fastmcp 4.23.10 → 4.23.12

package/dist/{chunk-EHTAPWBU.js → chunk-ULNQF5KG.js}

@@ -1,6 +1,6 @@
 import {
   cancelResponseBody
-} from "./chunk-G44SPVP7.js";
+} from "./chunk-CAQLTSJ5.js";
 import {
   objectRootSchema,
   strictInputSchema,
@@ -1451,7 +1451,6 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
               if (!match) {
                 continue;
               }
-              const uri = uriTemplate.fill(match);
               const result = await resourceTemplate.load(
                 match,
                 this.#auth,
@@ -1468,7 +1467,9 @@ ${error instanceof Error ? error.stack : JSON.stringify(error)}`
                   description: resourceTemplate.description,
                   mimeType: resource2.mimeType ?? resourceTemplate.mimeType,
                   name: resourceTemplate.name,
-                  uri: resource2.uri ?? uri
+                  // The URI asked for. Refilling the template from `match` can
+                  // spell it differently: `{path}` refills `a,b` as `a%2Cb`.
+                  uri: resource2.uri ?? request.params.uri
                 }))
               };
             }
@@ -1879,6 +1880,19 @@ function matchUriTemplate(template, uri) {
   if (!match) {
     return void 0;
   }
+  const scalarNames = new Set(template.varNames);
+  for (const [expression] of template.template.matchAll(/\{[^}]*\}/g)) {
+    if (/^\{[?&]/.test(expression) || expression.includes("*")) {
+      for (const name of parseURITemplate(expression).varNames) {
+        scalarNames.delete(name);
+      }
+    }
+  }
+  for (const [name, value] of Object.entries(match)) {
+    if (scalarNames.has(name) && Array.isArray(value)) {
+      match[name] = value.join(",");
+    }
+  }
   const checksQuery = !/\{[?&]/.test(template.template);
   const checksFragment = !template.template.includes("{#");
   const shape = (value) => [
@@ -1900,15 +1914,20 @@ function normalizePath(path) {
   return path.startsWith("/") ? path : `/${path}`;
 }
 function parseBasicAuthHeader(authHeader) {
-  const basicMatch = authHeader?.match(/^Basic\s+(.+)$/);
+  const basicMatch = authHeader?.match(/^Basic\s+(.*)$/i);
   if (!basicMatch) return null;
+  const credentials = Buffer.from(basicMatch[1].trim(), "base64").toString(
+    "utf-8"
+  );
+  const separator = credentials.indexOf(":");
+  if (separator <= 0) return "malformed";
   try {
-    const credentials = Buffer.from(basicMatch[1], "base64").toString("utf-8");
-    const credMatch = credentials.match(/^([^:]+):(.*)$/);
-    if (!credMatch) return null;
-    return { clientId: credMatch[1], clientSecret: credMatch[2] };
+    return {
+      clientId: decodeURIComponent(credentials.slice(0, separator)),
+      clientSecret: decodeURIComponent(credentials.slice(separator + 1))
+    };
   } catch {
-    return null;
+    return "malformed";
   }
 }
 function parseBooleanSetting(value, source) {
@@ -1957,6 +1976,10 @@ var OAUTH_CREDENTIAL_RESPONSE_HEADERS = {
   "Content-Type": "application/json",
   Pragma: "no-cache"
 };
+var OAUTH_INVALID_CLIENT_RESPONSE_HEADERS = {
+  ...OAUTH_CREDENTIAL_RESPONSE_HEADERS,
+  "WWW-Authenticate": 'Basic realm="oauth", charset="UTF-8"'
+};
 function stripBasePath(path, basePath) {
   if (!basePath) {
     return path;
@@ -3040,8 +3063,37 @@ var FastMCP = class extends FastMCPEventEmitter {
                 const basicAuth = parseBasicAuthHeader(
                   req.headers.authorization
                 );
-                const clientId = basicAuth?.clientId || params.get("client_id") || "";
-                const clientSecret = basicAuth?.clientSecret ?? params.get("client_secret") ?? void 0;
+                if (basicAuth === "malformed") {
+                  throw {
+                    toJSON: () => ({
+                      error: "invalid_client",
+                      error_description: "Malformed Basic Authorization header"
+                    })
+                  };
+                }
+                if (basicAuth) {
+                  if (params.has("client_secret")) {
+                    throw {
+                      statusCode: 400,
+                      toJSON: () => ({
+                        error: "invalid_request",
+                        error_description: "Send client credentials in the Authorization header or the request body, not both"
+                      })
+                    };
+                  }
+                  const bodyClientId = params.get("client_id");
+                  if (bodyClientId !== null && bodyClientId !== basicAuth.clientId) {
+                    throw {
+                      statusCode: 400,
+                      toJSON: () => ({
+                        error: "invalid_request",
+                        error_description: "client_id in the request body does not match the Authorization header"
+                      })
+                    };
+                  }
+                }
+                const clientId = basicAuth ? basicAuth.clientId : params.get("client_id") || "";
+                const clientSecret = basicAuth ? basicAuth.clientSecret : params.get("client_secret") ?? void 0;
                 let response;
                 if (grantType === "authorization_code") {
                   response = await oauthProxy.exchangeAuthorizationCode({
@@ -3068,14 +3120,15 @@ var FastMCP = class extends FastMCPEventEmitter {
                 }
                 res.writeHead(200, OAUTH_CREDENTIAL_RESPONSE_HEADERS).end(JSON.stringify(response));
               } catch (error) {
-                const statusCode = error.statusCode || 400;
-                res.writeHead(statusCode, OAUTH_CREDENTIAL_RESPONSE_HEADERS).end(
-                  JSON.stringify(
-                    error.toJSON?.() || {
-                      error: "invalid_request"
-                    }
-                  )
-                );
+                const body = error.toJSON?.() || {
+                  error: "invalid_request"
+                };
+                if (body.error === "invalid_client") {
+                  res.writeHead(401, OAUTH_INVALID_CLIENT_RESPONSE_HEADERS).end(JSON.stringify(body));
+                } else {
+                  const statusCode = error.statusCode || 400;
+                  res.writeHead(statusCode, OAUTH_CREDENTIAL_RESPONSE_HEADERS).end(JSON.stringify(body));
+                }
               }
               resolve();
             });
@@ -3341,4 +3394,4 @@ export {
   FastMCPSession,
   FastMCP
 };
-//# sourceMappingURL=chunk-EHTAPWBU.js.map
+//# sourceMappingURL=chunk-ULNQF5KG.js.map