fastmcp 4.23.11 → 4.23.13

package/dist/{chunk-G44SPVP7.js → chunk-CAQLTSJ5.js}

@@ -34,11 +34,26 @@ function requireScopes(...requiredScopes) {
 }
 
 // src/auth/OAuthProxy.ts
-import { randomBytes as randomBytes4 } from "crypto";
+import { createHash as createHash2, randomBytes as randomBytes4 } from "crypto";
 import { z as z2 } from "zod";
 
 // src/auth/OAuthProxyStateStore.ts
 import { z } from "zod";
+
+// src/auth/types.ts
+var DEFAULT_ACCESS_TOKEN_TTL = 3600;
+var DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = 31536e3;
+var DEFAULT_REFRESH_TOKEN_TTL = 2592e3;
+var TOKEN_ENDPOINT_AUTH_METHODS = [
+  "client_secret_basic",
+  "client_secret_post",
+  "none"
+];
+var DEFAULT_AUTHORIZATION_CODE_TTL = 300;
+var DEFAULT_TRANSACTION_TTL = 600;
+var DEFAULT_UPSTREAM_REQUEST_TIMEOUT_MS = 1e4;
+
+// src/auth/OAuthProxyStateStore.ts
 var STORAGE_KEY_PREFIX = {
   client: "client:",
   code: "code:",
@@ -76,7 +91,11 @@ var proxyDcrClientStorageSchema = z.object({
   metadata: dcrClientMetadataSchema.optional(),
   redirectUris: z.array(z.string()),
   registeredAt: storedDateSchema,
-  source: z.literal("cimd").optional()
+  source: z.literal("cimd").optional(),
+  // Optional: registrations written before it was recorded do not carry it.
+  // Listed so that it survives a read — an unlisted key is stripped, which
+  // would quietly turn every confidential client back into a legacy one.
+  tokenEndpointAuthMethod: z.enum(TOKEN_ENDPOINT_AUTH_METHODS).optional()
 });
 var upstreamTokenSetStorageSchema = z.object({
   accessToken: z.string(),
@@ -277,14 +296,6 @@ var OAuthProxyStateStore = class {
   }
 };
 
-// src/auth/types.ts
-var DEFAULT_ACCESS_TOKEN_TTL = 3600;
-var DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = 31536e3;
-var DEFAULT_REFRESH_TOKEN_TTL = 2592e3;
-var DEFAULT_AUTHORIZATION_CODE_TTL = 300;
-var DEFAULT_TRANSACTION_TTL = 600;
-var DEFAULT_UPSTREAM_REQUEST_TIMEOUT_MS = 1e4;
-
 // src/cancelResponseBody.ts
 var cancelResponseBody = async (response) => {
   if (!response.body) {
@@ -484,7 +495,9 @@ var ClaimsExtractor = class {
     "iss",
     "jti",
     "nbf",
-    "scope"
+    "scope",
+    // Whether a proxy token is an access or a refresh token.
+    "token_use"
   ]);
   constructor(config) {
     if (typeof config === "boolean") {
@@ -973,7 +986,10 @@ var JWTIssuer = class {
       jti,
       scope,
       // Merge additional claims (custom claims from upstream)
-      ...additionalClaims || {}
+      ...additionalClaims || {},
+      // After the spread: what kind of token this is is the proxy's call, and
+      // no additional claim may change it.
+      token_use: "access"
     };
     return this.signToken(claims);
   }
@@ -992,7 +1008,9 @@ var JWTIssuer = class {
       jti,
       scope,
       // Merge additional claims (custom claims from upstream)
-      ...additionalClaims || {}
+      ...additionalClaims || {},
+      // After the spread — see issueAccessToken.
