mcp-creatio 0.6.1 → 0.6.3

package/dist/server/oauth/oauth-server.js

@@ -10,14 +10,17 @@ const client_manager_1 = require("./client-manager");
 const storage_1 = require("./storage");
 const token_manager_1 = require("./token-manager");
 const validators_1 = require("./validators");
+const ACCESS_TOKEN_TTL_SECONDS = 3600;
+const ISSUED_SCOPE = 'offline_access';
 class OAuthServer {
-    _jwtSecret = crypto_1.default.randomBytes(32).toString('hex');
     _storage = new storage_1.OAuthStorage();
     _tokenManager;
-    _baseUrl;
-    constructor(baseUrl = 'http://localhost:3000') {
-        this._baseUrl = baseUrl;
-        this._tokenManager = new token_manager_1.OAuthTokenManager(this._jwtSecret);
+    /**
+     * @param jwtSecret stable secret (from `CREATIO_MCP_JWT_SECRET`) signing the tokens issued to
+     *        MCP clients — stable so issued tokens survive a restart, unlike a random per-process key.
+     */
+    constructor(jwtSecret) {
+        this._tokenManager = new token_manager_1.OAuthTokenManager(jwtSecret);
     }
     _autoRegisterClientIfNeeded(client_id, redirect_uri) {
         if (this._storage.hasClient(client_id)) {
@@ -33,19 +36,32 @@ class OAuthServer {
         this._storage.addClient(client);
         return true;
     }
-    getAuthorizationServerMetadata() {
+    /** Mint an access token + a freshly-stored (rotating) refresh token as a standard OAuth response. */
+    _issueTokens(userKey, client_id, aud) {
+        const access_token = this._tokenManager.generateAccessToken(userKey, client_id, aud);
+        const refresh_token = this._tokenManager.generateRefreshToken();
+        this._storage.storeRefreshToken(refresh_token, userKey, client_id);
         return {
-            issuer: this._baseUrl,
-            authorization_endpoint: `${this._baseUrl}/authorize`,
-            token_endpoint: `${this._baseUrl}/token`,
-            registration_endpoint: `${this._baseUrl}/register`,
-            response_types_supported: ['code'],
-            grant_types_supported: ['authorization_code'],
-            token_endpoint_auth_methods_supported: ['none', 'client_secret_post'],
-            code_challenge_methods_supported: ['S256'],
-            scopes_supported: ['openid'],
+            access_token,
+            token_type: 'Bearer',
+            expires_in: ACCESS_TOKEN_TTL_SECONDS,
+            refresh_token,
+            scope: ISSUED_SCOPE,
         };
     }
+    /**
+     * Records a brokered authorization in flight and returns its opaque broker state (used as the
+     * `state` on the Creatio leg). Server-side storage keeps the client's PKCE and our Creatio-leg
+     * verifier apart — nothing is embedded in the Creatio `state`.
+     */
+    createPendingAuthorization(data) {
+        const brokerState = crypto_1.default.randomBytes(32).toString('base64url');
+        this._storage.storePendingAuthorization(brokerState, data);
+        return brokerState;
+    }
+    takePendingAuthorization(brokerState) {
+        return this._storage.takePendingAuthorization(brokerState);
+    }
     registerClient(redirect_uris) {
         const client = client_manager_1.OAuthClientManager.createClient(redirect_uris);
         this._storage.addClient(client);
@@ -61,39 +77,13 @@ class OAuthServer {
         }
         return validators_1.OAuthValidators.validateAuthorizationRequest(params, client);
     }
-    storeState(state, client_id) {
-        this._storage.storeState(state, client_id);
-        log_1.default.info('oauth.state.stored', { client_id });
-    }
-    validateState(state, client_id) {
-        const stateData = this._storage.getState(state);
-        if (!stateData) {
-            log_1.default.warn('oauth.state.not_found', { client_id });
-            return false;
-        }
-        if (stateData.expires_at < Date.now()) {
-            this._storage.deleteState(state);
-            log_1.default.warn('oauth.state.expired', { client_id });
-            return false;
-        }
-        if (stateData.client_id !== client_id) {
-            log_1.default.warn('oauth.state.client_mismatch', {
-                expected: stateData.client_id,
-                actual: client_id,
-            });
-            return false;
-        }
-        this._storage.deleteState(state);
-        log_1.default.info('oauth.state.validated_successfully', { client_id });
-        return true;
-    }
     generateAuthorizationCode(client_id, redirect_uri, code_challenge, code_challenge_method, userKey) {
         const code = crypto_1.default.randomBytes(32).toString('base64url');
         this._storage.storeAuthorizationCode(code, client_id, redirect_uri, code_challenge, code_challenge_method, userKey);
         log_1.default.info('oauth.authorization_code.generated', { client_id, userKey });
         return code;
     }
-    async exchangeCodeForToken(params) {
+    async exchangeCodeForToken(params, aud) {
         log_1.default.info('oauth.token.exchange_start', {
             grant_type: params.grant_type,
             client_id: params.client_id,
@@ -117,16 +107,60 @@ class OAuthServer {
             }
             return codeValidationError;
         }
-        const tokenResponse = this._tokenManager.createTokenResponse(authCode.userKey, params.client_id);
         this._storage.deleteAuthorizationCode(params.code);
         log_1.default.info('oauth.token.issued', { client_id: params.client_id, userKey: authCode.userKey });
-        return tokenResponse;
+        return this._issueTokens(authCode.userKey, params.client_id, aud);
     }
-    validateAccessToken(token) {
-        return this._tokenManager.validateAccessToken(token);
+    /**
+     * `refresh_token` grant: rotate the refresh token and mint a fresh access token WITHOUT a browser
+     * round-trip — bound to the same client (a stolen token can't be redeemed by another) and gated on
+     * the broker still holding this user's Creatio tokens, so a client never re-consents every hour.
+     */
+    async exchangeRefreshToken(params, aud, sessionStillHeld) {
+        const validationError = validators_1.OAuthValidators.validateTokenRequest(params);
+        if (validationError) {
+            return validationError;
+        }
+        const data = this._storage.getRefreshToken(params.refresh_token);
+        if (!data) {
+            return {
+                error: 'invalid_grant',
+                error_description: 'Invalid or expired refresh token',
+            };
+        }
+        if (data.client_id !== params.client_id) {
+            // Token presented by a different client than it was issued to — reuse/theft signal.
+            this._storage.deleteRefreshToken(params.refresh_token);
+            return { error: 'invalid_grant', error_description: 'Client mismatch' };
+        }
+        if (!(await sessionStillHeld(data.userKey))) {
+            this._storage.deleteRefreshToken(params.refresh_token);
+            return {
+                error: 'invalid_grant',
+                error_description: 'Session expired; re-authorization required',
+            };
+        }
+        // Rotate: the presented refresh token is single-use.
+        this._storage.deleteRefreshToken(params.refresh_token);
+        log_1.default.info('oauth.token.refreshed', { client_id: data.client_id, userKey: data.userKey });
+        return this._issueTokens(data.userKey, data.client_id, aud);
+    }
+    /** Verify a client-presented access token against this deployment's `iss`/`aud`; returns userKey. */
+    validateAccessToken(token, aud) {
+        return this._tokenManager.validateAccessToken(token, aud)?.userKey ?? null;
+    }
+    /** RFC 7009: resolve the user a presented token belongs to — our access JWT, or an issued
+     *  refresh token. Returns `null` for an unknown/invalid token (caller still answers 200). */
+    resolveUserFromToken(token, aud) {
+        const decoded = this._tokenManager.validateAccessToken(token, aud);
+        if (decoded) {
+            return decoded.userKey;
+        }
+        return this._storage.getRefreshToken(token)?.userKey ?? null;
     }
-    getClient(client_id) {
-        return this._storage.getClient(client_id);
+    /** Invalidate every refresh token we issued for a user (logout / revoke). */
+    purgeRefreshTokensForUser(userKey) {
+        this._storage.deleteRefreshTokensForUser(userKey);
     }
     cleanup() {
         this._storage.cleanup();

