corent-mcp 0.3.1 → 0.4.2

package/dist/oauth.js

@@ -0,0 +1,678 @@
+/**
+ * OAuth 2.1 authorization server for the hosted Corent MCP endpoint.
+ *
+ * Why this exists: claude.ai (and other remote MCP clients) authenticate
+ * connectors via OAuth — the user clicks "Connect", approves on our page, and
+ * the client holds a token. Without this, users must paste API keys into
+ * headers/URLs, which claude.ai custom connectors barely support.
+ *
+ * Deliberately STATELESS — no database, no session store:
+ *   - client_id      = signed blob embedding the registered redirect_uris
+ *   - authorization code = AES-256-GCM blob {api key, PKCE challenge, redirect_uri}, 5 min TTL
+ *   - access/refresh token = AES-256-GCM blob {api key}, 30/180 day TTL
+ * The user's Corent API key is the only credential; it rides encrypted inside
+ * the tokens. Revoking the key in the Corent dashboard instantly invalidates
+ * every token minted from it — that IS the revocation story.
+ *
+ * The consent page asks the user to paste their Corent API key once; we
+ * validate it against the live API before issuing a code. The key never
+ * appears in a URL and is never logged.
+ *
+ * Secret: MCP_TOKEN_SECRET env var. Rotating it invalidates all outstanding
+ * tokens (users just re-connect).
+ */
+import crypto from "node:crypto";
+import { CLASH_BOLD_WOFF2, LOGO_URL, HERO_POSTER_URL, HERO_VIDEO_URL } from "./brand.js";
+const ACCESS_TTL_S = 30 * 24 * 3600; // 30 days
+const REFRESH_TTL_S = 180 * 24 * 3600; // 180 days
+const CODE_TTL_S = 300; // 5 minutes
+// Token prefixes distinguish our minted tokens from raw co_live_ API keys.
+const P_ACCESS = "coa_";
+const P_REFRESH = "cor_";
+const P_CODE = "coc_";
+const P_CLIENT = "ccl_";
+function getSecretKey() {
+    const secret = process.env.MCP_TOKEN_SECRET;
+    if (!secret || secret.length < 16)
+        return null;
+    return crypto.createHash("sha256").update(secret).digest();
+}
+function b64url(buf) {
+    return buf.toString("base64url");
+}
+function encrypt(key, payload) {
+    const iv = crypto.randomBytes(12);
+    const cipher = crypto.createCipheriv("aes-256-gcm", key, iv);
+    const ct = Buffer.concat([cipher.update(JSON.stringify(payload), "utf8"), cipher.final()]);
+    return b64url(Buffer.concat([iv, cipher.getAuthTag(), ct]));
+}
+function decrypt(key, token) {
+    try {
+        const raw = Buffer.from(token, "base64url");
+        if (raw.length < 29)
+            return null;
+        const iv = raw.subarray(0, 12);
+        const tag = raw.subarray(12, 28);
+        const ct = raw.subarray(28);
+        const decipher = crypto.createDecipheriv("aes-256-gcm", key, iv);
+        decipher.setAuthTag(tag);
+        const pt = Buffer.concat([decipher.update(ct), decipher.final()]);
+        return JSON.parse(pt.toString("utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+function now() {
+    return Math.floor(Date.now() / 1000);
+}
+// ---------------------------------------------------------------------------
+// Client registration (RFC 7591, stateless)
+// ---------------------------------------------------------------------------
+function signClientId(key, redirectUris) {
+    const blob = b64url(Buffer.from(JSON.stringify({ ru: redirectUris, iat: now() }), "utf8"));
+    const mac = b64url(crypto.createHmac("sha256", key).update(blob).digest()).slice(0, 22);
+    return `${P_CLIENT}${blob}.${mac}`;
+}
+/** Returns the registered redirect_uris if the client_id is authentic, else null. */
+function verifyClientId(key, clientId) {
+    if (!clientId.startsWith(P_CLIENT))
+        return null;
+    const body = clientId.slice(P_CLIENT.length);
+    const dot = body.lastIndexOf(".");
+    if (dot < 0)
+        return null;
+    const blob = body.slice(0, dot);
+    const mac = body.slice(dot + 1);
+    const expected = b64url(crypto.createHmac("sha256", key).update(blob).digest()).slice(0, 22);
+    if (mac.length !== expected.length || !crypto.timingSafeEqual(Buffer.from(mac), Buffer.from(expected)))
+        return null;
+    try {
+        const parsed = JSON.parse(Buffer.from(blob, "base64url").toString("utf8"));
+        if (Array.isArray(parsed.ru) && parsed.ru.every((u) => typeof u === "string"))
+            return parsed.ru;
+    }
+    catch {
+        /* fall through */
+    }
+    return null;
+}
+function validRedirectUri(uri) {
+    try {
+        const u = new URL(uri);
+        if (u.protocol === "https:")
+            return true;
+        // Loopback redirects are allowed for local/dev MCP clients (OAuth 2.1 §8.4.2).
