strapi-oauth-mcp-manager 1.0.0 → 1.1.0

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## 1.1.0
+
+Customer sign-in with LINE, for apps that expose MCP tools to their own users.
+
+### Added
+
+- Token exchange (RFC 8693) at the token endpoint: a LINE client posts a customer's LINE ID token (`liff.getIDToken()`) and gets a short-lived MCP session. The session runs with the client's mapped admin token.
+- `resolveSubject(authorization)` on the `oauth` service. Tool plugins pass the `Authorization` header their handler received and get the customer's `line:U…` subject, or `null` when there's no verified customer (staff sessions, plain admin tokens and anything invalid). Call it only from MCP tool handlers: it identifies the customer but doesn't authenticate the request.
+- Configuration: `identityProviders.line.channelId` (digits only: the LINE Login channel ID, not the LIFF ID), the test-only `identityProviders.line.verifyUrl` (Strapi warns at startup while it's set), and `endUserAccessTokenTtl` (default 3600 seconds).
+- "Customer sign-in" when adding a client on the **MCP OAuth** page, a Customer column in the sessions list (masked), and token exchange details under Connection details.
+- Discovery lists the token exchange grant when LINE sign-in is configured.
+
+### Changed
+
+- New fields: `endUserProvider` on clients (existing clients are staff clients), and `subject` on grants.
+- LINE clients are always public, must keep a mapped admin token, and may have no redirect URI. Only one LINE client can be active at a time, and LINE clients can't use the consent page (`/authorize`).
+- Customer sessions have no refresh token. They expire after `endUserAccessTokenTtl`, and the app exchanges a fresh ID token.
+- Token exchange answers `invalid_grant` only when LINE rejects the ID token. When LINE can't be reached or the LINE client's admin token can't be used, it answers `temporarily_unavailable` (503) with `Retry-After`, and the Strapi log says why.
+
+### Breaking changes
+
+None. Staff sign-in, dynamic client registration, refresh rotation and revocation work as before.
+
 ## 1.0.0
 
 A rewrite that adds OAuth sign-in to the MCP server built into Strapi 5.47+ (`/mcp`).

package/README.md

@@ -174,6 +174,108 @@ These sign-in methods aren't supported:
 
 ---
 
+## Customer sign-in with LINE
+
+Staff connect with their Strapi admin account. Your **customers** can use MCP tools too, from an app inside LINE (a LIFF app or LINE MINI App). The app exchanges the customer's LINE ID token for a short-lived session, and your tools find out who the customer is.
+
+### Set it up
+
+1. **Configure the LINE channel** whose ID tokens you accept. That's the LINE Login or LINE MINI App channel that hosts your app. Use its channel ID (digits only, such as `1657000000`), not the LIFF ID.
+
+   ```ts
+   // config/plugins.ts
+   'strapi-oauth-mcp-manager': {
+     config: {
+       identityProviders: env('LINE_LOGIN_CHANNEL_ID')
+         ? { line: { channelId: env('LINE_LOGIN_CHANNEL_ID') } }
+         : {},
+       endUserAccessTokenTtl: 3600,
+     },
+   },
+   ```
+
+2. **Create an admin token for customers** under Settings → Admin Tokens. Every customer session runs with its permissions, so grant only what customers may do.
+
+   > **Content-type permissions aren't scoped to the customer.** The content tools Strapi generates (such as `list_article`) don't call `resolveSubject`, so any content-type permission on this token is available to every customer, unscoped. Grant only the tool-plugin actions customers need.
+
+3. **Add a client** on the **MCP OAuth** page. Choose **Customer sign-in: LINE** and map that token. LINE clients are public, and don't need a redirect URI.
+4. **Allow your app's origin** in `config/middlewares.ts`, because the app calls Strapi from the browser:
+
+   ```ts
+   {
+     name: 'strapi::cors',
+     config: {
+       origin: ['https://your-app.example.com'],
+       methods: ['GET', 'POST', 'DELETE', 'OPTIONS'],
+       headers: ['Content-Type', 'Authorization', 'Accept', 'mcp-session-id', 'mcp-protocol-version', 'Last-Event-ID'],
+       expose: ['WWW-Authenticate', 'mcp-session-id', 'mcp-protocol-version'],
+     },
+   },
+   ```
+
+### Exchange the ID token in your app
+
+The LIFF app needs the `openid` scope for `liff.getIDToken()`.
+
+```js
+async function startCustomerSession() {
+  await liff.init({ liffId });
+  if (!liff.isLoggedIn()) {
+    liff.login(); // LINE sends the customer back to your app, signed in
+    return null; // without this, the request below would send subject_token=null
+  }
+
+  const response = await fetch(`${STRAPI_URL}/api/strapi-oauth-mcp-manager/oauth/token`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body: new URLSearchParams({
+      grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange',
+      client_id: LINE_CLIENT_ID,
+      subject_token: liff.getIDToken(),
+      subject_token_type: 'urn:ietf:params:oauth:token-type:id_token',
+      resource: `${STRAPI_URL}/mcp`,
+    }),
+  });
+  const { access_token, expires_in } = await response.json();
+  // Call ${STRAPI_URL}/mcp with "Authorization: Bearer <access_token>". There is no refresh token:
+  // exchange a fresh ID token when the session expires.
+  return { access_token, expires_in };
+}
+```
+
+If the token endpoint answers `invalid_grant`, LINE rejected the ID token: sign the customer in again. If it answers `temporarily_unavailable` (HTTP 503), LINE couldn't be reached or the LINE client needs an admin's attention: try again after the `Retry-After` seconds. The Strapi log says which.
