mcp-auth-server 0.0.0-stage → 0.1.0

package/lib/storage/sql.storage.d.ts

@@ -0,0 +1,35 @@
+import type AuthorizationCodeRecordType from '../types/authorization.code.record.type';
+import type ClientRecordType from '../types/client.record.type';
+import type ConsentRecordType from '../types/consent.record.type';
+import type IStorage from '../types/i.storage';
+import type PendingAuthorizationType from '../types/pending.authorization.type';
+import type PendingFilterType from '../types/pending.filter.type';
+import type RefreshTokenRecordType from '../types/refresh.token.record.type';
+import type SqlDialectType from '../types/sql.dialect.type';
+import type SqlExecutorType from '../types/sql.executor.type';
+import type SqlStorageOptionsType from '../types/sql.storage.options.type';
+export default class SqlStorage implements IStorage {
+    private readonly executor;
+    private readonly dialect;
+    private readonly prefix;
+    constructor(executor: SqlExecutorType, dialect: SqlDialectType, options?: SqlStorageOptionsType);
+    migrate(): Promise<void>;
+    private run;
+    private first;
+    getClient(clientId: string): Promise<ClientRecordType | null>;
+    saveClient(client: ClientRecordType): Promise<void>;
+    savePendingAuthorization(pending: PendingAuthorizationType): Promise<void>;
+    getPendingAuthorization(stateId: string, now: Date): Promise<PendingAuthorizationType | null>;
+    attachUserToPendingAuthorization(stateId: string, userId: string, now: Date, displayName?: string): Promise<PendingAuthorizationType | null>;
+    takePendingAuthorization(stateId: string, filter: PendingFilterType): Promise<PendingAuthorizationType | null>;
+    deletePendingAuthorization(stateId: string): Promise<void>;
+    saveAuthorizationCode(code: AuthorizationCodeRecordType): Promise<void>;
+    claimAuthorizationCode(codeHash: string, now: Date): Promise<AuthorizationCodeRecordType | null>;
+    saveRefreshToken(token: RefreshTokenRecordType): Promise<void>;
+    findRefreshToken(tokenHash: string): Promise<RefreshTokenRecordType | null>;
+    claimRefreshToken(tokenHash: string, now: Date): Promise<RefreshTokenRecordType | null>;
+    revokeRefreshTokenFamily(familyId: string, now: Date): Promise<void>;
+    hasConsent(clientId: string, userId: string): Promise<boolean>;
+    upsertConsent(consent: ConsentRecordType): Promise<void>;
+    deleteExpired(now: Date): Promise<void>;
+}