+        return u.protocol === "http:" && (u.hostname === "localhost" || u.hostname === "127.0.0.1");
+    }
+    catch {
+        return false;
+    }
+}
+// ---------------------------------------------------------------------------
+// Token verification (used by http.ts to resolve Bearer tokens to API keys)
+// ---------------------------------------------------------------------------
+export function isOauthToken(bearer) {
+    return bearer.startsWith(P_ACCESS) || bearer.startsWith(P_REFRESH) || bearer.startsWith(P_CODE);
+}
+/** Resolve a coa_ access token to the Corent API key inside it, or null. */
+export function apiKeyFromAccessToken(bearer) {
+    const key = getSecretKey();
+    if (!key || !bearer.startsWith(P_ACCESS))
+        return null;
+    const tok = decrypt(key, bearer.slice(P_ACCESS.length));
+    if (!tok || tok.t !== "access" || typeof tok.k !== "string")
+        return null;
+    if (typeof tok.exp !== "number" || tok.exp < now())
+        return null;
+    return tok.k;
+}
+// ---------------------------------------------------------------------------
+// HTTP helpers
+// ---------------------------------------------------------------------------
+function json(res, status, body, headers = {}) {
+    res.writeHead(status, { "Content-Type": "application/json", "Cache-Control": "no-store", ...headers });
+    res.end(JSON.stringify(body));
+}
+// Outcome-only diagnostics: never log keys, codes, tokens, or query strings.
+function olog(msg) {
+    console.error(`[oauth] ${msg}`);
+}
+// Hardening headers for the credential-bearing pages: no framing (clickjack
+// overlay on the login form), no referrer leakage, no MIME sniffing.
+const PAGE_HEADERS = {
+    "X-Frame-Options": "DENY",
+    "Content-Security-Policy": "frame-ancestors 'none'",
+    "X-Content-Type-Options": "nosniff",
+    "Referrer-Policy": "no-referrer",
+    "Cache-Control": "no-store",
+};
+function html(res, status, body) {
+    res.writeHead(status, { "Content-Type": "text/html; charset=utf-8", ...PAGE_HEADERS });
+    res.end(body);
+}
+// Per-IP attempt limiter (in-memory, per machine). Purpose: stop password
+// brute-force through /oauth/approve, and keep one abuser from getting this
+// server's egress IP rate-limited at Supabase, which would break sign-in for
+// everyone. Fixed one-minute windows are plenty here.
