fastmcp 4.12.4 → 4.12.5

package/README.md

@@ -2015,20 +2015,23 @@ For more control over OAuth behavior, you can use the `oauth` option directly:
 import { FastMCP } from "fastmcp";
 import { GoogleProvider } from "fastmcp/auth";
 
-const authProxy = new GoogleProvider({
-  clientId: process.env.GOOGLE_CLIENT_ID,
-  clientSecret: process.env.GOOGLE_CLIENT_SECRET,
+const authProvider = new GoogleProvider({
   baseUrl: "https://your-server.com",
+  clientId: process.env.GOOGLE_CLIENT_ID!,
+  clientSecret: process.env.GOOGLE_CLIENT_SECRET!,
   scopes: ["openid", "profile", "email"],
 });
 
 const server = new FastMCP({
   name: "My Server",
   oauth: {
+    authorizationServer: authProvider
+      .getProxy()
+      .getAuthorizationServerMetadata(),
     enabled: true,
-    authorizationServer: authProxy.getAuthorizationServerMetadata(),
-    proxy: authProxy,
+    proxy: authProvider.getProxy(),
   },
+  version: "1.0.0",
 });
 ```
 

package/dist/FastMCP.cjs

@@ -11,7 +11,7 @@
 
 
 
-var _chunkDD63MJG7cjs = require('./chunk-DD63MJG7.cjs');
+var _chunkU36NARZGcjs = require('./chunk-U36NARZG.cjs');
 
 
 
@@ -49,5 +49,5 @@ var _chunkENMHHQJFcjs = require('./chunk-ENMHHQJF.cjs');
 
 
 
-exports.AuthProvider = _chunkENMHHQJFcjs.AuthProvider; exports.AzureProvider = _chunkENMHHQJFcjs.AzureProvider; exports.DiscoveryDocumentCache = _chunkDD63MJG7cjs.DiscoveryDocumentCache; exports.FastMCP = _chunkDD63MJG7cjs.FastMCP; exports.FastMCPError = _chunkDD63MJG7cjs.FastMCPError; exports.FastMCPSession = _chunkDD63MJG7cjs.FastMCPSession; exports.GitHubProvider = _chunkENMHHQJFcjs.GitHubProvider; exports.GoogleProvider = _chunkENMHHQJFcjs.GoogleProvider; exports.MEDIA_FETCH_TIMEOUT_MS = _chunkDD63MJG7cjs.MEDIA_FETCH_TIMEOUT_MS; exports.OAuthProvider = _chunkENMHHQJFcjs.OAuthProvider; exports.ServerState = _chunkDD63MJG7cjs.ServerState; exports.SessionError = _chunkDD63MJG7cjs.SessionError; exports.UnexpectedStateError = _chunkDD63MJG7cjs.UnexpectedStateError; exports.UserError = _chunkDD63MJG7cjs.UserError; exports.audioContent = _chunkDD63MJG7cjs.audioContent; exports.getAuthSession = _chunkENMHHQJFcjs.getAuthSession; exports.imageContent = _chunkDD63MJG7cjs.imageContent; exports.jsonSchemaAdapter = _chunkDD63MJG7cjs.jsonSchemaAdapter; exports.requireAll = _chunkENMHHQJFcjs.requireAll; exports.requireAny = _chunkENMHHQJFcjs.requireAny; exports.requireAuth = _chunkENMHHQJFcjs.requireAuth; exports.requireRole = _chunkENMHHQJFcjs.requireRole; exports.requireScopes = _chunkENMHHQJFcjs.requireScopes;
+exports.AuthProvider = _chunkENMHHQJFcjs.AuthProvider; exports.AzureProvider = _chunkENMHHQJFcjs.AzureProvider; exports.DiscoveryDocumentCache = _chunkU36NARZGcjs.DiscoveryDocumentCache; exports.FastMCP = _chunkU36NARZGcjs.FastMCP; exports.FastMCPError = _chunkU36NARZGcjs.FastMCPError; exports.FastMCPSession = _chunkU36NARZGcjs.FastMCPSession; exports.GitHubProvider = _chunkENMHHQJFcjs.GitHubProvider; exports.GoogleProvider = _chunkENMHHQJFcjs.GoogleProvider; exports.MEDIA_FETCH_TIMEOUT_MS = _chunkU36NARZGcjs.MEDIA_FETCH_TIMEOUT_MS; exports.OAuthProvider = _chunkENMHHQJFcjs.OAuthProvider; exports.ServerState = _chunkU36NARZGcjs.ServerState; exports.SessionError = _chunkU36NARZGcjs.SessionError; exports.UnexpectedStateError = _chunkU36NARZGcjs.UnexpectedStateError; exports.UserError = _chunkU36NARZGcjs.UserError; exports.audioContent = _chunkU36NARZGcjs.audioContent; exports.getAuthSession = _chunkENMHHQJFcjs.getAuthSession; exports.imageContent = _chunkU36NARZGcjs.imageContent; exports.jsonSchemaAdapter = _chunkU36NARZGcjs.jsonSchemaAdapter; exports.requireAll = _chunkENMHHQJFcjs.requireAll; exports.requireAny = _chunkENMHHQJFcjs.requireAny; exports.requireAuth = _chunkENMHHQJFcjs.requireAuth; exports.requireRole = _chunkENMHHQJFcjs.requireRole; exports.requireScopes = _chunkENMHHQJFcjs.requireScopes;
 //# sourceMappingURL=FastMCP.cjs.map

package/dist/FastMCP.js

@@ -11,7 +11,7 @@ import {
   audioContent,
   imageContent,
   jsonSchemaAdapter
-} from "./chunk-FKX5QBJV.js";
+} from "./chunk-HIIPZVNY.js";
 import {
   AuthProvider,
   AzureProvider,

package/dist/{chunk-FKX5QBJV.js → chunk-HIIPZVNY.js}

@@ -1462,6 +1462,7 @@ function parseBasicAuthHeader(authHeader) {
     return null;
   }
 }
+var OAUTH_PROXY_MAX_BODY_SIZE = 1024 * 1024;
 function stripBasePath(path, basePath) {
   if (!basePath) {
     return path;
@@ -2236,11 +2237,47 @@ var FastMCP = class extends FastMCPEventEmitter {
       try {
         if (req.method === "POST" && oauthPath === "/oauth/register") {
           await new Promise((resolve) => {
-            let body = "";
-            req.on("data", (chunk) => body += chunk);
+            const bodyChunks = [];
+            let bodySize = 0;
+            let failed = false;
+            const fail = () => {
+              if (failed || res.headersSent) {
+                resolve();
+                return;
+              }
+              failed = true;
+              res.writeHead(400, {
+                Connection: "close",
+                "Content-Type": "application/json"
