fastmcp 4.23.11 → 4.23.13

package/dist/{chunk-XUUJOVC7.js → chunk-ULNQF5KG.js}

@@ -1,6 +1,6 @@
 import {
   cancelResponseBody
-} from "./chunk-G44SPVP7.js";
+} from "./chunk-CAQLTSJ5.js";
 import {
   objectRootSchema,
   strictInputSchema,
@@ -1914,15 +1914,20 @@ function normalizePath(path) {
   return path.startsWith("/") ? path : `/${path}`;
 }
 function parseBasicAuthHeader(authHeader) {
-  const basicMatch = authHeader?.match(/^Basic\s+(.+)$/);
+  const basicMatch = authHeader?.match(/^Basic\s+(.*)$/i);
   if (!basicMatch) return null;
+  const credentials = Buffer.from(basicMatch[1].trim(), "base64").toString(
+    "utf-8"
+  );
+  const separator = credentials.indexOf(":");
+  if (separator <= 0) return "malformed";
   try {
-    const credentials = Buffer.from(basicMatch[1], "base64").toString("utf-8");
-    const credMatch = credentials.match(/^([^:]+):(.*)$/);
-    if (!credMatch) return null;
-    return { clientId: credMatch[1], clientSecret: credMatch[2] };
+    return {
+      clientId: decodeURIComponent(credentials.slice(0, separator)),
+      clientSecret: decodeURIComponent(credentials.slice(separator + 1))
+    };
   } catch {
-    return null;
+    return "malformed";
   }
 }
 function parseBooleanSetting(value, source) {
@@ -1971,6 +1976,10 @@ var OAUTH_CREDENTIAL_RESPONSE_HEADERS = {
   "Content-Type": "application/json",
   Pragma: "no-cache"
 };
+var OAUTH_INVALID_CLIENT_RESPONSE_HEADERS = {
+  ...OAUTH_CREDENTIAL_RESPONSE_HEADERS,
+  "WWW-Authenticate": 'Basic realm="oauth", charset="UTF-8"'
+};
 function stripBasePath(path, basePath) {
   if (!basePath) {
     return path;
@@ -3054,8 +3063,37 @@ var FastMCP = class extends FastMCPEventEmitter {
                 const basicAuth = parseBasicAuthHeader(
                   req.headers.authorization
                 );
-                const clientId = basicAuth?.clientId || params.get("client_id") || "";
-                const clientSecret = basicAuth?.clientSecret ?? params.get("client_secret") ?? void 0;
+                if (basicAuth === "malformed") {
+                  throw {
+                    toJSON: () => ({
+                      error: "invalid_client",
+                      error_description: "Malformed Basic Authorization header"
+                    })
+                  };
+                }
+                if (basicAuth) {
+                  if (params.has("client_secret")) {
+                    throw {
+                      statusCode: 400,
+                      toJSON: () => ({
+                        error: "invalid_request",
+                        error_description: "Send client credentials in the Authorization header or the request body, not both"
+                      })
+                    };
+                  }
+                  const bodyClientId = params.get("client_id");
+                  if (bodyClientId !== null && bodyClientId !== basicAuth.clientId) {
+                    throw {
+                      statusCode: 400,
+                      toJSON: () => ({
+                        error: "invalid_request",
+                        error_description: "client_id in the request body does not match the Authorization header"
+                      })
+                    };
+                  }
+                }
+                const clientId = basicAuth ? basicAuth.clientId : params.get("client_id") || "";
+                const clientSecret = basicAuth ? basicAuth.clientSecret : params.get("client_secret") ?? void 0;
                 let response;
                 if (grantType === "authorization_code") {
                   response = await oauthProxy.exchangeAuthorizationCode({
@@ -3082,14 +3120,15 @@ var FastMCP = class extends FastMCPEventEmitter {
                 }
                 res.writeHead(200, OAUTH_CREDENTIAL_RESPONSE_HEADERS).end(JSON.stringify(response));
               } catch (error) {
-                const statusCode = error.statusCode || 400;
-                res.writeHead(statusCode, OAUTH_CREDENTIAL_RESPONSE_HEADERS).end(
-                  JSON.stringify(
-                    error.toJSON?.() || {
-                      error: "invalid_request"
-                    }
-                  )
-                );
+                const body = error.toJSON?.() || {
+                  error: "invalid_request"
+                };
+                if (body.error === "invalid_client") {
+                  res.writeHead(401, OAUTH_INVALID_CLIENT_RESPONSE_HEADERS).end(JSON.stringify(body));
+                } else {
+                  const statusCode = error.statusCode || 400;
+                  res.writeHead(statusCode, OAUTH_CREDENTIAL_RESPONSE_HEADERS).end(JSON.stringify(body));
+                }
               }
               resolve();
             });
@@ -3355,4 +3394,4 @@ export {
   FastMCPSession,
   FastMCP
 };
-//# sourceMappingURL=chunk-XUUJOVC7.js.map
+//# sourceMappingURL=chunk-ULNQF5KG.js.map