+const RATE_WINDOW_MS = 60_000;
+const rateBuckets = new Map();
+function rateLimited(ip, scope, max) {
+    const nowMs = Date.now();
+    if (rateBuckets.size > 10_000) {
+        for (const [k, v] of rateBuckets)
+            if (v.reset < nowMs)
+                rateBuckets.delete(k);
+    }
+    const bucketKey = `${scope}:${ip}`;
+    const b = rateBuckets.get(bucketKey);
+    if (!b || b.reset < nowMs) {
+        rateBuckets.set(bucketKey, { n: 1, reset: nowMs + RATE_WINDOW_MS });
+        return false;
+    }
+    b.n += 1;
+    return b.n > max;
+}
+function clientIp(req) {
+    const fly = req.headers["fly-client-ip"];
+    if (typeof fly === "string" && fly)
+        return fly;
+    const fwd = req.headers["x-forwarded-for"];
+    if (typeof fwd === "string" && fwd)
+        return fwd.split(",")[0].trim();
+    return req.socket.remoteAddress ?? "unknown";
+}
+function oauthError(res, status, error, description) {
+    olog(`error ${status} ${error}: ${description}`);
+    json(res, status, { error, error_description: description });
+}
+function readRawBody(req, limit = 100_000) {
+    return new Promise((resolve, reject) => {
+        let data = "";
+        req.on("data", (chunk) => {
+            data += chunk;
+            if (data.length > limit)
+                reject(new Error("body too large"));
+        });
+        req.on("end", () => resolve(data));
+        req.on("error", reject);
+    });
+}
+/** Parse a request body as form-encoded or JSON into a flat string map. */
+async function readParams(req) {
+    const raw = await readRawBody(req);
+    const type = String(req.headers["content-type"] ?? "");
+    const out = {};
+    if (type.includes("application/json")) {
+        try {
+            const parsed = JSON.parse(raw);
+            for (const [k, v] of Object.entries(parsed))
+                if (typeof v === "string")
+                    out[k] = v;
+        }
+        catch {
+            /* empty */
+        }
+    }
+    else {
+        for (const [k, v] of new URLSearchParams(raw))
+            out[k] = v;
+    }
+    return out;
+}
+function escapeHtml(s) {
+    return s
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;");
+}
+// ---------------------------------------------------------------------------
+// Consent page
+// ---------------------------------------------------------------------------
+// Mirrors the corent.tech auth pages (frontend/src/components/auth-shell.tsx):
+// dark split-screen, mono eyebrow, Clash Display heading with the blue period,
+// white/opacity form fields, and the angled white submit button. Clash Display
+// Bold is base64-embedded; logo + hero loop hotlink to the live site so the
+// page stays in sync with the brand.
+const SHARED_CSS = `
+  :root { color-scheme: dark; }
+  @font-face { font-family: "Clash Display"; font-weight: 700; font-style: normal; font-display: swap;
+               src: url(data:font/woff2;base64,${CLASH_BOLD_WOFF2}) format("woff2"); }
+  * { box-sizing: border-box; margin: 0; }
+  body { font-family: "Geist", -apple-system, "Segoe UI", Roboto, sans-serif; background: #0A0A0A; color: #fff;
+         min-height: 100vh; display: flex; }
+  .col { position: relative; display: flex; flex-direction: column; width: 100%;
+         padding: 32px 40px; }
+  header { display: flex; align-items: center; justify-content: space-between; }
+  header img { height: 22px; width: auto; display: block; }
+  .back { font-size: 13px; color: rgba(255,255,255,0.5); text-decoration: none; transition: color .2s; }
+  .back:hover { color: #fff; }
+  .middle { display: flex; flex: 1; align-items: center; }
+  .inner { width: 100%; max-width: 400px; }
+  .eyebrow { display: flex; align-items: center; gap: 10px; font-family: "Geist Mono", ui-monospace, monospace;
+             font-size: 12px; letter-spacing: 0.18em; text-transform: uppercase; }
+  .eyebrow .a { color: rgba(255,255,255,0.7); } .eyebrow .s { color: #8FB5FF; } .eyebrow .b { color: rgba(255,255,255,0.45); }
+  h1 { font-family: "Clash Display", "Geist", sans-serif; font-weight: 700; text-transform: uppercase;
