mcp-auth-server 0.0.0-stage → 0.1.0

package/lib/functions/server/rotate.refresh.token.js

@@ -0,0 +1,33 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const sha256_hex_1 = __importDefault(require("../crypto/sha256.hex"));
+const text_value_1 = __importDefault(require("../http/text.value"));
+const issue_tokens_1 = __importDefault(require("./issue.tokens"));
+const token_failure_1 = __importDefault(require("./token.failure"));
+const rotateRefreshToken = async (context, params) => {
+    const refreshToken = (0, text_value_1.default)(params.refresh_token);
+    const clientId = (0, text_value_1.default)(params.client_id);
+    if (!refreshToken || !clientId)
+        return (0, token_failure_1.default)('invalid_request', 'refresh_token and client_id are required');
+    const { storage } = context.options;
+    const tokenHash = await (0, sha256_hex_1.default)(refreshToken);
+    const stored = await storage.findRefreshToken(tokenHash);
+    const at = context.now();
+    if (!stored || stored.clientId !== clientId || stored.expiresAt <= at)
+        return (0, token_failure_1.default)('invalid_grant', 'refresh token is invalid, expired or revoked');
+    if (stored.revokedAt) {
+        await storage.revokeRefreshTokenFamily(stored.familyId, at);
+        return (0, token_failure_1.default)('invalid_grant', 'refresh token is invalid, expired or revoked');
+    }
+    const claimed = await storage.claimRefreshToken(tokenHash, at);
+    if (!claimed) {
+        await storage.revokeRefreshTokenFamily(stored.familyId, at);
+        return (0, token_failure_1.default)('invalid_grant', 'refresh token was already used; all tokens of this session are revoked');
+    }
+    return (0, issue_tokens_1.default)(context, clientId, stored.userId, stored.familyId, stored.expiresAt, tokenHash);
+};
+exports.default = rotateRefreshToken;
+//# sourceMappingURL=rotate.refresh.token.js.map

package/lib/functions/server/rotate.refresh.token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotate.refresh.token.js","sourceRoot":"","sources":["../../../src/functions/server/rotate.refresh.token.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAIb,sEAA6C;AAC7C,oEAA2C;AAC3C,kEAAyC;AACzC,oEAA2C;AAE3C,MAAM,kBAAkB,GAAG,KAAK,EAAE,OAAgC,EAAE,MAA+B,EAA6B,EAAE;IACjI,MAAM,YAAY,GAAuB,IAAA,oBAAS,EAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAuB,IAAA,oBAAS,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjE,IAAI,CAAC,YAAY,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAA,uBAAY,EAAC,iBAAiB,EAAE,0CAA0C,CAAC,CAAC;IAEnH,MAAM,EAAC,OAAO,EAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAClC,MAAM,SAAS,GAAW,MAAM,IAAA,oBAAS,EAAC,YAAY,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACzD,MAAM,EAAE,GAAS,OAAO,CAAC,GAAG,EAAE,CAAC;IAC/B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,IAAI,EAAE;QAAE,OAAO,IAAA,uBAAY,EAAC,eAAe,EAAE,8CAA8C,CAAC,CAAC;IAC5J,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,OAAO,CAAC,wBAAwB,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC5D,OAAO,IAAA,uBAAY,EAAC,eAAe,EAAE,8CAA8C,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC/D,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,OAAO,CAAC,wBAAwB,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC5D,OAAO,IAAA,uBAAY,EAAC,eAAe,EAAE,wEAAwE,CAAC,CAAC;IAChH,CAAC;IACD,OAAO,IAAA,sBAAW,EAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AACpG,CAAC,CAAC;AACF,kBAAe,kBAAkB,CAAC"}

package/lib/functions/server/token.failure.d.ts

@@ -0,0 +1,3 @@
+import type HttpResponseType from '../../types/http.response.type';
+declare const tokenFailure: (error: string, description: string, status?: number) => HttpResponseType;
+export default tokenFailure;

package/lib/functions/server/token.failure.js

@@ -0,0 +1,9 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const oauth_error_response_1 = __importDefault(require("../http/oauth.error.response"));
+const tokenFailure = (error, description, status = 400) => (0, oauth_error_response_1.default)(status, error, description, { 'cache-control': 'no-store', pragma: 'no-cache' });
+exports.default = tokenFailure;
+//# sourceMappingURL=token.failure.js.map

