mcp-auth-server 0.0.0-stage → 0.1.1

package/lib/functions/upstream/oidc.upstream.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.upstream.js","sourceRoot":"","sources":["../../../src/functions/upstream/oidc.upstream.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAMb,oFAA0D;AAC1D,sEAA6C;AAC7C,wEAA8C;AAI9C,MAAM,YAAY,GAAG,CAAC,OAAgC,EAAa,EAAE;IACpE,MAAM,SAAS,GAAiB,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,KAAU,EAAE,IAAkB,EAAqB,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IAC7H,IAAI,SAA6C,CAAC;IAClD,IAAI,IAAkC,CAAC;IAEvC,MAAM,aAAa,GAAG,GAA2B,EAAE;QAClD,SAAS,KAAK,CAAC,KAAK,IAA4B,EAAE;YACjD,MAAM,QAAQ,GAAa,MAAM,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YACjE,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1F,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,CAAC;QACjD,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAS,EAAE;YACpC,SAAS,GAAG,SAAS,CAAC;YACtB,MAAM,KAAK,CAAC;QACb,CAAC,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IAClB,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,EAAE,KAAc,EAAoB,EAAE;QAC3D,IAAI,KAAK;YAAE,IAAI,GAAG,SAAS,CAAC;QAC5B,IAAI,KAAK,CAAC,KAAK,IAAsB,EAAE;YACtC,MAAM,EAAC,QAAQ,EAAC,GAAG,MAAM,aAAa,EAAE,CAAC;YACzC,MAAM,QAAQ,GAAa,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;YACrD,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAC3F,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;QACxB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAS,EAAE;YACpC,IAAI,GAAG,SAAS,CAAC;YACjB,MAAM,KAAK,CAAC;QACb,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACb,CAAC,CAAC;IAEF,OAAO;QACN,KAAK,CAAC,KAAK,CAAC,OAA4B;YACvC,MAAM,QAAQ,GAAkB,MAAM,aAAa,EAAE,CAAC;YACtD,MAAM,GAAG,GAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;YAC1D,GAAG,CAAC,MAAM,GAAG,IAAI,eAAe,CAAC;gBAChC,SAAS,EAAE,OAAO,CAAC,QAAQ;gBAC3B,aAAa,EAAE,MAAM;gBACrB,YAAY,EAAE,OAAO,CAAC,WAAW;gBACjC,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,sBAAsB;gBAC9C,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO;gBAC9B,cAAc,EAAE,MAAM,IAAA,2BAAe,EAAC,OAAO,CAAC,OAAO,CAAC,oBAAoB,IAAI,EAAE,CAAC;gBACjF,qBAAqB,EAAE,MAAM;aAC7B,CAAC,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,EAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAC,CAAC;QAChD,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,OAA4B;YAC1C,MAAM,IAAI,GAAuB,IAAA,qBAAU,EAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACrE,IAAI,IAAA,qBAAU,EAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAC/D,MAAM,QAAQ,GAAkB,MAAM,aAAa,EAAE,CAAC;YAEtD,MAAM,QAAQ,GAAa,MAAM,SAAS,CAAC,QAAQ,CAAC,cAAc,EAAE;gBACnE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAC,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAC;gBAC1F,IAAI,EAAE,IAAI,eAAe,CAAC;oBACzB,UAAU,EAAE,oBAAoB;oBAChC,IAAI;oBACJ,YAAY,EAAE,OAAO,CAAC,WAAW;oBACjC,SAAS,EAAE,OAAO,CAAC,QAAQ;oBAC3B,aAAa,EAAE,OAAO,CAAC,YAAY;oBACnC,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,oBAAoB,IAAI,EAAE;iBACzD,CAAC,CAAC,QAAQ,EAAE;aACb,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YAC9B,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAwB,CAAC;YAC9D,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAElC,OAAO,CAAC,MAAM,IAAA,yBAAa,EAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAA4B,CAAC;QACxI,CAAC;KACD,CAAC;AACH,CAAC,CAAC;AACF,kBAAe,YAAY,CAAC"}

package/lib/functions/upstream/verify.id.token.d.ts

@@ -0,0 +1,3 @@
+import { JWTPayload } from 'jose';
+declare const verifyIdToken: (token: string, loadJwks: (force: boolean) => Promise<any>, issuer: string, audience: string, now?: Date) => Promise<JWTPayload>;
+export default verifyIdToken;

package/lib/functions/upstream/verify.id.token.js

@@ -0,0 +1,16 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+const jose_1 = require("jose");
+const verifyIdToken = async (token, loadJwks, issuer, audience, now) => {
+    const options = { issuer, audience, currentDate: now };
+    try {
+        return (await (0, jose_1.jwtVerify)(token, (0, jose_1.createLocalJWKSet)(await loadJwks(false)), options)).payload;
+    }
+    catch (error) {
+        if (!(error instanceof jose_1.errors.JWKSNoMatchingKey))
+            throw error;
+        return (await (0, jose_1.jwtVerify)(token, (0, jose_1.createLocalJWKSet)(await loadJwks(true)), options)).payload;
+    }
+};
+exports.default = verifyIdToken;
+//# sourceMappingURL=verify.id.token.js.map

package/lib/functions/upstream/verify.id.token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.id.token.js","sourceRoot":"","sources":["../../../src/functions/upstream/verify.id.token.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,+BAAsE;AAEtE,MAAM,aAAa,GAAG,KAAK,EAAE,KAAa,EAAE,QAA0C,EAAE,MAAc,EAAE,QAAgB,EAAE,GAAU,EAAuB,EAAE;IAC5J,MAAM,OAAO,GAAG,EAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAC,CAAC;IACrD,IAAI,CAAC;QACJ,OAAO,CAAC,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAA,wBAAiB,EAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IAC5F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,CAAC,CAAC,KAAK,YAAY,aAAM,CAAC,iBAAiB,CAAC;YAAE,MAAM,KAAK,CAAC;QAC9D,OAAO,CAAC,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAA,wBAAiB,EAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IAC3F,CAAC;AACF,CAAC,CAAC;AACF,kBAAe,aAAa,CAAC"}

