fastmcp 4.12.8 → 4.13.0

package/dist/FastMCP.cjs

@@ -24,7 +24,7 @@ var _chunkU36NARZGcjs = require('./chunk-U36NARZG.cjs');
 
 
 
-var _chunkKMG3C24Zcjs = require('./chunk-KMG3C24Z.cjs');
+var _chunk5FVNY65Mcjs = require('./chunk-5FVNY65M.cjs');
 
 
 
@@ -49,5 +49,5 @@ var _chunkKMG3C24Zcjs = require('./chunk-KMG3C24Z.cjs');
 
 
 
-exports.AuthProvider = _chunkKMG3C24Zcjs.AuthProvider; exports.AzureProvider = _chunkKMG3C24Zcjs.AzureProvider; exports.DiscoveryDocumentCache = _chunkU36NARZGcjs.DiscoveryDocumentCache; exports.FastMCP = _chunkU36NARZGcjs.FastMCP; exports.FastMCPError = _chunkU36NARZGcjs.FastMCPError; exports.FastMCPSession = _chunkU36NARZGcjs.FastMCPSession; exports.GitHubProvider = _chunkKMG3C24Zcjs.GitHubProvider; exports.GoogleProvider = _chunkKMG3C24Zcjs.GoogleProvider; exports.MEDIA_FETCH_TIMEOUT_MS = _chunkU36NARZGcjs.MEDIA_FETCH_TIMEOUT_MS; exports.OAuthProvider = _chunkKMG3C24Zcjs.OAuthProvider; exports.ServerState = _chunkU36NARZGcjs.ServerState; exports.SessionError = _chunkU36NARZGcjs.SessionError; exports.UnexpectedStateError = _chunkU36NARZGcjs.UnexpectedStateError; exports.UserError = _chunkU36NARZGcjs.UserError; exports.audioContent = _chunkU36NARZGcjs.audioContent; exports.getAuthSession = _chunkKMG3C24Zcjs.getAuthSession; exports.imageContent = _chunkU36NARZGcjs.imageContent; exports.jsonSchemaAdapter = _chunkU36NARZGcjs.jsonSchemaAdapter; exports.requireAll = _chunkKMG3C24Zcjs.requireAll; exports.requireAny = _chunkKMG3C24Zcjs.requireAny; exports.requireAuth = _chunkKMG3C24Zcjs.requireAuth; exports.requireRole = _chunkKMG3C24Zcjs.requireRole; exports.requireScopes = _chunkKMG3C24Zcjs.requireScopes;
+exports.AuthProvider = _chunk5FVNY65Mcjs.AuthProvider; exports.AzureProvider = _chunk5FVNY65Mcjs.AzureProvider; exports.DiscoveryDocumentCache = _chunkU36NARZGcjs.DiscoveryDocumentCache; exports.FastMCP = _chunkU36NARZGcjs.FastMCP; exports.FastMCPError = _chunkU36NARZGcjs.FastMCPError; exports.FastMCPSession = _chunkU36NARZGcjs.FastMCPSession; exports.GitHubProvider = _chunk5FVNY65Mcjs.GitHubProvider; exports.GoogleProvider = _chunk5FVNY65Mcjs.GoogleProvider; exports.MEDIA_FETCH_TIMEOUT_MS = _chunkU36NARZGcjs.MEDIA_FETCH_TIMEOUT_MS; exports.OAuthProvider = _chunk5FVNY65Mcjs.OAuthProvider; exports.ServerState = _chunkU36NARZGcjs.ServerState; exports.SessionError = _chunkU36NARZGcjs.SessionError; exports.UnexpectedStateError = _chunkU36NARZGcjs.UnexpectedStateError; exports.UserError = _chunkU36NARZGcjs.UserError; exports.audioContent = _chunkU36NARZGcjs.audioContent; exports.getAuthSession = _chunk5FVNY65Mcjs.getAuthSession; exports.imageContent = _chunkU36NARZGcjs.imageContent; exports.jsonSchemaAdapter = _chunkU36NARZGcjs.jsonSchemaAdapter; exports.requireAll = _chunk5FVNY65Mcjs.requireAll; exports.requireAny = _chunk5FVNY65Mcjs.requireAny; exports.requireAuth = _chunk5FVNY65Mcjs.requireAuth; exports.requireRole = _chunk5FVNY65Mcjs.requireRole; exports.requireScopes = _chunk5FVNY65Mcjs.requireScopes;
 //# sourceMappingURL=FastMCP.cjs.map