+
+### Use the customer's identity in your tools
+
+Tool handlers see the caller's original `Authorization` header, so ask this plugin who holds the session:
+
+```ts
+createHandler: (strapi) => async ({ args, extra }) => {
+  const subject = await strapi
+    .plugin('strapi-oauth-mcp-manager')
+    .service('oauth')
+    .resolveSubject(extra.requestInfo?.headers?.authorization); // "line:U…" or null
+  if (!subject) {
+    // No verified customer: a staff session, a plain admin token, or no valid session.
+  }
+  // ...scope the tool to this customer
+};
+```
+
+`resolveSubject` identifies the customer but doesn't authenticate the request, so call it only from MCP tool handlers, where the middleware has already validated the session. `null` means there's no verified customer, not that the caller is staff.
+
+Never take the customer from a tool argument or a custom header. A header set by a middleware doesn't reach tools, and one sent by the caller could be forged. The session token can't be.
+
+### Limits
+
+- **No rate limit on the token endpoint.** Put one in front of it (proxy or WAF) for public apps.
+- **A captured ID token can be exchanged until it expires,** like any bearer token. Sessions last at most `endUserAccessTokenTtl`.
+- **To end customer sessions,** deactivate or delete the LINE client, delete or regenerate its admin token, or revoke single sessions on the **MCP OAuth** page. Customer sessions have no "revoke every session approved by" button: their approver is the token's owner, so it would end every customer's session.
+- **`identityProviders.line.verifyUrl`** is only for tests and local development, for example with the mock server in this plugin's repository (`node test/e2e/mock-line-verify.mjs`; it isn't in the npm package). Strapi logs a warning at startup while it's set. Never set it in production.
+- **One LINE client can be active at a time.** Every LINE client accepts ID tokens from the one configured channel, so LINE clients are interchangeable: a customer could use any active one and get its admin token. The plugin refuses to create or re-activate a LINE client while another one is active. Deactivate or delete the other one first.
+
+---
+
 ## How it works
 
 ```mermaid
@@ -228,11 +330,18 @@ export default () => ({
       dynamicClientRegistration: true, // false = only clients added in the admin panel
       allowUserPermissions: false, // true = also offer "All of my permissions" on the consent page
       cleanupIntervalMs: 3600000, // how often expired data is removed; 0 turns it off
+      identityProviders: {}, // customer sign-in, off by default; e.g. { line: { channelId: '1657000000' } }
+      endUserAccessTokenTtl: 3600, // seconds a customer session lasts (there is no refresh token)
     },
   },
 });
 ```
 
+`identityProviders.line` turns on [customer sign-in with LINE](#customer-sign-in-with-line):
+
+- `channelId` (required): the channel ID of your LINE Login or LINE MINI App channel, digits only. Not the LIFF ID.
+- `verifyUrl` (tests only): where to verify ID tokens instead of LINE's endpoint, such as a local mock server. Strapi logs a warning at startup while it's set.
+
 The **MCP OAuth** admin page requires the **Manage MCP OAuth clients and grants** permission, on the **Plugins** tab of each role under **Settings → Administration Panel → Roles**. Super Admins have it by default.
 
 ---
@@ -262,6 +371,7 @@ The **MCP OAuth** admin page requires the **Manage MCP OAuth clients and grants*
 | Sign-in page links use `http://` or the wrong host | Set `url` in `config/server.ts`, or `proxy: true` behind a reverse proxy. |
 | "The redirect URI is not registered for this client" | For clients added in the admin panel, the redirect URI must match exactly. `*` matches any run of characters except `/`. |
 | A client suddenly gets `401` | Its session was revoked, its token was deleted or regenerated, or the user was deactivated. Reconnect. |
+| Customer sign-in answers `temporarily_unavailable` | The Strapi log says why: LINE couldn't be reached, or the LINE client needs a working admin token (the log names the client and the fix). |
 
 ---
 
@@ -289,6 +399,26 @@ End-to-end tests run against a development Strapi app that has the MCP server en
 BASE=http://localhost:1337 ADMIN_EMAIL=you@example.com ADMIN_PASSWORD=... npm run test:e2e
 ```
 
+The suites use the test app's Article type with the fields in `FIELDS` (default `title,body`); set `FIELDS=title,description`, for example, if your Article type has different fields. `SUBJECT` (default `api::article.article`) sets the content type those permissions are for.
+
+The LINE suite (`test/e2e/line-exchange.mjs`) starts a mock LINE verify server on port 4545, so keep that port free. It creates its own LINE client, so no other LINE client may be active in the test app. The test app needs customer sign-in pointed at the mock. Have its `config/plugins.ts` read two variables:
+
+```ts
+'strapi-oauth-mcp-manager': {
+  config: {
+    identityProviders: env('LINE_LOGIN_CHANNEL_ID')
+      ? { line: { channelId: env('LINE_LOGIN_CHANNEL_ID'), verifyUrl: env('LINE_VERIFY_URL') } }
+      : {},
+  },
+},
+```
+
+and start the app with them set:
+
+```bash
+LINE_LOGIN_CHANNEL_ID=1234567890 LINE_VERIFY_URL=http://localhost:4545/verify npm run develop
+```
+
 The tests sign in many times, so turn off the admin login rate limit in that app (`rateLimit: { enabled: false }` in `config/admin.ts`). They also create users, tokens and sessions and change the Editor and Author roles temporarily, so don't point them at production.
