rivet-design 0.10.7 → 0.10.9

package/dist/mcp/auth/httpOAuthProvider.d.ts

@@ -0,0 +1,103 @@
+import type { Response } from 'express';
+import type { OAuthServerProvider, AuthorizationParams } from '@modelcontextprotocol/sdk/server/auth/provider.js';
+import type { OAuthRegisteredClientsStore } from '@modelcontextprotocol/sdk/server/auth/clients.js';
+import type { OAuthClientInformationFull, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
+import type { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types.js';
+/** Rivet credentials issued by the proxy after a completed browser login. */
+export type PersistedRivetTokens = {
+    token: string;
+    refreshToken?: string;
+    user?: {
+        id: string;
+        email: string;
+    };
+};
+export type RivetOAuthProviderOptions = {
+    /** Base URL of the Rivet proxy (auth backend), e.g. https://rivet-proxy.onrender.com */
+    proxyUrl: string;
+    /**
+     * Public URL of the local OAuth browser callback page. Must be a bare
+     * localhost origin (no path) — the proxy rejects custom redirect paths.
+     */
+    callbackUrl: string;
+    /** The MCP client (`--editor`), recorded with the login for analytics. */
+    mcpEditor?: string;
+    /** Persists tokens locally after login (e.g. ConfigManager.setAuth). */
+    persistTokens?: (tokens: PersistedRivetTokens) => void;
+    /** Confirms a refresh token is still accepted by durable local auth state. */
+    isRefreshTokenCurrent?: (refreshToken: string) => boolean;
+    fetchImpl?: typeof fetch;
+    /** Test override for the proxy token polling interval. */
+    pollIntervalMs?: number;
+};
+/** In-memory dynamic client registration store (clients are ephemeral). */
+declare class InMemoryClientsStore implements OAuthRegisteredClientsStore {
+    private clients;
+    getClient(clientId: string): OAuthClientInformationFull | undefined;
+    registerClient(client: Omit<OAuthClientInformationFull, 'client_id' | 'client_id_issued_at'> & Partial<Pick<OAuthClientInformationFull, 'client_id' | 'client_id_issued_at'>>): OAuthClientInformationFull;
+}
+/**
+ * OAuth authorization server provider that bridges the MCP OAuth spec
+ * (authorization code + PKCE, dynamic client registration) onto the existing
+ * Rivet proxy Google login flow:
+ *
+ * 1. `authorize` starts a proxy Google login with this server's local
+ *    callback page as the redirect origin and sends the browser to Google.
+ * 2. The browser returns to the local callback page, which forwards the
+ *    Supabase hash tokens to `completeBrowserCallback`. That completes the
+ *    proxy login, obtains the Rivet access token, and mints a single-use
+ *    authorization code bound to the client's PKCE challenge.
+ * 3. `exchangeAuthorizationCode` returns the Rivet access token as the OAuth
+ *    access token; `verifyAccessToken` validates bearer tokens against the
+ *    proxy profile endpoint.
+ */
+export declare class RivetOAuthServerProvider implements OAuthServerProvider {
+    readonly clientsStore: InMemoryClientsStore;
+    private readonly proxyUrl;
+    private readonly callbackUrl;
+    private readonly mcpEditor?;
+    private readonly persistTokens?;
+    private readonly isRefreshTokenCurrent?;
+    private readonly fetchFn;
+    private readonly pollIntervalMs;
+    private readonly pendingAuthorizations;
+    private readonly authorizationCodes;
+    private readonly issuedBearerTokens;
+    private readonly verifiedTokens;
+    private readonly revokedAccessTokens;
+    private readonly revokedRefreshTokens;
+    private readonly activeRefreshTokens;
+    constructor(options: RivetOAuthProviderOptions);
+    authorize(client: OAuthClientInformationFull, params: AuthorizationParams, res: Response): Promise<void>;
+    /**
+     * Completes a browser login forwarded by the local OAuth callback page:
+     * finishes the proxy login session, obtains Rivet credentials, mints a
+     * single-use authorization code, and returns the MCP client redirect URL.
+     */
+    completeBrowserCallback(input: {
+        sessionId?: string;
+        accessToken?: string;
+        refreshToken?: string;
+    }): Promise<{
+        redirectUrl: string;
+    }>;
+    challengeForAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string): Promise<string>;
+    exchangeAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string, _codeVerifier?: string, redirectUri?: string): Promise<OAuthTokens>;
+    exchangeRefreshToken(_client: OAuthClientInformationFull, refreshToken: string): Promise<OAuthTokens>;
+    verifyAccessToken(token: string): Promise<AuthInfo>;
+    /**
+     * Invalidates a bearer token issued by this OAuth provider and its paired
+     * refresh token, if the provider knows one.
