mcp-auth-server 0.0.0-stage → 0.1.0

package/lib/functions/server/authenticate.request.d.ts

@@ -0,0 +1,5 @@
+import type AuthenticateResultType from '../../types/authenticate.result.type';
+import type HttpRequestType from '../../types/http.request.type';
+import type McpAuthContextType from '../../types/mcp.auth.context.type';
+declare const authenticateRequest: <TUser>(context: McpAuthContextType<TUser>, headers: HttpRequestType["headers"], rpcBody?: unknown) => Promise<AuthenticateResultType<TUser>>;
+export default authenticateRequest;

package/lib/functions/server/authenticate.request.js

@@ -0,0 +1,24 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const header_value_1 = __importDefault(require("../http/header.value"));
+const text_value_1 = __importDefault(require("../http/text.value"));
+const verify_access_token_1 = __importDefault(require("../jwt/verify.access.token"));
+const challenge_response_1 = __importDefault(require("./challenge.response"));
+const authenticateRequest = async (context, headers, rpcBody) => {
+    const bearer = /^Bearer (\S+)$/i.exec((0, header_value_1.default)(headers, 'authorization') ?? '')?.[1];
+    if (!bearer)
+        return (0, challenge_response_1.default)(context, rpcBody, false, 'missing_token');
+    const verified = await (0, verify_access_token_1.default)(await context.getKeys(), bearer, context.issuer, context.options.resource, context.now());
+    if ('reason' in verified)
+        return (0, challenge_response_1.default)(context, rpcBody, true, verified.reason);
+    const subject = (0, text_value_1.default)(verified.claims.sub);
+    const user = subject ? await context.options.loadActiveUser(subject) : null;
+    if (!user)
+        return (0, challenge_response_1.default)(context, rpcBody, true, 'user_inactive');
+    return { user, claims: verified.claims };
+};
+exports.default = authenticateRequest;
+//# sourceMappingURL=authenticate.request.js.map

package/lib/functions/server/authenticate.request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticate.request.js","sourceRoot":"","sources":["../../../src/functions/server/authenticate.request.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAKb,wEAA+C;AAC/C,oEAA2C;AAC3C,qFAA2D;AAC3D,8EAAqD;AAErD,MAAM,mBAAmB,GAAG,KAAK,EAAS,OAAkC,EAAE,OAAmC,EAAE,OAAiB,EAA0C,EAAE;IAC/K,MAAM,MAAM,GAAuB,iBAAiB,CAAC,IAAI,CAAC,IAAA,sBAAW,EAAC,OAAO,EAAE,eAAe,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5G,IAAI,CAAC,MAAM;QAAE,OAAO,IAAA,4BAAiB,EAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;IAEhF,MAAM,QAAQ,GAAG,MAAM,IAAA,6BAAiB,EAAC,MAAM,OAAO,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACnI,IAAI,QAAQ,IAAI,QAAQ;QAAE,OAAO,IAAA,4BAAiB,EAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE5F,MAAM,OAAO,GAAuB,IAAA,oBAAS,EAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,IAAI,CAAC,IAAI;QAAE,OAAO,IAAA,4BAAiB,EAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;IAC7E,OAAO,EAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAC,CAAC;AACxC,CAAC,CAAC;AACF,kBAAe,mBAAmB,CAAC"}

package/lib/functions/server/awaiting.consent.d.ts

@@ -0,0 +1,5 @@
+import type HttpRequestType from '../../types/http.request.type';
+import type McpAuthContextType from '../../types/mcp.auth.context.type';
+import type PendingAuthorizationType from '../../types/pending.authorization.type';
+declare const awaitingConsent: (context: McpAuthContextType<any>, request: HttpRequestType, state: unknown) => Promise<PendingAuthorizationType | null>;
+export default awaitingConsent;

package/lib/functions/server/awaiting.consent.js

@@ -0,0 +1,18 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const text_value_1 = __importDefault(require("../http/text.value"));
+const awaitingConsent = async (context, request, state) => {
+    const stateId = (0, text_value_1.default)(state);
+    const pending = stateId ? await context.options.storage.getPendingAuthorization(stateId, context.now()) : null;
+    if (!pending?.userId)
+        return null;
+    const { upstream } = context.options;
+    if (upstream.verifyUser && !(await upstream.verifyUser(request, pending.userId)))
+        return null;
+    return pending;
+};
+exports.default = awaitingConsent;
+//# sourceMappingURL=awaiting.consent.js.map

package/lib/functions/server/awaiting.consent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"awaiting.consent.js","sourceRoot":"","sources":["../../../src/functions/server/awaiting.consent.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAKb,oEAA2C;AAE3C,MAAM,eAAe,GAAG,KAAK,EAAE,OAAgC,EAAE,OAAwB,EAAE,KAAc,EAA4C,EAAE;IACtJ,MAAM,OAAO,GAAuB,IAAA,oBAAS,EAAC,KAAK,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/G,IAAI,CAAC,OAAO,EAAE,MAAM;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,EAAC,QAAQ,EAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IACnC,IAAI,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9F,OAAO,OAAO,CAAC;AAChB,CAAC,CAAC;AACF,kBAAe,eAAe,CAAC"}

package/lib/functions/server/build.routes.d.ts

@@ -0,0 +1,4 @@
+import type McpAuthContextType from '../../types/mcp.auth.context.type';
+import type RouteType from '../../types/route.type';
+declare const buildRoutes: (context: McpAuthContextType<any>) => RouteType[];
+export default buildRoutes;