package/dist/server/oauth/oauth-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-server.js","sourceRoot":"","sources":["../../../src/server/oauth/oauth-server.ts"],"names":[],"mappings":";;;;;;AAAA,oDAA4B;AAE5B,oDAA4B;AAE5B,qDAAsD;AACtD,uCAAyC;AACzC,mDAAoD;AACpD,6CAA+C;AAW/C,MAAa,WAAW;IACN,UAAU,GAAW,gBAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5D,QAAQ,GAAG,IAAI,sBAAY,EAAE,CAAC;IAC9B,aAAa,CAAoB;IAC1C,QAAQ,CAAS;IAEzB,YAAY,UAAkB,uBAAuB;QACpD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,aAAa,GAAG,IAAI,iCAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7D,CAAC;IAEO,2BAA2B,CAAC,SAAiB,EAAE,YAAoB;QAC1E,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,OAAO,KAAK,CAAC;QACd,CAAC;QACD,8EAA8E;QAC9E,yFAAyF;QACzF,IAAI,CAAC,4BAAe,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAAE,CAAC;YACzD,aAAG,CAAC,IAAI,CAAC,qCAAqC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YAC/D,OAAO,KAAK,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,mCAAkB,CAAC,kBAAkB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAC9E,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC;IACb,CAAC;IAEM,8BAA8B;QACpC,OAAO;YACN,MAAM,EAAE,IAAI,CAAC,QAAQ;YACrB,sBAAsB,EAAE,GAAG,IAAI,CAAC,QAAQ,YAAY;YACpD,cAAc,EAAE,GAAG,IAAI,CAAC,QAAQ,QAAQ;YACxC,qBAAqB,EAAE,GAAG,IAAI,CAAC,QAAQ,WAAW;YAClD,wBAAwB,EAAE,CAAC,MAAM,CAAC;YAClC,qBAAqB,EAAE,CAAC,oBAAoB,CAAC;YAC7C,qCAAqC,EAAE,CAAC,MAAM,EAAE,oBAAoB,CAAC;YACrE,gCAAgC,EAAE,CAAC,MAAM,CAAC;YAC1C,gBAAgB,EAAE,CAAC,QAAQ,CAAC;SAC5B,CAAC;IACH,CAAC;IAEM,cAAc,CAAC,aAAuB;QAC5C,MAAM,MAAM,GAAG,mCAAkB,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAChC,OAAO,MAAM,CAAC;IACf,CAAC;IAEM,4BAA4B,CAAC,MAAiC;QACpE,IAAI,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,aAAa,GAAG,IAAI,CAAC,2BAA2B,CACrD,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,YAAY,CACnB,CAAC;YACF,IAAI,aAAa,EAAE,CAAC;gBACnB,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACpD,CAAC;QACF,CAAC;QACD,OAAO,4BAAe,CAAC,4BAA4B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrE,CAAC;IAEM,UAAU,CAAC,KAAa,EAAE,SAAiB;QACjD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC3C,aAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IAC/C,CAAC;IAEM,aAAa,CAAC,KAAa,EAAE,SAAiB;QACpD,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAChD,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,aAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YACjD,OAAO,KAAK,CAAC;QACd,CAAC;QACD,IAAI,SAAS,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACvC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACjC,aAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YAC/C,OAAO,KAAK,CAAC;QACd,CAAC;QACD,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACvC,aAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE;gBACvC,QAAQ,EAAE,SAAS,CAAC,SAAS;gBAC7B,MAAM,EAAE,SAAS;aACjB,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACjC,aAAG,CAAC,IAAI,CAAC,oCAAoC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC;IACb,CAAC;IAEM,yBAAyB,CAC/B,SAAiB,EACjB,YAAoB,EACpB,cAAsB,EACtB,qBAA6B,EAC7B,OAAe;QAEf,MAAM,IAAI,GAAG,gBAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CACnC,IAAI,EACJ,SAAS,EACT,YAAY,EACZ,cAAc,EACd,qBAAqB,EACrB,OAAO,CACP,CAAC;QACF,aAAG,CAAC,IAAI,CAAC,oCAAoC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC;IACb,CAAC;IAEM,KAAK,CAAC,oBAAoB,CAChC,MAAyB;QAEzB,aAAG,CAAC,IAAI,CAAC,4BAA4B,EAAE;YACtC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa;SACzC,CAAC,CAAC;QACH,MAAM,eAAe,GAAG,4BAAe,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACrE,IAAI,eAAe,EAAE,CAAC;YACrB,OAAO,eAAe,CAAC;QACxB,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAK,CAAC,CAAC;QAClE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,aAAG,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YACzE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,CAAC;QACpF,CAAC;QACD,MAAM,mBAAmB,GAAG,IAAI,CAAC,aAAa,CAAC,oBAAoB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACtF,IAAI,mBAAmB,EAAE,CAAC;YACzB,IACC,mBAAmB,CAAC,KAAK,KAAK,eAAe;gBAC7C,mBAAmB,CAAC,iBAAiB,KAAK,4BAA4B,EACrE,CAAC;gBACF,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC,MAAM,CAAC,IAAK,CAAC,CAAC;YACrD,CAAC;YACD,OAAO,mBAAmB,CAAC;QAC5B,CAAC;QACD,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAC3D,QAAQ,CAAC,OAAO,EAChB,MAAM,CAAC,SAAS,CAChB,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC,MAAM,CAAC,IAAK,CAAC,CAAC;QACpD,aAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3F,OAAO,aAAa,CAAC;IACtB,CAAC;IAEM,mBAAmB,CAAC,KAAa;QACvC,OAAO,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC;IAEM,SAAS,CAAC,SAAiB;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC;IAEM,OAAO;QACb,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;IACzB,CAAC;CACD;AA5JD,kCA4JC"}