package/dist/FastMCP.d.cts

@@ -12,8 +12,8 @@ import { CorsOptions } from 'mcp-proxy';
 export { CorsOptions } from 'mcp-proxy';
 import { StrictEventEmitter } from 'strict-event-emitter-types';
 import { z } from 'zod';
-import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-zVRjvkf8.cjs';
-export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-zVRjvkf8.cjs';
+import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-Bvt5a7yr.cjs';
+export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-Bvt5a7yr.cjs';
 import 'node:http';
 
 declare class DiscoveryDocumentCache {

package/dist/FastMCP.d.ts

@@ -12,8 +12,8 @@ import { CorsOptions } from 'mcp-proxy';
 export { CorsOptions } from 'mcp-proxy';
 import { StrictEventEmitter } from 'strict-event-emitter-types';
 import { z } from 'zod';
-import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-zVRjvkf8.js';
-export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-zVRjvkf8.js';
+import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-Bvt5a7yr.js';
+export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-Bvt5a7yr.js';
 import 'node:http';
 
 declare class DiscoveryDocumentCache {

package/dist/FastMCP.js

@@ -24,7 +24,7 @@ import {
   requireAuth,
   requireRole,
   requireScopes
-} from "./chunk-Y7GSHCYB.js";
+} from "./chunk-ZOG7IPIX.js";
 export {
   AuthProvider,
   AzureProvider,

package/dist/{OAuthProvider-zVRjvkf8.d.cts → OAuthProvider-Bvt5a7yr.d.cts}

@@ -205,6 +205,22 @@ interface OAuthProxyConfig {
      * https URLs enables CWE-601 open-redirect / authorization-code theft.
      */
     allowedRedirectUriPatterns?: string[];
+    /**
+     * Accept `code_challenge_method=plain` at /oauth/authorize (default: true).
+     *
+     * `plain` is the weaker PKCE mode by RFC 7636 §7.2: the challenge *is* the
+     * verifier, so anyone who observes the authorization request — a proxy, a
+     * server log, browser history — can replay a stolen authorization code. S256
+     * sends only a hash and has no such exposure. OAuth 2.1 §7.5.2 and the MCP
+     * authorization spec both require S256.
+     *
+     * Set to `false` to refuse `plain`: it is dropped from
+     * `codeChallengeMethodsSupported` in the discovery metadata, rejected with
+     * `invalid_request` at /oauth/authorize, and any code already issued under it
+     * is refused at /oauth/token. Recommended for new deployments; it stays on by
+     * default because turning it off breaks clients that still ask for `plain`.
+     */
+    allowPlainPkce?: boolean;
     /** Authorization code TTL in seconds (default: 300) */
     authorizationCodeTtl?: number;
     /** Base URL of this proxy server */

package/dist/{OAuthProvider-zVRjvkf8.d.ts → OAuthProvider-Bvt5a7yr.d.ts}

@@ -205,6 +205,22 @@ interface OAuthProxyConfig {
      * https URLs enables CWE-601 open-redirect / authorization-code theft.
      */
     allowedRedirectUriPatterns?: string[];
+    /**
+     * Accept `code_challenge_method=plain` at /oauth/authorize (default: true).
+     *
+     * `plain` is the weaker PKCE mode by RFC 7636 §7.2: the challenge *is* the
+     * verifier, so anyone who observes the authorization request — a proxy, a
+     * server log, browser history — can replay a stolen authorization code. S256
+     * sends only a hash and has no such exposure. OAuth 2.1 §7.5.2 and the MCP
+     * authorization spec both require S256.
+     *
+     * Set to `false` to refuse `plain`: it is dropped from
+     * `codeChallengeMethodsSupported` in the discovery metadata, rejected with
+     * `invalid_request` at /oauth/authorize, and any code already issued under it
+     * is refused at /oauth/token. Recommended for new deployments; it stays on by
+     * default because turning it off breaks clients that still ask for `plain`.
+     */
+    allowPlainPkce?: boolean;
     /** Authorization code TTL in seconds (default: 300) */
     authorizationCodeTtl?: number;
     /** Base URL of this proxy server */

package/dist/auth/index.cjs

@@ -24,7 +24,7 @@
 
 
 
