mcp-auth-server 0.0.0-stage → 0.1.1

package/lib/types/mcp.auth.type.d.ts

@@ -0,0 +1,14 @@
+import type AuthenticateResultType from './authenticate.result.type';
+import type HttpRequestType from './http.request.type';
+import type HttpResponseType from './http.response.type';
+import type RouteType from './route.type';
+type McpAuthType<TUser = unknown> = {
+    issuer: string;
+    resource: string;
+    routes: RouteType[];
+    hasRoute: (request: HttpRequestType) => boolean;
+    handle: (request: HttpRequestType) => Promise<HttpResponseType>;
+    authenticate: (headers: HttpRequestType['headers'], rpcBody?: unknown) => Promise<AuthenticateResultType<TUser>>;
+    deleteExpired: () => Promise<void>;
+};
+export default McpAuthType;

package/lib/types/mcp.auth.type.js

@@ -0,0 +1,3 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=mcp.auth.type.js.map

package/lib/types/mcp.auth.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.auth.type.js","sourceRoot":"","sources":["../../src/types/mcp.auth.type.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC"}

package/lib/types/metadata.resolution.type.d.ts

@@ -0,0 +1,9 @@
+import type ClientMetadataType from './client.metadata.type';
+type MetadataResolutionType = {
+    ok: true;
+    metadata: ClientMetadataType;
+} | {
+    ok: false;
+    reason: string;
+};
+export default MetadataResolutionType;

package/lib/types/metadata.resolution.type.js

@@ -0,0 +1,3 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=metadata.resolution.type.js.map

package/lib/types/metadata.resolution.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.resolution.type.js","sourceRoot":"","sources":["../../src/types/metadata.resolution.type.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC"}

package/lib/types/mongo.storage.options.type.d.ts

@@ -0,0 +1,13 @@
+type MongoStorageOptionsType = {
+    collections?: {
+        clients?: string;
+        pendingAuthorizations?: string;
+        authorizationCodes?: string;
+        refreshTokens?: string;
+        consents?: string;
+    };
+    userIdField?: string;
+    userIdToDb?: (userId: string) => unknown;
+    userIdFromDb?: (value: unknown) => string;
+};
+export default MongoStorageOptionsType;

package/lib/types/mongo.storage.options.type.js

@@ -0,0 +1,3 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=mongo.storage.options.type.js.map

package/lib/types/mongo.storage.options.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mongo.storage.options.type.js","sourceRoot":"","sources":["../../src/types/mongo.storage.options.type.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC"}

package/lib/types/oidc.upstream.options.type.d.ts

@@ -0,0 +1,9 @@
+type OidcUpstreamOptionsType = {
+    discoveryUrl: string;
+    clientId: string;
+    clientSecret: string;
+    scope?: string;
+    fetch?: typeof fetch;
+    now?: () => Date;
+};
+export default OidcUpstreamOptionsType;

package/lib/types/oidc.upstream.options.type.js

@@ -0,0 +1,3 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=oidc.upstream.options.type.js.map

package/lib/types/oidc.upstream.options.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.upstream.options.type.js","sourceRoot":"","sources":["../../src/types/oidc.upstream.options.type.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC"}

package/lib/types/pending.authorization.type.d.ts

@@ -0,0 +1,14 @@
+type PendingAuthorizationType = {
+    stateId: string;
+    clientId: string;
+    clientName?: string;
+    redirectUri: string;
+    codeChallenge: string;
+    resource: string;
+    clientState?: string;
+    upstreamCodeVerifier?: string;
+    userId?: string;
+    userDisplayName?: string;
+    expiresAt: Date;
+};
+export default PendingAuthorizationType;

package/lib/types/pending.authorization.type.js

@@ -0,0 +1,3 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=pending.authorization.type.js.map

package/lib/types/pending.authorization.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending.authorization.type.js","sourceRoot":"","sources":["../../src/types/pending.authorization.type.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC"}

package/lib/types/pending.filter.type.d.ts

@@ -0,0 +1,5 @@
+type PendingFilterType = {
+    now: Date;
+    hasUser?: boolean;
+};
+export default PendingFilterType;

