skybridge 0.0.0-dev.e4f73e5 → 0.0.0-dev.e50416a

package/dist/server/auth/setup.test.js

@@ -5,6 +5,7 @@ import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/
 import * as jose from "jose";
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { McpServer } from "../server.js";
+import { createJwksVerifier } from "./verify.js";
 vi.mock("@skybridge/devtools", () => ({
     devtoolsStaticServer: () => ((_req, _res, next) => next()),
 }));
@@ -36,10 +37,10 @@ async function startJwks() {
     const port = server.address().port;
     return { privateKey, jwksUri: `http://localhost:${port}/jwks` };
 }
-function signToken(key) {
+function signToken(key, scope = "openid email") {
     return new jose.SignJWT({
         client_id: "client-1",
-        scope: "openid email",
+        scope,
         sub: "user-1",
     })
         .setProtectedHeader({ alg: "RS256", kid: "test-key" })
@@ -48,7 +49,7 @@ function signToken(key) {
         .setExpirationTime("1h")
         .sign(key);
 }
-async function bootServer(jwksUri, { baseUrl = "https://app.example.test" } = {}) {
+async function bootServer(jwksUri, { baseUrl = "https://app.example.test", legacyVerify = false, } = {}) {
     const { createApp } = await import("../express.js");
     const server = new McpServer({ name: "auth-test", version: "0.0.0" }, { capabilities: {} }, {
         oauth: {
@@ -59,7 +60,15 @@ async function bootServer(jwksUri, { baseUrl = "https://app.example.test" } = {}
                 token_endpoint: `${ISSUER}/token`,
                 response_types_supported: ["code"],
             },
-            verify: { issuer: ISSUER, audience: AUDIENCE, jwksUri },
+            ...(legacyVerify
+                ? { verify: { issuer: ISSUER, audience: AUDIENCE, jwksUri } }
+                : {
+                    verifier: createJwksVerifier({
+                        issuer: ISSUER,
+                        audience: AUDIENCE,
+                        jwksUri,
+                    }),
+                }),
             scopesSupported: ["openid", "email"],
             requiredScopes: ["openid"],
         },
@@ -115,6 +124,20 @@ describe("setupOAuth wiring", () => {
         expect(result.content[0]?.text).toBe("client-1");
         await client.close();
     });
+    it("builds the verifier from the legacy verify config", async () => {
+        const { privateKey, jwksUri } = await startJwks();
+        const base = await bootServer(jwksUri, { legacyVerify: true });
+        const token = await signToken(privateKey);
+        const client = new Client({ name: "test-client", version: "0.0.0" });
+        const transport = new StreamableHTTPClientTransport(new URL(`${base}/mcp`), { requestInit: { headers: { Authorization: `Bearer ${token}` } } });
+        await client.connect(transport);
+        const result = (await client.callTool({
+            name: "whoami",
+            arguments: {},
+        }));
+        expect(result.content[0]?.text).toBe("client-1");
+        await client.close();
+    });
 });
 describe("baseUrl inferred from headers", () => {
     it("derives the resource origin from x-forwarded-host", async () => {
@@ -165,6 +188,303 @@ describe("baseUrl inferred from headers", () => {
         expect(res.headers.get("www-authenticate")).toMatch(/resource_metadata="https:\/\/infer\.example\.test\//);
     });
 });
+async function bootMixedServer(jwksUri) {
+    const { createApp } = await import("../express.js");
+    const server = new McpServer({ name: "mixed-auth-test", version: "0.0.0" }, { capabilities: {} }, {
+        oauth: {
+            baseUrl: "https://app.example.test",
+            oauthMetadata: {
+                issuer: ISSUER,
+                authorization_endpoint: `${ISSUER}/authorize`,
+                token_endpoint: `${ISSUER}/token`,
+                response_types_supported: ["code"],
+            },
+            verifier: createJwksVerifier({
+                issuer: ISSUER,
+                audience: AUDIENCE,
+                jwksUri,
+            }),
+        },
+    })
+        .registerTool({
+        name: "public-whoami",
+        description: "Public.",
+        inputSchema: {},
+        auth: { allowsAnonymous: true },
+    }, (_args, extra) => ({
+        content: [{ type: "text", text: extra.authInfo?.clientId ?? "anon" }],
+    }))
+        .registerTool({
+        name: "private-whoami",
+        description: "Private.",
+        inputSchema: {},
+        auth: {},
+    }, (_args, extra) => ({
+        content: [{ type: "text", text: extra.authInfo?.clientId ?? "anon" }],
+    }));
+    server.registerTool("legacy-whoami", {
+        description: "Registered via the legacy string overload.",
+        inputSchema: {},
+    }, (_args, extra) => ({
+        content: [{ type: "text", text: extra.authInfo?.clientId ?? "anon" }],
+    }));
+    const httpServer = http.createServer();
+    await createApp({ mcpServer: server, httpServer });
+    const listening = http.createServer(server.express);
+    await new Promise((resolve) => listening.listen(0, resolve));
+    appServer = listening;
+    const port = listening.address().port;
+    return `http://localhost:${port}`;
+}
+describe("mixed-auth door", () => {
+    it("lets an anonymous caller initialize and run a noauth tool", async () => {
+        const { jwksUri } = await startJwks();
+        const base = await bootMixedServer(jwksUri);
+        const client = new Client({ name: "test-client", version: "0.0.0" });
+        await client.connect(new StreamableHTTPClientTransport(new URL(`${base}/mcp`)));
+        const result = (await client.callTool({
+            name: "public-whoami",
+            arguments: {},
+        }));
+        expect(result.content[0]?.text).toBe("anon");
+        await client.close();
+    });
+    it("exposes securitySchemes at the top level of tools/list (not only _meta)", async () => {
+        const { jwksUri } = await startJwks();
+        const base = await bootMixedServer(jwksUri);
+        const headers = {
+            "Content-Type": "application/json",
+            Accept: "application/json, text/event-stream",
+        };
+        await fetch(`${base}/mcp`, {
+            method: "POST",
+            headers,
+            body: JSON.stringify({
+                jsonrpc: "2.0",
+                id: 1,
+                method: "initialize",
+                params: {
+                    protocolVersion: "2025-06-18",
+                    capabilities: {},
+                    clientInfo: { name: "c", version: "0" },
+                },
+            }),
+        });
+        const res = await fetch(`${base}/mcp`, {
+            method: "POST",
+            headers,
+            body: JSON.stringify({ jsonrpc: "2.0", id: 2, method: "tools/list" }),
+        });
+        const text = await res.text();
+        const json = JSON.parse((text.match(/\{[\s\S]*\}/) ?? ["{}"])[0]);
+        const whoami = json.result.tools.find((t) => t.name === "private-whoami");
+        expect(whoami?.securitySchemes).toEqual([{ type: "oauth2" }]);
+    });
+    it("denies a protected tool inside an anonymous JSON-RPC batch", async () => {
+        const { jwksUri } = await startJwks();
+        const base = await bootMixedServer(jwksUri);
+        const res = await fetch(`${base}/mcp`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Accept: "application/json, text/event-stream",
+            },
+            body: JSON.stringify([
+                {
+                    jsonrpc: "2.0",
+                    id: 1,
+                    method: "tools/call",
+                    params: { name: "private-whoami", arguments: {} },
+                },
+            ]),
+        });
+        expect(res.status).toBe(401);
+        const wwwAuthenticate = res.headers.get("www-authenticate") ?? "";
+        expect(wwwAuthenticate).toMatch(/^Bearer /);
+        expect(wwwAuthenticate).toContain("resource_metadata=");
+        const text = await res.text();
+        expect(text).not.toContain("client-1");
+    });
+    it("gates a tool registered via the legacy string overload (secure default)", async () => {
+        const { jwksUri } = await startJwks();
+        const base = await bootMixedServer(jwksUri);
+        const res = await fetch(`${base}/mcp`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Accept: "application/json, text/event-stream",
+            },
+            body: JSON.stringify({
+                jsonrpc: "2.0",
+                id: 1,
+                method: "tools/call",
+                params: { name: "legacy-whoami", arguments: {} },
+            }),
+        });
+        expect(res.status).toBe(401);
+    });
+    it("returns 401 + WWW-Authenticate for a protected tool while anonymous", async () => {
+        const { jwksUri } = await startJwks();
+        const base = await bootMixedServer(jwksUri);
+        const res = await fetch(`${base}/mcp`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Accept: "application/json, text/event-stream",
+            },
+            body: JSON.stringify({
+                jsonrpc: "2.0",
+                id: 1,
+                method: "tools/call",
+                params: { name: "private-whoami", arguments: {} },
+            }),
+        });
+        expect(res.status).toBe(401);
+        expect(res.headers.get("www-authenticate")).toMatch(/error="invalid_token"/);
+        expect(res.headers.get("www-authenticate")).toMatch(/resource_metadata=/);
+    });
+    it("returns an in-band mcp/www_authenticate array to ChatGPT (not a transport 401)", async () => {
+        const { jwksUri } = await startJwks();
+        const base = await bootMixedServer(jwksUri);
+        const res = await fetch(`${base}/mcp`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Accept: "application/json, text/event-stream",
