fa-mcp-sdk 0.4.93 → 0.4.96

package/dist/core/auth/multi-auth.js

@@ -34,10 +34,7 @@ export const getTokenFromHttpHeader = (req) => {
     if (scheme.toLowerCase() === 'basic') {
         return { scheme: 'basic', credentials };
     }
-    if (jwtTokenRE.test(credentials)) {
-        return { scheme: 'jwtToken', credentials };
-    }
-    return { scheme: 'permanentServerTokens', credentials };
+    return { scheme: 'bearer', credentials, looksLikeJwt: jwtTokenRE.test(credentials) };
 };
 /**
  * Gets custom auth validator from global context.
@@ -150,54 +147,69 @@ export async function checkMultiAuth(req) {
             // fall through to standard auth
         }
     }
-    const { scheme: authType, credentials } = getTokenFromHttpHeader(req);
+    const { scheme, credentials } = getTokenFromHttpHeader(req);
     if (!credentials) {
         return { success: false, error: `${E_PFX}credentials not provided` };
     }
-    if (!authType) {
-        return { success: false, error: `${E_PFX}Cannot detect auth type from Authorization header` };
+    if (!scheme) {
+        return { success: false, error: `${E_PFX}Cannot detect auth scheme from Authorization header` };
     }
     logger.debug(`Checking auth types: ${configuredTypes}`);
-    if (!configuredSet.has(authType)) {
-        return { success: false, error: `${E_PFX}Detected in Authorisation header auth type ${authType} not configured` };
-    }
     let errorResult = undefined;
     try {
-        switch (authType) {
-            case 'permanentServerTokens': {
+        if (scheme === 'basic') {
+            if (!configuredSet.has('basic')) {
+                return {
+                    success: false,
+                    error: `${E_PFX}Detected Basic auth in Authorization header, but 'basic' is not configured`,
+                };
+            }
+            const result = checkBasicAuth(credentials);
+            if (result.success) {
+                return { ...result, authType: 'basic', payload: { user: result.username } };
+            }
+            errorResult = { ...result, authType: 'basic' };
+        }
+        else {
+            // Bearer / non-Basic: try permanent tokens first (O(1)), then JWT.
+            // Permanent tokens can contain dots, so we never classify purely by shape.
+            let permError;
+            let jwtErrorResult;
+            if (configuredSet.has('permanentServerTokens')) {
                 const { errorReason } = checkPermanentToken(credentials);
                 if (!errorReason) {
-                    return { success: true, authType };
+                    return { success: true, authType: 'permanentServerTokens' };
                 }
-                errorResult = { success: false, authType, error: `${E_PFX}${errorReason}` };
-                break;
+                permError = errorReason;
             }
-            case 'basic': {
-                const result = checkBasicAuth(credentials);
-                if (result.success) {
-                    // For basic auth, create payload with user property
-                    return { ...result, authType, payload: { user: result.username } };
-                }
-                errorResult = { ...result, authType };
-                break;
-            }
-            case 'jwtToken': {
+            if (configuredSet.has('jwtToken')) {
                 const xff = req.headers['x-forwarded-for'];
                 const xffStr = (Array.isArray(xff) ? (xff[0] ?? '') : (xff ?? '')).split(',').shift() ?? '';
                 const clientIp = req.ip ?? (xffStr.trim() || (req.socket?.remoteAddress ?? ''));
                 const { errorReason, payload, isTokenDecrypted } = checkJwtToken({ token: credentials, clientIp });
                 if (!errorReason) {
-                    return { success: true, authType, payload };
+                    return { success: true, authType: 'jwtToken', payload };
                 }
-                errorResult = { success: false, error: `${E_PFX}${errorReason}`, authType, isTokenDecrypted };
-                break;
+                jwtErrorResult = { success: false, error: `${E_PFX}${errorReason}`, authType: 'jwtToken', isTokenDecrypted };
+            }
+            // Prefer the JWT-specific error (it's more informative for malformed/expired JWTs).
+            // Fall back to the permanent token error if JWT wasn't configured/attempted.
+            if (jwtErrorResult) {
+                errorResult = jwtErrorResult;
+            }
+            else if (permError) {
+                errorResult = { success: false, authType: 'permanentServerTokens', error: `${E_PFX}${permError}` };
+            }
+            else {
+                errorResult = {
+                    success: false,
+                    error: `${E_PFX}No bearer auth method is configured (need permanentServerTokens or jwtToken)`,
+                };
             }
-            default:
-                errorResult = { success: false, error: `${E_PFX}Unknown auth type: ${authType}` };
         }
     }
     catch (error) {
-        logger.warn(`Auth type ${authType} failed with exception:`, error instanceof Error ? E_PFX + error.message : 'Unknown error');
+        logger.warn(`Auth scheme ${scheme} failed with exception:`, error instanceof Error ? E_PFX + error.message : 'Unknown error');
     }
     return (errorResult || {
         success: false,

