tiny-http-mcp-server 0.1.25 → 0.1.27

package/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -7,6 +7,7 @@ import { createAuthorizationState } from "./authorization-state.js";
 import { generateCodeChallenge, generateCodeVerifier } from "./pkce.js";
 import { exchangeAuthorizationCode, OAuthError, refreshAccessToken, isRetryableOAuthError, readOAuthJsonObjectResponse } from "./token-endpoint.js";
 import { canonicalizeResourceIndicator } from "../resource-indicator.js";
+import { withOAuthSessionTransaction } from "./session-transaction.js";
 const MAX_JS_DATE_MS = 8_640_000_000_000_000;
 export function createOAuthClientProvider(options) {
     if (isProviderOptions(options)) {
@@ -20,8 +21,6 @@ export function createDefaultOAuthClientProvider(options) {
     const clientStore = options.authStore === undefined ? null : createAuthStoreClientStore(options.authStore);
     const now = options.now ?? Date.now;
     const registeredClients = new Map();
-    const refreshPromises = new Map();
-    const authorizationPromises = new Map();
     if (options.initialGrant !== undefined) {
         let resource;
         try {
@@ -115,205 +114,183 @@ export function createDefaultOAuthClientProvider(options) {
     async function ensureAuthorizedSession(resource, discovery, fetch, allowInteractive, forceRefresh = false, signal, rejectedTokens) {
         signal?.throwIfAborted();
         const canonicalResource = canonicalizeResourceIndicator(resource);
-        let session = await loadSession(canonicalResource);
-        if (session !== null && initialGrant?.resource === canonicalResource)
-            initialGrantConsumed = true;
-        signal?.throwIfAborted();
-        if (discovery !== undefined && getOwnString(discovery.authorizationServerMetadata, "issuer") !== discovery.authorizationServer) {
-            throw new Error("OAuth discovery authorization-server issuer mismatch");
-        }
-        if (session !== null && (canonicalizeResourceIndicator(session.resource) !== canonicalResource
-            || getOwnString(session.discovery.authorizationServerMetadata, "issuer") !== session.authorizationServer
-            || (discovery !== undefined && discovery.authorizationServer !== session.authorizationServer))) {
-            await clearSession(canonicalResource);
-            session = null;
-        }
-        if (session === null && discovery !== undefined && !initialGrantConsumed && initialGrant?.resource === canonicalResource &&
-            initialGrant.tokens !== undefined && initialGrant.client !== null) {
-            assertSecureOAuthFlowEndpoints(discovery.authorizationServerMetadata);
-            session = { resource: canonicalResource, authorizationServer: discovery.authorizationServer,
-                client: initialGrant.client, tokens: initialGrant.tokens, discovery: toStoredDiscovery(discovery) };
-            await saveSession(canonicalResource, session);
-            initialGrantConsumed = true;
+        return withOAuthSessionTransaction(sessionStore, canonicalResource, async () => {
+            let session = await loadSession(canonicalResource);
+            if (session !== null && initialGrant?.resource === canonicalResource)
+                initialGrantConsumed = true;
             signal?.throwIfAborted();
-        }
-        if (forceRefresh && rejectedTokens !== undefined && (rejectedTokens === null || session?.tokens === undefined || !sameTokenGrant(session.tokens, rejectedTokens)))
-            forceRefresh = false;
-        const sessionDiscovery = resolveDiscovery(discovery, session);
-        if (session?.tokens !== undefined && !forceRefresh && !isExpired(session.tokens, now)) {
-            return session;
-        }
-        if (session?.tokens?.refreshToken !== undefined &&
-            sessionDiscovery !== undefined &&
-            (forceRefresh || isExpired(session.tokens, now))) {
-            session = await refreshSession(canonicalResource, session, sessionDiscovery, fetch, signal);
-            if (session?.tokens !== undefined && !isExpired(session.tokens, now)) {
+            if (discovery !== undefined && getOwnString(discovery.authorizationServerMetadata, "issuer") !== discovery.authorizationServer) {
+                throw new Error("OAuth discovery authorization-server issuer mismatch");
+            }
+            if (session !== null && (canonicalizeResourceIndicator(session.resource) !== canonicalResource
+                || getOwnString(session.discovery.authorizationServerMetadata, "issuer") !== session.authorizationServer
+                || (discovery !== undefined && discovery.authorizationServer !== session.authorizationServer))) {
+                await clearSession(canonicalResource);
+                session = null;
+            }
+            if (session === null && discovery !== undefined && !initialGrantConsumed && initialGrant?.resource === canonicalResource &&
+                initialGrant.tokens !== undefined && initialGrant.client !== null) {
+                assertSecureOAuthFlowEndpoints(discovery.authorizationServerMetadata);
+                session = { resource: canonicalResource, authorizationServer: discovery.authorizationServer,
+                    client: initialGrant.client, tokens: initialGrant.tokens, discovery: toStoredDiscovery(discovery) };
+                await saveSession(canonicalResource, session);
+                initialGrantConsumed = true;
+                signal?.throwIfAborted();
+            }
+            if (forceRefresh && rejectedTokens !== undefined && (rejectedTokens === null || session?.tokens === undefined || !sameTokenGrant(session.tokens, rejectedTokens)))