+      token_use: "refresh"
     };
     return this.signToken(claims);
   }
@@ -1332,6 +1350,10 @@ var RESERVED_AUTHORIZATION_PARAMS = /* @__PURE__ */ new Set([
   "scope",
   "state"
 ]);
+var passthroughRefreshBindingSchema = z2.object({
+  clientAuthenticated: z2.boolean(),
+  clientId: z2.string()
+});
 var OAuthProxy = class {
   claimsExtractor = null;
   cleanupInterval = null;
@@ -1453,17 +1475,18 @@ var OAuthProxy = class {
         "code_challenge_method 'plain' is not supported; use S256"
       );
     }
-    if (registeredClient.source === "cimd") {
+    if (isPublicClient(registeredClient)) {
+      const kind = describeUnauthenticatedClient(registeredClient);
       if (!params.code_challenge) {
         throw new OAuthProxyError(
           "invalid_request",
-          "code_challenge is required for Client ID Metadata Document clients"
+          `code_challenge is required for ${kind}`
         );
       }
       if (params.code_challenge_method !== "S256") {
         throw new OAuthProxyError(
           "invalid_request",
-          "code_challenge_method must be S256 for Client ID Metadata Document clients"
+          `code_challenge_method must be S256 for ${kind}`
         );
       }
     }
@@ -1497,10 +1520,7 @@ var OAuthProxy = class {
         "Only authorization_code grant type is supported"
       );
     }
-    const registeredClient = await this.resolveClient(request.client_id);
-    if (!registeredClient) {
-      throw new OAuthProxyError("invalid_client", "Unknown client_id");
-    }
+    const { authenticated, client } = await this.authenticateClient(request);
     const consumed = await this.stateStore.consumeClientCode(request.code);
     if (!consumed) {
       throw new OAuthProxyError(
@@ -1516,13 +1536,16 @@ var OAuthProxy = class {
       );
     }
     const clientCode = consumed.clientCode;
-    if (clientCode.clientId !== request.client_id) {
-      throw new OAuthProxyError("invalid_client", "Client ID mismatch");
+    if (clientCode.clientId !== client.clientId) {
+      throw new OAuthProxyError(
+        "invalid_grant",
+        "Authorization code was issued to another client"
+      );
     }
-    if (registeredClient.source === "cimd" && !clientCode.codeChallenge) {
+    if (!authenticated && (!clientCode.codeChallenge || clientCode.codeChallengeMethod !== "S256")) {
       throw new OAuthProxyError(
         "invalid_grant",
-        "PKCE is required for Client ID Metadata Document clients"
+        `S256 PKCE is required for ${describeUnauthenticatedClient(client)}`
       );
     }
     if (clientCode.codeChallenge) {
@@ -1550,7 +1573,8 @@ var OAuthProxy = class {
     if (this.config.enableTokenSwap && this.jwtIssuer) {
       return await this.issueSwappedTokens(
         clientCode.clientId,
-        clientCode.upstreamTokens
+        clientCode.upstreamTokens,
+        authenticated
       );
     } else {
       const response = {
@@ -1559,6 +1583,11 @@ var OAuthProxy = class {
         token_type: clientCode.upstreamTokens.tokenType
       };
       if (clientCode.upstreamTokens.refreshToken) {
+        await this.savePassthroughRefreshBinding(
+          clientCode.upstreamTokens.refreshToken,
+          { clientAuthenticated: authenticated, clientId: client.clientId },
+          clientCode.upstreamTokens.refreshExpiresIn
+        );
         response.refresh_token = clientCode.upstreamTokens.refreshToken;
       }
       if (clientCode.upstreamTokens.idToken) {
@@ -1580,10 +1609,11 @@ var OAuthProxy = class {
         "Only refresh_token grant type is supported"
       );
     }
+    const caller = await this.authenticateClient(request);
     if (this.config.enableTokenSwap && this.jwtIssuer) {
-      return await this.handleSwapModeRefresh(request);
+      return await this.handleSwapModeRefresh(request, caller);
     }
-    return await this.handlePassthroughRefresh(request);
+    return await this.handlePassthroughRefresh(request, caller);
   }
   /**