package/lib/functions/server/build.routes.js

@@ -0,0 +1,40 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const trim_trailing_slashes_1 = __importDefault(require("../http/trim.trailing.slashes"));
+const authorization_server_metadata_handler_1 = __importDefault(require("../../handlers/authorization.server.metadata.handler"));
+const authorize_handler_1 = __importDefault(require("../../handlers/authorize.handler"));
+const callback_handler_1 = __importDefault(require("../../handlers/callback.handler"));
+const consent_decision_handler_1 = __importDefault(require("../../handlers/consent.decision.handler"));
+const consent_page_handler_1 = __importDefault(require("../../handlers/consent.page.handler"));
+const protected_resource_metadata_handler_1 = __importDefault(require("../../handlers/protected.resource.metadata.handler"));
+const register_handler_1 = __importDefault(require("../../handlers/register.handler"));
+const resume_handler_1 = __importDefault(require("../../handlers/resume.handler"));
+const revoke_handler_1 = __importDefault(require("../../handlers/revoke.handler"));
+const token_handler_1 = __importDefault(require("../../handlers/token.handler"));
+const buildRoutes = (context) => {
+    const { basePath, callbackPath } = context;
+    const { upstream, resource } = context.options;
+    const resourcePath = (0, trim_trailing_slashes_1.default)(new URL(resource).pathname);
+    const withRequest = (handler) => (request) => handler(context, request);
+    const metadata = (path, handler) => ({ method: 'GET', path, name: 'metadata', handler });
+    const protectedResource = () => (0, protected_resource_metadata_handler_1.default)(context);
+    const authorizationServer = () => (0, authorization_server_metadata_handler_1.default)(context);
+    return [
+        metadata('/.well-known/oauth-protected-resource', protectedResource),
+        ...(resourcePath ? [metadata(`/.well-known/oauth-protected-resource${resourcePath}`, protectedResource)] : []),
+        ...['/.well-known/oauth-authorization-server', '/.well-known/openid-configuration'].flatMap((path) => [...new Set([path, `${path}${basePath}`, `${basePath}${path}`])].map((full) => metadata(full, authorizationServer))),
+        ...(context.registrationEnabled ? [{ method: 'POST', path: `${basePath}/register`, name: 'register', handler: withRequest(register_handler_1.default) }] : []),
+        { method: 'GET', path: `${basePath}/authorize`, name: 'authorize', handler: withRequest(authorize_handler_1.default) },
+        ...(upstream.callback ? [{ method: 'GET', path: `${basePath}${callbackPath}`, name: 'callback', handler: withRequest(callback_handler_1.default) }] : []),
+        ...(upstream.resume ? [{ method: 'GET', path: `${basePath}/oauth/resume`, name: 'resume', handler: withRequest(resume_handler_1.default) }] : []),
+        { method: 'GET', path: `${basePath}/oauth/consent`, name: 'consent', handler: withRequest(consent_page_handler_1.default) },
+        { method: 'POST', path: `${basePath}/oauth/consent`, name: 'consent', handler: withRequest(consent_decision_handler_1.default) },
+        { method: 'POST', path: `${basePath}/token`, name: 'token', handler: withRequest(token_handler_1.default) },
+        { method: 'POST', path: `${basePath}/revoke`, name: 'revoke', handler: withRequest(revoke_handler_1.default) }
+    ];
+};
+exports.default = buildRoutes;
+//# sourceMappingURL=build.routes.js.map

package/lib/functions/server/build.routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.routes.js","sourceRoot":"","sources":["../../../src/functions/server/build.routes.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAEb,0FAAgE;AAChE,iIAAsG;AACtG,yFAAgE;AAChE,uFAA8D;AAC9D,uGAA6E;AAC7E,+FAAqE;AACrE,6HAAkG;AAClG,uFAA8D;AAC9D,mFAA0D;AAC1D,mFAA0D;AAC1D,iFAAwD;AAKxD,MAAM,WAAW,GAAG,CAAC,OAAgC,EAAe,EAAE;IACrE,MAAM,EAAC,QAAQ,EAAE,YAAY,EAAC,GAAG,OAAO,CAAC;IACzC,MAAM,EAAC,QAAQ,EAAE,QAAQ,EAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAC7C,MAAM,YAAY,GAAW,IAAA,+BAAmB,EAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC7E,MAAM,WAAW,GAChB,CAAC,OAAyG,EAAwB,EAAE,CACpI,CAAC,OAAO,EAAE,EAAE,CACX,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5B,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,OAA6B,EAAa,EAAE,CAAC,CAAC,EAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAC,CAAC,CAAC;IAChI,MAAM,iBAAiB,GAAyB,GAAG,EAAE,CAAC,IAAA,6CAAgC,EAAC,OAAO,CAAC,CAAC;IAChG,MAAM,mBAAmB,GAAyB,GAAG,EAAE,CAAC,IAAA,+CAAkC,EAAC,OAAO,CAAC,CAAC;IAEpG,OAAO;QACN,QAAQ,CAAC,uCAAuC,EAAE,iBAAiB,CAAC;QACpE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,wCAAwC,YAAY,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9G,GAAG,CAAC,yCAAyC,EAAE,mCAAmC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAY,EAAe,EAAE,CACzH,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI,GAAG,QAAQ,EAAE,EAAE,GAAG,QAAQ,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAY,EAAa,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC,CACtI;QACD,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,CAAC,0BAAe,CAAC,EAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9J,EAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,QAAQ,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,CAAC,2BAAgB,CAAC,EAAC;QACzG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,QAAQ,GAAG,YAAY,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,CAAC,0BAAe,CAAC,EAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzJ,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,QAAQ,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAC,wBAAa,CAAC,EAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjJ,EAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,QAAQ,gBAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC,8BAAkB,CAAC,EAAC;QAC7G,EAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,gBAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC,kCAAsB,CAAC,EAAC;QAClH,EAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,uBAAY,CAAC,EAAC;QAC9F,EAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAC,wBAAa,CAAC,EAAC;KACjG,CAAC;AACH,CAAC,CAAC;AACF,kBAAe,WAAW,CAAC"}

package/lib/functions/server/build.upstream.context.d.ts

@@ -0,0 +1,6 @@
+import type HttpRequestType from '../../types/http.request.type';
+import type McpAuthContextType from '../../types/mcp.auth.context.type';
+import type PendingAuthorizationType from '../../types/pending.authorization.type';
+import type UpstreamContextType from '../../types/upstream.context.type';
+declare const buildUpstreamContext: (context: McpAuthContextType<any>, request: HttpRequestType, pending: PendingAuthorizationType) => UpstreamContextType;
+export default buildUpstreamContext;