package/lib/storage/sql.storage.js

@@ -0,0 +1,128 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const optional_date_1 = __importDefault(require("../functions/sql/optional.date"));
+const row_to_client_1 = __importDefault(require("../functions/sql/row.to.client"));
+const row_to_code_1 = __importDefault(require("../functions/sql/row.to.code"));
+const row_to_pending_1 = __importDefault(require("../functions/sql/row.to.pending"));
+const row_to_refresh_token_1 = __importDefault(require("../functions/sql/row.to.refresh.token"));
+const sql_schema_1 = __importDefault(require("../functions/sql/sql.schema"));
+const to_dialect_sql_1 = __importDefault(require("../functions/sql/to.dialect.sql"));
+class SqlStorage {
+    executor;
+    dialect;
+    prefix;
+    constructor(executor, dialect, options = {}) {
+        this.executor = executor;
+        this.dialect = dialect;
+        this.prefix = options.tablePrefix ?? 'mcp_oauth_';
+    }
+    async migrate() {
+        for (const statement of (0, sql_schema_1.default)(this.dialect, this.prefix))
+            await this.run(statement, []);
+    }
+    async run(sql, params) {
+        return (await this.executor((0, to_dialect_sql_1.default)(sql, this.dialect), params)) ?? [];
+    }
+    async first(sql, params) {
+        return (await this.run(sql, params))[0];
+    }
+    async getClient(clientId) {
+        const row = await this.first(`SELECT * FROM ${this.prefix}clients WHERE client_id = ?`, [clientId]);
+        return row ? (0, row_to_client_1.default)(row) : null;
+    }
+    async saveClient(client) {
+        await this.run(`INSERT INTO ${this.prefix}clients (client_id, client_name, redirect_uris, application_type, token_endpoint_auth_method, grant_types, response_types, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`, [
+            client.clientId,
+            client.clientName ?? null,
+            JSON.stringify(client.redirectUris),
+            client.applicationType ?? null,
+            client.tokenEndpointAuthMethod,
+            JSON.stringify(client.grantTypes),
+            JSON.stringify(client.responseTypes),
+            client.createdAt.getTime()
+        ]);
+    }
+    async savePendingAuthorization(pending) {
+        await this.run(`INSERT INTO ${this.prefix}pending_authorizations (state_id, client_id, client_name, redirect_uri, code_challenge, resource, client_state, upstream_code_verifier, user_id, user_display_name, expires_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+            pending.stateId,
+            pending.clientId,
+            pending.clientName ?? null,
+            pending.redirectUri,
+            pending.codeChallenge,
+            pending.resource,
+            pending.clientState ?? null,
+            pending.upstreamCodeVerifier ?? null,
+            pending.userId ?? null,
+            pending.userDisplayName ?? null,
+            pending.expiresAt.getTime()
+        ]);
+    }
+    async getPendingAuthorization(stateId, now) {
+        const row = await this.first(`SELECT * FROM ${this.prefix}pending_authorizations WHERE state_id = ? AND expires_at > ?`, [stateId, now.getTime()]);
+        return row ? (0, row_to_pending_1.default)(row) : null;
+    }
+    async attachUserToPendingAuthorization(stateId, userId, now, displayName) {
+        const row = await this.first(`UPDATE ${this.prefix}pending_authorizations SET user_id = ?, user_display_name = ? WHERE state_id = ? AND expires_at > ? AND user_id IS NULL RETURNING *`, [userId, displayName ?? null, stateId, now.getTime()]);
+        return row ? (0, row_to_pending_1.default)(row) : null;
