codexgpt 1.0.0

package/dist/auth/localAdminSession.js

@@ -0,0 +1,173 @@
+import { createHash, randomBytes as nodeRandomBytes, timingSafeEqual } from "node:crypto";
+const TOKEN_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+const DEFAULT_BOOTSTRAP_TTL_MS = 2 * 60 * 1000;
+const DEFAULT_IDLE_TTL_MS = 15 * 60 * 1000;
+const DEFAULT_ABSOLUTE_TTL_MS = 8 * 60 * 60 * 1000;
+const DEFAULT_MAX_SESSIONS = 4;
+export const LOCAL_ADMIN_COOKIE_NAME = "codexgpt_admin";
+function localAdminError(code, message) {
+    return Object.assign(new Error(`${code}: ${message}`), { code });
+}
+function boundedInteger(value, min, max, code) {
+    if (!Number.isSafeInteger(value) || value < min || value > max) {
+        throw localAdminError(code, "Local admin session configuration is invalid.");
+    }
+    return value;
+}
+function digest(value) {
+    return createHash("sha256").update(value, "utf8").digest("hex");
+}
+function exactLoopbackOrigin(input) {
+    let parsed;
+    try {
+        parsed = new URL(input);
+    }
+    catch {
+        throw localAdminError("AUTH_ADMIN_ORIGIN_INVALID", "Local admin origin is invalid.");
+    }
+    if (parsed.protocol !== "http:" || parsed.hostname !== "127.0.0.1" ||
+        !parsed.port || parsed.username || parsed.password || parsed.search || parsed.hash || parsed.pathname !== "/") {
+        throw localAdminError("AUTH_ADMIN_ORIGIN_INVALID", "Local admin origin must be exact HTTP loopback with an explicit port.");
+    }
+    return parsed.origin;
+}
+function equalToken(left, right) {
+    const leftBytes = Buffer.from(left, "utf8");
+    const rightBytes = Buffer.from(right, "utf8");
+    return leftBytes.length === rightBytes.length && timingSafeEqual(leftBytes, rightBytes);
+}
+export class LocalAdminSessionManager {
+    #now;
+    #randomBytes;
+    #bootstrapTtlMs;
+    #idleTtlMs;
+    #absoluteTtlMs;
+    #maxSessions;
+    #bootstraps = new Map();
+    #sessions = new Map();
+    constructor(options = {}) {
+        this.#now = options.now ?? Date.now;
+        this.#randomBytes = options.randomBytes ?? nodeRandomBytes;
+        this.#bootstrapTtlMs = boundedInteger(options.bootstrapTtlMs ?? DEFAULT_BOOTSTRAP_TTL_MS, 1_000, 15 * 60 * 1000, "AUTH_ADMIN_BOOTSTRAP_TTL_INVALID");
+        this.#idleTtlMs = boundedInteger(options.idleTtlMs ?? DEFAULT_IDLE_TTL_MS, 1_000, 60 * 60 * 1000, "AUTH_ADMIN_IDLE_TTL_INVALID");
+        this.#absoluteTtlMs = boundedInteger(options.absoluteTtlMs ?? DEFAULT_ABSOLUTE_TTL_MS, this.#idleTtlMs, 24 * 60 * 60 * 1000, "AUTH_ADMIN_ABSOLUTE_TTL_INVALID");
+        this.#maxSessions = boundedInteger(options.maxSessions ?? DEFAULT_MAX_SESSIONS, 1, 16, "AUTH_ADMIN_SESSION_CAPACITY_INVALID");
+    }
+    issueBootstrap(input) {
+        this.#prune();
+        const origin = exactLoopbackOrigin(input.origin);
+        const token = this.#randomToken();
+        const expiresAt = this.#now() + this.#bootstrapTtlMs;
+        this.#bootstraps.set(digest(token), { digest: digest(token), origin, expiresAt });
+        return Object.freeze({
+            token,
+            url: `${origin}/#bootstrap=${token}`,
+            expiresAt: new Date(expiresAt).toISOString()
+        });
+    }
+    exchangeBootstrap(token, origin) {
+        this.#prune();
+        const expectedOrigin = exactLoopbackOrigin(origin);
+        if (!TOKEN_PATTERN.test(token)) {
+            throw localAdminError("AUTH_ADMIN_BOOTSTRAP_INVALID", "Local admin bootstrap is invalid or expired.");
+        }
+        const key = digest(token);
+        const record = this.#bootstraps.get(key);
