fastmcp 4.9.0 → 4.9.1

package/README.md

@@ -1951,14 +1951,9 @@ const server = new FastMCP({
 FastMCP also supports OAuth discovery endpoints for direct integration with OAuth providers, supporting both **MCP Specification 2025-03-26** and **MCP Specification 2025-06-18**. This provides standard discovery endpoints that comply with RFC 8414 (OAuth 2.0 Authorization Server Metadata) and RFC 9470 (OAuth 2.0 Protected Resource Metadata):
 
 ```ts
-import { FastMCP, DiscoveryDocumentCache } from "fastmcp";
-import { buildGetJwks } from "get-jwks";
-import fastJwt from "fast-jwt";
-
-// Create a cache for discovery documents (reuse across requests)
-const discoveryCache = new DiscoveryDocumentCache({
-  ttl: 3600000, // Cache for 1 hour (default)
-});
+import { FastMCP } from "fastmcp";
+import buildGetJwks from "get-jwks";
+import fastJwt, { type DecodedJwt } from "fast-jwt";
 
 const server = new FastMCP({
   name: "My Server",
@@ -1991,39 +1986,20 @@ const server = new FastMCP({
 
     // Validate OAuth JWT access token using OpenID Connect discovery
     try {
-      // Fetch and cache the discovery document
-      const discoveryUrl =
-        "https://auth.example.com/.well-known/openid-configuration";
-      // Alternative: Use OAuth authorization server metadata endpoint
-      // const discoveryUrl = 'https://auth.example.com/.well-known/oauth-authorization-server';
-
-      const config = (await discoveryCache.get(discoveryUrl)) as {
-        jwks_uri: string;
-        issuer: string;
-      };
-      const jwksUri = config.jwks_uri;
-      const issuer = config.issuer;
-
-      // Create JWKS client for token verification using discovered endpoint
-      const getJwks = buildGetJwks({
-        jwksUrl: jwksUri,
-        cache: true,
-        rateLimit: true,
-      });
+      // Create JWKS client for token verification
+      const getJwks = buildGetJwks();
 
-      // Create JWT verifier with JWKS and discovered issuer
+      // Create JWT verifier
       const verify = fastJwt.createVerifier({
-        key: async (token) => {
-          const { header } = fastJwt.decode(token, { complete: true });
-          const jwk = await getJwks.getJwk({
+        async key({ header }: DecodedJwt) {
+          const publicKey = await getJwks.getPublicKey({
             kid: header.kid,
             alg: header.alg,
+            domain: "https://auth.example.com",
           });
-          return jwk;
+          return publicKey;
         },
-        algorithms: ["RS256", "ES256"],
-        issuer: issuer,
-        audience: "mcp://my-server",
+        algorithms: ["RS256"],
       });
 
       // Verify the JWT token
@@ -2081,7 +2057,7 @@ Clients discover protected resource metadata using the following search order:
 
 Both the sub-path and root endpoints return identical metadata, ensuring compatibility with all MCP client implementations.
 
-For JWT token validation, you can use libraries like [`get-jwks`](https://github.com/nearform/get-jwks) and [`@fastify/jwt`](https://github.com/fastify/fastify-jwt) for OAuth JWT tokens.
+For JWT token validation, you can use libraries like [`get-jwks`](https://github.com/nearform/get-jwks) and [`fast-jwt`](https://github.com/nearform/fast-jwt) for OAuth JWT tokens.
