canvas-lms-mcp 1.29.4 → 1.30.0

package/README.md

@@ -212,7 +212,9 @@ Host verification (Claude Desktop, ChatGPT, Codex fallback) is performed manuall
 
 ## Deployment Modes
 
-### stdio (Default)
+Every process runs exactly one **auth profile**: `local_static_token` (stdio, the default), `remote_static_token` (`serve`, the default), or `oauth_brokered` (`serve --auth-profile oauth_brokered`). Run `npx canvas-lms-mcp doctor` to see which profile your configuration resolves to and what it is missing, without printing any secret.
+
+### stdio (Default) — `local_static_token`
 
 For local AI clients like Claude Desktop, Cursor, and VS Code. The server communicates over stdin/stdout.
 
@@ -220,9 +222,11 @@ For local AI clients like Claude Desktop, Cursor, and VS Code. The server commun
 npx canvas-lms-mcp --token $CANVAS_API_TOKEN --base-url $CANVAS_BASE_URL
 ```
 
-### HTTP
+stdio has no network edge, so hosts cannot show a login state for it: Codex lists a stdio server as `Auth Unsupported` and `codex mcp login` refuses it. That is by design (the MCP authorization spec applies to HTTP transports only). Use the OAuth profile below when you need a native **Authenticate** experience.
+
+### HTTP (static token, self-managed) — `remote_static_token`
 
-For web-based clients or hosted services. Starts an HTTP server with Streamable HTTP transport.
+For a developer's own HTTP experiments, or an application that already holds Canvas tokens. Starts an HTTP server with Streamable HTTP transport; each request carries a Canvas token in `X-Canvas-Token`, or the server's configured token is used.
 
 ```bash
 npx canvas-lms-mcp serve \
@@ -236,6 +240,22 @@ Endpoints:
 - `POST /mcp` -- MCP protocol endpoint
 - `GET /health` -- Health check (returns `{"status":"ok"}`)
 
+This profile is **self-managed only**: anyone who can reach the port can present any token, and Canvas's API policy forbids asking other users for personal tokens. Do not expose it to other people; use the OAuth profile instead.
+
+### HTTP (OAuth, host-visible login) — `oauth_brokered`
+
+For Codex, ChatGPT, Claude, and any other host that implements the MCP authorization specification. The server is an OAuth 2.1 authorization + resource server for MCP clients and connects each user to your Canvas institution through a Canvas Developer Key. Hosts show **Not logged in** → **Authenticate**; `codex mcp login canvas-lms` completes the login in the browser. No `CANVAS_API_TOKEN` is needed, and `X-Canvas-Token` is refused.
+
+```bash
+export CANVAS_BASE_URL=https://school.instructure.com
+export CANVAS_MCP_ISSUER=http://127.0.0.1:3001          # public URL of this server; https when hosted
+export CANVAS_OAUTH_CLIENT_ID=…                          # Canvas Developer Key
+export CANVAS_OAUTH_CLIENT_SECRET=…
+npx canvas-lms-mcp serve --auth-profile oauth_brokered
+```
+
+Full setup (Canvas admin prerequisites, Codex `config.toml`, hosted deployment, verification matrix): [docs/oauth-profile.md](docs/oauth-profile.md).
+
 ### Docker
 
 ```bash
@@ -289,7 +309,11 @@ const courses = await canvas.courses.list()
 | `--base-url` | `CANVAS_BASE_URL` | (required) | Canvas instance URL |
 | `serve` | -- | stdio mode | Switch to HTTP mode |
 | `--port` | -- | `3001` | HTTP server port |
-| `--allowed-origin` | `CANVAS_ALLOWED_ORIGIN` | `http://localhost:3000` | CORS allowed origin |
+| `--allowed-origin` | `CANVAS_ALLOWED_ORIGIN` | `http://localhost:3000` | CORS allowed origin; requests carrying any other `Origin` header are refused |
+| `--auth-profile` | `CANVAS_AUTH_PROFILE` | `local_static_token` (stdio) / `remote_static_token` (`serve`) | Auth profile: `local_static_token`, `remote_static_token`, or `oauth_brokered` (see [docs/oauth-profile.md](docs/oauth-profile.md)) |
+| `--host` | `CANVAS_HTTP_HOST` | all interfaces; `127.0.0.1` in `oauth_brokered` | Bind address for HTTP mode |
+| `--issuer` | `CANVAS_MCP_ISSUER` | (required in `oauth_brokered`) | Public URL of this server; OAuth issuer and resource prefix |
+| `doctor` | -- | -- | Print an identity-safe setup report (also `auth status`); exit 1 when something is missing |
 | `--role` | `CANVAS_ROLE` | (all tools) | Filter tools by Canvas role: `student`, `teacher`, or `admin` (see [Role-based tool filtering](#role-based-tool-filtering)) |
 | `--destructive-tools=<mode>` | `CANVAS_DESTRUCTIVE_TOOLS` | `allow` | `allow` or `block`. `block` unregisters the seven irreversible delete tools (see [Destructive tool policy](#destructive-tool-policy)) |
 
@@ -297,9 +321,20 @@ const courses = await canvas.courses.list()
 
 | Variable | Required | Description |
 |----------|----------|-------------|
-| `CANVAS_API_TOKEN` | Yes | Canvas personal access token |
+| `CANVAS_API_TOKEN` | Yes, except in `oauth_brokered` | Canvas personal access token |
 | `CANVAS_BASE_URL` | Yes | Canvas instance URL (e.g., `https://school.instructure.com`) |
 | `CANVAS_ALLOWED_ORIGIN` | No | CORS origin for HTTP mode (default: `http://localhost:3000`) |
+| `CANVAS_AUTH_PROFILE` | No | `local_static_token`, `remote_static_token`, or `oauth_brokered` (see [docs/oauth-profile.md](docs/oauth-profile.md)) |
+| `CANVAS_HTTP_HOST` | No | Bind address for HTTP mode (default: all interfaces; `127.0.0.1` in `oauth_brokered`) |