+    }
+    async takePendingAuthorization(stateId, filter) {
+        let userClause = '';
+        if (true === filter.hasUser)
+            userClause = ' AND user_id IS NOT NULL';
+        if (false === filter.hasUser)
+            userClause = ' AND user_id IS NULL';
+        const row = await this.first(`DELETE FROM ${this.prefix}pending_authorizations WHERE state_id = ? AND expires_at > ?${userClause} RETURNING *`, [
+            stateId,
+            filter.now.getTime()
+        ]);
+        return row ? (0, row_to_pending_1.default)(row) : null;
+    }
+    async deletePendingAuthorization(stateId) {
+        await this.run(`DELETE FROM ${this.prefix}pending_authorizations WHERE state_id = ?`, [stateId]);
+    }
+    async saveAuthorizationCode(code) {
+        await this.run(`INSERT INTO ${this.prefix}authorization_codes (code_hash, client_id, redirect_uri, code_challenge, resource, user_id, used_at, expires_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`, [code.codeHash, code.clientId, code.redirectUri, code.codeChallenge, code.resource, code.userId, (0, optional_date_1.default)(code.usedAt), code.expiresAt.getTime()]);
+    }
+    async claimAuthorizationCode(codeHash, now) {
+        const row = await this.first(`UPDATE ${this.prefix}authorization_codes SET used_at = ? WHERE code_hash = ? AND used_at IS NULL AND expires_at > ? RETURNING *`, [
+            now.getTime(),
+            codeHash,
+            now.getTime()
+        ]);
+        return row ? (0, row_to_code_1.default)(row) : null;
+    }
+    async saveRefreshToken(token) {
+        await this.run(`INSERT INTO ${this.prefix}refresh_tokens (token_hash, family_id, client_id, user_id, resource, used_at, revoked_at, expires_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`, [token.tokenHash, token.familyId, token.clientId, token.userId, token.resource, (0, optional_date_1.default)(token.usedAt), (0, optional_date_1.default)(token.revokedAt), token.expiresAt.getTime()]);
+    }
+    async findRefreshToken(tokenHash) {
+        const row = await this.first(`SELECT * FROM ${this.prefix}refresh_tokens WHERE token_hash = ?`, [tokenHash]);
+        return row ? (0, row_to_refresh_token_1.default)(row) : null;
+    }
+    async claimRefreshToken(tokenHash, now) {
+        const row = await this.first(`UPDATE ${this.prefix}refresh_tokens SET used_at = ? WHERE token_hash = ? AND used_at IS NULL AND revoked_at IS NULL AND expires_at > ? RETURNING *`, [now.getTime(), tokenHash, now.getTime()]);
+        return row ? (0, row_to_refresh_token_1.default)(row) : null;
+    }
+    async revokeRefreshTokenFamily(familyId, now) {
+        await this.run(`UPDATE ${this.prefix}refresh_tokens SET revoked_at = ? WHERE family_id = ? AND revoked_at IS NULL`, [now.getTime(), familyId]);
+    }
+    async hasConsent(clientId, userId) {
+        return !!(await this.first(`SELECT 1 AS found FROM ${this.prefix}consents WHERE client_id = ? AND user_id = ?`, [clientId, userId]));
+    }
+    async upsertConsent(consent) {
+        await this.run(`INSERT INTO ${this.prefix}consents (client_id, user_id, created_at) VALUES (?, ?, ?) ON CONFLICT (client_id, user_id) DO NOTHING`, [
+            consent.clientId,
+            consent.userId,
+            Date.now()
+        ]);
+    }
+    async deleteExpired(now) {
+        for (const table of ['pending_authorizations', 'authorization_codes', 'refresh_tokens']) {
+            await this.run(`DELETE FROM ${this.prefix}${table} WHERE expires_at <= ?`, [now.getTime()]);
+        }
+    }
+}
+exports.default = SqlStorage;
+//# sourceMappingURL=sql.storage.js.map

