machine-bridge-mcp 1.0.8 → 1.1.1

package/src/local/worker-health.mjs

@@ -0,0 +1,246 @@
+import http from "node:http";
+import https from "node:https";
+import { appName } from "./state.mjs";
+import { proxyAgentForHttp } from "./network-proxy.mjs";
+
+const MAX_HEALTH_BODY_BYTES = 64 * 1024;
+const DEFAULT_HEALTH_TIMEOUT_MS = 5_000;
+const NON_RETRYABLE_HEALTH_ERRORS = new Set(["missing_worker_url", "invalid_worker_url", "proxy_configuration"]);
+const WORKER_NAME = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+const WORKERS_DEV_HOST = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.workers\.dev$/;
+
+export async function workerHealth(workerUrl, expectedVersion, options = {}) {
+  if (!workerUrl) return { ok: false, error: "missing_worker_url" };
+  let healthUrl;
+  try {
+    healthUrl = workerHealthUrl(workerUrl, options.expectedWorkerName);
+  } catch {
+    return { ok: false, error: "invalid_worker_url" };
+  }
+
+  try {
+    const probe = typeof options.probe === "function" ? options.probe : requestAllowedWorkerHealthJson;
+    const result = await probe(healthUrl, {
+      timeoutMs: options.timeoutMs,
+      proxyResolver: options.proxyResolver,
+      proxyAgentForUrl: options.proxyAgentForUrl,
+    });
+    const networkRoute = result.networkRoute || "direct";
+    if (result.statusCode !== 200) return { ok: false, error: `HTTP ${result.statusCode}`, networkRoute };
+    const body = result.body;
+    if (body?.ok !== true || body?.server !== appName) return { ok: false, error: "unexpected_health_response", networkRoute };
+    if (body?.version !== expectedVersion) return { ok: false, error: `version_mismatch:${body?.version || "unknown"}!=${expectedVersion}`, networkRoute };
+    return { ok: true, version: body.version, networkRoute };
+  } catch (error) {
+    return {
+      ok: false,
+      error: workerHealthError(error),
+      networkRoute: error?.networkRoute || (hasErrorCode(error, "http_proxy_configuration") ? "invalid-proxy-configuration" : "unknown"),
+    };
+  }
+}
+
+export async function retryWorkerHealth(workerUrl, expectedVersion, attempts, options = {}) {
+  const count = Math.max(1, Number.parseInt(String(attempts), 10) || 1);
+  const wait = typeof options.wait === "function" ? options.wait : sleep;
+  let last = { ok: false, error: "not_checked" };
+  for (let index = 0; index < count; index += 1) {
+    last = await workerHealth(workerUrl, expectedVersion, options);
+    if (last.ok) return last;
+    if (!isRetryableWorkerHealthError(last.error)) return last;
+    if (index + 1 < count) await wait(1_000 + index * 500);
+  }
+  return last;
+}
+
+export function workerHealthUrl(workerUrl, expectedWorkerName = "") {
+  const base = new URL(`${String(workerUrl).replace(/\/+$/, "")}/`);
+  const hostname = base.hostname.toLowerCase();
+  const expectedName = String(expectedWorkerName || "").toLowerCase();
+  if (base.protocol !== "https:" || base.port || base.username || base.password || base.search || base.hash || base.pathname !== "/") {
+    throw new Error("Worker URL must be an HTTPS workers.dev origin");
+  }
+  if (!WORKERS_DEV_HOST.test(hostname)) throw new Error("Worker URL must use a workers.dev hostname");
+  if (expectedName && (!WORKER_NAME.test(expectedName) || hostname.split(".")[0] !== expectedName)) {
+    throw new Error("Worker URL hostname does not match the recorded Worker name");
+  }
+  return `https://${hostname}/healthz`;
+}
+
+export function isRetryableWorkerHealthError(value) {
+  return !NON_RETRYABLE_HEALTH_ERRORS.has(String(value || ""));
+}
+
+export function workerHealthRequiresRedeploy(value) {
+  const reason = String(value || "");
+  return reason.startsWith("version_mismatch:")
+    || reason === "unexpected_health_response"
+    || reason === "HTTP 404"
+    || reason === "HTTP 410";
+}
+
+export function workerHealthUserReason(value) {
+  const reason = String(value || "");
+  if (reason.startsWith("version_mismatch:")) return "deployed version does not match the local package";
+  if (/^HTTP \d+$/.test(reason)) return "health endpoint returned an HTTP error";
+  if (reason === "unexpected_health_response") return "health endpoint returned an unexpected response";
+  if (reason === "timeout") return "health check timed out";
+  if (reason === "tls_error") return "TLS validation failed";
+  if (reason === "network_error") return "network request failed";
+  if (reason === "proxy_configuration") return "HTTP proxy configuration is invalid";
+  if (reason === "missing_worker_url") return "Worker URL is missing";
+  if (reason === "invalid_worker_url") return "Worker URL is invalid";
+  return "health check failed";
+}
+
+export function workerHealthError(error) {
+  if (hasErrorCode(error, "http_proxy_configuration")) return "proxy_configuration";
+  if (hasErrorCode(error, "ETIMEDOUT") || hasErrorCode(error, "ABORT_ERR") || /timeout|timed out|aborted/i.test(errorMessages(error))) return "timeout";
+  if (hasTlsError(error)) return "tls_error";
+  if (hasNetworkError(error)) return "network_error";
+  return "request_failed";
+}
+
+export function requestWorkerHealthJson(url, options = {}) {
+  return requestJson(new URL(String(url)), {
