fastmcp 4.16.13 → 4.17.0

package/dist/{chunk-V5SKPW6E.js → chunk-UKKIJDLP.js}

@@ -72,6 +72,7 @@ var proxyDcrClientStorageSchema = z.object({
   callbackUrl: z.string(),
   clientId: z.string(),
   clientSecret: z.string().optional(),
+  expiresAt: storedDateSchema.optional(),
   metadata: dcrClientMetadataSchema.optional(),
   redirectUris: z.array(z.string()),
   registeredAt: storedDateSchema
@@ -172,10 +173,18 @@ var OAuthProxyStateStore = class {
       `${STORAGE_KEY_PREFIX.transaction}${transactionId}`
     );
   }
+  /**
+   * A client carrying `expiresAt` is a cached resolution rather than a
+   * permanent registration (CIMD), so a lapsed copy is dropped and reported as
+   * a miss — the caller re-resolves it from the source of truth.
+   */
   async getRegisteredClientByClientId(clientId) {
     const cached = this.registeredClientsByClientId.get(clientId);
     if (cached) {
-      return cached;
+      if (!cached.expiresAt || !this.isExpired(cached.expiresAt)) {
+        return cached;
+      }
+      this.registeredClientsByClientId.delete(clientId);
     }
     const stored = await this.tokenStorage.get(
       `${STORAGE_KEY_PREFIX.client}${clientId}`
@@ -184,6 +193,10 @@ var OAuthProxyStateStore = class {
     if (!parsed.success) {
       return null;
     }
+    if (parsed.data.expiresAt && this.isExpired(parsed.data.expiresAt)) {
+      await this.tokenStorage.delete(`${STORAGE_KEY_PREFIX.client}${clientId}`);
+      return null;
+    }
     this.cacheRegisteredClient(parsed.data);
     return parsed.data;
   }
@@ -205,12 +218,6 @@ var OAuthProxyStateStore = class {
     }
     return parsed.data;
   }
-  async isTransactionCallbackRegistered(transaction) {
-    const registeredClient = await this.getRegisteredClientByClientId(
-      transaction.clientId
-    );
-    return registeredClient?.redirectUris.includes(transaction.clientCallbackUrl) ?? false;
-  }
   /**
    * Record that an authorization code has been redeemed, so a later attempt
    * gets "already used" rather than looking like an unknown code. Keyed and
@@ -233,7 +240,8 @@ var OAuthProxyStateStore = class {
   async saveRegisteredClient(client) {
     await this.tokenStorage.save(
       `${STORAGE_KEY_PREFIX.client}${client.clientId}`,
-      client
+      client,
+      client.expiresAt ? this.getTtlSeconds(client.expiresAt) : void 0
     );
   }
   async saveTransaction(transaction) {
@@ -276,6 +284,172 @@ var DEFAULT_AUTHORIZATION_CODE_TTL = 300;
 var DEFAULT_TRANSACTION_TTL = 600;
 var DEFAULT_UPSTREAM_REQUEST_TIMEOUT_MS = 1e4;
 
+// src/auth/utils/cimd.ts
+var CIMD_FETCH_TIMEOUT_MS = 5e3;
+var CIMD_CLIENT_TTL_MS = 15 * 60 * 1e3;
+var CIMD_MAX_RESPONSE_BYTES = 65536;
+async function resolveCimdClient(clientId, requestedRedirectUri, validateRedirectUri) {
+  let url;
+  try {
+    url = new URL(clientId);
+  } catch {
+    return null;
+  }
+  if (url.protocol !== "https:" || url.search) {
+    return null;
+  }
+  if (isPrivateOrLoopbackHost(url.hostname)) {
+    return null;
+  }
+  let response;
+  try {
+    response = await fetch(clientId, {
+      redirect: "error",
+      signal: AbortSignal.timeout(CIMD_FETCH_TIMEOUT_MS)
+    });
+  } catch {
+    return null;
+  }
+  if (!response.ok) {
+    return null;
+  }
+  const text = await readBoundedText(response);
+  if (text === null) {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return null;
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    return null;
+  }
+  const doc = parsed;
+  if (doc.client_id !== clientId) {
+    return null;
+  }
+  if (!isStringArray(doc.redirect_uris) || doc.redirect_uris.length === 0) {
+    return null;
+  }
+  const redirectUris = doc.redirect_uris;
+  if (requestedRedirectUri && !redirectUris.includes(requestedRedirectUri)) {
+    return null;
+  }
+  if (!redirectUris.every((uri) => validateRedirectUri(uri))) {
+    return null;
+  }
+  const metadata = {
+    client_name: optionalString(doc.client_name),
+    client_uri: optionalString(doc.client_uri),
+    logo_uri: optionalString(doc.logo_uri),
+    policy_uri: optionalString(doc.policy_uri),
+    scope: optionalString(doc.scope),
+    tos_uri: optionalString(doc.tos_uri)
+  };
+  return {
+    callbackUrl: redirectUris[0],
+    clientId,
+    // CIMD is a public-client mechanism secured by PKCE; there is no secret.
