mcp-creatio 0.3.10 → 0.4.1

package/dist/server/http/creatio-oauth-handlers.js

@@ -7,6 +7,7 @@ exports.CreatioOAuthHandlers = void 0;
 const log_1 = __importDefault(require("../../log"));
 const services_1 = require("../../services");
 const utils_1 = require("../../utils");
+const oauth_1 = require("../oauth");
 class CreatioOAuthHandlers {
     _sessionContext = services_1.SessionContext.instance;
     _server;
@@ -15,14 +16,6 @@ class CreatioOAuthHandlers {
         this._server = server;
         this._oauthServer = oauthServer;
     }
-    _mapAllSessionsToUser(userKey) {
-        const sessions = this._sessionContext.getAllSessions();
-        const sessionIds = sessions.map((s) => s.id);
-        log_1.default.info('mapping_all_sessions', { userKey, sessionCount: sessionIds.length, sessionIds });
-        for (const sessionId of sessionIds) {
-            this._sessionContext.setSessionUserKey(sessionId, userKey);
-        }
-    }
     async handleOAuthStart(req, res) {
         try {
             const userKey = req.query.userKey;
@@ -32,7 +25,10 @@ class CreatioOAuthHandlers {
                 res.status(400).send('Missing userKey parameter. Add ?userKey=your_user_key to URL');
                 return;
             }
-            const state = this._sessionContext.createOAuthState(effectiveUserKey);
+            // Bind the OAuth state to the session that initiated the flow (if any),
+            // so the callback maps only that session — never every active session (CWE-639).
+            const initiatingSessionId = (0, utils_1.getSessionIdFromRequest)(req) ?? undefined;
+            const state = this._sessionContext.createOAuthState(effectiveUserKey, initiatingSessionId);
             const url = await this._server.authProvider.getAuthorizeUrl(state);
             const mcpParams = req.query;
             if (mcpParams.client_id && mcpParams.redirect_uri) {
@@ -53,9 +49,8 @@ class CreatioOAuthHandlers {
             const code = String(req.query?.code ?? '') || String(req.body?.code ?? '');
             const state = String(req.query?.state ?? '') || String(req.body?.state ?? '');
             log_1.default.info('oauth.callback.start', {
-                code: code ? '***' + code.slice(-4) : 'missing',
-                state: state ? state.substring(0, 50) + '...' : 'missing',
-                fullState: state,
+                hasCode: !!code,
+                hasState: !!state,
             });
             if (!code || !state) {
                 res.status(400).send('Missing code or state');
@@ -64,36 +59,46 @@ class CreatioOAuthHandlers {
             const stateParts = state.split('&');
             const creatioState = stateParts[0];
             log_1.default.info('oauth.callback.state_parse', {
-                originalState: state,
-                creatioState,
                 hasMcpParams: stateParts.length > 1,
             });
             if (!creatioState) {
-                log_1.default.error('oauth.callback.no_creatio_state', { originalState: state });
+                log_1.default.error('oauth.callback.no_creatio_state');
                 res.status(400).send('Invalid state format');
                 return;
             }
-            const userKey = this._sessionContext.validateAndConsumeOAuthState(creatioState);
-            if (!userKey) {
-                log_1.default.error('oauth.callback.creatio_state_invalid', { creatioState });
+            const stateResult = this._sessionContext.validateAndConsumeOAuthState(creatioState);
+            if (!stateResult) {
+                log_1.default.error('oauth.callback.creatio_state_invalid');
                 res.status(400).send('Unknown or expired state');
                 return;
             }
+            const { userKey, sessionId: boundSessionId } = stateResult;
             await (0, utils_1.runWithContext)({ userKey }, async () => this._server.authProvider.finishAuthorization(code));
-            this._mapAllSessionsToUser(userKey);
+            // Map ONLY the session that initiated this flow, if it still exists.
+            // Bearer-token MCP clients carry their identity in the issued JWT and need
+            // no session mapping at all.
+            if (boundSessionId && this._sessionContext.hasSession(boundSessionId)) {
+                this._sessionContext.mapSessionToUser(boundSessionId, userKey);
+            }
             const stateParams = new URLSearchParams(state);
             const clientId = stateParams.get('client_id');
             const redirectUri = stateParams.get('redirect_uri');
             const codeChallenge = stateParams.get('code_challenge');
             if (clientId && redirectUri && codeChallenge) {
+                // Re-validate the redirect target before emitting any redirect: the MCP params
+                // are appended to the state in plaintext and must not be trusted blindly (CWE-601).
+                if (!oauth_1.OAuthValidators.isAllowedRedirectUri(redirectUri)) {
+                    log_1.default.error('oauth.callback.redirect_uri_disallowed', { clientId });
+                    res.status(400).send('Disallowed redirect_uri');
+                    return;
+                }
                 const mcpState = stateParams.get('mcp_state');
                 log_1.default.info('oauth.callback.state_validation', {
-                    mcpState,
                     clientId,
                     hasState: !!mcpState,
                 });
                 if (mcpState && !this._oauthServer.validateState(mcpState, clientId)) {
-                    log_1.default.error('oauth.callback.state_invalid', { mcpState, clientId });
+                    log_1.default.error('oauth.callback.state_invalid', { clientId });
                     const errorUrl = new URL(redirectUri);
                     errorUrl.searchParams.set('error', 'invalid_request');
                     errorUrl.searchParams.set('error_description', 'Unknown or expired state');
@@ -119,9 +124,11 @@ class CreatioOAuthHandlers {
     }
     async handleOAuthRevoke(req, res) {
         try {
-            const userKey = req.query.userKey || req.body?.userKey;
+            // Identity comes ONLY from the validated Bearer token (set by bearerAuth middleware).
+            // A caller must never be able to revoke another user's tokens via ?userKey= (CWE-639).
+            const userKey = req.userKey;
             if (!userKey) {
-                res.status(400).send('Missing userKey parameter');
+                res.status(401).send('Valid Bearer token required');
                 return;
             }
             await (0, utils_1.runWithContext)({ userKey }, async () => this._server.authProvider.revoke());