+       font-size: clamp(2.2rem, 6vw, 52px); line-height: 0.95; letter-spacing: -0.02em; margin-top: 16px; }
+  h1 .dot { color: #9CC8FF; }
+  .sub { margin-top: 16px; font-size: 15px; line-height: 1.7; font-weight: 300; color: rgba(255,255,255,0.55); }
+  .sub strong { color: rgba(255,255,255,0.8); font-weight: 500; }
+  label { display: block; font-size: 13px; font-weight: 500; color: rgba(255,255,255,0.7); margin: 28px 0 8px; }
+  input[type="password"], input[type="email"] { height: 44px; width: 100%; border-radius: 8px; border: 1px solid rgba(255,255,255,0.12);
+         background: rgba(255,255,255,0.06); padding: 0 14px; font-size: 15px; color: #fff;
+         font-family: "Geist Mono", ui-monospace, monospace; outline: none; transition: border-color .2s, background .2s; }
+  input[type="password"], input[type="email"]::placeholder { color: rgba(255,255,255,0.25); }
+  input[type="password"], input[type="email"]:focus { border-color: rgba(255,255,255,0.35); background: rgba(255,255,255,0.08); }
+  .hint { margin-top: 10px; font-size: 12.5px; line-height: 1.6; color: rgba(255,255,255,0.45); }
+  .hint a { color: #8FB5FF; text-decoration: none; }
+  .hint a:hover { text-decoration: underline; }
+  .error { margin-top: 16px; padding: 11px 14px; border-radius: 8px; border: 1px solid rgba(217,105,95,0.4);
+           background: rgba(217,105,95,0.12); color: #E8A9A2; font-size: 13px; line-height: 1.5; }
+  .actions { display: flex; align-items: center; gap: 22px; margin-top: 28px; }
+  .connect { display: inline-flex; height: 48px; align-items: center; justify-content: center; border: none;
+             background: #fff; color: #000; padding: 0 24px 0 28px; font-family: inherit; font-size: 16px;
+             font-weight: 700; font-style: italic; letter-spacing: -0.01em; cursor: pointer;
+             clip-path: polygon(1rem 0, 100% 0, 100% 100%, 1rem 100%, 0 50%);
+             filter: drop-shadow(0 8px 22px rgba(0,0,0,0.4)); transition: transform .2s; }
+  .connect:hover { transform: translateY(-1px); }
+  .connect:active { transform: translateY(0) scale(0.98); }
+  .cancel { background: none; border: none; padding: 0; font-family: inherit; font-size: 14px;
+            color: rgba(255,255,255,0.5); cursor: pointer; transition: color .2s; }
+  .cancel:hover { color: #fff; }
+  .fine { margin-top: 26px; font-size: 12px; line-height: 1.6; color: rgba(255,255,255,0.35); }
+  .panel { display: none; }
+  @media (min-width: 1024px) {
+    .col { width: 46%; max-width: 640px; flex-shrink: 0; padding: 32px 48px; }
+    .panel { display: block; position: relative; flex: 1; overflow: hidden; }
+    .panel video { position: absolute; inset: 0; height: 100%; width: 100%; object-fit: cover; object-position: right; }
+    .panel .melt { pointer-events: none; position: absolute; inset: 0;
+                   background: linear-gradient(to right, #0A0A0A 0%, rgba(10,10,10,0.35) 18%, transparent 40%); }
+  }`;
+// No third-party font hosts: users type credentials on this page, so their IP
+// must not be disclosed to anyone (Google Fonts on a login page is a GDPR
+// finding). Clash Display is embedded; body text uses the system stack.
+const FONT_LINKS = "";
+const BRAND_PANEL = `<div class="panel" aria-hidden="true">
+    <video autoplay muted loop playsinline poster="${HERO_POSTER_URL}"><source src="${HERO_VIDEO_URL}" type="video/mp4"></video>
+    <div class="melt"></div>
+  </div>`;
+export function loginEnabled(cfg) {
+    return Boolean(cfg.supabaseUrl && cfg.supabaseAnonKey);
+}
+function consentPage(params, errorMsg, withLogin = true) {
+    const hidden = ["client_id", "redirect_uri", "state", "code_challenge", "code_challenge_method"]
+        .filter((k) => params[k])
+        .map((k) => `<input type="hidden" name="${k}" value="${escapeHtml(params[k])}">`)
+        .join("\n        ");
+    const err = errorMsg ? `<p class="error">${escapeHtml(errorMsg)}</p>` : "";
+    // Two ways in: sign-in (default, key minted server-side) or key-paste
+    // (fallback — also the only path for Google-login accounts, which have no
+    // password to check). A small inline script swaps which block is active.