+    timeoutMs: boundedTimeout(options.timeoutMs),
+    proxyResolver: options.proxyResolver,
+    proxyAgentForUrl: options.proxyAgentForUrl,
+  });
+}
+
+function requestAllowedWorkerHealthJson(url, options = {}) {
+  const target = new URL(String(url));
+  if (target.protocol !== "https:" || target.port || target.pathname !== "/healthz" || target.search || target.hash || !WORKERS_DEV_HOST.test(target.hostname)) {
+    const error = new Error("health request target is not an allowed workers.dev endpoint");
+    error.code = "ERR_INVALID_WORKER_HEALTH_URL";
+    throw error;
+  }
+  return requestJson(target, {
+    timeoutMs: boundedTimeout(options.timeoutMs),
+    proxyResolver: options.proxyResolver,
+    proxyAgentForUrl: options.proxyAgentForUrl,
+  });
+}
+
+function requestJson(target, options) {
+  return new Promise((resolvePromise, rejectPromise) => {
+    const selectProxy = typeof options.proxyAgentForUrl === "function" ? options.proxyAgentForUrl : proxyAgentForHttp;
+    let proxy;
+    try {
+      proxy = selectProxy(target.href, options.proxyResolver);
+    } catch (error) {
+      rejectPromise(withNetworkRoute(error, "invalid-proxy-configuration"));
+      return;
+    }
+    const networkRoute = proxy?.agent ? "proxy" : "direct";
+    const transport = target.protocol === "https:" ? https : http;
+    const request = transport.request({
+      protocol: target.protocol,
+      hostname: target.hostname,
+      port: target.port || undefined,
+      method: "GET",
+      path: `${target.pathname}${target.search}`,
+      headers: {
+        Accept: "application/json",
+        "User-Agent": "machine-bridge-mcp-health",
+      },
+      ...(proxy?.agent ? { agent: proxy.agent } : {}),
+    });
+    let settled = false;
+    const finish = (callback) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      callback();
+    };
+    const rejectWithRoute = (error) => finish(() => rejectPromise(withNetworkRoute(error, networkRoute)));
+    const timer = setTimeout(() => {
+      const error = new Error(`health request timed out after ${options.timeoutMs}ms`);
+      error.code = "ETIMEDOUT";
+      request.destroy(error);
+    }, options.timeoutMs);
+    timer.unref?.();
+
+    request.on("response", (response) => {
+      const statusCode = Number(response.statusCode || 0);
+      const chunks = [];
+      let bytes = 0;
+      response.on("data", (chunk) => {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        bytes += buffer.length;
+        if (bytes > MAX_HEALTH_BODY_BYTES) {
+          const error = new Error("health response exceeded the size limit");
+          error.code = "ERR_RESPONSE_TOO_LARGE";
+          response.destroy(error);
+          return;
+        }
+        chunks.push(buffer);
+      });
+      response.on("error", rejectWithRoute);
+      response.on("end", () => {
+        if (settled) return;
+        let body = null;
+        try {
+          body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+        } catch {
+          // Invalid JSON is reported through the normal unexpected-health-response classification.
+        }
+        finish(() => resolvePromise({ statusCode, body, networkRoute }));
+      });
+    });
+    request.on("error", rejectWithRoute);
+    request.end();
+  });
+}
+
+function withNetworkRoute(error, networkRoute) {
+  const value = error instanceof Error ? error : new Error(String(error));
+  if (!value.networkRoute) value.networkRoute = networkRoute;
+  return value;
+}
+
+function hasTlsError(error) {
+  const codes = errorCodes(error);
+  if (codes.some((code) => code.startsWith("ERR_TLS_") || code.startsWith("CERT_") || code.includes("CERTIFICATE") || code === "UNABLE_TO_VERIFY_LEAF_SIGNATURE" || code === "DEPTH_ZERO_SELF_SIGNED_CERT")) return true;
+  return /certificate|\bTLS\b|\bSSL\b/i.test(errorMessages(error));
+}
+
+function hasNetworkError(error) {
+  const networkCodes = new Set([
+    "ECONNABORTED", "ECONNREFUSED", "ECONNRESET", "EHOSTUNREACH", "ENETDOWN", "ENETRESET",
+    "ENETUNREACH", "ENOTFOUND", "EAI_AGAIN", "EPIPE", "UND_ERR_CONNECT_TIMEOUT",
+  ]);
+  if (errorCodes(error).some((code) => networkCodes.has(code))) return true;
+  return /fetch failed|network|socket hang up|connection reset|connection refused/i.test(errorMessages(error));
+}
+
+function hasErrorCode(error, expected) {
+  return errorCodes(error).includes(expected);
+}
+
+function errorCodes(error) {
+  const codes = [];
+  for (let current = error; current && typeof current === "object"; current = current.cause) {
+    if (typeof current.code === "string") codes.push(current.code);
+  }
+  return codes;
+}
+
+function errorMessages(error) {
+  const messages = [];
+  for (let current = error; current; current = current?.cause) {
+    messages.push(String(current?.message || current));
+    if (typeof current !== "object") break;
+  }
+  return messages.join(" ");
+}
+
+function boundedTimeout(value) {
+  const numeric = Number(value);
+  return Number.isFinite(numeric) && numeric > 0 ? Math.min(60_000, Math.floor(numeric)) : DEFAULT_HEALTH_TIMEOUT_MS;
+}
+
+function sleep(ms) {
+  return new Promise((resolvePromise) => setTimeout(resolvePromise, ms));
+}