+{"version":3,"file":"oauth-server.js","sourceRoot":"","sources":["../../../src/server/oauth/oauth-server.ts"],"names":[],"mappings":";;;;;;AAAA,oDAA4B;AAE5B,oDAA4B;AAE5B,qDAAsD;AACtD,uCAAyC;AACzC,mDAAmE;AACnE,6CAA+C;AAc/C,MAAM,wBAAwB,GAAG,IAAI,CAAC;AACtC,MAAM,YAAY,GAAG,gBAAgB,CAAC;AAEtC,MAAa,WAAW;IACN,QAAQ,GAAG,IAAI,sBAAY,EAAE,CAAC;IAC9B,aAAa,CAAoB;IAElD;;;OAGG;IACH,YAAY,SAAiB;QAC5B,IAAI,CAAC,aAAa,GAAG,IAAI,iCAAiB,CAAC,SAAS,CAAC,CAAC;IACvD,CAAC;IAEO,2BAA2B,CAAC,SAAiB,EAAE,YAAoB;QAC1E,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,OAAO,KAAK,CAAC;QACd,CAAC;QACD,8EAA8E;QAC9E,yFAAyF;QACzF,IAAI,CAAC,4BAAe,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAAE,CAAC;YACzD,aAAG,CAAC,IAAI,CAAC,qCAAqC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YAC/D,OAAO,KAAK,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,mCAAkB,CAAC,kBAAkB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAC9E,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC;IACb,CAAC;IAED,qGAAqG;IAC7F,YAAY,CAAC,OAAe,EAAE,SAAiB,EAAE,GAAkB;QAC1E,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QACrF,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,oBAAoB,EAAE,CAAC;QAChE,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,aAAa,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACnE,OAAO;YACN,YAAY;YACZ,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,wBAAwB;YACpC,aAAa;YACb,KAAK,EAAE,YAAY;SACnB,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,0BAA0B,CAAC,IAOjC;QACA,MAAM,WAAW,GAAG,gBAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ,CAAC,yBAAyB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAC3D,OAAO,WAAW,CAAC;IACpB,CAAC;IAEM,wBAAwB,CAAC,WAAmB;QAClD,OAAO,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC,WAAW,CAAC,CAAC;IAC5D,CAAC;IAEM,cAAc,CAAC,aAAuB;QAC5C,MAAM,MAAM,GAAG,mCAAkB,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAChC,OAAO,MAAM,CAAC;IACf,CAAC;IAEM,4BAA4B,CAAC,MAAiC;QACpE,IAAI,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,aAAa,GAAG,IAAI,CAAC,2BAA2B,CACrD,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,YAAY,CACnB,CAAC;YACF,IAAI,aAAa,EAAE,CAAC;gBACnB,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACpD,CAAC;QACF,CAAC;QACD,OAAO,4BAAe,CAAC,4BAA4B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrE,CAAC;IAEM,yBAAyB,CAC/B,SAAiB,EACjB,YAAoB,EACpB,cAAsB,EACtB,qBAA6B,EAC7B,OAAe;QAEf,MAAM,IAAI,GAAG,gBAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CACnC,IAAI,EACJ,SAAS,EACT,YAAY,EACZ,cAAc,EACd,qBAAqB,EACrB,OAAO,CACP,CAAC;QACF,aAAG,CAAC,IAAI,CAAC,oCAAoC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC;IACb,CAAC;IAEM,KAAK,CAAC,oBAAoB,CAChC,MAAyB,EACzB,GAAkB;QAElB,aAAG,CAAC,IAAI,CAAC,4BAA4B,EAAE;YACtC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa;SACzC,CAAC,CAAC;QACH,MAAM,eAAe,GAAG,4BAAe,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACrE,IAAI,eAAe,EAAE,CAAC;YACrB,OAAO,eAAe,CAAC;QACxB,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAK,CAAC,CAAC;QAClE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,aAAG,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YACzE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,CAAC;QACpF,CAAC;QACD,MAAM,mBAAmB,GAAG,IAAI,CAAC,aAAa,CAAC,oBAAoB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACtF,IAAI,mBAAmB,EAAE,CAAC;YACzB,IACC,mBAAmB,CAAC,KAAK,KAAK,eAAe;gBAC7C,mBAAmB,CAAC,iBAAiB,KAAK,4BAA4B,EACrE,CAAC;gBACF,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC,MAAM,CAAC,IAAK,CAAC,CAAC;YACrD,CAAC;YACD,OAAO,mBAAmB,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC,MAAM,CAAC,IAAK,CAAC,CAAC;QACpD,aAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3F,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACnE,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,oBAAoB,CAChC,MAAyB,EACzB,GAAkB,EAClB,gBAAkC;QAElC,MAAM,eAAe,GAAG,4BAAe,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACrE,IAAI,eAAe,EAAE,CAAC;YACrB,OAAO,eAAe,CAAC;QACxB,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,aAAc,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO;gBACN,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EAAE,kCAAkC;aACrD,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YACzC,oFAAoF;YACpF,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,MAAM,CAAC,aAAc,CAAC,CAAC;YACxD,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,MAAM,CAAC,aAAc,CAAC,CAAC;YACxD,OAAO;gBACN,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EAAE,4CAA4C;aAC/D,CAAC;QACH,CAAC;QACD,qDAAqD;QACrD,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,MAAM,CAAC,aAAc,CAAC,CAAC;QACxD,aAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACxF,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC7D,CAAC;IAED,qGAAqG;IAC9F,mBAAmB,CAAC,KAAa,EAAE,GAAkB;QAC3D,OAAO,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC;IAC5E,CAAC;IAED;iGAC6F;IACtF,oBAAoB,CAAC,KAAa,EAAE,GAAkB;QAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACnE,IAAI,OAAO,EAAE,CAAC;YACb,OAAO,OAAO,CAAC,OAAO,CAAC;QACxB,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC;IAC9D,CAAC;IAED,6EAA6E;IACtE,yBAAyB,CAAC,OAAe;QAC/C,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;IAEM,OAAO;QACb,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;IACzB,CAAC;CACD;AAvMD,kCAuMC"}