package/lib/types/pending.filter.type.js

@@ -0,0 +1,3 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=pending.filter.type.js.map

package/lib/types/pending.filter.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending.filter.type.js","sourceRoot":"","sources":["../../src/types/pending.filter.type.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC"}

package/lib/types/redirect.policy.type.d.ts

@@ -0,0 +1,5 @@
+type RedirectPolicyType = {
+    httpsHosts: string[];
+    customSchemes: string[];
+};
+export default RedirectPolicyType;

package/lib/types/redirect.policy.type.js

@@ -0,0 +1,3 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=redirect.policy.type.js.map

package/lib/types/redirect.policy.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect.policy.type.js","sourceRoot":"","sources":["../../src/types/redirect.policy.type.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC"}

package/lib/types/refresh.token.record.type.d.ts

@@ -0,0 +1,11 @@
+type RefreshTokenRecordType = {
+    tokenHash: string;
+    familyId: string;
+    clientId: string;
+    userId: string;
+    resource: string;
+    usedAt?: Date;
+    revokedAt?: Date;
+    expiresAt: Date;
+};
+export default RefreshTokenRecordType;

package/lib/types/refresh.token.record.type.js

@@ -0,0 +1,3 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=refresh.token.record.type.js.map

package/lib/types/refresh.token.record.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.token.record.type.js","sourceRoot":"","sources":["../../src/types/refresh.token.record.type.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC"}

package/lib/types/resolved.client.type.d.ts

@@ -0,0 +1,7 @@
+type ResolvedClientType = {
+    clientId: string;
+    clientName?: string;
+    redirectUris: string[];
+    metadataDocument: boolean;
+};
+export default ResolvedClientType;

package/lib/types/resolved.client.type.js

@@ -0,0 +1,3 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=resolved.client.type.js.map

package/lib/types/resolved.client.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolved.client.type.js","sourceRoot":"","sources":["../../src/types/resolved.client.type.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC"}

package/lib/types/route.name.type.d.ts

@@ -0,0 +1,2 @@
+type RouteNameType = 'register' | 'token' | 'revoke' | 'authorize' | 'callback' | 'resume' | 'consent' | 'metadata';
+export default RouteNameType;

package/lib/types/route.name.type.js

@@ -0,0 +1,3 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=route.name.type.js.map

package/lib/types/route.name.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.name.type.js","sourceRoot":"","sources":["../../src/types/route.name.type.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC"}

package/lib/types/route.type.d.ts

@@ -0,0 +1,10 @@
+import type HttpRequestType from './http.request.type';
+import type HttpResponseType from './http.response.type';
+import type RouteNameType from './route.name.type';
+type RouteType = {
+    method: 'GET' | 'POST';
+    path: string;
+    name: RouteNameType;
+    handler: (request: HttpRequestType) => Promise<HttpResponseType>;
+};
+export default RouteType;

package/lib/types/route.type.js

@@ -0,0 +1,3 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=route.type.js.map

package/lib/types/route.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.type.js","sourceRoot":"","sources":["../../src/types/route.type.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC"}

package/lib/types/sql.dialect.type.d.ts

@@ -0,0 +1,2 @@
+type SqlDialectType = 'postgres' | 'sqlite';
+export default SqlDialectType;

package/lib/types/sql.dialect.type.js

@@ -0,0 +1,3 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=sql.dialect.type.js.map

package/lib/types/sql.dialect.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql.dialect.type.js","sourceRoot":"","sources":["../../src/types/sql.dialect.type.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC"}

package/lib/types/sql.executor.type.d.ts

@@ -0,0 +1,4 @@
+type SqlRowType = Record<string, unknown>;
+type SqlExecutorType = (sql: string, params: unknown[]) => Promise<SqlRowType[]> | SqlRowType[];
+export type { SqlRowType };
+export default SqlExecutorType;

package/lib/types/sql.executor.type.js

@@ -0,0 +1,3 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=sql.executor.type.js.map

package/lib/types/sql.executor.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql.executor.type.js","sourceRoot":"","sources":["../../src/types/sql.executor.type.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC"}