package/src/worker/index.ts

@@ -9,10 +9,11 @@ import { sanitizeDaemonPolicy, sanitizeDaemonTools, type DaemonPolicy } from "./
 import { accountRoleAllowsTool, accountRoleToolNames, type AccountRole } from "./access";
 import { accountAuthoritySnapshot, decorateProjectOverview, describeDaemonCeiling } from "./authority";
 import { accountAdminAuthorized, handleAccountAdminOperation } from "./account-admin";
+import { exchangeOAuthToken } from "./oauth-tokens";
 import { serverInfoTool, workspaceTools } from "./tool-catalog";
 import {
-  AUTH_BLOCK_SECONDS, accountByName, authorizationIdentity, emptyOAuthStore, isCurrentOAuthStore,
-  pkceS256, pruneAuthFailures, pruneClientRecordByExpiry, pruneRecordByExpiry, randomToken,
+  AUTH_BLOCK_SECONDS, OFFLINE_ACCESS_SCOPE, accountByName, authorizationIdentity, emptyOAuthStore,
+  isCurrentOAuthStore, pruneAuthFailures, pruneClientRecordByExpiry, pruneRecordByExpiry, randomToken,
   recordAuthorizationFailure, safeEqual, sha256Hex, validateAuthorizationRequest, verifyAccountPassword,
   type OAuthClient, type OAuthStore, type ValidatedAuthorization,
 } from "./oauth-state";
@@ -23,13 +24,12 @@ import {
 } from "./http";
 