 
 ---

package/dist/_chunks/{App-Ddu3EpO8.mjs → App-BLcSXikb.mjs}

@@ -1,10 +1,10 @@
-import { jsx, jsxs } from "react/jsx-runtime";
+import { jsx, jsxs, Fragment } from "react/jsx-runtime";
 import { useFetchClient, useNotification, Page, Layouts, ConfirmDialog } from "@strapi/strapi/admin";
 import { Routes, Route } from "react-router-dom";
 import { useState, useCallback, useEffect } from "react";
-import { Alert, Button, Flex, Typography, EmptyStateLayout, Table, Thead, Tr, Th, Tbody, Td, Badge, IconButton, Box, Switch, Dialog, SingleSelect, SingleSelectOption, Modal, Field, TextInput, Textarea, Radio } from "@strapi/design-system";
+import { Alert, Button, Flex, Typography, EmptyStateLayout, Table, Thead, Tr, Th, Tbody, Td, Badge, IconButton, Box, Switch, Dialog, SingleSelect, SingleSelectOption, Modal, Field, TextInput, Radio, Textarea } from "@strapi/design-system";
 import { Trash, User, WarningCircle, Duplicate, Plus } from "@strapi/icons";
-import { P as PLUGIN_ID } from "./index-BrZfQfFg.mjs";
+import { P as PLUGIN_ID } from "./index-B36PlzpY.mjs";
 const PICK_ON_CONNECT = "pick";
 const formatDate = (value) => value ? new Date(value).toLocaleString() : "—";
 const Section = ({ title, subtitle, action, children }) => /* @__PURE__ */ jsxs(Box, { background: "neutral0", hasRadius: true, shadow: "tableShadow", padding: 6, children: [
@@ -41,18 +41,20 @@ const TokenSelect = ({
   value,
   current,
   onChange,
-  disabled
+  disabled,
+  allowPickOnConnect = true
 }) => {
   const ownsCurrent = current && tokens.some((t) => t.id === current.id);
   return /* @__PURE__ */ jsxs(
     SingleSelect,
     {
       "aria-label": "Admin token",
-      value,
+      placeholder: "Choose one of your admin tokens",
+      value: !allowPickOnConnect && value === PICK_ON_CONNECT ? null : value,
       disabled,
       onChange: (next) => onChange(String(next)),
       children: [
-        /* @__PURE__ */ jsx(SingleSelectOption, { value: PICK_ON_CONNECT, children: "Picked when connecting" }),
+        allowPickOnConnect && /* @__PURE__ */ jsx(SingleSelectOption, { value: PICK_ON_CONNECT, children: "Picked when connecting" }),
         current && !ownsCurrent && /* @__PURE__ */ jsx(SingleSelectOption, { value: String(current.id), disabled: true, children: current.missing ? "Deleted token" : `${current.name} (owned by ${current.ownerEmail ?? "another admin"})` }),
         tokens.map((token) => /* @__PURE__ */ jsx(SingleSelectOption, { value: String(token.id), children: token.name }, token.id))
       ]
@@ -67,6 +69,7 @@ const CreateClientModal = ({ onCreated, tokens }) => {
   const [redirectUris, setRedirectUris] = useState("");
   const [confidential, setConfidential] = useState("confidential");
   const [adminTokenId, setAdminTokenId] = useState(PICK_ON_CONNECT);
+  const [signIn, setSignIn] = useState("none");
   const [created, setCreated] = useState(null);
   const [submitting, setSubmitting] = useState(false);
   const reset = () => {
@@ -74,15 +77,18 @@ const CreateClientModal = ({ onCreated, tokens }) => {
     setRedirectUris("");
     setConfidential("confidential");
     setAdminTokenId(PICK_ON_CONNECT);
+    setSignIn("none");
     setCreated(null);
   };
   const submit = async () => {
     setSubmitting(true);
     try {
+      const line = signIn === "line";
       const { data } = await post(`/${PLUGIN_ID}/clients`, {
         name,
-        redirectUris: redirectUris.split("\n").map((uri) => uri.trim()).filter(Boolean),
-        confidential: confidential === "confidential",
+        endUserProvider: signIn,
+        redirectUris: line ? [] : redirectUris.split("\n").map((uri) => uri.trim()).filter(Boolean),
+        confidential: line ? false : confidential === "confidential",
         adminTokenId: adminTokenId === PICK_ON_CONNECT ? null : Number(adminTokenId)
       });
       setCreated(data.data);
@@ -110,12 +116,20 @@ const CreateClientModal = ({ onCreated, tokens }) => {
             /* @__PURE__ */ jsx(CopyValue, { label: "Client ID", value: created.clientId }),
             created.clientSecret && /* @__PURE__ */ jsx(CopyValue, { label: "Client secret", value: created.clientSecret })
           ] }) : /* @__PURE__ */ jsxs(Flex, { direction: "column", alignItems: "stretch", gap: 4, children: [
-            /* @__PURE__ */ jsx(Typography, { textColor: "neutral600", children: "Only needed for clients that ask for a client ID and secret, like ChatGPT connectors. Claude and most MCP clients register themselves automatically." }),
+            /* @__PURE__ */ jsx(Typography, { textColor: "neutral600", children: "Only needed for clients that ask for a client ID and secret, like ChatGPT connectors, or for a customer app that signs people in with LINE. Claude and most MCP clients register themselves automatically." }),
             /* @__PURE__ */ jsxs(Field.Root, { name: "name", required: true, children: [
               /* @__PURE__ */ jsx(Field.Label, { children: "Name" }),
-              /* @__PURE__ */ jsx(TextInput, { value: name, onChange: (e) => setName(e.target.value), placeholder: "ChatGPT" })
+              /* @__PURE__ */ jsx(TextInput, { value: name, onChange: (e) => setName(e.target.value), placeholder: signIn === "line" ? "Customer app" : "ChatGPT" })
             ] }),