+                "User-Agent": "openai-mcp/1.0",
+            },
+            body: JSON.stringify({
+                jsonrpc: "2.0",
+                id: 7,
+                method: "tools/call",
+                params: { name: "private-whoami", arguments: {} },
+            }),
+        });
+        expect(res.status).toBe(200);
+        expect(res.headers.get("www-authenticate")).toBeNull();
+        const body = (await res.json());
+        expect(body.id).toBe(7);
+        expect(body.result.isError).toBe(true);
+        const challenge = body.result._meta["mcp/www_authenticate"];
+        expect(Array.isArray(challenge)).toBe(true);
+        expect(challenge[0]).toMatch(/error="invalid_token"/);
+        expect(challenge[0]).toMatch(/resource_metadata=/);
+    });
+    it("fails closed on a ChatGPT batch (transport 401, no in-band challenge)", async () => {
+        const { jwksUri } = await startJwks();
+        const base = await bootMixedServer(jwksUri);
+        const res = await fetch(`${base}/mcp`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Accept: "application/json, text/event-stream",
+                "User-Agent": "openai-mcp/1.0",
+            },
+            body: JSON.stringify([
+                {
+                    jsonrpc: "2.0",
+                    id: 1,
+                    method: "tools/call",
+                    params: { name: "private-whoami", arguments: {} },
+                },
+            ]),
+        });
+        expect(res.status).toBe(401);
+        expect(res.headers.get("www-authenticate")).toMatch(/^Bearer /);
+        const text = await res.text();
+        expect(text).not.toContain("client-1");
+    });
+});
+async function bootScopedServer(jwksUri) {
+    const { createApp } = await import("../express.js");
+    const server = new McpServer({ name: "scoped-auth-test", version: "0.0.0" }, { capabilities: {} }, {
+        oauth: {
+            baseUrl: "https://app.example.test",
+            oauthMetadata: {
+                issuer: ISSUER,
+                authorization_endpoint: `${ISSUER}/authorize`,
+                token_endpoint: `${ISSUER}/token`,
+                response_types_supported: ["code"],
+            },
+            verifier: createJwksVerifier({
+                issuer: ISSUER,
+                audience: AUDIENCE,
+                jwksUri,
+            }),
+        },
+    }).registerTool({
+        name: "checkout",
+        description: "Needs the checkout scope.",
+        inputSchema: {},
+        auth: { scopes: ["checkout"] },
+    }, () => ({ content: [{ type: "text", text: "ok" }] }));
+    const httpServer = http.createServer();
+    await createApp({ mcpServer: server, httpServer });
+    const listening = http.createServer(server.express);
+    await new Promise((resolve) => listening.listen(0, resolve));
+    appServer = listening;
+    const port = listening.address().port;
+    return `http://localhost:${port}`;
+}
+describe("per-tool scope enforcement in fully-authenticated mode", () => {
+    it("returns 403 for a valid token missing the tool's scope", async () => {
+        const { privateKey, jwksUri } = await startJwks();
+        const base = await bootScopedServer(jwksUri);
+        const token = await signToken(privateKey, "openid");
+        const res = await fetch(`${base}/mcp`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Accept: "application/json, text/event-stream",
+                Authorization: `Bearer ${token}`,
+            },
+            body: JSON.stringify({
+                jsonrpc: "2.0",
+                id: 1,
+                method: "tools/call",
+                params: { name: "checkout", arguments: {} },
+            }),
+        });
+        expect(res.status).toBe(403);
+        const header = res.headers.get("www-authenticate");
+        expect(header).toMatch(/error="insufficient_scope"/);
+        expect(header).toMatch(/scope="checkout"/);
+    });
+    it("allows a token carrying the tool's scope", async () => {
+        const { privateKey, jwksUri } = await startJwks();
+        const base = await bootScopedServer(jwksUri);
+        const token = await signToken(privateKey, "openid checkout");
+        const client = new Client({ name: "test-client", version: "0.0.0" });
+        await client.connect(new StreamableHTTPClientTransport(new URL(`${base}/mcp`), {
+            requestInit: { headers: { Authorization: `Bearer ${token}` } },
+        }));
+        const result = (await client.callTool({
+            name: "checkout",
+            arguments: {},
+        }));
+        expect(result.content[0]?.text).toBe("ok");
+        await client.close();
+    });
+});
+describe("auth shorthand validation", () => {
+    it("throws when `auth` requires sign-in but no oauth provider is configured", () => {
+        expect(() => new McpServer({ name: "t", version: "0" }).registerTool({ name: "x", inputSchema: {}, auth: {} }, () => ({ content: [{ type: "text", text: "" }] }))).toThrow(/no `oauth` provider/);
+    });
+    it("throws when `auth` sets scopes but no oauth provider is configured", () => {
+        expect(() => new McpServer({ name: "t", version: "0" }).registerTool({ name: "x", inputSchema: {}, auth: { scopes: ["checkout"] } }, () => ({ content: [{ type: "text", text: "" }] }))).toThrow(/no `oauth` provider/);
+    });
+    it("allows `auth: { allowsAnonymous: true }` without an oauth provider", () => {
+        expect(() => new McpServer({ name: "t", version: "0" }).registerTool({ name: "x", inputSchema: {}, auth: { allowsAnonymous: true } }, () => ({ content: [{ type: "text", text: "" }] }))).not.toThrow();
+    });
+    it("prefers `securitySchemes` over `auth` when both are set (untyped path)", () => {
+        expect(() => new McpServer({ name: "t", version: "0" }).registerTool({
+            name: "x",
+            inputSchema: {},
+            auth: {},
+            securitySchemes: [{ type: "oauth2" }],
+        }, () => ({ content: [{ type: "text", text: "" }] }))).not.toThrow();
+    });
+});
 describe("oauth config validation", () => {
     const validMetadata = {
         issuer: ISSUER,
@@ -177,7 +497,10 @@ describe("oauth config validation", () => {
             oauth: {
                 baseUrl: "not-a-url",
                 oauthMetadata: validMetadata,
-                verify: { issuer: ISSUER, audience: AUDIENCE },
+                verifier: createJwksVerifier({
+                    issuer: ISSUER,
+                    audience: AUDIENCE,
+                }),
             },
         })).toThrow(/baseUrl must be a valid absolute URL/);
     });

package/dist/server/auth/setup.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"setup.test.js","sourceRoot":"","sources":["../../../src/server/auth/setup.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAEnG,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,EAAE,CAAC,IAAI,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;IACpC,oBAAoB,EAAE,GAAG,EAAE,CACzB,CAAC,CAAC,IAAa,EAAE,IAAa,EAAE,IAAgB,EAAE,EAAE,CAClD,IAAI,EAAE,CAAmB;CAC9B,CAAC,CAAC,CAAC;AACJ,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC;IACrC,cAAc,EAAE,CAAC,WAAoB,EAAE,EAAE,CACvC,CAAC,CAAC,IAAa,EAAE,IAAa,EAAE,IAAgB,EAAE,EAAE,CAClD,IAAI,EAAE,CAAmB;CAC9B,CAAC,CAAC,CAAC;AAEJ,MAAM,MAAM,GAAG,qBAAqB,CAAC;AACrC,MAAM,QAAQ,GAAG,eAAe,CAAC;AAEjC,IAAI,UAAmC,CAAC;AACxC,IAAI,SAAkC,CAAC;AACvC,SAAS,CAAC,GAAG,EAAE;IACb,UAAU,EAAE,KAAK,EAAE,CAAC;IACpB,SAAS,EAAE,KAAK,EAAE,CAAC;AACrB,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,SAAS;IACtB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG;QACV,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACpC,GAAG,EAAE,UAAU;QACf,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,KAAK;KACX,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC7C,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,UAAU,GAAG,MAAM,CAAC;IACpB,MAAM,IAAI,GAAI,MAAM,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;IACzD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,oBAAoB,IAAI,OAAO,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,SAAS,CAAC,GAAc;IAC/B,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC;QACtB,SAAS,EAAE,UAAU;QACrB,KAAK,EAAE,cAAc;QACrB,GAAG,EAAE,QAAQ;KACd,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;SACrD,SAAS,CAAC,MAAM,CAAC;SACjB,WAAW,CAAC,QAAQ,CAAC;SACrB,iBAAiB,CAAC,IAAI,CAAC;SACvB,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,OAAe,EACf,EAAE,OAAO,GAAG,0BAA0B,KAAkC,EAAE;IAE1E,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,EACvC,EAAE,YAAY,EAAE,EAAE,EAAE,EACpB;QACE,KAAK,EAAE;YACL,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;YACxC,aAAa,EAAE;gBACb,MAAM,EAAE,MAAM;gBACd,sBAAsB,EAAE,GAAG,MAAM,YAAY;gBAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;gBACjC,wBAAwB,EAAE,CAAC,MAAM,CAAC;aACnC;YACD,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE;YACvD,eAAe,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;YACpC,cAAc,EAAE,CAAC,QAAQ,CAAC;SAC3B;KACF,CACF,CAAC,YAAY,CACZ;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,8BAA8B;QAC3C,WAAW,EAAE,EAAE;KAChB,EACD,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACjB,iBAAiB,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,IAAI,IAAI,EAAE;QACjE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,IAAI,MAAM,EAAE,CAAC;KACtE,CAAC,CACH,CAAC;IAEF,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IACvC,MAAM,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IACnE,SAAS,GAAG,SAAS,CAAC;IACtB,MAAM,IAAI,GAAI,SAAS,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;IAC5D,OAAO,oBAAoB,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;QAEvC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,uCAAuC,CAAC,CAAC;QACxE