package/dist/server/http/creatio-oauth-handlers.js.map

@@ -1 +1 @@
-{"version":3,"file":"creatio-oauth-handlers.js","sourceRoot":"","sources":["../../../src/server/http/creatio-oauth-handlers.ts"],"names":[],"mappings":";;;;;;AAAA,oDAA4B;AAC5B,6CAAgD;AAChD,uCAA6C;AAM7C,MAAa,oBAAoB;IACf,eAAe,GAAG,yBAAc,CAAC,QAAQ,CAAC;IAC1C,OAAO,CAAS;IAChB,YAAY,CAAc;IAE3C,YAAY,MAAc,EAAE,WAAwB;QACnD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;IACjC,CAAC;IAEO,qBAAqB,CAAC,OAAe;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,cAAc,EAAE,CAAC;QACvD,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7C,aAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QAC3F,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACpC,IAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC5D,CAAC;IACF,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAAC,GAAY,EAAE,GAAa;QACxD,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,OAAiB,CAAC;YAC5C,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,OAAiB,CAAC;YAC5C,MAAM,gBAAgB,GAAG,OAAO,IAAI,OAAO,CAAC;YAC5C,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACvB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CACnB,8DAA8D,CAC9D,CAAC;gBACF,OAAO;YACR,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;YACtE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YACnE,MAAM,SAAS,GAAG,GAAG,CAAC,KAAY,CAAC;YACnC,IAAI,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC;gBACnD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC5B,MAAM,YAAY,GAAG,GAAG,KAAK,cAAc,SAAS,CAAC,SAAS,iBAAiB,kBAAkB,CAAC,SAAS,CAAC,YAAY,CAAC,mBAAmB,SAAS,CAAC,cAAc,0BAA0B,SAAS,CAAC,qBAAqB,cAAc,SAAS,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;gBACnQ,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;gBAC/C,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC7C,CAAC;YACD,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YACnB,aAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;YACvE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAC5C,CAAC;IACF,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAAC,GAAY,EAAE,GAAa;QAC3D,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,IAAI,MAAM,CAAE,GAAW,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;YACpF,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,MAAM,CAAE,GAAW,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YACvF,aAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE;gBAChC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC/C,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS;gBACzD,SAAS,EAAE,KAAK;aAChB,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;gBAC9C,OAAO;YACR,CAAC;YACD,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YACnC,aAAG,CAAC,IAAI,CAAC,4BAA4B,EAAE;gBACtC,aAAa,EAAE,KAAK;gBACpB,YAAY;gBACZ,YAAY,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC;aACnC,CAAC,CAAC;YACH,IAAI,CAAC,YAAY,EAAE,CAAC;gBACnB,aAAG,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;gBACvE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;gBAC7C,OAAO;YACR,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YAChF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,aAAG,CAAC,KAAK,CAAC,sCAAsC,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;gBACpE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;gBACjD,OAAO;YACR,CAAC;YACD,MAAM,IAAA,sBAAc,EAAC,EAAE,OAAO,EAAE,EAAE,KAAK,IAAI,EAAE,CAC5C,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,mBAAmB,CAAC,IAAI,CAAC,CACnD,CAAC;YACF,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;YACpC,MAAM,WAAW,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC9C,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YACpD,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YACxD,IAAI,QAAQ,IAAI,WAAW,IAAI,aAAa,EAAE,CAAC;gBAC9C,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBAC9C,aAAG,CAAC,IAAI,CAAC,iCAAiC,EAAE;oBAC3C,QAAQ;oBACR,QAAQ;oBACR,QAAQ,EAAE,CAAC,CAAC,QAAQ;iBACpB,CAAC,CAAC;gBACH,IAAI,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;oBACtE,aAAG,CAAC,KAAK,CAAC,8BAA8B,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;oBAClE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;oBACtC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;oBACtD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,0BAA0B,CAAC,CAAC;oBAC3E,IAAI,QAAQ,EAAE,CAAC;wBACd,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;oBAC9C,CAAC;oBACD,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC1C,CAAC;gBACD,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,yBAAyB,CAC3D,QAAQ,EACR,WAAW,EACX,aAAa,EACb,WAAW,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,MAAM,EAClD,OAAO,CACP,CAAC;gBACF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;gBACzC,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC/C,IAAI,QAAQ,EAAE,CAAC;oBACd,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBACjD,CAAC;gBACD,OAAO,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC7C,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YACnB,aAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAC/C,CAAC;IACF,CAAC;IAEM,KAAK,CAAC,iBAAiB,CAAC,GAAY,EAAE,GAAa;QACzD,IAAI,CAAC;YACJ,MAAM,OAAO,GAAI,GAAG,CAAC,KAAK,CAAC,OAAkB,IAAK,GAAG,CAAC,IAAI,EAAE,OAAkB,CAAC;YAC/E,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;gBAClD,OAAO;YACR,CAAC;YACD,MAAM,IAAA,sBAAc,EAAC,EAAE,OAAO,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;YAClF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YACnB,aAAG,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;YACxE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC7C,CAAC;IACF,CAAC;CACD;AAzID,oDAyIC"}
+{"version":3,"file":"creatio-oauth-handlers.js","sourceRoot":"","sources":["../../../src/server/http/creatio-oauth-handlers.ts"],"names":[],"mappings":";;;;;;AAAA,oDAA4B;AAC5B,6CAAgD;AAChD,uCAAsE;AACtE,oCAA2C;AAM3C,MAAa,oBAAoB;IACf,eAAe,GAAG,yBAAc,CAAC,QAAQ,CAAC;IAC1C,OAAO,CAAS;IAChB,YAAY,CAAc;IAE3C,YAAY,MAAc,EAAE,WAAwB;QACnD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;IACjC,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAAC,GAAY,EAAE,GAAa;QACxD,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,OAAiB,CAAC;YAC5C,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,OAAiB,CAAC;YAC5C,MAAM,gBAAgB,GAAG,OAAO,IAAI,OAAO,CAAC;YAC5C,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACvB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CACnB,8DAA8D,CAC9D,CAAC;gBACF,OAAO;YACR,CAAC;YACD,wEAAwE;YACxE,iFAAiF;YACjF,MAAM,mBAAmB,GAAG,IAAA,+BAAuB,EAAC,GAAG,CAAC,IAAI,SAAS,CAAC;YACtE,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAClD,gBAAgB,EAChB,mBAAmB,CACnB,CAAC;YACF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YACnE,MAAM,SAAS,GAAG,GAAG,CAAC,KAAY,CAAC;YACnC,IAAI,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC;gBACnD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC5B,MAAM,YAAY,GAAG,GAAG,KAAK,cAAc,SAAS,CAAC,SAAS,iBAAiB,kBAAkB,CAAC,SAAS,CAAC,YAAY,CAAC,mBAAmB,SAAS,CAAC,cAAc,0BAA0B,SAAS,CAAC,qBAAqB,cAAc,SAAS,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;gBACnQ,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;gBAC/C,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC7C,CAAC;YACD,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YACnB,aAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;YACvE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAC5C,CAAC;IACF,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAAC,GAAY,EAAE,GAAa;QAC3D,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,IAAI,MAAM,CAAE,GAAW,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;YACpF,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,MAAM,CAAE,GAAW,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YACvF,aAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE;gBAChC,OAAO,EAAE,CAAC,CAAC,IAAI;gBACf,QAAQ,EAAE,CAAC,CAAC,KAAK;aACjB,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;gBAC9C,OAAO;YACR,CAAC;YACD,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YACnC,aAAG,CAAC,IAAI,CAAC,4BAA4B,EAAE;gBACtC,YAAY,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC;aACnC,CAAC,CAAC;YACH,IAAI,CAAC,YAAY,EAAE,CAAC;gBACnB,aAAG,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;gBAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;gBAC7C,OAAO;YACR,CAAC;YACD,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YACpF,IAAI,CAAC,WAAW,EAAE,CAAC;gBAClB,aAAG,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;gBAClD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;gBACjD,OAAO;YACR,CAAC;YACD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,WAAW,CAAC;YAC3D,MAAM,IAAA,sBAAc,EAAC,EAAE,OAAO,EAAE,EAAE,KAAK,IAAI,EAAE,CAC5C,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,mBAAmB,CAAC,IAAI,CAAC,CACnD,CAAC;YACF,qEAAqE;YACrE,2EAA2E;YAC3E,6BAA6B;YAC7B,IAAI,cAAc,IAAI,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;gBACvE,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,WAAW,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC9C,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YACpD,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YACxD,IAAI,QAAQ,IAAI,WAAW,IAAI,aAAa,EAAE,CAAC;gBAC9C,+EAA+E;gBAC/E,oFAAoF;gBACpF,IAAI,CAAC,uBAAe,CAAC,oBAAoB,CAAC,WAAW,CAAC,EAAE,CAAC;oBACxD,aAAG,CAAC,KAAK,CAAC,wCAAwC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;oBAClE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;oBAChD,OAAO;gBACR,CAAC;gBACD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBAC9C,aAAG,CAAC,IAAI,CAAC,iCAAiC,EAAE;oBAC3C,QAAQ;oBACR,QAAQ,EAAE,CAAC,CAAC,QAAQ;iBACpB,CAAC,CAAC;gBACH,IAAI,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;oBACtE,aAAG,CAAC,KAAK,CAAC,8BAA8B,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;oBACxD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;oBACtC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;oBACtD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,0BAA0B,CAAC,CAAC;oBAC3E,IAAI,QAAQ,EAAE,CAAC;wBACd,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;oBAC9C,CAAC;oBACD,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC1C,CAAC;gBACD,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,yBAAyB,CAC3D,QAAQ,EACR,WAAW,EACX,aAAa,EACb,WAAW,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,MAAM,EAClD,OAAO,CACP,CAAC;gBACF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;gBACzC,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC/C,IAAI,QAAQ,EAAE,CAAC;oBACd,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBACjD,CAAC;gBACD,OAAO,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC7C,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YACnB,aAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAC/C,CAAC;IACF,CAAC;IAEM,KAAK,CAAC,iBAAiB,CAAC,GAAY,EAAE,GAAa;QACzD,IAAI,CAAC;YACJ,sFAAsF;YACtF,uFAAuF;YACvF,MAAM,OAAO,GAAI,GAAW,CAAC,OAA6B,CAAC;YAC3D,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;gBACpD,OAAO;YACR,CAAC;YACD,MAAM,IAAA,sBAAc,EAAC,EAAE,OAAO,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;YAClF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YACnB,aAAG,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;YACxE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC7C,CAAC;IACF,CAAC;CACD;AAjJD,oDAiJC"}