+| `CANVAS_MCP_ISSUER` | `oauth_brokered` | Public URL of this server, `https` unless loopback |
+| `CANVAS_OAUTH_CLIENT_ID` | `oauth_brokered` | Canvas Developer Key ID |
+| `CANVAS_OAUTH_CLIENT_SECRET` | `oauth_brokered` | Canvas Developer Key secret |
+| `CANVAS_OAUTH_SCOPES` | No | Space-separated Canvas API scopes for a Developer Key with *Enforce Scopes* |
+| `CANVAS_MCP_OAUTH_CLIENTS` | No | JSON array of pre-registered MCP clients |
+| `CANVAS_MCP_OAUTH_DCR` | No | `true` (default) / `false`: dynamic client registration |
+| `CANVAS_MCP_OAUTH_CIMD_ALLOWED_HOSTS` | No | Trusted Client ID Metadata Document hosts (default `chatgpt.com`; `*` any; `none` off) |
+| `CANVAS_MCP_OAUTH_STORE` | No | Path of the encrypted OAuth grant store (default: in-memory) |
+| `CANVAS_MCP_OAUTH_STORE_KEY` | With store | Secret that encrypts the grant store |
 | `CANVAS_ROLE` | No | Filter the tool list by role: `student`, `teacher`, or `admin` (see [Role-based tool filtering](#role-based-tool-filtering)) |
 | `CANVAS_ENABLE_ASSIGNMENT_SUBMISSION` | No | Set to `true` to register the opt-in [assignment submission tools](#student-assignment-submission-opt-in) |
 | `CANVAS_PSEUDONYMIZE_STUDENTS` | No | Set to `true` to enable [FERPA mode](#ferpa-mode-student-pseudonymization) |

package/bin/canvas-lms-mcp.js

@@ -6,6 +6,8 @@ if (sub === 'init') {
   await import('../dist/init.js')
 } else if (sub === 'serve') {
   await import('../dist/http.js')
+} else if (sub === 'doctor' || (sub === 'auth' && process.argv[3] === 'status')) {
+  await import('../dist/doctor.js')
 } else {
   await import('../dist/stdio.js')
 }

package/dist/auth/doctor.d.ts

@@ -0,0 +1,29 @@
+import { type AuthProfile, type TransportMode } from './profile';
+export type DoctorStatus = 'ok' | 'warn' | 'missing' | 'info';
+export interface DoctorCheck {
+    label: string;
+    status: DoctorStatus;
+    detail: string;
+}
+export interface DoctorReport {
+    mode: TransportMode;
+    profile?: AuthProfile;
+    checks: DoctorCheck[];
+    /** True when the server would start with this configuration. */
+    ready: boolean;
+}
+export type DoctorEnv = Record<string, string | undefined>;
+interface DoctorArgs {
+    mode: TransportMode;
+    authProfile?: string;
+    token?: string;
+    baseUrl?: string;
+    issuer?: string;
+    host?: string;
+}
+/** A lenient scan of the same flags `parseArgs` reads; never exits. */
+export declare function scanDoctorArgs(argv: string[]): DoctorArgs;
+export declare function diagnose(argv: string[], env: DoctorEnv): DoctorReport;
+export declare function formatReport(report: DoctorReport): string;
+export {};
+//# sourceMappingURL=doctor.d.ts.map

package/dist/auth/doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/auth/doctor.ts"],"names":[],"mappings":"AAQA,OAAO,EAKL,KAAK,WAAW,EAChB,KAAK,aAAa,EACnB,MAAM,WAAW,CAAA;AAElB,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,CAAA;AAE7D,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,YAAY,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,aAAa,CAAA;IACnB,OAAO,CAAC,EAAE,WAAW,CAAA;IACrB,MAAM,EAAE,WAAW,EAAE,CAAA;IACrB,gEAAgE;IAChE,KAAK,EAAE,OAAO,CAAA;CACf;AAED,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;AAE1D,UAAU,UAAU;IAClB,IAAI,EAAE,aAAa,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,uEAAuE;AACvE,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAyCzD;AAwDD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,SAAS,GAAG,YAAY,CAuKrE;AASD,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAazD"}

package/dist/auth/oauth/authorization-server.d.ts

@@ -0,0 +1,75 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { CanvasOAuthClient } from './canvas-oauth';
+import { ClientResolver } from './clients';
+import { type McpScope, type OAuthProfileConfig } from './config';
+import type { OAuthStore } from './store';
+export declare const FLOW_COOKIE = "canvas_mcp_authz";
+export declare const SCOPE_DESCRIPTIONS: Record<McpScope, string>;
+export interface AuthorizationServerLogger {
+    warn(message: string): void;
+    error(message: string): void;
+}
+export interface AuthorizationServerOptions {
+    config: OAuthProfileConfig;
+    store: OAuthStore;
+    clients: ClientResolver;
+    canvas: CanvasOAuthClient;
+    now?: () => number;
+    log?: AuthorizationServerLogger;
+}
+export interface OAuthErrorBody {
+    error: string;
+    error_description?: string;
+}
+type Query = URLSearchParams;
+/** Canonical comparison for RFC 8707 `resource` values (§7). */
+export declare function normalizeResource(value: string): string | undefined;
+export declare class AuthorizationServer {
+    readonly config: OAuthProfileConfig;
+    private readonly store;
+    private readonly clients;
+    private readonly canvas;
+    private readonly now;
+    private readonly log;
+    private lastPurge;
+    constructor(options: AuthorizationServerOptions);
+    /** Well-known documents are host-rooted, so they match on the raw path. */
+    wellKnownPaths(): {
+        protectedResource: string[];
+        authorizationServer: string[];
+    };
+    /**
+     * Dispatch one request. `rawPath` is the request path as received;
+     * `path` has the issuer's own path prefix removed. Returns false when the
+     * request is not an OAuth endpoint.
