claude-ide-bridge 2.4.1 → 2.4.3

package/dist/oauth.d.ts

@@ -1,37 +1,52 @@
-import http from "node:http";
 /**
- * OAuth 2.1 Authorization Server + Resource Server for claude-ide-bridge.
+ * OAuth 2.0 Authorization Server for claude-ide-bridge.
  *
- * Implements the MCP spec (2025-11-25) authorization requirements:
- *  - /.well-known/oauth-protected-resource  (RFC 9728)
- *  - /.well-known/oauth-authorization-server (RFC 8414)
- *  - GET  /authorize  — approval page
- *  - POST /authorize  — form submit (issues auth code)
- *  - POST /token      — code + PKCE verifier → access token
+ * Implements the MCP OAuth 2.0 profile required for authenticated remote servers:
+ *   - RFC 8414  Authorization Server Metadata (/.well-known/oauth-authorization-server)
+ *   - RFC 6749  Authorization Code Grant with PKCE (S256, RFC 7636)
+ *   - RFC 7009  Token Revocation (/oauth/revoke)
  *
- * The existing authToken from the lock file is issued as the access token —
- * no new token system is needed.
+ * Design
+ *   All state is in-memory. The bridge's static bearer token is the resource owner
+ *   credential: only someone who knows it can open an OAuth flow via the approval page.
+ *   Issued access tokens are opaque base64url strings stored in a TTL map.
+ *   resolveBearerToken() is called by server.ts to admit OAuth-issued tokens alongside
+ *   the static bridge token (backward compat).
+ *   Refresh tokens are not issued.
+ *
+ * Security
+ *   PKCE S256 mandatory. Auth codes single-use, 5 min TTL. Access tokens 1 h TTL.
+ *   All string comparisons via crypto.timingSafeEqual. HTML output attribute-escaped.
  */
-export declare const ALLOWED_REDIRECT_URIS: Set<string>;
-export declare class OAuthServer {
-    private readonly authToken;
-    private port;
-    private bindAddress;
-    private codes;
-    private pruneTimer;
-    constructor(authToken: string);
-    setPort(port: number, bindAddress?: string): void;
-    close(): void;
-    private baseUrl;
-    private pruneExpiredCodes;
-    /** WWW-Authenticate header value to include on 401 responses. */
-    wwwAuthenticate(): string;
-    handleProtectedResourceMetadata(_req: http.IncomingMessage, res: http.ServerResponse): void;
-    handleAuthorizationServerMetadata(_req: http.IncomingMessage, res: http.ServerResponse): void;
-    handleAuthorize(req: http.IncomingMessage, res: http.ServerResponse): Promise<void>;
-    private handleAuthorizeGet;
-    private handleAuthorizePost;
-    private validateAuthorizeParams;
-    handleToken(req: http.IncomingMessage, res: http.ServerResponse): Promise<void>;
+import type { IncomingMessage, ServerResponse } from "node:http";
+export interface OAuthServer {
+    handleDiscovery(res: ServerResponse): void;
+    handleAuthorize(req: IncomingMessage, res: ServerResponse): Promise<void>;
+    handleToken(req: IncomingMessage, res: ServerResponse): Promise<void>;
+    handleRevoke(req: IncomingMessage, res: ServerResponse): Promise<void>;
+    resolveBearerToken(token: string): string | null;
+}
+export declare class OAuthServerImpl implements OAuthServer {
+    private readonly bridgeToken;
+    private readonly issuerUrl;
+    private readonly authCodes;
+    private readonly accessTokens;
+    private readonly gcTimer;
+    constructor(bridgeToken: string, issuerUrl: string);
+    destroy(): void;
+    handleDiscovery(res: ServerResponse): void;
+    handleAuthorize(req: IncomingMessage, res: ServerResponse): Promise<void>;
+    private authorizeGet;
+    private authorizePost;
+    handleToken(req: IncomingMessage, res: ServerResponse): Promise<void>;
+    handleRevoke(req: IncomingMessage, res: ServerResponse): Promise<void>;
+    resolveBearerToken(token: string): string | null;
+    private randomToken;
+    private safeEqual;
+    private pkceVerify;
+    private readBody;
+    private sendJson;
+    private sendError;
+    private parseAuthorizeParams;
+    private approvalPage;
 }
-export declare function createOAuthServer(authToken: string): OAuthServer;