package/dist/server/http/httpServer.d.ts

@@ -1,15 +1,24 @@
+import express from 'express';
 import type { Server } from '../mcp';
 export declare class HttpServer {
+    private static readonly CLEANUP_INTERVAL_MS;
+    private static readonly BODY_LIMIT;
+    private static readonly RATE_LIMIT_AUTH_FLOW;
+    private static readonly RATE_LIMIT_TOKEN;
+    private static readonly RATE_LIMIT_REGISTER;
+    private static readonly RATE_LIMIT_REVOKE;
     private readonly _server;
     private readonly _app;
     private readonly _connections;
     private _srv;
+    private _cleanupTimer;
     private readonly _sessionContext;
     private readonly _oauthServer;
     private readonly _middleware;
     private readonly _mcpHandlers;
     private readonly _creatioOauthHandlers;
     private readonly _mcpOauthHandlers;
+    get app(): express.Express;
     constructor(server: Server);
     private _setupMiddleware;
     private _setupRoutes;

package/dist/server/http/httpServer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"httpServer.d.ts","sourceRoot":"","sources":["../../../src/server/http/httpServer.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAErC,qBAAa,UAAU;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;IAClC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAClD,OAAO,CAAC,IAAI,CAAe;IAC3B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA2B;IAC3D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAc;IAC3C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAiB;IAC7C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAc;IAC3C,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAuB;IAC7D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAmB;gBAEzC,MAAM,EAAE,MAAM;IAW1B,OAAO,CAAC,gBAAgB;IAWxB,OAAO,CAAC,YAAY;IAQpB,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,eAAe;IAIvB,OAAO,CAAC,2BAA2B;IAYnC,OAAO,CAAC,uBAAuB;IAexB,KAAK,CAAC,IAAI,EAAE,MAAM;IAmBZ,IAAI;CAkCjB"}
+{"version":3,"file":"httpServer.d.ts","sourceRoot":"","sources":["../../../src/server/http/httpServer.ts"],"names":[],"mappings":"AAGA,OAAO,OAAO,MAAM,SAAS,CAAC;AAa9B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAErC,qBAAa,UAAU;IACtB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAiB;IAG5D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAsC;IAExE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAiC;IAC7E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAiC;IACzE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAiC;IAC5E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAiC;IAC1E,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;IAClC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAClD,OAAO,CAAC,IAAI,CAAe;IAC3B,OAAO,CAAC,aAAa,CAA6B;IAClD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA2B;IAC3D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAc;IAC3C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAiB;IAC7C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAc;IAC3C,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAuB;IAC7D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAmB;IAErD,IAAW,GAAG,IAAI,OAAO,CAAC,OAAO,CAEhC;gBAEW,MAAM,EAAE,MAAM;IAW1B,OAAO,CAAC,gBAAgB;IAWxB,OAAO,CAAC,YAAY;IAQpB,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,eAAe;IAIvB,OAAO,CAAC,2BAA2B;IAmBnC,OAAO,CAAC,uBAAuB;IAqBxB,KAAK,CAAC,IAAI,EAAE,MAAM;IA0BZ,IAAI;CAoCjB"}

package/dist/server/http/httpServer.js

@@ -8,22 +8,36 @@ const express_1 = __importDefault(require("express"));
 const creatio_1 = require("../../creatio/");
 const log_1 = __importDefault(require("../../log"));
 const services_1 = require("../../services");
+const utils_1 = require("../../utils");
 const oauth_1 = require("../oauth");
 const creatio_oauth_handlers_1 = require("./creatio-oauth-handlers");
 const mcp_handlers_1 = require("./mcp-handlers");
 const mcp_oauth_handlers_1 = require("./mcp-oauth-handlers");
 const middleware_1 = require("./middleware");
 class HttpServer {
+    static CLEANUP_INTERVAL_MS = 5 * 60 * 1000;
+    // Generous, configurable cap so large CRM payloads/filters are not truncated.
+    // DoS on the OAuth surface is handled by the rate limiter (frequency), not body size.
+    static BODY_LIMIT = (0, utils_1.env)('MCP_MAX_BODY_SIZE') || '10mb';
+    // Per-route fixed-window limits (per client IP) for the unauthenticated OAuth surface.
+    static RATE_LIMIT_AUTH_FLOW = { windowMs: 60_000, max: 60 };
+    static RATE_LIMIT_TOKEN = { windowMs: 60_000, max: 30 };
+    static RATE_LIMIT_REGISTER = { windowMs: 60_000, max: 10 };
+    static RATE_LIMIT_REVOKE = { windowMs: 60_000, max: 20 };
     _server;
     _app = (0, express_1.default)();
     _connections = new Set();
     _srv;
+    _cleanupTimer;
     _sessionContext = services_1.SessionContext.instance;
     _oauthServer;
     _middleware;
     _mcpHandlers;
     _creatioOauthHandlers;
     _mcpOauthHandlers;
+    get app() {
+        return this._app;
+    }
     constructor(server) {
         this._server = server;
         this._oauthServer = new oauth_1.OAuthServer();
@@ -37,8 +51,8 @@ class HttpServer {
     _setupMiddleware() {
         this._app.use(this._middleware.correlationId());
         this._app.use(this._middleware.requestLogging());
-        this._app.use(express_1.default.json());
-        this._app.use(express_1.default.urlencoded({ extended: true }));
+        this._app.use(express_1.default.json({ limit: HttpServer.BODY_LIMIT }));
+        this._app.use(express_1.default.urlencoded({ extended: true, limit: HttpServer.BODY_LIMIT }));
         if (this._isNeedMCPOAuth()) {
             this._app.use('/mcp', this._middleware.bearerAuth());
         }
@@ -60,15 +74,15 @@ class HttpServer {
         return this._server.authProvider.type === creatio_1.AuthProviderType.OAuth2Code;
     }
     _setupCreatioOAuthEndpoints() {
-        this._app.get('/oauth/start', (req, res) => this._creatioOauthHandlers.handleOAuthStart(req, res));
-        this._app.get('/oauth/callback', (req, res) => this._creatioOauthHandlers.handleOAuthCallback(req, res));
-        this._app.post('/oauth/revoke', (req, res) => this._creatioOauthHandlers.handleOAuthRevoke(req, res));
+        this._app.get('/oauth/start', this._middleware.rateLimit(HttpServer.RATE_LIMIT_AUTH_FLOW), (req, res) => this._creatioOauthHandlers.handleOAuthStart(req, res));
+        this._app.get('/oauth/callback', this._middleware.rateLimit(HttpServer.RATE_LIMIT_AUTH_FLOW), (req, res) => this._creatioOauthHandlers.handleOAuthCallback(req, res));
+        this._app.post('/oauth/revoke', this._middleware.rateLimit(HttpServer.RATE_LIMIT_REVOKE), this._middleware.bearerAuth(), (req, res) => this._creatioOauthHandlers.handleOAuthRevoke(req, res));
     }
     _setupMCPOAuthEndpoints() {
         this._app.get('/.well-known/oauth-authorization-server', (req, res) => this._mcpOauthHandlers.handleMetadata(req, res));
-        this._app.post('/register', (req, res) => this._mcpOauthHandlers.handleClientRegistration(req, res));
-        this._app.get('/authorize', (req, res) => this._mcpOauthHandlers.handleAuthorization(req, res));
-        this._app.post('/token', (req, res) => this._mcpOauthHandlers.handleTokenExchange(req, res));
+        this._app.post('/register', this._middleware.rateLimit(HttpServer.RATE_LIMIT_REGISTER), (req, res) => this._mcpOauthHandlers.handleClientRegistration(req, res));
+        this._app.get('/authorize', this._middleware.rateLimit(HttpServer.RATE_LIMIT_AUTH_FLOW), (req, res) => this._mcpOauthHandlers.handleAuthorization(req, res));
+        this._app.post('/token', this._middleware.rateLimit(HttpServer.RATE_LIMIT_TOKEN), (req, res) => this._mcpOauthHandlers.handleTokenExchange(req, res));
     }
     start(port) {
         return new Promise((resolve, reject) => {
@@ -86,13 +100,22 @@ class HttpServer {
                 this._connections.add(socket);
                 socket.once('close', () => this._connections.delete(socket));
             });
+            // Periodically evict expired OAuth codes/states so these maps stay bounded
+            // over a long-running process. Unref'd so it never holds the event loop open.
+            this._cleanupTimer = setInterval(() => {
+                this._oauthServer.cleanup();
+                this._sessionContext.cleanupExpiredOAuthStates();
+            }, HttpServer.CLEANUP_INTERVAL_MS);
+            this._cleanupTimer.unref();
         });
     }
     async stop() {
+        if (this._cleanupTimer) {
+            clearInterval(this._cleanupTimer);
+            this._cleanupTimer = undefined;
+        }
         try {
-            if (this._server.authProvider && 'cancelAllRefresh' in this._server.authProvider) {
-                this._server.authProvider.cancelAllRefresh();
-            }
+            this._server.authProvider.cancelAllRefresh();
         }
         catch (err) {
             log_1.default.warn('token_refresh_cleanup_failed', { error: String(err) });