package/lib/handlers/authorization.server.metadata.handler.d.ts

@@ -0,0 +1,4 @@
+import type HttpResponseType from '../types/http.response.type';
+import type McpAuthContextType from '../types/mcp.auth.context.type';
+declare const authorizationServerMetadataHandler: (context: McpAuthContextType<any>) => Promise<HttpResponseType>;
+export default authorizationServerMetadataHandler;

package/lib/handlers/authorization.server.metadata.handler.js

@@ -0,0 +1,24 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const json_response_1 = __importDefault(require("../functions/http/json.response"));
+const authorizationServerMetadataHandler = async (context) => {
+    const { issuer } = context;
+    return (0, json_response_1.default)(200, {
+        issuer,
+        authorization_endpoint: `${issuer}/authorize`,
+        token_endpoint: `${issuer}/token`,
+        ...(context.registrationEnabled ? { registration_endpoint: `${issuer}/register` } : {}),
+        revocation_endpoint: `${issuer}/revoke`,
+        response_types_supported: ['code'],
+        grant_types_supported: ['authorization_code', 'refresh_token'],
+        code_challenge_methods_supported: ['S256'],
+        token_endpoint_auth_methods_supported: ['none'],
+        authorization_response_iss_parameter_supported: true,
+        ...(context.cimdEnabled ? { client_id_metadata_document_supported: true } : {})
+    });
+};
+exports.default = authorizationServerMetadataHandler;
+//# sourceMappingURL=authorization.server.metadata.handler.js.map

package/lib/handlers/authorization.server.metadata.handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.server.metadata.handler.js","sourceRoot":"","sources":["../../src/handlers/authorization.server.metadata.handler.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAEb,oFAA2D;AAI3D,MAAM,kCAAkC,GAAG,KAAK,EAAE,OAAgC,EAA6B,EAAE;IAChH,MAAM,EAAC,MAAM,EAAC,GAAG,OAAO,CAAC;IACzB,OAAO,IAAA,uBAAY,EAAC,GAAG,EAAE;QACxB,MAAM;QACN,sBAAsB,EAAE,GAAG,MAAM,YAAY;QAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;QACjC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAC,qBAAqB,EAAE,GAAG,MAAM,WAAW,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,mBAAmB,EAAE,GAAG,MAAM,SAAS;QACvC,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC9D,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,qCAAqC,EAAE,CAAC,MAAM,CAAC;QAC/C,8CAA8C,EAAE,IAAI;QACpD,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAC,qCAAqC,EAAE,IAAI,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7E,CAAC,CAAC;AACJ,CAAC,CAAC;AACF,kBAAe,kCAAkC,CAAC"}

package/lib/handlers/authorize.handler.d.ts

@@ -0,0 +1,5 @@
+import type HttpRequestType from '../types/http.request.type';
+import type HttpResponseType from '../types/http.response.type';
+import type McpAuthContextType from '../types/mcp.auth.context.type';
+declare const authorizeHandler: (context: McpAuthContextType<any>, request: HttpRequestType) => Promise<HttpResponseType>;
+export default authorizeHandler;

package/lib/handlers/authorize.handler.js

@@ -0,0 +1,58 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const random_token_1 = __importDefault(require("../functions/crypto/random.token"));
+const oauth_error_response_1 = __importDefault(require("../functions/http/oauth.error.response"));
+const query_param_1 = __importDefault(require("../functions/http/query.param"));
+const redirect_response_1 = __importDefault(require("../functions/http/redirect.response"));
+const build_error_redirect_1 = __importDefault(require("../functions/redirect/build.error.redirect"));
+const attach_and_continue_1 = __importDefault(require("../functions/server/attach.and.continue"));
+const build_upstream_context_1 = __importDefault(require("../functions/server/build.upstream.context"));
+const deny_authorization_1 = __importDefault(require("../functions/server/deny.authorization"));
+const codeChallengePattern = /^[A-Za-z0-9_-]{43}$/;
+const authorizeHandler = async (context, request) => {
+    const { storage, upstream, resource, logger } = context.options;
+    const clientId = (0, query_param_1.default)(request, 'client_id');
+    const client = clientId ? await context.resolveClient(clientId) : { error: 'unknown client_id' };
+    if ('error' in client)
+        return (0, oauth_error_response_1.default)(400, 'invalid_request', client.error);
+    const redirectUri = (0, query_param_1.default)(request, 'redirect_uri');
+    if (!redirectUri || !client.redirectUris.includes(redirectUri))
+        return (0, oauth_error_response_1.default)(400, 'invalid_request', 'redirect_uri is not registered for this client');
+    const clientState = (0, query_param_1.default)(request, 'state');
+    const fail = (error, description) => (0, redirect_response_1.default)((0, build_error_redirect_1.default)(redirectUri, context.issuer, error, description, clientState));
+    if ('code' !== (0, query_param_1.default)(request, 'response_type'))
+        return fail('unsupported_response_type', 'response_type must be code');
+    const codeChallenge = (0, query_param_1.default)(request, 'code_challenge');
+    if (!codeChallenge || !codeChallengePattern.test(codeChallenge) || 'S256' !== (0, query_param_1.default)(request, 'code_challenge_method')) {
+        return fail('invalid_request', 'PKCE with code_challenge_method S256 is required');
+    }
+    if ((0, query_param_1.default)(request, 'resource') !== resource)
+        return fail('invalid_target', 'resource does not match this server');
+    const pending = {
+        stateId: (0, random_token_1.default)(32),
+        clientId: client.clientId,
+        clientName: client.clientName,
+        redirectUri,
+        codeChallenge,
+        resource,
+        clientState,
+        upstreamCodeVerifier: (0, random_token_1.default)(32),
+        expiresAt: new Date(context.now().getTime() + context.ttl.pending * 1000)
+    };
+    await storage.savePendingAuthorization(pending);
+    try {
+        const begun = await upstream.begin((0, build_upstream_context_1.default)(context, request, pending));
+        if ('redirect' === begun.type)
+            return (0, redirect_response_1.default)(begun.url);
+        return await (0, attach_and_continue_1.default)(context, pending, begun.user);
+    }
+    catch (error) {
+        logger?.error?.('MCP upstream begin failed', { error: error instanceof Error ? error.message : String(error) });
+        return (0, deny_authorization_1.default)(context, pending);
+    }
+};
+exports.default = authorizeHandler;
+//# sourceMappingURL=authorize.handler.js.map