 
 #### Passing Headers Through Context
 

package/dist/FastMCP.cjs

@@ -20,7 +20,7 @@ var _chunkMJCWKCHZcjs = require('./chunk-MJCWKCHZ.cjs');
 
 
 
-var _chunkIX3HKAX4cjs = require('./chunk-IX3HKAX4.cjs');
+var _chunkDZYT6QAHcjs = require('./chunk-DZYT6QAH.cjs');
 
 
 
@@ -41,5 +41,5 @@ var _chunkIX3HKAX4cjs = require('./chunk-IX3HKAX4.cjs');
 
 
 
-exports.AuthProvider = _chunkIX3HKAX4cjs.AuthProvider; exports.AzureProvider = _chunkIX3HKAX4cjs.AzureProvider; exports.DiscoveryDocumentCache = _chunkMJCWKCHZcjs.DiscoveryDocumentCache; exports.FastMCP = _chunkMJCWKCHZcjs.FastMCP; exports.FastMCPSession = _chunkMJCWKCHZcjs.FastMCPSession; exports.GitHubProvider = _chunkIX3HKAX4cjs.GitHubProvider; exports.GoogleProvider = _chunkIX3HKAX4cjs.GoogleProvider; exports.OAuthProvider = _chunkIX3HKAX4cjs.OAuthProvider; exports.ServerState = _chunkMJCWKCHZcjs.ServerState; exports.UnexpectedStateError = _chunkMJCWKCHZcjs.UnexpectedStateError; exports.UserError = _chunkMJCWKCHZcjs.UserError; exports.audioContent = _chunkMJCWKCHZcjs.audioContent; exports.getAuthSession = _chunkIX3HKAX4cjs.getAuthSession; exports.imageContent = _chunkMJCWKCHZcjs.imageContent; exports.requireAll = _chunkIX3HKAX4cjs.requireAll; exports.requireAny = _chunkIX3HKAX4cjs.requireAny; exports.requireAuth = _chunkIX3HKAX4cjs.requireAuth; exports.requireRole = _chunkIX3HKAX4cjs.requireRole; exports.requireScopes = _chunkIX3HKAX4cjs.requireScopes;
+exports.AuthProvider = _chunkDZYT6QAHcjs.AuthProvider; exports.AzureProvider = _chunkDZYT6QAHcjs.AzureProvider; exports.DiscoveryDocumentCache = _chunkMJCWKCHZcjs.DiscoveryDocumentCache; exports.FastMCP = _chunkMJCWKCHZcjs.FastMCP; exports.FastMCPSession = _chunkMJCWKCHZcjs.FastMCPSession; exports.GitHubProvider = _chunkDZYT6QAHcjs.GitHubProvider; exports.GoogleProvider = _chunkDZYT6QAHcjs.GoogleProvider; exports.OAuthProvider = _chunkDZYT6QAHcjs.OAuthProvider; exports.ServerState = _chunkMJCWKCHZcjs.ServerState; exports.UnexpectedStateError = _chunkMJCWKCHZcjs.UnexpectedStateError; exports.UserError = _chunkMJCWKCHZcjs.UserError; exports.audioContent = _chunkMJCWKCHZcjs.audioContent; exports.getAuthSession = _chunkDZYT6QAHcjs.getAuthSession; exports.imageContent = _chunkMJCWKCHZcjs.imageContent; exports.requireAll = _chunkDZYT6QAHcjs.requireAll; exports.requireAny = _chunkDZYT6QAHcjs.requireAny; exports.requireAuth = _chunkDZYT6QAHcjs.requireAuth; exports.requireRole = _chunkDZYT6QAHcjs.requireRole; exports.requireScopes = _chunkDZYT6QAHcjs.requireScopes;
 //# sourceMappingURL=FastMCP.cjs.map

package/dist/FastMCP.d.cts

@@ -12,8 +12,8 @@ import { CorsOptions } from 'mcp-proxy';
 export { CorsOptions } from 'mcp-proxy';
 import { StrictEventEmitter } from 'strict-event-emitter-types';
 import { z } from 'zod';
-import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-vyjR-9Z7.cjs';
-export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-vyjR-9Z7.cjs';
+import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-BNqoBTYA.cjs';
+export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-BNqoBTYA.cjs';
 import 'node:http';
 
 declare class DiscoveryDocumentCache {

package/dist/FastMCP.d.ts

@@ -12,8 +12,8 @@ import { CorsOptions } from 'mcp-proxy';
 export { CorsOptions } from 'mcp-proxy';
 import { StrictEventEmitter } from 'strict-event-emitter-types';
 import { z } from 'zod';
-import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-vyjR-9Z7.js';
-export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-vyjR-9Z7.js';
+import { A as AuthProvider, O as OAuthSession, a as OAuthProxy } from './OAuthProvider-BNqoBTYA.js';
+export { j as AuthProviderConfig, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, d as OAuthProvider, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from './OAuthProvider-BNqoBTYA.js';
 import 'node:http';
 
 declare class DiscoveryDocumentCache {

package/dist/FastMCP.js

@@ -20,7 +20,7 @@ import {
   requireAuth,
   requireRole,
   requireScopes
-} from "./chunk-OJG4XYXA.js";
+} from "./chunk-GM44BOI7.js";
 export {
   AuthProvider,
   AzureProvider,

package/dist/{OAuthProvider-vyjR-9Z7.d.cts → OAuthProvider-BNqoBTYA.d.cts}

@@ -382,6 +382,21 @@ interface TokenStorage {
     get(key: string): Promise<null | unknown>;
     /** Save a value with optional TTL */
     save(key: string, value: unknown, ttl?: number): Promise<void>;
+    /**
+     * Atomically retrieve a value and delete it, returning `null` if the key was
+     * absent. At most one caller may observe a given value.