-var _chunkKMG3C24Zcjs = require('../chunk-KMG3C24Z.cjs');
+var _chunk5FVNY65Mcjs = require('../chunk-5FVNY65M.cjs');
 
 
 
@@ -51,5 +51,5 @@ var _chunkKMG3C24Zcjs = require('../chunk-KMG3C24Z.cjs');
 
 
 
-exports.AuthProvider = _chunkKMG3C24Zcjs.AuthProvider; exports.AzureProvider = _chunkKMG3C24Zcjs.AzureProvider; exports.ConsentManager = _chunkKMG3C24Zcjs.ConsentManager; exports.DEFAULT_ACCESS_TOKEN_TTL = _chunkKMG3C24Zcjs.DEFAULT_ACCESS_TOKEN_TTL; exports.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = _chunkKMG3C24Zcjs.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH; exports.DEFAULT_AUTHORIZATION_CODE_TTL = _chunkKMG3C24Zcjs.DEFAULT_AUTHORIZATION_CODE_TTL; exports.DEFAULT_REFRESH_TOKEN_TTL = _chunkKMG3C24Zcjs.DEFAULT_REFRESH_TOKEN_TTL; exports.DEFAULT_TRANSACTION_TTL = _chunkKMG3C24Zcjs.DEFAULT_TRANSACTION_TTL; exports.DiskStore = _chunkKMG3C24Zcjs.DiskStore; exports.EncryptedTokenStorage = _chunkKMG3C24Zcjs.EncryptedTokenStorage; exports.GitHubProvider = _chunkKMG3C24Zcjs.GitHubProvider; exports.GoogleProvider = _chunkKMG3C24Zcjs.GoogleProvider; exports.JWKSVerifier = _chunkKMG3C24Zcjs.JWKSVerifier; exports.JWTIssuer = _chunkKMG3C24Zcjs.JWTIssuer; exports.MemoryTokenStorage = _chunkKMG3C24Zcjs.MemoryTokenStorage; exports.OAuthProvider = _chunkKMG3C24Zcjs.OAuthProvider; exports.OAuthProxy = _chunkKMG3C24Zcjs.OAuthProxy; exports.OAuthProxyError = _chunkKMG3C24Zcjs.OAuthProxyError; exports.PKCEUtils = _chunkKMG3C24Zcjs.PKCEUtils; exports.getAuthSession = _chunkKMG3C24Zcjs.getAuthSession; exports.requireAll = _chunkKMG3C24Zcjs.requireAll; exports.requireAny = _chunkKMG3C24Zcjs.requireAny; exports.requireAuth = _chunkKMG3C24Zcjs.requireAuth; exports.requireRole = _chunkKMG3C24Zcjs.requireRole; exports.requireScopes = _chunkKMG3C24Zcjs.requireScopes;
+exports.AuthProvider = _chunk5FVNY65Mcjs.AuthProvider; exports.AzureProvider = _chunk5FVNY65Mcjs.AzureProvider; exports.ConsentManager = _chunk5FVNY65Mcjs.ConsentManager; exports.DEFAULT_ACCESS_TOKEN_TTL = _chunk5FVNY65Mcjs.DEFAULT_ACCESS_TOKEN_TTL; exports.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = _chunk5FVNY65Mcjs.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH; exports.DEFAULT_AUTHORIZATION_CODE_TTL = _chunk5FVNY65Mcjs.DEFAULT_AUTHORIZATION_CODE_TTL; exports.DEFAULT_REFRESH_TOKEN_TTL = _chunk5FVNY65Mcjs.DEFAULT_REFRESH_TOKEN_TTL; exports.DEFAULT_TRANSACTION_TTL = _chunk5FVNY65Mcjs.DEFAULT_TRANSACTION_TTL; exports.DiskStore = _chunk5FVNY65Mcjs.DiskStore; exports.EncryptedTokenStorage = _chunk5FVNY65Mcjs.EncryptedTokenStorage; exports.GitHubProvider = _chunk5FVNY65Mcjs.GitHubProvider; exports.GoogleProvider = _chunk5FVNY65Mcjs.GoogleProvider; exports.JWKSVerifier = _chunk5FVNY65Mcjs.JWKSVerifier; exports.JWTIssuer = _chunk5FVNY65Mcjs.JWTIssuer; exports.MemoryTokenStorage = _chunk5FVNY65Mcjs.MemoryTokenStorage; exports.OAuthProvider = _chunk5FVNY65Mcjs.OAuthProvider; exports.OAuthProxy = _chunk5FVNY65Mcjs.OAuthProxy; exports.OAuthProxyError = _chunk5FVNY65Mcjs.OAuthProxyError; exports.PKCEUtils = _chunk5FVNY65Mcjs.PKCEUtils; exports.getAuthSession = _chunk5FVNY65Mcjs.getAuthSession; exports.requireAll = _chunk5FVNY65Mcjs.requireAll; exports.requireAny = _chunk5FVNY65Mcjs.requireAny; exports.requireAuth = _chunk5FVNY65Mcjs.requireAuth; exports.requireRole = _chunk5FVNY65Mcjs.requireRole; exports.requireScopes = _chunk5FVNY65Mcjs.requireScopes;
 //# sourceMappingURL=index.cjs.map