package/lib/handlers/authorize.handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.handler.js","sourceRoot":"","sources":["../../src/handlers/authorize.handler.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAEb,oFAA2D;AAC3D,kGAAwE;AACxE,gFAAuD;AACvD,4FAAmE;AACnE,sGAA4E;AAC5E,kGAAwE;AACxE,wGAA8E;AAC9E,gGAAuE;AAMvE,MAAM,oBAAoB,GAAW,qBAAqB,CAAC;AAE3D,MAAM,gBAAgB,GAAG,KAAK,EAAE,OAAgC,EAAE,OAAwB,EAA6B,EAAE;IACxH,MAAM,EAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAC9D,MAAM,QAAQ,GAAuB,IAAA,qBAAU,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAE,EAAC,KAAK,EAAE,mBAAmB,EAAW,CAAC;IAC1G,IAAI,OAAO,IAAI,MAAM;QAAE,OAAO,IAAA,8BAAkB,EAAC,GAAG,EAAE,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAEvF,MAAM,WAAW,GAAuB,IAAA,qBAAU,EAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAC5E,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,IAAA,8BAAkB,EAAC,GAAG,EAAE,iBAAiB,EAAE,gDAAgD,CAAC,CAAC;IAEpK,MAAM,WAAW,GAAuB,IAAA,qBAAU,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,WAAmB,EAAoB,EAAE,CAAC,IAAA,2BAAgB,EAAC,IAAA,8BAAkB,EAAC,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;IAE1K,IAAI,MAAM,KAAK,IAAA,qBAAU,EAAC,OAAO,EAAE,eAAe,CAAC;QAAE,OAAO,IAAI,CAAC,2BAA2B,EAAE,4BAA4B,CAAC,CAAC;IAC5H,MAAM,aAAa,GAAuB,IAAA,qBAAU,EAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAChF,IAAI,CAAC,aAAa,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,MAAM,KAAK,IAAA,qBAAU,EAAC,OAAO,EAAE,uBAAuB,CAAC,EAAE,CAAC;QAC5H,OAAO,IAAI,CAAC,iBAAiB,EAAE,kDAAkD,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,IAAA,qBAAU,EAAC,OAAO,EAAE,UAAU,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,gBAAgB,EAAE,qCAAqC,CAAC,CAAC;IAEvH,MAAM,OAAO,GAA6B;QACzC,OAAO,EAAE,IAAA,sBAAW,EAAC,EAAE,CAAC;QACxB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,WAAW;QACX,aAAa;QACb,QAAQ;QACR,WAAW;QACX,oBAAoB,EAAE,IAAA,sBAAW,EAAC,EAAE,CAAC;QACrC,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;KACzE,CAAC;IACF,MAAM,OAAO,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAEhD,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAA,gCAAoB,EAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QACpF,IAAI,UAAU,KAAK,KAAK,CAAC,IAAI;YAAE,OAAO,IAAA,2BAAgB,EAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClE,OAAO,MAAM,IAAA,6BAAiB,EAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,EAAE,KAAK,EAAE,CAAC,2BAA2B,EAAE,EAAC,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAC,CAAC,CAAC;QAC9G,OAAO,IAAA,4BAAiB,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;AACF,CAAC,CAAC;AACF,kBAAe,gBAAgB,CAAC"}

package/lib/handlers/callback.handler.d.ts

@@ -0,0 +1,5 @@
+import type HttpRequestType from '../types/http.request.type';
+import type HttpResponseType from '../types/http.response.type';
+import type McpAuthContextType from '../types/mcp.auth.context.type';
+declare const callbackHandler: (context: McpAuthContextType<any>, request: HttpRequestType) => Promise<HttpResponseType>;
+export default callbackHandler;

package/lib/handlers/callback.handler.js

@@ -0,0 +1,32 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const oauth_error_response_1 = __importDefault(require("../functions/http/oauth.error.response"));
+const text_value_1 = __importDefault(require("../functions/http/text.value"));
+const attach_and_continue_1 = __importDefault(require("../functions/server/attach.and.continue"));
+const build_upstream_context_1 = __importDefault(require("../functions/server/build.upstream.context"));
+const deny_authorization_1 = __importDefault(require("../functions/server/deny.authorization"));
+const load_pending_1 = __importDefault(require("../functions/server/load.pending"));
+const callbackHandler = async (context, request) => {
+    const pending = await (0, load_pending_1.default)(context, request);
+    if (!pending)
+        return (0, oauth_error_response_1.default)(400, 'invalid_request', 'unknown or already used state');
+    const { upstream, resolveUser, logger } = context.options;
+    let user;
+    try {
+        const claims = await upstream.callback?.((0, build_upstream_context_1.default)(context, request, pending));
+        const subject = (0, text_value_1.default)(claims?.sub);
+        if (claims && resolveUser)
+            user = await resolveUser(claims);
+        else if (claims && subject)
+            user = { id: subject, displayName: (0, text_value_1.default)(claims.name) };
+    }
+    catch (error) {
+        logger?.error?.('MCP upstream callback failed', { error: error instanceof Error ? error.message : String(error) });
+    }
+    return user?.id ? (0, attach_and_continue_1.default)(context, pending, user) : (0, deny_authorization_1.default)(context, pending);
+};
+exports.default = callbackHandler;
+//# sourceMappingURL=callback.handler.js.map