package/dist/core/auth/multi-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"multi-auth.js","sourceRoot":"","sources":["../../../src/core/auth/multi-auth.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAE1C;;GAEG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAI1B,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxD,OAAO,EAAE,MAAM,IAAI,GAAG,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAC5F,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAGrD,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAEvE,MAAM,EACJ,OAAO,EAAE,WAAW,EACpB,qBAAqB,EAAE,EAAE,EACzB,KAAK,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,EACxD,QAAQ,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,GAC9B,GAAG,SAAS,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC;AAEpC;;GAEG;AACH,MAAM,SAAS,GAAG;IAChB,qBAAqB,EAAE,CAAC,EAAE,iBAAiB;IAC3C,KAAK,EAAE,CAAC,EAAE,kBAAkB;IAC5B,QAAQ,EAAE,CAAC,EAAE,oCAAoC;IACjD,MAAM,EAAE,CAAC;CACV,CAAC;AAEF,MAAM,QAAQ,GAAG,iBAAiB,CAAC;AACnC,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAY,EAA+C,EAAE;IAClG,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1C,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,MAAM,GAAW,EAAE,CAAC;IACxB,IAAI,WAAW,GAAW,CAAC,CAAC;IAC5B,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACrB,CAAC,MAAM,GAAG,EAAE,EAAE,WAAW,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;QACrC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC1C,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;IAC7C,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,uBAAuB,EAAE,WAAW,EAAE,CAAC;AAC1D,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,IAAI,gBAAwD,CAAC;AAE7D,SAAS,sBAAsB;IAC7B,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,gBAAgB,IAAI,SAAS,CAAC;IACvC,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,oBAAoB,CAAC;IAChD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,4DAA4D;QAC5D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,EAAE,GAAG,WAAW,CAAC,mBAAmB,CAAC;IAC3C,gBAAgB,GAAG,OAAO,EAAE,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACxD,OAAO,gBAAgB,IAAI,SAAS,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,UAAU,GAAe,EAAE,CAAC;IAClC,MAAM,MAAM,GAA6B,EAAE,CAAC;IAC5C,MAAM,MAAM,GAAwB,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,GAAG,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;IAE1G,IAAI,WAAW,EAAE,CAAC;QAChB,8BAA8B;QAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5C,UAAU,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QAED,kBAAkB;QAClB,IAAI,UAAU,EAAE,MAAM,EAAE,CAAC;YACvB,IAAI,UAAU,CAAC,MAAM,GAAG,sBAAsB,EAAE,CAAC;gBAC/C,MAAM,CAAC,QAAQ,GAAG;oBAChB,oCAAoC,UAAU,CAAC,MAAM,4BAA4B,sBAAsB,aAAa;iBACrH,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QAED,mBAAmB;QACnB,IAAI,SAAS,IAAI,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,EAAE,CAAC;YAChB,0DAA0D;YAC1D,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAChC,CAAC;YACD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAChC,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjB,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,sBAAsB,EAAE,EAAE,CAAC;QAC7B,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,MAAM,CAAC,aAAa,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,CAAC,eAAe,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,IAAI,iBAAkD,CAAC;AAEvD,SAAS,oBAAoB;IAC3B,IAAI,iBAAiB,EAAE,CAAC;QACtB,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,MAAM,MAAM,GAAG,uBAAuB,EAAE,CAAC;IACzC,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;QAChC,iBAAiB,GAAG,MAAM,CAAC;IAC7B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,KAAK,GAAG,YAAY,CAAC;AAE3B;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAY;IAC/C,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,eAAe,EAAE,GAAG,oBAAoB,EAAE,CAAC;IAC9E,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QACvB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,sCAAsC,EAAE,CAAC;IACnF,CAAC;IAED,yFAAyF;IACzF,MAAM,eAAe,GAAG,sBAAsB,EAAE,CAAC;IACjD,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,4BAA4B,GAAG,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