+     */
+    revokeAccessToken(token: string): void;
+    private rememberIssuedBearerToken;
+    private getValidCodeEntry;
+    private toOAuthTokens;
+    private pollForRivetTokens;
+    private prunePendingAuthorizations;
+    private pruneAuthorizationCodes;
+    private pruneVerifiedTokens;
+    private pruneIssuedBearerTokens;
+}
+export {};
+//# sourceMappingURL=httpOAuthProvider.d.ts.map

package/dist/mcp/auth/httpOAuthProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"httpOAuthProvider.d.ts","sourceRoot":"","sources":["../../../src/mcp/auth/httpOAuthProvider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,KAAK,EACV,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AACpG,OAAO,KAAK,EACV,0BAA0B,EAC1B,WAAW,EACZ,MAAM,0CAA0C,CAAC;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAgC/E,6EAA6E;AAC7E,MAAM,MAAM,oBAAoB,GAAG;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,wFAAwF;IACxF,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,oBAAoB,KAAK,IAAI,CAAC;IACvD,8EAA8E;IAC9E,qBAAqB,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC;IAC1D,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,0DAA0D;IAC1D,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAoCF,2EAA2E;AAC3E,cAAM,oBAAqB,YAAW,2BAA2B;IAC/D,OAAO,CAAC,OAAO,CAAiD;IAEhE,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,0BAA0B,GAAG,SAAS;IAInE,cAAc,CACZ,MAAM,EAAE,IAAI,CAAC,0BAA0B,EAAE,WAAW,GAAG,qBAAqB,CAAC,GAC3E,OAAO,CAAC,IAAI,CAAC,0BAA0B,EAAE,WAAW,GAAG,qBAAqB,CAAC,CAAC,GAC/E,0BAA0B;CAgB9B;AAgGD;;;;;;;;;;;;;;GAcG;AACH,qBAAa,wBAAyB,YAAW,mBAAmB;IAClE,QAAQ,CAAC,YAAY,uBAA8B;IAEnD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAyC;IACxE,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAoC;IAC3E,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IAExC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAGlC;IACJ,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAG/B;IACJ,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAwC;IAC3E,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqC;IACpE,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IACzD,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAqB;IAC1D,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;gBAE7C,OAAO,EAAE,yBAAyB;IAUxC,SAAS,CACb,MAAM,EAAE,0BAA0B,EAClC,MAAM,EAAE,mBAAmB,EAC3B,GAAG,EAAE,QAAQ,GACZ,OAAO,CAAC,IAAI,CAAC;IAqDhB;;;;OAIG;IACG,uBAAuB,CAAC,KAAK,EAAE;QACnC,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IA4D9B,6BAA6B,CACjC,MAAM,EAAE,0BAA0B,EAClC,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,MAAM,CAAC;IAKZ,yBAAyB,CAC7B,MAAM,EAAE,0BAA0B,EAClC,iBAAiB,EAAE,MAAM,EACzB,aAAa,CAAC,EAAE,MAAM,EACtB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,WAAW,CAAC;IAcjB,oBAAoB,CACxB,OAAO,EAAE,0BAA0B,EACnC,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,WAAW,CAAC;IAkCjB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IA8DzD;;;OAGG;IACH,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAWtC,OAAO,CAAC,yBAAyB;IAYjC,OAAO,CAAC,iBAAiB;IAgBzB,OAAO,CAAC,aAAa;YAYP,kBAAkB;IAoChC,OAAO,CAAC,0BAA0B;IASlC,OAAO,CAAC,uBAAuB;IAS/B,OAAO,CAAC,mBAAmB;IAS3B,OAAO,CAAC,uBAAuB;CAQhC"}

package/dist/mcp/auth/httpOAuthProvider.js

@@ -0,0 +1,454 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RivetOAuthServerProvider = void 0;
+const crypto_1 = require("crypto");
+const errors_js_1 = require("@modelcontextprotocol/sdk/server/auth/errors.js");
+const accessTokenRefresh_1 = require("../../services/accessTokenRefresh");
+const telemetry_1 = require("../../config/telemetry");
+const logger_1 = require("../../utils/logger");
+const log = (0, logger_1.createLogger)('mcp-http-oauth');
+const AUTH_CODE_TTL_MS = 10 * 60_000;
+const PENDING_AUTH_TTL_MS = 10 * 60_000;
+const TOKEN_VERIFY_CACHE_TTL_MS = 60_000;
+const DEFAULT_TOKEN_TTL_SECONDS = 3600;
+const TOKEN_POLL_MAX_ATTEMPTS = 120;
+const TOKEN_POLL_INTERVAL_MS = 1000;
+const PROFILE_FETCH_TIMEOUT_MS = 10_000;
+const MCP_OAUTH_SCOPE = 'rivet';
+const HOSTED_DASHBOARD_AUTH_URL = 'https://rivet-proxy.onrender.com/dashboard/';
+const LOOPBACK_REDIRECT_HOSTS = new Set([
+    'localhost',
+    '127.0.0.1',
+    '::1',
+    '[::1]',
+]);
+/** In-memory dynamic client registration store (clients are ephemeral). */
+class InMemoryClientsStore {
+    clients = new Map();
+    getClient(clientId) {
+        return this.clients.get(clientId);
+    }
+    registerClient(client) {
+        if (!client.redirect_uris.every(isLoopbackRedirectUri)) {
+            throw new errors_js_1.InvalidClientMetadataError('Rivet MCP OAuth clients must use loopback HTTP redirect URIs.');
+        }
+        const registered = {
+            ...client,
+            client_id: client.client_id ?? (0, crypto_1.randomUUID)(),
+            client_id_issued_at: client.client_id_issued_at ?? Math.floor(Date.now() / 1000),
+        };
+        this.clients.set(registered.client_id, registered);
+        return registered;
+    }
+}
+const isLoopbackRedirectUri = (redirectUri) => {
+    try {
+        const url = new URL(redirectUri);
+        return (url.protocol === 'http:' && LOOPBACK_REDIRECT_HOSTS.has(url.hostname));
+    }
+    catch {
+        return false;
+    }
+};
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+const escapeHtml = (value) => value
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;');
+/**
+ * Shows the browser user which local OAuth client will receive the code before
+ * starting Google sign-in.