package/lib/handlers/callback.handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback.handler.js","sourceRoot":"","sources":["../../src/handlers/callback.handler.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAEb,kGAAwE;AACxE,8EAAqD;AACrD,kGAAwE;AACxE,wGAA8E;AAC9E,gGAAuE;AACvE,oFAA2D;AAM3D,MAAM,eAAe,GAAG,KAAK,EAAE,OAAgC,EAAE,OAAwB,EAA6B,EAAE;IACvH,MAAM,OAAO,GAAG,MAAM,IAAA,sBAAW,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAA,8BAAkB,EAAC,GAAG,EAAE,iBAAiB,EAAE,+BAA+B,CAAC,CAAC;IAEjG,MAAM,EAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IACxD,IAAI,IAAuC,CAAC;IAC5C,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAA,gCAAoB,EAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1F,MAAM,OAAO,GAAuB,IAAA,oBAAS,EAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC3D,IAAI,MAAM,IAAI,WAAW;YAAE,IAAI,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;aACvD,IAAI,MAAM,IAAI,OAAO;YAAE,IAAI,GAAG,EAAC,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,IAAA,oBAAS,EAAC,MAAM,CAAC,IAAI,CAAC,EAAC,CAAC;IACvF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,EAAE,KAAK,EAAE,CAAC,8BAA8B,EAAE,EAAC,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAC,CAAC,CAAC;IAClH,CAAC;IACD,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAA,6BAAiB,EAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,4BAAiB,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AACnG,CAAC,CAAC;AACF,kBAAe,eAAe,CAAC"}

package/lib/handlers/consent.decision.handler.d.ts

@@ -0,0 +1,5 @@
+import type HttpRequestType from '../types/http.request.type';
+import type HttpResponseType from '../types/http.response.type';
+import type McpAuthContextType from '../types/mcp.auth.context.type';
+declare const consentDecisionHandler: (context: McpAuthContextType<any>, request: HttpRequestType) => Promise<HttpResponseType>;
+export default consentDecisionHandler;

package/lib/handlers/consent.decision.handler.js

@@ -0,0 +1,30 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const form_params_1 = __importDefault(require("../functions/http/form.params"));
+const plain_error_response_1 = __importDefault(require("../functions/http/plain.error.response"));
+const redirect_response_1 = __importDefault(require("../functions/http/redirect.response"));
+const build_error_redirect_1 = __importDefault(require("../functions/redirect/build.error.redirect"));
+const awaiting_consent_1 = __importDefault(require("../functions/server/awaiting.consent"));
+const issue_authorization_code_1 = __importDefault(require("../functions/server/issue.authorization.code"));
+const consentDecisionHandler = async (context, request) => {
+    const invalid = () => (0, plain_error_response_1.default)(400, 'Invalid or expired authorization request');
+    const body = (0, form_params_1.default)(request.body);
+    const decision = body.decision;
+    if ('approve' !== decision && 'deny' !== decision)
+        return invalid();
+    if (!(await (0, awaiting_consent_1.default)(context, request, body.state)))
+        return invalid();
+    const { storage } = context.options;
+    const pending = await storage.takePendingAuthorization(body.state, { now: context.now(), hasUser: true });
+    if (!pending)
+        return invalid();
+    if ('deny' === decision)
+        return (0, redirect_response_1.default)((0, build_error_redirect_1.default)(pending.redirectUri, context.issuer, 'access_denied', 'the user denied the request', pending.clientState));
+    await storage.upsertConsent({ clientId: pending.clientId, userId: pending.userId });
+    return (0, issue_authorization_code_1.default)(context, pending);
+};
+exports.default = consentDecisionHandler;
+//# sourceMappingURL=consent.decision.handler.js.map

package/lib/handlers/consent.decision.handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.decision.handler.js","sourceRoot":"","sources":["../../src/handlers/consent.decision.handler.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAEb,gFAAuD;AACvD,kGAAwE;AACxE,4FAAmE;AACnE,sGAA4E;AAC5E,4FAAmE;AACnE,4GAAkF;AAKlF,MAAM,sBAAsB,GAAG,KAAK,EAAE,OAAgC,EAAE,OAAwB,EAA6B,EAAE;IAC9H,MAAM,OAAO,GAAG,GAAqB,EAAE,CAAC,IAAA,8BAAkB,EAAC,GAAG,EAAE,0CAA0C,CAAC,CAAC;IAC5G,MAAM,IAAI,GAA4B,IAAA,qBAAU,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAY,IAAI,CAAC,QAAQ,CAAC;IACxC,IAAI,SAAS,KAAK,QAAQ,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,OAAO,EAAE,CAAC;IACpE,IAAI,CAAC,CAAC,MAAM,IAAA,0BAAe,EAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,OAAO,EAAE,CAAC;IAE7E,MAAM,EAAC,OAAO,EAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAe,EAAE,EAAC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAC,CAAC,CAAC;IAClH,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,EAAE,CAAC;IAE/B,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAA,2BAAgB,EAAC,IAAA,8BAAkB,EAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,6BAA6B,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IAE/K,MAAM,OAAO,CAAC,aAAa,CAAC,EAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,MAAgB,EAAC,CAAC,CAAC;IAC5F,OAAO,IAAA,kCAAsB,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC,CAAC;AACF,kBAAe,sBAAsB,CAAC"}

package/lib/handlers/consent.page.handler.d.ts

@@ -0,0 +1,5 @@
+import type HttpRequestType from '../types/http.request.type';
+import type HttpResponseType from '../types/http.response.type';
+import type McpAuthContextType from '../types/mcp.auth.context.type';
+declare const consentPageHandler: (context: McpAuthContextType<any>, request: HttpRequestType) => Promise<HttpResponseType>;
+export default consentPageHandler;