+        if (!record || record.expiresAt <= this.#now() || record.origin !== expectedOrigin) {
+            this.#bootstraps.delete(key);
+            throw localAdminError("AUTH_ADMIN_BOOTSTRAP_INVALID", "Local admin bootstrap is invalid or expired.");
+        }
+        if (this.#sessions.size >= this.#maxSessions) {
+            throw localAdminError("AUTH_ADMIN_SESSION_CAPACITY", "Local admin session capacity is full.");
+        }
+        this.#bootstraps.delete(key);
+        const cookieValue = this.#randomToken();
+        const csrfToken = this.#randomToken();
+        const now = this.#now();
+        const absoluteExpiresAt = now + this.#absoluteTtlMs;
+        this.#sessions.set(digest(cookieValue), {
+            cookieValue,
+            csrfToken,
+            createdAt: now,
+            lastSeenAt: now,
+            absoluteExpiresAt
+        });
+        return Object.freeze({
+            cookieValue,
+            csrfToken,
+            expiresAt: new Date(Math.min(absoluteExpiresAt, now + this.#idleTtlMs)).toISOString()
+        });
+    }
+    validateSession(cookieValue) {
+        this.#prune();
+        if (!TOKEN_PATTERN.test(cookieValue)) {
+            throw localAdminError("AUTH_ADMIN_SESSION_INVALID", "Local admin session is invalid.");
+        }
+        const key = digest(cookieValue);
+        const record = this.#sessions.get(key);
+        if (!record) {
+            throw localAdminError("AUTH_ADMIN_SESSION_EXPIRED", "Local admin session has expired.");
+        }
+        const now = this.#now();
+        if (record.absoluteExpiresAt <= now || record.lastSeenAt + this.#idleTtlMs <= now) {
+            this.#sessions.delete(key);
+            throw localAdminError("AUTH_ADMIN_SESSION_EXPIRED", "Local admin session has expired.");
+        }
+        record.lastSeenAt = now;
+        return Object.freeze({
+            cookieValue: record.cookieValue,
+            csrfToken: record.csrfToken,
+            expiresAt: new Date(Math.min(record.absoluteExpiresAt, now + this.#idleTtlMs)).toISOString()
+        });
+    }
+    assertCsrf(cookieValue, csrfToken) {
+        const session = this.validateSession(cookieValue);
+        if (!TOKEN_PATTERN.test(csrfToken) || !equalToken(session.csrfToken, csrfToken)) {
+            throw localAdminError("AUTH_ADMIN_CSRF_INVALID", "Local admin CSRF token is invalid.");
+        }
+    }
+    revoke(cookieValue) {
+        if (TOKEN_PATTERN.test(cookieValue))
+            this.#sessions.delete(digest(cookieValue));
+    }
+    sessionCount() {
+        this.#prune();
+        return this.#sessions.size;
+    }
+    #randomToken() {
+        const value = this.#randomBytes(32);
+        if (!Buffer.isBuffer(value) || value.length !== 32) {
+            throw localAdminError("AUTH_ADMIN_RANDOM_INVALID", "Local admin random source is invalid.");
+        }
+        return value.toString("base64url");
+    }
+    #prune() {
+        const now = this.#now();
+        for (const [key, bootstrap] of this.#bootstraps) {
+            if (bootstrap.expiresAt <= now)
+                this.#bootstraps.delete(key);
+        }
+        for (const [key, session] of this.#sessions) {
+            if (session.absoluteExpiresAt <= now || session.lastSeenAt + this.#idleTtlMs <= now) {
+                this.#sessions.delete(key);
+            }
+        }
+    }
+}
+export function parseLocalAdminCookie(header) {
+    if (!header)
+        return "";
+    let value = "";
+    let seen = false;
+    for (const part of header.split(";")) {
+        const [name, ...rest] = part.trim().split("=");
+        if (name !== LOCAL_ADMIN_COOKIE_NAME)
+            continue;