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAI7B,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;QAEvC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,MAAM,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;SACtE,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,IAAI,6BAA6B,CACjD,IAAI,GAAG,CAAC,GAAG,IAAI,MAAM,CAAC,EACtB,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,EAAE,CACnE,CAAC;QACF,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEhC,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC;YACpC,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,EAAE;SACd,CAAC,CAED,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEjD,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,uCAAuC,EAAE;YACtE,OAAO,EAAE,EAAE,kBAAkB,EAAE,oBAAoB,EAAE;SACtD,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,uCAAuC,EAAE;YACtE,OAAO,EAAE;gBACP,kBAAkB,EAAE,gCAAgC;gBACpD,mBAAmB,EAAE,aAAa;aACnC;SACF,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,uCAAuC,EAAE;YACtE,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE;SAC3C,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,MAAM,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,kBAAkB,EAAE,oBAAoB;aACzC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;SACtE,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CACjD,qDAAqD,CACtD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,MAAM,aAAa,GAAG;QACpB,MAAM,EAAE,MAAM;QACd,sBAAsB,EAAE,GAAG,MAAM,YAAY;QAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;QACjC,wBAAwB,EAAE,CAAC,MAAM,CAAC;KACnC,CAAC;IAEF,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,CACJ,GAAG,EAAE,CACH,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE;YACpD,KAAK,EAAE;gBACL,OAAO,EAAE,WAAW;gBACpB,aAAa,EAAE,aAAa;gBAC5B,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE;aAC/C;SACF,CAAC,CACL,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport http from \"node:http\";\nimport { Client } from \"@modelcontextprotocol/sdk/client/index.js\";\nimport { StreamableHTTPClientTransport } from \"@modelcontextprotocol/sdk/client/streamableHttp.js\";\nimport type { RequestHandler } from \"express\";\nimport * as jose from \"jose\";\nimport { afterEach, describe, expect, it, vi } from \"vitest\";\nimport { McpServer } from \"../server.js\";\n\nvi.mock(\"@skybridge/devtools\", () => ({\n  devtoolsStaticServer: () =>\n    ((_req: unknown, _res: unknown, next: () => void) =>\n      next()) as RequestHandler,\n}));\nvi.mock(\"../viewsDevServer.js\", () => ({\n  viewsDevServer: (_httpServer: unknown) =>\n    ((_req: unknown, _res: unknown, next: () => void) =>\n      next()) as RequestHandler,\n}));\n\nconst ISSUER = \"https://issuer.test\";\nconst AUDIENCE = \"api://default\";\n\nlet jwksServer: http.Server | undefined;\nlet appServer: http.Server | undefined;\nafterEach(() => {\n  jwksServer?.close();\n  appServer?.close();\n});\n\nasync function startJwks() {\n  const { publicKey, privateKey } = await jose.generateKeyPair(\"RS256\");\n  const jwk = {\n    ...(await jose.exportJWK(publicKey)),\n    kid: \"test-key\",\n    alg: \"RS256\",\n    use: \"sig\",\n  };\n  const server = http.createServer((_req, res) => {\n    res.setHeader(\"content-type\", \"application/json\");\n    res.end(JSON.stringify({ keys: [jwk] }));\n  });\n  await new Promise<void>((resolve) => server.listen(0, resolve));\n  jwksServer = server;\n  const port = (server.address() as { port: number }).port;\n  return { privateKey, jwksUri: `http://localhost:${port}/jwks` };\n}\n\nfunction signToken(key: CryptoKey) {\n  return new jose.SignJWT({\n    client_id: \"client-1\",\n    scope: \"openid email\",\n    sub: \"user-1\",\n  })\n    .setProtectedHeader({ alg: \"RS256\", kid: \"test-key\" })\n    .setIssuer(ISSUER)\n    .setAudience(AUDIENCE)\n    .setExpirationTime(\"1h\")\n    .sign(key);\n}\n\nasync function bootServer(\n  jwksUri: string,\n  { baseUrl = \"https://app.example.test\" }: { baseUrl?: string | null } = {},\n) {\n  const { createApp } = await import(\"../express.js\");\n  const server = new McpServer(\n    { name: \"auth-test\", version: \"0.0.0\" },\n    { capabilities: {} },\n    {\n      oauth: {\n        ...(baseUrl === null ? {} : { baseUrl }),\n        oauthMetadata: {\n          issuer: ISSUER,\n          authorization_endpoint: `${ISSUER}/authorize`,\n          token_endpoint: `${ISSUER}/token`,\n          response_types_supported: [\"code\"],\n        },\n        verify: { issuer: ISSUER, audience: AUDIENCE, jwksUri },\n        scopesSupported: [\"openid\", \"email\"],\n        requiredScopes: [\"openid\"],\n      },\n    },\n  ).registerTool(\n    {\n      name: \"whoami\",\n      description: \"Returns the caller identity.\",\n      inputSchema: {},\n    },\n    (_args, extra) => ({\n      structuredContent: { clientId: extra.authInfo?.clientId ?? null },\n      content: [{ type: \"text\", text: extra.authInfo?.clientId ?? \"anon\" }],\n    }),\n  );\n\n  const httpServer = http.createServer();\n  await createApp({ mcpServer: server, httpServer });\n  const listening = http.createServer(server.express);\n  await new Promise<void>((resolve) => listening.listen(0, resolve));\n  appServer = listening;\n  const port = (listening.address() as { port: number }).port;\n  return `http://localhost:${port}`;\n}\n\ndescribe(\"setupOAuth wiring\", () => {\n  it(\"serves protected-resource metadata\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri);\n\n    const res = await fetch(`${base}/.well-known/oauth-protected-resource`);\n    expect(res.status).toBe(200);\n    const body = (await res.json()) as {\n      resource: string;\n      authorization_servers: string[];\n      scopes_supported: string[];\n    };\n    expect(body.resource).toBe(\"https://app.example.test/\");\n    expect(body.authorization_servers).toContain(ISSUER);\n    expect(body.scopes_supported).toEqual([\"openid\", \"email\"]);\n  });\n\n  it(\"rejects /mcp without a token (401 + WWW-Authenticate)\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri);\n\n    const res = await fetch(`${base}/mcp`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify({ jsonrpc: \"2.0\", method: \"initialize\", id: 1 }),\n    });\n    expect(res.status).toBe(401);\n    expect(res.headers.get(\"www-authenticate\")).toMatch(/resource_metadata=/);\n  });\n\n  it(\"threads authInfo into the tool handler for a valid token\", async () => {\n    const { privateKey, jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri);\n    const token = await signToken(privateKey);\n\n    const client = new Client({ name: \"test-client\", version: \"0.0.0\" });\n    const transport = new StreamableHTTPClientTransport(\n      new URL(`${base}/mcp`),\n      { requestInit: { headers: { Authorization: `Bearer ${token}` } } },\n    );\n    await client.connect(transport);\n\n    const result = (await client.callTool({\n      name: \"whoami\",\n      arguments: {},\n    })) as unknown as {\n      content: { type: string; text: string }[];\n    };\n    expect(result.content[0]?.text).toBe(\"client-1\");\n\n    await client.close();\n  });\n});\n\ndescribe(\"baseUrl inferred from headers\", () => {\n  it(\"derives the resource origin from x-forwarded-host\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri, { baseUrl: null });\n\n    const res = await fetch(`${base}/.well-known/oauth-protected-resource`, {\n      headers: { \"x-forwarded-host\": \"infer.example.test\" },\n    });\n    expect(res.status).toBe(200);\n    const body = (await res.json()) as { resource: string };\n    expect(body.resource).toBe(\"https://infer.example.test/\");\n  });\n\n  it(\"uses the first hop of a forwarded-host chain\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri, { baseUrl: null });\n\n    const res = await fetch(`${base}/.well-known/oauth-protected-resource`, {\n      headers: {\n        \"x-forwarded-host\": \"public.example, internal.local\",\n        \"x-forwarded-proto\": \"https, http\",\n      },\n    });\n    expect(res.status).toBe(200);\n    const body = (await res.json()) as { resource: string };\n    expect(body.resource).toBe(\"https://public.example/\");\n  });\n\n  it(\"ignores the client Origin header, using Host instead\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri, { baseUrl: null });\n\n    const res = await fetch(`${base}/.well-known/oauth-protected-resource`, {\n      headers: { origin: \"https://chatgpt.com\" },\n    });\n    expect(res.status).toBe(200);\n    const body = (await res.json()) as { resource: string };\n    expect(body.resource).toMatch(/^http:\\/\\/(localhost|127\\.0\\.0\\.1):/);\n  });\n\n  it(\"points the 401 WWW-Authenticate at the inferred host\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri, { baseUrl: null });\n\n    const res = await fetch(`${base}/mcp`, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n        \"x-forwarded-host\": \"infer.example.test\",\n      },\n      body: JSON.stringify({ jsonrpc: \"2.0\", method: \"initialize\", id: 1 }),\n    });\n    expect(res.status).toBe(401);\n    expect(res.headers.get(\"www-authenticate\")).toMatch(\n      /resource_metadata=\"https:\\/\\/infer\\.example\\.test\\//,\n    );\n  });\n});\n\ndescribe(\"oauth config validation\", () => {\n  const validMetadata = {\n    issuer: ISSUER,\n    authorization_endpoint: `${ISSUER}/authorize`,\n    token_endpoint: `${ISSUER}/token`,\n    response_types_supported: [\"code\"],\n  };\n\n  it(\"throws on a non-absolute baseUrl\", () => {\n    expect(\n      () =>\n        new McpServer({ name: \"t\", version: \"0\" }, undefined, {\n          oauth: {\n            baseUrl: \"not-a-url\",\n            oauthMetadata: validMetadata,\n            verify: { issuer: ISSUER, audience: AUDIENCE },\n          },\n        }),\n    ).toThrow(/baseUrl must be a valid absolute URL/);\n  });\n});\n"]}