    * Get OAuth discovery metadata
@@ -1721,6 +1751,9 @@ var OAuthProxy = class {
     if (!result.valid || !result.claims?.jti) {
       return null;
     }
+    if (result.claims.token_use !== "access") {
+      return null;
+    }
     const mapping = await this.tokenStorage.get(
       `mapping:${result.claims.jti}`
     );
@@ -1750,8 +1783,15 @@ var OAuthProxy = class {
         );
       }
     }
+    const tokenEndpointAuthMethod = request.token_endpoint_auth_method || "client_secret_basic";
+    if (!isTokenEndpointAuthMethod(tokenEndpointAuthMethod)) {
+      throw new OAuthProxyError(
+        "invalid_client_metadata",
+        `Unsupported token_endpoint_auth_method: ${tokenEndpointAuthMethod}. Supported: ${TOKEN_ENDPOINT_AUTH_METHODS.join(", ")}`
+      );
+    }
     const proxyClientId = randomBytes4(16).toString("hex");
-    const proxyClientSecret = randomBytes4(32).toString("base64url");
+    const proxyClientSecret = tokenEndpointAuthMethod === "none" ? void 0 : randomBytes4(32).toString("base64url");
     const client = {
       callbackUrl: request.redirect_uris[0],
       clientId: proxyClientId,
@@ -1770,7 +1810,8 @@ var OAuthProxy = class {
         tos_uri: request.tos_uri
       },
       redirectUris: request.redirect_uris,
-      registeredAt: /* @__PURE__ */ new Date()
+      registeredAt: /* @__PURE__ */ new Date(),
+      tokenEndpointAuthMethod
     };
     await this.stateStore.saveRegisteredClient(client);
     this.stateStore.cacheRegisteredClient(client);
@@ -1780,8 +1821,9 @@ var OAuthProxy = class {
       // Echo back optional metadata
       client_name: request.client_name,
       client_secret: proxyClientSecret,
-      client_secret_expires_at: 0,
-      // Never expires
+      // RFC 7591 §3.2.1: required alongside a secret, and only then.
+      client_secret_expires_at: proxyClientSecret ? 0 : void 0,
+      // 0: never
       client_uri: request.client_uri,
       contacts: request.contacts,
       grant_types: request.grant_types || [
@@ -1797,11 +1839,49 @@ var OAuthProxy = class {
       scope: request.scope,
       software_id: request.software_id,
       software_version: request.software_version,
-      token_endpoint_auth_method: request.token_endpoint_auth_method || "client_secret_basic",
+      token_endpoint_auth_method: tokenEndpointAuthMethod,
       tos_uri: request.tos_uri
     };
     return response;
   }
+  /**
+   * RFC 6749 §2.3 / §3.2.1: identify the client behind a token request and,
+   * when it presents a secret, authenticate it.
+   *
+   * A client registered with a secret method must present its secret. A
+   * public client must not present one: it was issued none. A registration
+   * that predates recorded auth methods may do either — it was issued a
+   * secret whatever it asked for — and is treated as unauthenticated when it
+   * leaves it out, which the grants then hold it to.
+   *
+   * Throws `invalid_client` on any failure. Nothing here touches grant state,
+   * so a caller that fails cannot spend a code or refresh token.
+   */
+  async authenticateClient(request) {
+    if (!request.client_id) {
+      throw new OAuthProxyError("invalid_client", "client_id is required");
+    }
+    const client = await this.resolveClient(request.client_id);
+    if (!client) {
+      throw new OAuthProxyError("invalid_client", "Unknown client_id");
+    }
+    if (request.client_secret) {
+      if (!client.clientSecret || !secretsMatch(request.client_secret, client.clientSecret)) {
+        throw new OAuthProxyError(
+          "invalid_client",
+          "Client authentication failed"
+        );
+      }
+      return { authenticated: true, client };
+    }
+    if (client.tokenEndpointAuthMethod === "client_secret_basic" || client.tokenEndpointAuthMethod === "client_secret_post") {
+      throw new OAuthProxyError(
+        "invalid_client",
+        "Client authentication failed: client_secret is required"
+      );
+    }
+    return { authenticated: false, client };