+        if (seen)
+            return "";
+        seen = true;
+        value = rest.join("=");
+    }
+    return value;
+}
+//# sourceMappingURL=localAdminSession.js.map

package/dist/auth/localAdminSession.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"localAdminSession.js","sourceRoot":"","sources":["../../src/auth/localAdminSession.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,IAAI,eAAe,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1F,MAAM,aAAa,GAAG,qBAAqB,CAAC;AAC5C,MAAM,wBAAwB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/C,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC3C,MAAM,uBAAuB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACnD,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAE/B,MAAM,CAAC,MAAM,uBAAuB,GAAG,gBAAyB,CAAC;AAqCjE,SAAS,eAAe,CAAC,IAAY,EAAE,OAAe;IACpD,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,GAAW,EAAE,GAAW,EAAE,IAAY;IAC3E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,GAAG,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;QAC/D,MAAM,eAAe,CAAC,IAAI,EAAE,+CAA+C,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,eAAe,CAAC,2BAA2B,EAAE,gCAAgC,CAAC,CAAC;IACvF,CAAC;IACD,IACE,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW;QAC9D,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,EAC7G,CAAC;QACD,MAAM,eAAe,CAAC,2BAA2B,EAAE,uEAAuE,CAAC,CAAC;IAC9H,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,KAAa;IAC7C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9C,OAAO,SAAS,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,OAAO,wBAAwB;IAC1B,IAAI,CAAe;IACnB,YAAY,CAA2B;IACvC,eAAe,CAAS;IACxB,UAAU,CAAS;IACnB,cAAc,CAAS;IACvB,YAAY,CAAS;IACrB,WAAW,GAAG,IAAI,GAAG,EAA2B,CAAC;IACjD,SAAS,GAAG,IAAI,GAAG,EAAyB,CAAC;IAEtD,YAAY,UAA2C,EAAE;QACvD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACpC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,IAAI,eAAe,CAAC;QAC3D,IAAI,CAAC,eAAe,GAAG,cAAc,CAAC,OAAO,CAAC,cAAc,IAAI,wBAAwB,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,kCAAkC,CAAC,CAAC;QACrJ,IAAI,CAAC,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,SAAS,IAAI,mBAAmB,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,6BAA6B,CAAC,CAAC;QACjI,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC,OAAO,CAAC,aAAa,IAAI,uBAAuB,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,iCAAiC,CAAC,CAAC;QAChK,IAAI,CAAC,YAAY,GAAG,cAAc,CAAC,OAAO,CAAC,WAAW,IAAI,oBAAoB,EAAE,CAAC,EAAE,EAAE,EAAE,qCAAqC,CAAC,CAAC;IAChI,CAAC;IAED,cAAc,CAAC,KAAyB;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC;QACrD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAClF,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,KAAK;YACL,GAAG,EAAE,GAAG,MAAM,eAAe,KAAK,EAAE;YACpC,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,iBAAiB,CAAC,KAAa,EAAE,MAAc;QAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,MAAM,cAAc,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,eAAe,CAAC,8BAA8B,EAAE,8CAA8C,CAAC,CAAC;QACxG,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;YACnF,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,eAAe,CAAC,8BAA8B,EAAE,8CAA8C,CAAC,CAAC;QACxG,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC7C,MAAM,eAAe,CAAC,6BAA6B,EAAE,uCAAuC,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,MAAM,iBAAiB,GAAG,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC;QACpD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE;YACtC,WAAW;YACX,SAAS;YACT,SAAS,EAAE,GAAG;YACd,UAAU,EAAE,GAAG;YACf,iBAAiB;SAClB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,WAAW;YACX,SAAS;YACT,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,EAAE;SACtF,CAAC,CAAC;IACL,CAAC;IAED,eAAe,CAAC,WAAmB;QACjC,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACrC,MAAM,eAAe,CAAC,4BAA4B,EAAE,iCAAiC,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,eAAe,CAAC,4BAA4B,EAAE,kCAAkC,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,MAAM,CAAC,iBAAiB,IAAI,GAAG,IAAI,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;YAClF,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3B,MAAM,eAAe,CAAC,4BAA4B,EAAE,kCAAkC,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC;QACxB,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,EAAE,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,EAAE;SAC7F,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,WAAmB,EAAE,SAAiB;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;YAChF,MAAM,eAAe,CAAC,yBAAyB,EAAE,oCAAoC,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAED,MAAM,CAAC,WAAmB;QACxB,IAAI,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IAClF,CAAC;IAED,YAAY;QACV,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;IAC7B,CAAC;IAED,YAAY;QACV,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACnD,MAAM,eAAe,CAAC,2BAA2B,EAAE,uCAAuC,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACrC,CAAC;IAED,MAAM;QACJ,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAChD,IAAI,SAAS,CAAC,SAAS,IAAI,GAAG;gBAAE,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/D,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAC5C,IAAI,OAAO,CAAC,iBAAiB,IAAI,GAAG,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;gBACpF,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,qBAAqB,CAAC,MAA0B;IAC9D,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,IAAI,KAAK,uBAAuB;YAAE,SAAS;QAC/C,IAAI,IAAI;YAAE,OAAO,EAAE,CAAC;QACpB,IAAI,GAAG,IAAI,CAAC;QACZ,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/auth/metadata.js

@@ -0,0 +1,69 @@
+import { assertEnabledOAuthScopes, createOAuthDeploymentIdentity } from "./schemas.js";
+export const PROTECTED_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource/mcp";
+export const PROTECTED_RESOURCE_METADATA_COMPATIBILITY_PATH = "/.well-known/oauth-protected-resource";
+export const AUTHORIZATION_SERVER_METADATA_PATH = "/.well-known/oauth-authorization-server";
+export const PUBLIC_OAUTH_ENDPOINTS = Object.freeze([
+    "/",
+    "/authorize",
+    "/authorize/status/*",
+    "/authorize/continue/*",
+    "/token",
+    "/register",
+    "/revoke",
+    "/jwks",
+    "/healthz",
+    "/mcp"
+]);
+const OPEN_MACHINE_CORS_HEADERS = Object.freeze({
+    "Access-Control-Allow-Origin": "*"
+});
+const NO_CORS_HEADERS = Object.freeze({});
+const METADATA_HEADERS = Object.freeze({
+    "Content-Type": "application/json",
+    "Cache-Control": "public, max-age=60, must-revalidate",
+    "X-Content-Type-Options": "nosniff",
+    "Access-Control-Allow-Origin": "*"
+});
+function validatedIdentity(input) {
+    return createOAuthDeploymentIdentity(input);
+}
+export function buildProtectedResourceMetadata(identityInput, enabledScopesInput) {
+    const identity = validatedIdentity(identityInput);
+    const enabledScopes = assertEnabledOAuthScopes(enabledScopesInput);
+    return Object.freeze({
+        resource: identity.resource,
+        authorization_servers: Object.freeze([identity.issuer]),
+        scopes_supported: enabledScopes,
+        bearer_methods_supported: Object.freeze(["header"]),
+        resource_documentation: `${identity.issuer}/`
+    });
+}
+export function buildAuthorizationServerMetadata(identityInput, enabledScopesInput) {
+    const identity = validatedIdentity(identityInput);
+    const enabledScopes = assertEnabledOAuthScopes(enabledScopesInput);
+    return Object.freeze({