+ */
+const getClientApprovalHtml = (input) => {
+    const clientName = input.clientName?.trim() || 'Unknown MCP client';
+    return `<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Approve Rivet MCP sign in</title>
+    <style>
+      body {
+        margin: 0;
+        min-height: 100vh;
+        display: grid;
+        place-items: center;
+        font-family: system-ui, sans-serif;
+        background: #0b0b0f;
+        color: #fff;
+      }
+      main {
+        max-width: 480px;
+        padding: 32px;
+      }
+      code {
+        word-break: break-all;
+      }
+      a {
+        display: inline-block;
+        margin-top: 20px;
+        padding: 10px 14px;
+        border-radius: 8px;
+        background: #fff;
+        color: #0b0b0f;
+        text-decoration: none;
+        font-weight: 600;
+      }
+    </style>
+  </head>
+  <body>
+    <main>
+      <h1>Approve Rivet MCP sign in</h1>
+      <p><strong>${escapeHtml(clientName)}</strong> wants to connect to Rivet.</p>
+      <p>After sign-in, Rivet will return an OAuth code to:</p>
+      <p><code>${escapeHtml(input.redirectUri)}</code></p>
+      <a href="${escapeHtml(input.authUrl)}">Continue to Rivet sign in</a>
+    </main>
+  </body>
+</html>`;
+};
+const getTokenExpiryMs = (token) => {
+    const secondsUntilExpiry = (0, accessTokenRefresh_1.getJwtSecondsUntilExpiry)(token) ?? DEFAULT_TOKEN_TTL_SECONDS;
+    return Date.now() + Math.max(secondsUntilExpiry, 1) * 1000;
+};
+const normalizeProfileUser = (user) => {
+    if (typeof user?.id !== 'string' || typeof user.email !== 'string') {
+        return undefined;
+    }
+    return { id: user.id, email: user.email };
+};
+/**
+ * OAuth authorization server provider that bridges the MCP OAuth spec
+ * (authorization code + PKCE, dynamic client registration) onto the existing
+ * Rivet proxy Google login flow:
+ *
+ * 1. `authorize` starts a proxy Google login with this server's local
+ *    callback page as the redirect origin and sends the browser to Google.
+ * 2. The browser returns to the local callback page, which forwards the
+ *    Supabase hash tokens to `completeBrowserCallback`. That completes the
+ *    proxy login, obtains the Rivet access token, and mints a single-use
+ *    authorization code bound to the client's PKCE challenge.
+ * 3. `exchangeAuthorizationCode` returns the Rivet access token as the OAuth
+ *    access token; `verifyAccessToken` validates bearer tokens against the
+ *    proxy profile endpoint.
+ */
+class RivetOAuthServerProvider {
+    clientsStore = new InMemoryClientsStore();
+    proxyUrl;
+    callbackUrl;
+    mcpEditor;
+    persistTokens;
+    isRefreshTokenCurrent;
+    fetchFn;
+    pollIntervalMs;
+    pendingAuthorizations = new Map();
+    authorizationCodes = new Map();
+    issuedBearerTokens = new Map();
+    verifiedTokens = new Map();
+    revokedAccessTokens = new Set();
+    revokedRefreshTokens = new Set();
+    activeRefreshTokens = new Set();
+    constructor(options) {
+        this.proxyUrl = options.proxyUrl.replace(/\/$/, '');
+        this.callbackUrl = options.callbackUrl;
+        this.mcpEditor = options.mcpEditor;
+        this.persistTokens = options.persistTokens;
+        this.isRefreshTokenCurrent = options.isRefreshTokenCurrent;
+        this.fetchFn = options.fetchImpl ?? fetch;
+        this.pollIntervalMs = options.pollIntervalMs ?? TOKEN_POLL_INTERVAL_MS;
+    }
+    async authorize(client, params, res) {
+        const response = await this.fetchFn(`${this.proxyUrl}/api/auth/google/start`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                redirectOrigin: this.callbackUrl,
+                authDestination: HOSTED_DASHBOARD_AUTH_URL,
+                source: 'mcp',
+                editor: this.mcpEditor,
+                version: telemetry_1.RIVET_VERSION,
+            }),
+        });
+        const result = (await response.json().catch(() => null));
+        if (!response.ok ||
+            !result?.success ||
+            !result.authUrl ||
+            !result.sessionId ||
+            !result.pollSecret ||
+            !result.completionSecret) {
+            log.warn('Proxy login start failed', { status: response.status });
+            throw new errors_js_1.ServerError('Failed to start Rivet sign-in');
+        }
+        this.prunePendingAuthorizations();
+        this.pendingAuthorizations.set(result.sessionId, {
+            client,
+            params,
+            pollSecret: result.pollSecret,
+            completionSecret: result.completionSecret,
+            expiresAt: Date.now() + PENDING_AUTH_TTL_MS,
+        });
+        res.status(200).type('html').send(getClientApprovalHtml({
+            authUrl: result.authUrl,
+            clientName: client.client_name,
+            redirectUri: params.redirectUri,
+        }));
+    }
+    /**
+     * Completes a browser login forwarded by the local OAuth callback page:
+     * finishes the proxy login session, obtains Rivet credentials, mints a
+     * single-use authorization code, and returns the MCP client redirect URL.