+  }
   /**
    * Calculate access token TTL from upstream tokens
    */
@@ -2019,7 +2099,29 @@ var OAuthProxy = class {
   /**
    * Handle passthrough mode refresh - forward refresh token directly to upstream
    */
-  async handlePassthroughRefresh(request) {
+  async handlePassthroughRefresh(request, caller) {
+    const bindingKey = this.passthroughRefreshKey(request.refresh_token);
+    const binding = passthroughRefreshBindingSchema.safeParse(
+      await this.tokenStorage.get(bindingKey)
+    );
+    if (!binding.success) {
+      throw new OAuthProxyError(
+        "invalid_grant",
+        "Invalid or expired refresh token"
+      );
+    }
+    if (binding.data.clientId !== caller.client.clientId) {
+      throw new OAuthProxyError(
+        "invalid_grant",
+        "Refresh token was issued to another client"
+      );
+    }
+    if (binding.data.clientAuthenticated && !caller.authenticated) {
+      throw new OAuthProxyError(
+        "invalid_client",
+        "Client authentication failed: client_secret is required"
+      );
+    }
     const useBasicAuth = this.config.upstreamTokenEndpointAuthMethod === "client_secret_basic";
     const bodyParams = {
       grant_type: "refresh_token",
@@ -2050,6 +2152,17 @@ var OAuthProxy = class {
       throw new OAuthProxyError(errorCode, errorDescription);
     }
     const tokens = await this.parseTokenResponse(tokenResponse);
+    await this.savePassthroughRefreshBinding(
+      tokens.refresh_token || request.refresh_token,
+      {
+        clientAuthenticated: caller.authenticated,
+        clientId: caller.client.clientId
+      },
+      tokens.refresh_expires_in
+    );
+    if (tokens.refresh_token && tokens.refresh_token !== request.refresh_token) {
+      await this.tokenStorage.delete(bindingKey);
+    }
     return {
       access_token: tokens.access_token,
       expires_in: tokens.expires_in || 3600,
@@ -2062,21 +2175,30 @@ var OAuthProxy = class {
   /**
    * Handle swap mode refresh - verify FastMCP JWT and issue new tokens
    */
-  async handleSwapModeRefresh(request) {
+  async handleSwapModeRefresh(request, caller) {
     if (!this.jwtIssuer) {
       throw new Error("JWT issuer not initialized");
     }
     const verifyResult = await this.jwtIssuer.verify(request.refresh_token);
-    if (!verifyResult.valid) {
+    if (!verifyResult.valid || !verifyResult.claims) {
       throw new OAuthProxyError(
         "invalid_grant",
         "Invalid or expired refresh token"
       );
     }
-    const jti = verifyResult.claims?.jti;
+    if (verifyResult.claims.token_use !== "refresh") {
+      throw new OAuthProxyError("invalid_grant", "Not a refresh token");
+    }
+    const jti = verifyResult.claims.jti;
     if (!jti) {
       throw new OAuthProxyError("invalid_grant", "Refresh token missing JTI");
     }
+    if (verifyResult.claims.client_id !== caller.client.clientId) {
+      throw new OAuthProxyError(
+        "invalid_grant",
+        "Refresh token was issued to another client"
+      );
+    }
     const mapping = await this.takeMapping(jti);
     if (!mapping) {
       throw new OAuthProxyError(
@@ -2085,6 +2207,18 @@ var OAuthProxy = class {
       );
     }
     try {
+      if (mapping.clientId !== caller.client.clientId) {
+        throw new OAuthProxyError(
+          "invalid_grant",
+          "Refresh token was issued to another client"
+        );
+      }
+      if (mapping.clientAuthenticated !== false && !caller.authenticated) {
+        throw new OAuthProxyError(
+          "invalid_client",
+          "Client authentication failed: client_secret is required"
+        );
+      }
       const upstreamTokens = await this.tokenStorage.get(
         `upstream:${mapping.upstreamTokenKey}`
       );
@@ -2120,7 +2254,8 @@ var OAuthProxy = class {
       return await this.issueSwappedTokensForRefresh(
         mapping.clientId,
         refreshedUpstreamTokens,
-        mapping.upstreamTokenKey
+        mapping.upstreamTokenKey,