package/dist/auth/index.d.cts

@@ -1,5 +1,5 @@
-import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-zVRjvkf8.cjs';
-export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-zVRjvkf8.cjs';
+import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-Bvt5a7yr.cjs';
+export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-Bvt5a7yr.cjs';
 import 'node:http';
 
 /**

package/dist/auth/index.d.ts

@@ -1,5 +1,5 @@
-import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-zVRjvkf8.js';
-export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-zVRjvkf8.js';
+import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-Bvt5a7yr.js';
+export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-Bvt5a7yr.js';
 import 'node:http';
 
 /**

package/dist/auth/index.js

@@ -24,7 +24,7 @@ import {
   requireAuth,
   requireRole,
   requireScopes
-} from "../chunk-Y7GSHCYB.js";
+} from "../chunk-ZOG7IPIX.js";
 export {
   AuthProvider,
   AzureProvider,

package/dist/{chunk-KMG3C24Z.cjs → chunk-5FVNY65M.cjs}

@@ -419,6 +419,16 @@ var ClaimsExtractor = (_class = class {
 
 // src/auth/utils/consent.ts
 
+
+// src/auth/utils/constantTime.ts
+
+function equalsConstantTime(a, b) {
+  const bufA = Buffer.from(a, "utf8");
+  const bufB = Buffer.from(b, "utf8");
+  return bufA.length === bufB.length && _crypto.timingSafeEqual.call(void 0, bufA, bufB);
+}
+
+// src/auth/utils/consent.ts
 var ConsentManager = class {
   
   constructor(signingKey) {
@@ -671,9 +681,7 @@ var ConsentManager = class {
       }
       const payload = Buffer.from(payloadB64, "base64").toString("utf8");
       const expectedSignature = this.sign(payload);
-      const actualBuf = Buffer.from(signature);
-      const expectedBuf = Buffer.from(expectedSignature);
-      if (actualBuf.length !== expectedBuf.length || !_crypto.timingSafeEqual.call(void 0, actualBuf, expectedBuf)) {
+      if (!equalsConstantTime(signature, expectedSignature)) {
         return null;
       }
       const data = JSON.parse(payload);
@@ -805,9 +813,7 @@ var JWTIssuer = class {
       }
       const [headerB64, payloadB64, signatureB64] = parts;
       const expectedSignature = this.sign(`${headerB64}.${payloadB64}`);
-      const actualBuf = Buffer.from(signatureB64);
-      const expectedBuf = Buffer.from(expectedSignature);
-      if (actualBuf.length !== expectedBuf.length || !_crypto.timingSafeEqual.call(void 0, actualBuf, expectedBuf)) {
+      if (!signatureB64 || !equalsConstantTime(signatureB64, expectedSignature)) {
         return {
           error: "Invalid signature",
           valid: false
@@ -955,11 +961,6 @@ var PKCEUtils = class _PKCEUtils {
     return buffer.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
   }
 };
-function equalsConstantTime(a, b) {
-  const bufA = Buffer.from(a, "utf8");
-  const bufB = Buffer.from(b, "utf8");
-  return bufA.length === bufB.length && _crypto.timingSafeEqual.call(void 0, bufA, bufB);
-}
 