+                forceRefresh = false;
+            const sessionDiscovery = resolveDiscovery(discovery, session);
+            if (session?.tokens !== undefined && !forceRefresh && !isExpired(session.tokens, now)) {
                 return session;
             }
-        }
-        if (forceRefresh && session?.tokens !== undefined) {
-            session = clearSessionTokens(session);
-            await saveSession(canonicalResource, session);
-        }
-        if (!allowInteractive || sessionDiscovery === undefined) {
-            return session;
-        }
-        if (options.allowInteractive === false)
-            throw new Error("OAuth interactive authorization is disabled");
-        return authorizeSession(canonicalResource, session, sessionDiscovery, fetch, signal);
+            if (session?.tokens?.refreshToken !== undefined &&
+                sessionDiscovery !== undefined &&
+                (forceRefresh || isExpired(session.tokens, now))) {
+                session = await refreshSession(canonicalResource, session, sessionDiscovery, fetch, signal);
+                if (session?.tokens !== undefined && !isExpired(session.tokens, now)) {
+                    return session;
+                }
+            }
+            if (forceRefresh && session?.tokens !== undefined) {
+                session = clearSessionTokens(session);
+                await saveSession(canonicalResource, session);
+            }
+            if (!allowInteractive || sessionDiscovery === undefined) {
+                return session;
+            }
+            if (options.allowInteractive === false)
+                throw new Error("OAuth interactive authorization is disabled");
+            return authorizeSession(canonicalResource, session, sessionDiscovery, fetch, signal);
+        }, { signal, timeoutMs: options.sessionLockTimeoutMs });
     }
     async function refreshSession(resource, session, discovery, fetch, signal) {
         signal?.throwIfAborted();
         assertSecureOAuthFlowEndpoints(discovery.authorizationServerMetadata);
-        const inFlight = refreshPromises.get(resource);
-        if (inFlight !== undefined) {
-            return inFlight;
+        if (session.tokens?.refreshToken === undefined) {
+            return session;
         }
-        const promise = (async () => {
+        let refreshAttempted = false;
+        let refreshedTokens;
+        while (true) {
             try {
-                if (session.tokens?.refreshToken === undefined) {
-                    return session;
+                refreshedTokens = await refreshAccessToken({
+                    tokenEndpoint: requireOwnString(discovery.authorizationServerMetadata, "token_endpoint", "Authorization server metadata"),
+                    clientId: session.client.clientId,
+                    clientSecret: session.client.clientSecret,
+                    refreshToken: session.tokens.refreshToken,
+                    resource,
+                    fetch, signal,
+                    now
+                });
+                break;
+            }
+            catch (error) {
+                signal?.throwIfAborted();
+                if (error instanceof OAuthError && error.error === "invalid_grant") {
+                    const clearedSession = clearSessionTokens(session);
+                    await saveSession(resource, clearedSession);
+                    return clearedSession;
                 }
-                let refreshAttempted = false;
-                let refreshedTokens;
-                while (true) {
-                    try {
-                        refreshedTokens = await refreshAccessToken({
-                            tokenEndpoint: requireOwnString(discovery.authorizationServerMetadata, "token_endpoint", "Authorization server metadata"),
-                            clientId: session.client.clientId,
-                            clientSecret: session.client.clientSecret,
-                            refreshToken: session.tokens.refreshToken,
-                            resource,
-                            fetch, signal,
-                            now
-                        });
-                        break;
-                    }
-                    catch (error) {
-                        signal?.throwIfAborted();
-                        if (error instanceof OAuthError && error.error === "invalid_grant") {
-                            const clearedSession = clearSessionTokens(session);
-                            await saveSession(resource, clearedSession);
-                            return clearedSession;
-                        }
-                        if (shouldReRegisterStoredDynamicClient(error, await loadRegisteredClient(discovery.authorizationServer), false)) {
-                            await clearRegisteredClient(discovery.authorizationServer);
-                            await clearSession(resource);
-                            return null;
-                        }
-                        if (!refreshAttempted && isRetryableOAuthError(error)) {
-                            refreshAttempted = true;
-                            continue;
-                        }
-                        throw error;
-                    }
+                if (shouldReRegisterStoredDynamicClient(error, await loadRegisteredClient(discovery.authorizationServer), false)) {
+                    await clearRegisteredClient(discovery.authorizationServer);
+                    await clearSession(resource);
+                    return null;
                 }
-                const updatedSession = {
-                    ...session,
-                    tokens: {