 const SERVER_NAME = String(serverMetadata.name);
-const SERVER_VERSION = "1.0.8";
+const SERVER_VERSION = "1.1.1";
 const MCP_PROTOCOL_VERSION = String(serverMetadata.protocolVersion);
 const MCP_SUPPORTED_PROTOCOL_VERSIONS = serverMetadata.supportedProtocolVersions.map((value) => String(value));
 const JSONRPC_VERSION = "2.0";
 const DEFAULT_MAX_BODY_BYTES = 8 * 1024 * 1024;
 const MAX_BODY_BYTES = 16 * 1024 * 1024;
-const TOKEN_TTL_SECONDS = 60 * 60 * 24 * 30;
 const OAUTH_BODY_LIMIT_BYTES = 64 * 1024;
 const MAX_PENDING_CALLS = 32;
 const MAX_DAEMON_MESSAGE_BYTES = 8 * 1024 * 1024;
@@ -38,10 +38,8 @@ const OAUTH_UNUSED_CLIENT_TTL_SECONDS = 60 * 60;
 const MAX_OAUTH_CLIENTS = 50;
 const MAX_OAUTH_CLIENTS_PER_IDENTITY = 5;
 const OAUTH_CLIENT_IDLE_TTL_SECONDS = 60 * 60 * 24 * 90;
-const MAX_TOKENS_PER_CLIENT = 20;
 const MAX_CODES_PER_CLIENT = 10;
 const MAX_OAUTH_CODES = 200;
-const MAX_OAUTH_TOKENS = 500;
 const MAX_AUTH_FAILURE_IDENTITIES = 200;
 const AUTHORIZATION_FIELDS = new Set(["response_type", "client_id", "redirect_uri", "code_challenge", "code_challenge_method", "scope", "resource", "state"]);
 
@@ -591,10 +589,10 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
       token_endpoint: `${base}/oauth/token`,
       registration_endpoint: `${base}/oauth/register`,
       response_types_supported: ["code"],
-      grant_types_supported: ["authorization_code"],
+      grant_types_supported: ["authorization_code", "refresh_token"],
       token_endpoint_auth_methods_supported: ["none"],
       code_challenge_methods_supported: ["S256"],
-      scopes_supported: [SERVER_NAME],
+      scopes_supported: [SERVER_NAME, OFFLINE_ACCESS_SCOPE],
     };
   }
 
@@ -602,7 +600,7 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     return {
       resource: `${base}/mcp`,
       authorization_servers: [base],
-      scopes_supported: [SERVER_NAME],
+      scopes_supported: [SERVER_NAME, OFFLINE_ACCESS_SCOPE],
       bearer_methods_supported: ["header"],
       resource_name: SERVER_NAME,
     };
@@ -646,7 +644,7 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
         delete client.registration_identity;
         changed = true;
       }
-      const ttl = client.last_used_at === client.created_at ? OAUTH_UNUSED_CLIENT_TTL_SECONDS : OAUTH_CLIENT_IDLE_TTL_SECONDS;
+      const ttl = client.has_been_authorized === false ? OAUTH_UNUSED_CLIENT_TTL_SECONDS : OAUTH_CLIENT_IDLE_TTL_SECONDS;
       if (!activeClientIds.has(clientId) && client.last_used_at + ttl <= now) {
         delete store.clients[clientId];
         changed = true;
@@ -689,9 +687,11 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     return this.withOAuthLock(async () => {
       const store = await this.oauthStore();
       const registrationIdentity = await authorizationIdentity(request, this.identityKey());
-      const identityClientCount = Object.values(store.clients).filter((client) => client.registration_identity === registrationIdentity).length;
-      if (identityClientCount >= MAX_OAUTH_CLIENTS_PER_IDENTITY) {
-        return json({ error: "too_many_requests", error_description: "client registration limit reached for this source" }, 429);
+      const pendingIdentityClientCount = Object.values(store.clients).filter((client) => (
+        client.registration_identity === registrationIdentity && client.has_been_authorized === false
+      )).length;
+      if (pendingIdentityClientCount >= MAX_OAUTH_CLIENTS_PER_IDENTITY) {
+        return json({ error: "too_many_requests", error_description: "pending client registration limit reached for this source" }, 429);
       }
       if (Object.keys(store.clients).length >= MAX_OAUTH_CLIENTS) {
         return json({ error: "temporarily_unavailable", error_description: "client registry is full; remove stale state or retry after inactive clients expire" }, 503);
@@ -703,6 +703,7 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
         redirect_uris: normalized,
         created_at: now,
         last_used_at: now,
+        has_been_authorized: false,
         registration_identity: registrationIdentity,
       };
       store.clients[client.client_id] = client;
@@ -711,7 +712,7 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
         client_id: client.client_id,
         client_name: client.client_name,
         redirect_uris: client.redirect_uris,
-        grant_types: ["authorization_code"],
+        grant_types: ["authorization_code", "refresh_token"],
         response_types: ["code"],
         token_endpoint_auth_method: "none",
         client_id_issued_at: client.created_at,
@@ -807,6 +808,7 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
       }
       delete store.auth_failures[identity];
       client.last_used_at = now;
+      client.has_been_authorized = true;
 