+     */
+    async completeBrowserCallback(input) {
+        const { sessionId, accessToken, refreshToken } = input;
+        if (!sessionId || !accessToken) {
+            throw new Error('OAuth callback missing session or token');
+        }
+        const pending = this.pendingAuthorizations.get(sessionId);
+        this.pendingAuthorizations.delete(sessionId);
+        if (!pending || pending.expiresAt < Date.now()) {
+            throw new Error('Unknown or expired sign-in session');
+        }
+        const completeResponse = await this.fetchFn(`${this.proxyUrl}/api/auth/google/complete`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                sessionId,
+                accessToken,
+                refreshToken,
+                completionSecret: pending.completionSecret,
+            }),
+        });
+        const completeResult = (await completeResponse.json().catch(() => null));
+        if (!completeResponse.ok || !completeResult?.success) {
+            throw new Error(completeResult?.error ?? 'Rivet sign-in completion failed');
+        }
+        const tokens = await this.pollForRivetTokens(sessionId, pending.pollSecret);
+        try {
+            this.persistTokens?.(tokens);
+        }
+        catch (error) {
+            log.warn('Failed to persist Rivet tokens after MCP OAuth login:', error);
+        }
+        const code = (0, crypto_1.randomBytes)(32).toString('base64url');
+        this.pruneAuthorizationCodes();
+        this.authorizationCodes.set(code, {
+            clientId: pending.client.client_id,
+            codeChallenge: pending.params.codeChallenge,
+            redirectUri: pending.params.redirectUri,
+            accessToken: tokens.token,
+            refreshToken: tokens.refreshToken,
+            user: tokens.user,
+            expiresAt: Date.now() + AUTH_CODE_TTL_MS,
+        });
+        const redirectUrl = new URL(pending.params.redirectUri);
+        redirectUrl.searchParams.set('code', code);
+        if (pending.params.state) {
+            redirectUrl.searchParams.set('state', pending.params.state);
+        }
+        return { redirectUrl: redirectUrl.toString() };
+    }
+    async challengeForAuthorizationCode(client, authorizationCode) {
+        const entry = this.getValidCodeEntry(client, authorizationCode);
+        return entry.codeChallenge;
+    }
+    async exchangeAuthorizationCode(client, authorizationCode, _codeVerifier, redirectUri) {
+        const entry = this.getValidCodeEntry(client, authorizationCode);
+        if (redirectUri && entry.redirectUri !== redirectUri) {
+            throw new errors_js_1.InvalidGrantError('redirect_uri does not match');
+        }
+        this.authorizationCodes.delete(authorizationCode);
+        this.rememberIssuedBearerToken({
+            token: entry.accessToken,
+            refreshToken: entry.refreshToken,
+            user: entry.user,
+        });
+        return this.toOAuthTokens(entry.accessToken, entry.refreshToken);
+    }
+    async exchangeRefreshToken(_client, refreshToken) {
+        if (this.revokedRefreshTokens.has(refreshToken) ||
+            !this.activeRefreshTokens.has(refreshToken) ||
+            this.isRefreshTokenCurrent?.(refreshToken) === false) {
+            throw new errors_js_1.InvalidGrantError('Refresh token was revoked');
+        }
+        const refreshed = await (0, accessTokenRefresh_1.refreshAccessTokenViaProxy)({
+            refreshToken,
+            proxyUrl: this.proxyUrl,
+            fetchImpl: this.fetchFn,
+        });
+        if (!refreshed) {
+            throw new errors_js_1.InvalidGrantError('Refresh token was rejected');
+        }
+        const nextRefreshToken = refreshed.refreshToken ?? refreshToken;
+        try {
+            this.persistTokens?.({
+                token: refreshed.token,
+                refreshToken: nextRefreshToken,
+            });
+        }
+        catch (error) {
+            log.warn('Failed to persist refreshed Rivet tokens:', error);
+        }
+        this.activeRefreshTokens.delete(refreshToken);
+        this.rememberIssuedBearerToken({
+            token: refreshed.token,
+            refreshToken: nextRefreshToken,
+        });
+        return this.toOAuthTokens(refreshed.token, nextRefreshToken);
+    }
+    async verifyAccessToken(token) {
+        if (this.revokedAccessTokens.has(token)) {
+            this.verifiedTokens.delete(token);
+            throw new errors_js_1.InvalidTokenError('Access token was revoked');
+        }
+        const cached = this.verifiedTokens.get(token);
+        if (cached && cached.cachedUntil > Date.now()) {
+            return cached.authInfo;
+        }
+        let response;
+        try {
+            response = await this.fetchFn(`${this.proxyUrl}/api/user/profile`, {
+                method: 'GET',
+                headers: {
+                    'Content-Type': 'application/json',
+                    Authorization: `Bearer ${token}`,
+                },
+                signal: AbortSignal.timeout(PROFILE_FETCH_TIMEOUT_MS),
+            });
+        }
+        catch (error) {
+            log.warn('Token verification request failed:', error);
+            throw new errors_js_1.ServerError('Could not reach the Rivet auth server');
+        }
+        const result = (await response.json().catch(() => null));
+        if (!response.ok || !result?.success) {
+            this.verifiedTokens.delete(token);