package/lib/types/sql.storage.options.type.d.ts

@@ -0,0 +1,4 @@
+type SqlStorageOptionsType = {
+    tablePrefix?: string;
+};
+export default SqlStorageOptionsType;

package/lib/types/sql.storage.options.type.js

@@ -0,0 +1,3 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=sql.storage.options.type.js.map

package/lib/types/sql.storage.options.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql.storage.options.type.js","sourceRoot":"","sources":["../../src/types/sql.storage.options.type.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC"}

package/lib/types/upstream.begin.type.d.ts

@@ -0,0 +1,9 @@
+import type AuthenticatedUserType from './authenticated.user.type';
+type UpstreamBeginType = {
+    type: 'redirect';
+    url: string;
+} | {
+    type: 'user';
+    user: AuthenticatedUserType;
+};
+export default UpstreamBeginType;

package/lib/types/upstream.begin.type.js

@@ -0,0 +1,3 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=upstream.begin.type.js.map

package/lib/types/upstream.begin.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream.begin.type.js","sourceRoot":"","sources":["../../src/types/upstream.begin.type.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC"}

package/lib/types/upstream.context.type.d.ts

@@ -0,0 +1,10 @@
+import type HttpRequestType from './http.request.type';
+import type PendingAuthorizationType from './pending.authorization.type';
+type UpstreamContextType = {
+    request: HttpRequestType;
+    pending: PendingAuthorizationType;
+    issuer: string;
+    callbackUrl: string;
+    resumeUrl: string;
+};
+export default UpstreamContextType;

package/lib/types/upstream.context.type.js

@@ -0,0 +1,3 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=upstream.context.type.js.map

package/lib/types/upstream.context.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream.context.type.js","sourceRoot":"","sources":["../../src/types/upstream.context.type.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC"}

package/lib/types/verify.result.type.d.ts

@@ -0,0 +1,6 @@
+type VerifyResultType = {
+    claims: Record<string, unknown>;
+} | {
+    reason: 'expired' | 'invalid_token';
+};
+export default VerifyResultType;

package/lib/types/verify.result.type.js

@@ -0,0 +1,3 @@
+'use strict';
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=verify.result.type.js.map

package/lib/types/verify.result.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.result.type.js","sourceRoot":"","sources":["../../src/types/verify.result.type.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC"}

