db-mcp 1.0.1

package/dist/auth/AuthorizationServerDiscovery.d.ts

@@ -0,0 +1,90 @@
+/**
+ * db-mcp - Authorization Server Discovery (RFC 8414)
+ *
+ * Discovers and caches OAuth 2.0 Authorization Server Metadata
+ * as specified in RFC 8414.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc8414
+ */
+import type { AuthorizationServerMetadata, AuthServerDiscoveryConfig } from "./types.js";
+/**
+ * Authorization Server Metadata Discovery
+ *
+ * Fetches and caches OAuth 2.0 authorization server metadata
+ * from the /.well-known/oauth-authorization-server endpoint.
+ */
+export declare class AuthorizationServerDiscovery {
+    private readonly authServerUrl;
+    private readonly cacheTtl;
+    private readonly timeout;
+    private cachedMetadata;
+    private cacheExpiry;
+    constructor(config: AuthServerDiscoveryConfig);
+    /**
+     * Discover authorization server metadata
+     *
+     * Fetches from /.well-known/oauth-authorization-server
+     * Results are cached for cacheTtl seconds.
+     *
+     * @returns Authorization server metadata
+     * @throws AuthServerDiscoveryError if discovery fails
+     */
+    discover(): Promise<AuthorizationServerMetadata>;
+    /**
+     * Validate required metadata fields per RFC 8414
+     */
+    private validateMetadata;
+    /**
+     * Get cached metadata (throws if not discovered)
+     */
+    getMetadata(): AuthorizationServerMetadata;
+    /**
+     * Get JWKS URI from metadata
+     *
+     * @throws Error if metadata not discovered or jwks_uri not present
+     */
+    getJwksUri(): string;
+    /**
+     * Get token endpoint from metadata
+     */
+    getTokenEndpoint(): string;
+    /**
+     * Get issuer from metadata
+     */
+    getIssuer(): string;
+    /**
+     * Get registration endpoint from metadata (RFC 7591)
+     *
+     * @returns Registration endpoint or null if not supported
+     */
+    getRegistrationEndpoint(): string | null;
+    /**
+     * Check if dynamic client registration is supported
+     */
+    supportsClientRegistration(): boolean;
+    /**
+     * Get supported scopes from metadata
+     */
+    getSupportedScopes(): string[];
+    /**
+     * Check if a specific scope is supported
+     */
+    isScopeSupported(scope: string): boolean;
+    /**
+     * Clear cached metadata
+     */
+    clearCache(): void;
+    /**
+     * Check if cache is valid
+     */
+    isCacheValid(): boolean;
+    /**
+     * Get the authorization server URL
+     */
+    getAuthServerUrl(): string;
+}
+/**
+ * Create an Authorization Server Discovery instance
+ */
+export declare function createAuthServerDiscovery(authServerUrl: string, options?: Partial<Omit<AuthServerDiscoveryConfig, "authServerUrl">>): AuthorizationServerDiscovery;
+//# sourceMappingURL=AuthorizationServerDiscovery.d.ts.map

package/dist/auth/AuthorizationServerDiscovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthorizationServerDiscovery.d.ts","sourceRoot":"","sources":["../../src/auth/AuthorizationServerDiscovery.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,2BAA2B,EAC3B,yBAAyB,EAC1B,MAAM,YAAY,CAAC;AAUpB;;;;;GAKG;AACH,qBAAa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IAEjC,OAAO,CAAC,cAAc,CAA4C;IAClE,OAAO,CAAC,WAAW,CAAK;gBAEZ,MAAM,EAAE,yBAAyB;IAY7C;;;;;;;;OAQG;IACG,QAAQ,IAAI,OAAO,CAAC,2BAA2B,CAAC;IAmEtD;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAqBxB;;OAEG;IACH,WAAW,IAAI,2BAA2B;IAS1C;;;;OAIG;IACH,UAAU,IAAI,MAAM;IAUpB;;OAEG;IACH,gBAAgB,IAAI,MAAM;IAI1B;;OAEG;IACH,SAAS,IAAI,MAAM;IAInB;;;;OAIG;IACH,uBAAuB,IAAI,MAAM,GAAG,IAAI;IAIxC;;OAEG;IACH,0BAA0B,IAAI,OAAO;IAIrC;;OAEG;IACH,kBAAkB,IAAI,MAAM,EAAE;IAI9B;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAMxC;;OAEG;IACH,UAAU,IAAI,IAAI;IAQlB;;OAEG;IACH,YAAY,IAAI,OAAO;IAIvB;;OAEG;IACH,gBAAgB,IAAI,MAAM;CAG3B;AAMD;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,aAAa,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,yBAAyB,EAAE,eAAe,CAAC,CAAC,GAClE,4BAA4B,CAM9B"}