package/lib/handlers/consent.page.handler.js

@@ -0,0 +1,43 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const is_metadata_client_id_1 = __importDefault(require("../functions/cimd/is.metadata.client.id"));
+const plain_error_response_1 = __importDefault(require("../functions/http/plain.error.response"));
+const query_param_1 = __importDefault(require("../functions/http/query.param"));
+const describe_redirect_target_1 = __importDefault(require("../functions/redirect/describe.redirect.target"));
+const is_loopback_redirect_1 = __importDefault(require("../functions/redirect/is.loopback.redirect"));
+const awaiting_consent_1 = __importDefault(require("../functions/server/awaiting.consent"));
+const consentPageHandler = async (context, request) => {
+    const pending = await (0, awaiting_consent_1.default)(context, request, (0, query_param_1.default)(request, 'state'));
+    if (!pending)
+        return (0, plain_error_response_1.default)(400, 'Invalid or expired authorization request');
+    const metadataDocument = (0, is_metadata_client_id_1.default)(pending.clientId);
+    const model = {
+        action: `${context.basePath}/oauth/consent`,
+        state: pending.stateId,
+        clientId: pending.clientId,
+        clientName: pending.clientName,
+        clientHost: metadataDocument ? new URL(pending.clientId).host : undefined,
+        metadataDocument,
+        redirectUri: pending.redirectUri,
+        redirectTarget: (0, describe_redirect_target_1.default)(pending.redirectUri),
+        redirectIsLocalhost: (0, is_loopback_redirect_1.default)(pending.redirectUri),
+        userDisplayName: pending.userDisplayName,
+        productName: context.productName,
+        environmentLabel: context.options.environmentLabel
+    };
+    return {
+        status: 200,
+        headers: {
+            'content-type': 'text/html; charset=utf-8',
+            'x-frame-options': 'DENY',
+            'content-security-policy': "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'",
+            'cache-control': 'no-store'
+        },
+        body: context.renderConsent(model)
+    };
+};
+exports.default = consentPageHandler;
+//# sourceMappingURL=consent.page.handler.js.map

package/lib/handlers/consent.page.handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.page.handler.js","sourceRoot":"","sources":["../../src/handlers/consent.page.handler.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAEb,oGAAyE;AACzE,kGAAwE;AACxE,gFAAuD;AACvD,8GAAoF;AACpF,sGAA4E;AAC5E,4FAAmE;AAMnE,MAAM,kBAAkB,GAAG,KAAK,EAAE,OAAgC,EAAE,OAAwB,EAA6B,EAAE;IAC1H,MAAM,OAAO,GAAG,MAAM,IAAA,0BAAe,EAAC,OAAO,EAAE,OAAO,EAAE,IAAA,qBAAU,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IACtF,IAAI,CAAC,OAAO;QAAE,OAAO,IAAA,8BAAkB,EAAC,GAAG,EAAE,0CAA0C,CAAC,CAAC;IAEzF,MAAM,gBAAgB,GAAY,IAAA,+BAAkB,EAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvE,MAAM,KAAK,GAAqB;QAC/B,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,gBAAgB;QAC3C,KAAK,EAAE,OAAO,CAAC,OAAO;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QACzE,gBAAgB;QAChB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,cAAc,EAAE,IAAA,kCAAsB,EAAC,OAAO,CAAC,WAAW,CAAC;QAC3D,mBAAmB,EAAE,IAAA,8BAAkB,EAAC,OAAO,CAAC,WAAW,CAAC;QAC5D,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,gBAAgB;KAClD,CAAC;IACF,OAAO;QACN,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACR,cAAc,EAAE,0BAA0B;YAC1C,iBAAiB,EAAE,MAAM;YACzB,yBAAyB,EAAE,uEAAuE;YAClG,eAAe,EAAE,UAAU;SAC3B;QACD,IAAI,EAAE,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC;KAClC,CAAC;AACH,CAAC,CAAC;AACF,kBAAe,kBAAkB,CAAC"}

package/lib/handlers/protected.resource.metadata.handler.d.ts

@@ -0,0 +1,4 @@
+import type HttpResponseType from '../types/http.response.type';
+import type McpAuthContextType from '../types/mcp.auth.context.type';
+declare const protectedResourceMetadataHandler: (context: McpAuthContextType<any>) => Promise<HttpResponseType>;
+export default protectedResourceMetadataHandler;

package/lib/handlers/protected.resource.metadata.handler.js

@@ -0,0 +1,9 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const json_response_1 = __importDefault(require("../functions/http/json.response"));
+const protectedResourceMetadataHandler = async (context) => (0, json_response_1.default)(200, { resource: context.options.resource, authorization_servers: [context.issuer], bearer_methods_supported: ['header'] });
+exports.default = protectedResourceMetadataHandler;
+//# sourceMappingURL=protected.resource.metadata.handler.js.map

package/lib/handlers/protected.resource.metadata.handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protected.resource.metadata.handler.js","sourceRoot":"","sources":["../../src/handlers/protected.resource.metadata.handler.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAEb,oFAA2D;AAI3D,MAAM,gCAAgC,GAAG,KAAK,EAAE,OAAgC,EAA6B,EAAE,CAC9G,IAAA,uBAAY,EAAC,GAAG,EAAE,EAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,qBAAqB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,wBAAwB,EAAE,CAAC,QAAQ,CAAC,EAAC,CAAC,CAAC;AACxI,kBAAe,gCAAgC,CAAC"}

package/lib/handlers/register.handler.d.ts

@@ -0,0 +1,5 @@
+import type HttpRequestType from '../types/http.request.type';
+import type HttpResponseType from '../types/http.response.type';
+import type McpAuthContextType from '../types/mcp.auth.context.type';
+declare const registerHandler: (context: McpAuthContextType<any>, request: HttpRequestType) => Promise<HttpResponseType>;
+export default registerHandler;