package/lib/functions/server/token.failure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.failure.js","sourceRoot":"","sources":["../../../src/functions/server/token.failure.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAGb,wFAA8D;AAE9D,MAAM,YAAY,GAAG,CAAC,KAAa,EAAE,WAAmB,EAAE,SAAiB,GAAG,EAAoB,EAAE,CACnG,IAAA,8BAAkB,EAAC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,EAAC,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAC,CAAC,CAAC;AACnG,kBAAe,YAAY,CAAC"}

package/lib/functions/sql/from.better.sqlite3.d.ts

@@ -0,0 +1,10 @@
+import type SqlExecutorType from '../../types/sql.executor.type';
+type PreparedType = {
+    reader: boolean;
+    all: (...params: any[]) => Record<string, unknown>[];
+    run: (...params: any[]) => unknown;
+};
+declare const fromBetterSqlite3: (db: {
+    prepare: (sql: string) => PreparedType;
+}) => SqlExecutorType;
+export default fromBetterSqlite3;

package/lib/functions/sql/from.better.sqlite3.js

@@ -0,0 +1,11 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+const fromBetterSqlite3 = (db) => (sql, params) => {
+    const statement = db.prepare(sql);
+    if (statement.reader)
+        return statement.all(...params);
+    statement.run(...params);
+    return [];
+};
+exports.default = fromBetterSqlite3;
+//# sourceMappingURL=from.better.sqlite3.js.map

package/lib/functions/sql/from.better.sqlite3.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"from.better.sqlite3.js","sourceRoot":"","sources":["../../../src/functions/sql/from.better.sqlite3.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAMb,MAAM,iBAAiB,GACtB,CAAC,EAA4C,EAAmB,EAAE,CAClE,CAAC,GAAW,EAAE,MAAiB,EAAE,EAAE;IAClC,MAAM,SAAS,GAAiB,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,SAAS,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;IACtD,SAAS,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;IACzB,OAAO,EAAE,CAAC;AACX,CAAC,CAAC;AACH,kBAAe,iBAAiB,CAAC"}

package/lib/functions/sql/from.bun.sqlite.d.ts

@@ -0,0 +1,7 @@
+import type SqlExecutorType from '../../types/sql.executor.type';
+declare const fromBunSqlite: (db: {
+    query: (sql: string) => {
+        all: (...params: any[]) => Record<string, unknown>[];
+    };
+}) => SqlExecutorType;
+export default fromBunSqlite;

package/lib/functions/sql/from.bun.sqlite.js

@@ -0,0 +1,5 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+const fromBunSqlite = (db) => (sql, params) => db.query(sql).all(...params);
+exports.default = fromBunSqlite;
+//# sourceMappingURL=from.bun.sqlite.js.map

package/lib/functions/sql/from.bun.sqlite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"from.bun.sqlite.js","sourceRoot":"","sources":["../../../src/functions/sql/from.bun.sqlite.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAIb,MAAM,aAAa,GAClB,CAAC,EAAoF,EAAmB,EAAE,CAC1G,CAAC,GAAW,EAAE,MAAiB,EAAE,EAAE,CAClC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;AAC/B,kBAAe,aAAa,CAAC"}

package/lib/functions/sql/from.d1.d.ts

@@ -0,0 +1,11 @@
+import type SqlExecutorType from '../../types/sql.executor.type';
+declare const fromD1: (db: {
+    prepare: (sql: string) => {
+        bind: (...params: unknown[]) => {
+            all: () => Promise<{
+                results?: Record<string, unknown>[];
+            }>;
+        };
+    };
+}) => SqlExecutorType;
+export default fromD1;

package/lib/functions/sql/from.d1.js

@@ -0,0 +1,8 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+const fromD1 = (db) => async (sql, params) => (await db
+    .prepare(sql)
+    .bind(...params)
+    .all()).results ?? [];
+exports.default = fromD1;
+//# sourceMappingURL=from.d1.js.map

package/lib/functions/sql/from.d1.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"from.d1.js","sourceRoot":"","sources":["../../../src/functions/sql/from.d1.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAIb,MAAM,MAAM,GACX,CAAC,EAA6H,EAAmB,EAAE,CACnJ,KAAK,EAAE,GAAW,EAAE,MAAiB,EAAE,EAAE,CACxC,CACC,MAAM,EAAE;KACN,OAAO,CAAC,GAAG,CAAC;KACZ,IAAI,CAAC,GAAG,MAAM,CAAC;KACf,GAAG,EAAE,CACP,CAAC,OAAO,IAAI,EAAE,CAAC;AAClB,kBAAe,MAAM,CAAC"}