package/dist/server/oauth/storage.d.ts

@@ -7,23 +7,60 @@ export interface AuthorizationCodeData {
     userKey: string;
     expires_at: number;
 }
-export interface StateData {
+/**
+ * A brokered authorization in flight between `/authorize` and `/oauth/callback`. It links the MCP
+ * client's request (its redirect + PKCE + state) to our own Creatio-leg PKCE verifier, keyed by an
+ * opaque broker state. Kept server-side ON PURPOSE — nothing is embedded in the Creatio `state`
+ * string, so the two PKCE pairs never collide.
+ */
+export interface PendingAuthorizationData {
+    client_id: string;
+    /** The MCP client's redirect URI (where we send our code at the end). */
+    redirect_uri: string;
+    /** The MCP client's PKCE challenge (verified later at /token). */
+    code_challenge: string;
+    code_challenge_method: string;
+    /** The MCP client's state, echoed back to it. */
+    client_state?: string | undefined;
+    /** Our Creatio-leg PKCE verifier, used to exchange the Creatio code in the callback. */
+    creatio_verifier: string;
+    expires_at: number;
+}
+/** A refresh token the broker issued to a client, bound to the user it represents and the client
+ *  it was issued to (so a stolen token can't be redeemed by a different client). Single-use:
+ *  rotated on every refresh. */
+export interface RefreshTokenData {
+    userKey: string;
     client_id: string;
     expires_at: number;
 }
 export declare class OAuthStorage {
+    private static readonly CLIENT_TTL_MS;
+    private static readonly MAX_CLIENTS;
+    private static readonly REFRESH_TOKEN_TTL_MS;
     private readonly _clients;
     private readonly _authorizationCodes;
-    private readonly _authorizationStates;
+    private readonly _pendingAuthorizations;
+    private readonly _refreshTokens;
+    private _evictExpired;
+    private _evictExpiredClients;
+    /** Hard-cap the client store, evicting the oldest (insertion order ~ creation order). */
+    private _capClients;
     addClient(client: OAuthClient): void;
     getClient(client_id: string): OAuthClient | undefined;
     hasClient(client_id: string): boolean;
     storeAuthorizationCode(code: string, client_id: string, redirect_uri: string, code_challenge: string, code_challenge_method: string, userKey: string, expiresInMs?: number): void;
     getAuthorizationCode(code: string): AuthorizationCodeData | undefined;
     deleteAuthorizationCode(code: string): void;
-    storeState(state: string, client_id: string, expiresInMs?: number): void;
-    getState(state: string): StateData | undefined;
-    deleteState(state: string): void;
+    storePendingAuthorization(brokerState: string, data: Omit<PendingAuthorizationData, 'expires_at'>, expiresInMs?: number): void;
+    /** Returns and removes the pending authorization (single-use), or `undefined` if absent/expired. */
+    takePendingAuthorization(brokerState: string): PendingAuthorizationData | undefined;
+    storeRefreshToken(token: string, userKey: string, client_id: string, expiresInMs?: number): void;
+    /** Returns the refresh-token record, or `undefined` if absent/expired (expired ones are pruned). */
+    getRefreshToken(token: string): RefreshTokenData | undefined;
+    deleteRefreshToken(token: string): void;
+    /** Drop every refresh token issued for a user (logout / revoke). */
+    deleteRefreshTokensForUser(userKey: string): void;
     cleanup(): void;
 }
 //# sourceMappingURL=storage.d.ts.map

package/dist/server/oauth/storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../../src/server/oauth/storage.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C,MAAM,WAAW,qBAAqB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,SAAS;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,YAAY;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkC;IAC3D,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAA4C;IAChF,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAgC;IAE9D,SAAS,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI;IAIpC,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS;IAIrD,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAIrC,sBAAsB,CAC5B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,cAAc,EAAE,MAAM,EACtB,qBAAqB,EAAE,MAAM,EAC7B,OAAO,EAAE,MAAM,EACf,WAAW,GAAE,MAAuB,GAClC,IAAI;IAYA,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS;IAIrE,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAI3C,UAAU,CAChB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,WAAW,GAAE,MAAuB,GAClC,IAAI;IAKA,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS;IAI9C,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAIhC,OAAO,IAAI,IAAI;CAiBtB"}
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../../src/server/oauth/storage.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C,MAAM,WAAW,qBAAqB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,cAAc,EAAE,MAAM,CAAC;IACvB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,iDAAiD;IACjD,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,wFAAwF;IACxF,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;CACnB;AAED;;gCAEgC;AAChC,MAAM,WAAW,gBAAgB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,YAAY;IAGxB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAuB;IAC5D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAQ;IAC3C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAA4B;IAExE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkC;IAC3D,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAA4C;IAChF,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAA+C;IACtF,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAuC;IAEtE,OAAO,CAAC,aAAa;IAQrB,OAAO,CAAC,oBAAoB;IAS5B,yFAAyF;IACzF,OAAO,CAAC,WAAW;IAUZ,SAAS,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI;IAKpC,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS;IAIrD,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAIrC,sBAAsB,CAC5B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,cAAc,EAAE,MAAM,EACtB,qBAAqB,EAAE,MAAM,EAC7B,OAAO,EAAE,MAAM,EACf,WAAW,GAAE,MAAuB,GAClC,IAAI;IAYA,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS;IAIrE,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAI3C,yBAAyB,CAC/B,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,IAAI,CAAC,wBAAwB,EAAE,YAAY,CAAC,EAClD,WAAW,GAAE,MAAuB,GAClC,IAAI;IAOP,oGAAoG;IAC7F,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,wBAAwB,GAAG,SAAS;IASnF,iBAAiB,CACvB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,WAAW,GAAE,MAA0C,GACrD,IAAI;IAQP,oGAAoG;IAC7F,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS;IAY5D,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAI9C,oEAAoE;IAC7D,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAQjD,OAAO,IAAI,IAAI;CAatB"}