package/lib/functions/server/build.upstream.context.js

@@ -0,0 +1,11 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+const buildUpstreamContext = (context, request, pending) => ({
+    request,
+    pending,
+    issuer: context.issuer,
+    callbackUrl: `${context.issuer}${context.callbackPath}`,
+    resumeUrl: `${context.issuer}/oauth/resume?state=${encodeURIComponent(pending.stateId)}`
+});
+exports.default = buildUpstreamContext;
+//# sourceMappingURL=build.upstream.context.js.map

package/lib/functions/server/build.upstream.context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.upstream.context.js","sourceRoot":"","sources":["../../../src/functions/server/build.upstream.context.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAOb,MAAM,oBAAoB,GAAG,CAAC,OAAgC,EAAE,OAAwB,EAAE,OAAiC,EAAuB,EAAE,CAAC,CAAC;IACrJ,OAAO;IACP,OAAO;IACP,MAAM,EAAE,OAAO,CAAC,MAAM;IACtB,WAAW,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE;IACvD,SAAS,EAAE,GAAG,OAAO,CAAC,MAAM,uBAAuB,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;CACxF,CAAC,CAAC;AACH,kBAAe,oBAAoB,CAAC"}

package/lib/functions/server/challenge.response.d.ts

@@ -0,0 +1,4 @@
+import type AuthenticateResultType from '../../types/authenticate.result.type';
+import type McpAuthContextType from '../../types/mcp.auth.context.type';
+declare const challengeResponse: (context: McpAuthContextType<any>, rpcBody: unknown, tokenSent: boolean, reason: string) => AuthenticateResultType<any>;
+export default challengeResponse;

package/lib/functions/server/challenge.response.js

@@ -0,0 +1,14 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+const challengeResponse = (context, rpcBody, tokenSent, reason) => {
+    const metadata = `resource_metadata="${context.resourceMetadataUrl}"`;
+    const id = rpcBody && 'object' === typeof rpcBody && !Array.isArray(rpcBody) ? (rpcBody.id ?? null) : null;
+    return {
+        status: 401,
+        reason,
+        headers: { 'www-authenticate': tokenSent ? `Bearer error="invalid_token", ${metadata}` : `Bearer ${metadata}`, 'content-type': 'application/json' },
+        body: { jsonrpc: '2.0', id, error: { code: -32000, message: 'Authentication Required' } }
+    };
+};
+exports.default = challengeResponse;
+//# sourceMappingURL=challenge.response.js.map

package/lib/functions/server/challenge.response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge.response.js","sourceRoot":"","sources":["../../../src/functions/server/challenge.response.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAKb,MAAM,iBAAiB,GAAG,CAAC,OAAgC,EAAE,OAAgB,EAAE,SAAkB,EAAE,MAAc,EAA+B,EAAE;IACjJ,MAAM,QAAQ,GAAW,sBAAsB,OAAO,CAAC,mBAAmB,GAAG,CAAC;IAC9E,MAAM,EAAE,GAAY,OAAO,IAAI,QAAQ,KAAK,OAAO,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAE,OAA0B,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxI,OAAO;QACN,MAAM,EAAE,GAAG;QACX,MAAM;QACN,OAAO,EAAE,EAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC,CAAC,iCAAiC,QAAQ,EAAE,CAAC,CAAC,CAAC,UAAU,QAAQ,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAC;QACjJ,IAAI,EAAE,EAAC,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAC,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,yBAAyB,EAAC,EAAC;KACrF,CAAC;AACH,CAAC,CAAC;AACF,kBAAe,iBAAiB,CAAC"}

package/lib/functions/server/continue.with.user.d.ts

@@ -0,0 +1,5 @@
+import type HttpResponseType from '../../types/http.response.type';
+import type McpAuthContextType from '../../types/mcp.auth.context.type';
+import type PendingAuthorizationType from '../../types/pending.authorization.type';
+declare const continueWithUser: (context: McpAuthContextType<any>, pending: PendingAuthorizationType) => Promise<HttpResponseType>;
+export default continueWithUser;

package/lib/functions/server/continue.with.user.js

@@ -0,0 +1,18 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const plain_error_response_1 = __importDefault(require("../http/plain.error.response"));
+const redirect_response_1 = __importDefault(require("../http/redirect.response"));
+const issue_authorization_code_1 = __importDefault(require("./issue.authorization.code"));
+const continueWithUser = async (context, pending) => {
+    const { storage } = context.options;
+    if (!(await storage.hasConsent(pending.clientId, pending.userId))) {
+        return (0, redirect_response_1.default)(`${context.issuer}/oauth/consent?state=${encodeURIComponent(pending.stateId)}`);
+    }
+    const taken = await storage.takePendingAuthorization(pending.stateId, { now: context.now(), hasUser: true });
+    return taken ? (0, issue_authorization_code_1.default)(context, taken) : (0, plain_error_response_1.default)(400, 'Invalid or expired authorization request');
+};
+exports.default = continueWithUser;
+//# sourceMappingURL=continue.with.user.js.map

package/lib/functions/server/continue.with.user.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"continue.with.user.js","sourceRoot":"","sources":["../../../src/functions/server/continue.with.user.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAKb,wFAA8D;AAC9D,kFAAyD;AACzD,0FAAgE;AAEhE,MAAM,gBAAgB,GAAG,KAAK,EAAE,OAAgC,EAAE,OAAiC,EAA6B,EAAE;IACjI,MAAM,EAAC,OAAO,EAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAClC,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAgB,CAAC,CAAC,EAAE,CAAC;QAC7E,OAAO,IAAA,2BAAgB,EAAC,GAAG,OAAO,CAAC,MAAM,wBAAwB,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,wBAAwB,CAAC,OAAO,CAAC,OAAO,EAAE,EAAC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAC,CAAC,CAAC;IAC3G,OAAO,KAAK,CAAC,CAAC,CAAC,IAAA,kCAAsB,EAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAA,8BAAkB,EAAC,GAAG,EAAE,0CAA0C,CAAC,CAAC;AAC7H,CAAC,CAAC;AACF,kBAAe,gBAAgB,CAAC"}