+{"version":3,"file":"setup.test.js","sourceRoot":"","sources":["../../../src/server/auth/setup.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAEnG,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,EAAE,CAAC,IAAI,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;IACpC,oBAAoB,EAAE,GAAG,EAAE,CACzB,CAAC,CAAC,IAAa,EAAE,IAAa,EAAE,IAAgB,EAAE,EAAE,CAClD,IAAI,EAAE,CAAmB;CAC9B,CAAC,CAAC,CAAC;AACJ,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC;IACrC,cAAc,EAAE,CAAC,WAAoB,EAAE,EAAE,CACvC,CAAC,CAAC,IAAa,EAAE,IAAa,EAAE,IAAgB,EAAE,EAAE,CAClD,IAAI,EAAE,CAAmB;CAC9B,CAAC,CAAC,CAAC;AAEJ,MAAM,MAAM,GAAG,qBAAqB,CAAC;AACrC,MAAM,QAAQ,GAAG,eAAe,CAAC;AAEjC,IAAI,UAAmC,CAAC;AACxC,IAAI,SAAkC,CAAC;AACvC,SAAS,CAAC,GAAG,EAAE;IACb,UAAU,EAAE,KAAK,EAAE,CAAC;IACpB,SAAS,EAAE,KAAK,EAAE,CAAC;AACrB,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,SAAS;IACtB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG;QACV,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACpC,GAAG,EAAE,UAAU;QACf,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,KAAK;KACX,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC7C,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,UAAU,GAAG,MAAM,CAAC;IACpB,MAAM,IAAI,GAAI,MAAM,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;IACzD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,oBAAoB,IAAI,OAAO,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,SAAS,CAAC,GAAc,EAAE,KAAK,GAAG,cAAc;IACvD,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC;QACtB,SAAS,EAAE,UAAU;QACrB,KAAK;QACL,GAAG,EAAE,QAAQ;KACd,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;SACrD,SAAS,CAAC,MAAM,CAAC;SACjB,WAAW,CAAC,QAAQ,CAAC;SACrB,iBAAiB,CAAC,IAAI,CAAC;SACvB,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,OAAe,EACf,EACE,OAAO,GAAG,0BAA0B,EACpC,YAAY,GAAG,KAAK,MACmC,EAAE;IAE3D,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,EACvC,EAAE,YAAY,EAAE,EAAE,EAAE,EACpB;QACE,KAAK,EAAE;YACL,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;YACxC,aAAa,EAAE;gBACb,MAAM,EAAE,MAAM;gBACd,sBAAsB,EAAE,GAAG,MAAM,YAAY;gBAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;gBACjC,wBAAwB,EAAE,CAAC,MAAM,CAAC;aACnC;YACD,GAAG,CAAC,YAAY;gBACd,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;gBAC7D,CAAC,CAAC;oBACE,QAAQ,EAAE,kBAAkB,CAAC;wBAC3B,MAAM,EAAE,MAAM;wBACd,QAAQ,EAAE,QAAQ;wBAClB,OAAO;qBACR,CAAC;iBACH,CAAC;YACN,eAAe,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;YACpC,cAAc,EAAE,CAAC,QAAQ,CAAC;SAC3B;KACF,CACF,CAAC,YAAY,CACZ;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,8BAA8B;QAC3C,WAAW,EAAE,EAAE;KAChB,EACD,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACjB,iBAAiB,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,IAAI,IAAI,EAAE;QACjE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,IAAI,MAAM,EAAE,CAAC;KACtE,CAAC,CACH,CAAC;IAEF,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IACvC,MAAM,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IACnE,SAAS,GAAG,SAAS,CAAC;IACtB,MAAM,IAAI,GAAI,SAAS,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;IAC5D,OAAO,oBAAoB,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;QAEvC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,uCAAuC,CAAC,CAAC;QACxE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAI7B,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;QAEvC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,MAAM,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;SACtE,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,IAAI,6BAA6B,CACjD,IAAI,GAAG,CAAC,GAAG,IAAI,MAAM,CAAC,EACtB,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,EAAE,CACnE,CAAC;QACF,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEhC,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC;YACpC,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,EAAE;SACd,CAAC,CAED,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEjD,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,IAAI,6BAA6B,CACjD,IAAI,GAAG,CAAC,GAAG,IAAI,MAAM,CAAC,EACtB,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,EAAE,CACnE,CAAC;QACF,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEhC,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC;YACpC,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,EAAE;SACd,CAAC,CAA6D,CAAC;QAChE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEjD,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,uCAAuC,EAAE;YACtE,OAAO,EAAE,EAAE,kBAAkB,EAAE,oBAAoB,EAAE;SACtD,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,uCAAuC,EAAE;YACtE,OAAO,EAAE;gBACP,kBAAkB,EAAE,gCAAgC;gBACpD,mBAAmB,EAAE,aAAa;aACnC;SACF,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,uCAAuC,EAAE;YACtE,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE;SAC3C,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,MAAM,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,kBAAkB,EAAE,oBAAoB;aACzC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;SACtE,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CACjD,qDAAqD,CACtD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,eAAe,CAAC,OAAe;IAC5C,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,EAAE,EAC7C,EAAE,YAAY,EAAE,EAAE,EAAE,EACpB;QACE,KAAK,EAAE;YACL,OAAO,EAAE,0BAA0B;YACnC,aAAa,EAAE;gBACb,MAAM,EAAE,MAAM;gBACd,sBAAsB,EAAE,GAAG,MAAM,YAAY;gBAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;gBACjC,wBAAwB,EAAE,CAAC,MAAM,CAAC;aACnC;YACD,QAAQ,EAAE,kBAAkB,CAAC;gBAC3B,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,QAAQ;gBAClB,OAAO;aACR,CAAC;SACH;KACF,CACF;SACE,YAAY,CACX;QACE,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,SAAS;QACtB,WAAW,EAAE,EAAE;QACf,IAAI,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;KAChC,EACD,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACjB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,IAAI,MAAM,EAAE,CAAC;KACtE,CAAC,CACH;SACA,YAAY,CACX;QACE,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,UAAU;QACvB,WAAW,EAAE,EAAE;QACf,IAAI,EAAE,EAAE;KACT,EACD,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACjB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,IAAI,MAAM,EAAE,CAAC;KACtE,CAAC,CACH,CAAC;IAEH,MAAM,CAAC,YAA6C,CACnD,eAAe,EACf;QACE,WAAW,EAAE,4CAA4C;QACzD,WAAW,EAAE,EAAE;KAChB,EACD,CAAC,KAAc,EAAE,KAA2C,EAAE,EAAE,CAAC,CAAC;QAChE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,IAAI,MAAM,EAAE,CAAC;KACtE,CAAC,CACH,CAAC;IAEF,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IACvC,MAAM,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IACnE,SAAS,GAAG,SAAS,CAAC;IACtB,MAAM,IAAI,GAAI,SAAS,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;IAC5D,OAAO,oBAAoB,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAE5C,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACrE,MAAM,MAAM,CAAC,OAAO,CAClB,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC,CAC1D,CAAC;QAEF,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC;YACpC,IAAI,EAAE,eAAe;YACrB,SAAS,EAAE,EAAE;SACd,CAAC,CAA+C,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE7C,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG;YACd,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,qCAAqC;SAC9C,CAAC;QACF,MAAM,KAAK,CAAC,GAAG,IAAI,MAAM,EAAE;YACzB,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE;oBACN,eAAe,EAAE,YAAY;oBAC7B,YAAY,EAAE,EAAE;oBAChB,UAAU,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE;iBACxC;aACF,CAAC;SACH,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,MAAM,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;SACtE,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAE/D,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC;QAC1E,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAE5C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,MAAM,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,qCAAqC;aAC9C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB;oBACE,OAAO,EAAE,KAAK;oBACd,EAAE,EAAE,CAAC;oBACL,MAAM,EAAE,YAAY;oBACpB,MAAM,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,EAAE,EAAE;iBAClD;aACF,CAAC;SACH,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;QAClE,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC5C,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAE5C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,MAAM,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,qCAAqC;aAC9C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,EAAE,EAAE;aACjD,CAAC;SACH,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAE5C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,MAAM,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,qCAAqC;aAC9C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,EAAE,EAAE;aAClD,CAAC;SACH,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CACjD,uBAAuB,CACxB,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAC9F,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAE5C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,MAAM,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,qCAAqC;gBAC7C,YAAY,EAAE,gBAAgB;aAC/B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,EAAE,EAAE;aAClD,CAAC;SACH,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAM7B,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC5D,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;QACtD,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAE5C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,MAAM,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,qCAAqC;gBAC7C,YAAY,EAAE,gBAAgB;aAC/B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB;oBACE,OAAO,EAAE,KAAK;oBACd,EAAE,EAAE,CAAC;oBACL,MAAM,EAAE,YAAY;oBACpB,MAAM,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,EAAE,EAAE;iBAClD;aACF,CAAC;SACH,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,gBAAgB,CAAC,OAAe;IAC7C,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