+    clientSecret: void 0,
+    expiresAt: new Date(Date.now() + CIMD_CLIENT_TTL_MS),
+    metadata,
+    redirectUris,
+    registeredAt: /* @__PURE__ */ new Date()
+  };
+}
+function expandIPv6(host) {
+  const sides = host.split("::");
+  if (sides.length > 2) {
+    return null;
+  }
+  const head = sides[0] ? sides[0].split(":") : [];
+  const tail = sides.length === 2 && sides[1] ? sides[1].split(":") : [];
+  if (sides.length === 1 && head.length !== 8) {
+    return null;
+  }
+  const missing = 8 - head.length - tail.length;
+  if (missing < 0) {
+    return null;
+  }
+  const parts = [...head, ...Array(missing).fill("0"), ...tail];
+  if (parts.length !== 8) {
+    return null;
+  }
+  const groups = parts.map((g) => Number.parseInt(g || "0", 16));
+  return groups.every((g) => !Number.isNaN(g)) ? groups : null;
+}
+function isPrivateOrLoopbackHost(hostname) {
+  const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (host === "localhost" || host === "0.0.0.0") {
+    return true;
+  }
+  if (host.includes(":")) {
+    return isPrivateOrLoopbackIPv6(host);
+  }
+  return host === "127.0.0.1" || /^169\.254\./.test(host) || /^10\./.test(host) || /^192\.168\./.test(host) || /^172\.(1[6-9]|2\d|3[01])\./.test(host);
+}
+function isPrivateOrLoopbackIPv6(host) {
+  const groups = expandIPv6(host);
+  if (!groups) {
+    return false;
+  }
+  if (groups.every((g) => g === 0)) {
+    return true;
+  }
+  if (groups.slice(0, 7).every((g) => g === 0) && groups[7] === 1) {
+    return true;
+  }
+  const [first] = groups;
+  if ((first & 65472) === 65152) {
+    return true;
+  }
+  if ((first & 65024) === 64512) {
+    return true;
+  }
+  if (groups[0] === 0 && groups[1] === 0 && groups[2] === 0 && groups[3] === 0 && groups[4] === 0 && (groups[5] === 0 || groups[5] === 65535)) {
+    const ipv4 = `${groups[6] >> 8}.${groups[6] & 255}.${groups[7] >> 8}.${groups[7] & 255}`;
+    return isPrivateOrLoopbackHost(ipv4);
+  }
+  return false;
+}
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+function optionalString(value) {
+  return typeof value === "string" ? value : void 0;
+}
+async function readBoundedText(response) {
+  const contentLength = response.headers.get("content-length");
+  if (contentLength && Number(contentLength) > CIMD_MAX_RESPONSE_BYTES) {
+    return null;
+  }
+  const reader = response.body?.getReader();
+  if (!reader) {
+    return null;
+  }
+  const chunks = [];
+  let totalBytes = 0;
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) {
+        break;
+      }
+      totalBytes += value.byteLength;
+      if (totalBytes > CIMD_MAX_RESPONSE_BYTES) {
+        await reader.cancel();
+        return null;
+      }
+      chunks.push(value);
+    }
+  } catch {
+    return null;
+  }
+  return Buffer.concat(chunks).toString("utf-8");
+}
+
 // src/auth/utils/claimsExtractor.ts
 var ClaimsExtractor = class {
   config;
@@ -1155,9 +1329,13 @@ var OAuthProxy = class {
   ownedTokenStorage = null;
   /**
    * Keyed by proxy-issued client_id for authorize/token-exchange lookups and
-   * for the defence-in-depth callback checks. A registration never changes
+   * for the defence-in-depth callback checks. A DCR registration never changes
    * after it is written, so caching it locally cannot go stale; it is also
    * persisted, so another instance can hydrate it.
+   *
+   * A CIMD client is not a registration but a snapshot of a document that can
+   * change under us, so it is cached with an `expiresAt` and re-resolved once
+   * that passes.