package/dist/server/http/httpServer.js.map

@@ -1 +1 @@
-{"version":3,"file":"httpServer.js","sourceRoot":"","sources":["../../../src/server/http/httpServer.ts"],"names":[],"mappings":";;;;;;AAGA,sDAA8B;AAE9B,4CAAkD;AAClD,oDAA4B;AAC5B,6CAAgD;AAChD,oCAAuC;AAEvC,qEAAgE;AAChE,iDAA6C;AAC7C,6DAAwD;AACxD,6CAA8C;AAI9C,MAAa,UAAU;IACL,OAAO,CAAS;IAChB,IAAI,GAAG,IAAA,iBAAO,GAAE,CAAC;IACjB,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,IAAI,CAAe;IACV,eAAe,GAAG,yBAAc,CAAC,QAAQ,CAAC;IAC1C,YAAY,CAAc;IAC1B,WAAW,CAAiB;IAC5B,YAAY,CAAc;IAC1B,qBAAqB,CAAuB;IAC5C,iBAAiB,CAAmB;IAErD,YAAY,MAAc;QACzB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,YAAY,GAAG,IAAI,mBAAW,EAAE,CAAC;QACtC,IAAI,CAAC,WAAW,GAAG,IAAI,2BAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzD,IAAI,CAAC,YAAY,GAAG,IAAI,0BAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,qBAAqB,GAAG,IAAI,6CAAoB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACvF,IAAI,CAAC,iBAAiB,GAAG,IAAI,qCAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACjE,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,IAAI,CAAC,YAAY,EAAE,CAAC;IACrB,CAAC;IAEO,gBAAgB;QACvB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC,CAAC;IAChD,CAAC;IAEO,YAAY;QACnB,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC1B,IAAI,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;YAC5B,IAAI,CAAC,2BAA2B,EAAE,CAAC;YACnC,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAChC,CAAC;IACF,CAAC;IAEO,kBAAkB;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QAChF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QACtF,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1F,CAAC;IAEO,eAAe;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,KAAK,0BAAgB,CAAC,UAAU,CAAC;IACvE,CAAC;IAEO,2BAA2B;QAClC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAC1C,IAAI,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,CACrD,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAC7C,IAAI,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CACxD,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAC5C,IAAI,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CACtD,CAAC;IACH,CAAC;IAEO,uBAAuB;QAC9B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,yCAAyC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CACrE,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAC/C,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CACxC,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CACzD,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CACxC,IAAI,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CACpD,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CACrC,IAAI,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CACpD,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,IAAY;QACxB,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC5C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;gBACvC,aAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBACpB,OAAO,EAAE,CAAC;YACX,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAClC,IAAI,CAAC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC;YAC7E,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC7B,aAAG,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC5D,MAAM,CAAC,GAAG,CAAC,CAAC;YACb,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAc,EAAE,EAAE;gBAC7C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YAC9D,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,IAAI;QAChB,IAAI,CAAC;YACJ,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,kBAAkB,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;gBACjF,IAAI,CAAC,OAAO,CAAC,YAAoB,CAAC,gBAAgB,EAAE,CAAC;YACvD,CAAC;QACF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,aAAG,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,IAAI,CAAC;gBACJ,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;gBAC7B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;oBACnC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;gBAClC,CAAC,CAAC,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,aAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACtD,CAAC;QACF,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC;gBACJ,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACX,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,cAAc,EAAE,CAAC;QACvD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAChC,IAAI,CAAC;gBACJ,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC;YAC5B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,aAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAChD,CAAC;IACF,CAAC;CACD;AApID,gCAoIC"}
+{"version":3,"file":"httpServer.js","sourceRoot":"","sources":["../../../src/server/http/httpServer.ts"],"names":[],"mappings":";;;;;;AAGA,sDAA8B;AAE9B,4CAAkD;AAClD,oDAA4B;AAC5B,6CAAgD;AAChD,uCAAkC;AAClC,oCAAuC;AAEvC,qEAAgE;AAChE,iDAA6C;AAC7C,6DAAwD;AACxD,6CAA8C;AAI9C,MAAa,UAAU;IACd,MAAM,CAAU,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAC5D,8EAA8E;IAC9E,sFAAsF;IAC9E,MAAM,CAAU,UAAU,GAAG,IAAA,WAAG,EAAC,mBAAmB,CAAC,IAAI,MAAM,CAAC;IACxE,uFAAuF;IAC/E,MAAM,CAAU,oBAAoB,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IACrE,MAAM,CAAU,gBAAgB,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IACjE,MAAM,CAAU,mBAAmB,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IACpE,MAAM,CAAU,iBAAiB,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IACzD,OAAO,CAAS;IAChB,IAAI,GAAG,IAAA,iBAAO,GAAE,CAAC;IACjB,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,IAAI,CAAe;IACnB,aAAa,CAA6B;IACjC,eAAe,GAAG,yBAAc,CAAC,QAAQ,CAAC;IAC1C,YAAY,CAAc;IAC1B,WAAW,CAAiB;IAC5B,YAAY,CAAc;IAC1B,qBAAqB,CAAuB;IAC5C,iBAAiB,CAAmB;IAErD,IAAW,GAAG;QACb,OAAO,IAAI,CAAC,IAAI,CAAC;IAClB,CAAC;IAED,YAAY,MAAc;QACzB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,YAAY,GAAG,IAAI,mBAAW,EAAE,CAAC;QACtC,IAAI,CAAC,WAAW,GAAG,IAAI,2BAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzD,IAAI,CAAC,YAAY,GAAG,IAAI,0BAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,qBAAqB,GAAG,IAAI,6CAAoB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACvF,IAAI,CAAC,iBAAiB,GAAG,IAAI,qCAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACjE,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,IAAI,CAAC,YAAY,EAAE,CAAC;IACrB,CAAC;IAEO,gBAAgB;QACvB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QACpF,IAAI,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC,CAAC;IAChD,CAAC;IAEO,YAAY;QACnB,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC1B,IAAI,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;YAC5B,IAAI,CAAC,2BAA2B,EAAE,CAAC;YACnC,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAChC,CAAC;IACF,CAAC;IAEO,kBAAkB;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QAChF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QACtF,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1F,CAAC;IAEO,eAAe;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,KAAK,0BAAgB,CAAC,UAAU,CAAC;IACvE,CAAC;IAEO,2BAA2B;QAClC,IAAI,CAAC,IAAI,CAAC,GAAG,CACZ,cAAc,EACd,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAC3D,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,CACnE,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,GAAG,CACZ,iBAAiB,EACjB,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAC3D,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CACtE,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,IAAI,CACb,eAAe,EACf,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,UAAU,CAAC,iBAAiB,CAAC,EACxD,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,EAC7B,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CACpE,CAAC;IACH,CAAC;IAEO,uBAAuB;QAC9B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,yCAAyC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CACrE,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAC/C,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,IAAI,CACb,WAAW,EACX,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAC1D,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CACvE,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,GAAG,CACZ,YAAY,EACZ,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAC3D,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAClE,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,IAAI,CACb,QAAQ,EACR,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,UAAU,CAAC,gBAAgB,CAAC,EACvD,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAClE,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,IAAY;QACxB,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC5C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;gBACvC,aAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBACpB,OAAO,EAAE,CAAC;YACX,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAClC,IAAI,CAAC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC;YAC7E,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC7B,aAAG,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC5D,MAAM,CAAC,GAAG,CAAC,CAAC;YACb,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAc,EAAE,EAAE;gBAC7C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YAC9D,CAAC,CAAC,CAAC;YACH,2EAA2E;YAC3E,8EAA8E;YAC9E,IAAI,CAAC,aAAa,GAAG,WAAW,CAAC,GAAG,EAAE;gBACrC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;gBAC5B,IAAI,CAAC,eAAe,CAAC,yBAAyB,EAAE,CAAC;YAClD,CAAC,EAAE,UAAU,CAAC,mBAAmB,CAAC,CAAC;YACnC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,IAAI;QAChB,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAClC,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC;QAChC,CAAC;QACD,IAAI,CAAC;YACJ,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,aAAG,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,IAAI,CAAC;gBACJ,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;gBAC7B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;oBACnC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;gBAClC,CAAC,CAAC,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,aAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACtD,CAAC;QACF,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC;gBACJ,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACX,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,cAAc,EAAE,CAAC;QACvD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAChC,IAAI,CAAC;gBACJ,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC;YAC5B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,aAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAChD,CAAC;IACF,CAAC;;AAvKF,gCAwKC"}