package/lib/handlers/register.handler.js

@@ -0,0 +1,44 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const form_params_1 = __importDefault(require("../functions/http/form.params"));
+const json_response_1 = __importDefault(require("../functions/http/json.response"));
+const oauth_error_response_1 = __importDefault(require("../functions/http/oauth.error.response"));
+const random_id_1 = __importDefault(require("../functions/crypto/random.id"));
+const is_allowed_redirect_uri_1 = __importDefault(require("../functions/redirect/is.allowed.redirect.uri"));
+const registerHandler = async (context, request) => {
+    const body = (0, form_params_1.default)(request.body);
+    const redirectUris = body.redirect_uris;
+    if (!Array.isArray(redirectUris) || 0 === redirectUris.length)
+        return (0, oauth_error_response_1.default)(400, 'invalid_redirect_uri', 'redirect_uris must be a non-empty array');
+    const rejected = redirectUris.find((uri) => !(0, is_allowed_redirect_uri_1.default)(uri, context.redirectPolicy));
+    if (undefined !== rejected) {
+        context.options.logger?.info?.('MCP register rejected', { redirectUris, clientName: body.client_name });
+        return (0, oauth_error_response_1.default)(400, 'invalid_redirect_uri', `redirect_uri not allowed: ${String(rejected).slice(0, 200)}`);
+    }
+    const client = {
+        clientId: (0, random_id_1.default)(),
+        clientName: 'string' === typeof body.client_name ? body.client_name.slice(0, 200) : undefined,
+        redirectUris: redirectUris,
+        applicationType: 'string' === typeof body.application_type ? body.application_type.slice(0, 32) : undefined,
+        tokenEndpointAuthMethod: 'none',
+        grantTypes: ['authorization_code', 'refresh_token'],
+        responseTypes: ['code'],
+        createdAt: context.now()
+    };
+    await context.options.storage.saveClient(client);
+    return (0, json_response_1.default)(201, {
+        client_id: client.clientId,
+        client_id_issued_at: Math.floor(client.createdAt.getTime() / 1000),
+        client_name: client.clientName,
+        redirect_uris: client.redirectUris,
+        ...(client.applicationType ? { application_type: client.applicationType } : {}),
+        token_endpoint_auth_method: client.tokenEndpointAuthMethod,
+        grant_types: client.grantTypes,
+        response_types: client.responseTypes
+    }, { 'cache-control': 'no-store' });
+};
+exports.default = registerHandler;
+//# sourceMappingURL=register.handler.js.map

package/lib/handlers/register.handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.handler.js","sourceRoot":"","sources":["../../src/handlers/register.handler.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAEb,gFAAuD;AACvD,oFAA2D;AAC3D,kGAAwE;AACxE,8EAAqD;AACrD,4GAAiF;AAMjF,MAAM,eAAe,GAAG,KAAK,EAAE,OAAgC,EAAE,OAAwB,EAA6B,EAAE;IACvH,MAAM,IAAI,GAA4B,IAAA,qBAAU,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAY,IAAI,CAAC,aAAa,CAAC;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,YAAY,CAAC,MAAM;QAAE,OAAO,IAAA,8BAAkB,EAAC,GAAG,EAAE,sBAAsB,EAAE,yCAAyC,CAAC,CAAC;IACjK,MAAM,QAAQ,GAAY,YAAY,CAAC,IAAI,CAAC,CAAC,GAAY,EAAW,EAAE,CAAC,CAAC,IAAA,iCAAoB,EAAC,GAAG,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;IAC3H,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,uBAAuB,EAAE,EAAC,YAAY,EAAE,UAAU,EAAE,IAAI,CAAC,WAAW,EAAC,CAAC,CAAC;QACtG,OAAO,IAAA,8BAAkB,EAAC,GAAG,EAAE,sBAAsB,EAAE,6BAA6B,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACvH,CAAC;IAED,MAAM,MAAM,GAAqB;QAChC,QAAQ,EAAE,IAAA,mBAAQ,GAAE;QACpB,UAAU,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QAC7F,YAAY,EAAE,YAAwB;QACtC,eAAe,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;QAC3G,uBAAuB,EAAE,MAAM;QAC/B,UAAU,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QACnD,aAAa,EAAE,CAAC,MAAM,CAAC;QACvB,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE;KACxB,CAAC;IACF,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAEjD,OAAO,IAAA,uBAAY,EAClB,GAAG,EACH;QACC,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;QAClE,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAC,gBAAgB,EAAE,MAAM,CAAC,eAAe,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,0BAA0B,EAAE,MAAM,CAAC,uBAAuB;QAC1D,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,cAAc,EAAE,MAAM,CAAC,aAAa;KACpC,EACD,EAAC,eAAe,EAAE,UAAU,EAAC,CAC7B,CAAC;AACH,CAAC,CAAC;AACF,kBAAe,eAAe,CAAC"}

package/lib/handlers/resume.handler.d.ts

@@ -0,0 +1,5 @@
+import type HttpRequestType from '../types/http.request.type';
+import type HttpResponseType from '../types/http.response.type';
+import type McpAuthContextType from '../types/mcp.auth.context.type';
+declare const resumeHandler: (context: McpAuthContextType<any>, request: HttpRequestType) => Promise<HttpResponseType>;
+export default resumeHandler;

package/lib/handlers/resume.handler.js

@@ -0,0 +1,25 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const oauth_error_response_1 = __importDefault(require("../functions/http/oauth.error.response"));
+const attach_and_continue_1 = __importDefault(require("../functions/server/attach.and.continue"));
+const build_upstream_context_1 = __importDefault(require("../functions/server/build.upstream.context"));
+const deny_authorization_1 = __importDefault(require("../functions/server/deny.authorization"));
+const load_pending_1 = __importDefault(require("../functions/server/load.pending"));
+const resumeHandler = async (context, request) => {
+    const pending = await (0, load_pending_1.default)(context, request);
+    if (!pending)
+        return (0, oauth_error_response_1.default)(400, 'invalid_request', 'unknown or already used state');
+    let user = null;
+    try {
+        user = (await context.options.upstream.resume?.((0, build_upstream_context_1.default)(context, request, pending))) ?? null;
+    }
+    catch (error) {
+        context.options.logger?.error?.('MCP upstream resume failed', { error: error instanceof Error ? error.message : String(error) });
+    }
+    return user?.id ? (0, attach_and_continue_1.default)(context, pending, user) : (0, deny_authorization_1.default)(context, pending);
+};
+exports.default = resumeHandler;
+//# sourceMappingURL=resume.handler.js.map

package/lib/handlers/resume.handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resume.handler.js","sourceRoot":"","sources":["../../src/handlers/resume.handler.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAEb,kGAAwE;AACxE,kGAAwE;AACxE,wGAA8E;AAC9E,gGAAuE;AACvE,oFAA2D;AAM3D,MAAM,aAAa,GAAG,KAAK,EAAE,OAAgC,EAAE,OAAwB,EAA6B,EAAE;IACrH,MAAM,OAAO,GAAG,MAAM,IAAA,sBAAW,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAA,8BAAkB,EAAC,GAAG,EAAE,iBAAiB,EAAE,+BAA+B,CAAC,CAAC;IAEjG,IAAI,IAAI,GAAiC,IAAI,CAAC;IAC9C,IAAI,CAAC;QACJ,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAA,gCAAoB,EAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC3G,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,4BAA4B,EAAE,EAAC,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAC,CAAC,CAAC;IAChI,CAAC;IACD,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAA,6BAAiB,EAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,4BAAiB,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AACnG,CAAC,CAAC;AACF,kBAAe,aAAa,CAAC"}