-            /* @__PURE__ */ jsxs(Field.Root, { name: "redirectUris", required: true, hint: "One per line. * matches any run of characters except /.", children: [
+            /* @__PURE__ */ jsxs(Field.Root, { name: "signIn", hint: "LINE: customers sign in to your LINE app, which exchanges their LINE ID token for a session. No consent page is shown.", children: [
+              /* @__PURE__ */ jsx(Field.Label, { children: "Customer sign-in" }),
+              /* @__PURE__ */ jsxs(Radio.Group, { value: signIn, onValueChange: (value) => setSignIn(value), "aria-label": "Customer sign-in", children: [
+                /* @__PURE__ */ jsx(Radio.Item, { value: "none", children: "None: people connect with their Strapi admin account" }),
+                /* @__PURE__ */ jsx(Radio.Item, { value: "line", children: "LINE: customers sign in with LINE" })
+              ] }),
+              /* @__PURE__ */ jsx(Field.Hint, {})
+            ] }),
+            signIn === "none" && /* @__PURE__ */ jsxs(Field.Root, { name: "redirectUris", required: true, hint: "One per line. * matches any run of characters except /.", children: [
               /* @__PURE__ */ jsx(Field.Label, { children: "Redirect URIs" }),
               /* @__PURE__ */ jsx(
                 Textarea,
@@ -131,15 +145,16 @@ const CreateClientModal = ({ onCreated, tokens }) => {
               Field.Root,
               {
                 name: "adminToken",
-                hint: "Map one of your admin tokens so every connection uses it. Only you can then approve this client. Leave it to let each person pick one of their own tokens.",
+                required: signIn === "line",
+                hint: signIn === "line" ? "Required. Every customer session runs with this token's permissions, so grant it only what customers need." : "Map one of your admin tokens so every connection uses it. Only you can then approve this client. Leave it to let each person pick one of their own tokens.",
                 children: [
                   /* @__PURE__ */ jsx(Field.Label, { children: "Admin token" }),
-                  /* @__PURE__ */ jsx(TokenSelect, { tokens, value: adminTokenId, onChange: setAdminTokenId }),
+                  /* @__PURE__ */ jsx(TokenSelect, { tokens, value: adminTokenId, onChange: setAdminTokenId, allowPickOnConnect: signIn === "none" }),
                   /* @__PURE__ */ jsx(Field.Hint, {})
                 ]
               }
             ),
-            /* @__PURE__ */ jsxs(Field.Root, { name: "type", children: [
+            signIn === "none" && /* @__PURE__ */ jsxs(Field.Root, { name: "type", children: [
               /* @__PURE__ */ jsx(Field.Label, { children: "Client type" }),
               /* @__PURE__ */ jsxs(Radio.Group, { value: confidential, onValueChange: setConfidential, "aria-label": "Client type", children: [
                 /* @__PURE__ */ jsx(Radio.Item, { value: "confidential", children: "Confidential (client ID + secret)" }),
@@ -149,7 +164,7 @@ const CreateClientModal = ({ onCreated, tokens }) => {
           ] }) }),
           /* @__PURE__ */ jsxs(Modal.Footer, { children: [
             /* @__PURE__ */ jsx(Modal.Close, { children: /* @__PURE__ */ jsx(Button, { variant: "tertiary", children: created ? "Done" : "Cancel" }) }),
-            !created && /* @__PURE__ */ jsx(Button, { onClick: submit, loading: submitting, disabled: !name.trim() || !redirectUris.trim(), children: "Create" })
+            !created && /* @__PURE__ */ jsx(Button, { onClick: submit, loading: submitting, disabled: !name.trim() || (signIn === "line" ? adminTokenId === PICK_ON_CONNECT : !redirectUris.trim()), children: "Create" })
           ] })
         ] })
       ]
@@ -243,7 +258,16 @@ const HomePage = () => {
         /* @__PURE__ */ jsx(CopyValue, { label: "Authorization server metadata", value: overview.endpoints.authorizationServerMetadata }),
         /* @__PURE__ */ jsx(CopyValue, { label: "Authorization endpoint", value: overview.endpoints.authorization }),
         /* @__PURE__ */ jsx(CopyValue, { label: "Token endpoint", value: overview.endpoints.token }),
-        /* @__PURE__ */ jsxs(Typography, { variant: "pi", textColor: "neutral600", children: [
+        overview.lineSignIn.configured ? /* @__PURE__ */ jsxs(Fragment, { children: [
+          /* @__PURE__ */ jsx(CopyValue, { label: "Token exchange grant type", value: overview.tokenExchange.grantType }),
+          /* @__PURE__ */ jsx(CopyValue, { label: "Subject token type (LINE ID token)", value: overview.tokenExchange.subjectTokenType }),
+          /* @__PURE__ */ jsxs(Typography, { tag: "p", variant: "pi", textColor: "neutral600", children: [
+            "LINE sign-in is on for channel ",
+            overview.lineSignIn.channelId,
+            ". Customer apps post liff.getIDToken() to the token endpoint with a LINE client's ID."
+          ] })
+        ] }) : clients.some((client) => client.endUserProvider === "line") && /* @__PURE__ */ jsx(Alert, { variant: "warning", title: "LINE sign-in is off", closeLabel: "Close", children: "A LINE client exists, but identityProviders.line.channelId isn't set in this plugin's config." }),
+        /* @__PURE__ */ jsxs(Typography, { tag: "p", variant: "pi", textColor: "neutral600", children: [
           "Dynamic client registration is ",
           overview.dynamicClientRegistration ? "on" : "off",
           "."