package/lib/functions/server/create.client.resolver.d.ts

@@ -0,0 +1,6 @@
+import type McpAuthOptionsType from '../../types/mcp.auth.options.type';
+import type ResolvedClientType from '../../types/resolved.client.type';
+declare const createClientResolver: (options: McpAuthOptionsType<any>, now: () => Date, cimdEnabled: boolean) => ((clientId: string) => Promise<ResolvedClientType | {
+    error: string;
+}>);
+export default createClientResolver;

package/lib/functions/server/create.client.resolver.js

@@ -0,0 +1,26 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const lru_metadata_cache_1 = __importDefault(require("../../cache/lru.metadata.cache"));
+const create_metadata_resolver_1 = __importDefault(require("../cimd/create.metadata.resolver"));
+const is_metadata_client_id_1 = __importDefault(require("../cimd/is.metadata.client.id"));
+const createClientResolver = (options, now, cimdEnabled) => {
+    const cache = options.cimd?.cache ?? new lru_metadata_cache_1.default(500, () => now().getTime());
+    const resolveMetadata = (0, create_metadata_resolver_1.default)(options.cimd ?? {}, cache);
+    return async (clientId) => {
+        if (cimdEnabled && (0, is_metadata_client_id_1.default)(clientId)) {
+            const resolution = await resolveMetadata(clientId);
+            if (!resolution.ok) {
+                options.logger?.info?.('MCP client metadata rejected', { clientId, reason: resolution.reason });
+                return { error: 'client metadata document is invalid or unreachable' };
+            }
+            return { clientId, clientName: resolution.metadata.client_name.slice(0, 200), redirectUris: resolution.metadata.redirect_uris, metadataDocument: true };
+        }
+        const client = await options.storage.getClient(clientId);
+        return client ? { clientId, clientName: client.clientName, redirectUris: client.redirectUris, metadataDocument: false } : { error: 'unknown client_id' };
+    };
+};
+exports.default = createClientResolver;
+//# sourceMappingURL=create.client.resolver.js.map

package/lib/functions/server/create.client.resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create.client.resolver.js","sourceRoot":"","sources":["../../../src/functions/server/create.client.resolver.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAEb,wFAA8D;AAG9D,gGAAsE;AACtE,0FAA+D;AAE/D,MAAM,oBAAoB,GAAG,CAAC,OAAgC,EAAE,GAAe,EAAE,WAAoB,EAAyE,EAAE;IAC/K,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,4BAAgB,CAAC,GAAG,EAAE,GAAW,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9F,MAAM,eAAe,GAAG,IAAA,kCAAsB,EAAC,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;IAE1E,OAAO,KAAK,EAAE,QAAgB,EAAiD,EAAE;QAChF,IAAI,WAAW,IAAI,IAAA,+BAAkB,EAAC,QAAQ,CAAC,EAAE,CAAC;YACjD,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;YACnD,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;gBACpB,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,8BAA8B,EAAE,EAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAC,CAAC,CAAC;gBAC9F,OAAO,EAAC,KAAK,EAAE,oDAAoD,EAAC,CAAC;YACtE,CAAC;YACD,OAAO,EAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,QAAQ,CAAC,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAC,CAAC;QACvJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC,CAAC,CAAC,EAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,gBAAgB,EAAE,KAAK,EAAC,CAAC,CAAC,CAAC,EAAC,KAAK,EAAE,mBAAmB,EAAC,CAAC;IACtJ,CAAC,CAAC;AACH,CAAC,CAAC;AACF,kBAAe,oBAAoB,CAAC"}

package/lib/functions/server/create.mcp.auth.context.d.ts

@@ -0,0 +1,4 @@
+import type McpAuthContextType from '../../types/mcp.auth.context.type';
+import type McpAuthOptionsType from '../../types/mcp.auth.options.type';
+declare const createMcpAuthContext: <TUser>(options: McpAuthOptionsType<TUser>) => McpAuthContextType<TUser>;
+export default createMcpAuthContext;

package/lib/functions/server/create.mcp.auth.context.js

@@ -0,0 +1,38 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const trim_trailing_slashes_1 = __importDefault(require("../http/trim.trailing.slashes"));
+const render_default_consent_1 = __importDefault(require("../consent/render.default.consent"));
+const resolve_key_pair_1 = __importDefault(require("../keys/resolve.key.pair"));
+const create_client_resolver_1 = __importDefault(require("./create.client.resolver"));
+const createMcpAuthContext = (options) => {
+    const issuer = (0, trim_trailing_slashes_1.default)(options.issuer);
+    const now = options.now ?? (() => new Date());
+    const cimdEnabled = options.cimd?.enabled ?? true;
+    let keys;
+    return {
+        options,
+        issuer,
+        basePath: (0, trim_trailing_slashes_1.default)(new URL(issuer).pathname),
+        callbackPath: options.callbackPath ?? '/oauth/callback',
+        productName: options.productName ?? 'MCP server',
+        redirectPolicy: { httpsHosts: options.redirects?.httpsHosts ?? [], customSchemes: options.redirects?.customSchemes ?? [] },
+        ttl: {
+            accessToken: options.ttl?.accessToken ?? 3600,
+            refreshToken: options.ttl?.refreshToken ?? 2592000,
+            pending: options.ttl?.pending ?? 600,
+            code: options.ttl?.code ?? 60
+        },
+        now,
+        registrationEnabled: options.registration?.enabled ?? true,
+        cimdEnabled,
+        renderConsent: options.renderConsent ?? render_default_consent_1.default,
+        resourceMetadataUrl: `${issuer}/.well-known/oauth-protected-resource`,
+        getKeys: () => (keys ??= (0, resolve_key_pair_1.default)(options.signingKey, options.verificationKey)),
+        resolveClient: (0, create_client_resolver_1.default)(options, now, cimdEnabled)
+    };
+};
+exports.default = createMcpAuthContext;
+//# sourceMappingURL=create.mcp.auth.context.js.map