+     *
+     * Optional, but **required for correctness when more than one process shares
+     * this storage**: the OAuth proxy consumes authorization codes and
+     * transactions through it, and single-use enforcement depends on the
+     * atomicity. Without it the proxy falls back to a non-atomic get + delete,
+     * where two concurrent requests can both redeem the same authorization code.
+     *
+     * Most backends expose a suitable primitive: Redis `GETDEL`, DynamoDB
+     * `DeleteItem` with `ReturnValues: "ALL_OLD"`, or SQL
+     * `DELETE ... RETURNING *`.
+     */
+    take?(key: string): Promise<null | unknown>;
 }
 /**
  * Token verification result
@@ -431,16 +446,18 @@ interface UpstreamTokenSet {
 declare class OAuthProxy {
     private claimsExtractor;
     private cleanupInterval;
-    private clientCodes;
     private config;
     private consentManager;
     private jwtIssuer?;
-    /** Keyed by redirect_uri for defence-in-depth checks in handleCallback/handleConsent */
-    private registeredClients;
-    /** Keyed by proxy-issued client_id for authorize/token-exchange lookups */
+    /**
+     * Keyed by proxy-issued client_id for authorize/token-exchange lookups and
+     * for the defence-in-depth callback checks. A registration never changes
+     * after it is written, so caching it locally cannot go stale; it is also
+     * persisted, so another instance can hydrate it.
+     */
     private registeredClientsByClientId;
+    private stateStore;
     private tokenStorage;
-    private transactions;
     constructor(config: OAuthProxyConfig);
     /**
      * OAuth authorization endpoint
@@ -503,7 +520,7 @@ declare class OAuthProxy {
      */
     private calculateAccessTokenTtl;
     /**
-     * Clean up expired transactions and codes
+     * Periodic maintenance hook. Expiry is enforced by the token storage.
      */
     private cleanup;
     /**

package/dist/{OAuthProvider-vyjR-9Z7.d.ts → OAuthProvider-BNqoBTYA.d.ts}

@@ -382,6 +382,21 @@ interface TokenStorage {
     get(key: string): Promise<null | unknown>;
     /** Save a value with optional TTL */
     save(key: string, value: unknown, ttl?: number): Promise<void>;
+    /**
+     * Atomically retrieve a value and delete it, returning `null` if the key was
+     * absent. At most one caller may observe a given value.
+     *
+     * Optional, but **required for correctness when more than one process shares
+     * this storage**: the OAuth proxy consumes authorization codes and
+     * transactions through it, and single-use enforcement depends on the
+     * atomicity. Without it the proxy falls back to a non-atomic get + delete,
+     * where two concurrent requests can both redeem the same authorization code.
+     *
+     * Most backends expose a suitable primitive: Redis `GETDEL`, DynamoDB
+     * `DeleteItem` with `ReturnValues: "ALL_OLD"`, or SQL
+     * `DELETE ... RETURNING *`.