,gBAAgB,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9F,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,4BAA4B,CAAC,CAAC;YACzE,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;gBACzB,OAAO,YAAY,CAAC;YACtB,CAAC;YACD,iDAAiD;QACnD,CAAC;QAAC,OAAO,KAAkB,EAAE,CAAC;YAC5B,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;YACrD,gCAAgC;QAClC,CAAC;IACH,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IACtE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,0BAA0B,EAAE,CAAC;IACvE,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,mDAAmD,EAAE,CAAC;IAChG,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,wBAAwB,eAAe,EAAE,CAAC,CAAC;IAExD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,8CAA8C,QAAQ,iBAAiB,EAAE,CAAC;IACpH,CAAC;IAED,IAAI,WAAW,GAA2B,SAAS,CAAC;IACpD,IAAI,CAAC;QACH,QAAQ,QAAQ,EAAE,CAAC;YACjB,KAAK,uBAAuB,CAAC,CAAC,CAAC;gBAC7B,MAAM,EAAE,WAAW,EAAE,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;gBACzD,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;gBACrC,CAAC;gBACD,WAAW,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,KAAK,GAAG,WAAW,EAAE,EAAE,CAAC;gBAC5E,MAAM;YACR,CAAC;YAED,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,MAAM,MAAM,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;gBAC3C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACnB,oDAAoD;oBACpD,OAAO,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,QAAS,EAAE,EAAE,CAAC;gBACtE,CAAC;gBACD,WAAW,GAAG,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC;gBACtC,MAAM;YACR,CAAC;YAED,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;gBAC3C,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;gBAC5F,MAAM,QAAQ,GAAG,GAAG,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC;gBAChF,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACnG,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;gBAC9C,CAAC;gBACD,WAAW,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,GAAG,WAAW,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;gBAC9F,MAAM;YACR,CAAC;YAED;gBACE,WAAW,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,sBAAsB,QAAQ,EAAE,EAAE,CAAC;QACtF,CAAC;IACH,CAAC;IAAC,OAAO,KAAkB,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CACT,aAAa,QAAQ,yBAAyB,EAC9C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CACjE,CAAC;IACJ,CAAC;IAED,OAAO,CACL,WAAW,IAAI;QACb,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,GAAG,KAAK,qDAAqD,eAAe,EAAE;KACtF,CACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,oBAAoB,EAAE,CAAC;IAEtD,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAC1C,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAClE,MAAM,CAAC,IAAI,CAAC,uBAAuB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAE5D,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAC1C,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE;YACjD,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC;IAEvC,4CAA4C;IAC5C,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;QACnB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,0DAA0D;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC;IAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/C,6BAA6B;QAC7B,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;YAC/D,OAAO,EAAE,aAAa,EAAE,UAAU,UAAU,EAAE,EAAE,CAAC;QACnD,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACvB,IAAI,KAAK,EAAE,QAAQ,IAAI,KAAK,EAAE,QAAQ,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC1F,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAC5C,OAAO,EAAE,aAAa,EAAE,SAAS,WAAW,EAAE,EAAE,CAAC;IACnD,CAAC;IAED,gEAAgE;IAChE,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC;IAChC,IAAI,SAAS,EAAE,UAAU,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpE,MAAM,KAAK,GAAG,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;QAC9D,OAAO,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;IAC9C,CAAC;IAED,sDAAsD;IACtD,OAAO,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;IACtF,OAAO,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;IAC/F,OAAO,EAAE,CAAC;AACZ,CAAC"}
