAC;QAClB,CAAC,WAAW,EAAE,EAAE,CAAC;QACjB,CAAC,OAAO,EAAE,EAAE,CAAC;QACb,CAAC,QAAQ,EAAE,EAAE,CAAC;QACd,CAAC,YAAY,EAAE,EAAE,CAAC;QAClB,CAAC,QAAQ,EAAE,CAAC,CAAC;QACb,CAAC,QAAQ,EAAE,EAAE,CAAC;QACd,CAAC,QAAQ,EAAE,CAAC,CAAC;KACd,CAAC;IACF,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5C,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IACD,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5C,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAC3D,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpE,OAAO,OAAO;SACX,KAAK,CAAC,GAAG,CAAC;SACV,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACnF,CAAC;AAED,SAAS,YAAY,CAAC,KAAoC;IACxD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,eAAe,CAAC,OAAe,EAAE,KAAe;IACvD,MAAM,KAAK,GAAG,IAAI,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/auth/memory-store.d.ts

@@ -0,0 +1,15 @@
+import type { RawOAuthStore } from "./store.js";
+export declare class MemoryOAuthStore implements RawOAuthStore {
+    private readonly now;
+    private readonly entries;
+    constructor(now?: () => number);
+    get(key: string): Promise<string | undefined>;
+    set(key: string, value: string, ttlSeconds: number): Promise<void>;
+    consume(key: string): Promise<string | undefined>;
+    delete(key: string): Promise<void>;
+    setIfAbsent(key: string, value: string, ttlSeconds: number): Promise<boolean>;
+    compareAndDelete(key: string, expectedValue: string): Promise<void>;
+    ping(): Promise<void>;
+    close(): Promise<void>;
+}
+//# sourceMappingURL=memory-store.d.ts.map

package/dist/auth/memory-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-store.d.ts","sourceRoot":"","sources":["../../src/auth/memory-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAOhD,qBAAa,gBAAiB,YAAW,aAAa;IAGxC,OAAO,CAAC,QAAQ,CAAC,GAAG;IAFhC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA4B;gBAEvB,GAAG,GAAE,MAAM,MAAiB;IAEnD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAY7C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlE,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAMjD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlC,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ7E,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMnE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAErB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B"}

package/dist/auth/memory-store.js

@@ -0,0 +1,46 @@
+export class MemoryOAuthStore {
+    now;
+    entries = new Map();
+    constructor(now = Date.now) {
+        this.now = now;
+    }
+    async get(key) {
+        const entry = this.entries.get(key);
+        if (!entry) {
+            return undefined;
+        }
+        if (entry.expiresAtMs <= this.now()) {
+            this.entries.delete(key);
+            return undefined;
+        }
+        return entry.value;
+    }
+    async set(key, value, ttlSeconds) {
+        this.entries.set(key, { value, expiresAtMs: this.now() + ttlSeconds * 1000 });
+    }
+    async consume(key) {
+        const value = await this.get(key);
+        this.entries.delete(key);
+        return value;
+    }
+    async delete(key) {
+        this.entries.delete(key);
+    }
+    async setIfAbsent(key, value, ttlSeconds) {
+        if ((await this.get(key)) !== undefined) {
+            return false;
+        }
+        await this.set(key, value, ttlSeconds);
+        return true;
+    }
+    async compareAndDelete(key, expectedValue) {
+        if ((await this.get(key)) === expectedValue) {
+            this.entries.delete(key);
+        }
+    }
+    async ping() { }
+    async close() {
+        this.entries.clear();
+    }
+}
+//# sourceMappingURL=memory-store.js.map