package/dist/auth/AuthorizationServerDiscovery.js

@@ -0,0 +1,204 @@
+/**
+ * db-mcp - Authorization Server Discovery (RFC 8414)
+ *
+ * Discovers and caches OAuth 2.0 Authorization Server Metadata
+ * as specified in RFC 8414.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc8414
+ */
+import { AuthServerDiscoveryError } from "./errors.js";
+import { createModuleLogger, ERROR_CODES } from "../utils/logger.js";
+const logger = createModuleLogger("AUTH");
+// =============================================================================
+// Authorization Server Discovery
+// =============================================================================
+/**
+ * Authorization Server Metadata Discovery
+ *
+ * Fetches and caches OAuth 2.0 authorization server metadata
+ * from the /.well-known/oauth-authorization-server endpoint.
+ */
+export class AuthorizationServerDiscovery {
+    authServerUrl;
+    cacheTtl;
+    timeout;
+    cachedMetadata = null;
+    cacheExpiry = 0;
+    constructor(config) {
+        // Normalize URL (remove trailing slash)
+        this.authServerUrl = config.authServerUrl.replace(/\/+$/, "");
+        this.cacheTtl = config.cacheTtl ?? 3600;
+        this.timeout = config.timeout ?? 5000;
+        logger.info(`Authorization Server Discovery initialized for: ${this.authServerUrl}`, { code: "AUTH_INIT" });
+    }
+    /**
+     * Discover authorization server metadata
+     *
+     * Fetches from /.well-known/oauth-authorization-server
+     * Results are cached for cacheTtl seconds.
+     *
+     * @returns Authorization server metadata
+     * @throws AuthServerDiscoveryError if discovery fails
+     */
+    async discover() {
+        // Check cache
+        if (this.cachedMetadata && Date.now() < this.cacheExpiry) {
+            logger.info("Using cached authorization server metadata", {
+                code: "AUTH_CACHE_HIT",
+            });
+            return this.cachedMetadata;
+        }
+        const metadataUrl = `${this.authServerUrl}/.well-known/oauth-authorization-server`;
+        logger.info(`Fetching authorization server metadata from: ${metadataUrl}`, {
+            code: "AUTH_DISCOVERY",
+        });
+        try {
+            const controller = new AbortController();
+            const timeoutId = setTimeout(() => controller.abort(), this.timeout);
+            const response = await fetch(metadataUrl, {
+                method: "GET",
+                headers: {
+                    Accept: "application/json",
+                },
+                signal: controller.signal,
+            });
+            clearTimeout(timeoutId);
+            if (!response.ok) {
+                throw new Error(`HTTP ${String(response.status)}: ${response.statusText}`);
+            }
+            const metadata = (await response.json());
+            // Validate required fields per RFC 8414
+            this.validateMetadata(metadata);
+            // Cache the metadata
+            this.cachedMetadata = metadata;
+            this.cacheExpiry = Date.now() + this.cacheTtl * 1000;
+            logger.info(`Authorization server metadata cached for ${String(this.cacheTtl)}s`, { code: "AUTH_DISCOVERY_SUCCESS" });
+            return metadata;
+        }
+        catch (error) {
+            const cause = error instanceof Error ? error : new Error(String(error));
+            logger.error(`Failed to discover authorization server: ${this.authServerUrl}`, {
+                code: ERROR_CODES.AUTH.DISCOVERY_FAILED.full,
+                operation: "discover",
+                entityId: this.authServerUrl,
+                error: cause,
+            });
+            throw new AuthServerDiscoveryError(this.authServerUrl, cause);
+        }
+    }