+    const loginBlock = `
+        <div id="mode-login"${withLogin ? "" : " hidden"}>
+          <label for="email">Email</label>
+          <input type="email" id="email" name="email" placeholder="you@company.com" autocomplete="email">
+          <label for="password">Password</label>
+          <input type="password" id="password" name="password" autocomplete="current-password">
+          <p class="hint">Sign in with your Corent account. A connection key is created for you automatically — you never handle it. <a href="#" id="to-key">Prefer to paste an API key?</a></p>
+        </div>`;
+    const keyBlock = `
+        <div id="mode-key"${withLogin ? " hidden" : ""}>
+          <label for="key">Your Corent API key</label>
+          <input type="password" id="key" name="corent_api_key" placeholder="co_live_..." autocomplete="off">
+          <p class="hint">Find or create a key at <a href="https://corent.tech/dashboard/api-keys" target="_blank" rel="noopener">corent.tech &rarr; Dashboard &rarr; API keys</a>.${withLogin ? ' <a href="#" id="to-login">Sign in instead?</a>' : ""}</p>
+        </div>`;
+    const toggleScript = withLogin
+        ? `<script>
+  (function () {
+    var l = document.getElementById("mode-login"), k = document.getElementById("mode-key");
+    function swap(showKey) {
+      l.hidden = showKey; k.hidden = !showKey;
+      // Only the visible path's fields should submit values.
+      l.querySelectorAll("input").forEach(function (i) { if (showKey) i.value = ""; });
+      k.querySelectorAll("input").forEach(function (i) { if (!showKey) i.value = ""; });
+    }
+    document.getElementById("to-key").addEventListener("click", function (e) { e.preventDefault(); swap(true); });
+    var back = document.getElementById("to-login");
+    if (back) back.addEventListener("click", function (e) { e.preventDefault(); swap(false); });
+  })();
+</script>`
+        : "";
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="robots" content="noindex">
+<title>Connect to Corent</title>
+<link rel="icon" type="image/png" href="https://corent.tech/brand/intro-mark.png">
+${FONT_LINKS}
+<style>${SHARED_CSS}</style>
+</head>
+<body>
+  <div class="col">
+    <header>
+      <a href="https://corent.tech" aria-label="Corent home"><img src="${LOGO_URL}" alt="Corent"></a>
+      <a class="back" href="https://corent.tech">&larr; Back to site</a>
+    </header>
+    <div class="middle">
+      <div class="inner">
+        <p class="eyebrow"><span class="a">Authorize</span><span class="s">/</span><span class="b">MCP connector</span></p>
+        <h1>Connect your account<span class="dot">.</span></h1>
+        <p class="sub">An application is asking to use your Corent account. It will be able to <strong>generate images and videos</strong> billed to your balance, and check balance and job status. It cannot change your account settings.</p>
+        ${err}
+        <form method="POST" action="/oauth/approve">
+        ${hidden}${loginBlock}${keyBlock}
+        <div class="actions">
+          <button type="submit" name="decision" value="approve" class="connect">Connect</button>
+          <button type="submit" name="decision" value="deny" class="cancel" formnovalidate>Cancel</button>
+        </div>
+        </form>
+        <p class="fine">New connections can spend at most $10/day until you raise the limit in your dashboard. Disconnecting: revoke the connection&rsquo;s API key in your dashboard at any time.</p>
+      </div>
+    </div>
+  </div>
+  ${BRAND_PANEL}
+  ${toggleScript}
+</body>
+</html>`;
+}
+function errorPage(message) {
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="robots" content="noindex">
+<title>Corent — can’t continue</title>
+${FONT_LINKS}
+<style>${SHARED_CSS}
+  .center { display: flex; flex: 1; align-items: center; }
+</style>
+</head>
+<body>
+  <div class="col">
+    <header>
+      <a href="https://corent.tech" aria-label="Corent home"><img src="${LOGO_URL}" alt="Corent"></a>
+      <a class="back" href="https://corent.tech">&larr; Back to site</a>
+    </header>
+    <div class="middle">
+      <div class="inner">
+        <p class="eyebrow"><span class="a">Authorize</span><span class="s">/</span><span class="b">Error</span></p>
+        <h1>Can&rsquo;t continue<span class="dot">.</span></h1>
+        <p class="sub">${escapeHtml(message)}</p>
+      </div>
+    </div>
+  </div>
+  ${BRAND_PANEL}
+</body>
+</html>`;
+}
+/**
+ * Sign-in path: verify the user's Corent credentials against Supabase, then
+ * mint a fresh scoped API key via the backend using the session JWT. The user
+ * never sees or handles the key. Returns the key, or a user-facing error line.