+     */
+    handle(req: IncomingMessage, res: ServerResponse, rawPath: string, path: string, query: Query): Promise<boolean>;
+    private requireMethod;
+    get resourceMetadataUrl(): string;
+    protectedResourceMetadata(): Record<string, unknown>;
+    authorizationServerMetadata(): Record<string, unknown>;
+    handleRegister(req: IncomingMessage, res: ServerResponse): Promise<void>;
+    handleAuthorize(res: ServerResponse, query: Query): Promise<void>;
+    handleContinue(req: IncomingMessage, res: ServerResponse): Promise<void>;
+    handleCanvasCallback(req: IncomingMessage, res: ServerResponse, query: Query): Promise<void>;
+    handleToken(req: IncomingMessage, res: ServerResponse): Promise<void>;
+    private exchangeAuthorizationCode;
+    private refreshTokens;
+    private issueTokens;
+    handleRevoke(req: IncomingMessage, res: ServerResponse): Promise<void>;
+    /**
+     * Revoke everything behind a grant: every MCP token, the grant record, and
+     * the Canvas token it holds. Canvas revocation is best-effort — a Canvas
+     * outage must not leave the MCP side of the grant alive.
+     */
+    revokeGrant(grantId: string): Promise<void>;
+    private authenticateClient;
+    private invalidGrant;
+    private sendBodyError;
+    private htmlError;
+    private maybePurge;
+}
+/** Build `redirect_uri?error=…&error_description=…&state=…`. */
+export declare function errorRedirect(redirectUri: string, error: string, description: string, state: string | undefined): string;
+export {};
+//# sourceMappingURL=authorization-server.d.ts.map

package/dist/auth/oauth/authorization-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-server.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/authorization-server.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,EAAE,iBAAiB,EAAoB,MAAM,gBAAgB,CAAA;AACpE,OAAO,EAEL,cAAc,EAGf,MAAM,WAAW,CAAA;AAClB,OAAO,EAML,KAAK,QAAQ,EACb,KAAK,kBAAkB,EACxB,MAAM,UAAU,CAAA;AAwBjB,OAAO,KAAK,EAEV,UAAU,EAIX,MAAM,SAAS,CAAA;AAEhB,eAAO,MAAM,WAAW,qBAAqB,CAAA;AAI7C,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAGvD,CAAA;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,kBAAkB,CAAA;IAC1B,KAAK,EAAE,UAAU,CAAA;IACjB,OAAO,EAAE,cAAc,CAAA;IACvB,MAAM,EAAE,iBAAiB,CAAA;IACzB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,GAAG,CAAC,EAAE,yBAAyB,CAAA;CAChC;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,KAAK,KAAK,GAAG,eAAe,CAAA;AAE5B,gEAAgE;AAChE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUnE;AAED,qBAAa,mBAAmB;IAC9B,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAA;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAY;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IACxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;IAC1C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAc;IAClC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA2B;IAC/C,OAAO,CAAC,SAAS,CAAI;gBAET,OAAO,EAAE,0BAA0B;IAW/C,2EAA2E;IAC3E,cAAc,IAAI;QAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;QAAC,mBAAmB,EAAE,MAAM,EAAE,CAAA;KAAE;IAkBhF;;;;OAIG;IACG,MAAM,CACV,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,KAAK,GACX,OAAO,CAAC,OAAO,CAAC;IA8CnB,OAAO,CAAC,aAAa;IAarB,IAAI,mBAAmB,IAAI,MAAM,CAGhC;IAED,yBAAyB,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAYpD,2BAA2B,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IA0BhD,cAAc,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IA6BxE,eAAe,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC;IAwHjE,cAAc,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAgFxE,oBAAoB,CACxB,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,KAAK,GACX,OAAO,CAAC,IAAI,CAAC;IAkIV,WAAW,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;YA4B7D,yBAAyB;YA2DzB,aAAa;YAoEb,WAAW;IA4CnB,YAAY,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAkC5E;;;;OAIG;IACG,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAyBnC,kBAAkB;IAgDhC,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,aAAa;IAQrB,OAAO,CAAC,SAAS;YAUH,UAAU;CAMzB;AAED,gEAAgE;AAChE,wBAAgB,aAAa,CAC3B,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,MAAM,CAMR"}

package/dist/auth/oauth/canvas-oauth.d.ts

@@ -0,0 +1,49 @@
+export type CanvasOAuthErrorKind = 
+/** Canvas refused the grant: code invalid/expired, or the token was revoked. */
+'invalid_grant'
+/** Canvas answered, but not with a usable token response. */
+ | 'malformed'
+/** Canvas is unreachable or returned a 5xx. */
+ | 'unavailable';
+export declare class CanvasOAuthError extends Error {
+    readonly kind: CanvasOAuthErrorKind;
+    readonly status?: number;
+    constructor(kind: CanvasOAuthErrorKind, message: string, status?: number);
+}
+export interface CanvasOAuthClientConfig {
+    baseUrl: string;
+    clientId: string;
+    clientSecret: string;