@@ -254,9 +278,10 @@ const HomePage = () => {
         {
           title: "Connected sessions",
           subtitle: "Each session uses an admin token owned by the person who approved it. Deactivating that person, or deleting or regenerating the token in Settings → Admin Tokens, also ends the session.",
-          children: grants.length === 0 ? /* @__PURE__ */ jsx(EmptyStateLayout, { content: "No MCP clients are connected yet." }) : /* @__PURE__ */ jsxs(Table, { colCount: 6, rowCount: grants.length + 1, children: [
+          children: grants.length === 0 ? /* @__PURE__ */ jsx(EmptyStateLayout, { content: "No MCP clients are connected yet." }) : /* @__PURE__ */ jsxs(Table, { colCount: 7, rowCount: grants.length + 1, children: [
             /* @__PURE__ */ jsx(Thead, { children: /* @__PURE__ */ jsxs(Tr, { children: [
               /* @__PURE__ */ jsx(Th, { children: /* @__PURE__ */ jsx(Typography, { variant: "sigma", children: "Client" }) }),
+              /* @__PURE__ */ jsx(Th, { children: /* @__PURE__ */ jsx(Typography, { variant: "sigma", children: "Customer" }) }),
               /* @__PURE__ */ jsx(Th, { children: /* @__PURE__ */ jsx(Typography, { variant: "sigma", children: "Approved by" }) }),
               /* @__PURE__ */ jsx(Th, { children: /* @__PURE__ */ jsx(Typography, { variant: "sigma", children: "Access" }) }),
               /* @__PURE__ */ jsx(Th, { children: /* @__PURE__ */ jsx(Typography, { variant: "sigma", children: "Last used" }) }),
@@ -265,6 +290,7 @@ const HomePage = () => {
             ] }) }),
             /* @__PURE__ */ jsx(Tbody, { children: grants.map((grant) => /* @__PURE__ */ jsxs(Tr, { children: [
               /* @__PURE__ */ jsx(Td, { children: /* @__PURE__ */ jsx(Typography, { fontWeight: "semiBold", children: grant.clientName }) }),
+              /* @__PURE__ */ jsx(Td, { children: /* @__PURE__ */ jsx(Typography, { children: grant.subject ?? "—" }) }),
               /* @__PURE__ */ jsx(Td, { children: /* @__PURE__ */ jsxs(Flex, { gap: 2, children: [
                 /* @__PURE__ */ jsx(Typography, { children: grant.userEmail ?? "—" }),
                 !grant.userActive && /* @__PURE__ */ jsx(Badge, { variant: "danger", children: "Inactive" })
@@ -282,7 +308,7 @@ const HomePage = () => {
                     children: /* @__PURE__ */ jsx(Trash, {})
                   }
                 ),
-                /* @__PURE__ */ jsx(
+                !grant.subject && /* @__PURE__ */ jsx(
                   IconButton,
                   {
                     label: `Revoke every session approved by ${grant.userEmail ?? "this user"}`,
@@ -323,15 +349,17 @@ const HomePage = () => {
               ] }) }),
               /* @__PURE__ */ jsx(Td, { children: /* @__PURE__ */ jsxs(Flex, { gap: 1, children: [
                 /* @__PURE__ */ jsx(Badge, { variant: client.registrationType === "dynamic" ? "secondary" : "primary", children: client.registrationType === "dynamic" ? "Self-registered" : "Manual" }),
-                /* @__PURE__ */ jsx(Badge, { children: client.tokenEndpointAuthMethod === "none" ? "Public" : "Confidential" })
+                /* @__PURE__ */ jsx(Badge, { children: client.tokenEndpointAuthMethod === "none" ? "Public" : "Confidential" }),
+                client.endUserProvider === "line" && /* @__PURE__ */ jsx(Badge, { variant: "success", children: "LINE sign-in" })
               ] }) }),
-              /* @__PURE__ */ jsx(Td, { children: /* @__PURE__ */ jsx(Typography, { variant: "pi", style: { wordBreak: "break-all" }, children: client.redirectUris.join(", ") }) }),
+              /* @__PURE__ */ jsx(Td, { children: /* @__PURE__ */ jsx(Typography, { variant: "pi", style: { wordBreak: "break-all" }, children: client.redirectUris.length ? client.redirectUris.join(", ") : "—" }) }),
               /* @__PURE__ */ jsx(Td, { children: /* @__PURE__ */ jsx(Box, { minWidth: "220px", children: /* @__PURE__ */ jsx(
                 TokenSelect,
                 {
                   tokens,
                   current: client.adminToken,
                   value: client.adminToken ? String(client.adminToken.id) : PICK_ON_CONNECT,
+                  allowPickOnConnect: client.endUserProvider !== "line",
                   onChange: (next) => run(
                     () => put(`/${PLUGIN_ID}/clients/${client.id}`, {
                       adminTokenId: next === PICK_ON_CONNECT ? null : Number(next)

package/dist/_chunks/{App-WKeHpRl7.js → App-CxPrn10p.js}

@@ -6,7 +6,7 @@ const reactRouterDom = require("react-router-dom");
 const react = require("react");
 const designSystem = require("@strapi/design-system");
 const icons = require("@strapi/icons");
-const index = require("./index-BPOlIxN_.js");
+const index = require("./index-dzfso1OG.js");
 const PICK_ON_CONNECT = "pick";
 const formatDate = (value) => value ? new Date(value).toLocaleString() : "—";
 const Section = ({ title, subtitle, action, children }) => /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Box, { background: "neutral0", hasRadius: true, shadow: "tableShadow", padding: 6, children: [
@@ -43,18 +43,20 @@ const TokenSelect = ({
   value,
   current,
   onChange,
-  disabled
+  disabled,