package/lib/handlers/revoke.handler.d.ts

@@ -0,0 +1,5 @@
+import type HttpRequestType from '../types/http.request.type';
+import type HttpResponseType from '../types/http.response.type';
+import type McpAuthContextType from '../types/mcp.auth.context.type';
+declare const revokeHandler: (context: McpAuthContextType<any>, request: HttpRequestType) => Promise<HttpResponseType>;
+export default revokeHandler;

package/lib/handlers/revoke.handler.js

@@ -0,0 +1,27 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const sha256_hex_1 = __importDefault(require("../functions/crypto/sha256.hex"));
+const form_params_1 = __importDefault(require("../functions/http/form.params"));
+const json_response_1 = __importDefault(require("../functions/http/json.response"));
+const text_value_1 = __importDefault(require("../functions/http/text.value"));
+const has_credentials_1 = __importDefault(require("../functions/server/has.credentials"));
+const token_failure_1 = __importDefault(require("../functions/server/token.failure"));
+const revokeHandler = async (context, request) => {
+    const params = (0, form_params_1.default)(request.body);
+    if ((0, has_credentials_1.default)(request, params))
+        return (0, token_failure_1.default)('invalid_client', 'public clients must not send credentials', 401);
+    const value = (0, text_value_1.default)(params.token);
+    const clientId = (0, text_value_1.default)(params.client_id);
+    if (!value || !clientId)
+        return (0, token_failure_1.default)('invalid_request', 'token and client_id are required');
+    const { storage } = context.options;
+    const stored = await storage.findRefreshToken(await (0, sha256_hex_1.default)(value));
+    if (stored && stored.clientId === clientId)
+        await storage.revokeRefreshTokenFamily(stored.familyId, context.now());
+    return (0, json_response_1.default)(200, {}, { 'cache-control': 'no-store', pragma: 'no-cache' });
+};
+exports.default = revokeHandler;
+//# sourceMappingURL=revoke.handler.js.map

package/lib/handlers/revoke.handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revoke.handler.js","sourceRoot":"","sources":["../../src/handlers/revoke.handler.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAEb,gFAAuD;AACvD,gFAAuD;AACvD,oFAA2D;AAC3D,8EAAqD;AACrD,0FAAiE;AACjE,sFAA6D;AAK7D,MAAM,aAAa,GAAG,KAAK,EAAE,OAAgC,EAAE,OAAwB,EAA6B,EAAE;IACrH,MAAM,MAAM,GAA4B,IAAA,qBAAU,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,IAAI,IAAA,yBAAc,EAAC,OAAO,EAAE,MAAM,CAAC;QAAE,OAAO,IAAA,uBAAY,EAAC,gBAAgB,EAAE,0CAA0C,EAAE,GAAG,CAAC,CAAC;IAE5H,MAAM,KAAK,GAAuB,IAAA,oBAAS,EAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAuB,IAAA,oBAAS,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjE,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAA,uBAAY,EAAC,iBAAiB,EAAE,kCAAkC,CAAC,CAAC;IAEpG,MAAM,EAAC,OAAO,EAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,MAAM,IAAA,oBAAS,EAAC,KAAK,CAAC,CAAC,CAAC;IACtE,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,OAAO,CAAC,wBAAwB,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACnH,OAAO,IAAA,uBAAY,EAAC,GAAG,EAAE,EAAE,EAAE,EAAC,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAC,CAAC,CAAC;AACjF,CAAC,CAAC;AACF,kBAAe,aAAa,CAAC"}

package/lib/handlers/token.handler.d.ts

@@ -0,0 +1,5 @@
+import type HttpRequestType from '../types/http.request.type';
+import type HttpResponseType from '../types/http.response.type';
+import type McpAuthContextType from '../types/mcp.auth.context.type';
+declare const tokenHandler: (context: McpAuthContextType<any>, request: HttpRequestType) => Promise<HttpResponseType>;
+export default tokenHandler;

package/lib/handlers/token.handler.js

@@ -0,0 +1,22 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const form_params_1 = __importDefault(require("../functions/http/form.params"));
+const exchange_authorization_code_1 = __importDefault(require("../functions/server/exchange.authorization.code"));
+const has_credentials_1 = __importDefault(require("../functions/server/has.credentials"));
+const rotate_refresh_token_1 = __importDefault(require("../functions/server/rotate.refresh.token"));
+const token_failure_1 = __importDefault(require("../functions/server/token.failure"));
+const tokenHandler = async (context, request) => {
+    const params = (0, form_params_1.default)(request.body);
+    if ((0, has_credentials_1.default)(request, params))
+        return (0, token_failure_1.default)('invalid_client', 'public clients must not send credentials', 401);
+    if ('authorization_code' === params.grant_type)
+        return (0, exchange_authorization_code_1.default)(context, params);
+    if ('refresh_token' === params.grant_type)
+        return (0, rotate_refresh_token_1.default)(context, params);
+    return (0, token_failure_1.default)('unsupported_grant_type', 'grant_type must be authorization_code or refresh_token');
+};
+exports.default = tokenHandler;
+//# sourceMappingURL=token.handler.js.map

