fastmcp 4.12.4 → 4.12.6

package/dist/{chunk-2ZFQSPXZ.js → chunk-SZ4XCW5X.js}

@@ -1802,51 +1802,62 @@ var OAuthProxy = class {
     if (!jti) {
       throw new OAuthProxyError("invalid_grant", "Refresh token missing JTI");
     }
-    const mapping = await this.tokenStorage.get(`mapping:${jti}`);
+    const mapping = await this.takeMapping(jti);
     if (!mapping) {
       throw new OAuthProxyError(
         "invalid_grant",
         "Refresh token already used or expired"
       );
     }
-    const upstreamTokens = await this.tokenStorage.get(
-      `upstream:${mapping.upstreamTokenKey}`
-    );
-    if (!upstreamTokens) {
-      throw new OAuthProxyError(
-        "invalid_grant",
-        "Upstream tokens not found or expired"
+    try {
+      const upstreamTokens = await this.tokenStorage.get(
+        `upstream:${mapping.upstreamTokenKey}`
       );
-    }
-    if (!upstreamTokens.refreshToken) {
-      throw new OAuthProxyError(
-        "invalid_grant",
-        "No upstream refresh token available"
+      if (!upstreamTokens) {
+        throw new OAuthProxyError(
+          "invalid_grant",
+          "Upstream tokens not found or expired"
+        );
+      }
+      if (!upstreamTokens.refreshToken) {
+        throw new OAuthProxyError(
+          "invalid_grant",
+          "No upstream refresh token available"
+        );
+      }
+      const refreshedUpstreamTokens = await this.refreshUpstreamTokens(
+        upstreamTokens.refreshToken,
+        request.scope
       );
+      if (refreshedUpstreamTokens.scope.length === 0) {
+        refreshedUpstreamTokens.scope = upstreamTokens.scope;
+      }
+      const refreshTokenTtl = refreshedUpstreamTokens.refreshExpiresIn ?? this.config.refreshTokenTtl ?? DEFAULT_REFRESH_TOKEN_TTL;
+      const accessTokenTtl = this.calculateAccessTokenTtl(
+        refreshedUpstreamTokens
+      );
+      const upstreamStorageTtl = Math.max(accessTokenTtl, refreshTokenTtl, 1);
+      await this.tokenStorage.save(
+        `upstream:${mapping.upstreamTokenKey}`,
+        refreshedUpstreamTokens,
+        upstreamStorageTtl
+      );
+      return await this.issueSwappedTokensForRefresh(
+        mapping.clientId,
+        refreshedUpstreamTokens,
+        mapping.upstreamTokenKey
+      );
+    } catch (error) {
+      try {
+        await this.restoreMapping(jti, mapping);
+      } catch (restoreError) {
+        console.error(
+          `Failed to restore refresh token mapping ${jti}:`,
+          restoreError
+        );
+      }
+      throw error;
     }
-    const refreshedUpstreamTokens = await this.refreshUpstreamTokens(
-      upstreamTokens.refreshToken,
-      request.scope
-    );
-    if (refreshedUpstreamTokens.scope.length === 0) {
-      refreshedUpstreamTokens.scope = upstreamTokens.scope;
-    }
-    const refreshTokenTtl = refreshedUpstreamTokens.refreshExpiresIn ?? this.config.refreshTokenTtl ?? DEFAULT_REFRESH_TOKEN_TTL;
-    const accessTokenTtl = this.calculateAccessTokenTtl(
-      refreshedUpstreamTokens
-    );
-    const upstreamStorageTtl = Math.max(accessTokenTtl, refreshTokenTtl, 1);
-    await this.tokenStorage.save(
-      `upstream:${mapping.upstreamTokenKey}`,
-      refreshedUpstreamTokens,
-      upstreamStorageTtl
-    );
-    return await this.issueSwappedTokensForRefresh(
-      mapping.clientId,
-      refreshedUpstreamTokens,
-      mapping.upstreamTokenKey,
-      jti
-    );
   }
   /**
    * Issue swapped tokens (JWT pattern)
@@ -1927,11 +1938,10 @@ var OAuthProxy = class {
   /**
    * Issue swapped tokens for refresh flow
    */
-  async issueSwappedTokensForRefresh(clientId, upstreamTokens, upstreamTokenKey, oldJti) {
+  async issueSwappedTokensForRefresh(clientId, upstreamTokens, upstreamTokenKey) {
     if (!this.jwtIssuer) {
       throw new Error("JWT issuer not initialized");
     }
-    await this.tokenStorage.delete(`mapping:${oldJti}`);
     const customClaims = await this.extractUpstreamClaims(upstreamTokens);
     const accessTokenTtl = this.calculateAccessTokenTtl(upstreamTokens);
     const refreshTokenTtl = upstreamTokens.refreshToken ? upstreamTokens.refreshExpiresIn ?? this.config.refreshTokenTtl ?? DEFAULT_REFRESH_TOKEN_TTL : 0;
@@ -2108,6 +2118,29 @@ var OAuthProxy = class {
       tokenType: tokens.token_type || "Bearer"
     };
   }
+  /**
+   * Put a claimed refresh-token mapping back after a rotation failed, keeping
+   * whatever lifetime it had left.
+   *
+   * A mapping that is already expired, or that carries no usable expiry, is
+   * dropped instead. Inventing a TTL here would extend the lifetime of a
+   * credential in a security path, and every mapping this proxy writes records
+   * `expiresAt`.
+   */
+  async restoreMapping(jti, mapping) {
+    if (!mapping.expiresAt) {
+      return;
+    }
+    const expiresAt = new Date(mapping.expiresAt).getTime();
+    if (Number.isNaN(expiresAt)) {
+      return;
+    }
+    const ttl = Math.ceil((expiresAt - Date.now()) / 1e3);
+    if (ttl <= 0) {
+      return;
+    }
+    await this.tokenStorage.save(`mapping:${jti}`, mapping, ttl);
+  }
   /**
    * Start periodic cleanup of expired transactions and codes
    */
@@ -2116,6 +2149,24 @@ var OAuthProxy = class {
       this.cleanup();
     }, 6e4);
   }
+  /**
+   * Atomically claim a token mapping, mirroring `OAuthProxyStateStore`: at most
+   * one caller — across all processes sharing the storage — can receive a given
+   * mapping, which is what makes single use enforceable. Falls back to a
+   * non-atomic get + delete for storages that do not implement `take`.
+   */
+  async takeMapping(jti) {
+    const key = `mapping:${jti}`;
+    if (this.tokenStorage.take) {
+      return await this.tokenStorage.take(key);
+    }
+    const stored = await this.tokenStorage.get(key);
+    if (stored === null) {
+      return null;
+    }
+    await this.tokenStorage.delete(key);
+    return stored;
+  }
   /**
    * Validate a redirect URI against the configured allow-list.
    *
@@ -2733,4 +2784,4 @@ export {
   DiskStore,
   JWKSVerifier
 };
-//# sourceMappingURL=chunk-2ZFQSPXZ.js.map
+//# sourceMappingURL=chunk-SZ4XCW5X.js.map