package/lib/functions/sql/from.node.sqlite.d.ts

@@ -0,0 +1,7 @@
+import type SqlExecutorType from '../../types/sql.executor.type';
+declare const fromNodeSqlite: (db: {
+    prepare: (sql: string) => {
+        all: (...params: any[]) => Record<string, unknown>[];
+    };
+}) => SqlExecutorType;
+export default fromNodeSqlite;

package/lib/functions/sql/from.node.sqlite.js

@@ -0,0 +1,5 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+const fromNodeSqlite = (db) => (sql, params) => db.prepare(sql).all(...params);
+exports.default = fromNodeSqlite;
+//# sourceMappingURL=from.node.sqlite.js.map

package/lib/functions/sql/from.node.sqlite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"from.node.sqlite.js","sourceRoot":"","sources":["../../../src/functions/sql/from.node.sqlite.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAIb,MAAM,cAAc,GACnB,CAAC,EAAsF,EAAmB,EAAE,CAC5G,CAAC,GAAW,EAAE,MAAiB,EAAE,EAAE,CAClC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;AACjC,kBAAe,cAAc,CAAC"}

package/lib/functions/sql/from.pg.d.ts

@@ -0,0 +1,7 @@
+import type SqlExecutorType from '../../types/sql.executor.type';
+declare const fromPg: (client: {
+    query: (text: string, values: unknown[]) => Promise<{
+        rows: Record<string, unknown>[];
+    }>;
+}) => SqlExecutorType;
+export default fromPg;

package/lib/functions/sql/from.pg.js

@@ -0,0 +1,5 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+const fromPg = (client) => async (sql, params) => (await client.query(sql, params)).rows;
+exports.default = fromPg;
+//# sourceMappingURL=from.pg.js.map

package/lib/functions/sql/from.pg.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"from.pg.js","sourceRoot":"","sources":["../../../src/functions/sql/from.pg.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAIb,MAAM,MAAM,GACX,CAAC,MAAgG,EAAmB,EAAE,CACtH,KAAK,EAAE,GAAW,EAAE,MAAiB,EAAE,EAAE,CACxC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,kBAAe,MAAM,CAAC"}

package/lib/functions/sql/from.postgres.js.d.ts

@@ -0,0 +1,5 @@
+import type SqlExecutorType from '../../types/sql.executor.type';
+declare const fromPostgresJs: (client: {
+    unsafe: (text: string, values: any[]) => Promise<ArrayLike<Record<string, unknown>>>;
+}) => SqlExecutorType;
+export default fromPostgresJs;

package/lib/functions/sql/from.postgres.js.js

@@ -0,0 +1,5 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+const fromPostgresJs = (client) => async (sql, params) => Array.from(await client.unsafe(sql, params));
+exports.default = fromPostgresJs;
+//# sourceMappingURL=from.postgres.js.js.map

package/lib/functions/sql/from.postgres.js.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"from.postgres.js.js","sourceRoot":"","sources":["../../../src/functions/sql/from.postgres.js.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAIb,MAAM,cAAc,GACnB,CAAC,MAA8F,EAAmB,EAAE,CACpH,KAAK,EAAE,GAAW,EAAE,MAAiB,EAAE,EAAE,CACxC,KAAK,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAe,CAAC,CAAC,CAAC;AACxD,kBAAe,cAAc,CAAC"}

package/lib/functions/sql/optional.date.d.ts

@@ -0,0 +1,2 @@
+declare const optionalDate: (value: Date | undefined) => number | null;
+export default optionalDate;

package/lib/functions/sql/optional.date.js

@@ -0,0 +1,5 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+const optionalDate = (value) => (value ? value.getTime() : null);
+exports.default = optionalDate;
+//# sourceMappingURL=optional.date.js.map

package/lib/functions/sql/optional.date.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"optional.date.js","sourceRoot":"","sources":["../../../src/functions/sql/optional.date.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,MAAM,YAAY,GAAG,CAAC,KAAuB,EAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAClG,kBAAe,YAAY,CAAC"}

package/lib/functions/sql/optional.number.d.ts

@@ -0,0 +1,2 @@
+declare const optionalNumber: (value: unknown) => number | undefined;
+export default optionalNumber;

package/lib/functions/sql/optional.number.js

@@ -0,0 +1,5 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+const optionalNumber = (value) => (null === value || undefined === value ? undefined : Number(value));
+exports.default = optionalNumber;
+//# sourceMappingURL=optional.number.js.map