+  allowPickOnConnect = true
 }) => {
   const ownsCurrent = current && tokens.some((t) => t.id === current.id);
   return /* @__PURE__ */ jsxRuntime.jsxs(
     designSystem.SingleSelect,
     {
       "aria-label": "Admin token",
-      value,
+      placeholder: "Choose one of your admin tokens",
+      value: !allowPickOnConnect && value === PICK_ON_CONNECT ? null : value,
       disabled,
       onChange: (next) => onChange(String(next)),
       children: [
-        /* @__PURE__ */ jsxRuntime.jsx(designSystem.SingleSelectOption, { value: PICK_ON_CONNECT, children: "Picked when connecting" }),
+        allowPickOnConnect && /* @__PURE__ */ jsxRuntime.jsx(designSystem.SingleSelectOption, { value: PICK_ON_CONNECT, children: "Picked when connecting" }),
         current && !ownsCurrent && /* @__PURE__ */ jsxRuntime.jsx(designSystem.SingleSelectOption, { value: String(current.id), disabled: true, children: current.missing ? "Deleted token" : `${current.name} (owned by ${current.ownerEmail ?? "another admin"})` }),
         tokens.map((token) => /* @__PURE__ */ jsxRuntime.jsx(designSystem.SingleSelectOption, { value: String(token.id), children: token.name }, token.id))
       ]
@@ -69,6 +71,7 @@ const CreateClientModal = ({ onCreated, tokens }) => {
   const [redirectUris, setRedirectUris] = react.useState("");
   const [confidential, setConfidential] = react.useState("confidential");
   const [adminTokenId, setAdminTokenId] = react.useState(PICK_ON_CONNECT);
+  const [signIn, setSignIn] = react.useState("none");
   const [created, setCreated] = react.useState(null);
   const [submitting, setSubmitting] = react.useState(false);
   const reset = () => {
@@ -76,15 +79,18 @@ const CreateClientModal = ({ onCreated, tokens }) => {
     setRedirectUris("");
     setConfidential("confidential");
     setAdminTokenId(PICK_ON_CONNECT);
+    setSignIn("none");
     setCreated(null);
   };
   const submit = async () => {
     setSubmitting(true);
     try {
+      const line = signIn === "line";
       const { data } = await post(`/${index.PLUGIN_ID}/clients`, {
         name,
-        redirectUris: redirectUris.split("\n").map((uri) => uri.trim()).filter(Boolean),
-        confidential: confidential === "confidential",
+        endUserProvider: signIn,
+        redirectUris: line ? [] : redirectUris.split("\n").map((uri) => uri.trim()).filter(Boolean),
+        confidential: line ? false : confidential === "confidential",
         adminTokenId: adminTokenId === PICK_ON_CONNECT ? null : Number(adminTokenId)
       });
       setCreated(data.data);
@@ -112,12 +118,20 @@ const CreateClientModal = ({ onCreated, tokens }) => {
             /* @__PURE__ */ jsxRuntime.jsx(CopyValue, { label: "Client ID", value: created.clientId }),
             created.clientSecret && /* @__PURE__ */ jsxRuntime.jsx(CopyValue, { label: "Client secret", value: created.clientSecret })
           ] }) : /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { direction: "column", alignItems: "stretch", gap: 4, children: [
-            /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { textColor: "neutral600", children: "Only needed for clients that ask for a client ID and secret, like ChatGPT connectors. Claude and most MCP clients register themselves automatically." }),
+            /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { textColor: "neutral600", children: "Only needed for clients that ask for a client ID and secret, like ChatGPT connectors, or for a customer app that signs people in with LINE. Claude and most MCP clients register themselves automatically." }),
             /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Field.Root, { name: "name", required: true, children: [
               /* @__PURE__ */ jsxRuntime.jsx(designSystem.Field.Label, { children: "Name" }),
-              /* @__PURE__ */ jsxRuntime.jsx(designSystem.TextInput, { value: name, onChange: (e) => setName(e.target.value), placeholder: "ChatGPT" })
+              /* @__PURE__ */ jsxRuntime.jsx(designSystem.TextInput, { value: name, onChange: (e) => setName(e.target.value), placeholder: signIn === "line" ? "Customer app" : "ChatGPT" })
             ] }),
-            /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Field.Root, { name: "redirectUris", required: true, hint: "One per line. * matches any run of characters except /.", children: [
+            /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Field.Root, { name: "signIn", hint: "LINE: customers sign in to your LINE app, which exchanges their LINE ID token for a session. No consent page is shown.", children: [
+              /* @__PURE__ */ jsxRuntime.jsx(designSystem.Field.Label, { children: "Customer sign-in" }),
+              /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Radio.Group, { value: signIn, onValueChange: (value) => setSignIn(value), "aria-label": "Customer sign-in", children: [
+                /* @__PURE__ */ jsxRuntime.jsx(designSystem.Radio.Item, { value: "none", children: "None: people connect with their Strapi admin account" }),
+                /* @__PURE__ */ jsxRuntime.jsx(designSystem.Radio.Item, { value: "line", children: "LINE: customers sign in with LINE" })