package/lib/handlers/token.handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.handler.js","sourceRoot":"","sources":["../../src/handlers/token.handler.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;AAEb,gFAAuD;AACvD,kHAAwF;AACxF,0FAAiE;AACjE,oGAA0E;AAC1E,sFAA6D;AAK7D,MAAM,YAAY,GAAG,KAAK,EAAE,OAAgC,EAAE,OAAwB,EAA6B,EAAE;IACpH,MAAM,MAAM,GAA4B,IAAA,qBAAU,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,IAAI,IAAA,yBAAc,EAAC,OAAO,EAAE,MAAM,CAAC;QAAE,OAAO,IAAA,uBAAY,EAAC,gBAAgB,EAAE,0CAA0C,EAAE,GAAG,CAAC,CAAC;IAC5H,IAAI,oBAAoB,KAAK,MAAM,CAAC,UAAU;QAAE,OAAO,IAAA,qCAAyB,EAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAClG,IAAI,eAAe,KAAK,MAAM,CAAC,UAAU;QAAE,OAAO,IAAA,8BAAkB,EAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACtF,OAAO,IAAA,uBAAY,EAAC,wBAAwB,EAAE,wDAAwD,CAAC,CAAC;AACzG,CAAC,CAAC;AACF,kBAAe,YAAY,CAAC"}

package/lib/mcp.auth.entra.d.ts

@@ -0,0 +1,4 @@
+import entraUpstream from './functions/upstream/entra.upstream';
+export { entraUpstream };
+declare const McpAuthEntra: {};
+export default McpAuthEntra;

package/lib/mcp.auth.entra.js

@@ -0,0 +1,11 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.entraUpstream = void 0;
+const entra_upstream_1 = __importDefault(require("./functions/upstream/entra.upstream"));
+exports.entraUpstream = entra_upstream_1.default;
+const McpAuthEntra = {};
+exports.default = McpAuthEntra;
+//# sourceMappingURL=mcp.auth.entra.js.map

package/lib/mcp.auth.entra.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.auth.entra.js","sourceRoot":"","sources":["../src/mcp.auth.entra.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;;AAEb,yFAAgE;AAExD,wBAFD,wBAAa,CAEC;AACrB,MAAM,YAAY,GAAG,EAAE,CAAC;AACxB,kBAAe,YAAY,CAAC"}

package/lib/mcp.auth.express.d.ts

@@ -0,0 +1,4 @@
+import expressMiddleware from './adapters/express/express.middleware';
+export { expressMiddleware };
+declare const McpAuthExpress: {};
+export default McpAuthExpress;

package/lib/mcp.auth.express.js

@@ -0,0 +1,11 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.expressMiddleware = void 0;
+const express_middleware_1 = __importDefault(require("./adapters/express/express.middleware"));
+exports.expressMiddleware = express_middleware_1.default;
+const McpAuthExpress = {};
+exports.default = McpAuthExpress;
+//# sourceMappingURL=mcp.auth.express.js.map

package/lib/mcp.auth.express.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.auth.express.js","sourceRoot":"","sources":["../src/mcp.auth.express.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;;AAEb,+FAAsE;AAE9D,4BAFD,4BAAiB,CAEC;AACzB,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,kBAAe,cAAc,CAAC"}

package/lib/mcp.auth.fastify.d.ts

@@ -0,0 +1,4 @@
+import fastifyPlugin from './adapters/fastify/fastify.plugin';
+export { fastifyPlugin };
+declare const McpAuthFastify: {};
+export default McpAuthFastify;

package/lib/mcp.auth.fastify.js

@@ -0,0 +1,11 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fastifyPlugin = void 0;
+const fastify_plugin_1 = __importDefault(require("./adapters/fastify/fastify.plugin"));
+exports.fastifyPlugin = fastify_plugin_1.default;
+const McpAuthFastify = {};
+exports.default = McpAuthFastify;
+//# sourceMappingURL=mcp.auth.fastify.js.map

package/lib/mcp.auth.fastify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.auth.fastify.js","sourceRoot":"","sources":["../src/mcp.auth.fastify.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;;AAEb,uFAA8D;AAEtD,wBAFD,wBAAa,CAEC;AACrB,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,kBAAe,cAAc,CAAC"}

package/lib/mcp.auth.fetch.d.ts

@@ -0,0 +1,6 @@
+import createFetchHandler from './adapters/fetch/create.fetch.handler';
+import toHttpRequest from './adapters/fetch/to.http.request';
+import toResponse from './adapters/fetch/to.response';
+export { createFetchHandler, toHttpRequest, toResponse };
+declare const McpAuthFetch: {};
+export default McpAuthFetch;

package/lib/mcp.auth.fetch.js

@@ -0,0 +1,15 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toResponse = exports.toHttpRequest = exports.createFetchHandler = void 0;
+const create_fetch_handler_1 = __importDefault(require("./adapters/fetch/create.fetch.handler"));
+exports.createFetchHandler = create_fetch_handler_1.default;
+const to_http_request_1 = __importDefault(require("./adapters/fetch/to.http.request"));
+exports.toHttpRequest = to_http_request_1.default;
+const to_response_1 = __importDefault(require("./adapters/fetch/to.response"));
+exports.toResponse = to_response_1.default;
+const McpAuthFetch = {};
+exports.default = McpAuthFetch;
+//# sourceMappingURL=mcp.auth.fetch.js.map

package/lib/mcp.auth.fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.auth.fetch.js","sourceRoot":"","sources":["../src/mcp.auth.fetch.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;;AAEb,iGAAuE;AAI/D,6BAJD,8BAAkB,CAIC;AAH1B,uFAA6D;AAGjC,wBAHrB,yBAAa,CAGqB;AAFzC,+EAAsD;AAEX,qBAFpC,qBAAU,CAEoC;AACrD,MAAM,YAAY,GAAG,EAAE,CAAC;AACxB,kBAAe,YAAY,CAAC"}

package/lib/mcp.auth.koa.d.ts

@@ -0,0 +1,4 @@
+import koaMiddleware from './adapters/koa/koa.middleware';
+export { koaMiddleware };
+declare const McpAuthKoa: {};
+export default McpAuthKoa;

package/lib/mcp.auth.koa.js

@@ -0,0 +1,11 @@
+'use strict';
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.koaMiddleware = void 0;
+const koa_middleware_1 = __importDefault(require("./adapters/koa/koa.middleware"));
+exports.koaMiddleware = koa_middleware_1.default;
+const McpAuthKoa = {};
+exports.default = McpAuthKoa;
+//# sourceMappingURL=mcp.auth.koa.js.map