package/dist/auth/memory-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-store.js","sourceRoot":"","sources":["../../src/auth/memory-store.ts"],"names":[],"mappings":"AAOA,MAAM,OAAO,gBAAgB;IAGE;IAFZ,OAAO,GAAG,IAAI,GAAG,EAAiB,CAAC;IAEpD,YAA6B,MAAoB,IAAI,CAAC,GAAG;QAA5B,QAAG,GAAH,GAAG,CAAyB;IAAG,CAAC;IAE7D,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACpC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa,EAAE,UAAkB;QACtD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAW;QACvB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAW,EAAE,KAAa,EAAE,UAAkB;QAC9D,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,GAAW,EAAE,aAAqB;QACvD,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,aAAa,EAAE,CAAC;YAC5C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,KAAmB,CAAC;IAE9B,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF"}

package/dist/auth/pingcode-oauth-client.d.ts

@@ -0,0 +1,23 @@
+import type { PingCodeCredentials } from "../config.js";
+import type { Logger } from "../logger.js";
+import { type FetchLike } from "../pingcode/token-provider.js";
+export interface PingCodeUserTokens {
+    accessToken: string;
+    refreshToken: string;
+    expiresAtMs: number;
+}
+export declare class PingCodeOAuthClient {
+    private readonly authorizationBaseUrl;
+    private readonly apiBaseUrl;
+    private readonly credentials;
+    private readonly timeoutMs;
+    private readonly logger;
+    private readonly fetchImpl;
+    private readonly now;
+    constructor(authorizationBaseUrl: string, apiBaseUrl: string, credentials: PingCodeCredentials, timeoutMs: number, logger: Logger, fetchImpl?: FetchLike, now?: () => number);
+    createAuthorizationUrl(state: string): URL;
+    exchangeAuthorizationCode(code: string): Promise<PingCodeUserTokens>;
+    refresh(refreshToken: string): Promise<PingCodeUserTokens>;
+    private requestToken;
+}
+//# sourceMappingURL=pingcode-oauth-client.d.ts.map

package/dist/auth/pingcode-oauth-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pingcode-oauth-client.d.ts","sourceRoot":"","sources":["../../src/auth/pingcode-oauth-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAG3C,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAEhF,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,mBAAmB;IAE5B,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;gBANH,oBAAoB,EAAE,MAAM,EAC5B,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,mBAAmB,EAChC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,SAAS,GAAE,SAAiB,EAC5B,GAAG,GAAE,MAAM,MAAiB;IAG/C,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG;IAQpC,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAiBpE,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;YAYlD,YAAY;CAqD3B"}