+ * Fresh keys get the backend's safe-by-default $10/day cap.
+ */
+async function loginAndMintKey(cfg, email, password) {
+    try {
+        const login = await fetch(`${cfg.supabaseUrl}/auth/v1/token?grant_type=password`, {
+            method: "POST",
+            headers: { apikey: cfg.supabaseAnonKey, "Content-Type": "application/json" },
+            body: JSON.stringify({ email, password }),
+            signal: AbortSignal.timeout(10_000),
+        });
+        if (!login.ok) {
+            olog("approve: sign-in rejected by Supabase");
+            return {
+                error: "That email/password wasn’t accepted. If you signed up with Google, use “paste an API key instead” below.",
+            };
+        }
+        const jwt = (await login.json())?.access_token;
+        if (typeof jwt !== "string" || !jwt)
+            return { error: "Sign-in failed. Please try again." };
+        const mint = await fetch(`${cfg.apiUrl}/v1/account/api-keys`, {
+            method: "POST",
+            headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
+            body: JSON.stringify({ name: `Claude connector (${new Date().toISOString().slice(0, 10)})` }),
+            signal: AbortSignal.timeout(10_000),
+        });
+        if (!mint.ok) {
+            olog(`approve: key mint failed (${mint.status})`);
+            return { error: "Signed in, but creating the connection key failed. Please try again." };
+        }
+        const apiKey = (await mint.json())?.api_key;
+        if (typeof apiKey !== "string" || !apiKey)
+            return { error: "Key creation returned no key. Please try again." };
+        olog("approve: signed in, connection key minted");
+        return { apiKey };
+    }
+    catch {
+        return { error: "Could not reach the Corent account service. Please try again." };
+    }
+}
+/**
+ * Handle OAuth-related routes. Returns true if the request was handled.
+ * Wire this into the HTTP server BEFORE the /mcp route.
+ */
+export async function handleOauth(req, res, url, cfg) {
+    const path = url.pathname;
+    // --- Discovery metadata (RFC 8414 + RFC 9728). Some clients append the
+    // resource path ("/mcp") to the well-known URL, so serve both forms.
+    if (req.method === "GET" &&
+        (path === "/.well-known/oauth-authorization-server" || path === "/.well-known/oauth-authorization-server/mcp")) {
+        json(res, 200, {
+            issuer: cfg.publicUrl,
+            authorization_endpoint: `${cfg.publicUrl}/authorize`,
+            token_endpoint: `${cfg.publicUrl}/token`,
+            registration_endpoint: `${cfg.publicUrl}/register`,
+            response_types_supported: ["code"],
+            grant_types_supported: ["authorization_code", "refresh_token"],
+            code_challenge_methods_supported: ["S256"],
+            token_endpoint_auth_methods_supported: ["none"],
+            scopes_supported: ["corent"],
+        });
+        return true;
+    }
+    if (req.method === "GET" &&
+        (path === "/.well-known/oauth-protected-resource" || path === "/.well-known/oauth-protected-resource/mcp")) {
+        json(res, 200, {
+            resource: `${cfg.publicUrl}/mcp`,
+            authorization_servers: [cfg.publicUrl],
+            bearer_methods_supported: ["header"],
+            scopes_supported: ["corent"],
+        });
+        return true;
+    }
+    if (!["/register", "/authorize", "/oauth/approve", "/token"].includes(path))
+        return false;
+    console.error(`[oauth] ${req.method} ${path}`);
+    const key = getSecretKey();
+    if (!key) {
+        // Deployed without MCP_TOKEN_SECRET — OAuth can't mint anything safely.