+    /**
+     * Validate required metadata fields per RFC 8414
+     */
+    validateMetadata(metadata) {
+        if (!metadata.issuer) {
+            throw new Error("Missing required field: issuer");
+        }
+        if (!metadata.token_endpoint) {
+            throw new Error("Missing required field: token_endpoint");
+        }
+        // Validate issuer matches the expected URL
+        // Per RFC 8414, issuer MUST be identical to the authorization server URL
+        const expectedIssuer = this.authServerUrl;
+        if (metadata.issuer !== expectedIssuer) {
+            logger.warning(`Issuer mismatch: expected ${expectedIssuer}, got ${metadata.issuer}`, { code: "AUTH_ISSUER_MISMATCH" });
+            // Note: This is a warning, not an error, as some auth servers may use different URLs
+        }
+    }
+    /**
+     * Get cached metadata (throws if not discovered)
+     */
+    getMetadata() {
+        if (!this.cachedMetadata) {
+            throw new Error("Authorization server metadata not yet discovered. Call discover() first.");
+        }
+        return this.cachedMetadata;
+    }
+    /**
+     * Get JWKS URI from metadata
+     *
+     * @throws Error if metadata not discovered or jwks_uri not present
+     */
+    getJwksUri() {
+        const metadata = this.getMetadata();
+        if (!metadata.jwks_uri) {
+            throw new Error("Authorization server does not provide jwks_uri");
+        }
+        return metadata.jwks_uri;
+    }
+    /**
+     * Get token endpoint from metadata
+     */
+    getTokenEndpoint() {
+        return this.getMetadata().token_endpoint;
+    }
+    /**
+     * Get issuer from metadata
+     */
+    getIssuer() {
+        return this.getMetadata().issuer;
+    }
+    /**
+     * Get registration endpoint from metadata (RFC 7591)
+     *
+     * @returns Registration endpoint or null if not supported
+     */
+    getRegistrationEndpoint() {
+        return this.getMetadata().registration_endpoint ?? null;
+    }
+    /**
+     * Check if dynamic client registration is supported
+     */
+    supportsClientRegistration() {
+        return this.getRegistrationEndpoint() !== null;
+    }
+    /**
+     * Get supported scopes from metadata
+     */
+    getSupportedScopes() {
+        return this.getMetadata().scopes_supported ?? [];
+    }
+    /**
+     * Check if a specific scope is supported
+     */
+    isScopeSupported(scope) {
+        const supportedScopes = this.getSupportedScopes();
+        // If no scopes are listed, assume all scopes are supported
+        return supportedScopes.length === 0 || supportedScopes.includes(scope);
+    }
+    /**
+     * Clear cached metadata
+     */
+    clearCache() {
+        this.cachedMetadata = null;
+        this.cacheExpiry = 0;
+        logger.info("Authorization server metadata cache cleared", {
+            code: "AUTH_CACHE_CLEARED",
+        });
+    }
+    /**
+     * Check if cache is valid
+     */
+    isCacheValid() {
+        return this.cachedMetadata !== null && Date.now() < this.cacheExpiry;
+    }
+    /**
+     * Get the authorization server URL
+     */
+    getAuthServerUrl() {
+        return this.authServerUrl;
+    }
+}
+// =============================================================================
+// Factory Function
+// =============================================================================
+/**
+ * Create an Authorization Server Discovery instance
+ */
+export function createAuthServerDiscovery(authServerUrl, options) {
+    return new AuthorizationServerDiscovery({
+        authServerUrl,
+        cacheTtl: options?.cacheTtl,
+        timeout: options?.timeout,
+    });
+}
+//# sourceMappingURL=AuthorizationServerDiscovery.js.map