+    redirectUri: string;
+    scopes?: string;
+    fetch?: typeof fetch;
+    now?: () => number;
+}
+export interface CanvasTokenSet {
+    accessToken: string;
+    refreshToken: string;
+    /** Epoch milliseconds. */
+    expiresAt: number;
+    canvasUserId: string;
+}
+export interface CanvasRefreshedToken {
+    accessToken: string;
+    expiresAt: number;
+    /** Present only if Canvas ever starts rotating refresh tokens. */
+    refreshToken?: string;
+}
+export declare class CanvasOAuthClient {
+    private readonly config;
+    private readonly fetchImpl;
+    private readonly now;
+    constructor(config: CanvasOAuthClientConfig);
+    /** Where to send the user's browser. `state` is the pending authorization id. */
+    authorizationUrl(state: string): string;
+    exchangeCode(code: string): Promise<CanvasTokenSet>;
+    refresh(refreshToken: string): Promise<CanvasRefreshedToken>;
+    /** Revoke a Canvas access token (and with it the grant's refresh token). */
+    revoke(accessToken: string): Promise<void>;
+    private expiresAt;
+    private tokenRequest;
+}
+//# sourceMappingURL=canvas-oauth.d.ts.map

package/dist/auth/oauth/canvas-oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canvas-oauth.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/canvas-oauth.ts"],"names":[],"mappings":"AA0BA,MAAM,MAAM,oBAAoB;AAC9B,gFAAgF;AAC9E,eAAe;AACjB,6DAA6D;GAC3D,WAAW;AACb,+CAA+C;GAC7C,aAAa,CAAA;AAEjB,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAA;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;gBAEZ,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;CAMzE;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;IACpB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,0BAA0B;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,kEAAkE;IAClE,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AASD,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyB;IAChD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAc;IACxC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAc;gBAEtB,MAAM,EAAE,uBAAuB;IAM3C,iFAAiF;IACjF,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAUjC,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAgBnD,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAgBlE,4EAA4E;IACtE,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBhD,OAAO,CAAC,SAAS;YAQH,YAAY;CAmF3B"}

package/dist/auth/oauth/clients.d.ts

@@ -0,0 +1,59 @@
+import { type McpScope, type OAuthProfileConfig } from './config';
+import type { ClientAuthMethod, OAuthStore, RegisteredClient } from './store';
+export declare const ALLOWED_GRANT_TYPES: readonly ["authorization_code", "refresh_token"];
+export declare const ALLOWED_AUTH_METHODS: readonly ClientAuthMethod[];
+export declare class ClientRegistrationError extends Error {
+    readonly error: 'invalid_client_metadata' | 'invalid_redirect_uri';
+    constructor(error: ClientRegistrationError['error'], message: string);
+}
+export interface RegistrationResult {
+    client: RegisteredClient;
+    /** Returned once, never stored in the clear. */
+    clientSecret?: string;
+}
+export interface ClientResolverOptions {
+    store: OAuthStore;
+    config: Pick<OAuthProfileConfig, 'clients' | 'cimdAllowedHosts' | 'dynamicRegistration'>;
+    fetch?: typeof fetch;
+    now?: () => number;
+}
+export declare function parseScopeParam(raw: string | null | undefined): McpScope[] | undefined;
+/** Whether a client_id is shaped like a Client ID Metadata Document URL. */
+export declare function isCimdClientId(clientId: string): boolean;
+export declare class ClientResolver {
+    private readonly store;
+    private readonly config;
+    private readonly fetchImpl;
+    private readonly now;
+    constructor(options: ClientResolverOptions);
+    get cimdEnabled(): boolean;
+    get dynamicRegistrationEnabled(): boolean;
+    /** Write the operator's pre-registered clients into the store. Idempotent. */
+    seedPreregistered(): Promise<void>;
+    /**
+     * Find a client by id: the store first (pre-registered, dynamic, or a fresh
+     * CIMD cache entry), then a CIMD fetch when the id is an allowlisted URL.
+     */
+    resolve(clientId: string): Promise<RegisteredClient | undefined>;
+    isCimdHostAllowed(hostname: string): boolean;
+    private fetchCimd;
+    /** RFC 7591 dynamic registration. Throws `ClientRegistrationError`. */
+    register(body: unknown): Promise<RegistrationResult>;
+}
+interface ValidatedMetadata {
+    redirectUris: string[];
+    clientName?: string;
+    tokenEndpointAuthMethod: ClientAuthMethod;
+    grantTypes: string[];
+}
+/**
+ * Validate RFC 7591 client metadata. Shared by DCR and CIMD; the latter is
+ * public-only because this server does not support `private_key_jwt`.