+     */
+    take?(key: string): Promise<null | unknown>;
 }
 /**
  * Token verification result
@@ -431,16 +446,18 @@ interface UpstreamTokenSet {
 declare class OAuthProxy {
     private claimsExtractor;
     private cleanupInterval;
-    private clientCodes;
     private config;
     private consentManager;
     private jwtIssuer?;
-    /** Keyed by redirect_uri for defence-in-depth checks in handleCallback/handleConsent */
-    private registeredClients;
-    /** Keyed by proxy-issued client_id for authorize/token-exchange lookups */
+    /**
+     * Keyed by proxy-issued client_id for authorize/token-exchange lookups and
+     * for the defence-in-depth callback checks. A registration never changes
+     * after it is written, so caching it locally cannot go stale; it is also
+     * persisted, so another instance can hydrate it.
+     */
     private registeredClientsByClientId;
+    private stateStore;
     private tokenStorage;
-    private transactions;
     constructor(config: OAuthProxyConfig);
     /**
      * OAuth authorization endpoint
@@ -503,7 +520,7 @@ declare class OAuthProxy {
      */
     private calculateAccessTokenTtl;
     /**
-     * Clean up expired transactions and codes
+     * Periodic maintenance hook. Expiry is enforced by the token storage.
      */
     private cleanup;
     /**

package/dist/auth/index.cjs

@@ -24,7 +24,7 @@
 
 
 
-var _chunkIX3HKAX4cjs = require('../chunk-IX3HKAX4.cjs');
+var _chunkDZYT6QAHcjs = require('../chunk-DZYT6QAH.cjs');
 
 
 
@@ -51,5 +51,5 @@ var _chunkIX3HKAX4cjs = require('../chunk-IX3HKAX4.cjs');
 
 
 
-exports.AuthProvider = _chunkIX3HKAX4cjs.AuthProvider; exports.AzureProvider = _chunkIX3HKAX4cjs.AzureProvider; exports.ConsentManager = _chunkIX3HKAX4cjs.ConsentManager; exports.DEFAULT_ACCESS_TOKEN_TTL = _chunkIX3HKAX4cjs.DEFAULT_ACCESS_TOKEN_TTL; exports.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = _chunkIX3HKAX4cjs.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH; exports.DEFAULT_AUTHORIZATION_CODE_TTL = _chunkIX3HKAX4cjs.DEFAULT_AUTHORIZATION_CODE_TTL; exports.DEFAULT_REFRESH_TOKEN_TTL = _chunkIX3HKAX4cjs.DEFAULT_REFRESH_TOKEN_TTL; exports.DEFAULT_TRANSACTION_TTL = _chunkIX3HKAX4cjs.DEFAULT_TRANSACTION_TTL; exports.DiskStore = _chunkIX3HKAX4cjs.DiskStore; exports.EncryptedTokenStorage = _chunkIX3HKAX4cjs.EncryptedTokenStorage; exports.GitHubProvider = _chunkIX3HKAX4cjs.GitHubProvider; exports.GoogleProvider = _chunkIX3HKAX4cjs.GoogleProvider; exports.JWKSVerifier = _chunkIX3HKAX4cjs.JWKSVerifier; exports.JWTIssuer = _chunkIX3HKAX4cjs.JWTIssuer; exports.MemoryTokenStorage = _chunkIX3HKAX4cjs.MemoryTokenStorage; exports.OAuthProvider = _chunkIX3HKAX4cjs.OAuthProvider; exports.OAuthProxy = _chunkIX3HKAX4cjs.OAuthProxy; exports.OAuthProxyError = _chunkIX3HKAX4cjs.OAuthProxyError; exports.PKCEUtils = _chunkIX3HKAX4cjs.PKCEUtils; exports.getAuthSession = _chunkIX3HKAX4cjs.getAuthSession; exports.requireAll = _chunkIX3HKAX4cjs.requireAll; exports.requireAny = _chunkIX3HKAX4cjs.requireAny; exports.requireAuth = _chunkIX3HKAX4cjs.requireAuth; exports.requireRole = _chunkIX3HKAX4cjs.requireRole; exports.requireScopes = _chunkIX3HKAX4cjs.requireScopes;