package/dist/auth/pingcode-oauth-client.js

@@ -0,0 +1,103 @@
+import { PingCodeError } from "../pingcode/errors.js";
+import { userOAuthTokenSchema } from "../pingcode/schemas.js";
+import { normalizeExpiry } from "../pingcode/token-provider.js";
+export class PingCodeOAuthClient {
+    authorizationBaseUrl;
+    apiBaseUrl;
+    credentials;
+    timeoutMs;
+    logger;
+    fetchImpl;
+    now;
+    constructor(authorizationBaseUrl, apiBaseUrl, credentials, timeoutMs, logger, fetchImpl = fetch, now = Date.now) {
+        this.authorizationBaseUrl = authorizationBaseUrl;
+        this.apiBaseUrl = apiBaseUrl;
+        this.credentials = credentials;
+        this.timeoutMs = timeoutMs;
+        this.logger = logger;
+        this.fetchImpl = fetchImpl;
+        this.now = now;
+    }
+    createAuthorizationUrl(state) {
+        const url = new URL("authorize", `${this.authorizationBaseUrl}/`);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("client_id", this.credentials.clientId);
+        url.searchParams.set("state", state);
+        return url;
+    }
+    async exchangeAuthorizationCode(code) {
+        const payload = await this.requestToken({
+            grant_type: "authorization_code",
+            client_id: this.credentials.clientId,
+            client_secret: this.credentials.clientSecret,
+            code,
+        });
+        if (!payload.refreshToken) {
+            throw new PingCodeError("PingCode 使用者 Token 響應缺少 Refresh Token", "INVALID_RESPONSE");
+        }
+        return {
+            accessToken: payload.accessToken,
+            refreshToken: payload.refreshToken,
+            expiresAtMs: payload.expiresAtMs,
+        };
+    }
+    async refresh(refreshToken) {
+        const payload = await this.requestToken({
+            grant_type: "refresh_token",
+            refresh_token: refreshToken,
+        });
+        return {
+            accessToken: payload.accessToken,
+            refreshToken: payload.refreshToken ?? refreshToken,
+            expiresAtMs: payload.expiresAtMs,
+        };
+    }
+    async requestToken(query) {
+        const url = new URL("v1/auth/token", `${this.apiBaseUrl}/`);
+        for (const [key, value] of Object.entries(query)) {
+            url.searchParams.set(key, value);
+        }
+        let response;
+        try {
+            response = await this.fetchImpl(url, {
+                method: "GET",
+                headers: { Accept: "application/json" },
+                signal: AbortSignal.timeout(this.timeoutMs),
+            });
+        }
+        catch (error) {
+            const timeout = isTimeoutError(error);
+            throw new PingCodeError(timeout ? "取得 PingCode 使用者 Token 逾時" : "無法連線到 PingCode 認證服務", timeout ? "TIMEOUT" : "UPSTREAM_UNAVAILABLE", { retryable: true, cause: error });
+        }
+        if (!response.ok) {
+            this.logger.warn("請求 PingCode 使用者 Token 失敗", { status: response.status });
+            throw new PingCodeError("PingCode 拒絕了使用者 OAuth 請求", "AUTHENTICATION_FAILED", {
+                status: response.status,
+            });
+        }
+        let body;
+        try {
+            body = await response.json();
+        }
+        catch (error) {
+            throw new PingCodeError("PingCode 返回了無效的使用者 Token 響應", "INVALID_RESPONSE", {
+                cause: error,
+            });
+        }
+        const parsed = userOAuthTokenSchema.safeParse(body);
+        if (!parsed.success) {
+            throw new PingCodeError("PingCode 使用者 Token 響應不符合預期資料結構", "INVALID_RESPONSE", {
+                cause: parsed.error,
+            });
+        }
+        return {
+            accessToken: parsed.data.access_token,
+            ...(parsed.data.refresh_token ? { refreshToken: parsed.data.refresh_token } : {}),
+            expiresAtMs: normalizeExpiry(parsed.data.expires_in, this.now()),
+        };
+    }
+}
+function isTimeoutError(error) {
+    return error instanceof Error && (error.name === "TimeoutError" || error.name === "AbortError");
+}
+//# sourceMappingURL=pingcode-oauth-client.js.map

package/dist/auth/pingcode-oauth-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pingcode-oauth-client.js","sourceRoot":"","sources":["../../src/auth/pingcode-oauth-client.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAkB,MAAM,+BAA+B,CAAC;AAQhF,MAAM,OAAO,mBAAmB;IAEX;IACA;IACA;IACA;IACA;IACA;IACA;IAPnB,YACmB,oBAA4B,EAC5B,UAAkB,EAClB,WAAgC,EAChC,SAAiB,EACjB,MAAc,EACd,YAAuB,KAAK,EAC5B,MAAoB,IAAI,CAAC,GAAG;QAN5B,yBAAoB,GAApB,oBAAoB,CAAQ;QAC5B,eAAU,GAAV,UAAU,CAAQ;QAClB,gBAAW,GAAX,WAAW,CAAqB;QAChC,cAAS,GAAT,SAAS,CAAQ;QACjB,WAAM,GAAN,MAAM,CAAQ;QACd,cAAS,GAAT,SAAS,CAAmB;QAC5B,QAAG,GAAH,GAAG,CAAyB;IAC5C,CAAC;IAEJ,sBAAsB,CAAC,KAAa;QAClC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,oBAAoB,GAAG,CAAC,CAAC;QAClE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC7D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrC,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,yBAAyB,CAAC,IAAY;QAC1C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC;YACtC,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ;YACpC,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,YAAY;YAC5C,IAAI;SACL,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1B,MAAM,IAAI,aAAa,CAAC,uCAAuC,EAAE,kBAAkB,CAAC,CAAC;QACvF,CAAC;QACD,OAAO;YACL,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,YAAoB;QAChC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC;YACtC,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;SAC5B,CAAC,CAAC;QACH,OAAO;YACL,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,YAAY;YAClD,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,KAA6B;QAKtD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,eAAe,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;QAC5D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;gBACnC,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;aAC5C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YACtC,MAAM,IAAI,aAAa,CACrB,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,qBAAqB,EAC5D,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB,EAC5C,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAClC,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1E,MAAM,IAAI,aAAa,CAAC,0BAA0B,EAAE,uBAAuB,EAAE;gBAC3E,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,aAAa,CAAC,6BAA6B,EAAE,kBAAkB,EAAE;gBACzE,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,aAAa,CAAC,gCAAgC,EAAE,kBAAkB,EAAE;gBAC5E,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;QACD,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY;YACrC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,WAAW,EAAE,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;SACjE,CAAC;IACJ,CAAC;CACF;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,KAAK,YAAY,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;AAClG,CAAC"}