+        caller.authenticated
       );
     } catch (error) {
       try {
@@ -2138,7 +2273,7 @@ var OAuthProxy = class {
    * Issue swapped tokens (JWT pattern)
    * Issues short-lived FastMCP JWTs and stores upstream tokens securely
    */
-  async issueSwappedTokens(clientId, upstreamTokens) {
+  async issueSwappedTokens(clientId, upstreamTokens, clientAuthenticated) {
     if (!this.jwtIssuer) {
       throw new Error("JWT issuer not initialized");
     }
@@ -2197,6 +2332,7 @@ var OAuthProxy = class {
       await this.tokenStorage.save(
         `mapping:${refreshJti}`,
         {
+          clientAuthenticated,
           clientId,
           createdAt: /* @__PURE__ */ new Date(),
           expiresAt: new Date(Date.now() + refreshTokenTtl * 1e3),
@@ -2213,7 +2349,7 @@ var OAuthProxy = class {
   /**
    * Issue swapped tokens for refresh flow
    */
-  async issueSwappedTokensForRefresh(clientId, upstreamTokens, upstreamTokenKey) {
+  async issueSwappedTokensForRefresh(clientId, upstreamTokens, upstreamTokenKey, clientAuthenticated) {
     if (!this.jwtIssuer) {
       throw new Error("JWT issuer not initialized");
     }
@@ -2256,6 +2392,7 @@ var OAuthProxy = class {
       await this.tokenStorage.save(
         `mapping:${refreshJti}`,
         {
+          clientAuthenticated,
           clientId,
           createdAt: /* @__PURE__ */ new Date(),
           expiresAt: new Date(Date.now() + refreshTokenTtl * 1e3),
@@ -2328,6 +2465,14 @@ var OAuthProxy = class {
     const rawJson = await response.json();
     return tokenResponseSchema.parse(rawJson);
   }
+  /**
+   * Storage key for the client binding of a passthrough-mode upstream refresh
+   * token. Keyed by its hash: storage keys are not encrypted, and the token
+   * itself is a live upstream credential.
+   */
+  passthroughRefreshKey(refreshToken) {
+    return `passthrough-refresh:${sha256(refreshToken)}`;
+  }
   /**
    * Redirect to upstream OAuth provider
    */
@@ -2460,6 +2605,18 @@ var OAuthProxy = class {
     }
     await this.tokenStorage.save(`mapping:${jti}`, mapping, ttl);
   }
+  /**
+   * Record which client a passthrough-mode upstream refresh token was handed
+   * to. It lives as long as the upstream says the token does, or as the
+   * configured refresh-token lifetime when it does not say.
+   */
+  async savePassthroughRefreshBinding(refreshToken, binding, refreshExpiresIn) {
+    await this.tokenStorage.save(
+      this.passthroughRefreshKey(refreshToken),
+      binding,
+      refreshExpiresIn ?? this.config.refreshTokenTtl ?? DEFAULT_REFRESH_TOKEN_TTL
+    );
+  }
   /**
    * Start periodic cleanup of expired transactions and codes
    */
@@ -2524,6 +2681,19 @@ var OAuthProxy = class {
     );
   }
 };
+var isPublicClient = (client) => client.source === "cimd" || client.tokenEndpointAuthMethod === "none";
+var describeUnauthenticatedClient = (client) => {
+  if (client.source === "cimd") {
+    return "Client ID Metadata Document clients";
+  }
+  if (client.tokenEndpointAuthMethod === "none") {
+    return 'clients registered with token_endpoint_auth_method "none"';
+  }
+  return "clients that do not authenticate with their client_secret";
+};
+var isTokenEndpointAuthMethod = (value) => TOKEN_ENDPOINT_AUTH_METHODS.includes(value);
+var sha256 = (value) => createHash2("sha256").update(value).digest("base64url");
+var secretsMatch = (presented, expected) => equalsConstantTime(sha256(presented), sha256(expected));
 var OAuthProxyError = class extends Error {
   constructor(code, description, statusCode = 400) {
     super(code);
@@ -3136,6 +3306,7 @@ export {
   DEFAULT_ACCESS_TOKEN_TTL,
   DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH,
   DEFAULT_REFRESH_TOKEN_TTL,
+  TOKEN_ENDPOINT_AUTH_METHODS,
   DEFAULT_AUTHORIZATION_CODE_TTL,
   DEFAULT_TRANSACTION_TTL,
   ConsentManager,
@@ -3153,4 +3324,4 @@ export {
   DiskStore,
   JWKSVerifier
 };
-//# sourceMappingURL=chunk-G44SPVP7.js.map
+//# sourceMappingURL=chunk-CAQLTSJ5.js.map