mikser-io-auth 0.5.0 → 0.5.2

package/index.js

@@ -8,7 +8,7 @@ import { basic, jwt } from './lib/verifiers.js'
 import { redirectUriAllowed, validateRedirectUri, registerDynamicClient } from './lib/clients.js'
 import { challengeFromVerifier, verifyPkce, opaqueToken } from './lib/pkce.js'
 import { loginPage } from './lib/login-page.js'
-import { mountRoutes } from './lib/routes.js'
+import { mountRoutes, metadataHandler } from './lib/routes.js'
 import * as grants from './lib/grants.js'
 
 export { parseHtpasswd, parseHtgroup, verifyPassword, createIdentityStore }
@@ -152,6 +152,22 @@ export function auth(options = {}) {
 
             app.use(base, router)
 
+            // RFC 8414 §3.1: an issuer with no path component publishes its
+            // metadata at <origin>/.well-known/oauth-authorization-server.
+            // `issuerFor` is the origin, so that is where a conforming client
+            // looks — including every MCP client, which is sent here by the
+            // resource's RFC 9728 document naming this issuer. Mounted under
+            // `base` alone, the document exists but at an address nothing
+            // following the spec will ask for, and dynamic client
+            // registration fails with the metadata sitting right there.
+            //
+            // The copy under `base` stays: clients that append to the issuer
+            // rather than insert the well-known segment find it there.
+            if (base && base !== '/') {
+                app.get('/.well-known/oauth-authorization-server',
+                    metadataHandler({ base, issuerFor: originOf }))
+            }
+
             // Codes are 60s and refresh tokens 30d; without a sweep the rows
             // accumulate for the life of the database. Once at boot is enough
             // for a build tool — the checks that matter (expiry, single use)

package/lib/grants.js

@@ -49,7 +49,21 @@ registerSchema('auth', `
         created_at    INTEGER NOT NULL,
         last_used_at  INTEGER
     );
-`)
+`, {
+    // Durable: these tables are not derived from anything on disk.
+    //
+    // The engine wipes its database whenever the schema version or the
+    // config checksum changes — an upgrade, or any deploy that edits
+    // mikser.config.js. That is correct for a cache the files can rebuild,
+    // and wrong here: a registered OAuth client and its refresh token exist
+    // only because a human completed a sign-in once. Losing them logs every
+    // connected agent out, and the operator's first sign of it is being
+    // asked to authorize again after an unrelated deploy.
+    //
+    // Codes are 60s and swept anyway; they ride along because they share the
+    // schema, and a stale one is rejected on expiry rather than trusted.
+    durable: true,
+})
 
 const db = () => useDatabase().handle
 

package/lib/routes.js

@@ -19,6 +19,33 @@ function authParams(src) {
     return { response_type, client_id, redirect_uri, code_challenge, code_challenge_method, scope, state }
 }
 
+// The authorization server metadata document.
+//
+// Exported because WHERE it is served is part of the contract, and one mount
+// cannot satisfy it. `issuerFor` returns the origin, and RFC 8414 §3.1 says
+// an issuer with no path component publishes at
+// <origin>/.well-known/oauth-authorization-server. This router is mounted
+// under `base`, so its own copy answers one level down — where a client that
+// appends to the issuer looks, and nowhere a client following RFC 8414 does.
+// index.js mounts this at the root as well; both paths return this document.
+export function metadataHandler({ base, issuerFor }) {
+    return (req, res) => {
+        const issuer = issuerFor(req)
+        res.json({
+            issuer,
+            authorization_endpoint:                `${issuer}${base}/authorize`,
+            token_endpoint:                        `${issuer}${base}/token`,
+            jwks_uri:                              `${issuer}${base}/jwks.json`,
+            response_types_supported:              ['code'],
+            grant_types_supported:                 ['authorization_code', 'refresh_token', 'password'],
+            code_challenge_methods_supported:      ['S256'],
+            token_endpoint_auth_methods_supported: ['none'],
+            id_token_signing_alg_values_supported: [ALG],
+            registration_endpoint:                 `${issuer}${base}/register`,
+        })
+    }
+}
+
 export function mountRoutes(router, ctx) {
     const { base, nameOf, ready, logoUrl, ttl, issuerFor, audienceFor, dcr, logger } = ctx
 
@@ -41,21 +68,7 @@ export function mountRoutes(router, ctx) {
         res.json(jwks({ publicJwk: ready().key.publicJwk }))
     })
 
-    router.get('/.well-known/oauth-authorization-server', (req, res) => {
-        const issuer = issuerFor(req)
-        res.json({
-            issuer,
-            authorization_endpoint:                `${issuer}${base}/authorize`,
-            token_endpoint:                        `${issuer}${base}/token`,
-            jwks_uri:                              `${issuer}${base}/jwks.json`,
-            response_types_supported:              ['code'],
-            grant_types_supported:                 ['authorization_code', 'refresh_token', 'password'],
-            code_challenge_methods_supported:      ['S256'],
-            token_endpoint_auth_methods_supported: ['none'],
-            id_token_signing_alg_values_supported: [ALG],
-            registration_endpoint:                 `${issuer}${base}/register`,
-        })
-    })
+    router.get('/.well-known/oauth-authorization-server', metadataHandler({ base, issuerFor }))
 
     // ── /authorize ───────────────────────────────────────────────────────
     //

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mikser-io-auth",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "Authentication for mikser-io: an OAuth 2.1 authorization server (self-registering clients, authorization code + PKCE, refresh rotation) and HTTP Basic / JWT verifiers over Apache-format htpasswd and htgroup files in the working folder. Implements the ADR-0012 verifier contract, so it plugs in wherever a static token does — api, mcp, forms.",
   "main": "index.js",
   "type": "module",

package/test/authorize.test.js

@@ -340,6 +340,34 @@ describe('discovery', () => {
         assert.ok(doc.grant_types_supported.includes('authorization_code'))
     })
 
+    // RFC 8414 §3.1: the metadata for an issuer with no path component lives
+    // at <origin>/.well-known/oauth-authorization-server. The document names
+    // the origin as its issuer, so serving it only under /auth makes it
+    // unreachable at the one address a conforming client derives — and every
+    // MCP client is a conforming client, sent here by the resource's RFC 9728
+    // document. Dynamic registration then fails with the metadata present.
+    it('serves the metadata at the origin, where the issuer it declares says it is', async () => {
+        const res = await fetch(url('/.well-known/oauth-authorization-server'))
+        assert.equal(res.status, 200)
+        const doc = await res.json()
+        assert.match(doc.registration_endpoint, /\/auth\/register$/)
+    })
+
+    it('is reachable by deriving the URL from the issuer it declares', async () => {
+        const doc = await (await fetch(url('/auth/.well-known/oauth-authorization-server'))).json()
+        // What a client actually does: take `issuer`, append the well-known
+        // path, fetch. If that 404s, discovery is broken however correct the
+        // document's contents are.
+        const derived = await fetch(`${doc.issuer}/.well-known/oauth-authorization-server`)
+        assert.equal(derived.status, 200)
+    })
+
+    it('serves the same document at both mounts', async () => {
+        const atBase = await (await fetch(url('/auth/.well-known/oauth-authorization-server'))).json()
+        const atRoot = await (await fetch(url('/.well-known/oauth-authorization-server'))).json()
+        assert.deepEqual(atRoot, atBase)
+    })
+
     it('publishes a JWKS with no private component', async () => {
         const doc = await (await fetch(url('/auth/jwks.json'))).json()
         assert.equal(doc.keys.length, 1)