+{"version":3,"file":"multi-auth.js","sourceRoot":"","sources":["../../../src/core/auth/multi-auth.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAE1C;;GAEG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAI1B,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxD,OAAO,EAAE,MAAM,IAAI,GAAG,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAC5F,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAGrD,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAEvE,MAAM,EACJ,OAAO,EAAE,WAAW,EACpB,qBAAqB,EAAE,EAAE,EACzB,KAAK,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,EACxD,QAAQ,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,GAC9B,GAAG,SAAS,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC;AAEpC;;GAEG;AACH,MAAM,SAAS,GAAG;IAChB,qBAAqB,EAAE,CAAC,EAAE,iBAAiB;IAC3C,KAAK,EAAE,CAAC,EAAE,kBAAkB;IAC5B,QAAQ,EAAE,CAAC,EAAE,oCAAoC;IACjD,MAAM,EAAE,CAAC;CACV,CAAC;AAIF,MAAM,QAAQ,GAAG,iBAAiB,CAAC;AACnC,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,GAAY,EAC2D,EAAE;IACzE,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1C,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,MAAM,GAAW,EAAE,CAAC;IACxB,IAAI,WAAW,GAAW,CAAC,CAAC;IAC5B,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACrB,CAAC,MAAM,GAAG,EAAE,EAAE,WAAW,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;QACrC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC1C,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;AACvF,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,IAAI,gBAAwD,CAAC;AAE7D,SAAS,sBAAsB;IAC7B,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,gBAAgB,IAAI,SAAS,CAAC;IACvC,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,oBAAoB,CAAC;IAChD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,4DAA4D;QAC5D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,EAAE,GAAG,WAAW,CAAC,mBAAmB,CAAC;IAC3C,gBAAgB,GAAG,OAAO,EAAE,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACxD,OAAO,gBAAgB,IAAI,SAAS,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,UAAU,GAAe,EAAE,CAAC;IAClC,MAAM,MAAM,GAA6B,EAAE,CAAC;IAC5C,MAAM,MAAM,GAAwB,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,GAAG,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;IAE1G,IAAI,WAAW,EAAE,CAAC;QAChB,8BAA8B;QAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5C,UAAU,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QAED,kBAAkB;QAClB,IAAI,UAAU,EAAE,MAAM,EAAE,CAAC;YACvB,IAAI,UAAU,CAAC,MAAM,GAAG,sBAAsB,EAAE,CAAC;gBAC/C,MAAM,CAAC,QAAQ,GAAG;oBAChB,oCAAoC,UAAU,CAAC,MAAM,4BAA4B,sBAAsB,aAAa;iBACrH,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QAED,mBAAmB;QACnB,IAAI,SAAS,IAAI,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,EAAE,CAAC;YAChB,0DAA0D;YAC1D,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAChC,CAAC;YACD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAChC,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjB,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,sBAAsB,EAAE,EAAE,CAAC;QAC7B,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,MAAM,CAAC,aAAa,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,CAAC,eAAe,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,IAAI,iBAAkD,CAAC;AAEvD,SAAS,oBAAoB;IAC3B,IAAI,iBAAiB,EAAE,CAAC;QACtB,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,MAAM,MAAM,GAAG,uBAAuB,EAAE,CAAC;IACzC,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;QAChC,iBAAiB,GAAG,MAAM,CAAC;IAC7B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,KAAK,GAAG,YAAY,CAAC;AAE3B;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAY;IAC/C,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,eAAe,EAAE,GAAG,oBAAoB,EAAE,CAAC;IAC9E,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QACvB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,sCAAsC,EAAE,CAAC;IACnF,CAAC;IAED,yFAAyF;IACzF,MAAM,eAAe,GAAG,sBAAsB,EAAE,CAAC;IACjD,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,4BAA4B,GAAG,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,gBAAgB,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9F,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,4BAA4B,CAAC,CAAC;YACzE,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;gBACzB,OAAO,YAAY,CAAC;YACtB,CAAC;YACD,iDAAiD;QACnD,CAAC;QAAC,OAAO,KAAkB,EAAE,CAAC;YAC5B,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;YACrD,gCAAgC;QAClC,CAAC;IACH,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC5D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,0BAA0B,EAAE,CAAC;IACvE,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,qDAAqD,EAAE,CAAC;IAClG,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,wBAAwB,eAAe,EAAE,CAAC,CAAC;IAExD,IAAI,WAAW,GAA2B,SAAS,CAAC;IACpD,IAAI,CAAC;QACH,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAChC,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,GAAG,KAAK,4EAA4E;iBAC5F,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;YAC3C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,OAAO,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,QAAS,EAAE,EAAE,CAAC;YAC/E,CAAC;YACD,WAAW,GAAG,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,mEAAmE;YACnE,2EAA2E;YAC3E,IAAI,SAA6B,CAAC;YAClC,IAAI,cAAsC,CAAC;YAE3C,IAAI,aAAa,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,CAAC;gBAC/C,MAAM,EAAE,WAAW,EAAE,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;gBACzD,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,uBAAuB,EAAE,CAAC;gBAC9D,CAAC;gBACD,SAAS,GAAG,WAAW,CAAC;YAC1B,CAAC;YAED,IAAI,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAClC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;gBAC3C,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;gBAC5F,MAAM,QAAQ,GAAG,GAAG,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC;gBAChF,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACnG,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;gBAC1D,CAAC;gBACD,cAAc,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,GAAG,WAAW,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC;YAC/G,CAAC;YAED,oFAAoF;YACpF,6EAA6E;YAC7E,IAAI,cAAc,EAAE,CAAC;gBACnB,WAAW,GAAG,cAAc,CAAC;YAC/B,CAAC;iBAAM,IAAI,SAAS,EAAE,CAAC;gBACrB,WAAW,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,uBAAuB,EAAE,KAAK,EAAE,GAAG,KAAK,GAAG,SAAS,EAAE,EAAE,CAAC;YACrG,CAAC;iBAAM,CAAC;gBACN,WAAW,GAAG;oBACZ,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,GAAG,KAAK,8EAA8E;iBAC9F,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAkB,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CACT,eAAe,MAAM,yBAAyB,EAC9C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CACjE,CAAC;IACJ,CAAC;IAED,OAAO,CACL,WAAW,IAAI;QACb,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,GAAG,KAAK,qDAAqD,eAAe,EAAE;KACtF,CACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,oBAAoB,EAAE,CAAC;IAEtD,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAC1C,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAClE,MAAM,CAAC,IAAI,CAAC,uBAAuB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAE5D,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAC1C,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE;YACjD,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC;IAEvC,4CAA4C;IAC5C,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;QACnB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,0DAA0D;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC;IAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/C,6BAA6B;QAC7B,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;YAC/D,OAAO,EAAE,aAAa,EAAE,UAAU,UAAU,EAAE,EAAE,CAAC;QACnD,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACvB,IAAI,KAAK,EAAE,QAAQ,IAAI,KAAK,EAAE,QAAQ,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC1F,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAC5C,OAAO,EAAE,aAAa,EAAE,SAAS,WAAW,EAAE,EAAE,CAAC;IACnD,CAAC;IAED,gEAAgE;IAChE,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC;IAChC,IAAI,SAAS,EAAE,UAAU,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpE,MAAM,KAAK,GAAG,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;QAC9D,OAAO,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;IAC9C,CAAC;IAED,sDAAsD;IACtD,OAAO,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;IACtF,OAAO,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;IAC/F,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/core/auth/revocation.d.ts