,OAAO,EAAE,EAC9C,EAAE,YAAY,EAAE,EAAE,EAAE,EACpB;QACE,KAAK,EAAE;YACL,OAAO,EAAE,0BAA0B;YACnC,aAAa,EAAE;gBACb,MAAM,EAAE,MAAM;gBACd,sBAAsB,EAAE,GAAG,MAAM,YAAY;gBAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;gBACjC,wBAAwB,EAAE,CAAC,MAAM,CAAC;aACnC;YACD,QAAQ,EAAE,kBAAkB,CAAC;gBAC3B,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,QAAQ;gBAClB,OAAO;aACR,CAAC;SACH;KACF,CACF,CAAC,YAAY,CACZ;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,2BAA2B;QACxC,WAAW,EAAE,EAAE;QACf,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE;KAC/B,EACD,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CACpD,CAAC;IAEF,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IACvC,MAAM,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IACnE,SAAS,GAAG,SAAS,CAAC;IACtB,MAAM,IAAI,GAAI,SAAS,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;IAC5D,OAAO,oBAAoB,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,QAAQ,CAAC,wDAAwD,EAAE,GAAG,EAAE;IACtE,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAEpD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,MAAM,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,qCAAqC;gBAC7C,aAAa,EAAE,UAAU,KAAK,EAAE;aACjC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE;aAC5C,CAAC;SACH,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;QAE7D,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACrE,MAAM,MAAM,CAAC,OAAO,CAClB,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,MAAM,CAAC,EAAE;YACxD,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE;SAC/D,CAAC,CACH,CAAC;QAEF,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC;YACpC,IAAI,EAAE,UAAU;YAChB,SAAS,EAAE,EAAE;SACd,CAAC,CAAkE,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE3C,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,MAAM,CAAC,GAAG,EAAE,CACV,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,YAAY,CACrD,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EACxC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAClD,CACF,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,CAAC,GAAG,EAAE,CACV,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,YAAY,CACrD,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAC9D,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAClD,CACF,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,CAAC,GAAG,EAAE,CACV,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,YAAY,CACrD,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,EAC/D,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAClD,CACF,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,CAAC,GAAG,EAAE,CAER,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,YAG5C,CACC;YACE,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,EAAE;YACf,IAAI,EAAE,EAAE;YACR,eAAe,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;SACtC,EACD,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAClD,CACF,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,MAAM,aAAa,GAAG;QACpB,MAAM,EAAE,MAAM;QACd,sBAAsB,EAAE,GAAG,MAAM,YAAY;QAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;QACjC,wBAAwB,EAAE,CAAC,MAAM,CAAC;KACnC,CAAC;IAEF,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,CACJ,GAAG,EAAE,CACH,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE;YACpD,KAAK,EAAE;gBACL,OAAO,EAAE,WAAW;gBACpB,aAAa,EAAE,aAAa;gBAC5B,QAAQ,EAAE,kBAAkB,CAAC;oBAC3B,MAAM,EAAE,MAAM;oBACd,QAAQ,EAAE,QAAQ;iBACnB,CAAC;aACH;SACF,CAAC,CACL,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport http from \"node:http\";\nimport { Client } from \"@modelcontextprotocol/sdk/client/index.js\";\nimport { StreamableHTTPClientTransport } from \"@modelcontextprotocol/sdk/client/streamableHttp.js\";\nimport type { RequestHandler } from \"express\";\nimport * as jose from \"jose\";\nimport { afterEach, describe, expect, it, vi } from \"vitest\";\nimport { McpServer } from \"../server.js\";\nimport { createJwksVerifier } from \"./verify.js\";\n\nvi.mock(\"@skybridge/devtools\", () => ({\n  devtoolsStaticServer: () =>\n    ((_req: unknown, _res: unknown, next: () => void) =>\n      next()) as RequestHandler,\n}));\nvi.mock(\"../viewsDevServer.js\", () => ({\n  viewsDevServer: (_httpServer: unknown) =>\n    ((_req: unknown, _res: unknown, next: () => void) =>\n      next()) as RequestHandler,\n}));\n\nconst ISSUER = \"https://issuer.test\";\nconst AUDIENCE = \"api://default\";\n\nlet jwksServer: http.Server | undefined;\nlet appServer: http.Server | undefined;\nafterEach(() => {\n  jwksServer?.close();\n  appServer?.close();\n});\n\nasync function startJwks() {\n  const { publicKey, privateKey } = await jose.generateKeyPair(\"RS256\");\n  const jwk = {\n    ...(await jose.exportJWK(publicKey)),\n    kid: \"test-key\",\n    alg: \"RS256\",\n    use: \"sig\",\n  };\n  const server = http.createServer((_req, res) => {\n    res.setHeader(\"content-type\", \"application/json\");\n    res.end(JSON.stringify({ keys: [jwk] }));\n  });\n  await new Promise<void>((resolve) => server.listen(0, resolve));\n  jwksServer = server;\n  const port = (server.address() as { port: number }).port;\n  return { privateKey, jwksUri: `http://localhost:${port}/jwks` };\n}\n\nfunction signToken(key: CryptoKey, scope = \"openid email\") {\n  return new jose.SignJWT({\n    client_id: \"client-1\",\n    scope,\n    sub: \"user-1\",\n  })\n    .setProtectedHeader({ alg: \"RS256\", kid: \"test-key\" })\n    .setIssuer(ISSUER)\n    .setAudience(AUDIENCE)\n    .setExpirationTime(\"1h\")\n    .sign(key);\n}\n\nasync function bootServer(\n  jwksUri: string,\n  {\n    baseUrl = \"https://app.example.test\",\n    legacyVerify = false,\n  }: { baseUrl?: string | null; legacyVerify?: boolean } = {},\n) {\n  const { createApp } = await import(\"../express.js\");\n  const server = new McpServer(\n    { name: \"auth-test\", version: \"0.0.0\" },\n    { capabilities: {} },\n    {\n      oauth: {\n        ...(baseUrl === null ? {} : { baseUrl }),\n        oauthMetadata: {\n          issuer: ISSUER,\n          authorization_endpoint: `${ISSUER}/authorize`,\n          token_endpoint: `${ISSUER}/token`,\n          response_types_supported: [\"code\"],\n        },\n        ...(legacyVerify\n          ? { verify: { issuer: ISSUER, audience: AUDIENCE, jwksUri } }\n          : {\n              verifier: createJwksVerifier({\n                issuer: ISSUER,\n                audience: AUDIENCE,\n                jwksUri,\n              }),\n            }),\n        scopesSupported: [\"openid\", \"email\"],\n        requiredScopes: [\"openid\"],\n      },\n    },\n  ).registerTool(\n    {\n      name: \"whoami\",\n      description: \"Returns the caller identity.\",\n      inputSchema: {},\n    },\n    (_args, extra) => ({\n      structuredContent: { clientId: extra.authInfo?.clientId ?? null },\n      content: [{ type: \"text\", text: extra.authInfo?.clientId ?? \"anon\" }],\n    }),\n  );\n\n  const httpServer = http.createServer();\n  await createApp({ mcpServer: server, httpServer });\n  const listening = http.createServer(server.express);\n  await new Promise<void>((resolve) => listening.listen(0, resolve));\n  appServer = listening;\n  const port = (listening.address() as { port: number }).port;\n  return `http://localhost:${port}`;\n}\n\ndescribe(\"setupOAuth wiring\", () => {\n  it(\"serves protected-resource metadata\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri);\n\n    const res = await fetch(`${base}/.well-known/oauth-protected-resource`);\n    expect(res.status).toBe(200);\n    const body = (await res.json()) as {\n      resource: string;\n      authorization_servers: string[];\n      scopes_supported: string[];\n    };\n    expect(body.resource).toBe(\"https://app.example.test/\");\n    expect(body.authorization_servers).toContain(ISSUER);\n    expect(body.scopes_supported).toEqual([\"openid\", \"email\"]);\n  });\n\n  it(\"rejects /mcp without a token (401 + WWW-Authenticate)\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri);\n\n    const res = await fetch(`${base}/mcp`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify({ jsonrpc: \"2.0\", method: \"initialize\", id: 1 }),\n    });\n    expect(res.status).toBe(401);\n    expect(res.headers.get(\"www-authenticate\")).toMatch(/resource_metadata=/);\n  });\n\n  it(\"threads authInfo into the tool handler for a valid token\", async () => {\n    const { privateKey, jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri);\n    const token = await signToken(privateKey);\n\n    const client = new Client({ name: \"test-client\", version: \"0.0.0\" });\n    const transport = new StreamableHTTPClientTransport(\n      new URL(`${base}/mcp`),\n      { requestInit: { headers: { Authorization: `Bearer ${token}` } } },\n    );\n    await client.connect(transport);\n\n    const result = (await client.callTool({\n      name: \"whoami\",\n      arguments: {},\n    })) as unknown as {\n      content: { type: string; text: string }[];\n    };\n    expect(result.content[0]?.text).toBe(\"client-1\");\n\n    await client.close();\n  });\n  it(\"builds the verifier from the legacy verify config\", async () => {\n    const { privateKey, jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri, { legacyVerify: true });\n    const token = await signToken(privateKey);\n\n    const client = new Client({ name: \"test-client\", version: \"0.0.0\" });\n    const transport = new StreamableHTTPClientTransport(\n      new URL(`${base}/mcp`),\n      { requestInit: { headers: { Authorization: `Bearer ${token}` } } },\n    );\n    await client.connect(transport);\n\n    const result = (await client.callTool({\n      name: \"whoami\",\n      arguments: {},\n    })) as unknown as { content: { type: string; text: string }[] };\n    expect(result.content[0]?.text).toBe(\"client-1\");\n\n    await client.close();\n  });\n});\n\ndescribe(\"baseUrl inferred from headers\", () => {\n  it(\"derives the resource origin from x-forwarded-host\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri, { baseUrl: null });\n\n    const res = await fetch(`${base}/.well-known/oauth-protected-resource`, {\n      headers: { \"x-forwarded-host\": \"infer.example.test\" },\n    });\n    expect(res.status).toBe(200);\n    const body = (await res.json()) as { resource: string };\n    expect(body.resource).toBe(\"https://infer.example.test/\");\n  });\n\n  it(\"uses the first hop of a forwarded-host chain\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri, { baseUrl: null });\n\n    const res = await fetch(`${base}/.well-known/oauth-protected-resource`, {\n      headers: {\n        \"x-forwarded-host\": \"public.example, internal.local\",\n        \"x-forwarded-proto\": \"https, http\",\n      },\n    });\n    expect(res.status).toBe(200);\n    const body = (await res.json()) as { resource: string };\n    expect(body.resource).toBe(\"https://public.example/\");\n  });\n\n  it(\"ignores the client Origin header, using Host instead\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri, { baseUrl: null });\n\n    const res = await fetch(`${base}/.well-known/oauth-protected-resource`, {\n      headers: { origin: \"https://chatgpt.com\" },\n    });\n    expect(res.status).toBe(200);\n    const body = (await res.json()) as { resource: string };\n    expect(body.resource).toMatch(/^http:\\/\\/(localhost|127\\.0\\.0\\.1):/);\n  });\n\n  it(\"points the 401 WWW-Authenticate at the inferred host\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri, { baseUrl: null });\n\n    const res = await fetch(`${base}/mcp`, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n        \"x-forwarded-host\": \"infer.example.test\",\n      },\n      body: JSON.stringify({ jsonrpc: \"2.0\", method: \"initialize\", id: 1 }),\n    });\n    expect(res.status).toBe(401);\n    expect(res.headers.get(\"www-authenticate\")).toMatch(\n      /resource_metadata=\"https:\\/\\/infer\\.example\\.test\\//,\n    );\n  });\n});\n\nasync function bootMixedServer(jwksUri: string) {\n  const { createApp } = await import(\"../express.js\");\n  const server = new McpServer(\n    { name: \"mixed-auth-test\", version: \"0.0.0\" },\n    { capabilities: {} },\n    {\n      oauth: {\n        baseUrl: \"https://app.example.test\",\n        oauthMetadata: {\n          issuer: ISSUER,\n          authorization_endpoint: `${ISSUER}/authorize`,\n          token_endpoint: `${ISSUER}/token`,\n          response_types_supported: [\"code\"],\n        },\n        verifier: createJwksVerifier({\n          issuer: ISSUER,\n          audience: AUDIENCE,\n          jwksUri,\n        }),\n      },\n    },\n  )\n    .registerTool(\n      {\n        name: \"public-whoami\",\n        description: \"Public.\",\n        inputSchema: {},\n        auth: { allowsAnonymous: true },\n      },\n      (_args, extra) => ({\n        content: [{ type: \"text\", text: extra.authInfo?.clientId ?? \"anon\" }],\n      }),\n    )\n    .registerTool(\n      {\n        name: \"private-whoami\",\n        description: \"Private.\",\n        inputSchema: {},\n        auth: {},\n      },\n      (_args, extra) => ({\n        content: [{ type: \"text\", text: extra.authInfo?.clientId ?? \"anon\" }],\n      }),\n    );\n\n  (server.registerTool as (...a: unknown[]) => unknown)(\n    \"legacy-whoami\",\n    {\n      description: \"Registered via the legacy string overload.\",\n      inputSchema: {},\n    },\n    (_args: unknown, extra: { authInfo?: { clientId?: string } }) => ({\n      content: [{ type: \"text\", text: extra.authInfo?.clientId ?? \"anon\" }],\n    }),\n  );\n\n  const httpServer = http.createServer();\n  await createApp({ mcpServer: server, httpServer });\n  const listening = http.createServer(server.express);\n  await new Promise<void>((resolve) => listening.listen(0, resolve));\n  appServer = listening;\n  const port = (listening.address() as { port: number }).port;\n  return `http://localhost:${port}`;\n}\n\ndescribe(\"mixed-auth door\", () => {\n  it(\"lets an anonymous caller initialize and run a noauth tool\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootMixedServer(jwksUri);\n\n    const client = new Client({ name: \"test-client\", version: \"0.0.0\" });\n    await client.connect(\n      new StreamableHTTPClientTransport(new URL(`${base}/mcp`)),\n    );\n\n    const result = (await client.callTool({\n      name: \"public-whoami\",\n      arguments: {},\n    })) as unknown as { content: { text: string }[] };\n    expect(result.content[0]?.text).toBe(\"anon\");\n\n    await client.close();\n  });\n\n  it(\"exposes securitySchemes at the top level of tools/list (not only _meta)\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootMixedServer(jwksUri);\n    const headers = {\n      \"Content-Type\": \"application/json\",\n      Accept: \"application/json, text/event-stream\",\n    };\n    await fetch(`${base}/mcp`, {\n      method: \"POST\",\n      headers,\n      body: JSON.stringify({\n        jsonrpc: \"2.0\",\n        id: 1,\n        method: \"initialize\",\n        params: {\n          protocolVersion: \"2025-06-18\",\n          capabilities: {},\n          clientInfo: { name: \"c\", version: \"0\" },\n        },\n      }),\n    });\n    const res = await fetch(`${base}/mcp`, {\n      method: \"POST\",\n      headers,\n      body: JSON.stringify({ jsonrpc: \"2.0\", id: 2, method: \"tools/list\" }),\n    });\n    const text = await res.text();\n    const json = JSON.parse((text.match(/\\{[\\s\\S]*\\}/) ?? [\"{}\"])[0]) as {\n      result: { tools: Array<{ name: string; securitySchemes?: unknown }> };\n    };\n    const whoami = json.result.tools.find((t) => t.name === \"private-whoami\");\n    expect(whoami?.securitySchemes).toEqual([{ type: \"oauth2\" }]);\n  });\n\n  it(\"denies a protected tool inside an anonymous JSON-RPC batch\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootMixedServer(jwksUri);\n\n    const res = await fetch(`${base}/mcp`, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n        Accept: \"application/json, text/event-stream\",\n      },\n      body: JSON.stringify([\n        {\n          jsonrpc: \"2.0\",\n          id: 1,\n          method: \"tools/call\",\n          params: { name: \"private-whoami\", arguments: {} },\n        },\n      ]),\n    });\n    expect(res.status).toBe(401);\n    const wwwAuthenticate = res.headers.get(\"www-authenticate\") ?? \"\";\n    expect(wwwAuthenticate).toMatch(/^Bearer /);\n    expect(wwwAuthenticate).toContain(\"resource_metadata=\");\n    const text = await res.text();\n    expect(text).not.toContain(\"client-1\");\n  });\n\n  it(\"gates a tool registered via the legacy string overload (secure default)\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootMixedServer(jwksUri);\n\n    const res = await fetch(`${base}/mcp`, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n        Accept: \"application/json, text/event-stream\",\n      },\n      body: JSON.stringify({\n        jsonrpc: \"2.0\",\n        id: 1,\n        method: \"tools/call\",\n        params: { name: \"legacy-whoami\", arguments: {} },\n      }),\n    });\n    expect(res.status).toBe(401);\n  });\n\n  it(\"returns 401 + WWW-Authenticate for a protected tool while anonymous\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootMixedServer(jwksUri);\n\n    const res = await fetch(`${base}/mcp`, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n        Accept: \"application/json, text/event-stream\",\n      },\n      body: JSON.stringify({\n        jsonrpc: \"2.0\",\n        id: 1,\n        method: \"tools/call\",\n        params: { name: \"private-whoami\", arguments: {} },\n      }),\n    });\n    expect(res.status).toBe(401);\n    expect(res.headers.get(\"www-authenticate\")).toMatch(\n      /error=\"invalid_token\"/,\n    );\n    expect(res.headers.get(\"www-authenticate\")).toMatch(/resource_metadata=/);\n  });\n\n  it(\"returns an in-band mcp/www_authenticate array to ChatGPT (not a transport 401)\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootMixedServer(jwksUri);\n\n    const res = await fetch(`${base}/mcp`, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n        Accept: \"application/json, text/event-stream\",\n        \"User-Agent\": \"openai-mcp/1.0\",\n      },\n      body: JSON.stringify({\n        jsonrpc: \"2.0\",\n        id: 7,\n        method: \"tools/call\",\n        params: { name: \"private-whoami\", arguments: {} },\n      }),\n    });\n    expect(res.status).toBe(200);\n    expect(res.headers.get(\"www-authenticate\")).toBeNull();\n    const body = (await res.json()) as {\n      id: number;\n      result: {\n        isError: boolean;\n        _meta: { \"mcp/www_authenticate\": string[] };\n      };\n    };\n    expect(body.id).toBe(7);\n    expect(body.result.isError).toBe(true);\n    const challenge = body.result._meta[\"mcp/www_authenticate\"];\n    expect(Array.isArray(challenge)).toBe(true);\n    expect(challenge[0]).toMatch(/error=\"invalid_token\"/);\n    expect(challenge[0]).toMatch(/resource_metadata=/);\n  });\n\n  it(\"fails closed on a ChatGPT batch (transport 401, no in-band challenge)\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootMixedServer(jwksUri);\n\n    const res = await fetch(`${base}/mcp`, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n        Accept: \"application/json, text/event-stream\",\n        \"User-Agent\": \"openai-mcp/1.0\",\n      },\n      body: JSON.stringify([\n        {\n          jsonrpc: \"2.0\",\n          id: 1,\n          method: \"tools/call\",\n          params: { name: \"private-whoami\", arguments: {} },\n        },\n      ]),\n    });\n    expect(res.status).toBe(401);\n    expect(res.headers.get(\"www-authenticate\")).toMatch(/^Bearer /);\n    const text = await res.text();\n    expect(text).not.toContain(\"client-1\");\n  });\n});\n\nasync function bootScopedServer(jwksUri: string) {\n  const { createApp } = await import(\"../express.js\");\n  const server = new McpServer(\n    { name: \"scoped-auth-test\", version: \"0.0.0\" },\n    { capabilities: {} },\n    {\n      oauth: {\n        baseUrl: \"https://app.example.test\",\n        oauthMetadata: {\n          issuer: ISSUER,\n          authorization_endpoint: `${ISSUER}/authorize`,\n          token_endpoint: `${ISSUER}/token`,\n          response_types_supported: [\"code\"],\n        },\n        verifier: createJwksVerifier({\n          issuer: ISSUER,\n          audience: AUDIENCE,\n          jwksUri,\n        }),\n      },\n    },\n  ).registerTool(\n    {\n      name: \"checkout\",\n      description: \"Needs the checkout scope.