+exports.AuthProvider = _chunkDZYT6QAHcjs.AuthProvider; exports.AzureProvider = _chunkDZYT6QAHcjs.AzureProvider; exports.ConsentManager = _chunkDZYT6QAHcjs.ConsentManager; exports.DEFAULT_ACCESS_TOKEN_TTL = _chunkDZYT6QAHcjs.DEFAULT_ACCESS_TOKEN_TTL; exports.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH = _chunkDZYT6QAHcjs.DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH; exports.DEFAULT_AUTHORIZATION_CODE_TTL = _chunkDZYT6QAHcjs.DEFAULT_AUTHORIZATION_CODE_TTL; exports.DEFAULT_REFRESH_TOKEN_TTL = _chunkDZYT6QAHcjs.DEFAULT_REFRESH_TOKEN_TTL; exports.DEFAULT_TRANSACTION_TTL = _chunkDZYT6QAHcjs.DEFAULT_TRANSACTION_TTL; exports.DiskStore = _chunkDZYT6QAHcjs.DiskStore; exports.EncryptedTokenStorage = _chunkDZYT6QAHcjs.EncryptedTokenStorage; exports.GitHubProvider = _chunkDZYT6QAHcjs.GitHubProvider; exports.GoogleProvider = _chunkDZYT6QAHcjs.GoogleProvider; exports.JWKSVerifier = _chunkDZYT6QAHcjs.JWKSVerifier; exports.JWTIssuer = _chunkDZYT6QAHcjs.JWTIssuer; exports.MemoryTokenStorage = _chunkDZYT6QAHcjs.MemoryTokenStorage; exports.OAuthProvider = _chunkDZYT6QAHcjs.OAuthProvider; exports.OAuthProxy = _chunkDZYT6QAHcjs.OAuthProxy; exports.OAuthProxyError = _chunkDZYT6QAHcjs.OAuthProxyError; exports.PKCEUtils = _chunkDZYT6QAHcjs.PKCEUtils; exports.getAuthSession = _chunkDZYT6QAHcjs.getAuthSession; exports.requireAll = _chunkDZYT6QAHcjs.requireAll; exports.requireAny = _chunkDZYT6QAHcjs.requireAny; exports.requireAuth = _chunkDZYT6QAHcjs.requireAuth; exports.requireRole = _chunkDZYT6QAHcjs.requireRole; exports.requireScopes = _chunkDZYT6QAHcjs.requireScopes;
 //# sourceMappingURL=index.cjs.map

package/dist/auth/index.d.cts

@@ -1,5 +1,5 @@
-import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-vyjR-9Z7.cjs';
-export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-vyjR-9Z7.cjs';
+import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-BNqoBTYA.cjs';
+export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-BNqoBTYA.cjs';
 import 'node:http';
 
 /**
@@ -101,6 +101,15 @@ declare class DiskStore implements TokenStorage {
      * Get the number of stored items
      */
     size(): Promise<number>;
+    /**
+     * Atomically retrieve a value and delete it.
+     *
+     * rename() is atomic on POSIX filesystems, so when several processes race
+     * for the same key exactly one rename succeeds and the losers see ENOENT.
+     * That is what makes single-use authorization codes safe when more than one
+     * process shares the directory.
+     */
+    take(key: string): Promise<null | unknown>;
     /**
      * Ensure storage directory exists
      */
@@ -376,7 +385,13 @@ declare class EncryptedTokenStorage implements TokenStorage {
     delete(key: string): Promise<void>;
     get(key: string): Promise<null | unknown>;
     save(key: string, value: unknown, ttl?: number): Promise<void>;
+    /**
+     * Delegates to the backend so that the atomicity of the underlying store is
+     * preserved; falls back to get + delete when the backend cannot do better.
+     */
+    take(key: string): Promise<null | unknown>;
     private decrypt;
+    private decryptStored;
     private encrypt;
 }
 /**
@@ -398,6 +413,11 @@ declare class MemoryTokenStorage implements TokenStorage {
      * Get the number of stored items
      */
     size(): number;
+    /**
+     * Atomic by construction: the read and the delete happen in a single
+     * synchronous block, so no other task can observe the value in between.