+ */
+export declare function validateClientMetadata(body: unknown, options: {
+    requirePublic: boolean;
+}): ValidatedMetadata;
+/** The RFC 7591 response body for a registered client. */
+export declare function registrationResponse(result: RegistrationResult): Record<string, unknown>;
+export {};
+//# sourceMappingURL=clients.d.ts.map

package/dist/auth/oauth/clients.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clients.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/clients.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,KAAK,QAAQ,EACb,KAAK,kBAAkB,EAExB,MAAM,UAAU,CAAA;AAGjB,OAAO,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAE7E,eAAO,MAAM,mBAAmB,kDAAmD,CAAA;AACnF,eAAO,MAAM,oBAAoB,EAAE,SAAS,gBAAgB,EAI3D,CAAA;AASD,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,KAAK,EAAE,yBAAyB,GAAG,sBAAsB,CAAA;gBACtD,KAAK,EAAE,uBAAuB,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM;CAKrE;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,gBAAgB,CAAA;IACxB,gDAAgD;IAChD,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,UAAU,CAAA;IACjB,MAAM,EAAE,IAAI,CAAC,kBAAkB,EAAE,SAAS,GAAG,kBAAkB,GAAG,qBAAqB,CAAC,CAAA;IACxF,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;IACpB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,QAAQ,EAAE,GAAG,SAAS,CAUtF;AAED,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAQxD;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAY;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;IACxD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAc;IACxC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAc;gBAEtB,OAAO,EAAE,qBAAqB;IAO1C,IAAI,WAAW,IAAI,OAAO,CAEzB;IAED,IAAI,0BAA0B,IAAI,OAAO,CAExC;IAED,8EAA8E;IACxE,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAMxC;;;OAGG;IACG,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAoBtE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;YAM9B,SAAS;IA0DvB,uEAAuE;IACjE,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC;CAqB3D;AAgBD,UAAU,iBAAiB;IACzB,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,uBAAuB,EAAE,gBAAgB,CAAA;IACzC,UAAU,EAAE,MAAM,EAAE,CAAA;CACrB;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,OAAO,EACb,OAAO,EAAE;IAAE,aAAa,EAAE,OAAO,CAAA;CAAE,GAClC,iBAAiB,CAiHnB;AAaD,0DAA0D;AAC1D,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAcxF"}

package/dist/auth/oauth/config.d.ts

@@ -0,0 +1,92 @@
+/** Scopes this server issues. MCP scopes, not Canvas scopes (§7.4). */
+export declare const MCP_SCOPES: readonly ["canvas:read", "canvas:write"];
+export type McpScope = (typeof MCP_SCOPES)[number];
+export declare function isMcpScope(value: string): value is McpScope;
+/** Default CIMD trust: where Codex hosts its client metadata documents. */
+export declare const DEFAULT_CIMD_ALLOWED_HOSTS: string[];
+/** Lifetimes (seconds). */
+export declare const ACCESS_TOKEN_TTL_SECONDS: number;
+export declare const REFRESH_TOKEN_TTL_SECONDS: number;
+export declare const AUTHORIZATION_CODE_TTL_SECONDS: number;
+export declare const PENDING_AUTHORIZATION_TTL_SECONDS: number;
+export interface PreregisteredClient {
+    client_id: string;
+    client_name?: string;
+    redirect_uris: string[];
+    /** Present for confidential clients. Stored hashed in the client store. */
+    client_secret?: string;
+}
+export interface OAuthProfileConfig {
+    /** Canonical issuer: absolute URL, no trailing slash, no query/fragment. */
+    issuer: string;
+    /** `new URL(issuer).pathname` with a trailing slash stripped; '' at the root. */
+    issuerPath: string;
+    /** RFC 8707 resource identifier: `${issuer}/mcp`. */
+    resource: string;
+    canvas: {
+        baseUrl: string;
+        clientId: string;
+        clientSecret: string;
+        /** Canvas API scopes, or undefined for the Developer Key default. */
+        scopes?: string;
+    };
+    clients: PreregisteredClient[];
+    dynamicRegistration: boolean;
+    /** Lower-cased hostnames; `['*']` = any https host; `[]` = CIMD disabled. */
+    cimdAllowedHosts: string[];
+    store?: {
+        path: string;
+        keySecret: string;
+    };
+}
+/**
+ * Every environment variable the OAuth profile reads. The docs drift guard
+ * (tests/docs/oauth-profile-doc-consistency.test.ts) checks that each one is
+ * documented, so a new variable cannot ship undocumented.
+ */
+export declare const OAUTH_ENV_VARS: readonly ["CANVAS_AUTH_PROFILE", "CANVAS_HTTP_HOST", "CANVAS_MCP_ISSUER", "CANVAS_OAUTH_CLIENT_ID", "CANVAS_OAUTH_CLIENT_SECRET", "CANVAS_OAUTH_SCOPES", "CANVAS_MCP_OAUTH_CLIENTS", "CANVAS_MCP_OAUTH_DCR", "CANVAS_MCP_OAUTH_CIMD_ALLOWED_HOSTS", "CANVAS_MCP_OAUTH_STORE", "CANVAS_MCP_OAUTH_STORE_KEY"];
+export interface OAuthEnv {
+    CANVAS_BASE_URL?: string;
+    CANVAS_MCP_ISSUER?: string;
+    CANVAS_OAUTH_CLIENT_ID?: string;
+    CANVAS_OAUTH_CLIENT_SECRET?: string;
+    CANVAS_OAUTH_SCOPES?: string;
+    CANVAS_MCP_OAUTH_CLIENTS?: string;
+    CANVAS_MCP_OAUTH_DCR?: string;
+    CANVAS_MCP_OAUTH_CIMD_ALLOWED_HOSTS?: string;
+    CANVAS_MCP_OAUTH_STORE?: string;
+    CANVAS_MCP_OAUTH_STORE_KEY?: string;
+}
+export interface OAuthConfigOverrides {
+    /** `--issuer` */
+    issuer?: string;
+    /** `--base-url` / resolved Canvas base URL. */
+    baseUrl?: string;
+}
+export declare class OAuthConfigError extends Error {
+    constructor(message: string);
+}
+/**
+ * Normalise and validate the issuer (§5): absolute, `https` unless loopback,
+ * no query or fragment, trailing slash stripped.