       const code = randomToken("mcp_code");
       const redirectLocation = authorizationRedirectLocation(redirectUri, code, state);
@@ -829,45 +831,13 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     });
   }
 
-  private async exchangeToken(request: Request, base: string): Promise<Response> {
-    const body = await parseRequestBody(request, OAUTH_BODY_LIMIT_BYTES);
-    if (String(body.grant_type ?? "") !== "authorization_code") return json({ error: "unsupported_grant_type" }, 400);
-
-    const code = String(body.code ?? "");
-    const verifier = String(body.code_verifier ?? "");
-    if (!/^[A-Za-z0-9._~-]{43,128}$/.test(verifier)) return json({ error: "invalid_grant", error_description: "invalid code_verifier" }, 400);
-    return this.withOAuthLock(async () => {
-      const store = await this.oauthStore();
-      const record = store.codes[code];
-      if (!record) return json({ error: "invalid_grant" }, 400);
-      if (String(body.client_id ?? "") !== record.client_id || String(body.redirect_uri ?? "") !== record.redirect_uri) {
-        return json({ error: "invalid_grant", error_description: "client or redirect mismatch" }, 400);
-      }
-      if (String(body.resource ?? record.resource) !== record.resource) {
-        return json({ error: "invalid_target", error_description: "resource mismatch" }, 400);
-      }
-      if (!(await safeEqual(await pkceS256(verifier), record.code_challenge))) {
-        return json({ error: "invalid_grant", error_description: "invalid code_verifier" }, 400);
-      }
-
-      const tokenVersion = this.env.OAUTH_TOKEN_VERSION ?? "";
-      if (!tokenVersion) return json({ error: "server_error", error_description: "OAuth token version is not configured" }, 503);
-      delete store.codes[code];
-      const accessToken = randomToken("mcp_at");
-      store.tokens[`sha256:${await sha256Hex(accessToken)}`] = {
-        client_id: record.client_id,
-        account_id: record.account_id,
-        account_version: record.account_version,
-        role: record.role,
-        scope: record.scope,
-        resource: `${base}/mcp`,
-        version: tokenVersion,
-        expires_at: Math.floor(Date.now() / 1000) + TOKEN_TTL_SECONDS,
-      };
-      pruneClientRecordByExpiry(store.tokens, record.client_id, MAX_TOKENS_PER_CLIENT);
-      pruneRecordByExpiry(store.tokens, MAX_OAUTH_TOKENS);
-      await this.ctx.storage.put("oauth", store);
-      return json({ access_token: accessToken, token_type: "Bearer", expires_in: TOKEN_TTL_SECONDS, scope: record.scope });
+  private exchangeToken(request: Request, base: string): Promise<Response> {
+    return exchangeOAuthToken(request, base, {
+      storage: this.ctx.storage,
+      tokenVersion: this.env.OAUTH_TOKEN_VERSION ?? "",
+      serverName: SERVER_NAME,
+      loadOAuthStore: () => this.oauthStore(),
+      withLock: (callback) => this.withOAuthLock(callback),
     });
   }
 