package/dist/server/oauth/storage.js

@@ -6,11 +6,43 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.OAuthStorage = void 0;
 const log_1 = __importDefault(require("../../log"));
 class OAuthStorage {
+    // Dynamically-registered clients are unauthenticated (open DCR), so the store is bounded by TTL
+    // + a hard cap, evicting the oldest, to deny a memory-exhaustion DoS via IP-rotating /register.
+    static CLIENT_TTL_MS = 24 * 60 * 60 * 1000;
+    static MAX_CLIENTS = 1000;
+    static REFRESH_TOKEN_TTL_MS = 30 * 24 * 60 * 60 * 1000;
     _clients = new Map();
     _authorizationCodes = new Map();
-    _authorizationStates = new Map();
+    _pendingAuthorizations = new Map();
+    _refreshTokens = new Map();
+    _evictExpired(map, now) {
+        for (const [key, data] of map.entries()) {
+            if (now > data.expires_at) {
+                map.delete(key);
+            }
+        }
+    }
+    _evictExpiredClients(now) {
+        for (const [id, client] of this._clients.entries()) {
+            if (now - client.created_at > OAuthStorage.CLIENT_TTL_MS) {
+                this._clients.delete(id);
+            }
+        }
+        this._capClients();
+    }
+    /** Hard-cap the client store, evicting the oldest (insertion order ~ creation order). */
+    _capClients() {
+        while (this._clients.size > OAuthStorage.MAX_CLIENTS) {
+            const oldest = this._clients.keys().next().value;
+            if (oldest === undefined) {
+                break;
+            }
+            this._clients.delete(oldest);
+        }
+    }
     addClient(client) {
         this._clients.set(client.client_id, client);
+        this._capClients();
     }
     getClient(client_id) {
         return this._clients.get(client_id);
@@ -35,31 +67,62 @@ class OAuthStorage {
     deleteAuthorizationCode(code) {
         this._authorizationCodes.delete(code);
     }
-    storeState(state, client_id, expiresInMs = 30 * 60 * 1000) {
-        const expires_at = Date.now() + expiresInMs;
-        this._authorizationStates.set(state, { client_id, expires_at });
+    storePendingAuthorization(brokerState, data, expiresInMs = 10 * 60 * 1000) {
+        this._pendingAuthorizations.set(brokerState, {
+            ...data,
+            expires_at: Date.now() + expiresInMs,
+        });
     }
-    getState(state) {
-        return this._authorizationStates.get(state);
+    /** Returns and removes the pending authorization (single-use), or `undefined` if absent/expired. */
+    takePendingAuthorization(brokerState) {
+        const data = this._pendingAuthorizations.get(brokerState);
+        if (!data) {
+            return undefined;
+        }
+        this._pendingAuthorizations.delete(brokerState);
+        return Date.now() > data.expires_at ? undefined : data;
     }
-    deleteState(state) {
-        this._authorizationStates.delete(state);
+    storeRefreshToken(token, userKey, client_id, expiresInMs = OAuthStorage.REFRESH_TOKEN_TTL_MS) {
+        this._refreshTokens.set(token, {
+            userKey,
+            client_id,
+            expires_at: Date.now() + expiresInMs,
+        });
     }
-    cleanup() {
-        const now = Date.now();
-        for (const [code, data] of this._authorizationCodes.entries()) {
-            if (now > data.expires_at) {
-                this._authorizationCodes.delete(code);
-            }
+    /** Returns the refresh-token record, or `undefined` if absent/expired (expired ones are pruned). */
+    getRefreshToken(token) {
+        const data = this._refreshTokens.get(token);
+        if (!data) {
+            return undefined;
         }
-        for (const [state, data] of this._authorizationStates.entries()) {
-            if (now > data.expires_at) {
-                this._authorizationStates.delete(state);
+        if (Date.now() > data.expires_at) {
+            this._refreshTokens.delete(token);
+            return undefined;
+        }
+        return data;
+    }
+    deleteRefreshToken(token) {
+        this._refreshTokens.delete(token);
+    }
+    /** Drop every refresh token issued for a user (logout / revoke). */
+    deleteRefreshTokensForUser(userKey) {
+        for (const [token, data] of this._refreshTokens) {
+            if (data.userKey === userKey) {
+                this._refreshTokens.delete(token);
             }
         }
+    }
+    cleanup() {
+        const now = Date.now();
+        this._evictExpired(this._authorizationCodes, now);
+        this._evictExpired(this._pendingAuthorizations, now);
+        this._evictExpired(this._refreshTokens, now);
+        this._evictExpiredClients(now);
         log_1.default.info('oauth.storage.cleanup.completed', {
             remaining_codes: this._authorizationCodes.size,
-            remaining_states: this._authorizationStates.size,
+            remaining_pending: this._pendingAuthorizations.size,
+            remaining_refresh: this._refreshTokens.size,
+            remaining_clients: this._clients.size,
         });
     }
 }