+ */
+export declare function parseIssuer(raw: string): {
+    issuer: string;
+    issuerPath: string;
+    url: URL;
+};
+export declare function isLoopbackIssuer(issuer: string): boolean;
+/**
+ * Build the OAuth profile configuration, or throw `OAuthConfigError` naming
+ * the first thing that is wrong. `overrides` carry CLI flags, which win over
+ * the environment.
+ */
+export declare function loadOAuthProfileConfig(env: OAuthEnv, overrides?: OAuthConfigOverrides): OAuthProfileConfig;
+/**
+ * Bind-host rule (§5): a loopback issuer must not be reachable from the
+ * network. Returns the host to bind, or throws.
+ */
+export declare function resolveBindHost(config: OAuthProfileConfig, requestedHost: string | undefined): string;
+/** Hash a pre-registered client secret for storage; exported for the client store. */
+export declare function hashClientSecret(secret: string): string;
+//# sourceMappingURL=config.d.ts.map

package/dist/auth/oauth/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/config.ts"],"names":[],"mappings":"AAQA,uEAAuE;AACvE,eAAO,MAAM,UAAU,0CAA2C,CAAA;AAClE,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAA;AAElD,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,QAAQ,CAE3D;AAED,2EAA2E;AAC3E,eAAO,MAAM,0BAA0B,UAAkB,CAAA;AAEzD,2BAA2B;AAC3B,eAAO,MAAM,wBAAwB,QAAU,CAAA;AAC/C,eAAO,MAAM,yBAAyB,QAAoB,CAAA;AAC1D,eAAO,MAAM,8BAA8B,QAAS,CAAA;AACpD,eAAO,MAAM,iCAAiC,QAAU,CAAA;AAExD,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,2EAA2E;IAC3E,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAA;IACd,iFAAiF;IACjF,UAAU,EAAE,MAAM,CAAA;IAClB,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE;QACN,OAAO,EAAE,MAAM,CAAA;QACf,QAAQ,EAAE,MAAM,CAAA;QAChB,YAAY,EAAE,MAAM,CAAA;QACpB,qEAAqE;QACrE,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,CAAA;IACD,OAAO,EAAE,mBAAmB,EAAE,CAAA;IAC9B,mBAAmB,EAAE,OAAO,CAAA;IAC5B,6EAA6E;IAC7E,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAA;QACZ,SAAS,EAAE,MAAM,CAAA;KAClB,CAAA;CACF;AAED;;;;GAIG;AACH,eAAO,MAAM,cAAc,6SAYjB,CAAA;AAEV,MAAM,WAAW,QAAQ;IACvB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,0BAA0B,CAAC,EAAE,MAAM,CAAA;IACnC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,mCAAmC,CAAC,EAAE,MAAM,CAAA;IAC5C,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,0BAA0B,CAAC,EAAE,MAAM,CAAA;CACpC;AAED,MAAM,WAAW,oBAAoB;IACnC,iBAAiB;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,GAAG,CAAA;CAAE,CA4BzF;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAExD;AAyED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,QAAQ,EACb,SAAS,GAAE,oBAAyB,GACnC,kBAAkB,CA0EpB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,kBAAkB,EAC1B,aAAa,EAAE,MAAM,GAAG,SAAS,GAChC,MAAM,CAaR;AAED,sFAAsF;AACtF,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEvD"}

package/dist/auth/oauth/crypto.d.ts

@@ -0,0 +1,28 @@
+export declare const TOKEN_PREFIX: {
+    readonly access: "mcpat_";
+    readonly refresh: "mcprt_";
+    readonly code: "mcpac_";
+    readonly client: "mcpcl_";
+    readonly secret: "mcpcs_";
+};
+export type TokenKind = keyof typeof TOKEN_PREFIX;
+/** 256 bits of entropy behind a recognisable prefix. */
+export declare function mintToken(kind: TokenKind): string;
+/** Random opaque identifier (pending authorizations, grants, cookies). */
+export declare function randomId(): string;
+/** Lookup key for a token, code, or secret. Hex so it is safe in JSON and file names. */
+export declare function hashToken(value: string): string;
+export declare function sha256Base64Url(value: string): string;
+/** Constant-time string equality; unequal lengths compare false without leaking where. */
+export declare function timingSafeEqualStrings(a: string, b: string): boolean;
+/** True when `secret` hashes to `hash` (client secrets are stored hashed). */
+export declare function verifyHashedSecret(secret: string, hash: string): boolean;
+export declare function isValidCodeChallenge(challenge: string): boolean;
+export declare function isValidCodeVerifier(verifier: string): boolean;
+/**
+ * PKCE S256 check (RFC 7636 §4.6). `plain` is not a method this server
+ * accepts, so there is nothing to select on: the challenge is always compared
+ * to `BASE64URL(SHA256(verifier))`.