package/dist/auth/AuthorizationServerDiscovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthorizationServerDiscovery.js","sourceRoot":"","sources":["../../src/auth/AuthorizationServerDiscovery.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAErE,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;AAE1C,gFAAgF;AAChF,iCAAiC;AACjC,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,OAAO,4BAA4B;IACtB,aAAa,CAAS;IACtB,QAAQ,CAAS;IACjB,OAAO,CAAS;IAEzB,cAAc,GAAuC,IAAI,CAAC;IAC1D,WAAW,GAAG,CAAC,CAAC;IAExB,YAAY,MAAiC;QAC3C,wCAAwC;QACxC,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC;QACxC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC;QAEtC,MAAM,CAAC,IAAI,CACT,mDAAmD,IAAI,CAAC,aAAa,EAAE,EACvE,EAAE,IAAI,EAAE,WAAW,EAAE,CACtB,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,QAAQ;QACZ,cAAc;QACd,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YACzD,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE;gBACxD,IAAI,EAAE,gBAAgB;aACvB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,cAAc,CAAC;QAC7B,CAAC;QAED,MAAM,WAAW,GAAG,GAAG,IAAI,CAAC,aAAa,yCAAyC,CAAC;QAEnF,MAAM,CAAC,IAAI,CAAC,gDAAgD,WAAW,EAAE,EAAE;YACzE,IAAI,EAAE,gBAAgB;SACvB,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAErE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE;gBACxC,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE;oBACP,MAAM,EAAE,kBAAkB;iBAC3B;gBACD,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YAEH,YAAY,CAAC,SAAS,CAAC,CAAC;YAExB,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CACb,QAAQ,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,UAAU,EAAE,CAC1D,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAgC,CAAC;YAExE,wCAAwC;YACxC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAEhC,qBAAqB;YACrB,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC;YAC/B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YAErD,MAAM,CAAC,IAAI,CACT,4CAA4C,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EACpE,EAAE,IAAI,EAAE,wBAAwB,EAAE,CACnC,CAAC;YAEF,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAExE,MAAM,CAAC,KAAK,CACV,4CAA4C,IAAI,CAAC,aAAa,EAAE,EAChE;gBACE,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI;gBAC5C,SAAS,EAAE,UAAU;gBACrB,QAAQ,EAAE,IAAI,CAAC,aAAa;gBAC5B,KAAK,EAAE,KAAK;aACb,CACF,CAAC;YAEF,MAAM,IAAI,wBAAwB,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED;;OAEG;IACK,gBAAgB,CAAC,QAAqC;QAC5D,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QAED,2CAA2C;QAC3C,yEAAyE;QACzE,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC;QAC1C,IAAI,QAAQ,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;YACvC,MAAM,CAAC,OAAO,CACZ,6BAA6B,cAAc,SAAS,QAAQ,CAAC,MAAM,EAAE,EACrE,EAAE,IAAI,EAAE,sBAAsB,EAAE,CACjC,CAAC;YACF,qFAAqF;QACvF,CAAC;IACH,CAAC;IAED;;OAEG;IACH,WAAW;QACT,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,0EAA0E,CAC3E,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED;;;;OAIG;IACH,UAAU;QACR,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAEpC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,QAAQ,CAAC,QAAQ,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,cAAc,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACH,uBAAuB;QACrB,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,qBAAqB,IAAI,IAAI,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,0BAA0B;QACxB,OAAO,IAAI,CAAC,uBAAuB,EAAE,KAAK,IAAI,CAAC;IACjD,CAAC;IAED;;OAEG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,gBAAgB,IAAI,EAAE,CAAC;IACnD,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,KAAa;QAC5B,MAAM,eAAe,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAClD,2DAA2D;QAC3D,OAAO,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzE,CAAC;IAED;;OAEG;IACH,UAAU;QACR,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC3B,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,6CAA6C,EAAE;YACzD,IAAI,EAAE,oBAAoB;SAC3B,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,cAAc,KAAK,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC;IACvE,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;CACF;AAED,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,yBAAyB,CACvC,aAAqB,EACrB,OAAmE;IAEnE,OAAO,IAAI,4BAA4B,CAAC;QACtC,aAAa;QACb,QAAQ,EAAE,OAAO,EAAE,QAAQ;QAC3B,OAAO,EAAE,OAAO,EAAE,OAAO;KAC1B,CAAC,CAAC;AACL,CAAC"}