    */
   registeredClientsByClientId = /* @__PURE__ */ new Map();
   stateStore;
@@ -1167,6 +1345,7 @@ var OAuthProxy = class {
       allowPlainPkce: true,
       authorizationCodeTtl: DEFAULT_AUTHORIZATION_CODE_TTL,
       consentRequired: true,
+      enableCimd: false,
       enableTokenSwap: true,
       // Enabled by default for security
       redirectPath: "/oauth/callback",
@@ -1223,7 +1402,10 @@ var OAuthProxy = class {
         "Only 'code' response type is supported"
       );
     }
-    const registeredClient = await this.stateStore.getRegisteredClientByClientId(params.client_id);
+    const registeredClient = await this.resolveClient(
+      params.client_id,
+      params.redirect_uri
+    );
     if (!registeredClient) {
       throw new OAuthProxyError("invalid_client", "Unknown client_id");
     }
@@ -1275,7 +1457,7 @@ var OAuthProxy = class {
         "Only authorization_code grant type is supported"
       );
     }
-    const registeredClient = await this.stateStore.getRegisteredClientByClientId(request.client_id);
+    const registeredClient = await this.resolveClient(request.client_id);
     if (!registeredClient) {
       throw new OAuthProxyError("invalid_client", "Unknown client_id");
     }
@@ -1363,6 +1545,7 @@ var OAuthProxy = class {
   getAuthorizationServerMetadata() {
     return {
       authorizationEndpoint: `${this.config.baseUrl}/oauth/authorize`,
+      ...this.config.enableCimd ? { clientIdMetadataDocumentSupported: true } : {},
       codeChallengeMethodsSupported: this.config.allowPlainPkce ? ["S256", "plain"] : ["S256"],
       grantTypesSupported: ["authorization_code", "refresh_token"],
       issuer: this.config.baseUrl,
@@ -1398,7 +1581,7 @@ var OAuthProxy = class {
     if (!transaction) {
       throw new OAuthProxyError("invalid_request", "Invalid or expired state");
     }
-    if (!await this.stateStore.isTransactionCallbackRegistered(transaction)) {
+    if (!await this.isTransactionCallbackRegistered(transaction)) {
       throw new OAuthProxyError(
         "invalid_request",
         "Transaction callback URL is not registered"
@@ -1444,7 +1627,7 @@ var OAuthProxy = class {
     }
     if (action === "deny") {
       await this.stateStore.deleteTransaction(transactionId);
-      if (!await this.stateStore.isTransactionCallbackRegistered(transaction)) {
+      if (!await this.isTransactionCallbackRegistered(transaction)) {
         throw new OAuthProxyError(
           "invalid_request",
           "Transaction callback URL is not registered"
@@ -2030,6 +2213,21 @@ var OAuthProxy = class {
     }
     return response;
   }
+  /**
+   * Defence in depth for the callback and consent-denial redirects: the
+   * transaction's stored callback URL must still be registered for its client.
+   *
+   * Resolution goes through {@link resolveClient}, so a CIMD registration whose
+   * cached copy lapsed mid-flow is re-fetched rather than mistaken for one that
+   * was revoked.
+   */
+  async isTransactionCallbackRegistered(transaction) {
+    const registeredClient = await this.resolveClient(
+      transaction.clientId,
+      transaction.clientCallbackUrl
+    );
+    return registeredClient?.redirectUris.includes(transaction.clientCallbackUrl) ?? false;
+  }
   /**
    * Match URI against pattern (supports wildcards)
    */
@@ -2157,6 +2355,32 @@ var OAuthProxy = class {
       tokenType: tokens.token_type || "Bearer"
     };
   }
+  /**
+   * Resolve the client behind a `client_id`: a stored registration if there is
+   * one, otherwise — when CIMD is enabled — the client's metadata document.
+   *
+   * A resolved CIMD client is cached like a DCR registration but carries the
+   * `expiresAt` the resolver stamped on it, so the store drops it once it
+   * lapses and the next call re-fetches the document. Every lookup goes
+   * through here, so a lapse always means "re-resolve", never "unknown
+   * client" mid-flow.
+   */
+  async resolveClient(clientId, requestedRedirectUri) {
+    const registeredClient = await this.stateStore.getRegisteredClientByClientId(clientId);
+    if (registeredClient || !this.config.enableCimd) {
+      return registeredClient;
+    }
+    const resolved = await resolveCimdClient(
+      clientId,
+      requestedRedirectUri,
+      (uri) => this.validateRedirectUri(uri)
+    );
+    if (resolved) {
+      this.stateStore.cacheRegisteredClient(resolved);
+      await this.stateStore.saveRegisteredClient(resolved);
+    }
+    return resolved;
+  }
   /**
    * Put a claimed refresh-token mapping back after a rotation failed, keeping
    * whatever lifetime it had left.
@@ -2222,11 +2446,15 @@ var OAuthProxy = class {
    * theft. Do not loosen the default beyond loopback addresses.
    */
   validateRedirectUri(uri) {
+    let parsed;
     try {
-      new URL(uri);
+      parsed = new URL(uri);
     } catch {
       return false;
     }
+    if (parsed.username !== "" || parsed.password !== "") {
+      return false;
+    }
     const patterns = this.config.allowedRedirectUriPatterns;
     if (Array.isArray(patterns) && patterns.length === 0) {
       return false;
@@ -2826,4 +3054,4 @@ export {
   DiskStore,
   JWKSVerifier
 };
-//# sourceMappingURL=chunk-V5SKPW6E.js.map
+//# sourceMappingURL=chunk-UKKIJDLP.js.map