+        issuer: identity.issuer,
+        authorization_endpoint: `${identity.issuer}/authorize`,
+        token_endpoint: `${identity.issuer}/token`,
+        registration_endpoint: `${identity.issuer}/register`,
+        revocation_endpoint: `${identity.issuer}/revoke`,
+        jwks_uri: `${identity.issuer}/jwks`,
+        response_types_supported: Object.freeze(["code"]),
+        grant_types_supported: Object.freeze(["authorization_code", "refresh_token"]),
+        code_challenge_methods_supported: Object.freeze(["S256"]),
+        authorization_response_iss_parameter_supported: true,
+        token_endpoint_auth_methods_supported: Object.freeze(["none"]),
+        revocation_endpoint_auth_methods_supported: Object.freeze(["none"]),
+        scopes_supported: enabledScopes
+    });
+}
+export function oauthCorsHeaders(kind) {
+    return kind === "metadata" || kind === "machine" ? OPEN_MACHINE_CORS_HEADERS : NO_CORS_HEADERS;
+}
+export function metadataResponse(document) {
+    return Object.freeze({
+        body: JSON.stringify(document),
+        headers: METADATA_HEADERS
+    });
+}
+//# sourceMappingURL=metadata.js.map

package/dist/auth/metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../../src/auth/metadata.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,6BAA6B,EAAE,MAAM,cAAc,CAAC;AAGvF,MAAM,CAAC,MAAM,gCAAgC,GAAG,2CAA2C,CAAC;AAC5F,MAAM,CAAC,MAAM,8CAA8C,GAAG,uCAAuC,CAAC;AACtG,MAAM,CAAC,MAAM,kCAAkC,GAAG,yCAAyC,CAAC;AAE5F,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC;IAClD,GAAG;IACH,YAAY;IACZ,qBAAqB;IACrB,uBAAuB;IACvB,QAAQ;IACR,WAAW;IACX,SAAS;IACT,OAAO;IACP,UAAU;IACV,MAAM;CACE,CAAC,CAAC;AAIZ,MAAM,yBAAyB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC9C,6BAA6B,EAAE,GAAG;CACnC,CAAC,CAAC;AACH,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAC1C,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC;IACrC,cAAc,EAAE,kBAAkB;IAClC,eAAe,EAAE,qCAAqC;IACtD,wBAAwB,EAAE,SAAS;IACnC,6BAA6B,EAAE,GAAG;CACnC,CAAC,CAAC;AA0BH,SAAS,iBAAiB,CAAC,KAA8B;IACvD,OAAO,6BAA6B,CAAC,KAAK,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,aAAsC,EACtC,kBAAqC;IAErC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC;IAClD,MAAM,aAAa,GAAG,wBAAwB,CAAC,kBAAkB,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,qBAAqB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACvD,gBAAgB,EAAE,aAAa;QAC/B,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAU,CAAC;QAC5D,sBAAsB,EAAE,GAAG,QAAQ,CAAC,MAAM,GAAG;KAC9C,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,aAAsC,EACtC,kBAAqC;IAErC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC;IAClD,MAAM,aAAa,GAAG,wBAAwB,CAAC,kBAAkB,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,sBAAsB,EAAE,GAAG,QAAQ,CAAC,MAAM,YAAY;QACtD,cAAc,EAAE,GAAG,QAAQ,CAAC,MAAM,QAAQ;QAC1C,qBAAqB,EAAE,GAAG,QAAQ,CAAC,MAAM,WAAW;QACpD,mBAAmB,EAAE,GAAG,QAAQ,CAAC,MAAM,SAAS;QAChD,QAAQ,EAAE,GAAG,QAAQ,CAAC,MAAM,OAAO;QACnC,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAU,CAAC;QAC1D,qBAAqB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,oBAAoB,EAAE,eAAe,CAAU,CAAC;QACtF,gCAAgC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAU,CAAC;QAClE,8CAA8C,EAAE,IAAI;QACpD,qCAAqC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAU,CAAC;QACvE,0CAA0C,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAU,CAAC;QAC5E,gBAAgB,EAAE,aAAa;KAChC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAmB;IAClD,OAAO,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,eAAe,CAAC;AACjG,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAmB,QAAW;IAI5D,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;QAC9B,OAAO,EAAE,gBAAgB;KAC1B,CAAC,CAAC;AACL,CAAC"}