+              }).end(
+                JSON.stringify({
+                  error: "invalid_request",
+                  error_description: "Request body exceeds 1 MiB"
+                })
+              );
+              resolve();
+            };
+            req.on("data", (chunk) => {
+              if (failed) {
+                return;
+              }
+              bodySize += chunk.length;
+              if (bodySize > OAUTH_PROXY_MAX_BODY_SIZE) {
+                fail();
+                return;
+              }
+              bodyChunks.push(chunk);
+            });
+            req.on("aborted", fail);
+            req.on("error", fail);
             req.on("end", async () => {
+              if (failed) {
+                return;
+              }
               try {
-                const request = JSON.parse(body);
+                const request = JSON.parse(
+                  Buffer.concat(bodyChunks).toString("utf8")
+                );
                 const response = await oauthProxy.registerClient(request);
                 res.writeHead(201, { "Content-Type": "application/json" }).end(JSON.stringify(response));
               } catch (error) {
@@ -2306,14 +2343,48 @@ var FastMCP = class extends FastMCPEventEmitter {
         }
         if (req.method === "POST" && oauthPath === "/oauth/consent") {
           await new Promise((resolve) => {
-            let body = "";
-            req.on("data", (chunk) => body += chunk);
+            const bodyChunks = [];
+            let bodySize = 0;
+            let failed = false;
+            const fail = () => {
+              if (failed || res.headersSent) {
+                resolve();
+                return;
+              }
+              failed = true;
+              res.writeHead(400, {
+                Connection: "close",
+                "Content-Type": "application/json"
+              }).end(
+                JSON.stringify({
+                  error: "invalid_request",
+                  error_description: "Request body exceeds 1 MiB"
+                })
+              );
+              resolve();
+            };
+            req.on("data", (chunk) => {
+              if (failed) {
+                return;
+              }
+              bodySize += chunk.length;
+              if (bodySize > OAUTH_PROXY_MAX_BODY_SIZE) {
+                fail();
+                return;
+              }
+              bodyChunks.push(chunk);
+            });
+            req.on("aborted", fail);
+            req.on("error", fail);
             req.on("end", async () => {
+              if (failed) {
+                return;
+              }
               try {
                 const mockRequest = new Request(
                   `http://${host}${url2.pathname}${url2.search}`,
                   {
-                    body,
+                    body: Buffer.concat(bodyChunks).toString("utf8"),
                     headers: {
                       "Content-Type": "application/x-www-form-urlencoded"
                     },
@@ -2344,11 +2415,47 @@ var FastMCP = class extends FastMCPEventEmitter {
         }
         if (req.method === "POST" && oauthPath === "/oauth/token") {
           await new Promise((resolve) => {
-            let body = "";
-            req.on("data", (chunk) => body += chunk);
+            const bodyChunks = [];
+            let bodySize = 0;
+            let failed = false;
+            const fail = () => {
+              if (failed || res.headersSent) {
+                resolve();
+                return;
+              }
+              failed = true;
+              res.writeHead(400, {
+                Connection: "close",
+                "Content-Type": "application/json"
+              }).end(
+                JSON.stringify({
+                  error: "invalid_request",
+                  error_description: "Request body exceeds 1 MiB"
+                })
+              );
+              resolve();
+            };
+            req.on("data", (chunk) => {
+              if (failed) {
+                return;
+              }
+              bodySize += chunk.length;
+              if (bodySize > OAUTH_PROXY_MAX_BODY_SIZE) {
+                fail();
+                return;
+              }
+              bodyChunks.push(chunk);
+            });
+            req.on("aborted", fail);
+            req.on("error", fail);
             req.on("end", async () => {
+              if (failed) {
+                return;
+              }
               try {
-                const params = new URLSearchParams(body);
+                const params = new URLSearchParams(
+                  Buffer.concat(bodyChunks).toString("utf8")
+                );
                 const grantType = params.get("grant_type");
                 const basicAuth = parseBasicAuthHeader(
                   req.headers.authorization
@@ -2548,4 +2655,4 @@ export {
   FastMCPSession,
   FastMCP
 };
-//# sourceMappingURL=chunk-FKX5QBJV.js.map
+//# sourceMappingURL=chunk-HIIPZVNY.js.map