package/lib/functions/server/create.mcp.auth.context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create.mcp.auth.context.js","sourceRoot":"","sources":["../../../src/functions/server/create.mcp.auth.context.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAEb,0FAAgE;AAGhE,+FAAqE;AACrE,gFAAsD;AACtD,sFAA4D;AAE5D,MAAM,oBAAoB,GAAG,CAAQ,OAAkC,EAA6B,EAAE;IACrG,MAAM,MAAM,GAAW,IAAA,+BAAmB,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAe,OAAO,CAAC,GAAG,IAAI,CAAC,GAAS,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAChE,MAAM,WAAW,GAAY,OAAO,CAAC,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC;IAC3D,IAAI,IAAmD,CAAC;IAExD,OAAO;QACN,OAAO;QACP,MAAM;QACN,QAAQ,EAAE,IAAA,+BAAmB,EAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;QACvD,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,iBAAiB;QACvD,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,YAAY;QAChD,cAAc,EAAE,EAAC,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE,UAAU,IAAI,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,SAAS,EAAE,aAAa,IAAI,EAAE,EAAC;QACxH,GAAG,EAAE;YACJ,WAAW,EAAE,OAAO,CAAC,GAAG,EAAE,WAAW,IAAI,IAAI;YAC7C,YAAY,EAAE,OAAO,CAAC,GAAG,EAAE,YAAY,IAAI,OAAO;YAClD,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,IAAI,GAAG;YACpC,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE;SAC7B;QACD,GAAG;QACH,mBAAmB,EAAE,OAAO,CAAC,YAAY,EAAE,OAAO,IAAI,IAAI;QAC1D,WAAW;QACX,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,gCAAoB;QAC5D,mBAAmB,EAAE,GAAG,MAAM,uCAAuC;QACrE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,KAAK,IAAA,0BAAc,EAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;QACrF,aAAa,EAAE,IAAA,gCAAoB,EAAC,OAAO,EAAE,GAAG,EAAE,WAAW,CAAC;KAC9D,CAAC;AACH,CAAC,CAAC;AACF,kBAAe,oBAAoB,CAAC"}

package/lib/functions/server/create.mcp.auth.d.ts

@@ -0,0 +1,4 @@
+import type McpAuthOptionsType from '../../types/mcp.auth.options.type';
+import type McpAuthType from '../../types/mcp.auth.type';
+declare const createMcpAuth: <TUser = unknown>(options: McpAuthOptionsType<TUser>) => McpAuthType<TUser>;
+export default createMcpAuth;

package/lib/functions/server/create.mcp.auth.js

@@ -0,0 +1,25 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const authenticate_request_1 = __importDefault(require("./authenticate.request"));
+const build_routes_1 = __importDefault(require("./build.routes"));
+const create_mcp_auth_context_1 = __importDefault(require("./create.mcp.auth.context"));
+const find_route_1 = __importDefault(require("./find.route"));
+const handle_request_1 = __importDefault(require("./handle.request"));
+const createMcpAuth = (options) => {
+    const context = (0, create_mcp_auth_context_1.default)(options);
+    const routes = (0, build_routes_1.default)(context);
+    return {
+        issuer: context.issuer,
+        resource: options.resource,
+        routes,
+        hasRoute: (request) => !!(0, find_route_1.default)(routes, request),
+        handle: (request) => (0, handle_request_1.default)(context, routes, request),
+        authenticate: (headers, rpcBody) => (0, authenticate_request_1.default)(context, headers, rpcBody),
+        deleteExpired: () => options.storage.deleteExpired(context.now())
+    };
+};
+exports.default = createMcpAuth;
+//# sourceMappingURL=create.mcp.auth.js.map

package/lib/functions/server/create.mcp.auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create.mcp.auth.js","sourceRoot":"","sources":["../../../src/functions/server/create.mcp.auth.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAKb,kFAAyD;AACzD,kEAAyC;AACzC,wFAA6D;AAC7D,8DAAqC;AACrC,sEAA6C;AAE7C,MAAM,aAAa,GAAG,CAAkB,OAAkC,EAAsB,EAAE;IACjG,MAAM,OAAO,GAAG,IAAA,iCAAoB,EAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAA,sBAAW,EAAC,OAAO,CAAC,CAAC;IAEpC,OAAO;QACN,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,MAAM;QACN,QAAQ,EAAE,CAAC,OAAwB,EAAW,EAAE,CAAC,CAAC,CAAC,IAAA,oBAAS,EAAC,MAAM,EAAE,OAAO,CAAC;QAC7E,MAAM,EAAE,CAAC,OAAwB,EAAE,EAAE,CAAC,IAAA,wBAAa,EAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;QAC7E,YAAY,EAAE,CAAC,OAAmC,EAAE,OAAiB,EAAE,EAAE,CAAC,IAAA,8BAAmB,EAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;QACxH,aAAa,EAAE,GAAkB,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;KAChF,CAAC;AACH,CAAC,CAAC;AACF,kBAAe,aAAa,CAAC"}

package/lib/functions/server/deny.authorization.d.ts

@@ -0,0 +1,5 @@
+import type HttpResponseType from '../../types/http.response.type';
+import type McpAuthContextType from '../../types/mcp.auth.context.type';
+import type PendingAuthorizationType from '../../types/pending.authorization.type';
+declare const denyAuthorization: (context: McpAuthContextType<any>, pending: PendingAuthorizationType, description?: string) => Promise<HttpResponseType>;
+export default denyAuthorization;

package/lib/functions/server/deny.authorization.js

@@ -0,0 +1,13 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const redirect_response_1 = __importDefault(require("../http/redirect.response"));
+const build_error_redirect_1 = __importDefault(require("../redirect/build.error.redirect"));
+const denyAuthorization = async (context, pending, description = 'sign-in failed') => {
+    await context.options.storage.deletePendingAuthorization(pending.stateId);
+    return (0, redirect_response_1.default)((0, build_error_redirect_1.default)(pending.redirectUri, context.issuer, 'access_denied', description, pending.clientState));
+};
+exports.default = denyAuthorization;
+//# sourceMappingURL=deny.authorization.js.map