package/lib/functions/sql/optional.number.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"optional.number.js","sourceRoot":"","sources":["../../../src/functions/sql/optional.number.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,MAAM,cAAc,GAAG,CAAC,KAAc,EAAsB,EAAE,CAAC,CAAC,IAAI,KAAK,KAAK,IAAI,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACnI,kBAAe,cAAc,CAAC"}

package/lib/functions/sql/optional.text.d.ts

@@ -0,0 +1,2 @@
+declare const optionalText: (value: unknown) => string | undefined;
+export default optionalText;

package/lib/functions/sql/optional.text.js

@@ -0,0 +1,5 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+const optionalText = (value) => (null === value || undefined === value ? undefined : String(value));
+exports.default = optionalText;
+//# sourceMappingURL=optional.text.js.map

package/lib/functions/sql/optional.text.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"optional.text.js","sourceRoot":"","sources":["../../../src/functions/sql/optional.text.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,MAAM,YAAY,GAAG,CAAC,KAAc,EAAsB,EAAE,CAAC,CAAC,IAAI,KAAK,KAAK,IAAI,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACjI,kBAAe,YAAY,CAAC"}

package/lib/functions/sql/row.to.client.d.ts

@@ -0,0 +1,4 @@
+import type ClientRecordType from '../../types/client.record.type';
+import type { SqlRowType } from '../../types/sql.executor.type';
+declare const rowToClient: (row: SqlRowType) => ClientRecordType;
+export default rowToClient;

package/lib/functions/sql/row.to.client.js

@@ -0,0 +1,18 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const optional_text_1 = __importDefault(require("./optional.text"));
+const rowToClient = (row) => ({
+    clientId: String(row.client_id),
+    clientName: (0, optional_text_1.default)(row.client_name),
+    redirectUris: JSON.parse(String(row.redirect_uris)),
+    applicationType: (0, optional_text_1.default)(row.application_type),
+    tokenEndpointAuthMethod: 'none',
+    grantTypes: JSON.parse(String(row.grant_types)),
+    responseTypes: JSON.parse(String(row.response_types)),
+    createdAt: new Date(Number(row.created_at))
+});
+exports.default = rowToClient;
+//# sourceMappingURL=row.to.client.js.map

package/lib/functions/sql/row.to.client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"row.to.client.js","sourceRoot":"","sources":["../../../src/functions/sql/row.to.client.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAIb,oEAA2C;AAE3C,MAAM,WAAW,GAAG,CAAC,GAAe,EAAoB,EAAE,CAAC,CAAC;IAC3D,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;IAC/B,UAAU,EAAE,IAAA,uBAAY,EAAC,GAAG,CAAC,WAAW,CAAC;IACzC,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACnD,eAAe,EAAE,IAAA,uBAAY,EAAC,GAAG,CAAC,gBAAgB,CAAC;IACnD,uBAAuB,EAAE,MAAM;IAC/B,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC/C,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACrD,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;CAC3C,CAAC,CAAC;AACH,kBAAe,WAAW,CAAC"}

package/lib/functions/sql/row.to.code.d.ts

@@ -0,0 +1,4 @@
+import type AuthorizationCodeRecordType from '../../types/authorization.code.record.type';
+import type { SqlRowType } from '../../types/sql.executor.type';
+declare const rowToCode: (row: SqlRowType) => AuthorizationCodeRecordType;
+export default rowToCode;

package/lib/functions/sql/row.to.code.js

@@ -0,0 +1,21 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const optional_number_1 = __importDefault(require("./optional.number"));
+const rowToCode = (row) => {
+    const usedAt = (0, optional_number_1.default)(row.used_at);
+    return {
+        codeHash: String(row.code_hash),
+        clientId: String(row.client_id),
+        redirectUri: String(row.redirect_uri),
+        codeChallenge: String(row.code_challenge),
+        resource: String(row.resource),
+        userId: String(row.user_id),
+        usedAt: undefined === usedAt ? undefined : new Date(usedAt),
+        expiresAt: new Date(Number(row.expires_at))
+    };
+};
+exports.default = rowToCode;
+//# sourceMappingURL=row.to.code.js.map

package/lib/functions/sql/row.to.code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"row.to.code.js","sourceRoot":"","sources":["../../../src/functions/sql/row.to.code.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAIb,wEAA+C;AAE/C,MAAM,SAAS,GAAG,CAAC,GAAe,EAA+B,EAAE;IAClE,MAAM,MAAM,GAAuB,IAAA,yBAAc,EAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/D,OAAO;QACN,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;QAC/B,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;QAC/B,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;QACrC,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC;QACzC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC9B,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;QAC3B,MAAM,EAAE,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC;QAC3D,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;KAC3C,CAAC;AACH,CAAC,CAAC;AACF,kBAAe,SAAS,CAAC"}

package/lib/functions/sql/row.to.pending.d.ts

@@ -0,0 +1,4 @@
+import type PendingAuthorizationType from '../../types/pending.authorization.type';
+import type { SqlRowType } from '../../types/sql.executor.type';
+declare const rowToPending: (row: SqlRowType) => PendingAuthorizationType;
+export default rowToPending;

package/lib/functions/sql/row.to.pending.js

@@ -0,0 +1,21 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const optional_text_1 = __importDefault(require("./optional.text"));
+const rowToPending = (row) => ({
+    stateId: String(row.state_id),
+    clientId: String(row.client_id),
+    clientName: (0, optional_text_1.default)(row.client_name),
+    redirectUri: String(row.redirect_uri),
+    codeChallenge: String(row.code_challenge),
+    resource: String(row.resource),
+    clientState: (0, optional_text_1.default)(row.client_state),
+    upstreamCodeVerifier: (0, optional_text_1.default)(row.upstream_code_verifier),
+    userId: (0, optional_text_1.default)(row.user_id),
+    userDisplayName: (0, optional_text_1.default)(row.user_display_name),
+    expiresAt: new Date(Number(row.expires_at))
+});
+exports.default = rowToPending;
+//# sourceMappingURL=row.to.pending.js.map

package/lib/functions/sql/row.to.pending.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"row.to.pending.js","sourceRoot":"","sources":["../../../src/functions/sql/row.to.pending.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAIb,oEAA2C;AAE3C,MAAM,YAAY,GAAG,CAAC,GAAe,EAA4B,EAAE,CAAC,CAAC;IACpE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;IAC/B,UAAU,EAAE,IAAA,uBAAY,EAAC,GAAG,CAAC,WAAW,CAAC;IACzC,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;IACrC,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC;IACzC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC9B,WAAW,EAAE,IAAA,uBAAY,EAAC,GAAG,CAAC,YAAY,CAAC;IAC3C,oBAAoB,EAAE,IAAA,uBAAY,EAAC,GAAG,CAAC,sBAAsB,CAAC;IAC9D,MAAM,EAAE,IAAA,uBAAY,EAAC,GAAG,CAAC,OAAO,CAAC;IACjC,eAAe,EAAE,IAAA,uBAAY,EAAC,GAAG,CAAC,iBAAiB,CAAC;IACpD,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;CAC3C,CAAC,CAAC;AACH,kBAAe,YAAY,CAAC"}

package/lib/functions/sql/row.to.refresh.token.d.ts

@@ -0,0 +1,4 @@
+import type RefreshTokenRecordType from '../../types/refresh.token.record.type';
+import type { SqlRowType } from '../../types/sql.executor.type';
+declare const rowToRefreshToken: (row: SqlRowType) => RefreshTokenRecordType;
+export default rowToRefreshToken;

package/lib/functions/sql/row.to.refresh.token.js

@@ -0,0 +1,22 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const optional_number_1 = __importDefault(require("./optional.number"));
+const rowToRefreshToken = (row) => {
+    const usedAt = (0, optional_number_1.default)(row.used_at);
+    const revokedAt = (0, optional_number_1.default)(row.revoked_at);
+    return {
+        tokenHash: String(row.token_hash),
+        familyId: String(row.family_id),
+        clientId: String(row.client_id),
+        userId: String(row.user_id),
+        resource: String(row.resource),
+        usedAt: undefined === usedAt ? undefined : new Date(usedAt),
+        revokedAt: undefined === revokedAt ? undefined : new Date(revokedAt),
+        expiresAt: new Date(Number(row.expires_at))
+    };
+};
+exports.default = rowToRefreshToken;
+//# sourceMappingURL=row.to.refresh.token.js.map

package/lib/functions/sql/row.to.refresh.token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"row.to.refresh.token.js","sourceRoot":"","sources":["../../../src/functions/sql/row.to.refresh.token.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAIb,wEAA+C;AAE/C,MAAM,iBAAiB,GAAG,CAAC,GAAe,EAA0B,EAAE;IACrE,MAAM,MAAM,GAAuB,IAAA,yBAAc,EAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAuB,IAAA,yBAAc,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrE,OAAO;QACN,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;QACjC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;QAC/B,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;QAC/B,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;QAC3B,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC9B,MAAM,EAAE,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC;QAC3D,SAAS,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC;QACpE,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;KAC3C,CAAC;AACH,CAAC,CAAC;AACF,kBAAe,iBAAiB,CAAC"}