+            throw new errors_js_1.InvalidTokenError('Rivet rejected the access token');
+        }
+        this.pruneIssuedBearerTokens();
+        const issuedToken = this.issuedBearerTokens.get(token);
+        const user = normalizeProfileUser(result.user) ?? issuedToken?.user;
+        const secondsUntilExpiry = (0, accessTokenRefresh_1.getJwtSecondsUntilExpiry)(token) ?? DEFAULT_TOKEN_TTL_SECONDS;
+        const authInfo = {
+            token,
+            clientId: 'rivet-mcp',
+            scopes: [MCP_OAUTH_SCOPE],
+            expiresAt: Math.floor(Date.now() / 1000) + Math.max(secondsUntilExpiry, 1),
+            extra: {
+                ...(issuedToken?.refreshToken
+                    ? { refreshToken: issuedToken.refreshToken }
+                    : {}),
+                ...(user ? { email: user.email, userId: user.id } : {}),
+            },
+        };
+        this.pruneVerifiedTokens();
+        this.verifiedTokens.set(token, {
+            authInfo,
+            cachedUntil: Date.now() +
+                Math.min(TOKEN_VERIFY_CACHE_TTL_MS, Math.max(secondsUntilExpiry, 1) * 1000),
+        });
+        return authInfo;
+    }
+    /**
+     * Invalidates a bearer token issued by this OAuth provider and its paired
+     * refresh token, if the provider knows one.
+     */
+    revokeAccessToken(token) {
+        const issuedToken = this.issuedBearerTokens.get(token);
+        this.revokedAccessTokens.add(token);
+        if (issuedToken?.refreshToken) {
+            this.revokedRefreshTokens.add(issuedToken.refreshToken);
+            this.activeRefreshTokens.delete(issuedToken.refreshToken);
+        }
+        this.issuedBearerTokens.delete(token);
+        this.verifiedTokens.delete(token);
+    }
+    rememberIssuedBearerToken(tokens) {
+        this.pruneIssuedBearerTokens();
+        this.issuedBearerTokens.set(tokens.token, {
+            refreshToken: tokens.refreshToken,
+            user: tokens.user,
+            expiresAt: getTokenExpiryMs(tokens.token),
+        });
+        if (tokens.refreshToken) {
+            this.activeRefreshTokens.add(tokens.refreshToken);
+        }
+    }
+    getValidCodeEntry(client, authorizationCode) {
+        const entry = this.authorizationCodes.get(authorizationCode);
+        if (!entry ||
+            entry.clientId !== client.client_id ||
+            entry.expiresAt < Date.now()) {
+            this.authorizationCodes.delete(authorizationCode);
+            throw new errors_js_1.InvalidGrantError('Invalid or expired authorization code');
+        }
+        return entry;
+    }
+    toOAuthTokens(accessToken, refreshToken) {
+        const secondsUntilExpiry = (0, accessTokenRefresh_1.getJwtSecondsUntilExpiry)(accessToken) ?? DEFAULT_TOKEN_TTL_SECONDS;
+        return {
+            access_token: accessToken,
+            token_type: 'bearer',
+            expires_in: Math.max(secondsUntilExpiry, 1),
+            scope: MCP_OAUTH_SCOPE,
+            ...(refreshToken ? { refresh_token: refreshToken } : {}),
+        };
+    }
+    async pollForRivetTokens(sessionId, pollSecret) {
+        for (let attempt = 0; attempt < TOKEN_POLL_MAX_ATTEMPTS; attempt++) {
+            const response = await this.fetchFn(`${this.proxyUrl}/api/auth/google/token`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ session: sessionId, pollSecret }),
+            });
+            const result = (await response.json().catch(() => null));
+            if (result?.success && result.token) {
+                return {
+                    token: result.token,
+                    refreshToken: result.refreshToken,
+                    user: result.user,
+                };
+            }
+            if (result?.error && result.error !== 'Pending') {
+                throw new Error(result.error);
+            }
+            await sleep(this.pollIntervalMs);
+        }
+        throw new Error('Timed out waiting for Rivet sign-in to complete');
+    }
+    prunePendingAuthorizations() {
+        const now = Date.now();
+        for (const [key, value] of this.pendingAuthorizations) {
+            if (value.expiresAt < now) {
+                this.pendingAuthorizations.delete(key);
+            }
+        }
+    }
+    pruneAuthorizationCodes() {
+        const now = Date.now();
+        for (const [key, value] of this.authorizationCodes) {
+            if (value.expiresAt < now) {
+                this.authorizationCodes.delete(key);
+            }
+        }
+    }
+    pruneVerifiedTokens() {
+        const now = Date.now();
+        for (const [key, value] of this.verifiedTokens) {
+            if (value.cachedUntil < now) {
+                this.verifiedTokens.delete(key);
+            }
+        }
+    }
+    pruneIssuedBearerTokens() {
+        const now = Date.now();
+        for (const [key, value] of this.issuedBearerTokens) {
+            if (value.expiresAt < now) {
+                this.issuedBearerTokens.delete(key);
+            }
+        }
+    }
+}
+exports.RivetOAuthServerProvider = RivetOAuthServerProvider;
+//# sourceMappingURL=httpOAuthProvider.js.map