package/lib/functions/server/deny.authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deny.authorization.js","sourceRoot":"","sources":["../../../src/functions/server/deny.authorization.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAKb,kFAAyD;AACzD,4FAAkE;AAElE,MAAM,iBAAiB,GAAG,KAAK,EAAE,OAAgC,EAAE,OAAiC,EAAE,cAAsB,gBAAgB,EAA6B,EAAE;IAC1K,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,0BAA0B,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1E,OAAO,IAAA,2BAAgB,EAAC,IAAA,8BAAkB,EAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;AACrI,CAAC,CAAC;AACF,kBAAe,iBAAiB,CAAC"}

package/lib/functions/server/exchange.authorization.code.d.ts

@@ -0,0 +1,4 @@
+import type HttpResponseType from '../../types/http.response.type';
+import type McpAuthContextType from '../../types/mcp.auth.context.type';
+declare const exchangeAuthorizationCode: (context: McpAuthContextType<any>, params: Record<string, unknown>) => Promise<HttpResponseType>;
+export default exchangeAuthorizationCode;

package/lib/functions/server/exchange.authorization.code.js

@@ -0,0 +1,32 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const random_id_1 = __importDefault(require("../crypto/random.id"));
+const sha256_base64_url_1 = __importDefault(require("../crypto/sha256.base64.url"));
+const sha256_hex_1 = __importDefault(require("../crypto/sha256.hex"));
+const text_value_1 = __importDefault(require("../http/text.value"));
+const issue_tokens_1 = __importDefault(require("./issue.tokens"));
+const token_failure_1 = __importDefault(require("./token.failure"));
+const codeVerifierPattern = /^[A-Za-z0-9\-._~]{43,128}$/;
+const exchangeAuthorizationCode = async (context, params) => {
+    const [code, clientId, redirectUri, codeVerifier, resource] = ['code', 'client_id', 'redirect_uri', 'code_verifier', 'resource'].map((name) => (0, text_value_1.default)(params[name]));
+    if (!code || !clientId || !redirectUri || !codeVerifier)
+        return (0, token_failure_1.default)('invalid_request', 'code, client_id, redirect_uri and code_verifier are required');
+    if (!codeVerifierPattern.test(codeVerifier))
+        return (0, token_failure_1.default)('invalid_grant', 'code_verifier is malformed');
+    const claimedAt = context.now();
+    const stored = await context.options.storage.claimAuthorizationCode(await (0, sha256_hex_1.default)(code), claimedAt);
+    if (!stored)
+        return (0, token_failure_1.default)('invalid_grant', 'authorization code is invalid, expired or already used');
+    if (stored.clientId !== clientId ||
+        stored.redirectUri !== redirectUri ||
+        stored.codeChallenge !== (await (0, sha256_base64_url_1.default)(codeVerifier)) ||
+        (resource && stored.resource !== resource)) {
+        return (0, token_failure_1.default)('invalid_grant', 'authorization code does not match the request');
+    }
+    return (0, issue_tokens_1.default)(context, clientId, stored.userId, (0, random_id_1.default)(), new Date(claimedAt.getTime() + context.ttl.refreshToken * 1000));
+};
+exports.default = exchangeAuthorizationCode;
+//# sourceMappingURL=exchange.authorization.code.js.map

package/lib/functions/server/exchange.authorization.code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exchange.authorization.code.js","sourceRoot":"","sources":["../../../src/functions/server/exchange.authorization.code.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAIb,oEAA2C;AAC3C,oFAA0D;AAC1D,sEAA6C;AAC7C,oEAA2C;AAC3C,kEAAyC;AACzC,oEAA2C;AAE3C,MAAM,mBAAmB,GAAW,4BAA4B,CAAC;AAEjE,MAAM,yBAAyB,GAAG,KAAK,EAAE,OAAgC,EAAE,MAA+B,EAA6B,EAAE;IACxI,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,IAAY,EAAsB,EAAE,CACzK,IAAA,oBAAS,EAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CACvB,CAAC;IACF,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,IAAI,CAAC,YAAY;QAAE,OAAO,IAAA,uBAAY,EAAC,iBAAiB,EAAE,8DAA8D,CAAC,CAAC;IAChK,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,YAAY,CAAC;QAAE,OAAO,IAAA,uBAAY,EAAC,eAAe,EAAE,4BAA4B,CAAC,CAAC;IAEhH,MAAM,SAAS,GAAS,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,MAAM,IAAA,oBAAS,EAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;IACtG,IAAI,CAAC,MAAM;QAAE,OAAO,IAAA,uBAAY,EAAC,eAAe,EAAE,wDAAwD,CAAC,CAAC;IAE5G,IACC,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAC5B,MAAM,CAAC,WAAW,KAAK,WAAW;QAClC,MAAM,CAAC,aAAa,KAAK,CAAC,MAAM,IAAA,2BAAe,EAAC,YAAY,CAAC,CAAC;QAC9D,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,EACzC,CAAC;QACF,OAAO,IAAA,uBAAY,EAAC,eAAe,EAAE,+CAA+C,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,IAAA,sBAAW,EAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAA,mBAAQ,GAAE,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC;AACnI,CAAC,CAAC;AACF,kBAAe,yBAAyB,CAAC"}

package/lib/functions/server/find.route.d.ts

@@ -0,0 +1,4 @@
+import type HttpRequestType from '../../types/http.request.type';
+import type RouteType from '../../types/route.type';
+declare const findRoute: (routes: RouteType[], request: HttpRequestType) => RouteType | undefined;
+export default findRoute;

package/lib/functions/server/find.route.js

@@ -0,0 +1,5 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+const findRoute = (routes, request) => routes.find((route) => route.method === request.method.toUpperCase() && route.path === request.path);
+exports.default = findRoute;
+//# sourceMappingURL=find.route.js.map

package/lib/functions/server/find.route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"find.route.js","sourceRoot":"","sources":["../../../src/functions/server/find.route.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAKb,MAAM,SAAS,GAAG,CAAC,MAAmB,EAAE,OAAwB,EAAyB,EAAE,CAC1F,MAAM,CAAC,IAAI,CAAC,CAAC,KAAgB,EAAW,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAC1H,kBAAe,SAAS,CAAC"}