+              ] }),
+              /* @__PURE__ */ jsxRuntime.jsx(designSystem.Field.Hint, {})
+            ] }),
+            signIn === "none" && /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Field.Root, { name: "redirectUris", required: true, hint: "One per line. * matches any run of characters except /.", children: [
               /* @__PURE__ */ jsxRuntime.jsx(designSystem.Field.Label, { children: "Redirect URIs" }),
               /* @__PURE__ */ jsxRuntime.jsx(
                 designSystem.Textarea,
@@ -133,15 +147,16 @@ const CreateClientModal = ({ onCreated, tokens }) => {
               designSystem.Field.Root,
               {
                 name: "adminToken",
-                hint: "Map one of your admin tokens so every connection uses it. Only you can then approve this client. Leave it to let each person pick one of their own tokens.",
+                required: signIn === "line",
+                hint: signIn === "line" ? "Required. Every customer session runs with this token's permissions, so grant it only what customers need." : "Map one of your admin tokens so every connection uses it. Only you can then approve this client. Leave it to let each person pick one of their own tokens.",
                 children: [
                   /* @__PURE__ */ jsxRuntime.jsx(designSystem.Field.Label, { children: "Admin token" }),
-                  /* @__PURE__ */ jsxRuntime.jsx(TokenSelect, { tokens, value: adminTokenId, onChange: setAdminTokenId }),
+                  /* @__PURE__ */ jsxRuntime.jsx(TokenSelect, { tokens, value: adminTokenId, onChange: setAdminTokenId, allowPickOnConnect: signIn === "none" }),
                   /* @__PURE__ */ jsxRuntime.jsx(designSystem.Field.Hint, {})
                 ]
               }
             ),
-            /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Field.Root, { name: "type", children: [
+            signIn === "none" && /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Field.Root, { name: "type", children: [
               /* @__PURE__ */ jsxRuntime.jsx(designSystem.Field.Label, { children: "Client type" }),
               /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Radio.Group, { value: confidential, onValueChange: setConfidential, "aria-label": "Client type", children: [
                 /* @__PURE__ */ jsxRuntime.jsx(designSystem.Radio.Item, { value: "confidential", children: "Confidential (client ID + secret)" }),
@@ -151,7 +166,7 @@ const CreateClientModal = ({ onCreated, tokens }) => {
           ] }) }),
           /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Modal.Footer, { children: [
             /* @__PURE__ */ jsxRuntime.jsx(designSystem.Modal.Close, { children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Button, { variant: "tertiary", children: created ? "Done" : "Cancel" }) }),
-            !created && /* @__PURE__ */ jsxRuntime.jsx(designSystem.Button, { onClick: submit, loading: submitting, disabled: !name.trim() || !redirectUris.trim(), children: "Create" })
+            !created && /* @__PURE__ */ jsxRuntime.jsx(designSystem.Button, { onClick: submit, loading: submitting, disabled: !name.trim() || (signIn === "line" ? adminTokenId === PICK_ON_CONNECT : !redirectUris.trim()), children: "Create" })
           ] })
         ] })
       ]
@@ -245,7 +260,16 @@ const HomePage = () => {
         /* @__PURE__ */ jsxRuntime.jsx(CopyValue, { label: "Authorization server metadata", value: overview.endpoints.authorizationServerMetadata }),
         /* @__PURE__ */ jsxRuntime.jsx(CopyValue, { label: "Authorization endpoint", value: overview.endpoints.authorization }),
         /* @__PURE__ */ jsxRuntime.jsx(CopyValue, { label: "Token endpoint", value: overview.endpoints.token }),
-        /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Typography, { variant: "pi", textColor: "neutral600", children: [
+        overview.lineSignIn.configured ? /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
+          /* @__PURE__ */ jsxRuntime.jsx(CopyValue, { label: "Token exchange grant type", value: overview.tokenExchange.grantType }),
+          /* @__PURE__ */ jsxRuntime.jsx(CopyValue, { label: "Subject token type (LINE ID token)", value: overview.tokenExchange.subjectTokenType }),
+          /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Typography, { tag: "p", variant: "pi", textColor: "neutral600", children: [
+            "LINE sign-in is on for channel ",
+            overview.lineSignIn.channelId,
+            ". Customer apps post liff.getIDToken() to the token endpoint with a LINE client's ID."
+          ] })
+        ] }) : clients.some((client) => client.endUserProvider === "line") && /* @__PURE__ */ jsxRuntime.jsx(designSystem.Alert, { variant: "warning", title: "LINE sign-in is off", closeLabel: "Close", children: "A LINE client exists, but identityProviders.line.channelId isn't set in this plugin's config." }),
+        /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Typography, { tag: "p", variant: "pi", textColor: "neutral600", children: [
           "Dynamic client registration is ",
           overview.dynamicClientRegistration ? "on" : "off",
           "."