package/lib/storage/sql.storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql.storage.js","sourceRoot":"","sources":["../../src/storage/sql.storage.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAEb,mFAA0D;AAC1D,mFAAyD;AACzD,+EAAqD;AACrD,qFAA2D;AAC3D,iGAAsE;AACtE,6EAAoD;AACpD,qFAA2D;AAa3D,MAAqB,UAAU;IAIZ;IACA;IAJD,MAAM,CAAS;IAEhC,YACkB,QAAyB,EACzB,OAAuB,EACxC,UAAiC,EAAE;QAFlB,aAAQ,GAAR,QAAQ,CAAiB;QACzB,YAAO,GAAP,OAAO,CAAgB;QAGxC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,WAAW,IAAI,YAAY,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,OAAO;QACZ,KAAK,MAAM,SAAS,IAAI,IAAA,oBAAS,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC7F,CAAC;IAEO,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,MAAiB;QAC/C,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAA,wBAAY,EAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7E,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,MAAiB;QACjD,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,QAAgB;QAC/B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,IAAI,CAAC,MAAM,6BAA6B,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACpG,OAAO,GAAG,CAAC,CAAC,CAAC,IAAA,uBAAW,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAwB;QACxC,MAAM,IAAI,CAAC,GAAG,CACb,eAAe,IAAI,CAAC,MAAM,wKAAwK,EAClM;YACC,MAAM,CAAC,QAAQ;YACf,MAAM,CAAC,UAAU,IAAI,IAAI;YACzB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC;YACnC,MAAM,CAAC,eAAe,IAAI,IAAI;YAC9B,MAAM,CAAC,uBAAuB;YAC9B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC;YACjC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC;YACpC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE;SAC1B,CACD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,OAAiC;QAC/D,MAAM,IAAI,CAAC,GAAG,CACb,eAAe,IAAI,CAAC,MAAM,0NAA0N,EACpP;YACC,OAAO,CAAC,OAAO;YACf,OAAO,CAAC,QAAQ;YAChB,OAAO,CAAC,UAAU,IAAI,IAAI;YAC1B,OAAO,CAAC,WAAW;YACnB,OAAO,CAAC,aAAa;YACrB,OAAO,CAAC,QAAQ;YAChB,OAAO,CAAC,WAAW,IAAI,IAAI;YAC3B,OAAO,CAAC,oBAAoB,IAAI,IAAI;YACpC,OAAO,CAAC,MAAM,IAAI,IAAI;YACtB,OAAO,CAAC,eAAe,IAAI,IAAI;YAC/B,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE;SAC3B,CACD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,OAAe,EAAE,GAAS;QACvD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,IAAI,CAAC,MAAM,8DAA8D,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACnJ,OAAO,GAAG,CAAC,CAAC,CAAC,IAAA,wBAAY,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,gCAAgC,CAAC,OAAe,EAAE,MAAc,EAAE,GAAS,EAAE,WAAoB;QACtG,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAC3B,UAAU,IAAI,CAAC,MAAM,qIAAqI,EAC1J,CAAC,MAAM,EAAE,WAAW,IAAI,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CACrD,CAAC;QACF,OAAO,GAAG,CAAC,CAAC,CAAC,IAAA,wBAAY,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,OAAe,EAAE,MAAyB;QACxE,IAAI,UAAU,GAAW,EAAE,CAAC;QAC5B,IAAI,IAAI,KAAK,MAAM,CAAC,OAAO;YAAE,UAAU,GAAG,0BAA0B,CAAC;QACrE,IAAI,KAAK,KAAK,MAAM,CAAC,OAAO;YAAE,UAAU,GAAG,sBAAsB,CAAC;QAClE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,IAAI,CAAC,MAAM,+DAA+D,UAAU,cAAc,EAAE;YAC/I,OAAO;YACP,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE;SACpB,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,CAAC,CAAC,IAAA,wBAAY,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,0BAA0B,CAAC,OAAe;QAC/C,MAAM,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,MAAM,2CAA2C,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAClG,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,IAAiC;QAC5D,MAAM,IAAI,CAAC,GAAG,CACb,eAAe,IAAI,CAAC,MAAM,kJAAkJ,EAC5K,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,IAAA,uBAAY,EAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CACrJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,QAAgB,EAAE,GAAS;QACvD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,MAAM,4GAA4G,EAAE;YAC/J,GAAG,CAAC,OAAO,EAAE;YACb,QAAQ;YACR,GAAG,CAAC,OAAO,EAAE;SACb,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,CAAC,CAAC,IAAA,qBAAS,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAA6B;QACnD,MAAM,IAAI,CAAC,GAAG,CACb,eAAe,IAAI,CAAC,MAAM,uIAAuI,EACjK,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAA,uBAAY,EAAC,KAAK,CAAC,MAAM,CAAC,EAAE,IAAA,uBAAY,EAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CACrK,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,SAAiB;QACvC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,IAAI,CAAC,MAAM,qCAAqC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QAC7G,OAAO,GAAG,CAAC,CAAC,CAAC,IAAA,8BAAiB,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,SAAiB,EAAE,GAAS;QACnD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAC3B,UAAU,IAAI,CAAC,MAAM,+HAA+H,EACpJ,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CACzC,CAAC;QACF,OAAO,GAAG,CAAC,CAAC,CAAC,IAAA,8BAAiB,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,QAAgB,EAAE,GAAS;QACzD,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,MAAM,8EAA8E,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;IAChJ,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,QAAgB,EAAE,MAAc;QAChD,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,0BAA0B,IAAI,CAAC,MAAM,8CAA8C,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACtI,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAA0B;QAC7C,MAAM,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,MAAM,wGAAwG,EAAE;YAClJ,OAAO,CAAC,QAAQ;YAChB,OAAO,CAAC,MAAM;YACd,IAAI,CAAC,GAAG,EAAE;SACV,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,GAAS;QAC5B,KAAK,MAAM,KAAK,IAAI,CAAC,wBAAwB,EAAE,qBAAqB,EAAE,gBAAgB,CAAC,EAAE,CAAC;YACzF,MAAM,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,MAAM,GAAG,KAAK,wBAAwB,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC7F,CAAC;IACF,CAAC;CACD;AApJD,6BAoJC"}