package/dist/auth/pingcode-oauth-provider.d.ts

@@ -0,0 +1,70 @@
+import type { Request, Response } from "express";
+import type { OAuthRegisteredClientsStore } from "@modelcontextprotocol/sdk/server/auth/clients.js";
+import type { AuthorizationParams, OAuthServerProvider } from "@modelcontextprotocol/sdk/server/auth/provider.js";
+import type { AuthInfo } from "@modelcontextprotocol/sdk/server/auth/types.js";
+import type { OAuthClientInformationFull, OAuthTokenRevocationRequest, OAuthTokens } from "@modelcontextprotocol/sdk/shared/auth.js";
+import type { AccessTokenProvider } from "../pingcode/access-token-provider.js";
+import type { Logger } from "../logger.js";
+import { PingCodeOAuthClient } from "./pingcode-oauth-client.js";
+import type { CimdClientResolverLike } from "./cimd-client-resolver.js";
+import type { OAuthStore } from "./store.js";
+interface PingCodeOAuthProviderOptions {
+    store: OAuthStore;
+    pingCodeClient: PingCodeOAuthClient;
+    publicBaseUrl: string;
+    accessTokenTtlSeconds: number;
+    refreshTokenTtlSeconds: number;
+    dcrClientTtlSeconds?: number;
+    cimdClientResolver?: CimdClientResolverLike;
+    logger: Logger;
+    now?: () => number;
+}
+export declare class PingCodeOAuthProvider implements OAuthServerProvider {
+    readonly clientsStore: OAuthRegisteredClientsStore;
+    readonly scope = "pingcode:read";
+    readonly scopes: string[];
+    readonly resourceUrl: URL;
+    readonly callbackUrl: URL;
+    readonly supportsCimd: boolean;
+    private readonly store;
+    private readonly pingCodeClient;
+    private readonly accessTokenTtlSeconds;
+    private readonly refreshTokenTtlSeconds;
+    private readonly dcrClientTtlSeconds;
+    private readonly logger;
+    private readonly cimdClientResolver;
+    private readonly now;
+    private readonly secureCookies;
+    constructor(options: PingCodeOAuthProviderOptions);
+    authorize(client: OAuthClientInformationFull, params: AuthorizationParams, response: Response): Promise<void>;
+    handlePingCodeCallback(request: Request, response: Response): Promise<void>;
+    challengeForAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string): Promise<string>;
+    exchangeAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string, _codeVerifier?: string, redirectUri?: string, resource?: URL): Promise<OAuthTokens>;
+    exchangeRefreshToken(client: OAuthClientInformationFull, refreshToken: string, scopes?: string[], resource?: URL): Promise<OAuthTokens>;
+    verifyAccessToken(token: string): Promise<AuthInfo>;
+    revokeToken(client: OAuthClientInformationFull, request: OAuthTokenRevocationRequest): Promise<void>;
+    getPingCodeAccessToken(mcpAccessToken: string, forceRefresh?: boolean): Promise<string>;
+    private getClient;
+    private logClientRegistrationMethod;
+    private registerClient;
+    private issueTokens;
+    private validateScopes;
+    private validateResource;
+    private redirectToClient;
+    private clientKey;
+    private transactionKey;
+    private authorizationCodeKey;
+    private accessTokenKey;
+    private refreshTokenKey;
+    private sessionKey;
+}
+export declare class UserOAuthTokenProvider implements AccessTokenProvider {
+    private readonly provider;
+    private readonly mcpAccessToken;
+    private forceRefresh;
+    constructor(provider: PingCodeOAuthProvider, mcpAccessToken: string);
+    getAccessToken(): Promise<string>;
+    invalidate(): void;
+}
+export {};
+//# sourceMappingURL=pingcode-oauth-provider.d.ts.map