package/lib/functions/sql/sql.schema.d.ts

@@ -0,0 +1,3 @@
+import type SqlDialectType from '../../types/sql.dialect.type';
+declare const sqlSchema: (dialect: SqlDialectType, prefix?: string) => string[];
+export default sqlSchema;

package/lib/functions/sql/sql.schema.js

@@ -0,0 +1,62 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+const sqlSchema = (dialect, prefix = 'mcp_oauth_') => {
+    const bigint = 'postgres' === dialect ? 'BIGINT' : 'INTEGER';
+    return [
+        `CREATE TABLE IF NOT EXISTS ${prefix}clients (
+	client_id TEXT PRIMARY KEY,
+	client_name TEXT,
+	redirect_uris TEXT NOT NULL,
+	application_type TEXT,
+	token_endpoint_auth_method TEXT NOT NULL,
+	grant_types TEXT NOT NULL,
+	response_types TEXT NOT NULL,
+	created_at ${bigint} NOT NULL
+)`,
+        `CREATE TABLE IF NOT EXISTS ${prefix}pending_authorizations (
+	state_id TEXT PRIMARY KEY,
+	client_id TEXT NOT NULL,
+	client_name TEXT,
+	redirect_uri TEXT NOT NULL,
+	code_challenge TEXT NOT NULL,
+	resource TEXT NOT NULL,
+	client_state TEXT,
+	upstream_code_verifier TEXT,
+	user_id TEXT,
+	user_display_name TEXT,
+	expires_at ${bigint} NOT NULL
+)`,
+        `CREATE INDEX IF NOT EXISTS ${prefix}pending_expires_idx ON ${prefix}pending_authorizations (expires_at)`,
+        `CREATE TABLE IF NOT EXISTS ${prefix}authorization_codes (
+	code_hash TEXT PRIMARY KEY,
+	client_id TEXT NOT NULL,
+	redirect_uri TEXT NOT NULL,
+	code_challenge TEXT NOT NULL,
+	resource TEXT NOT NULL,
+	user_id TEXT NOT NULL,
+	used_at ${bigint},
+	expires_at ${bigint} NOT NULL
+)`,
+        `CREATE INDEX IF NOT EXISTS ${prefix}codes_expires_idx ON ${prefix}authorization_codes (expires_at)`,
+        `CREATE TABLE IF NOT EXISTS ${prefix}refresh_tokens (
+	token_hash TEXT PRIMARY KEY,
+	family_id TEXT NOT NULL,
+	client_id TEXT NOT NULL,
+	user_id TEXT NOT NULL,
+	resource TEXT NOT NULL,
+	used_at ${bigint},
+	revoked_at ${bigint},
+	expires_at ${bigint} NOT NULL
+)`,
+        `CREATE INDEX IF NOT EXISTS ${prefix}refresh_family_idx ON ${prefix}refresh_tokens (family_id)`,
+        `CREATE INDEX IF NOT EXISTS ${prefix}refresh_expires_idx ON ${prefix}refresh_tokens (expires_at)`,
+        `CREATE TABLE IF NOT EXISTS ${prefix}consents (
+	client_id TEXT NOT NULL,
+	user_id TEXT NOT NULL,
+	created_at ${bigint} NOT NULL,
+	PRIMARY KEY (client_id, user_id)
+)`
+    ];
+};
+exports.default = sqlSchema;
+//# sourceMappingURL=sql.schema.js.map

package/lib/functions/sql/sql.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql.schema.js","sourceRoot":"","sources":["../../../src/functions/sql/sql.schema.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAIb,MAAM,SAAS,GAAG,CAAC,OAAuB,EAAE,SAAiB,YAAY,EAAY,EAAE;IACtF,MAAM,MAAM,GAAW,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,OAAO;QACN,8BAA8B,MAAM;;;;;;;;cAQxB,MAAM;EAClB;QACA,8BAA8B,MAAM;;;;;;;;;;;cAWxB,MAAM;EAClB;QACA,8BAA8B,MAAM,0BAA0B,MAAM,qCAAqC;QACzG,8BAA8B,MAAM;;;;;;;WAO3B,MAAM;cACH,MAAM;EAClB;QACA,8BAA8B,MAAM,wBAAwB,MAAM,kCAAkC;QACpG,8BAA8B,MAAM;;;;;;WAM3B,MAAM;cACH,MAAM;cACN,MAAM;EAClB;QACA,8BAA8B,MAAM,yBAAyB,MAAM,4BAA4B;QAC/F,8BAA8B,MAAM,0BAA0B,MAAM,6BAA6B;QACjG,8BAA8B,MAAM;;;cAGxB,MAAM;;EAElB;KACA,CAAC;AACH,CAAC,CAAC;AACF,kBAAe,SAAS,CAAC"}