\",\n      inputSchema: {},\n      auth: { scopes: [\"checkout\"] },\n    },\n    () => ({ content: [{ type: \"text\", text: \"ok\" }] }),\n  );\n\n  const httpServer = http.createServer();\n  await createApp({ mcpServer: server, httpServer });\n  const listening = http.createServer(server.express);\n  await new Promise<void>((resolve) => listening.listen(0, resolve));\n  appServer = listening;\n  const port = (listening.address() as { port: number }).port;\n  return `http://localhost:${port}`;\n}\n\ndescribe(\"per-tool scope enforcement in fully-authenticated mode\", () => {\n  it(\"returns 403 for a valid token missing the tool's scope\", async () => {\n    const { privateKey, jwksUri } = await startJwks();\n    const base = await bootScopedServer(jwksUri);\n    const token = await signToken(privateKey, \"openid\");\n\n    const res = await fetch(`${base}/mcp`, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n        Accept: \"application/json, text/event-stream\",\n        Authorization: `Bearer ${token}`,\n      },\n      body: JSON.stringify({\n        jsonrpc: \"2.0\",\n        id: 1,\n        method: \"tools/call\",\n        params: { name: \"checkout\", arguments: {} },\n      }),\n    });\n    expect(res.status).toBe(403);\n    const header = res.headers.get(\"www-authenticate\");\n    expect(header).toMatch(/error=\"insufficient_scope\"/);\n    expect(header).toMatch(/scope=\"checkout\"/);\n  });\n\n  it(\"allows a token carrying the tool's scope\", async () => {\n    const { privateKey, jwksUri } = await startJwks();\n    const base = await bootScopedServer(jwksUri);\n    const token = await signToken(privateKey, \"openid checkout\");\n\n    const client = new Client({ name: \"test-client\", version: \"0.0.0\" });\n    await client.connect(\n      new StreamableHTTPClientTransport(new URL(`${base}/mcp`), {\n        requestInit: { headers: { Authorization: `Bearer ${token}` } },\n      }),\n    );\n\n    const result = (await client.callTool({\n      name: \"checkout\",\n      arguments: {},\n    })) as unknown as { isError?: boolean; content: { text: string }[] };\n    expect(result.content[0]?.text).toBe(\"ok\");\n\n    await client.close();\n  });\n});\n\ndescribe(\"auth shorthand validation\", () => {\n  it(\"throws when `auth` requires sign-in but no oauth provider is configured\", () => {\n    expect(() =>\n      new McpServer({ name: \"t\", version: \"0\" }).registerTool(\n        { name: \"x\", inputSchema: {}, auth: {} },\n        () => ({ content: [{ type: \"text\", text: \"\" }] }),\n      ),\n    ).toThrow(/no `oauth` provider/);\n  });\n\n  it(\"throws when `auth` sets scopes but no oauth provider is configured\", () => {\n    expect(() =>\n      new McpServer({ name: \"t\", version: \"0\" }).registerTool(\n        { name: \"x\", inputSchema: {}, auth: { scopes: [\"checkout\"] } },\n        () => ({ content: [{ type: \"text\", text: \"\" }] }),\n      ),\n    ).toThrow(/no `oauth` provider/);\n  });\n\n  it(\"allows `auth: { allowsAnonymous: true }` without an oauth provider\", () => {\n    expect(() =>\n      new McpServer({ name: \"t\", version: \"0\" }).registerTool(\n        { name: \"x\", inputSchema: {}, auth: { allowsAnonymous: true } },\n        () => ({ content: [{ type: \"text\", text: \"\" }] }),\n      ),\n    ).not.toThrow();\n  });\n\n  it(\"prefers `securitySchemes` over `auth` when both are set (untyped path)\", () => {\n    expect(() =>\n      (\n        new McpServer({ name: \"t\", version: \"0\" }).registerTool as (\n          ...a: unknown[]\n        ) => unknown\n      )(\n        {\n          name: \"x\",\n          inputSchema: {},\n          auth: {},\n          securitySchemes: [{ type: \"oauth2\" }],\n        },\n        () => ({ content: [{ type: \"text\", text: \"\" }] }),\n      ),\n    ).not.toThrow();\n  });\n});\n\ndescribe(\"oauth config validation\", () => {\n  const validMetadata = {\n    issuer: ISSUER,\n    authorization_endpoint: `${ISSUER}/authorize`,\n    token_endpoint: `${ISSUER}/token`,\n    response_types_supported: [\"code\"],\n  };\n\n  it(\"throws on a non-absolute baseUrl\", () => {\n    expect(\n      () =>\n        new McpServer({ name: \"t\", version: \"0\" }, undefined, {\n          oauth: {\n            baseUrl: \"not-a-url\",\n            oauthMetadata: validMetadata,\n            verifier: createJwksVerifier({\n              issuer: ISSUER,\n              audience: AUDIENCE,\n            }),\n          },\n        }),\n    ).toThrow(/baseUrl must be a valid absolute URL/);\n  });\n});\n"]}

package/dist/server/auth/verify.d.ts

@@ -1,4 +1,4 @@
-import type { OAuthTokenVerifier } from "@modelcontextprotocol/sdk/server/auth/provider.js";
+import type { ExtraClaims, TokenVerifier } from "../auth.js";
 export type JwksVerifyConfig = {
     /** Expected `iss` claim. */
     issuer: string;
@@ -8,5 +8,39 @@ export type JwksVerifyConfig = {
     /** Defaults to `${issuer}/.well-known/jwks.json`. */
     jwksUri?: string;
 };
-/** Builds an `OAuthTokenVerifier` validating JWTs against a remote JWKS. Internal, not exported. */
-export declare function createJwksVerifier(config: JwksVerifyConfig): OAuthTokenVerifier;
+/**
+ * Claims a JWKS-verified token always carries into `extra`, whatever the IdP:
+ * `subject` (the renamed `sub`) plus the registered claims that survive the
+ * mapping. `client_id`, `scope` and `exp` do not appear here, since they become
+ * `AuthInfo` fields instead. Intersected into every claim shape a JWKS verifier
+ * resolves.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc7519#section-4.1
+ */
+export type RegisteredClaims = {
+    /** The token's `sub`, renamed on the way into `extra`. */
+    subject?: string;
+    /** Issuer of the token. */
+    iss?: string;
+    /** Audience the token was minted for. */
+    aud?: string | string[];
+    /** Issued-at, in unix seconds. */
+    iat?: number;
+    /** Not-valid-before, in unix seconds. */
+    nbf?: number;
+    /** Unique token id. */
+    jti?: string;
+};
+/**
+ * Builds a {@link TokenVerifier} that validates JWTs against a remote JWKS.
+ *
+ * `extra` receives the token's claims with `sub` renamed to `subject`, minus
+ * `client_id`, `scope` and `exp`, which map onto `AuthInfo` fields instead. Pass
+ * `TExtra` to declare what your IdP puts there; the branded providers do this
+ * for you. {@link RegisteredClaims} is always included, since those claims
+ * survive the mapping.
+ *
+ * @typeParam TExtra - Claims the verified token carries in `extra`. An
+ * assertion, not a runtime check: nothing rejects a token whose claims differ.
+ */
+export declare function createJwksVerifier<TExtra extends ExtraClaims = ExtraClaims>(config: JwksVerifyConfig): TokenVerifier<TExtra & RegisteredClaims>;

package/dist/server/auth/verify.js

@@ -1,7 +1,21 @@
 import { InvalidTokenError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
 import * as jose from "jose";
-/** Builds an `OAuthTokenVerifier` validating JWTs against a remote JWKS. Internal, not exported. */
+/**
+ * Builds a {@link TokenVerifier} that validates JWTs against a remote JWKS.
+ *
+ * `extra` receives the token's claims with `sub` renamed to `subject`, minus
+ * `client_id`, `scope` and `exp`, which map onto `AuthInfo` fields instead. Pass
+ * `TExtra` to declare what your IdP puts there; the branded providers do this
+ * for you. {@link RegisteredClaims} is always included, since those claims
+ * survive the mapping.
+ *
+ * @typeParam TExtra - Claims the verified token carries in `extra`. An
+ * assertion, not a runtime check: nothing rejects a token whose claims differ.
+ */
 export function createJwksVerifier(config) {
+    if (!config.issuer) {
+        throw new Error("createJwksVerifier requires an `issuer`");
+    }
     const jwksUri = config.jwksUri ??
         `${config.issuer.replace(/\/$/, "")}/.well-known/jwks.json`;
     const jwks = jose.createRemoteJWKSet(new URL(jwksUri));
@@ -17,7 +31,17 @@ export function createJwksVerifier(config) {
             }
             catch (err) {
                 const message = err instanceof Error ? err.message : String(err);
-                throw new InvalidTokenError(`Token verification failed: ${message}`);
+                // This reaches the `error_description` of a `WWW-Authenticate`
+                // challenge, whose value must not include characters outside
+                // %x20-21 / %x23-5B / %x5D-7E (OAuth 2.1 §5.3.1, RFC 6750 §3). jose
+                // quotes claim names in its messages, and a quote would end the
+                // parameter early, dropping the `resource_metadata` that follows it.
+                // Each run becomes a space rather than being dropped, so removing one
+                // never runs two words together.