package/dist/server/oauth/storage.js.map

@@ -1 +1 @@
-{"version":3,"file":"storage.js","sourceRoot":"","sources":["../../../src/server/oauth/storage.ts"],"names":[],"mappings":";;;;;;AAAA,oDAA4B;AAkB5B,MAAa,YAAY;IACP,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC1C,mBAAmB,GAAG,IAAI,GAAG,EAAiC,CAAC;IAC/D,oBAAoB,GAAG,IAAI,GAAG,EAAqB,CAAC;IAE9D,SAAS,CAAC,MAAmB;QACnC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAEM,SAAS,CAAC,SAAiB;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IAEM,SAAS,CAAC,SAAiB;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IAEM,sBAAsB,CAC5B,IAAY,EACZ,SAAiB,EACjB,YAAoB,EACpB,cAAsB,EACtB,qBAA6B,EAC7B,OAAe,EACf,cAAsB,EAAE,GAAG,EAAE,GAAG,IAAI;QAEpC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;QAC5C,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,EAAE;YAClC,SAAS;YACT,YAAY;YACZ,cAAc;YACd,qBAAqB;YACrB,OAAO;YACP,UAAU;SACV,CAAC,CAAC;IACJ,CAAC;IAEM,oBAAoB,CAAC,IAAY;QACvC,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IAEM,uBAAuB,CAAC,IAAY;QAC1C,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAEM,UAAU,CAChB,KAAa,EACb,SAAiB,EACjB,cAAsB,EAAE,GAAG,EAAE,GAAG,IAAI;QAEpC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;QAC5C,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;IACjE,CAAC;IAEM,QAAQ,CAAC,KAAa;QAC5B,OAAO,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAEM,WAAW,CAAC,KAAa;QAC/B,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAEM,OAAO;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/D,IAAI,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC3B,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACvC,CAAC;QACF,CAAC;QACD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,EAAE,CAAC;YACjE,IAAI,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC3B,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACzC,CAAC;QACF,CAAC;QACD,aAAG,CAAC,IAAI,CAAC,iCAAiC,EAAE;YAC3C,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC,IAAI;YAC9C,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC,IAAI;SAChD,CAAC,CAAC;IACJ,CAAC;CACD;AA/ED,oCA+EC"}
+{"version":3,"file":"storage.js","sourceRoot":"","sources":["../../../src/server/oauth/storage.ts"],"names":[],"mappings":";;;;;;AAAA,oDAA4B;AA0C5B,MAAa,YAAY;IACxB,gGAAgG;IAChG,gGAAgG;IACxF,MAAM,CAAU,aAAa,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACpD,MAAM,CAAU,WAAW,GAAG,IAAI,CAAC;IACnC,MAAM,CAAU,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAEvD,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC1C,mBAAmB,GAAG,IAAI,GAAG,EAAiC,CAAC;IAC/D,sBAAsB,GAAG,IAAI,GAAG,EAAoC,CAAC;IACrE,cAAc,GAAG,IAAI,GAAG,EAA4B,CAAC;IAE9D,aAAa,CAAC,GAAwC,EAAE,GAAW;QAC1E,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YACzC,IAAI,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC3B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjB,CAAC;QACF,CAAC;IACF,CAAC;IAEO,oBAAoB,CAAC,GAAW;QACvC,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YACpD,IAAI,GAAG,GAAG,MAAM,CAAC,UAAU,GAAG,YAAY,CAAC,aAAa,EAAE,CAAC;gBAC1D,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC1B,CAAC;QACF,CAAC;QACD,IAAI,CAAC,WAAW,EAAE,CAAC;IACpB,CAAC;IAED,yFAAyF;IACjF,WAAW;QAClB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC;YACtD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YACjD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM;YACP,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;IACF,CAAC;IAEM,SAAS,CAAC,MAAmB;QACnC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,WAAW,EAAE,CAAC;IACpB,CAAC;IAEM,SAAS,CAAC,SAAiB;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IAEM,SAAS,CAAC,SAAiB;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IAEM,sBAAsB,CAC5B,IAAY,EACZ,SAAiB,EACjB,YAAoB,EACpB,cAAsB,EACtB,qBAA6B,EAC7B,OAAe,EACf,cAAsB,EAAE,GAAG,EAAE,GAAG,IAAI;QAEpC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;QAC5C,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,EAAE;YAClC,SAAS;YACT,YAAY;YACZ,cAAc;YACd,qBAAqB;YACrB,OAAO;YACP,UAAU;SACV,CAAC,CAAC;IACJ,CAAC;IAEM,oBAAoB,CAAC,IAAY;QACvC,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IAEM,uBAAuB,CAAC,IAAY;QAC1C,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAEM,yBAAyB,CAC/B,WAAmB,EACnB,IAAkD,EAClD,cAAsB,EAAE,GAAG,EAAE,GAAG,IAAI;QAEpC,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,WAAW,EAAE;YAC5C,GAAG,IAAI;YACP,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW;SACpC,CAAC,CAAC;IACJ,CAAC;IAED,oGAAoG;IAC7F,wBAAwB,CAAC,WAAmB;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IACxD,CAAC;IAEM,iBAAiB,CACvB,KAAa,EACb,OAAe,EACf,SAAiB,EACjB,cAAsB,YAAY,CAAC,oBAAoB;QAEvD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE;YAC9B,OAAO;YACP,SAAS;YACT,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW;SACpC,CAAC,CAAC;IACJ,CAAC;IAED,oGAAoG;IAC7F,eAAe,CAAC,KAAa;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YAClC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAClC,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAEM,kBAAkB,CAAC,KAAa;QACtC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,oEAAoE;IAC7D,0BAA0B,CAAC,OAAe;QAChD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACjD,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;gBAC9B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnC,CAAC;QACF,CAAC;IACF,CAAC;IAEM,OAAO;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;QAClD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;QACrD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC/B,aAAG,CAAC,IAAI,CAAC,iCAAiC,EAAE;YAC3C,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC,IAAI;YAC9C,iBAAiB,EAAE,IAAI,CAAC,sBAAsB,CAAC,IAAI;YACnD,iBAAiB,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI;YAC3C,iBAAiB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;SACrC,CAAC,CAAC;IACJ,CAAC;;AAzJF,oCA0JC"}