package/lib/types/access.token.input.type.d.ts

@@ -0,0 +1,9 @@
+type AccessTokenInputType = {
+    issuer: string;
+    resource: string;
+    userId: string;
+    clientId: string;
+    ttlSeconds: number;
+    now: Date;
+};
+export default AccessTokenInputType;

package/lib/types/access.token.input.type.js

@@ -0,0 +1,3 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=access.token.input.type.js.map

package/lib/types/access.token.input.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.token.input.type.js","sourceRoot":"","sources":["../../src/types/access.token.input.type.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC"}

package/lib/types/app.session.upstream.options.type.d.ts

@@ -0,0 +1,7 @@
+import type AuthenticatedUserType from './authenticated.user.type';
+import type HttpRequestType from './http.request.type';
+type AppSessionUpstreamOptionsType = {
+    getSignedInUser: (request: HttpRequestType) => Promise<AuthenticatedUserType | null> | AuthenticatedUserType | null;
+    signInUrl: (returnTo: string) => string;
+};
+export default AppSessionUpstreamOptionsType;

package/lib/types/app.session.upstream.options.type.js

@@ -0,0 +1,3 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=app.session.upstream.options.type.js.map

package/lib/types/app.session.upstream.options.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.session.upstream.options.type.js","sourceRoot":"","sources":["../../src/types/app.session.upstream.options.type.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC"}

package/lib/types/authenticate.result.type.d.ts

@@ -0,0 +1,10 @@
+type AuthenticateResultType<TUser> = {
+    user: TUser;
+    claims: Record<string, unknown>;
+} | {
+    status: 401;
+    headers: Record<string, string>;
+    body: unknown;
+    reason: string;
+};
+export default AuthenticateResultType;

package/lib/types/authenticate.result.type.js

@@ -0,0 +1,3 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=authenticate.result.type.js.map

package/lib/types/authenticate.result.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticate.result.type.js","sourceRoot":"","sources":["../../src/types/authenticate.result.type.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC"}

package/lib/types/authenticated.user.type.d.ts

@@ -0,0 +1,5 @@
+type AuthenticatedUserType = {
+    id: string;
+    displayName?: string;
+};
+export default AuthenticatedUserType;

package/lib/types/authenticated.user.type.js

@@ -0,0 +1,3 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=authenticated.user.type.js.map

package/lib/types/authenticated.user.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticated.user.type.js","sourceRoot":"","sources":["../../src/types/authenticated.user.type.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC"}

package/lib/types/authorization.code.record.type.d.ts

@@ -0,0 +1,11 @@
+type AuthorizationCodeRecordType = {
+    codeHash: string;
+    clientId: string;
+    redirectUri: string;
+    codeChallenge: string;
+    resource: string;
+    userId: string;
+    usedAt?: Date;
+    expiresAt: Date;
+};
+export default AuthorizationCodeRecordType;

package/lib/types/authorization.code.record.type.js

@@ -0,0 +1,3 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=authorization.code.record.type.js.map

package/lib/types/authorization.code.record.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.code.record.type.js","sourceRoot":"","sources":["../../src/types/authorization.code.record.type.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC"}

package/lib/types/cimd.options.type.d.ts

@@ -0,0 +1,16 @@
+import type IMetadataCache from './i.metadata.cache';
+type CimdOptionsType = {
+    enabled?: boolean;
+    fetch?: typeof fetch;
+    guard?: (url: URL) => Promise<void> | void;
+    cache?: IMetadataCache;
+    timeoutMs?: number;
+    maxBytes?: number;
+    maxCacheSeconds?: number;
+    defaultCacheSeconds?: number;
+    trust?: {
+        allowHosts?: string[];
+        denyHosts?: string[];
+    };
+};
+export default CimdOptionsType;