package/lib/functions/server/handle.request.d.ts

@@ -0,0 +1,6 @@
+import type HttpRequestType from '../../types/http.request.type';
+import type HttpResponseType from '../../types/http.response.type';
+import type McpAuthContextType from '../../types/mcp.auth.context.type';
+import type RouteType from '../../types/route.type';
+declare const handleRequest: (context: McpAuthContextType<any>, routes: RouteType[], request: HttpRequestType) => Promise<HttpResponseType>;
+export default handleRequest;

package/lib/functions/server/handle.request.js

@@ -0,0 +1,21 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const json_response_1 = __importDefault(require("../http/json.response"));
+const oauth_error_response_1 = __importDefault(require("../http/oauth.error.response"));
+const find_route_1 = __importDefault(require("./find.route"));
+const limited = ['register', 'token', 'revoke'];
+const handleRequest = async (context, routes, request) => {
+    const route = (0, find_route_1.default)(routes, request);
+    if (!route)
+        return (0, json_response_1.default)(404, { error: 'not_found' });
+    const { rateLimit } = context.options;
+    if (rateLimit && limited.includes(route.name) && !(await rateLimit(request.ip ?? 'unknown', route.name))) {
+        return (0, oauth_error_response_1.default)(429, 'rate_limited', 'too many requests', { 'retry-after': '60' });
+    }
+    return route.handler(request);
+};
+exports.default = handleRequest;
+//# sourceMappingURL=handle.request.js.map

package/lib/functions/server/handle.request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handle.request.js","sourceRoot":"","sources":["../../../src/functions/server/handle.request.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAOb,0EAAiD;AACjD,wFAA8D;AAC9D,8DAAqC;AAErC,MAAM,OAAO,GAAoB,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;AAEjE,MAAM,aAAa,GAAG,KAAK,EAAE,OAAgC,EAAE,MAAmB,EAAE,OAAwB,EAA6B,EAAE;IAC1I,MAAM,KAAK,GAA0B,IAAA,oBAAS,EAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAA,uBAAY,EAAC,GAAG,EAAE,EAAC,KAAK,EAAE,WAAW,EAAC,CAAC,CAAC;IAC3D,MAAM,EAAC,SAAS,EAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IACpC,IAAI,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,EAAE,IAAI,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC1G,OAAO,IAAA,8BAAkB,EAAC,GAAG,EAAE,cAAc,EAAE,mBAAmB,EAAE,EAAC,aAAa,EAAE,IAAI,EAAC,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC,CAAC;AACF,kBAAe,aAAa,CAAC"}

package/lib/functions/server/has.credentials.d.ts

@@ -0,0 +1,3 @@
+import type HttpRequestType from '../../types/http.request.type';
+declare const hasCredentials: (request: HttpRequestType, params: Record<string, unknown>) => boolean;
+export default hasCredentials;

package/lib/functions/server/has.credentials.js

@@ -0,0 +1,9 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const header_value_1 = __importDefault(require("../http/header.value"));
+const hasCredentials = (request, params) => undefined !== params.client_secret || !!(0, header_value_1.default)(request.headers, 'authorization');
+exports.default = hasCredentials;
+//# sourceMappingURL=has.credentials.js.map

package/lib/functions/server/has.credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"has.credentials.js","sourceRoot":"","sources":["../../../src/functions/server/has.credentials.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAGb,wEAA+C;AAE/C,MAAM,cAAc,GAAG,CAAC,OAAwB,EAAE,MAA+B,EAAW,EAAE,CAC7F,SAAS,KAAK,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC,IAAA,sBAAW,EAAC,OAAO,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;AACvF,kBAAe,cAAc,CAAC"}

package/lib/functions/server/issue.authorization.code.d.ts

@@ -0,0 +1,5 @@
+import type HttpResponseType from '../../types/http.response.type';
+import type McpAuthContextType from '../../types/mcp.auth.context.type';
+import type PendingAuthorizationType from '../../types/pending.authorization.type';
+declare const issueAuthorizationCode: (context: McpAuthContextType<any>, pending: PendingAuthorizationType) => Promise<HttpResponseType>;
+export default issueAuthorizationCode;

package/lib/functions/server/issue.authorization.code.js

@@ -0,0 +1,24 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const random_token_1 = __importDefault(require("../crypto/random.token"));
+const sha256_hex_1 = __importDefault(require("../crypto/sha256.hex"));
+const build_redirect_1 = __importDefault(require("../redirect/build.redirect"));
+const redirect_response_1 = __importDefault(require("../http/redirect.response"));
+const issueAuthorizationCode = async (context, pending) => {
+    const code = (0, random_token_1.default)(32);
+    await context.options.storage.saveAuthorizationCode({
+        codeHash: await (0, sha256_hex_1.default)(code),
+        clientId: pending.clientId,
+        redirectUri: pending.redirectUri,
+        codeChallenge: pending.codeChallenge,
+        resource: pending.resource,
+        userId: pending.userId,
+        expiresAt: new Date(context.now().getTime() + context.ttl.code * 1000)
+    });
+    return (0, redirect_response_1.default)((0, build_redirect_1.default)(pending.redirectUri, context.issuer, { code, state: pending.clientState }));
+};
+exports.default = issueAuthorizationCode;
+//# sourceMappingURL=issue.authorization.code.js.map

package/lib/functions/server/issue.authorization.code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issue.authorization.code.js","sourceRoot":"","sources":["../../../src/functions/server/issue.authorization.code.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAKb,0EAAiD;AACjD,sEAA6C;AAC7C,gFAAuD;AACvD,kFAAyD;AAEzD,MAAM,sBAAsB,GAAG,KAAK,EAAE,OAAgC,EAAE,OAAiC,EAA6B,EAAE;IACvI,MAAM,IAAI,GAAW,IAAA,sBAAW,EAAC,EAAE,CAAC,CAAC;IACrC,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC;QACnD,QAAQ,EAAE,MAAM,IAAA,oBAAS,EAAC,IAAI,CAAC;QAC/B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,MAAM,EAAE,OAAO,CAAC,MAAgB;QAChC,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;KACtE,CAAC,CAAC;IACH,OAAO,IAAA,2BAAgB,EAAC,IAAA,wBAAa,EAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,EAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,WAAW,EAAC,CAAC,CAAC,CAAC;AACjH,CAAC,CAAC;AACF,kBAAe,sBAAsB,CAAC"}