+     */
+    take(key: string): Promise<null | unknown>;
 }
 
 export { ConsentData, ConsentManager, DiskStore, EncryptedTokenStorage, type JWKSVerificationResult, JWKSVerifier, type JWKSVerifierConfig, type JWTClaims, JWTIssuer, MemoryTokenStorage, OAuthTransaction, PKCEPair, PKCEUtils, TokenStorage, TokenVerificationResult, TokenVerifier };

package/dist/auth/index.d.ts

@@ -1,5 +1,5 @@
-import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-vyjR-9Z7.js';
-export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-vyjR-9Z7.js';
+import { p as OAuthTransaction, C as ConsentData, T as TokenStorage, q as TokenVerifier, s as TokenVerificationResult, P as PKCEPair } from '../OAuthProvider-BNqoBTYA.js';
+export { A as AuthProvider, j as AuthProviderConfig, y as AuthorizationParams, b as AzureProvider, k as AzureProviderConfig, l as AzureSession, z as ClientCode, B as DCRClientMetadata, E as DCRRequest, F as DCRResponse, D as DEFAULT_ACCESS_TOKEN_TTL, u as DEFAULT_ACCESS_TOKEN_TTL_NO_REFRESH, v as DEFAULT_AUTHORIZATION_CODE_TTL, w as DEFAULT_REFRESH_TOKEN_TTL, x as DEFAULT_TRANSACTION_TTL, m as GenericOAuthProviderConfig, G as GitHubProvider, n as GitHubSession, c as GoogleProvider, o as GoogleSession, H as OAuthError, d as OAuthProvider, I as OAuthProviderConfig, a as OAuthProxy, J as OAuthProxyConfig, t as OAuthProxyError, O as OAuthSession, K as ProxyDCRClient, R as RefreshRequest, L as TokenMapping, M as TokenRequest, N as TokenResponse, U as UpstreamTokenSet, g as getAuthSession, r as requireAll, e as requireAny, f as requireAuth, h as requireRole, i as requireScopes } from '../OAuthProvider-BNqoBTYA.js';
 import 'node:http';
 
 /**
@@ -101,6 +101,15 @@ declare class DiskStore implements TokenStorage {
      * Get the number of stored items
      */
     size(): Promise<number>;
+    /**
+     * Atomically retrieve a value and delete it.
+     *
+     * rename() is atomic on POSIX filesystems, so when several processes race
+     * for the same key exactly one rename succeeds and the losers see ENOENT.
+     * That is what makes single-use authorization codes safe when more than one
+     * process shares the directory.
+     */
+    take(key: string): Promise<null | unknown>;
     /**
      * Ensure storage directory exists
      */
@@ -376,7 +385,13 @@ declare class EncryptedTokenStorage implements TokenStorage {
     delete(key: string): Promise<void>;
     get(key: string): Promise<null | unknown>;
     save(key: string, value: unknown, ttl?: number): Promise<void>;
+    /**
+     * Delegates to the backend so that the atomicity of the underlying store is
+     * preserved; falls back to get + delete when the backend cannot do better.
+     */
+    take(key: string): Promise<null | unknown>;
     private decrypt;
+    private decryptStored;
     private encrypt;
 }
 /**
@@ -398,6 +413,11 @@ declare class MemoryTokenStorage implements TokenStorage {
      * Get the number of stored items
      */
     size(): number;
+    /**
+     * Atomic by construction: the read and the delete happen in a single
+     * synchronous block, so no other task can observe the value in between.
+     */
+    take(key: string): Promise<null | unknown>;
 }
 
 export { ConsentData, ConsentManager, DiskStore, EncryptedTokenStorage, type JWKSVerificationResult, JWKSVerifier, type JWKSVerifierConfig, type JWTClaims, JWTIssuer, MemoryTokenStorage, OAuthTransaction, PKCEPair, PKCEUtils, TokenStorage, TokenVerificationResult, TokenVerifier };

package/dist/auth/index.js

@@ -24,7 +24,7 @@ import {
   requireAuth,
   requireRole,
   requireScopes
-} from "../chunk-OJG4XYXA.js";
+} from "../chunk-GM44BOI7.js";
 export {
   AuthProvider,
   AzureProvider,