+                const safe = message
+                    .replace(/[^\x20-\x21\x23-\x5B\x5D-\x7E]+/g, " ")
+                    .trim();
+                throw new InvalidTokenError(`Token verification failed: ${safe}`);
             }
             const { client_id, scope, exp, sub, ...rest } = payload;
             const scopes = Array.isArray(scope)

package/dist/server/auth/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../src/server/auth/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AAGpF,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAY7B,oGAAoG;AACpG,MAAM,UAAU,kBAAkB,CAChC,MAAwB;IAExB,MAAM,OAAO,GACX,MAAM,CAAC,OAAO;QACd,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC;IAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAEvD,OAAO;QACL,KAAK,CAAC,iBAAiB,CAAC,KAAa;YACnC,IAAI,OAAwB,CAAC;YAC7B,IAAI,CAAC;gBACH,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;oBAC/C,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,yDAAyD;oBACzD,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;iBACpE,CAAC,CAAC,CAAC;YACN,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACjE,MAAM,IAAI,iBAAiB,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;YACvE,CAAC;YAED,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,OAQ/C,CAAC;YAEF,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBACjC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;gBACnB,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ;oBACzB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;oBACpC,CAAC,CAAC,EAAE,CAAC;YAET,OAAO;gBACL,KAAK;gBACL,QAAQ,EAAE,SAAS,IAAI,EAAE;gBACzB,MAAM;gBACN,SAAS,EAAE,GAAG;gBACd,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE;aACd,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { InvalidTokenError } from \"@modelcontextprotocol/sdk/server/auth/errors.js\";\nimport type { OAuthTokenVerifier } from \"@modelcontextprotocol/sdk/server/auth/provider.js\";\nimport type { AuthInfo } from \"@modelcontextprotocol/sdk/server/auth/types.js\";\nimport * as jose from \"jose\";\n\nexport type JwksVerifyConfig = {\n  /** Expected `iss` claim. */\n  issuer: string;\n  /** Expected `aud` claim. Omit to skip audience verification — for IdPs that\n   * don't bind an audience to their access tokens (e.g. Clerk). */\n  audience?: string;\n  /** Defaults to `${issuer}/.well-known/jwks.json`. */\n  jwksUri?: string;\n};\n\n/** Builds an `OAuthTokenVerifier` validating JWTs against a remote JWKS. Internal, not exported. */\nexport function createJwksVerifier(\n  config: JwksVerifyConfig,\n): OAuthTokenVerifier {\n  const jwksUri =\n    config.jwksUri ??\n    `${config.issuer.replace(/\\/$/, \"\")}/.well-known/jwks.json`;\n  const jwks = jose.createRemoteJWKSet(new URL(jwksUri));\n\n  return {\n    async verifyAccessToken(token: string): Promise<AuthInfo> {\n      let payload: jose.JWTPayload;\n      try {\n        ({ payload } = await jose.jwtVerify(token, jwks, {\n          issuer: config.issuer,\n          // jose skips the aud check when `audience` is undefined.\n          ...(config.audience !== undefined && { audience: config.audience }),\n        }));\n      } catch (err) {\n        const message = err instanceof Error ? err.message : String(err);\n        throw new InvalidTokenError(`Token verification failed: ${message}`);\n      }\n\n      const { client_id, scope, exp, sub, ...rest } = payload as Record<\n        string,\n        unknown\n      > & {\n        client_id?: string;\n        scope?: string | string[];\n        exp?: number;\n        sub?: string;\n      };\n\n      const scopes = Array.isArray(scope)\n        ? scope.map(String)\n        : typeof scope === \"string\"\n          ? scope.split(/\\s+/).filter(Boolean)\n          : [];\n\n      return {\n        token,\n        clientId: client_id ?? \"\",\n        scopes,\n        expiresAt: exp,\n        extra: { subject: sub, ...rest },\n      } satisfies AuthInfo;\n    },\n  };\n}\n"]}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../src/server/auth/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AACpF,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAqC7B;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAwB;IAExB,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,OAAO,GACX,MAAM,CAAC,OAAO;QACd,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC;IAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAEvD,OAAO;QACL,KAAK,CAAC,iBAAiB,CACrB,KAAa;YAEb,IAAI,OAAwB,CAAC;YAC7B,IAAI,CAAC;gBACH,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;oBAC/C,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,yDAAyD;oBACzD,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;iBACpE,CAAC,CAAC,CAAC;YACN,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACjE,+DAA+D;gBAC/D,6DAA6D;gBAC7D,oEAAoE;gBACpE,gEAAgE;gBAChE,qEAAqE;gBACrE,sEAAsE;gBACtE,iCAAiC;gBACjC,MAAM,IAAI,GAAG,OAAO;qBACjB,OAAO,CAAC,kCAAkC,EAAE,GAAG,CAAC;qBAChD,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,iBAAiB,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,OAQ/C,CAAC;YAEF,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBACjC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;gBACnB,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ;oBACzB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;oBACpC,CAAC,CAAC,EAAE,CAAC;YAET,OAAO;gBACL,KAAK;gBACL,QAAQ,EAAE,SAAS,IAAI,EAAE;gBACzB,MAAM;gBACN,SAAS,EAAE,GAAG;gBACd,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,EACZ;aACnB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { InvalidTokenError } from \"@modelcontextprotocol/sdk/server/auth/errors.js\";\nimport * as jose from \"jose\";\nimport type { AuthInfo, ExtraClaims, TokenVerifier } from \"../auth.js\";\n\nexport type JwksVerifyConfig = {\n  /** Expected `iss` claim. */\n  issuer: string;\n  /** Expected `aud` claim. Omit to skip audience verification — for IdPs that\n   * don't bind an audience to their access tokens (e.g. Clerk). */\n  audience?: string;\n  /** Defaults to `${issuer}/.well-known/jwks.json`. */\n  jwksUri?: string;\n};\n\n/**\n * Claims a JWKS-verified token always carries into `extra`, whatever the IdP:\n * `subject` (the renamed `sub`) plus the registered claims that survive the\n * mapping. `client_id`, `scope` and `exp` do not appear here, since they become\n * `AuthInfo` fields instead. Intersected into every claim shape a JWKS verifier\n * resolves.\n *\n * @see https://datatracker.ietf.org/doc/html/rfc7519#section-4.1\n */\nexport type RegisteredClaims = {\n  /** The token's `sub`, renamed on the way into `extra`. */\n  subject?: string;\n  /** Issuer of the token. */\n  iss?: string;\n  /** Audience the token was minted for. */\n  aud?: string | string[];\n  /** Issued-at, in unix seconds. */\n  iat?: number;\n  /** Not-valid-before, in unix seconds. */\n  nbf?: number;\n  /** Unique token id. */\n  jti?: string;\n};\n\n/**\n * Builds a {@link TokenVerifier} that validates JWTs against a remote JWKS.\n *\n * `extra` receives the token's claims with `sub` renamed to `subject`, minus\n * `client_id`, `scope` and `exp`, which map onto `AuthInfo` fields instead. Pass\n * `TExtra` to declare what your IdP puts there; the branded providers do this\n * for you. {@link RegisteredClaims} is always included, since those claims\n * survive the mapping.\n *\n * @typeParam TExtra - Claims the verified token carries in `extra`. An\n * assertion, not a runtime check: nothing rejects a token whose claims differ.\n */\nexport function createJwksVerifier<TExtra extends ExtraClaims = ExtraClaims>(\n  config: JwksVerifyConfig,\n): TokenVerifier<TExtra & RegisteredClaims> {\n  if (!config.issuer) {\n    throw new Error(\"createJwksVerifier requires an `issuer`\");\n  }\n  const jwksUri =\n    config.jwksUri ??\n    `${config.issuer.replace(/\\/$/, \"\")}/.well-known/jwks.json`;\n  const jwks = jose.createRemoteJWKSet(new URL(jwksUri));\n\n  return {\n    async verifyAccessToken(\n      token: string,\n    ): Promise<AuthInfo<TExtra & RegisteredClaims>> {\n      let payload: jose.JWTPayload;\n      try {\n        ({ payload } = await jose.jwtVerify(token, jwks, {\n          issuer: config.issuer,\n          // jose skips the aud check when `audience` is undefined.\n          ...(config.audience !== undefined && { audience: config.audience }),\n        }));\n      } catch (err) {\n        const message = err instanceof Error ? err.message : String(err);\n        // This reaches the `error_description` of a `WWW-Authenticate`\n        // challenge, whose value must not include characters outside\n        // %x20-21 / %x23-5B / %x5D-7E (OAuth 2.1 §5.3.1, RFC 6750 §3). jose\n        // quotes claim names in its messages, and a quote would end the\n        // parameter early, dropping the `resource_metadata` that follows it.\n        // Each run becomes a space rather than being dropped, so removing one\n        // never runs two words together.\n        const safe = message\n          .replace(/[^\\x20-\\x21\\x23-\\x5B\\x5D-\\x7E]+/g, \" \")\n          .trim();\n        throw new InvalidTokenError(`Token verification failed: ${safe}`);\n      }\n\n      const { client_id, scope, exp, sub, ...rest } = payload as Record<\n        string,\n        unknown\n      > & {\n        client_id?: string;\n        scope?: string | string[];\n        exp?: number;\n        sub?: string;\n      };\n\n      const scopes = Array.isArray(scope)\n        ? scope.map(String)\n        : typeof scope === \"string\"\n          ? scope.split(/\\s+/).filter(Boolean)\n          : [];\n\n      return {\n        token,\n        clientId: client_id ?? \"\",\n        scopes,\n        expiresAt: exp,\n        extra: { subject: sub, ...rest } as unknown as TExtra &\n          RegisteredClaims,\n      };\n    },\n  };\n}\n"]}