@@ -1,3 +1,4 @@
 export declare const isJwtTokenRevoked: (token: string) => boolean;
+export declare const isJtiRevoked: (jti: string) => boolean;
 export declare const isUserRevoked: (user: string) => boolean;
 //# sourceMappingURL=revocation.d.ts.map

package/dist/core/auth/revocation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"revocation.d.ts","sourceRoot":"","sources":["../../../src/core/auth/revocation.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,iBAAiB,GAAI,OAAO,MAAM,KAAG,OAA4C,CAAC;AAE/F,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,KAAG,OAAwD,CAAC"}
+{"version":3,"file":"revocation.d.ts","sourceRoot":"","sources":["../../../src/core/auth/revocation.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,iBAAiB,GAAI,OAAO,MAAM,KAAG,OAAgD,CAAC;AAEnG,eAAO,MAAM,YAAY,GAAI,KAAK,MAAM,KAAG,OAAuC,CAAC;AAEnF,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,KAAG,OAAwD,CAAC"}

package/dist/core/auth/revocation.js

@@ -1,8 +1,15 @@
 import { appConfig } from '../bootstrap/init-config.js';
 import { trim } from '../utils/utils.js';
 const revoked = appConfig.webServer?.auth?.revoked || {};
-const revokedTokensSet = new Set((Array.isArray(revoked.jwtTokens) ? revoked.jwtTokens : []).map((e) => trim(e?.token)).filter(Boolean));
+const entries = (Array.isArray(revoked.jwtTokens) ? revoked.jwtTokens : [])
+    .map((e) => trim(e?.token))
+    .filter(Boolean);
+// Full-token entries (legacy `<expire>.<hex>` or full standard JWT `a.b.c`) — exact match
+const revokedExactTokenSet = new Set(entries.filter((v) => v.includes('.')));
+// Bare jti entries (no dots) — match by JWT id
+const revokedJtiSet = new Set(entries.filter((v) => !v.includes('.')));
 const revokedUsersSet = new Set((Array.isArray(revoked.users) ? revoked.users : []).map((u) => trim(u).toLowerCase()).filter(Boolean));
-export const isJwtTokenRevoked = (token) => revokedTokensSet.has(trim(token));
+export const isJwtTokenRevoked = (token) => revokedExactTokenSet.has(trim(token));
+export const isJtiRevoked = (jti) => revokedJtiSet.has(trim(jti));
 export const isUserRevoked = (user) => revokedUsersSet.has(trim(user).toLowerCase());
 //# sourceMappingURL=revocation.js.map

package/dist/core/auth/revocation.js.map

@@ -1 +1 @@
-{"version":3,"file":"revocation.js","sourceRoot":"","sources":["../../../src/core/auth/revocation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxD,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAEzC,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,IAAK,EAAU,CAAC;AAElE,MAAM,gBAAgB,GAAgB,IAAI,GAAG,CAC3C,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAC5G,CAAC;AAEF,MAAM,eAAe,GAAgB,IAAI,GAAG,CAC1C,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAC3G,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAE/F,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC"}
+{"version":3,"file":"revocation.js","sourceRoot":"","sources":["../../../src/core/auth/revocation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxD,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAEzC,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,IAAK,EAAU,CAAC;AAElE,MAAM,OAAO,GAAa,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;KAClF,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;KAC/B,MAAM,CAAC,OAAO,CAAC,CAAC;AAEnB,0FAA0F;AAC1F,MAAM,oBAAoB,GAAgB,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAE1F,+CAA+C;AAC/C,MAAM,aAAa,GAAgB,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAEpF,MAAM,eAAe,GAAgB,IAAI,GAAG,CAC1C,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAC3G,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAEnG,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAW,EAAW,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAEnF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC"}

package/dist/core/auth/types.d.ts

@@ -5,6 +5,11 @@ export type TTokenType = 'permanent' | 'JWT';
 export interface ITokenPayload {
     user: string;
     expire: number;
+    iat?: string;
+    service?: string;
+    jti?: string;
+    iss?: string;
+    ip?: string;
     [key: string]: any;
 }
 export interface ICheckTokenResult {

package/dist/core/auth/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/auth/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,KAAK,CAAC;AAE7C,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IAEf,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,aAAa,CAAC;IAExB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,MAAM,QAAQ,GAAG,uBAAuB,GAAG,UAAU,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEjF,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,QAAQ,EAAE,CAAC;IACvB,aAAa,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7B,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACvC,OAAO,CAAC,EAAE,GAAG,CAAC;CACf"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/auth/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,KAAK,CAAC;AAE7C,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,aAAa,CAAC;IAExB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,MAAM,QAAQ,GAAG,uBAAuB,GAAG,UAAU,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEjF,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,QAAQ,EAAE,CAAC;IACvB,aAAa,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7B,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACvC,OAAO,CAAC,EAAE,GAAG,CAAC;CACf"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "fa-mcp-sdk",
   "productName": "FA MCP SDK",
-  "version": "0.4.93",
+  "version": "0.4.96",
   "description": "Core infrastructure and templates for building Model Context Protocol (MCP) servers with TypeScript",
   "type": "module",
   "main": "dist/core/index.js",
@@ -46,7 +46,9 @@
     "template:stdio": "node dist/template/start.js stdio",
     "token-gen": "node dist/core/auth/token-generator/server.js",
     "tsoa:spec": "tsoa spec",
-    "check-llm": "node dist/core/agent-tester/check-llm.js"
+    "check-llm": "node dist/core/agent-tester/check-llm.js",
+    "test:ip-check": "npm run build && node tests/ip-check.test.mjs",
+    "test:jwt": "npm run build && node tests/jwt.test.mjs"
   },
   "keywords": [
     "mcp",
@@ -86,6 +88,7 @@
     "fa-consul": "^1.0.7",
     "helmet": "^8.1.0",
     "js-yaml": "^4.1.1",
+    "jsonwebtoken": "^9.0.3",
     "node-cache": "^5.1.2",
     "openai": "^6.33.0",
     "pgvector": "^0.2.1",
@@ -101,6 +104,7 @@
     "@types/cors": "^2.8.19",
     "@types/express": "^5.0.6",
     "@types/js-yaml": "^4.0.9",
+    "@types/jsonwebtoken": "^9.0.10",
     "@types/mssql": "^9.1.11",
     "@types/node": "^25.5.2",
     "@types/swagger-ui-express": "^4.1.8",