package/lib/types/cimd.options.type.js

@@ -0,0 +1,3 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=cimd.options.type.js.map

package/lib/types/cimd.options.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cimd.options.type.js","sourceRoot":"","sources":["../../src/types/cimd.options.type.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC"}

package/lib/types/client.metadata.type.d.ts

@@ -0,0 +1,7 @@
+type ClientMetadataType = {
+    client_id: string;
+    client_name: string;
+    redirect_uris: string[];
+    [key: string]: unknown;
+};
+export default ClientMetadataType;

package/lib/types/client.metadata.type.js

@@ -0,0 +1,3 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=client.metadata.type.js.map

package/lib/types/client.metadata.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.metadata.type.js","sourceRoot":"","sources":["../../src/types/client.metadata.type.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC"}

package/lib/types/client.record.type.d.ts

@@ -0,0 +1,11 @@
+type ClientRecordType = {
+    clientId: string;
+    clientName?: string;
+    redirectUris: string[];
+    applicationType?: string;
+    tokenEndpointAuthMethod: 'none';
+    grantTypes: string[];
+    responseTypes: string[];
+    createdAt: Date;
+};
+export default ClientRecordType;

package/lib/types/client.record.type.js

@@ -0,0 +1,3 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=client.record.type.js.map

package/lib/types/client.record.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.record.type.js","sourceRoot":"","sources":["../../src/types/client.record.type.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC"}

package/lib/types/consent.model.type.d.ts

@@ -0,0 +1,15 @@
+type ConsentModelType = {
+    action: string;
+    state: string;
+    clientId: string;
+    clientName?: string;
+    clientHost?: string;
+    metadataDocument: boolean;
+    redirectUri: string;
+    redirectTarget: string;
+    redirectIsLocalhost: boolean;
+    userDisplayName?: string;
+    productName: string;
+    environmentLabel?: string;
+};
+export default ConsentModelType;

package/lib/types/consent.model.type.js

@@ -0,0 +1,3 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=consent.model.type.js.map

package/lib/types/consent.model.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.model.type.js","sourceRoot":"","sources":["../../src/types/consent.model.type.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC"}

package/lib/types/consent.record.type.d.ts

@@ -0,0 +1,5 @@
+type ConsentRecordType = {
+    clientId: string;
+    userId: string;
+};
+export default ConsentRecordType;

package/lib/types/consent.record.type.js

@@ -0,0 +1,3 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=consent.record.type.js.map

package/lib/types/consent.record.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.record.type.js","sourceRoot":"","sources":["../../src/types/consent.record.type.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC"}

package/lib/types/http.request.type.d.ts

@@ -0,0 +1,9 @@
+type HttpRequestType = {
+    method: string;
+    path: string;
+    query: Record<string, string | string[] | undefined>;
+    headers: Record<string, string | string[] | undefined>;
+    body?: unknown;
+    ip?: string;
+};
+export default HttpRequestType;

package/lib/types/http.request.type.js

@@ -0,0 +1,3 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=http.request.type.js.map

package/lib/types/http.request.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.request.type.js","sourceRoot":"","sources":["../../src/types/http.request.type.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC"}

package/lib/types/http.response.type.d.ts

@@ -0,0 +1,6 @@
+type HttpResponseType = {
+    status: number;
+    headers: Record<string, string>;
+    body?: unknown;
+};
+export default HttpResponseType;

package/lib/types/http.response.type.js

@@ -0,0 +1,3 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=http.response.type.js.map

package/lib/types/http.response.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.response.type.js","sourceRoot":"","sources":["../../src/types/http.response.type.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC"}

