claude-ide-bridge 2.4.0 → 2.4.2

package/dist/oauth.d.ts

@@ -1,52 +1,37 @@
+import http from "node:http";
 /**
- * OAuth 2.0 Authorization Server for claude-ide-bridge.
+ * OAuth 2.1 Authorization Server + Resource Server for claude-ide-bridge.
  *
- * Implements the MCP OAuth 2.0 profile required for authenticated remote servers:
- *   - RFC 8414  Authorization Server Metadata (/.well-known/oauth-authorization-server)
- *   - RFC 6749  Authorization Code Grant with PKCE (S256, RFC 7636)
- *   - RFC 7009  Token Revocation (/oauth/revoke)
+ * Implements the MCP spec (2025-11-25) authorization requirements:
+ *  - /.well-known/oauth-protected-resource  (RFC 9728)
+ *  - /.well-known/oauth-authorization-server (RFC 8414)
+ *  - GET  /authorize  — approval page
+ *  - POST /authorize  — form submit (issues auth code)
+ *  - POST /token      — code + PKCE verifier → access token
  *
- * Design
- *   All state is in-memory. The bridge's static bearer token is the resource owner
- *   credential: only someone who knows it can open an OAuth flow via the approval page.
- *   Issued access tokens are opaque base64url strings stored in a TTL map.
- *   resolveBearerToken() is called by server.ts to admit OAuth-issued tokens alongside
- *   the static bridge token (backward compat).
- *   Refresh tokens are not issued.
- *
- * Security
- *   PKCE S256 mandatory. Auth codes single-use, 5 min TTL. Access tokens 1 h TTL.
- *   All string comparisons via crypto.timingSafeEqual. HTML output attribute-escaped.
+ * The existing authToken from the lock file is issued as the access token —
+ * no new token system is needed.
  */
-import type { IncomingMessage, ServerResponse } from "node:http";
-export interface OAuthServer {
-    handleDiscovery(res: ServerResponse): void;
-    handleAuthorize(req: IncomingMessage, res: ServerResponse): Promise<void>;
-    handleToken(req: IncomingMessage, res: ServerResponse): Promise<void>;
-    handleRevoke(req: IncomingMessage, res: ServerResponse): Promise<void>;
-    resolveBearerToken(token: string): string | null;
-}
-export declare class OAuthServerImpl implements OAuthServer {
-    private readonly bridgeToken;
-    private readonly issuerUrl;
-    private readonly authCodes;
-    private readonly accessTokens;
-    private readonly gcTimer;
-    constructor(bridgeToken: string, issuerUrl: string);
-    destroy(): void;
-    handleDiscovery(res: ServerResponse): void;
-    handleAuthorize(req: IncomingMessage, res: ServerResponse): Promise<void>;
-    private authorizeGet;
-    private authorizePost;
-    handleToken(req: IncomingMessage, res: ServerResponse): Promise<void>;
-    handleRevoke(req: IncomingMessage, res: ServerResponse): Promise<void>;
-    resolveBearerToken(token: string): string | null;
-    private randomToken;
-    private safeEqual;
-    private pkceVerify;
-    private readBody;
-    private sendJson;
-    private sendError;
-    private parseAuthorizeParams;
-    private approvalPage;
+export declare const ALLOWED_REDIRECT_URIS: Set<string>;
+export declare class OAuthServer {
+    private readonly authToken;
+    private port;
+    private bindAddress;
+    private codes;
+    private pruneTimer;
+    constructor(authToken: string);
+    setPort(port: number, bindAddress?: string): void;
+    close(): void;
+    private baseUrl;
+    private pruneExpiredCodes;
+    /** WWW-Authenticate header value to include on 401 responses. */
+    wwwAuthenticate(): string;
+    handleProtectedResourceMetadata(_req: http.IncomingMessage, res: http.ServerResponse): void;
+    handleAuthorizationServerMetadata(_req: http.IncomingMessage, res: http.ServerResponse): void;
+    handleAuthorize(req: http.IncomingMessage, res: http.ServerResponse): Promise<void>;
+    private handleAuthorizeGet;
+    private handleAuthorizePost;
+    private validateAuthorizeParams;
+    handleToken(req: http.IncomingMessage, res: http.ServerResponse): Promise<void>;
 }
+export declare function createOAuthServer(authToken: string): OAuthServer;