 // src/auth/utils/tokenStore.ts
 
@@ -1159,6 +1160,7 @@ var OAuthProxy = (_class4 = class {
   
   constructor(config) {;_class4.prototype.__init5.call(this);_class4.prototype.__init6.call(this);_class4.prototype.__init7.call(this);_class4.prototype.__init8.call(this);
     this.config = {
+      allowPlainPkce: true,
       authorizationCodeTtl: DEFAULT_AUTHORIZATION_CODE_TTL,
       consentRequired: true,
       enableTokenSwap: true,
@@ -1233,6 +1235,12 @@ var OAuthProxy = (_class4 = class {
         "code_challenge_method required when code_challenge is present"
       );
     }
+    if (params.code_challenge_method === "plain" && !this.config.allowPlainPkce) {
+      throw new OAuthProxyError(
+        "invalid_request",
+        "code_challenge_method 'plain' is not supported; use S256"
+      );
+    }
     const transaction = await this.createTransaction(params);
     if (this.config.consentRequired && !transaction.consentGiven) {
       return this.consentManager.createConsentResponse(
@@ -1292,6 +1300,12 @@ var OAuthProxy = (_class4 = class {
           "code_verifier required for PKCE"
         );
       }
+      if (clientCode.codeChallengeMethod === "plain" && !this.config.allowPlainPkce) {
+        throw new OAuthProxyError(
+          "invalid_grant",
+          "code_challenge_method 'plain' is not supported; use S256"
+        );
+      }
       const valid = PKCEUtils.validateChallenge(
         request.code_verifier,
         clientCode.codeChallenge,
@@ -1345,7 +1359,7 @@ var OAuthProxy = (_class4 = class {
   getAuthorizationServerMetadata() {
     return {
       authorizationEndpoint: `${this.config.baseUrl}/oauth/authorize`,
-      codeChallengeMethodsSupported: ["S256", "plain"],
+      codeChallengeMethodsSupported: this.config.allowPlainPkce ? ["S256", "plain"] : ["S256"],
       grantTypesSupported: ["authorization_code", "refresh_token"],
       issuer: this.config.baseUrl,
       registrationEndpoint: `${this.config.baseUrl}/oauth/register`,
@@ -2802,4 +2816,4 @@ Original error: ${error.message}`
 
 
 exports.getAuthSession = getAuthSession; exports.requireAll = requireAll; exports.requireAny = requireAny; exports.requireAuth = requireAuth; exports.requireRole = requireRole; exports.requireScopes = requireScopes; exports.DEFAULT_ACCESS_TOKEN_TTL = DEFAULT_ACCESS_TOKEN_TTL; exports.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH; exports.DEFAULT_REFRESH_TOKEN_TTL = DEFAULT_REFRESH_TOKEN_TTL; exports.DEFAULT_AUTHORIZATION_CODE_TTL = DEFAULT_AUTHORIZATION_CODE_TTL; exports.DEFAULT_TRANSACTION_TTL = DEFAULT_TRANSACTION_TTL; exports.ConsentManager = ConsentManager; exports.JWTIssuer = JWTIssuer; exports.PKCEUtils = PKCEUtils; exports.EncryptedTokenStorage = EncryptedTokenStorage; exports.MemoryTokenStorage = MemoryTokenStorage; exports.OAuthProxy = OAuthProxy; exports.OAuthProxyError = OAuthProxyError; exports.AuthProvider = AuthProvider; exports.AzureProvider = AzureProvider; exports.GitHubProvider = GitHubProvider; exports.GoogleProvider = GoogleProvider; exports.OAuthProvider = OAuthProvider; exports.DiskStore = DiskStore; exports.JWKSVerifier = JWKSVerifier;
-//# sourceMappingURL=chunk-KMG3C24Z.cjs.map
+//# sourceMappingURL=chunk-5FVNY65M.cjs.map