package/dist/auth/pingcode-oauth-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pingcode-oauth-provider.d.ts","sourceRoot":"","sources":["../../src/auth/pingcode-oauth-provider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAQjD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AACpG,OAAO,KAAK,EACV,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,KAAK,EACV,0BAA0B,EAC1B,2BAA2B,EAC3B,WAAW,EACZ,MAAM,0CAA0C,CAAC;AAGlD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAChF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAA2B,MAAM,4BAA4B,CAAC;AAC1F,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAwC7C,UAAU,4BAA4B;IACpC,KAAK,EAAE,UAAU,CAAC;IAClB,cAAc,EAAE,mBAAmB,CAAC;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kBAAkB,CAAC,EAAE,sBAAsB,CAAC;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,qBAAa,qBAAsB,YAAW,mBAAmB;IAC/D,QAAQ,CAAC,YAAY,EAAE,2BAA2B,CAAC;IACnD,QAAQ,CAAC,KAAK,mBAAc;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;IACnC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAsB;IACrD,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAS;IAC/C,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAS;IAChD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;IAC7C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAqC;IACxE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAU;gBAE5B,OAAO,EAAE,4BAA4B;IAoB3C,SAAS,CACb,MAAM,EAAE,0BAA0B,EAClC,MAAM,EAAE,mBAAmB,EAC3B,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,IAAI,CAAC;IA+BV,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA8D3E,6BAA6B,CACjC,MAAM,EAAE,0BAA0B,EAClC,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,MAAM,CAAC;IAUZ,yBAAyB,CAC7B,MAAM,EAAE,0BAA0B,EAClC,iBAAiB,EAAE,MAAM,EACzB,aAAa,CAAC,EAAE,MAAM,EACtB,WAAW,CAAC,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,GAAG,GACb,OAAO,CAAC,WAAW,CAAC;IAyBjB,oBAAoB,CACxB,MAAM,EAAE,0BAA0B,EAClC,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,MAAM,EAAE,EACjB,QAAQ,CAAC,EAAE,GAAG,GACb,OAAO,CAAC,WAAW,CAAC;IAgCjB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAqBnD,WAAW,CACf,MAAM,EAAE,0BAA0B,EAClC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,IAAI,CAAC;IAoBV,sBAAsB,CAAC,cAAc,EAAE,MAAM,EAAE,YAAY,UAAQ,GAAG,OAAO,CAAC,MAAM,CAAC;YA2B7E,SAAS;IAmBvB,OAAO,CAAC,2BAA2B;YAOrB,cAAc;YAqBd,WAAW;IA+CzB,OAAO,CAAC,cAAc;IAWtB,OAAO,CAAC,gBAAgB;IAMxB,OAAO,CAAC,gBAAgB;IAiBxB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,oBAAoB;IAI5B,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,eAAe;IAIvB,OAAO,CAAC,UAAU;CAGnB;AAED,qBAAa,sBAAuB,YAAW,mBAAmB;IAI9D,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAJjC,OAAO,CAAC,YAAY,CAAS;gBAGV,QAAQ,EAAE,qBAAqB,EAC/B,cAAc,EAAE,MAAM;IAGnC,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC;IAMvC,UAAU,IAAI,IAAI;CAGnB"}