package/dist/server/http/mcp-handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-handlers.d.ts","sourceRoot":"","sources":["../../../src/server/http/mcp-handlers.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEjD,qBAAa,WAAW;IACvB,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA2B;IAC3D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;gBAErB,MAAM,EAAE,MAAM;IAIb,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAmDzD,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAe7E"}
+{"version":3,"file":"mcp-handlers.d.ts","sourceRoot":"","sources":["../../../src/server/http/mcp-handlers.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEjD,qBAAa,WAAW;IACvB,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA2B;IAC3D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;gBAErB,MAAM,EAAE,MAAM;IAIb,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAmDzD,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAmB7E"}

package/dist/server/http/mcp-handlers.js

@@ -74,7 +74,10 @@ class McpHandlers {
             res.status(400).send('Session has no transport');
             return;
         }
-        const userKey = (0, utils_1.getUserKeyFromRequest)(req);
+        // Prefer the validated Bearer identity and the session's own mapping over any
+        // caller-supplied ?userKey=/x-user-key, which must not override an authenticated
+        // identity (CWE-639).
+        const userKey = req.userKey || session?.userKey || (0, utils_1.getUserKeyFromRequest)(req);
         await (0, utils_1.runWithContext)({ userKey, sessionId }, async () => transport.handleRequest(req, res));
     }
 }

package/dist/server/http/mcp-handlers.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-handlers.js","sourceRoot":"","sources":["../../../src/server/http/mcp-handlers.ts"],"names":[],"mappings":";;;;;;AAAA,6CAAyC;AAEzC,0FAAmG;AACnG,iEAAyE;AAEzE,oDAA4B;AAC5B,6CAAgD;AAChD,uCAKqB;AAKrB,MAAa,WAAW;IACN,eAAe,GAAG,yBAAc,CAAC,QAAQ,CAAC;IAC1C,OAAO,CAAS;IAEjC,YAAY,MAAc;QACzB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACvB,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,GAAY,EAAE,GAAa;QACrD,MAAM,SAAS,GAAG,IAAA,+BAAuB,EAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,aAAa,GAAI,GAAW,CAAC,OAAO,CAAC;QAC3C,IAAI,SAAoD,CAAC;QACzD,MAAM,QAAQ,GAAG,IAAA,mBAAW,EAAC,GAAG,CAAC,CAAC;QAClC,IAAI,SAAS,IAAI,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YAC3D,SAAS,GAAG,OAAO,EAAE,SAAS,CAAC;YAC/B,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBAClC,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;gBACpD,aAAG,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YACjD,CAAC;QACF,CAAC;aAAM,IAAI,CAAC,SAAS,IAAI,IAAA,8BAAmB,EAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,SAAS,GAAG,IAAI,iDAA6B,CAAC;gBAC7C,kBAAkB,EAAE,GAAG,EAAE,CAAC,IAAA,wBAAU,GAAE;gBACtC,oBAAoB,EAAE,CAAC,GAAG,EAAE,EAAE;oBAC7B,IAAI,SAAS,EAAE,CAAC;wBACf,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,aAAa,CACjD,GAAG,EACH,aAAa,EACb,QAAQ,CACR,CAAC;wBACF,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;wBACzD,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;wBAC9C,aAAG,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAC3C,CAAC;gBACF,CAAC;aACD,CAAC,CAAC;YACH,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;gBACxB,IAAI,SAAS,EAAE,SAAS,EAAE,CAAC;oBAC1B,aAAG,CAAC,iBAAiB,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAC7D,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;gBACzD,CAAC;YACF,CAAC,CAAC;YACF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC1C,MAAM,GAAG,CAAC,OAAO,CAAC,SAAgB,CAAC,CAAC;QACrC,CAAC;aAAM,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACpB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,2CAA2C,EAAE;gBAC7E,EAAE,EAAE,IAAI;aACR,CAAC,CAAC;YACH,OAAO;QACR,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,aAAa,IAAI,OAAO,EAAE,OAAO,CAAC;QAClD,MAAM,IAAA,sBAAc,EAAC,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,KAAK,IAAI,EAAE,CACvD,SAAU,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAC5C,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,oBAAoB,CAAC,GAAY,EAAE,GAAa;QAC5D,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAuB,CAAC;QACtE,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;YACtD,OAAO;QACR,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,CAAC;QACrC,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;YACjD,OAAO;QACR,CAAC;QACD,MAAM,OAAO,GAAG,IAAA,6BAAqB,EAAC,GAAU,CAAC,CAAC;QAClD,MAAM,IAAA,sBAAc,EAAC,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7F,CAAC;CACD;AA1ED,kCA0EC"}
+{"version":3,"file":"mcp-handlers.js","sourceRoot":"","sources":["../../../src/server/http/mcp-handlers.ts"],"names":[],"mappings":";;;;;;AAAA,6CAAyC;AAEzC,0FAAmG;AACnG,iEAAyE;AAEzE,oDAA4B;AAC5B,6CAAgD;AAChD,uCAKqB;AAKrB,MAAa,WAAW;IACN,eAAe,GAAG,yBAAc,CAAC,QAAQ,CAAC;IAC1C,OAAO,CAAS;IAEjC,YAAY,MAAc;QACzB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACvB,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,GAAY,EAAE,GAAa;QACrD,MAAM,SAAS,GAAG,IAAA,+BAAuB,EAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,aAAa,GAAI,GAAW,CAAC,OAAO,CAAC;QAC3C,IAAI,SAAoD,CAAC;QACzD,MAAM,QAAQ,GAAG,IAAA,mBAAW,EAAC,GAAG,CAAC,CAAC;QAClC,IAAI,SAAS,IAAI,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YAC3D,SAAS,GAAG,OAAO,EAAE,SAAS,CAAC;YAC/B,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBAClC,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;gBACpD,aAAG,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YACjD,CAAC;QACF,CAAC;aAAM,IAAI,CAAC,SAAS,IAAI,IAAA,8BAAmB,EAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,SAAS,GAAG,IAAI,iDAA6B,CAAC;gBAC7C,kBAAkB,EAAE,GAAG,EAAE,CAAC,IAAA,wBAAU,GAAE;gBACtC,oBAAoB,EAAE,CAAC,GAAG,EAAE,EAAE;oBAC7B,IAAI,SAAS,EAAE,CAAC;wBACf,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,aAAa,CACjD,GAAG,EACH,aAAa,EACb,QAAQ,CACR,CAAC;wBACF,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;wBACzD,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;wBAC9C,aAAG,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAC3C,CAAC;gBACF,CAAC;aACD,CAAC,CAAC;YACH,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;gBACxB,IAAI,SAAS,EAAE,SAAS,EAAE,CAAC;oBAC1B,aAAG,CAAC,iBAAiB,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAC7D,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;gBACzD,CAAC;YACF,CAAC,CAAC;YACF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC1C,MAAM,GAAG,CAAC,OAAO,CAAC,SAAgB,CAAC,CAAC;QACrC,CAAC;aAAM,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACpB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,2CAA2C,EAAE;gBAC7E,EAAE,EAAE,IAAI;aACR,CAAC,CAAC;YACH,OAAO;QACR,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,aAAa,IAAI,OAAO,EAAE,OAAO,CAAC;QAClD,MAAM,IAAA,sBAAc,EAAC,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,KAAK,IAAI,EAAE,CACvD,SAAU,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAC5C,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,oBAAoB,CAAC,GAAY,EAAE,GAAa;QAC5D,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAuB,CAAC;QACtE,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;YACtD,OAAO;QACR,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,CAAC;QACrC,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;YACjD,OAAO;QACR,CAAC;QACD,8EAA8E;QAC9E,iFAAiF;QACjF,sBAAsB;QACtB,MAAM,OAAO,GACX,GAAW,CAAC,OAAO,IAAI,OAAO,EAAE,OAAO,IAAI,IAAA,6BAAqB,EAAC,GAAU,CAAC,CAAC;QAC/E,MAAM,IAAA,sBAAc,EAAC,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7F,CAAC;CACD;AA9ED,kCA8EC"}