package/src/worker/oauth-state.ts

@@ -1,6 +1,8 @@
 import { normalizeAccountRole, type AccountRole } from "./access";
 
 const OAUTH_STORE_SCHEMA_VERSION = 1;
+const OAUTH_REFRESH_STORE_SCHEMA_VERSION = 1;
+export const OFFLINE_ACCESS_SCOPE = "offline_access";
 const PASSWORD_TOKEN_PATTERN = /^[a-z][a-z0-9_]{2,31}_[A-Za-z0-9_-]{43}$/;
 
 export interface AccountRecord {
@@ -22,6 +24,7 @@ export interface OAuthClient {
   redirect_uris: string[];
   created_at: number;
   last_used_at: number;
+  has_been_authorized?: boolean;
   registration_identity?: string;
 }
 
@@ -48,6 +51,13 @@ export interface OAuthToken {
   expires_at: number;
 }
 
+export type OAuthRefreshToken = OAuthToken;
+
+export interface OAuthRefreshStore {
+  schema_version: number;
+  tokens: Record<string, OAuthRefreshToken>;
+}
+
 export interface OAuthFailure {
   count: number;
   window_started: number;
@@ -89,6 +99,13 @@ export function emptyOAuthStore(): OAuthStore {
   };
 }
 
+export function emptyOAuthRefreshStore(): OAuthRefreshStore {
+  return {
+    schema_version: OAUTH_REFRESH_STORE_SCHEMA_VERSION,
+    tokens: {},
+  };
+}
+
 export function isCurrentOAuthStore(value: unknown): value is OAuthStore {
   if (!value || typeof value !== "object" || Array.isArray(value)) return false;
   const store = value as Partial<OAuthStore>;
@@ -100,6 +117,24 @@ export function isCurrentOAuthStore(value: unknown): value is OAuthStore {
     && isRecord(store.auth_failures);
 }
 
+export function isCurrentOAuthRefreshStore(value: unknown): value is OAuthRefreshStore {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const store = value as Partial<OAuthRefreshStore>;
+  return store.schema_version === OAUTH_REFRESH_STORE_SCHEMA_VERSION && isRecord(store.tokens);
+}
+
+export function normalizeOAuthScope(value: unknown, serverName: string): string | null {
+  const raw = value === undefined ? serverName : String(value).trim();
+  if (!raw) return null;
+  const requested = raw.split(/\s+/);
+  const scopes = new Set(requested);
+  if (scopes.size !== requested.length || !scopes.has(serverName)) return null;
+  for (const scope of scopes) {
+    if (scope !== serverName && scope !== OFFLINE_ACCESS_SCOPE) return null;
+  }
+  return scopes.has(OFFLINE_ACCESS_SCOPE) ? `${serverName} ${OFFLINE_ACCESS_SCOPE}` : serverName;
+}
+
 export function validateAuthorizationRequest(
   body: Record<string, unknown>,
   base: string,
@@ -112,12 +147,12 @@ export function validateAuthorizationRequest(
   const codeChallenge = String(body.code_challenge ?? "");
   const codeChallengeMethod = String(body.code_challenge_method ?? "");
   const requestedResource = String(body.resource ?? `${base}/mcp`);
-  const scope = String(body.scope ?? serverName).trim();
+  const scope = normalizeOAuthScope(body.scope, serverName);
   const state = body.state === undefined ? "" : typeof body.state === "string" ? body.state : "";
 
   if (responseType !== "code") return { error: "response_type must be code.", status: 400 };
   if (requestedResource !== `${base}/mcp`) return { error: "resource mismatch.", status: 400 };
-  if (scope !== serverName) return { error: "unsupported scope.", status: 400 };
+  if (!scope) return { error: "unsupported scope.", status: 400 };
   if (body.state !== undefined && typeof body.state !== "string") return { error: "state must be a string.", status: 400 };
   if (state.length > 1024) return { error: "state is too long.", status: 400 };
   if (codeChallengeMethod !== "S256" || !/^[A-Za-z0-9_-]{43}$/.test(codeChallenge)) {