package/lib/types/i.metadata.cache.d.ts

@@ -0,0 +1,6 @@
+import type ClientMetadataType from './client.metadata.type';
+interface IMetadataCache {
+    get(url: string): Promise<ClientMetadataType | undefined>;
+    set(url: string, value: ClientMetadataType, ttlSeconds: number): Promise<void>;
+}
+export default IMetadataCache;

package/lib/types/i.metadata.cache.js

@@ -0,0 +1,3 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=i.metadata.cache.js.map

package/lib/types/i.metadata.cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"i.metadata.cache.js","sourceRoot":"","sources":["../../src/types/i.metadata.cache.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC"}

package/lib/types/i.storage.d.ts

@@ -0,0 +1,25 @@
+import type AuthorizationCodeRecordType from './authorization.code.record.type';
+import type ClientRecordType from './client.record.type';
+import type ConsentRecordType from './consent.record.type';
+import type PendingAuthorizationType from './pending.authorization.type';
+import type PendingFilterType from './pending.filter.type';
+import type RefreshTokenRecordType from './refresh.token.record.type';
+interface IStorage {
+    getClient(clientId: string): Promise<ClientRecordType | null>;
+    saveClient(client: ClientRecordType): Promise<void>;
+    savePendingAuthorization(pending: PendingAuthorizationType): Promise<void>;
+    getPendingAuthorization(stateId: string, now: Date): Promise<PendingAuthorizationType | null>;
+    attachUserToPendingAuthorization(stateId: string, userId: string, now: Date, displayName?: string): Promise<PendingAuthorizationType | null>;
+    takePendingAuthorization(stateId: string, filter: PendingFilterType): Promise<PendingAuthorizationType | null>;
+    deletePendingAuthorization(stateId: string): Promise<void>;
+    saveAuthorizationCode(code: AuthorizationCodeRecordType): Promise<void>;
+    claimAuthorizationCode(codeHash: string, now: Date): Promise<AuthorizationCodeRecordType | null>;
+    saveRefreshToken(token: RefreshTokenRecordType): Promise<void>;
+    findRefreshToken(tokenHash: string): Promise<RefreshTokenRecordType | null>;
+    claimRefreshToken(tokenHash: string, now: Date): Promise<RefreshTokenRecordType | null>;
+    revokeRefreshTokenFamily(familyId: string, now: Date): Promise<void>;
+    hasConsent(clientId: string, userId: string): Promise<boolean>;
+    upsertConsent(consent: ConsentRecordType): Promise<void>;
+    deleteExpired(now: Date): Promise<void>;
+}
+export default IStorage;

package/lib/types/i.storage.js

@@ -0,0 +1,3 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=i.storage.js.map

package/lib/types/i.storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"i.storage.js","sourceRoot":"","sources":["../../src/types/i.storage.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC"}

package/lib/types/i.upstream.d.ts

@@ -0,0 +1,11 @@
+import type AuthenticatedUserType from './authenticated.user.type';
+import type HttpRequestType from './http.request.type';
+import type UpstreamBeginType from './upstream.begin.type';
+import type UpstreamContextType from './upstream.context.type';
+interface IUpstream {
+    begin(context: UpstreamContextType): Promise<UpstreamBeginType>;
+    callback?(context: UpstreamContextType): Promise<Record<string, unknown> | null>;
+    resume?(context: UpstreamContextType): Promise<AuthenticatedUserType | null>;
+    verifyUser?(request: HttpRequestType, userId: string): Promise<boolean>;
+}
+export default IUpstream;

package/lib/types/i.upstream.js

@@ -0,0 +1,3 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=i.upstream.js.map

package/lib/types/i.upstream.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"i.upstream.js","sourceRoot":"","sources":["../../src/types/i.upstream.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC"}

package/lib/types/key.pair.type.d.ts

@@ -0,0 +1,5 @@
+type KeyPairType = {
+    privateKey: CryptoKey;
+    publicKey: CryptoKey;
+};
+export default KeyPairType;

package/lib/types/key.pair.type.js

@@ -0,0 +1,3 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=key.pair.type.js.map