package/lib/functions/sql/to.dialect.sql.d.ts

@@ -0,0 +1,3 @@
+import type SqlDialectType from '../../types/sql.dialect.type';
+declare const toDialectSql: (sql: string, dialect: SqlDialectType) => string;
+export default toDialectSql;

package/lib/functions/sql/to.dialect.sql.js

@@ -0,0 +1,13 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+const toDialectSql = (sql, dialect) => {
+    if ('postgres' !== dialect)
+        return sql;
+    let index = 0;
+    return sql.replaceAll('?', () => {
+        index += 1;
+        return `$${index}`;
+    });
+};
+exports.default = toDialectSql;
+//# sourceMappingURL=to.dialect.sql.js.map

package/lib/functions/sql/to.dialect.sql.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"to.dialect.sql.js","sourceRoot":"","sources":["../../../src/functions/sql/to.dialect.sql.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAIb,MAAM,YAAY,GAAG,CAAC,GAAW,EAAE,OAAuB,EAAU,EAAE;IACrE,IAAI,UAAU,KAAK,OAAO;QAAE,OAAO,GAAG,CAAC;IACvC,IAAI,KAAK,GAAW,CAAC,CAAC;IACtB,OAAO,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,GAAW,EAAE;QACvC,KAAK,IAAI,CAAC,CAAC;QACX,OAAO,IAAI,KAAK,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC;AACF,kBAAe,YAAY,CAAC"}

package/lib/functions/upstream/app.session.upstream.d.ts

@@ -0,0 +1,4 @@
+import type AppSessionUpstreamOptionsType from '../../types/app.session.upstream.options.type';
+import type IUpstream from '../../types/i.upstream';
+declare const appSessionUpstream: (options: AppSessionUpstreamOptionsType) => IUpstream;
+export default appSessionUpstream;

package/lib/functions/upstream/app.session.upstream.js

@@ -0,0 +1,18 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+const appSessionUpstream = (options) => ({
+    async begin(context) {
+        const user = await options.getSignedInUser(context.request);
+        if (user)
+            return { type: 'user', user };
+        return { type: 'redirect', url: options.signInUrl(context.resumeUrl) };
+    },
+    async resume(context) {
+        return (await options.getSignedInUser(context.request)) ?? null;
+    },
+    async verifyUser(request, userId) {
+        return (await options.getSignedInUser(request))?.id === userId;
+    }
+});
+exports.default = appSessionUpstream;
+//# sourceMappingURL=app.session.upstream.js.map

package/lib/functions/upstream/app.session.upstream.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.session.upstream.js","sourceRoot":"","sources":["../../../src/functions/upstream/app.session.upstream.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AASb,MAAM,kBAAkB,GAAG,CAAC,OAAsC,EAAa,EAAE,CAAC,CAAC;IAClF,KAAK,CAAC,KAAK,CAAC,OAA4B;QACvC,MAAM,IAAI,GAAiC,MAAM,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1F,IAAI,IAAI;YAAE,OAAO,EAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAC,CAAC;QACtC,OAAO,EAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,EAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAA4B;QACxC,OAAO,CAAC,MAAM,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,OAAwB,EAAE,MAAc;QACxD,OAAO,CAAC,MAAM,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,KAAK,MAAM,CAAC;IAChE,CAAC;CACD,CAAC,CAAC;AACH,kBAAe,kBAAkB,CAAC"}

package/lib/functions/upstream/entra.upstream.d.ts

@@ -0,0 +1,11 @@
+import type IUpstream from '../../types/i.upstream';
+type EntraUpstreamOptionsType = {
+    tenantId: string;
+    clientId: string;
+    clientSecret: string;
+    scope?: string;
+    fetch?: typeof fetch;
+    now?: () => Date;
+};
+declare const entraUpstream: (options: EntraUpstreamOptionsType) => IUpstream;
+export default entraUpstream;