package/dist/mcp/auth/httpOAuthProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"httpOAuthProvider.js","sourceRoot":"","sources":["../../../src/mcp/auth/httpOAuthProvider.ts"],"names":[],"mappings":";;;AAAA,mCAAiD;AAYjD,+EAKyD;AACzD,0EAG2C;AAC3C,sDAAuD;AACvD,+CAAkD;AAElD,MAAM,GAAG,GAAG,IAAA,qBAAY,EAAC,gBAAgB,CAAC,CAAC;AAE3C,MAAM,gBAAgB,GAAG,EAAE,GAAG,MAAM,CAAC;AACrC,MAAM,mBAAmB,GAAG,EAAE,GAAG,MAAM,CAAC;AACxC,MAAM,yBAAyB,GAAG,MAAM,CAAC;AACzC,MAAM,yBAAyB,GAAG,IAAI,CAAC;AACvC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AACpC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AACpC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AACxC,MAAM,eAAe,GAAG,OAAO,CAAC;AAChC,MAAM,yBAAyB,GAAG,6CAA6C,CAAC;AAChF,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,WAAW;IACX,WAAW;IACX,KAAK;IACL,OAAO;CACR,CAAC,CAAC;AA8DH,2EAA2E;AAC3E,MAAM,oBAAoB;IAChB,OAAO,GAAG,IAAI,GAAG,EAAsC,CAAC;IAEhE,SAAS,CAAC,QAAgB;QACxB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED,cAAc,CACZ,MACgF;QAEhF,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,sCAA0B,CAClC,+DAA+D,CAChE,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAA+B;YAC7C,GAAG,MAAM;YACT,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAA,mBAAU,GAAE;YAC3C,mBAAmB,EACjB,MAAM,CAAC,mBAAmB,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;SAC9D,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACnD,OAAO,UAAU,CAAC;IACpB,CAAC;CACF;AAED,MAAM,qBAAqB,GAAG,CAAC,WAAmB,EAAW,EAAE;IAC7D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACjC,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CACtE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,KAAK,GAAG,CAAC,EAAU,EAAiB,EAAE,CAC1C,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAEpD,MAAM,UAAU,GAAG,CAAC,KAAa,EAAU,EAAE,CAC3C,KAAK;KACF,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;KACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;KACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;KACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;KACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAE5B;;;GAGG;AACH,MAAM,qBAAqB,GAAG,CAAC,KAI9B,EAAU,EAAE;IACX,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,oBAAoB,CAAC;IACpE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAsCU,UAAU,CAAC,UAAU,CAAC;;iBAExB,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC;iBAC7B,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC;;;QAGlC,CAAC;AACT,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,KAAa,EAAU,EAAE;IACjD,MAAM,kBAAkB,GACtB,IAAA,6CAAwB,EAAC,KAAK,CAAC,IAAI,yBAAyB,CAAC;IAC/D,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;AAC7D,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAC3B,IAAiC,EACU,EAAE;IAC7C,IAAI,OAAO,IAAI,EAAE,EAAE,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACnE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;AAC5C,CAAC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAa,wBAAwB;IAC1B,YAAY,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAElC,QAAQ,CAAS;IACjB,WAAW,CAAS;IACpB,SAAS,CAAU;IACnB,aAAa,CAA0C;IACvD,qBAAqB,CAAqC;IAC1D,OAAO,CAAe;IACtB,cAAc,CAAS;IAEvB,qBAAqB,GAAG,IAAI,GAAG,EAG7C,CAAC;IACa,kBAAkB,GAAG,IAAI,GAAG,EAG1C,CAAC;IACa,kBAAkB,GAAG,IAAI,GAAG,EAA6B,CAAC;IAC1D,cAAc,GAAG,IAAI,GAAG,EAA0B,CAAC;IACnD,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,oBAAoB,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;IAEzD,YAAY,OAAkC;QAC5C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC;QAC3D,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;QAC1C,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,sBAAsB,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,SAAS,CACb,MAAkC,EAClC,MAA2B,EAC3B,GAAa;QAEb,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CACjC,GAAG,IAAI,CAAC,QAAQ,wBAAwB,EACxC;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,cAAc,EAAE,IAAI,CAAC,WAAW;gBAChC,eAAe,EAAE,yBAAyB;gBAC1C,MAAM,EAAE,KAAK;gBACb,MAAM,EAAE,IAAI,CAAC,SAAS;gBACtB,OAAO,EAAE,yBAAa;aACvB,CAAC;SACH,CACF,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAM/C,CAAC;QAET,IACE,CAAC,QAAQ,CAAC,EAAE;YACZ,CAAC,MAAM,EAAE,OAAO;YAChB,CAAC,MAAM,CAAC,OAAO;YACf,CAAC,MAAM,CAAC,SAAS;YACjB,CAAC,MAAM,CAAC,UAAU;YAClB,CAAC,MAAM,CAAC,gBAAgB,EACxB,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAClE,MAAM,IAAI,uBAAW,CAAC,+BAA+B,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,CAAC,0BAA0B,EAAE,CAAC;QAClC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE;YAC/C,MAAM;YACN,MAAM;YACN,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB;SAC5C,CAAC,CAAC;QAEH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAC/B,qBAAqB,CAAC;YACpB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,UAAU,EAAE,MAAM,CAAC,WAAW;YAC9B,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,uBAAuB,CAAC,KAI7B;QACC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;QACvD,IAAI,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1D,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,OAAO,CACzC,GAAG,IAAI,CAAC,QAAQ,2BAA2B,EAC3C;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,SAAS;gBACT,WAAW;gBACX,YAAY;gBACZ,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;aAC3C,CAAC;SACH,CACF,CAAC;QACF,MAAM,cAAc,GAAG,CAAC,MAAM,gBAAgB,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAG/D,CAAC;QACT,IAAI,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,cAAc,EAAE,KAAK,IAAI,iCAAiC,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC5E,IAAI,CAAC;YACH,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,IAAI,CAAC,uDAAuD,EAAE,KAAK,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACnD,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC/B,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,EAAE;YAChC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS;YAClC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa;YAC3C,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW;YACvC,WAAW,EAAE,MAAM,CAAC,KAAK;YACzB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB;SACzC,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACxD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC3C,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACzB,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,QAAQ,EAAE,EAAE,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,6BAA6B,CACjC,MAAkC,EAClC,iBAAyB;QAEzB,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QAChE,OAAO,KAAK,CAAC,aAAa,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,yBAAyB,CAC7B,MAAkC,EAClC,iBAAyB,EACzB,aAAsB,EACtB,WAAoB;QAEpB,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QAChE,IAAI,WAAW,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;YACrD,MAAM,IAAI,6BAAiB,CAAC,6BAA6B,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAClD,IAAI,CAAC,yBAAyB,CAAC;YAC7B,KAAK,EAAE,KAAK,CAAC,WAAW;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,OAAmC,EACnC,YAAoB;QAEpB,IACE,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,YAAY,CAAC;YAC3C,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,YAAY,CAAC;YAC3C,IAAI,CAAC,qBAAqB,EAAE,CAAC,YAAY,CAAC,KAAK,KAAK,EACpD,CAAC;YACD,MAAM,IAAI,6BAAiB,CAAC,2BAA2B,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAA,+CAA0B,EAAC;YACjD,YAAY;YACZ,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,OAAO;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,6BAAiB,CAAC,4BAA4B,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,gBAAgB,GAAG,SAAS,CAAC,YAAY,IAAI,YAAY,CAAC;QAChE,IAAI,CAAC;YACH,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,KAAK,EAAE,SAAS,CAAC,KAAK;gBACtB,YAAY,EAAE,gBAAgB;aAC/B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,IAAI,CAAC,2CAA2C,EAAE,KAAK,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC9C,IAAI,CAAC,yBAAyB,CAAC;YAC7B,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,YAAY,EAAE,gBAAgB;SAC/B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,IAAI,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAClC,MAAM,IAAI,6BAAiB,CAAC,0BAA0B,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,MAAM,IAAI,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC9C,OAAO,MAAM,CAAC,QAAQ,CAAC;QACzB,CAAC;QAED,IAAI,QAA6B,CAAC;QAClC,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,mBAAmB,EAAE;gBACjE,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,UAAU,KAAK,EAAE;iBACjC;gBACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,wBAAwB,CAAC;aACtD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,IAAI,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;YACtD,MAAM,IAAI,uBAAW,CAAC,uCAAuC,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAE/C,CAAC;QACT,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YACrC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAClC,MAAM,IAAI,6BAAiB,CAAC,iCAAiC,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,IAAI,CAAC;QACpE,MAAM,kBAAkB,GACtB,IAAA,6CAAwB,EAAC,KAAK,CAAC,IAAI,yBAAyB,CAAC;QAC/D,MAAM,QAAQ,GAAa;YACzB,KAAK;YACL,QAAQ,EAAE,WAAW;YACrB,MAAM,EAAE,CAAC,eAAe,CAAC;YACzB,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC;YAC1E,KAAK,EAAE;gBACL,GAAG,CAAC,WAAW,EAAE,YAAY;oBAC3B,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,YAAY,EAAE;oBAC5C,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxD;SACF,CAAC;QAEF,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC3B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE;YAC7B,QAAQ;YACR,WAAW,EACT,IAAI,CAAC,GAAG,EAAE;gBACV,IAAI,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;SAC9E,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;OAGG;IACH,iBAAiB,CAAC,KAAa;QAC7B,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvD,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,WAAW,EAAE,YAAY,EAAE,CAAC;YAC9B,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;YACxD,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAEO,yBAAyB,CAAC,MAA4B;QAC5D,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC/B,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE;YACxC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC;SAC1C,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAEO,iBAAiB,CACvB,MAAkC,EAClC,iBAAyB;QAEzB,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC7D,IACE,CAAC,KAAK;YACN,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS;YACnC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAC5B,CAAC;YACD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAClD,MAAM,IAAI,6BAAiB,CAAC,uCAAuC,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,aAAa,CAAC,WAAmB,EAAE,YAAqB;QAC9D,MAAM,kBAAkB,GACtB,IAAA,6CAAwB,EAAC,WAAW,CAAC,IAAI,yBAAyB,CAAC;QACrE,OAAO;YACL,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC;YAC3C,KAAK,EAAE,eAAe;YACtB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC9B,SAAiB,EACjB,UAAkB;QAElB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,uBAAuB,EAAE,OAAO,EAAE,EAAE,CAAC;YACnE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CACjC,GAAG,IAAI,CAAC,QAAQ,wBAAwB,EACxC;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;aACzD,CACF,CAAC;YACF,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAM/C,CAAC;YAET,IAAI,MAAM,EAAE,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACpC,OAAO;oBACL,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,IAAI,EAAE,MAAM,CAAC,IAAI;iBAClB,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,EAAE,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAChD,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChC,CAAC;YACD,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAEO,0BAA0B;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACtD,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;gBAC1B,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;IACH,CAAC;IAEO,uBAAuB;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACnD,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;gBAC1B,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;IACH,CAAC;IAEO,mBAAmB;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC/C,IAAI,KAAK,CAAC,WAAW,GAAG,GAAG,EAAE,CAAC;gBAC5B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IAEO,uBAAuB;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACnD,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;gBAC1B,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;IACH,CAAC;CACF;AA7ZD,4DA6ZC"}