package/lib/types/key.pair.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key.pair.type.js","sourceRoot":"","sources":["../../src/types/key.pair.type.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC"}

package/lib/types/logger.type.d.ts

@@ -0,0 +1,6 @@
+type LoggerType = {
+    info?: (message: string, meta?: Record<string, unknown>) => void;
+    warn?: (message: string, meta?: Record<string, unknown>) => void;
+    error?: (message: string, meta?: Record<string, unknown>) => void;
+};
+export default LoggerType;

package/lib/types/logger.type.js

@@ -0,0 +1,3 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=logger.type.js.map

package/lib/types/logger.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.type.js","sourceRoot":"","sources":["../../src/types/logger.type.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC"}

package/lib/types/mcp.auth.context.type.d.ts

@@ -0,0 +1,29 @@
+import type KeyPairType from './key.pair.type';
+import type McpAuthOptionsType from './mcp.auth.options.type';
+import type RedirectPolicyType from './redirect.policy.type';
+import type ConsentModelType from './consent.model.type';
+import type ResolvedClientType from './resolved.client.type';
+type McpAuthContextType<TUser = unknown> = {
+    options: McpAuthOptionsType<TUser>;
+    issuer: string;
+    basePath: string;
+    callbackPath: string;
+    productName: string;
+    redirectPolicy: RedirectPolicyType;
+    ttl: {
+        accessToken: number;
+        refreshToken: number;
+        pending: number;
+        code: number;
+    };
+    now: () => Date;
+    registrationEnabled: boolean;
+    cimdEnabled: boolean;
+    renderConsent: (model: ConsentModelType) => string;
+    resourceMetadataUrl: string;
+    getKeys: () => Promise<KeyPairType>;
+    resolveClient: (clientId: string) => Promise<ResolvedClientType | {
+        error: string;
+    }>;
+};
+export default McpAuthContextType;

package/lib/types/mcp.auth.context.type.js

@@ -0,0 +1,3 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=mcp.auth.context.type.js.map

package/lib/types/mcp.auth.context.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.auth.context.type.js","sourceRoot":"","sources":["../../src/types/mcp.auth.context.type.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC"}

package/lib/types/mcp.auth.options.type.d.ts

@@ -0,0 +1,39 @@
+import type AuthenticatedUserType from './authenticated.user.type';
+import type CimdOptionsType from './cimd.options.type';
+import type ConsentModelType from './consent.model.type';
+import type IStorage from './i.storage';
+import type IUpstream from './i.upstream';
+import type LoggerType from './logger.type';
+import type RouteNameType from './route.name.type';
+type McpAuthOptionsType<TUser = unknown> = {
+    issuer: string;
+    resource: string;
+    signingKey: CryptoKey | string;
+    verificationKey?: CryptoKey;
+    storage: IStorage;
+    upstream: IUpstream;
+    resolveUser?: (claims: Record<string, unknown>) => Promise<AuthenticatedUserType> | AuthenticatedUserType;
+    loadActiveUser: (id: string) => Promise<TUser | null> | TUser | null;
+    renderConsent?: (model: ConsentModelType) => string;
+    rateLimit?: (key: string, route: RouteNameType) => Promise<boolean> | boolean;
+    logger?: LoggerType;
+    callbackPath?: string;
+    productName?: string;
+    environmentLabel?: string;
+    registration?: {
+        enabled?: boolean;
+    };
+    cimd?: CimdOptionsType;
+    redirects?: {
+        httpsHosts?: string[];
+        customSchemes?: string[];
+    };
+    ttl?: {
+        accessToken?: number;
+        refreshToken?: number;
+        pending?: number;
+        code?: number;
+    };
+    now?: () => Date;
+};
+export default McpAuthOptionsType;

package/lib/types/mcp.auth.options.type.js

@@ -0,0 +1,3 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=mcp.auth.options.type.js.map

package/lib/types/mcp.auth.options.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.auth.options.type.js","sourceRoot":"","sources":["../../src/types/mcp.auth.options.type.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC"}