package/package.json

@@ -1,6 +1,108 @@
 {
-  "name": "mcp-auth-server",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+	"name": "mcp-auth-server",
+	"version": "0.1.1",
+	"description": "OAuth 2.1 authorization server for MCP servers, runtime-agnostic",
+	"license": "MIT",
+	"files": [
+		"lib/**/*",
+		"sql/**/*"
+	],
+	"bin": {
+		"mcp-auth-keygen": "./bin/keygen.mjs"
+	},
+	"main": "./lib/mcp.auth.server.js",
+	"types": "./lib/mcp.auth.server.d.ts",
+	"scripts": {
+		"all": "pnpm i && pnpm dedupe && (pnpm audit --fix=update || echo audit: unresolved vulnerabilities remain) && pnpm clean && pnpm format && pnpm build && skeletest -f && strictr -f && pnpm test && pnpm integration && pnpm run docs mcp-auth-server",
+		"clear:lib": "node -e \"require('node:fs').rmSync('lib',{recursive:true,force:true})\"",
+		"build": "pnpm clear:lib && tsc",
+		"build:watch": "tsc --watch",
+		"lint": "eslint .",
+		"clean": "eslint --fix .",
+		"format": "prettier --write \"src/**/*.ts\" \"test/**/*.ts\"",
+		"docs": "typedoc --readme none --out docs ./src/mcp.auth.server.ts",
+		"sync": "git pull && git fetch origin && git merge origin/main && pnpm i && git branch",
+		"test": "node --experimental-vm-modules ./node_modules/jest/bin/jest.js --coverage --config jest.config.js",
+		"integration": "ts-node test/integration/storage.integration.ts",
+		"quick": "node --experimental-vm-modules ./node_modules/jest/bin/jest.js --config jest.config.js",
+		"test:watch": "node --experimental-vm-modules ./node_modules/jest/bin/jest.js --watch --config jest.config.js",
+		"coveralls": "coveralls < coverage/lcov.info",
+		"test_qube": "node --experimental-vm-modules ./node_modules/jest/bin/jest.js --coverage --config jest.config.js --testResultsProcessor=jest-sonar-reporter",
+		"up": "pnpm up -i",
+		"latest": "pnpm up -i -L",
+		"l": "pnpm i && pnpm latest",
+		"srctree": "node -e \"const fs=require('node:fs'),path=require('node:path');fs.readdirSync('src',{recursive:true}).forEach(f=>console.log(path.resolve('src',f)))\" > srctree.txt",
+		"keygen": "node bin/keygen.mjs",
+		"preinstall": "npx only-allow pnpm"
+	},
+	"engines": {
+		"node": ">=24.12.0"
+	},
+	"packageManager": "pnpm@12.15.0",
+	"author": "Predrag Stojadinovic <predrag@stojadinovic.net>",
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/cope/mcp-auth-server.git"
+	},
+	"publishConfig": {
+		"access": "public"
+	},
+	"minimumReleaseAge": 2880,
+	"dependencies": {
+		"jose": "^5.10.0"
+	},
+	"devDependencies": {
+		"@electric-sql/pglite": "^0.5.12",
+		"@eslint/js": "^10.0.1",
+		"@types/better-sqlite3": "^9.6.0",
+		"@types/express": "^5.0.6",
+		"@types/jest": "^30.0.0",
+		"@types/koa": "^3.0.3",
+		"@types/node": "^26.6.5",
+		"@types/pg": "^8.23.1",
+		"@types/rewire": "^2.5.30",
+		"better-sqlite3": "^13.0.3",
+		"coveralls": "^3.1.1",
+		"eslint": "^10.13.0",
+		"eslint-config-prettier": "^10.1.8",
+		"eslint-plugin-sonarjs": "^4.2.2",
+		"express": "^5.3.0",
+		"fastify": "^5.12.7",
+		"jest": "^30.5.2",
+		"jest-sonar-reporter": "^2.0.0",
+		"koa": "^3.2.1",
+		"mongodb": "^7.7.0",
+		"mongodb-memory-server": "^11.3.0",
+		"pg": "^8.23.1",
+		"prettier": "^3.9.10",
+		"rewire": "^9.0.1",
+		"skeletest": "^0.7.5",
+		"source-map-support": "^0.5.21",
+		"strictr": "^0.5.7",
+		"ts-jest": "^29.4.15",
+		"ts-node": "^10.9.2",
+		"typedoc": "^0.28.20",
+		"typescript": "^6.0.3",
+		"typescript-eslint": "^8.72.1"
+	},
+	"peerDependencies": {
+		"express": ">=4",
+		"fastify": ">=4",
+		"koa": ">=2",
+		"mongodb": ">=6"
+	},
+	"peerDependenciesMeta": {
+		"express": {
+			"optional": true
+		},
+		"fastify": {
+			"optional": true
+		},
+		"koa": {
+			"optional": true
+		},
+		"mongodb": {
+			"optional": true
+		}
+	}
+}