package/scripts/generate-jwt.js

@@ -11,7 +11,8 @@
  *   -s,   --service-name   Service name (optional). ENV: JWT_PAYLOAD_SERVICE_NAME
  *   -p,   --params         Extra payload "key=value;key=value" (optional). ENV: JWT_PAYLOAD_PARAMS
  *
- * The encryptKey is read from config: webServer.auth.jwtToken.encryptKey
+ * The signing secret is read from config: webServer.auth.jwtToken.encryptKey
+ * Token format: standard signed JWT (HS256), 3 segments header.payload.signature.
  */
 
 import crypto from 'crypto';
@@ -19,6 +20,7 @@ import { readFileSync } from 'fs';
 import { fileURLToPath } from 'url';
 import { dirname, resolve } from 'path';
 import configModule from 'config';
+import jwt from 'jsonwebtoken';
 
 // ── CLI argument parsing ────────────────────────────────────────────
 
@@ -81,17 +83,11 @@ if (!encryptKey || String(encryptKey).trim() === '' || encryptKey === '***') {
   process.exit(1);
 }
 
-// ── Encryption (mirrors src/core/auth/jwt.ts) ───────────────────────
-
-const ALGORITHM = 'aes-256-ctr';
-const KEY = crypto.createHash('sha256').update(String(encryptKey)).digest('base64').substring(0, 32);
-
-function encrypt(text) {
-  const buffer = Buffer.from(text);
-  const iv = crypto.randomBytes(16);
-  const cipher = crypto.createCipheriv(ALGORITHM, KEY, iv);
-  const encryptedBuf = Buffer.concat([iv, cipher.update(buffer), cipher.final()]);
-  return encryptedBuf.toString('hex');
+let configuredIssuer = '';
+try {
+  configuredIssuer = String(configModule.get('webServer.auth.jwtToken.issuer') || '').trim();
+} catch {
+  // optional field, ignore
 }
 
 // ── Auto-detect service name if checkMCPName is enabled ─────────────
@@ -126,14 +122,9 @@ if (!effectiveService || !effectiveService.trim()) {
   }
 }
 
-// ── Build payload ───────────────────────────────────────────────────
-
-const payload = {};
-payload.user = username.trim().toLowerCase();
+// ── Build payload (private claims only) ─────────────────────────────
 
-if (effectiveService && effectiveService.trim()) {
-  payload.service = effectiveService.trim();
-}
+const privateClaims = {};
 
 // Parse extra params: "key1=value1;key2=value2"
 if (paramsRaw && paramsRaw.trim()) {
@@ -150,32 +141,67 @@ if (paramsRaw && paramsRaw.trim()) {
       console.error(`Error: empty key in param "${pair}"`);
       process.exit(1);
     }
-    payload[key] = value;
+    // Skip reserved fields if user accidentally passes them
+    if (['user', 'expire', 'iat', 'service', 'sub', 'aud', 'exp', 'iss', 'jti'].includes(key)) {
+      continue;
+    }
+    privateClaims[key] = value;
   }
 }
 