+ */
+export declare function verifyPkceS256(codeVerifier: string, codeChallenge: string): boolean;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/auth/oauth/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/crypto.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,YAAY;;;;;;CAMf,CAAA;AAEV,MAAM,MAAM,SAAS,GAAG,MAAM,OAAO,YAAY,CAAA;AAEjD,wDAAwD;AACxD,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAEjD;AAED,0EAA0E;AAC1E,wBAAgB,QAAQ,IAAI,MAAM,CAEjC;AAED,yFAAyF;AACzF,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,0FAA0F;AAC1F,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAKpE;AAED,8EAA8E;AAC9E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAExE;AAOD,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAGnF"}

package/dist/auth/oauth/file-store.d.ts

@@ -0,0 +1,49 @@
+import { type AuthorizationCode, type ConsumeCodeResult, type Grant, type MemoryOAuthStoreOptions, type OAuthStore, type PendingAuthorization, type RegisteredClient, type StoreSnapshot, type TokenRecord } from './store';
+export declare class OAuthStoreFileError extends Error {
+    constructor(message: string);
+}
+export declare function deriveStoreKey(secret: string): Buffer;
+export declare function encryptSnapshot(snapshot: StoreSnapshot, key: Buffer): string;
+export declare function decryptSnapshot(contents: string, key: Buffer): StoreSnapshot;
+export type FileOAuthStoreOptions = MemoryOAuthStoreOptions;
+export declare class FileOAuthStore implements OAuthStore {
+    private readonly inner;
+    private readonly path;
+    private readonly key;
+    private chain;
+    private dirty;
+    private writing;
+    private constructor();
+    /**
+     * Open (or create) the store. Throws `OAuthStoreFileError` when the file
+     * exists but cannot be read with this key — silently starting empty would
+     * strand every existing grant and hide a misconfiguration.
+     */
+    static open(path: string, keySecret: string, options?: FileOAuthStoreOptions): Promise<FileOAuthStore>;
+    /** Resolves once every mutation so far has reached disk. */
+    flush(): Promise<void>;
+    private persist;
+    private writeLoop;
+    private writeOnce;
+    private mutate;
+    getClient(clientId: string): Promise<RegisteredClient | undefined>;
+    putClient(client: RegisteredClient): Promise<void>;
+    deleteClient(clientId: string): Promise<void>;
+    putPendingAuthorization(pending: PendingAuthorization): Promise<void>;
+    getPendingAuthorization(id: string): Promise<PendingAuthorization | undefined>;
+    updatePendingAuthorization(pending: PendingAuthorization): Promise<void>;
+    takePendingAuthorization(id: string): Promise<PendingAuthorization | undefined>;
+    putAuthorizationCode(code: AuthorizationCode): Promise<void>;
+    consumeAuthorizationCode(hash: string, now: number): Promise<ConsumeCodeResult | undefined>;
+    putGrant(grant: Grant): Promise<void>;
+    getGrant(id: string): Promise<Grant | undefined>;
+    updateGrant(grant: Grant): Promise<void>;
+    deleteGrant(id: string): Promise<void>;
+    putToken(token: TokenRecord): Promise<void>;
+    getToken(hash: string): Promise<TokenRecord | undefined>;
+    takeToken(hash: string): Promise<TokenRecord | undefined>;
+    deleteToken(hash: string): Promise<void>;
+    deleteTokensForGrant(grantId: string): Promise<void>;
+    purgeExpired(now: number): Promise<void>;
+}
+//# sourceMappingURL=file-store.d.ts.map

package/dist/auth/oauth/file-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-store.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/file-store.ts"],"names":[],"mappings":"AAkBA,OAAO,EAEL,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,KAAK,EACV,KAAK,uBAAuB,EAC5B,KAAK,UAAU,EACf,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,WAAW,EACjB,MAAM,SAAS,CAAA;AAahB,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAa5E;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,aAAa,CAoC5E;AAED,MAAM,MAAM,qBAAqB,GAAG,uBAAuB,CAAA;AAE3D,qBAAa,cAAe,YAAW,UAAU;IAC/C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkB;IACxC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAQ;IAC7B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAQ;IAC5B,OAAO,CAAC,KAAK,CAAmC;IAChD,OAAO,CAAC,KAAK,CAAQ;IACrB,OAAO,CAAC,OAAO,CAAQ;IAEvB,OAAO;IAMP;;;;OAIG;WACU,IAAI,CACf,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,cAAc,CAAC;IAe1B,4DAA4D;IACtD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAI5B,OAAO,CAAC,OAAO;YAeD,SAAS;YAWT,SAAS;YAqBT,MAAM;IAMpB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAGlE,SAAS,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAGlD,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAG7C,uBAAuB,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAGrE,uBAAuB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAG9E,0BAA0B,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAGxE,wBAAwB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAG/E,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAG5D,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;IAG3F,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC;IAGrC,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC;IAGhD,WAAW,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC;IAGxC,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAGtC,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAG3C,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAGxD,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAGzD,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAGxC,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAGpD,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGzC"}

package/dist/auth/oauth/html.d.ts

@@ -0,0 +1,27 @@
+export declare function escapeHtml(value: string): string;
+export interface ConsentScope {
+    name: string;
+    description: string;
+}
+export interface ConsentPageInput {
+    clientName: string;
+    clientId: string;
+    /** True when `clientId` is a Client ID Metadata Document URL. */
+    clientIdIsUrl: boolean;
+    redirectUri: string;
+    redirectHost: string;
+    isLoopbackRedirect: boolean;
+    scopes: ConsentScope[];
+    canvasHost: string;
+    /** Form action, relative to the issuer. */
+    actionPath: string;
+    pendingId: string;
+    csrf: string;
+}
+export declare function renderConsentPage(input: ConsentPageInput): string;
+export interface ErrorPageInput {
+    title: string;
+    message: string;
+}
+export declare function renderErrorPage(input: ErrorPageInput): string;
+//# sourceMappingURL=html.d.ts.map

package/dist/auth/oauth/html.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"html.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/html.ts"],"names":[],"mappings":"AAcA,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhD;AA2CD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,iEAAiE;IACjE,aAAa,EAAE,OAAO,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,kBAAkB,EAAE,OAAO,CAAA;IAC3B,MAAM,EAAE,YAAY,EAAE,CAAA;IACtB,UAAU,EAAE,MAAM,CAAA;IAClB,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;CACb;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CA8BjE;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAO7D"}

package/dist/auth/oauth/http-util.d.ts

@@ -0,0 +1,75 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+/** Hard cap on any request body this server reads for OAuth purposes. */
+export declare const MAX_BODY_BYTES: number;
+export declare class BodyError extends Error {
+    readonly status: number;
+    constructor(message: string, status: number);
+}
+export declare function firstHeader(req: IncomingMessage, name: string): string | undefined;
+/** Media type only, lower-cased, without parameters. */
+export declare function contentType(req: IncomingMessage): string;
+export declare function readBody(req: IncomingMessage, limit?: number): Promise<string>;
+/** `application/x-www-form-urlencoded` body, as OAuth token/revoke/consent require. */
+export declare function readFormBody(req: IncomingMessage): Promise<URLSearchParams>;
+/** `application/json` body (dynamic client registration). */
+export declare function readJsonBody(req: IncomingMessage): Promise<unknown>;
+export declare function sendJson(res: ServerResponse, status: number, body: unknown, headers?: Record<string, string>): void;
+/**
+ * CSP for the two HTML pages this server serves (consent and error).