package/dist/server/oauth/token-manager.d.ts

@@ -1,12 +1,29 @@
 import type { AuthorizationCodeData } from './storage';
-import type { OAuthAccessToken, OAuthError, OAuthTokenRequest } from './types';
+import type { OAuthError, OAuthTokenRequest } from './types';
+/**
+ * Issuer + audience an access token is bound to: this MCP deployment's own origin (`iss`) and its
+ * `/mcp` resource (`aud`). Binding both closes token-redirection / confused-deputy — a token minted
+ * for deployment A is rejected by deployment B even when both share `CREATIO_MCP_JWT_SECRET`
+ * (the documented multi-instance setup). Mirrors RFC 9068 (`aud`) / RFC 8707 (resource indicators).
+ */
+export interface TokenAudience {
+    issuer: string;
+    audience: string;
+}
+/** The claims we trust off a verified access token. */
+export interface DecodedAccessToken {
+    userKey: string;
+    client_id: string;
+}
 export declare class OAuthTokenManager {
     private readonly _jwtSecret;
     constructor(jwtSecret: string);
-    generateAccessToken(userKey: string, client_id: string): string;
+    /** Mint a 1h access token bound to `userKey` (as `sub`), the issuing `client_id`, and the
+     *  deployment's `iss`/`aud`. */
+    generateAccessToken(userKey: string, client_id: string, aud: TokenAudience): string;
     generateRefreshToken(): string;
-    validateAccessToken(token: string): string | null;
-    createTokenResponse(userKey: string, client_id: string, refresh_token_required?: boolean): OAuthAccessToken;
+    /** Verify signature AND issuer/audience binding; return the trusted claims or `null`. */
+    validateAccessToken(token: string, aud: TokenAudience): DecodedAccessToken | null;
     verifyPKCE(code_verifier: string, code_challenge: string): boolean;
     validateAuthCodeData(authCode: AuthorizationCodeData, params: OAuthTokenRequest): OAuthError | null;
 }

package/dist/server/oauth/token-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-manager.d.ts","sourceRoot":"","sources":["../../../src/server/oauth/token-manager.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAE/E,qBAAa,iBAAiB;IAC7B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;gBAExB,SAAS,EAAE,MAAM;IAItB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;IAI/D,oBAAoB,IAAI,MAAM;IAI9B,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAUjD,mBAAmB,CACzB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,sBAAsB,GAAE,OAAc,GACpC,gBAAgB;IAeZ,UAAU,CAAC,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO;IAKlE,oBAAoB,CAC1B,QAAQ,EAAE,qBAAqB,EAC/B,MAAM,EAAE,iBAAiB,GACvB,UAAU,GAAG,IAAI;CAkBpB"}
+{"version":3,"file":"token-manager.d.ts","sourceRoot":"","sources":["../../../src/server/oauth/token-manager.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CACjB;AAED,uDAAuD;AACvD,MAAM,WAAW,kBAAkB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,qBAAa,iBAAiB;IAC7B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;gBAExB,SAAS,EAAE,MAAM;IAI7B;oCACgC;IACzB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,GAAG,MAAM;IASnF,oBAAoB,IAAI,MAAM;IAIrC,yFAAyF;IAClF,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,GAAG,kBAAkB,GAAG,IAAI;IAejF,UAAU,CAAC,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO;IAKlE,oBAAoB,CAC1B,QAAQ,EAAE,qBAAqB,EAC/B,MAAM,EAAE,iBAAiB,GACvB,UAAU,GAAG,IAAI;CAkBpB"}

package/dist/server/oauth/token-manager.js

@@ -12,36 +12,35 @@ class OAuthTokenManager {
     constructor(jwtSecret) {
         this._jwtSecret = jwtSecret;
     }
-    generateAccessToken(userKey, client_id) {
-        return jsonwebtoken_1.default.sign({ userKey, client_id }, this._jwtSecret, { expiresIn: '1h' });
+    /** Mint a 1h access token bound to `userKey` (as `sub`), the issuing `client_id`, and the
+     *  deployment's `iss`/`aud`. */
+    generateAccessToken(userKey, client_id, aud) {
+        return jsonwebtoken_1.default.sign({ client_id }, this._jwtSecret, {
+            subject: userKey,
+            expiresIn: '1h',
+            issuer: aud.issuer,
+            audience: aud.audience,
+        });
     }
     generateRefreshToken() {
         return crypto_1.default.randomBytes(32).toString('base64url');
     }
-    validateAccessToken(token) {
+    /** Verify signature AND issuer/audience binding; return the trusted claims or `null`. */
+    validateAccessToken(token, aud) {
         try {
-            const decoded = jsonwebtoken_1.default.verify(token, this._jwtSecret);
-            return decoded.userKey || null;
+            const decoded = jsonwebtoken_1.default.verify(token, this._jwtSecret, {
+                issuer: aud.issuer,
+                audience: aud.audience,
+            });
+            const userKey = typeof decoded.sub === 'string' ? decoded.sub : null;
+            const client_id = typeof decoded.client_id === 'string' ? decoded.client_id : '';
+            return userKey ? { userKey, client_id } : null;
         }
         catch (error) {
             log_1.default.warn('oauth.token.invalid', { error: String(error) });
             return null;
         }
     }
-    createTokenResponse(userKey, client_id, refresh_token_required = true) {
-        const access_token = this.generateAccessToken(userKey, client_id);
-        const expires_in = 3600;
-        const tokenResponse = {
-            access_token,
-            token_type: 'Bearer',
-            expires_in,
-            userKey,
-        };
-        if (refresh_token_required) {
-            tokenResponse.refresh_token = this.generateRefreshToken();
-        }
-        return tokenResponse;
-    }
     verifyPKCE(code_verifier, code_challenge) {
         const hash = crypto_1.default.createHash('sha256').update(code_verifier).digest('base64url');
         return hash === code_challenge;