+        json(res, 503, { error: "temporarily_unavailable", error_description: "OAuth is not configured on this server." });
+        return true;
+    }
+    // --- Dynamic client registration ---
+    if (path === "/register" && req.method === "POST") {
+        let body;
+        try {
+            body = JSON.parse(await readRawBody(req));
+        }
+        catch {
+            return oauthError(res, 400, "invalid_client_metadata", "Body must be JSON."), true;
+        }
+        const uris = body?.redirect_uris;
+        if (!Array.isArray(uris) || uris.length === 0 || !uris.every((u) => typeof u === "string" && validRedirectUri(u))) {
+            return (oauthError(res, 400, "invalid_redirect_uri", "redirect_uris must be https (or http://localhost) URLs."), true);
+        }
+        olog(`register: client registered for ${uris.map((u) => new URL(u).origin).join(",")}`);
+        json(res, 201, {
+            client_id: signClientId(key, uris),
+            redirect_uris: uris,
+            token_endpoint_auth_method: "none",
+            grant_types: ["authorization_code", "refresh_token"],
+            response_types: ["code"],
+            client_id_issued_at: now(),
+            client_name: typeof body?.client_name === "string" ? body.client_name : undefined,
+        });
+        return true;
+    }
+    // --- Authorization endpoint: render the consent page ---
+    if (path === "/authorize" && req.method === "GET") {
+        const q = Object.fromEntries(url.searchParams);
+        const registered = q.client_id ? verifyClientId(key, q.client_id) : null;
+        // Per OAuth 2.1: with an unverifiable client or redirect_uri we must show an
+        // error page, never redirect.
+        if (!registered) {
+            html(res, 400, errorPage("Unknown client. The application must register with this server first."));
+            return true;
+        }
+        if (!q.redirect_uri || !registered.includes(q.redirect_uri)) {
+            html(res, 400, errorPage("The redirect address does not match what the application registered."));
+            return true;
+        }
+        const redirectErr = (code, desc) => {
+            const to = new URL(q.redirect_uri);
+            to.searchParams.set("error", code);
+            to.searchParams.set("error_description", desc);
+            if (q.state)
+                to.searchParams.set("state", q.state);
+            res.writeHead(302, { Location: to.toString() });
+            res.end();
+        };
+        if (q.response_type !== "code")
+            return redirectErr("unsupported_response_type", "Only 'code' is supported."), true;
+        if (!q.code_challenge || q.code_challenge_method !== "S256")
+            return redirectErr("invalid_request", "PKCE with S256 is required."), true;
+        olog(`authorize: consent page rendered for ${new URL(q.redirect_uri).origin}`);
+        html(res, 200, consentPage(q, undefined, loginEnabled(cfg)));
+        return true;
+    }
+    // --- Consent form submission: validate the pasted key, mint a code ---
+    if (path === "/oauth/approve" && req.method === "POST") {
+        if (rateLimited(clientIp(req), "approve", 10)) {
+            olog("approve: rate limited");
+            html(res, 429, errorPage("Too many attempts. Wait a minute and try again."));
+            return true;
+        }
+        const p = await readParams(req);
+        // Re-validate everything server-side — hidden form fields are caller-controlled.
+        const registered = p.client_id ? verifyClientId(key, p.client_id) : null;
+        if (!registered || !p.redirect_uri || !registered.includes(p.redirect_uri)) {
+            html(res, 400, errorPage("This approval request is invalid or expired. Please retry from the application."));
+            return true;
+        }
+        const redirect = (params) => {
+            const to = new URL(p.redirect_uri);
+            for (const [k, v] of Object.entries(params))
+                to.searchParams.set(k, v);
+            if (p.state)
+                to.searchParams.set("state", p.state);
+            res.writeHead(302, { Location: to.toString() });
+            res.end();
+        };
+        if (p.decision !== "approve") {
+            olog("approve: user cancelled");
+            return redirect({ error: "access_denied", error_description: "The user cancelled." }), true;
+        }
+        if (!p.code_challenge) {
+            return redirect({ error: "invalid_request", error_description: "PKCE challenge missing." }), true;
+        }
+        const rerender = (msg) => html(res, 200, consentPage(p, msg, loginEnabled(cfg)));
+        let apiKey = (p.corent_api_key ?? "").trim();
+        if (apiKey) {
+            // Key-paste path: verify against the live API before minting anything.