package/dist/mcp/auth/tools.d.ts

@@ -6,6 +6,8 @@ export interface AuthToolDeps {
     telemetry?: TelemetryService;
     /** The MCP client (`--editor`), recorded with the login for analytics. */
     mcpEditor?: string;
+    /** Rejects an active HTTP OAuth bearer after logout clears local credentials. */
+    revokeBearerToken?: (token: string) => void;
 }
 type ToolResponse = {
     content: Array<{

package/dist/mcp/auth/tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../../src/mcp/auth/tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGzE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAMxE,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,KAAK,YAAY,GAAG;IAClB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAiCF;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAC1B,aAAa,WAAW,KACvB,CAAC,MAAM,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAWrC,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa,GACxB,KAAK,SAAS,EACd,OAAO,MAAM,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,KACxC,SAwBF,CAAC;AAEF,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAyH1E"}
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../../src/mcp/auth/tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGzE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAMxE,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7C;AAED,KAAK,YAAY,GAAG;IAClB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAiCF;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAC1B,aAAa,WAAW,KACvB,CAAC,MAAM,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAWrC,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa,GACxB,KAAK,SAAS,EACd,OAAO,MAAM,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,KACxC,SAwBF,CAAC;AAEF,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAuI1E"}

package/dist/mcp/auth/tools.js

@@ -33,7 +33,7 @@ const createAuthGuard = (authService) => {
         if (ok) {
             return null;
         }
-        return errorResponse('Authentication required. Ask the user to run the `login` tool (it opens a browser to sign in with Google), then retry.', 'AUTH_REQUIRED');
+        return errorResponse('Authentication required. Call the `mcp_auth` tool (it opens a browser to sign in with Google), then retry.', 'AUTH_REQUIRED');
     };
 };
 exports.createAuthGuard = createAuthGuard;
@@ -73,8 +73,8 @@ const withAuthGuard = (mcp, guard) => {
 };
 exports.withAuthGuard = withAuthGuard;
 function registerAuthTools(mcp, deps) {
-    const { authService, telemetry, mcpEditor } = deps;
-    registerTool(mcp, 'login', 'Authenticate this machine with Rivet via Google. Opens the user\'s browser to sign in, then blocks (~up to 2 minutes) until they finish. If already signed in with a valid session, returns immediately. On timeout, returns success:false with a retryable message — call login again to keep waiting.', {}, async () => {
+    const { authService, telemetry, mcpEditor, revokeBearerToken } = deps;
+    const loginHandler = async () => {
         try {
             // Real validation — only short-circuit on a genuinely live session,
             // never on a merely-present (possibly stale) token.
@@ -121,11 +121,18 @@ function registerAuthTools(mcp, deps) {
             log.warn('login tool error:', err);
             return errorResponse(err instanceof Error ? err.message : 'Login failed', 'LOGIN_FAILED');
         }
-    });
+    };
+    registerTool(mcp, 'login', 'Authenticate this machine with Rivet via Google. Opens the user\'s browser to sign in, then blocks (~up to 2 minutes) until they finish. If already signed in with a valid session, returns immediately. On timeout, returns success:false with a retryable message — call login again to keep waiting.', {}, loginHandler);
+    registerTool(mcp, 'mcp_auth', 'Authenticate this MCP server so the user can access all of its tools. When Rivet reports AUTH_REQUIRED, call this tool soon through your MCP tool-calling interface.', {}, loginHandler);
     registerTool(mcp, 'logout', 'Sign this machine out of Rivet and clear the stored credentials.', {}, async () => {
         try {
-            const email = (0, ConfigManager_1.getConfigManager)().getEmail();
+            const configManager = (0, ConfigManager_1.getConfigManager)();
+            const email = configManager.getEmail();
+            const bearerToken = configManager.getAuthToken();
             await authService.logout();
+            if (bearerToken) {
+                revokeBearerToken?.(bearerToken);
+            }
             telemetry?.track('mcp_logout', { source: 'mcp' });
             return jsonResponse({ loggedOut: true, email });
         }