package/dist/server/http/mcp-oauth-handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-oauth-handlers.d.ts","sourceRoot":"","sources":["../../../src/server/http/mcp-oauth-handlers.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEjD,qBAAa,gBAAgB;IAC5B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAc;gBAE/B,WAAW,EAAE,WAAW;IAI7B,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,IAAI;IAKjD,wBAAwB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,QAAQ,GAAG,IAAI;IAqBhE,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAsC/D,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;CA4BvF"}
+{"version":3,"file":"mcp-oauth-handlers.d.ts","sourceRoot":"","sources":["../../../src/server/http/mcp-oauth-handlers.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEjD,qBAAa,gBAAgB;IAC5B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAc;gBAE/B,WAAW,EAAE,WAAW;IAI7B,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,IAAI;IAKjD,wBAAwB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,QAAQ,GAAG,IAAI;IAqBhE,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAkD/D,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;CA4BvF"}

package/dist/server/http/mcp-oauth-handlers.js

@@ -48,6 +48,22 @@ class MCPOAuthHandlers {
                 code_challenge_method: req.query.code_challenge_method,
                 scope: req.query.scope,
             };
+            // Never redirect to an unvalidated target. If the redirect_uri is missing or
+            // not allow-listed, fail closed with a direct error response (CWE-601).
+            if (!params.redirect_uri || !validators_1.OAuthValidators.isAllowedRedirectUri(params.redirect_uri)) {
+                res.status(400).json({
+                    error: 'invalid_request',
+                    error_description: 'Missing or disallowed redirect_uri',
+                });
+                return;
+            }
+            // state is mandatory: it is the CSRF / session-binding control for the flow (CWE-352).
+            if (!params.state) {
+                const errorUrl = new URL(params.redirect_uri);
+                errorUrl.searchParams.set('error', 'invalid_request');
+                errorUrl.searchParams.set('error_description', 'state parameter is required');
+                return res.redirect(errorUrl.toString());
+            }
             const validationError = this._oauthServer.validateAuthorizationRequest(params);
             if (validationError) {
                 const errorUrl = new URL(params.redirect_uri);
@@ -55,14 +71,10 @@ class MCPOAuthHandlers {
                 if (validationError.error_description) {
                     errorUrl.searchParams.set('error_description', validationError.error_description);
                 }
-                if (params.state) {
-                    errorUrl.searchParams.set('state', params.state);
-                }
+                errorUrl.searchParams.set('state', params.state);
                 return res.redirect(errorUrl.toString());
             }
-            if (params.state) {
-                this._oauthServer.storeState(params.state, params.client_id);
-            }
+            this._oauthServer.storeState(params.state, params.client_id);
             const authKey = (0, node_crypto_1.randomUUID)();
             const creatioAuthUrl = `/oauth/start?authKey=${authKey}&client_id=${params.client_id}&redirect_uri=${encodeURIComponent(params.redirect_uri)}&code_challenge=${params.code_challenge}&code_challenge_method=${params.code_challenge_method}&state=${params.state || ''}`;
             res.redirect(creatioAuthUrl);

package/dist/server/http/mcp-oauth-handlers.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-oauth-handlers.js","sourceRoot":"","sources":["../../../src/server/http/mcp-oauth-handlers.ts"],"names":[],"mappings":";;;;;;AAAA,6CAAyC;AAEzC,oDAA4B;AAC5B,oDAAsD;AAKtD,MAAa,gBAAgB;IACX,YAAY,CAAc;IAE3C,YAAY,WAAwB;QACnC,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;IACjC,CAAC;IAEM,cAAc,CAAC,GAAY,EAAE,GAAa;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,8BAA8B,EAAE,CAAC;QACpE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpB,CAAC;IAEM,wBAAwB,CAAC,GAAY,EAAE,GAAa;QAC1D,IAAI,CAAC;YACJ,MAAM,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;YACnC,MAAM,eAAe,GAAG,4BAAe,CAAC,0BAA0B,CAAC,aAAa,CAAC,CAAC;YAClF,IAAI,eAAe,EAAE,CAAC;gBACrB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC3B,KAAK,EAAE,iBAAiB;oBACxB,iBAAiB,EAAE,eAAe;iBAClC,CAAC,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;YAC/D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,aAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC5D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACpB,KAAK,EAAE,cAAc;gBACrB,iBAAiB,EAAE,2BAA2B;aAC9C,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAAC,GAAY,EAAE,GAAa;QAC3D,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG;gBACd,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,SAAmB;gBACxC,YAAY,EAAE,GAAG,CAAC,KAAK,CAAC,YAAsB;gBAC9C,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,aAAuB;gBAChD,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAe;gBAChC,cAAc,EAAE,GAAG,CAAC,KAAK,CAAC,cAAwB;gBAClD,qBAAqB,EAAE,GAAG,CAAC,KAAK,CAAC,qBAA+B;gBAChE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAe;aAChC,CAAC;YACF,MAAM,eAAe,GAAG,IAAI,CAAC,YAAY,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC;YAC/E,IAAI,eAAe,EAAE,CAAC;gBACrB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBAC9C,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC;gBAC1D,IAAI,eAAe,CAAC,iBAAiB,EAAE,CAAC;oBACvC,QAAQ,CAAC,YAAY,CAAC,GAAG,CACxB,mBAAmB,EACnB,eAAe,CAAC,iBAAiB,CACjC,CAAC;gBACH,CAAC;gBACD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;oBAClB,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBAClD,CAAC;gBACD,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC1C,CAAC;YACD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBAClB,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9D,CAAC;YACD,MAAM,OAAO,GAAG,IAAA,wBAAU,GAAE,CAAC;YAC7B,MAAM,cAAc,GAAG,wBAAwB,OAAO,cAAc,MAAM,CAAC,SAAS,iBAAiB,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,mBAAmB,MAAM,CAAC,cAAc,0BAA0B,MAAM,CAAC,qBAAqB,UAAU,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YACzQ,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,aAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC7D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAC9C,CAAC;IACF,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAAC,GAAY,EAAE,GAAa;QAC3D,IAAI,CAAC;YACJ,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;YACnC,aAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE;gBAC/B,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC;gBACxC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI;gBACnB,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC/C,MAAM,EAAE;oBACP,UAAU,EAAE,WAAW,CAAC,UAAU;oBAClC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;oBACvE,SAAS,EAAE,WAAW,CAAC,SAAS;oBAChC,YAAY,EAAE,WAAW,CAAC,YAAY;oBACtC,iBAAiB,EAAE,CAAC,CAAC,WAAW,CAAC,aAAa;iBAC9C;aACD,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;YACzE,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;gBACvB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrC,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,aAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACzD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACpB,KAAK,EAAE,cAAc;gBACrB,iBAAiB,EAAE,0BAA0B;aAC7C,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;CACD;AAnGD,4CAmGC"}
+{"version":3,"file":"mcp-oauth-handlers.js","sourceRoot":"","sources":["../../../src/server/http/mcp-oauth-handlers.ts"],"names":[],"mappings":";;;;;;AAAA,6CAAyC;AAEzC,oDAA4B;AAC5B,oDAAsD;AAKtD,MAAa,gBAAgB;IACX,YAAY,CAAc;IAE3C,YAAY,WAAwB;QACnC,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;IACjC,CAAC;IAEM,cAAc,CAAC,GAAY,EAAE,GAAa;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,8BAA8B,EAAE,CAAC;QACpE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpB,CAAC;IAEM,wBAAwB,CAAC,GAAY,EAAE,GAAa;QAC1D,IAAI,CAAC;YACJ,MAAM,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;YACnC,MAAM,eAAe,GAAG,4BAAe,CAAC,0BAA0B,CAAC,aAAa,CAAC,CAAC;YAClF,IAAI,eAAe,EAAE,CAAC;gBACrB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC3B,KAAK,EAAE,iBAAiB;oBACxB,iBAAiB,EAAE,eAAe;iBAClC,CAAC,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;YAC/D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,aAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC5D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACpB,KAAK,EAAE,cAAc;gBACrB,iBAAiB,EAAE,2BAA2B;aAC9C,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAAC,GAAY,EAAE,GAAa;QAC3D,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG;gBACd,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,SAAmB;gBACxC,YAAY,EAAE,GAAG,CAAC,KAAK,CAAC,YAAsB;gBAC9C,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,aAAuB;gBAChD,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAe;gBAChC,cAAc,EAAE,GAAG,CAAC,KAAK,CAAC,cAAwB;gBAClD,qBAAqB,EAAE,GAAG,CAAC,KAAK,CAAC,qBAA+B;gBAChE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAe;aAChC,CAAC;YACF,6EAA6E;YAC7E,wEAAwE;YACxE,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,4BAAe,CAAC,oBAAoB,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;gBACxF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACpB,KAAK,EAAE,iBAAiB;oBACxB,iBAAiB,EAAE,oCAAoC;iBACvD,CAAC,CAAC;gBACH,OAAO;YACR,CAAC;YACD,uFAAuF;YACvF,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBAC9C,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;gBACtD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,6BAA6B,CAAC,CAAC;gBAC9E,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC1C,CAAC;YACD,MAAM,eAAe,GAAG,IAAI,CAAC,YAAY,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC;YAC/E,IAAI,eAAe,EAAE,CAAC;gBACrB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBAC9C,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC;gBAC1D,IAAI,eAAe,CAAC,iBAAiB,EAAE,CAAC;oBACvC,QAAQ,CAAC,YAAY,CAAC,GAAG,CACxB,mBAAmB,EACnB,eAAe,CAAC,iBAAiB,CACjC,CAAC;gBACH,CAAC;gBACD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBACjD,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC1C,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YAC7D,MAAM,OAAO,GAAG,IAAA,wBAAU,GAAE,CAAC;YAC7B,MAAM,cAAc,GAAG,wBAAwB,OAAO,cAAc,MAAM,CAAC,SAAS,iBAAiB,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,mBAAmB,MAAM,CAAC,cAAc,0BAA0B,MAAM,CAAC,qBAAqB,UAAU,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YACzQ,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,aAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC7D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAC9C,CAAC;IACF,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAAC,GAAY,EAAE,GAAa;QAC3D,IAAI,CAAC;YACJ,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;YACnC,aAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE;gBAC/B,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC;gBACxC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI;gBACnB,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC/C,MAAM,EAAE;oBACP,UAAU,EAAE,WAAW,CAAC,UAAU;oBAClC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;oBACvE,SAAS,EAAE,WAAW,CAAC,SAAS;oBAChC,YAAY,EAAE,WAAW,CAAC,YAAY;oBACtC,iBAAiB,EAAE,CAAC,CAAC,WAAW,CAAC,aAAa;iBAC9C;aACD,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;YACzE,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;gBACvB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrC,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,aAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACzD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACpB,KAAK,EAAE,cAAc;gBACrB,iBAAiB,EAAE,0BAA0B;aAC7C,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;CACD;AA/GD,4CA+GC"}