+            let valid = false;
+            try {
+                const check = await fetch(`${cfg.apiUrl}/v1/account/balance`, {
+                    headers: { Authorization: `Bearer ${apiKey}` },
+                    signal: AbortSignal.timeout(10_000),
+                });
+                valid = check.ok;
+            }
+            catch {
+                valid = false;
+            }
+            if (!valid) {
+                olog("approve: key rejected by API, re-rendering consent");
+                return rerender("That API key was not accepted by the Corent API. Check the key and try again."), true;
+            }
+            olog("approve: key accepted, issuing code");
+        }
+        else if (loginEnabled(cfg) && (p.email ?? "").trim() && p.password) {
+            // Sign-in path: real account login; key is minted behind the scenes.
+            const result = await loginAndMintKey(cfg, (p.email ?? "").trim(), p.password);
+            if ("error" in result)
+                return rerender(result.error), true;
+            apiKey = result.apiKey;
+        }
+        else {
+            return rerender(loginEnabled(cfg) ? "Enter your email and password to connect." : "Enter your Corent API key to connect."), true;
+        }
+        const code = P_CODE +
+            encrypt(key, {
+                t: "code",
+                k: apiKey,
+                cc: p.code_challenge,
+                ru: p.redirect_uri,
+                cid: p.client_id.slice(0, 64),
+                exp: now() + CODE_TTL_S,
+            });
+        olog(`approve: code issued, redirecting to ${new URL(p.redirect_uri).origin}`);
+        return redirect({ code }), true;
+    }
+    // --- Token endpoint ---
+    if (path === "/token" && req.method === "POST") {
+        if (rateLimited(clientIp(req), "token", 30)) {
+            return oauthError(res, 429, "slow_down", "Too many token requests; retry in a minute."), true;
+        }
+        const p = await readParams(req);
+        if (p.grant_type === "authorization_code") {
+            if (!p.code?.startsWith(P_CODE))
+                return oauthError(res, 400, "invalid_grant", "Malformed code."), true;
+            const c = decrypt(key, p.code.slice(P_CODE.length));
+            if (!c || c.t !== "code" || typeof c.k !== "string" || c.exp < now())
+                return oauthError(res, 400, "invalid_grant", "Code is invalid or expired."), true;
+            if (p.redirect_uri && p.redirect_uri !== c.ru)
+                return oauthError(res, 400, "invalid_grant", "redirect_uri mismatch."), true;
+            if (!p.code_verifier)
+                return oauthError(res, 400, "invalid_grant", "PKCE code_verifier required."), true;
+            const challenge = b64url(crypto.createHash("sha256").update(p.code_verifier).digest());
+            if (challenge !== c.cc)
+                return oauthError(res, 400, "invalid_grant", "PKCE verification failed."), true;
+            console.error("[oauth] token: authorization_code exchange ok");
+            olog("token: authorization_code grant ok — connection established");
+            json(res, 200, {
+                access_token: P_ACCESS + encrypt(key, { t: "access", k: c.k, exp: now() + ACCESS_TTL_S }),
+                refresh_token: P_REFRESH + encrypt(key, { t: "refresh", k: c.k, exp: now() + REFRESH_TTL_S }),
+                token_type: "Bearer",
+                expires_in: ACCESS_TTL_S,
+                scope: "corent",
+            });
+            return true;
+        }
+        if (p.grant_type === "refresh_token") {
+            if (!p.refresh_token?.startsWith(P_REFRESH))
+                return oauthError(res, 400, "invalid_grant", "Malformed refresh token."), true;
+            const t = decrypt(key, p.refresh_token.slice(P_REFRESH.length));
+            if (!t || t.t !== "refresh" || typeof t.k !== "string" || t.exp < now())
+                return oauthError(res, 400, "invalid_grant", "Refresh token is invalid or expired."), true;
+            olog("token: refresh grant ok");
+            json(res, 200, {
+                access_token: P_ACCESS + encrypt(key, { t: "access", k: t.k, exp: now() + ACCESS_TTL_S }),
+                refresh_token: P_REFRESH + encrypt(key, { t: "refresh", k: t.k, exp: now() + REFRESH_TTL_S }),
+                token_type: "Bearer",
+                expires_in: ACCESS_TTL_S,
+                scope: "corent",
+            });
+            return true;
+        }
+        return oauthError(res, 400, "unsupported_grant_type", "Use authorization_code or refresh_token."), true;
+    }
+    // Known path, wrong method.
+    json(res, 405, { error: "invalid_request", error_description: "Method not allowed." });
+    return true;
+}