package/dist/auth/OAuthResourceServer.d.ts

@@ -0,0 +1,65 @@
+/**
+ * db-mcp - OAuth Protected Resource Server (RFC 9728)
+ *
+ * Implements the OAuth 2.0 Protected Resource Metadata endpoint
+ * as specified in RFC 9728.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc9728
+ */
+import type { RequestHandler } from "express";
+import type { ProtectedResourceMetadata, ResourceServerConfig } from "./types.js";
+/**
+ * OAuth 2.0 Protected Resource Server
+ *
+ * Provides Protected Resource Metadata (RFC 9728) for MCP authorization.
+ */
+export declare class OAuthResourceServer {
+    private readonly config;
+    private metadata;
+    constructor(config: ResourceServerConfig);
+    /**
+     * Get the Protected Resource Metadata document
+     *
+     * @returns RFC 9728 compliant metadata
+     */
+    getMetadata(): ProtectedResourceMetadata;
+    /**
+     * Build the Protected Resource Metadata document
+     */
+    private buildMetadata;
+    /**
+     * Get Express request handler for the metadata endpoint
+     *
+     * Serves: GET /.well-known/oauth-protected-resource
+     */
+    getMetadataHandler(): RequestHandler;
+    /**
+     * Generate WWW-Authenticate header for 401 responses
+     *
+     * @param error - Error type for the header
+     * @param errorDescription - Human-readable error description
+     * @returns WWW-Authenticate header value
+     */
+    getWWWAuthenticateHeader(error?: string, errorDescription?: string): string;
+    /**
+     * Get the resource URI
+     */
+    getResourceUri(): string;
+    /**
+     * Get the authorization servers
+     */
+    getAuthorizationServers(): string[];
+    /**
+     * Get supported scopes
+     */
+    getSupportedScopes(): string[];
+    /**
+     * Clear cached metadata (useful when configuration changes)
+     */
+    clearCache(): void;
+}
+/**
+ * Create an OAuth Resource Server instance
+ */
+export declare function createOAuthResourceServer(config: ResourceServerConfig): OAuthResourceServer;
+//# sourceMappingURL=OAuthResourceServer.d.ts.map

package/dist/auth/OAuthResourceServer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthResourceServer.d.ts","sourceRoot":"","sources":["../../src/auth/OAuthResourceServer.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,KAAK,EACV,yBAAyB,EACzB,oBAAoB,EACrB,MAAM,YAAY,CAAC;AAUpB;;;;GAIG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;IACxD,OAAO,CAAC,QAAQ,CAA0C;gBAE9C,MAAM,EAAE,oBAAoB;IAiBxC;;;;OAIG;IACH,WAAW,IAAI,yBAAyB;IAKxC;;OAEG;IACH,OAAO,CAAC,aAAa;IASrB;;;;OAIG;IACH,kBAAkB,IAAI,cAAc;IAcpC;;;;;;OAMG;IACH,wBAAwB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM;IAc3E;;OAEG;IACH,cAAc,IAAI,MAAM;IAIxB;;OAEG;IACH,uBAAuB,IAAI,MAAM,EAAE;IAInC;;OAEG;IACH,kBAAkB,IAAI,MAAM,EAAE;IAI9B;;OAEG;IACH,UAAU,IAAI,IAAI;CAGnB;AAMD;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,oBAAoB,GAC3B,mBAAmB,CAErB"}