package/sql/postgres.sql

@@ -0,0 +1,61 @@
+CREATE TABLE IF NOT EXISTS mcp_oauth_clients (
+	client_id TEXT PRIMARY KEY,
+	client_name TEXT,
+	redirect_uris TEXT NOT NULL,
+	application_type TEXT,
+	token_endpoint_auth_method TEXT NOT NULL,
+	grant_types TEXT NOT NULL,
+	response_types TEXT NOT NULL,
+	created_at BIGINT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS mcp_oauth_pending_authorizations (
+	state_id TEXT PRIMARY KEY,
+	client_id TEXT NOT NULL,
+	client_name TEXT,
+	redirect_uri TEXT NOT NULL,
+	code_challenge TEXT NOT NULL,
+	resource TEXT NOT NULL,
+	client_state TEXT,
+	upstream_code_verifier TEXT,
+	user_id TEXT,
+	user_display_name TEXT,
+	expires_at BIGINT NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS mcp_oauth_pending_expires_idx ON mcp_oauth_pending_authorizations (expires_at);
+
+CREATE TABLE IF NOT EXISTS mcp_oauth_authorization_codes (
+	code_hash TEXT PRIMARY KEY,
+	client_id TEXT NOT NULL,
+	redirect_uri TEXT NOT NULL,
+	code_challenge TEXT NOT NULL,
+	resource TEXT NOT NULL,
+	user_id TEXT NOT NULL,
+	used_at BIGINT,
+	expires_at BIGINT NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS mcp_oauth_codes_expires_idx ON mcp_oauth_authorization_codes (expires_at);
+
+CREATE TABLE IF NOT EXISTS mcp_oauth_refresh_tokens (
+	token_hash TEXT PRIMARY KEY,
+	family_id TEXT NOT NULL,
+	client_id TEXT NOT NULL,
+	user_id TEXT NOT NULL,
+	resource TEXT NOT NULL,
+	used_at BIGINT,
+	revoked_at BIGINT,
+	expires_at BIGINT NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS mcp_oauth_refresh_family_idx ON mcp_oauth_refresh_tokens (family_id);
+
+CREATE INDEX IF NOT EXISTS mcp_oauth_refresh_expires_idx ON mcp_oauth_refresh_tokens (expires_at);
+
+CREATE TABLE IF NOT EXISTS mcp_oauth_consents (
+	client_id TEXT NOT NULL,
+	user_id TEXT NOT NULL,
+	created_at BIGINT NOT NULL,
+	PRIMARY KEY (client_id, user_id)
+);

package/sql/sqlite.sql

@@ -0,0 +1,61 @@
+CREATE TABLE IF NOT EXISTS mcp_oauth_clients (
+	client_id TEXT PRIMARY KEY,
+	client_name TEXT,
+	redirect_uris TEXT NOT NULL,
+	application_type TEXT,
+	token_endpoint_auth_method TEXT NOT NULL,
+	grant_types TEXT NOT NULL,
+	response_types TEXT NOT NULL,
+	created_at INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS mcp_oauth_pending_authorizations (
+	state_id TEXT PRIMARY KEY,
+	client_id TEXT NOT NULL,
+	client_name TEXT,
+	redirect_uri TEXT NOT NULL,
+	code_challenge TEXT NOT NULL,
+	resource TEXT NOT NULL,
+	client_state TEXT,
+	upstream_code_verifier TEXT,
+	user_id TEXT,
+	user_display_name TEXT,
+	expires_at INTEGER NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS mcp_oauth_pending_expires_idx ON mcp_oauth_pending_authorizations (expires_at);
+
+CREATE TABLE IF NOT EXISTS mcp_oauth_authorization_codes (
+	code_hash TEXT PRIMARY KEY,
+	client_id TEXT NOT NULL,
+	redirect_uri TEXT NOT NULL,
+	code_challenge TEXT NOT NULL,
+	resource TEXT NOT NULL,
+	user_id TEXT NOT NULL,
+	used_at INTEGER,
+	expires_at INTEGER NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS mcp_oauth_codes_expires_idx ON mcp_oauth_authorization_codes (expires_at);
+
+CREATE TABLE IF NOT EXISTS mcp_oauth_refresh_tokens (
+	token_hash TEXT PRIMARY KEY,
+	family_id TEXT NOT NULL,
+	client_id TEXT NOT NULL,
+	user_id TEXT NOT NULL,
+	resource TEXT NOT NULL,
+	used_at INTEGER,
+	revoked_at INTEGER,
+	expires_at INTEGER NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS mcp_oauth_refresh_family_idx ON mcp_oauth_refresh_tokens (family_id);
+
+CREATE INDEX IF NOT EXISTS mcp_oauth_refresh_expires_idx ON mcp_oauth_refresh_tokens (expires_at);
+
+CREATE TABLE IF NOT EXISTS mcp_oauth_consents (
+	client_id TEXT NOT NULL,
+	user_id TEXT NOT NULL,
+	created_at INTEGER NOT NULL,
+	PRIMARY KEY (client_id, user_id)
+);