+ *
+ * Deliberately no `form-action`: both outcomes of the consent POST are a 302
+ * to an origin chosen at runtime — Canvas on allow, the client's own redirect
+ * URI on deny — and Chrome enforces `form-action` against every hop of that
+ * navigation, so `'self'` aborted the login. `form-action` has no
+ * `default-src` fallback in CSP 3, so leaving it out is what permits the
+ * redirect; nothing else in the policy is relaxed.
+ */
+export declare const HTML_CONTENT_SECURITY_POLICY = "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'; base-uri 'none'";
+/**
+ * Referrer policy for those same pages.
+ *
+ * Not `no-referrer`: per Fetch, a non-CORS POST under that policy carries
+ * `Origin: null`, which the transport's own origin allowlist then refuses —
+ * so the consent form could not be submitted from any browser. `same-origin`
+ * keeps the privacy intent (no `Referer` on the hop to Canvas or to the
+ * client's redirect URI) while still sending a real `Origin` on the form
+ * post back to the issuer.
+ */
+export declare const HTML_REFERRER_POLICY = "same-origin";
+export declare function sendHtml(res: ServerResponse, status: number, html: string, headers?: Record<string, string>): void;
+export declare function sendRedirect(res: ServerResponse, location: string, headers?: Record<string, string>): void;
+export declare function parseCookies(header: string | undefined): Record<string, string>;
+export interface CookieOptions {
+    /** Seconds; omit for a session cookie, 0 to delete. */
+    maxAge?: number;
+    secure: boolean;
+    path?: string;
+}
+export declare function serializeCookie(name: string, value: string, options: CookieOptions): string;
+/** The token from `Authorization: Bearer <token>`, or undefined. */
+export declare function parseBearer(header: string | undefined): string | undefined;
+/** Credentials from `Authorization: Basic <base64>`, or undefined. */
+export declare function parseBasicAuth(header: string | undefined): {
+    username: string;
+    password: string;
+} | undefined;
+/** A request target this server was able to parse. */
+export interface RoutedPath {
+    /** Path with the issuer path prefix removed, for routing. */
+    path: string;
+    /** Path exactly as received, for the well-known endpoints. */
+    rawPath: string;
+    query: URLSearchParams;
+}
+/**
+ * Parse `req.url` against the issuer. The path is returned with the issuer's
+ * own path prefix removed when the request carries it, so routing is the same
+ * whether a reverse proxy strips the prefix or passes it through.
+ *
+ * Returns `undefined` when the request target is not a URL at all. The node
+ * HTTP parser is happy with targets `new URL` rejects (`//a:b`, `//`), and
+ * this runs before any authentication, so throwing here ended the process for
+ * anyone who could open a socket. The caller answers 400.
+ */
+export declare function routePath(rawUrl: string | undefined, issuerPath: string): RoutedPath | undefined;
+//# sourceMappingURL=http-util.d.ts.map

package/dist/auth/oauth/http-util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-util.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/http-util.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAEhE,yEAAyE;AACzE,eAAO,MAAM,cAAc,QAAY,CAAA;AAEvC,qBAAa,SAAU,SAAQ,KAAK;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;gBACX,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAK5C;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIlF;AAED,wDAAwD;AACxD,wBAAgB,WAAW,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CAGxD;AAED,wBAAsB,QAAQ,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,SAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAmB5F;AAED,uFAAuF;AACvF,wBAAsB,YAAY,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAMjF;AAED,6DAA6D;AAC7D,wBAAsB,YAAY,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAWzE;AAED,wBAAgB,QAAQ,CACtB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,EACb,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GACnC,IAAI,CAQN;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,4BAA4B,2FACiD,CAAA;AAE1F;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,gBAAgB,CAAA;AAEjD,wBAAgB,QAAQ,CACtB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GACnC,IAAI,CAWN;AAED,wBAAgB,YAAY,CAC1B,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GACnC,IAAI,CAGN;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAiB/E;AAED,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,OAAO,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,MAAM,CAQ3F;AAED,oEAAoE;AACpE,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAI1E;AAED,sEAAsE;AACtE,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAqBpD;AAED,sDAAsD;AACtD,MAAM,WAAW,UAAU;IACzB,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAA;IACZ,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,eAAe,CAAA;CACvB;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAahG"}