package/dist/auth/OAuthResourceServer.js

@@ -0,0 +1,121 @@
+/**
+ * db-mcp - OAuth Protected Resource Server (RFC 9728)
+ *
+ * Implements the OAuth 2.0 Protected Resource Metadata endpoint
+ * as specified in RFC 9728.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc9728
+ */
+import { SUPPORTED_SCOPES } from "./scopes.js";
+import { createModuleLogger } from "../utils/logger.js";
+const logger = createModuleLogger("AUTH");
+// =============================================================================
+// OAuth Resource Server
+// =============================================================================
+/**
+ * OAuth 2.0 Protected Resource Server
+ *
+ * Provides Protected Resource Metadata (RFC 9728) for MCP authorization.
+ */
+export class OAuthResourceServer {
+    config;
+    metadata = null;
+    constructor(config) {
+        this.config = {
+            resource: config.resource,
+            authorizationServers: config.authorizationServers,
+            scopesSupported: config.scopesSupported.length > 0
+                ? config.scopesSupported
+                : [...SUPPORTED_SCOPES],
+            bearerMethodsSupported: config.bearerMethodsSupported ?? ["header"],
+        };
+        logger.info(`OAuth Resource Server initialized for: ${this.config.resource}`, { code: "AUTH_INIT" });
+    }
+    /**
+     * Get the Protected Resource Metadata document
+     *
+     * @returns RFC 9728 compliant metadata
+     */
+    getMetadata() {
+        this.metadata ??= this.buildMetadata();
+        return this.metadata;
+    }
+    /**
+     * Build the Protected Resource Metadata document
+     */
+    buildMetadata() {
+        return {
+            resource: this.config.resource,
+            authorization_servers: this.config.authorizationServers,
+            scopes_supported: this.config.scopesSupported,
+            bearer_methods_supported: this.config.bearerMethodsSupported,
+        };
+    }
+    /**
+     * Get Express request handler for the metadata endpoint
+     *
+     * Serves: GET /.well-known/oauth-protected-resource
+     */
+    getMetadataHandler() {
+        return (_req, res) => {
+            const metadata = this.getMetadata();
+            res.setHeader("Content-Type", "application/json");
+            res.setHeader("Cache-Control", "public, max-age=3600");
+            res.json(metadata);
+            logger.info("Protected Resource Metadata served", {
+                code: "AUTH_METADATA_SERVED",
+            });
+        };
+    }
+    /**
+     * Generate WWW-Authenticate header for 401 responses
+     *
+     * @param error - Error type for the header
+     * @param errorDescription - Human-readable error description
+     * @returns WWW-Authenticate header value
+     */
+    getWWWAuthenticateHeader(error, errorDescription) {
+        const parts = [`Bearer realm="${this.config.resource}"`];
+        if (error) {
+            parts.push(`error="${error}"`);
+        }
+        if (errorDescription) {
+            parts.push(`error_description="${errorDescription}"`);
+        }
+        return parts.join(", ");
+    }
+    /**
+     * Get the resource URI
+     */
+    getResourceUri() {
+        return this.config.resource;
+    }
+    /**
+     * Get the authorization servers
+     */
+    getAuthorizationServers() {
+        return [...this.config.authorizationServers];
+    }
+    /**
+     * Get supported scopes
+     */
+    getSupportedScopes() {
+        return [...this.config.scopesSupported];
+    }
+    /**
+     * Clear cached metadata (useful when configuration changes)
+     */
+    clearCache() {
+        this.metadata = null;
+    }
+}
+// =============================================================================
+// Factory Function
+// =============================================================================
+/**
+ * Create an OAuth Resource Server instance
+ */
+export function createOAuthResourceServer(config) {
+    return new OAuthResourceServer(config);
+}
+//# sourceMappingURL=OAuthResourceServer.js.map

package/dist/auth/OAuthResourceServer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthResourceServer.js","sourceRoot":"","sources":["../../src/auth/OAuthResourceServer.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;AAE1C,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,OAAO,mBAAmB;IACb,MAAM,CAAiC;IAChD,QAAQ,GAAqC,IAAI,CAAC;IAE1D,YAAY,MAA4B;QACtC,IAAI,CAAC,MAAM,GAAG;YACZ,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;YACjD,eAAe,EACb,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;gBAC/B,CAAC,CAAC,MAAM,CAAC,eAAe;gBACxB,CAAC,CAAC,CAAC,GAAG,gBAAgB,CAAC;YAC3B,sBAAsB,EAAE,MAAM,CAAC,sBAAsB,IAAI,CAAC,QAAQ,CAAC;SACpE,CAAC;QAEF,MAAM,CAAC,IAAI,CACT,0CAA0C,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,EAChE,EAAE,IAAI,EAAE,WAAW,EAAE,CACtB,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,WAAW;QACT,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;OAEG;IACK,aAAa;QACnB,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,qBAAqB,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB;YACvD,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe;YAC7C,wBAAwB,EAAE,IAAI,CAAC,MAAM,CAAC,sBAAsB;SAC7D,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,kBAAkB;QAChB,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YACnB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAEpC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAClD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;YACvD,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAEnB,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;gBAChD,IAAI,EAAE,sBAAsB;aAC7B,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,wBAAwB,CAAC,KAAc,EAAE,gBAAyB;QAChE,MAAM,KAAK,GAAG,CAAC,iBAAiB,IAAI,CAAC,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC;QAEzD,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,gBAAgB,EAAE,CAAC;YACrB,KAAK,CAAC,IAAI,CAAC,sBAAsB,gBAAgB,GAAG,CAAC,CAAC;QACxD,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,uBAAuB;QACrB,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,kBAAkB;QAChB,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,UAAU;QACR,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;IACvB,CAAC;CACF;AAED,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAA4B;IAE5B,OAAO,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC"}