package/lib/functions/server/issue.tokens.d.ts

@@ -0,0 +1,4 @@
+import type HttpResponseType from '../../types/http.response.type';
+import type McpAuthContextType from '../../types/mcp.auth.context.type';
+declare const issueTokens: (context: McpAuthContextType<any>, clientId: string, userId: string, familyId: string, expiresAt: Date, parentHash?: string) => Promise<HttpResponseType>;
+export default issueTokens;

package/lib/functions/server/issue.tokens.js

@@ -0,0 +1,30 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const random_token_1 = __importDefault(require("../crypto/random.token"));
+const sha256_hex_1 = __importDefault(require("../crypto/sha256.hex"));
+const json_response_1 = __importDefault(require("../http/json.response"));
+const sign_access_token_1 = __importDefault(require("../jwt/sign.access.token"));
+const token_failure_1 = __importDefault(require("./token.failure"));
+const issueTokens = async (context, clientId, userId, familyId, expiresAt, parentHash) => {
+    const { storage, resource } = context.options;
+    const refreshToken = (0, random_token_1.default)(32);
+    await storage.saveRefreshToken({ tokenHash: await (0, sha256_hex_1.default)(refreshToken), familyId, clientId, userId, resource, expiresAt });
+    if (parentHash && (await storage.findRefreshToken(parentHash))?.revokedAt) {
+        await storage.revokeRefreshTokenFamily(familyId, context.now());
+        return (0, token_failure_1.default)('invalid_grant', 'refresh token was revoked during rotation');
+    }
+    const accessToken = await (0, sign_access_token_1.default)(await context.getKeys(), {
+        issuer: context.issuer,
+        resource,
+        userId,
+        clientId,
+        ttlSeconds: context.ttl.accessToken,
+        now: context.now()
+    });
+    return (0, json_response_1.default)(200, { access_token: accessToken, token_type: 'Bearer', expires_in: context.ttl.accessToken, refresh_token: refreshToken }, { 'cache-control': 'no-store', pragma: 'no-cache' });
+};
+exports.default = issueTokens;
+//# sourceMappingURL=issue.tokens.js.map

package/lib/functions/server/issue.tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issue.tokens.js","sourceRoot":"","sources":["../../../src/functions/server/issue.tokens.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAIb,0EAAiD;AACjD,sEAA6C;AAC7C,0EAAiD;AACjD,iFAAuD;AACvD,oEAA2C;AAE3C,MAAM,WAAW,GAAG,KAAK,EACxB,OAAgC,EAChC,QAAgB,EAChB,MAAc,EACd,QAAgB,EAChB,SAAe,EACf,UAAmB,EACS,EAAE;IAC9B,MAAM,EAAC,OAAO,EAAE,QAAQ,EAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAC5C,MAAM,YAAY,GAAW,IAAA,sBAAW,EAAC,EAAE,CAAC,CAAC;IAC7C,MAAM,OAAO,CAAC,gBAAgB,CAAC,EAAC,SAAS,EAAE,MAAM,IAAA,oBAAS,EAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAC,CAAC,CAAC;IAC5H,IAAI,UAAU,IAAI,CAAC,MAAM,OAAO,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;QAC3E,MAAM,OAAO,CAAC,wBAAwB,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAChE,OAAO,IAAA,uBAAY,EAAC,eAAe,EAAE,2CAA2C,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,WAAW,GAAW,MAAM,IAAA,2BAAe,EAAC,MAAM,OAAO,CAAC,OAAO,EAAE,EAAE;QAC1E,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ;QACR,MAAM;QACN,QAAQ;QACR,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW;QACnC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;KAClB,CAAC,CAAC;IACH,OAAO,IAAA,uBAAY,EAClB,GAAG,EACH,EAAC,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,aAAa,EAAE,YAAY,EAAC,EACnH,EAAC,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAC,CACjD,CAAC;AACH,CAAC,CAAC;AACF,kBAAe,WAAW,CAAC"}

package/lib/functions/server/load.pending.d.ts

@@ -0,0 +1,5 @@
+import type HttpRequestType from '../../types/http.request.type';
+import type McpAuthContextType from '../../types/mcp.auth.context.type';
+import type PendingAuthorizationType from '../../types/pending.authorization.type';
+declare const loadPending: (context: McpAuthContextType<any>, request: HttpRequestType) => Promise<PendingAuthorizationType | null>;
+export default loadPending;

package/lib/functions/server/load.pending.js

@@ -0,0 +1,13 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const query_param_1 = __importDefault(require("../http/query.param"));
+const loadPending = async (context, request) => {
+    const state = (0, query_param_1.default)(request, 'state');
+    const pending = state ? await context.options.storage.getPendingAuthorization(state, context.now()) : null;
+    return pending && !pending.userId ? pending : null;
+};
+exports.default = loadPending;
+//# sourceMappingURL=load.pending.js.map

package/lib/functions/server/load.pending.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load.pending.js","sourceRoot":"","sources":["../../../src/functions/server/load.pending.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAKb,sEAA6C;AAE7C,MAAM,WAAW,GAAG,KAAK,EAAE,OAAgC,EAAE,OAAwB,EAA4C,EAAE;IAClI,MAAM,KAAK,GAAuB,IAAA,qBAAU,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,uBAAuB,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3G,OAAO,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACpD,CAAC,CAAC;AACF,kBAAe,WAAW,CAAC"}

package/lib/functions/server/rotate.refresh.token.d.ts

@@ -0,0 +1,4 @@
+import type HttpResponseType from '../../types/http.response.type';
+import type McpAuthContextType from '../../types/mcp.auth.context.type';
+declare const rotateRefreshToken: (context: McpAuthContextType<any>, params: Record<string, unknown>) => Promise<HttpResponseType>;
+export default rotateRefreshToken;