-const expire = Date.now() + liveTimeSec * 1000;
-payload.expire = expire;
-payload.iat = new Date().toISOString();
-
 // ── Generate token ──────────────────────────────────────────────────
 
-const token = `${expire}.${encrypt(JSON.stringify(payload))}`;
+const normalizedUser = username.trim().toLowerCase();
+const signOptions = {
+  algorithm: 'HS256',
+  subject: normalizedUser,
+  expiresIn: liveTimeSec,
+  jwtid: crypto.randomUUID(),
+};
+if (effectiveService && effectiveService.trim()) {
+  signOptions.audience = effectiveService.trim();
+}
+if (configuredIssuer) {
+  signOptions.issuer = configuredIssuer;
+}
+
+const token = jwt.sign(privateClaims, String(encryptKey), signOptions);
+
+// ── Decode for display (normalized payload, mirrors checkJwtToken) ──
+
+const decoded = jwt.decode(token, { json: true }) || {};
+const expireMs = (decoded.exp || 0) * 1000;
+const iatIso = decoded.iat ? new Date(decoded.iat * 1000).toISOString() : new Date().toISOString();
+
+const displayPayload = { user: normalizedUser };
+if (decoded.aud) {
+  displayPayload.service = Array.isArray(decoded.aud) ? decoded.aud[0] : decoded.aud;
+}
+displayPayload.expire = expireMs;
+displayPayload.iat = iatIso;
+if (decoded.jti) {
+  displayPayload.jti = decoded.jti;
+}
+if (decoded.iss) {
+  displayPayload.iss = decoded.iss;
+}
+for (const [k, v] of Object.entries(privateClaims)) {
+  displayPayload[k] = v;
+}
 
 console.log('');
 console.log('JWT Token generated successfully');
 console.log('─'.repeat(50));
-console.log(`  User:      ${payload.user}`);
-if (payload.service) {
-  console.log(`  Service:   ${payload.service}`);
+console.log(`  User:      ${displayPayload.user}`);
+if (displayPayload.service) {
+  console.log(`  Service:   ${displayPayload.service}`);
 }
 console.log(`  TTL:       ${ttlRaw} (${liveTimeSec} seconds)`);
-console.log(`  Expires:   ${new Date(expire).toISOString()}`);
-if (Object.keys(payload).filter((k) => !['user', 'service', 'expire', 'iat'].includes(k)).length) {
-  const extra = Object.entries(payload)
-    .filter(([k]) => !['user', 'service', 'expire', 'iat'].includes(k))
-    .map(([k, v]) => `${k}=${v}`)
-    .join('; ');
+console.log(`  Expires:   ${new Date(expireMs).toISOString()}`);
+console.log(`  JTI:       ${displayPayload.jti || ''}`);
+const extraEntries = Object.entries(privateClaims);
+if (extraEntries.length) {
+  const extra = extraEntries.map(([k, v]) => `${k}=${v}`).join('; ');
   console.log(`  Params:    ${extra}`);
 }
 console.log('─'.repeat(50));
@@ -183,5 +209,5 @@ console.log('');
 console.log(token);
 console.log('');
 console.log('__PAYLOAD_JSON__');
-console.log(JSON.stringify({ ...payload, ttl: ttlRaw, expire_iso: new Date(expire).toISOString() }));
+console.log(JSON.stringify({ ...displayPayload, ttl: ttlRaw, expire_iso: new Date(expireMs).toISOString() }));
 console.log('__END_PAYLOAD_JSON__');

package/scripts/update-sdk.js

@@ -131,3 +131,19 @@ for (const { name, src, dest, preserve = [], respectPin = false } of targets) {
     console.log(`${name} updated`);
   }
 }
+
+const scriptsSrcDir = join(cwd, './node_modules/fa-mcp-sdk/scripts');
+const scriptsDestDir = join(cwd, 'scripts');
+const individualScripts = ['generate-jwt.js'];
+
+for (const file of individualScripts) {
+  const src = join(scriptsSrcDir, file);
+  const dest = join(scriptsDestDir, file);
+  if (!existsSync(src)) {
+    console.error('Source not found:', src);
+    process.exit(1);
+  }
+  mkdirSync(dirname(dest), { recursive: true });
+  cpSync(src, dest);
+  console.log(`scripts/${file} updated`);
+}