@@ -256,9 +280,10 @@ const HomePage = () => {
         {
           title: "Connected sessions",
           subtitle: "Each session uses an admin token owned by the person who approved it. Deactivating that person, or deleting or regenerating the token in Settings → Admin Tokens, also ends the session.",
-          children: grants.length === 0 ? /* @__PURE__ */ jsxRuntime.jsx(designSystem.EmptyStateLayout, { content: "No MCP clients are connected yet." }) : /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Table, { colCount: 6, rowCount: grants.length + 1, children: [
+          children: grants.length === 0 ? /* @__PURE__ */ jsxRuntime.jsx(designSystem.EmptyStateLayout, { content: "No MCP clients are connected yet." }) : /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Table, { colCount: 7, rowCount: grants.length + 1, children: [
             /* @__PURE__ */ jsxRuntime.jsx(designSystem.Thead, { children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Tr, { children: [
               /* @__PURE__ */ jsxRuntime.jsx(designSystem.Th, { children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "sigma", children: "Client" }) }),
+              /* @__PURE__ */ jsxRuntime.jsx(designSystem.Th, { children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "sigma", children: "Customer" }) }),
               /* @__PURE__ */ jsxRuntime.jsx(designSystem.Th, { children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "sigma", children: "Approved by" }) }),
               /* @__PURE__ */ jsxRuntime.jsx(designSystem.Th, { children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "sigma", children: "Access" }) }),
               /* @__PURE__ */ jsxRuntime.jsx(designSystem.Th, { children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "sigma", children: "Last used" }) }),
@@ -267,6 +292,7 @@ const HomePage = () => {
             ] }) }),
             /* @__PURE__ */ jsxRuntime.jsx(designSystem.Tbody, { children: grants.map((grant) => /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Tr, { children: [
               /* @__PURE__ */ jsxRuntime.jsx(designSystem.Td, { children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { fontWeight: "semiBold", children: grant.clientName }) }),
+              /* @__PURE__ */ jsxRuntime.jsx(designSystem.Td, { children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { children: grant.subject ?? "—" }) }),
               /* @__PURE__ */ jsxRuntime.jsx(designSystem.Td, { children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { gap: 2, children: [
                 /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { children: grant.userEmail ?? "—" }),
                 !grant.userActive && /* @__PURE__ */ jsxRuntime.jsx(designSystem.Badge, { variant: "danger", children: "Inactive" })
@@ -284,7 +310,7 @@ const HomePage = () => {
                     children: /* @__PURE__ */ jsxRuntime.jsx(icons.Trash, {})
                   }
                 ),
-                /* @__PURE__ */ jsxRuntime.jsx(
+                !grant.subject && /* @__PURE__ */ jsxRuntime.jsx(
                   designSystem.IconButton,
                   {
                     label: `Revoke every session approved by ${grant.userEmail ?? "this user"}`,
@@ -325,15 +351,17 @@ const HomePage = () => {
               ] }) }),
               /* @__PURE__ */ jsxRuntime.jsx(designSystem.Td, { children: /* @__PURE__ */ jsxRuntime.jsxs(designSystem.Flex, { gap: 1, children: [
                 /* @__PURE__ */ jsxRuntime.jsx(designSystem.Badge, { variant: client.registrationType === "dynamic" ? "secondary" : "primary", children: client.registrationType === "dynamic" ? "Self-registered" : "Manual" }),
-                /* @__PURE__ */ jsxRuntime.jsx(designSystem.Badge, { children: client.tokenEndpointAuthMethod === "none" ? "Public" : "Confidential" })
+                /* @__PURE__ */ jsxRuntime.jsx(designSystem.Badge, { children: client.tokenEndpointAuthMethod === "none" ? "Public" : "Confidential" }),
+                client.endUserProvider === "line" && /* @__PURE__ */ jsxRuntime.jsx(designSystem.Badge, { variant: "success", children: "LINE sign-in" })
               ] }) }),
-              /* @__PURE__ */ jsxRuntime.jsx(designSystem.Td, { children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", style: { wordBreak: "break-all" }, children: client.redirectUris.join(", ") }) }),
+              /* @__PURE__ */ jsxRuntime.jsx(designSystem.Td, { children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Typography, { variant: "pi", style: { wordBreak: "break-all" }, children: client.redirectUris.length ? client.redirectUris.join(", ") : "—" }) }),
               /* @__PURE__ */ jsxRuntime.jsx(designSystem.Td, { children: /* @__PURE__ */ jsxRuntime.jsx(designSystem.Box, { minWidth: "220px", children: /* @__PURE__ */ jsxRuntime.jsx(
                 TokenSelect,
                 {
                   tokens,
                   current: client.adminToken,
                   value: client.adminToken ? String(client.adminToken.id) : PICK_ON_CONNECT,
+                  allowPickOnConnect: client.endUserProvider !== "line",
                   onChange: (next) => run(
                     () => put(`/${index.PLUGIN_ID}/clients/${client.id}`, {
                       adminTokenId: next === PICK_ON_CONNECT ? null : Number(next)

package/dist/_chunks/{index-BrZfQfFg.mjs → index-B36PlzpY.mjs}

@@ -37,7 +37,7 @@ const index = {
       },
       permissions: [{ action: `plugin::${PLUGIN_ID}.manage`, subject: null }],
       Component: async () => {
-        const { App } = await import("./App-Ddu3EpO8.mjs");
+        const { App } = await import("./App-BLcSXikb.mjs");
         return App;
       }
     });

package/dist/_chunks/{index-BPOlIxN_.js → index-dzfso1OG.js}

@@ -38,7 +38,7 @@ const index = {
       },
       permissions: [{ action: `plugin::${PLUGIN_ID}.manage`, subject: null }],
       Component: async () => {
-        const { App } = await Promise.resolve().then(() => require("./App-WKeHpRl7.js"));
+        const { App } = await Promise.resolve().then(() => require("./App-CxPrn10p.js"));
         return App;
       }
     });

package/dist/admin/index.js

@@ -1,3 +1,3 @@
 "use strict";
-const index = require("../_chunks/index-BPOlIxN_.js");
+const index = require("../_chunks/index-dzfso1OG.js");
 module.exports = index.index;

package/dist/admin/index.mjs

@@ -1,4 +1,4 @@
-import { i } from "../_chunks/index-BrZfQfFg.mjs";
+import { i } from "../_chunks/index-B36PlzpY.mjs";
 export {
   i as default
 };