package/dist/auth/TokenValidator.d.ts

@@ -0,0 +1,60 @@
+/**
+ * db-mcp - Token Validator
+ *
+ * JWT access token validation using JWKS for signature verification.
+ * Supports RSA and EC algorithms commonly used with OAuth 2.0.
+ */
+import type { TokenValidationResult, TokenValidatorConfig } from "./types.js";
+import { InvalidTokenError, TokenExpiredError, InvalidSignatureError } from "./errors.js";
+/**
+ * JWT Token Validator
+ *
+ * Validates OAuth 2.0 access tokens using JWKS for signature verification.
+ */
+export declare class TokenValidator {
+    /** Resolved configuration with all defaults applied */
+    private readonly jwksUri;
+    private readonly issuer;
+    private readonly audience;
+    private readonly clockTolerance;
+    private readonly jwksCacheTtl;
+    private jwks;
+    private jwksExpiry;
+    constructor(config: TokenValidatorConfig);
+    /**
+     * Validate an access token
+     *
+     * @param token - The JWT access token
+     * @returns Validation result with claims or error
+     */
+    validate(token: string): Promise<TokenValidationResult>;
+    /**
+     * Get or refresh the JWKS
+     */
+    private getJwks;
+    /**
+     * Extract and normalize token claims
+     */
+    private extractClaims;
+    /**
+     * Handle validation errors and convert to TokenValidationResult
+     */
+    private handleValidationError;
+    /**
+     * Refresh the JWKS cache
+     */
+    refreshJwks(): void;
+    /**
+     * Clear the JWKS cache
+     */
+    clearCache(): void;
+    /**
+     * Convert a validation error to the appropriate OAuth error class
+     */
+    static toOAuthError(result: TokenValidationResult): InvalidTokenError | TokenExpiredError | InvalidSignatureError;
+}
+/**
+ * Create a Token Validator instance
+ */
+export declare function createTokenValidator(config: TokenValidatorConfig): TokenValidator;
+//# sourceMappingURL=TokenValidator.d.ts.map

package/dist/auth/TokenValidator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TokenValidator.d.ts","sourceRoot":"","sources":["../../src/auth/TokenValidator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EACV,qBAAqB,EAErB,oBAAoB,EACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,EAEtB,MAAM,aAAa,CAAC;AAUrB;;;;GAIG;AACH,qBAAa,cAAc;IACzB,uDAAuD;IACvD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IAEtC,OAAO,CAAC,IAAI,CAAqC;IACjD,OAAO,CAAC,UAAU,CAAK;gBAEX,MAAM,EAAE,oBAAoB;IAYxC;;;;;OAKG;IACG,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IA+B7D;;OAEG;IACH,OAAO,CAAC,OAAO;IAoCf;;OAEG;IACH,OAAO,CAAC,aAAa;IA+BrB;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAqE7B;;OAEG;IACH,WAAW,IAAI,IAAI;IAOnB;;OAEG;IACH,UAAU,IAAI,IAAI;IAQlB;;OAEG;IACH,MAAM,CAAC,YAAY,CACjB,MAAM,EAAE,qBAAqB,GAC5B,iBAAiB,GAAG,iBAAiB,GAAG,qBAAqB;CAWjE;AAMD;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,oBAAoB,GAC3B,cAAc,CAEhB"}