package/dist/server/oauth/token-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-manager.js","sourceRoot":"","sources":["../../../src/server/oauth/token-manager.ts"],"names":[],"mappings":";;;;;;AAAA,oDAA4B;AAE5B,gEAA+B;AAE/B,oDAA4B;AAK5B,MAAa,iBAAiB;IACZ,UAAU,CAAS;IAEpC,YAAY,SAAiB;QAC5B,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;IAC7B,CAAC;IAEM,mBAAmB,CAAC,OAAe,EAAE,SAAiB;QAC5D,OAAO,sBAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IAEM,oBAAoB;QAC1B,OAAO,gBAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACrD,CAAC;IAEM,mBAAmB,CAAC,KAAa;QACvC,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAQ,CAAC;YAC1D,OAAO,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,aAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IAEM,mBAAmB,CACzB,OAAe,EACf,SAAiB,EACjB,yBAAkC,IAAI;QAEtC,MAAM,YAAY,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAClE,MAAM,UAAU,GAAG,IAAI,CAAC;QACxB,MAAM,aAAa,GAAqB;YACvC,YAAY;YACZ,UAAU,EAAE,QAAQ;YACpB,UAAU;YACV,OAAO;SACP,CAAC;QACF,IAAI,sBAAsB,EAAE,CAAC;YAC5B,aAAa,CAAC,aAAa,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC3D,CAAC;QACD,OAAO,aAAa,CAAC;IACtB,CAAC;IAEM,UAAU,CAAC,aAAqB,EAAE,cAAsB;QAC9D,MAAM,IAAI,GAAG,gBAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACnF,OAAO,IAAI,KAAK,cAAc,CAAC;IAChC,CAAC;IAEM,oBAAoB,CAC1B,QAA+B,EAC/B,MAAyB;QAEzB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,UAAU,EAAE,CAAC;YACtC,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,CAAC;QACpF,CAAC;QACD,IAAI,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YAC7C,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,CAAC;QACzE,CAAC;QACD,IAAI,QAAQ,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC;YACnD,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,CAAC;QAC/E,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YAC3B,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACrE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,CAAC;QAClF,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;CACD;AAtED,8CAsEC"}
+{"version":3,"file":"token-manager.js","sourceRoot":"","sources":["../../../src/server/oauth/token-manager.ts"],"names":[],"mappings":";;;;;;AAAA,oDAA4B;AAE5B,gEAA+B;AAE/B,oDAA4B;AAsB5B,MAAa,iBAAiB;IACZ,UAAU,CAAS;IAEpC,YAAY,SAAiB;QAC5B,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED;oCACgC;IACzB,mBAAmB,CAAC,OAAe,EAAE,SAAiB,EAAE,GAAkB;QAChF,OAAO,sBAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE;YAC/C,OAAO,EAAE,OAAO;YAChB,SAAS,EAAE,IAAI;YACf,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;SACtB,CAAC,CAAC;IACJ,CAAC;IAEM,oBAAoB;QAC1B,OAAO,gBAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACrD,CAAC;IAED,yFAAyF;IAClF,mBAAmB,CAAC,KAAa,EAAE,GAAkB;QAC3D,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE;gBAClD,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;aACtB,CAAmB,CAAC;YACrB,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YACrE,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAChD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,aAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IAEM,UAAU,CAAC,aAAqB,EAAE,cAAsB;QAC9D,MAAM,IAAI,GAAG,gBAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACnF,OAAO,IAAI,KAAK,cAAc,CAAC;IAChC,CAAC;IAEM,oBAAoB,CAC1B,QAA+B,EAC/B,MAAyB;QAEzB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,UAAU,EAAE,CAAC;YACtC,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,CAAC;QACpF,CAAC;QACD,IAAI,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YAC7C,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,CAAC;QACzE,CAAC;QACD,IAAI,QAAQ,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC;YACnD,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,CAAC;QAC/E,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YAC3B,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACrE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,CAAC;QAClF,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;CACD;AAhED,8CAgEC"}

package/dist/server/oauth/types.d.ts

@@ -30,22 +30,10 @@ export interface OAuthAccessToken {
     expires_in: number;
     refresh_token?: string;
     scope?: string;
-    userKey: string;
 }
 export interface OAuthError {
     error: string;
     error_description?: string;
     error_uri?: string;
 }
-export interface OAuthAuthorizationServerMetadata {
-    issuer: string;
-    authorization_endpoint: string;
-    token_endpoint: string;
-    registration_endpoint: string;
-    response_types_supported: string[];
-    grant_types_supported: string[];
-    token_endpoint_auth_methods_supported: string[];
-    code_challenge_methods_supported: string[];
-    scopes_supported?: string[];
-}
 //# sourceMappingURL=types.d.ts.map

package/dist/server/oauth/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/server/oauth/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,yBAAyB;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,UAAU;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gCAAgC;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,qCAAqC,EAAE,MAAM,EAAE,CAAC;IAChD,gCAAgC,EAAE,MAAM,EAAE,CAAC;IAC3C,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/server/oauth/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,yBAAyB;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB"}

package/dist/server/oauth/validators.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validators.d.ts","sourceRoot":"","sources":["../../../src/server/oauth/validators.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,yBAAyB,EACzB,WAAW,EACX,UAAU,EACV,iBAAiB,EACjB,MAAM,SAAS,CAAC;AAIjB,qBAAa,eAAe;IAC3B;;;;OAIG;WACW,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;WAkB1C,4BAA4B,CACzC,MAAM,EAAE,yBAAyB,EACjC,MAAM,EAAE,WAAW,GAAG,SAAS,GAC7B,UAAU,GAAG,IAAI;WAgBN,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,GAAG,UAAU,GAAG,IAAI;WAUlE,0BAA0B,CAAC,aAAa,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI;CAsB/E"}
+{"version":3,"file":"validators.d.ts","sourceRoot":"","sources":["../../../src/server/oauth/validators.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,yBAAyB,EACzB,WAAW,EACX,UAAU,EACV,iBAAiB,EACjB,MAAM,SAAS,CAAC;AAIjB,qBAAa,eAAe;IAC3B;;;;OAIG;WACW,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;WAkB1C,4BAA4B,CACzC,MAAM,EAAE,yBAAyB,EACjC,MAAM,EAAE,WAAW,GAAG,SAAS,GAC7B,UAAU,GAAG,IAAI;WAgBN,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,GAAG,UAAU,GAAG,IAAI;WAmBlE,0BAA0B,CAAC,aAAa,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI;CAsB/E"}

package/dist/server/oauth/validators.js

@@ -43,13 +43,22 @@ class OAuthValidators {
         return null;
     }
     static validateTokenRequest(params) {
-        if (params.grant_type !== 'authorization_code') {
-            return { error: 'unsupported_grant_type' };
+        if (params.grant_type === 'authorization_code') {
+            if (!params.code || !params.code_verifier) {
+                return {
+                    error: 'invalid_request',
+                    error_description: 'Missing code or code_verifier',
+                };
+            }
+            return null;
         }
-        if (!params.code || !params.code_verifier) {
-            return { error: 'invalid_request', error_description: 'Missing code or code_verifier' };
+        if (params.grant_type === 'refresh_token') {
+            if (!params.refresh_token) {
+                return { error: 'invalid_request', error_description: 'Missing refresh_token' };
+            }
+            return null;
         }
-        return null;
+        return { error: 'unsupported_grant_type' };
     }
     static validateClientRegistration(redirect_uris) {
         if (!redirect_uris || !Array.isArray(redirect_uris)) {