package/dist/server/http/middleware.d.ts

@@ -1,8 +1,15 @@
+import type { RateLimitOptions } from './rate-limiter';
 import type { OAuthServer } from '../oauth';
 import type { NextFunction, Request, Response } from 'express';
 export declare class HttpMiddleware {
     private readonly _oauthServer;
     constructor(oauthServer: OAuthServer);
+    /**
+     * Per-route fixed-window rate limit, keyed by the real connection IP (req.ip /
+     * socket address) rather than the spoofable X-Forwarded-For header, so an
+     * attacker cannot bypass the limit by rotating that header.
+     */
+    rateLimit(options: RateLimitOptions): (req: Request, res: Response, next: NextFunction) => void;
     bearerAuth(): (req: Request, res: Response, next: NextFunction) => void;
     errorHandler(): (error: Error, req: Request, res: Response, next: NextFunction) => void;
     correlationId(): (req: Request, res: Response, next: NextFunction) => void;

package/dist/server/http/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../../src/server/http/middleware.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAE/D,qBAAa,cAAc;IAC1B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAc;gBAE/B,WAAW,EAAE,WAAW;IAI7B,UAAU,KACR,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY;IAkBjD,YAAY,KACV,OAAO,KAAK,EAAE,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY;IAiB/D,aAAa,KACX,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY;IAYjD,cAAc,KACZ,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY;CAwBxD"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../../src/server/http/middleware.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAE/D,qBAAa,cAAc;IAC1B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAc;gBAE/B,WAAW,EAAE,WAAW;IAIpC;;;;OAIG;IACI,SAAS,CAAC,OAAO,EAAE,gBAAgB,IAEjC,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY;IAgBjD,UAAU,KACR,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY;IAkBjD,YAAY,KACV,OAAO,KAAK,EAAE,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY;IAiB/D,aAAa,KACX,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY;IAYjD,cAAc,KACZ,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY;CAwBxD"}

package/dist/server/http/middleware.js

@@ -7,11 +7,34 @@ exports.HttpMiddleware = void 0;
 const crypto_1 = require("crypto");
 const log_1 = __importDefault(require("../../log"));
 const utils_1 = require("../../utils");
+const rate_limiter_1 = require("./rate-limiter");
 class HttpMiddleware {
     _oauthServer;
     constructor(oauthServer) {
         this._oauthServer = oauthServer;
     }
+    /**
+     * Per-route fixed-window rate limit, keyed by the real connection IP (req.ip /
+     * socket address) rather than the spoofable X-Forwarded-For header, so an
+     * attacker cannot bypass the limit by rotating that header.
+     */
+    rateLimit(options) {
+        const limiter = new rate_limiter_1.RateLimiter(options);
+        return (req, res, next) => {
+            const key = req.ip || req.socket?.remoteAddress || 'unknown';
+            const { allowed, retryAfterMs } = limiter.check(key, Date.now());
+            if (!allowed) {
+                res.setHeader('Retry-After', String(Math.ceil(retryAfterMs / 1000)));
+                log_1.default.warn('http.rate_limited', { path: req.path, ip: (0, utils_1.getClientIp)(req) });
+                res.status(429).json({
+                    error: 'too_many_requests',
+                    error_description: 'Rate limit exceeded. Try again later.',
+                });
+                return;
+            }
+            next();
+        };
+    }
     bearerAuth() {
         return (req, res, next) => {
             const authHeader = req.headers.authorization;