package/lib/functions/upstream/entra.upstream.js

@@ -0,0 +1,16 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const oidc_upstream_1 = __importDefault(require("./oidc.upstream"));
+const entraUpstream = (options) => (0, oidc_upstream_1.default)({
+    discoveryUrl: `https://login.microsoftonline.com/${encodeURIComponent(options.tenantId)}/v2.0/.well-known/openid-configuration`,
+    clientId: options.clientId,
+    clientSecret: options.clientSecret,
+    scope: options.scope ?? 'openid profile email',
+    fetch: options.fetch,
+    now: options.now
+});
+exports.default = entraUpstream;
+//# sourceMappingURL=entra.upstream.js.map

package/lib/functions/upstream/entra.upstream.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entra.upstream.js","sourceRoot":"","sources":["../../../src/functions/upstream/entra.upstream.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAGb,oEAA2C;AAI3C,MAAM,aAAa,GAAG,CAAC,OAAiC,EAAa,EAAE,CACtE,IAAA,uBAAY,EAAC;IACZ,YAAY,EAAE,qCAAqC,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,wCAAwC;IAC/H,QAAQ,EAAE,OAAO,CAAC,QAAQ;IAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;IAClC,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,sBAAsB;IAC9C,KAAK,EAAE,OAAO,CAAC,KAAK;IACpB,GAAG,EAAE,OAAO,CAAC,GAAG;CAChB,CAAC,CAAC;AACJ,kBAAe,aAAa,CAAC"}

package/lib/functions/upstream/oidc.upstream.d.ts

@@ -0,0 +1,4 @@
+import type IUpstream from '../../types/i.upstream';
+import type OidcUpstreamOptionsType from '../../types/oidc.upstream.options.type';
+declare const oidcUpstream: (options: OidcUpstreamOptionsType) => IUpstream;
+export default oidcUpstream;

package/lib/functions/upstream/oidc.upstream.js

@@ -0,0 +1,82 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const sha256_base64_url_1 = __importDefault(require("../crypto/sha256.base64.url"));
+const query_param_1 = __importDefault(require("../http/query.param"));
+const verify_id_token_1 = __importDefault(require("./verify.id.token"));
+const oidcUpstream = (options) => {
+    const fetchImpl = options.fetch ?? ((input, init) => fetch(input, init));
+    let discovery;
+    let jwks;
+    const loadDiscovery = () => {
+        discovery ??= (async () => {
+            const response = await fetchImpl(options.discoveryUrl);
+            if (!response.ok)
+                throw new Error(`OIDC discovery failed with status ${response.status}`);
+            return (await response.json());
+        })().catch((error) => {
+            discovery = undefined;
+            throw error;
+        });
+        return discovery;
+    };
+    const loadJwks = async (force) => {
+        if (force)
+            jwks = undefined;
+        jwks ??= (async () => {
+            const { jwks_uri } = await loadDiscovery();
+            const response = await fetchImpl(jwks_uri);
+            if (!response.ok)
+                throw new Error(`OIDC jwks fetch failed with status ${response.status}`);
+            return response.json();
+        })().catch((error) => {
+            jwks = undefined;
+            throw error;
+        });
+        return jwks;
+    };
+    return {
+        async begin(context) {
+            const metadata = await loadDiscovery();
+            const url = new URL(metadata.authorization_endpoint);
+            url.search = new URLSearchParams({
+                client_id: options.clientId,
+                response_type: 'code',
+                redirect_uri: context.callbackUrl,
+                scope: options.scope ?? 'openid profile email',
+                state: context.pending.stateId,
+                code_challenge: await (0, sha256_base64_url_1.default)(context.pending.upstreamCodeVerifier ?? ''),
+                code_challenge_method: 'S256'
+            }).toString();
+            return { type: 'redirect', url: url.toString() };
+        },
+        async callback(context) {
+            const code = (0, query_param_1.default)(context.request, 'code');
+            if ((0, query_param_1.default)(context.request, 'error') || !code)
+                return null;
+            const metadata = await loadDiscovery();
+            const response = await fetchImpl(metadata.token_endpoint, {
+                method: 'POST',
+                headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
+                body: new URLSearchParams({
+                    grant_type: 'authorization_code',
+                    code,
+                    redirect_uri: context.callbackUrl,
+                    client_id: options.clientId,
+                    client_secret: options.clientSecret,
+                    code_verifier: context.pending.upstreamCodeVerifier ?? ''
+                }).toString()
+            });
+            if (!response.ok)
+                return null;
+            const tokens = (await response.json());
+            if (!tokens.id_token)
+                return null;
+            return (await (0, verify_id_token_1.default)(tokens.id_token, loadJwks, metadata.issuer, options.clientId, options.now?.()));
+        }
+    };
+};
+exports.default = oidcUpstream;
+//# sourceMappingURL=oidc.upstream.js.map