package/dist/server/http/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../../src/server/http/middleware.ts"],"names":[],"mappings":";;;;;;AAAA,mCAAoC;AAEpC,oDAA4B;AAC5B,uCAA0C;AAK1C,MAAa,cAAc;IACT,YAAY,CAAc;IAE3C,YAAY,WAAwB;QACnC,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;IACjC,CAAC;IAEM,UAAU;QAChB,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;YAC1D,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7C,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBACpD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAClC,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;gBAC7D,IAAI,OAAO,EAAE,CAAC;oBACZ,GAAW,CAAC,OAAO,GAAG,OAAO,CAAC;oBAC/B,OAAO,IAAI,EAAE,CAAC;gBACf,CAAC;YACF,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACpB,KAAK,EAAE,cAAc;gBACrB,iBAAiB,EAChB,yEAAyE;aAC1E,CAAC,CAAC;QACJ,CAAC,CAAC;IACH,CAAC;IAEM,YAAY;QAClB,OAAO,CAAC,KAAY,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;YACxE,aAAG,CAAC,KAAK,CAAC,YAAY,EAAE;gBACvB,KAAK,EAAE,KAAK,CAAC,OAAO;gBACpB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,GAAG,CAAC,MAAM;aAClB,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACpB,KAAK,EAAE,cAAc;gBACrB,iBAAiB,EAAE,uBAAuB;aAC1C,CAAC,CAAC;QACJ,CAAC,CAAC;IACH,CAAC;IAEM,aAAa;QACnB,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;YAC1D,MAAM,aAAa,GAAI,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAY,IAAI,IAAA,mBAAU,GAAE,CAAC;YAClF,aAAG,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;YACnC,GAAW,CAAC,aAAa,GAAG,aAAa,CAAC;YAC3C,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,aAAa,CAAC,CAAC;YACjD,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;gBACrB,aAAG,CAAC,kBAAkB,EAAE,CAAC;YAC1B,CAAC,CAAC,CAAC;YACH,IAAI,EAAE,CAAC;QACR,CAAC,CAAC;IACH,CAAC;IAEM,cAAc;QACpB,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;YAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,EAAE,GAAG,IAAA,mBAAW,EAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAC5C,MAAM,aAAa,GAAI,GAAW,CAAC,aAAa,CAAC;YACjD,aAAG,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE;gBACpC,EAAE;gBACF,SAAS;gBACT,aAAa;gBACb,aAAa,EAAE,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC;gBAC5C,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC;aACxC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;gBACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;gBACxC,aAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE;oBAC/D,EAAE;oBACF,aAAa;oBACb,aAAa,EAAE,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC;oBAC9C,WAAW,EAAE,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC;iBAC1C,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,IAAI,EAAE,CAAC;QACR,CAAC,CAAC;IACH,CAAC;CACD;AAlFD,wCAkFC"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../../src/server/http/middleware.ts"],"names":[],"mappings":";;;;;;AAAA,mCAAoC;AAEpC,oDAA4B;AAC5B,uCAA0C;AAE1C,iDAA6C;AAM7C,MAAa,cAAc;IACT,YAAY,CAAc;IAE3C,YAAY,WAAwB;QACnC,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;IACjC,CAAC;IAED;;;;OAIG;IACI,SAAS,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,IAAI,0BAAW,CAAC,OAAO,CAAC,CAAC;QACzC,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;YAC1D,MAAM,GAAG,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,SAAS,CAAC;YAC7D,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACjE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACrE,aAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,IAAA,mBAAW,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACxE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACpB,KAAK,EAAE,mBAAmB;oBAC1B,iBAAiB,EAAE,uCAAuC;iBAC1D,CAAC,CAAC;gBACH,OAAO;YACR,CAAC;YACD,IAAI,EAAE,CAAC;QACR,CAAC,CAAC;IACH,CAAC;IAEM,UAAU;QAChB,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;YAC1D,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7C,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBACpD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAClC,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;gBAC7D,IAAI,OAAO,EAAE,CAAC;oBACZ,GAAW,CAAC,OAAO,GAAG,OAAO,CAAC;oBAC/B,OAAO,IAAI,EAAE,CAAC;gBACf,CAAC;YACF,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACpB,KAAK,EAAE,cAAc;gBACrB,iBAAiB,EAChB,yEAAyE;aAC1E,CAAC,CAAC;QACJ,CAAC,CAAC;IACH,CAAC;IAEM,YAAY;QAClB,OAAO,CAAC,KAAY,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;YACxE,aAAG,CAAC,KAAK,CAAC,YAAY,EAAE;gBACvB,KAAK,EAAE,KAAK,CAAC,OAAO;gBACpB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,GAAG,CAAC,MAAM;aAClB,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACpB,KAAK,EAAE,cAAc;gBACrB,iBAAiB,EAAE,uBAAuB;aAC1C,CAAC,CAAC;QACJ,CAAC,CAAC;IACH,CAAC;IAEM,aAAa;QACnB,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;YAC1D,MAAM,aAAa,GAAI,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAY,IAAI,IAAA,mBAAU,GAAE,CAAC;YAClF,aAAG,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;YACnC,GAAW,CAAC,aAAa,GAAG,aAAa,CAAC;YAC3C,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,aAAa,CAAC,CAAC;YACjD,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;gBACrB,aAAG,CAAC,kBAAkB,EAAE,CAAC;YAC1B,CAAC,CAAC,CAAC;YACH,IAAI,EAAE,CAAC;QACR,CAAC,CAAC;IACH,CAAC;IAEM,cAAc;QACpB,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;YAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,EAAE,GAAG,IAAA,mBAAW,EAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAC5C,MAAM,aAAa,GAAI,GAAW,CAAC,aAAa,CAAC;YACjD,aAAG,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE;gBACpC,EAAE;gBACF,SAAS;gBACT,aAAa;gBACb,aAAa,EAAE,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC;gBAC5C,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC;aACxC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;gBACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;gBACxC,aAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE;oBAC/D,EAAE;oBACF,aAAa;oBACb,aAAa,EAAE,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC;oBAC9C,WAAW,EAAE,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC;iBAC1C,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,IAAI,EAAE,CAAC;QACR,CAAC,CAAC;IACH,CAAC;CACD;AAzGD,wCAyGC"}

package/dist/server/http/rate-limiter.d.ts

@@ -0,0 +1,24 @@
+export interface RateLimitOptions {
+    /** Length of the fixed window in milliseconds. */
+    windowMs: number;
+    /** Maximum number of requests allowed per key within the window. */
+    max: number;
+}
+export interface RateLimitResult {
+    allowed: boolean;
+    retryAfterMs: number;
+}
+/**
+ * Minimal fixed-window in-memory rate limiter. Keyed by an arbitrary string
+ * (typically the client IP). Bounded memory: expired buckets are swept lazily
+ * once per window, so there is no background timer to leak.
+ */
+export declare class RateLimiter {
+    private readonly _buckets;
+    private readonly _options;
+    private _lastSweepAt;
+    constructor(options: RateLimitOptions);
+    check(key: string, now: number): RateLimitResult;
+    private _maybeSweep;
+}
+//# sourceMappingURL=rate-limiter.d.ts.map

package/dist/server/http/rate-limiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.d.ts","sourceRoot":"","sources":["../../../src/server/http/rate-limiter.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,gBAAgB;IAChC,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,GAAG,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,eAAe;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACrB;AAOD;;;;GAIG;AACH,qBAAa,WAAW;IACvB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IACtD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmB;IAC5C,OAAO,CAAC,YAAY,CAAK;gBAEb,OAAO,EAAE,gBAAgB;IAI9B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,eAAe;IAcvD,OAAO,CAAC,WAAW;CAWnB"}

package/dist/server/http/rate-limiter.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RateLimiter = void 0;
+/**
+ * Minimal fixed-window in-memory rate limiter. Keyed by an arbitrary string
+ * (typically the client IP). Bounded memory: expired buckets are swept lazily
+ * once per window, so there is no background timer to leak.
+ */
+class RateLimiter {
+    _buckets = new Map();
+    _options;
+    _lastSweepAt = 0;
+    constructor(options) {
+        this._options = options;
+    }
+    check(key, now) {
+        this._maybeSweep(now);
+        const bucket = this._buckets.get(key);
+        if (!bucket || now >= bucket.resetAt) {
+            this._buckets.set(key, { count: 1, resetAt: now + this._options.windowMs });
+            return { allowed: true, retryAfterMs: 0 };
+        }
+        if (bucket.count >= this._options.max) {
+            return { allowed: false, retryAfterMs: bucket.resetAt - now };
+        }
+        bucket.count++;
+        return { allowed: true, retryAfterMs: 0 };
+    }
+    _maybeSweep(now) {
+        if (now - this._lastSweepAt < this._options.windowMs) {
+            return;
+        }
+        this._lastSweepAt = now;
+        for (const [key, bucket] of this._buckets.entries()) {
+            if (now >= bucket.resetAt) {
+                this._buckets.delete(key);
+            }
+        }
+    }
+}
+exports.RateLimiter = RateLimiter;
+//# sourceMappingURL=rate-limiter.js.map

package/dist/server/http/rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../../../src/server/http/rate-limiter.ts"],"names":[],"mappings":";;;AAiBA;;;;GAIG;AACH,MAAa,WAAW;IACN,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IACrC,QAAQ,CAAmB;IACpC,YAAY,GAAG,CAAC,CAAC;IAEzB,YAAY,OAAyB;QACpC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;IACzB,CAAC;IAEM,KAAK,CAAC,GAAW,EAAE,GAAW;QACpC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC5E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;QAC3C,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACvC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC;QAC/D,CAAC;QACD,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IAC3C,CAAC;IAEO,WAAW,CAAC,GAAW;QAC9B,IAAI,GAAG,GAAG,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtD,OAAO;QACR,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,GAAG,CAAC;QACxB,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YACrD,IAAI,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC3B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;QACF,CAAC;IACF,CAAC;CACD;AAlCD,kCAkCC"}