-                        ...refreshedTokens,
-                        refreshToken: refreshedTokens.refreshToken ?? session.tokens.refreshToken
-                    },
-                    discovery: toStoredDiscovery(discovery)
-                };
-                await saveSession(resource, updatedSession);
-                return updatedSession;
-            }
-            finally {
-                refreshPromises.delete(resource);
+                if (!refreshAttempted && isRetryableOAuthError(error)) {
+                    refreshAttempted = true;
+                    continue;
+                }
+                throw error;
             }
-        })();
-        refreshPromises.set(resource, promise);
-        return promise;
+        }
+        const updatedSession = {
+            ...session,
+            tokens: {
+                ...refreshedTokens,
+                refreshToken: refreshedTokens.refreshToken ?? session.tokens.refreshToken
+            },
+            discovery: toStoredDiscovery(discovery)
+        };
+        await saveSession(resource, updatedSession);
+        return updatedSession;
     }
     async function authorizeSession(resource, existingSession, discovery, fetch, signal) {
         signal?.throwIfAborted();
-        const inFlight = authorizationPromises.get(resource);
-        if (inFlight !== undefined) {
-            return inFlight;
-        }
-        const promise = (async () => {
-            assertS256PkceSupport(discovery.authorizationServerMetadata);
-            assertSecureOAuthFlowEndpoints(discovery.authorizationServerMetadata);
-            let currentSession = existingSession;
-            let transientRetryAttempted = false;
-            let reRegistrationAttempted = false;
-            while (true) {
-                const loopback = await createLoopbackAuthorizationSession({
-                    openBrowser: options.browser.openBrowser,
-                    readLine: options.browser.readLine,
-                    createServer: options.browser.createServer,
-                    landingPage: options.browser.landingPage,
-                    redirectUri: options.browser.redirectUri,
-                    signal: options.browser.signal === undefined ? signal : signal === undefined ? options.browser.signal : AbortSignal.any([signal, options.browser.signal]),
-                    timeoutMs: options.browser.timeoutMs
+        assertS256PkceSupport(discovery.authorizationServerMetadata);
+        assertSecureOAuthFlowEndpoints(discovery.authorizationServerMetadata);
+        let currentSession = existingSession;
+        let transientRetryAttempted = false;
+        let reRegistrationAttempted = false;
+        while (true) {
+            const loopback = await createLoopbackAuthorizationSession({
+                openBrowser: options.browser.openBrowser,
+                readLine: options.browser.readLine,
+                createServer: options.browser.createServer,
+                landingPage: options.browser.landingPage,
+                redirectUri: options.browser.redirectUri,
+                signal: options.browser.signal === undefined ? signal : signal === undefined ? options.browser.signal : AbortSignal.any([signal, options.browser.signal]),
+                timeoutMs: options.browser.timeoutMs
+            });
+            let resolvedClient = null;
+            try {
+                resolvedClient = await resolveClient(currentSession, discovery, loopback.redirectUri, fetch, signal);
+                const sessionWithoutTokens = {
+                    resource,
+                    authorizationServer: discovery.authorizationServer,
+                    client: resolvedClient.client,
+                    discovery: toStoredDiscovery(discovery)
+                };
+                await saveSession(resource, sessionWithoutTokens);
+                const verifier = generateCodeVerifier();
+                const challenge = generateCodeChallenge(verifier);
+                const authorizationUrl = buildAuthorizationUrl({
+                    metadata: discovery.authorizationServerMetadata,
+                    resource,
+                    clientId: resolvedClient.client.clientId,
+                    redirectUri: loopback.redirectUri,
+                    codeChallenge: challenge,
+                    clientMetadata: getClientMetadata(options.client)
                 });
-                let resolvedClient = null;
-                try {
-                    resolvedClient = await resolveClient(currentSession, discovery, loopback.redirectUri, fetch, signal);
-                    const sessionWithoutTokens = {
-                        resource,
-                        authorizationServer: discovery.authorizationServer,
-                        client: resolvedClient.client,
-                        discovery: toStoredDiscovery(discovery)
-                    };
-                    await saveSession(resource, sessionWithoutTokens);
-                    const verifier = generateCodeVerifier();
-                    const challenge = generateCodeChallenge(verifier);
-                    const authorizationUrl = buildAuthorizationUrl({
-                        metadata: discovery.authorizationServerMetadata,
-                        resource,
-                        clientId: resolvedClient.client.clientId,
-                        redirectUri: loopback.redirectUri,
-                        codeChallenge: challenge,
-                        clientMetadata: getClientMetadata(options.client)
-                    });
-                    const code = await loopback.waitForCode(authorizationUrl);
-                    const tokens = await exchangeAuthorizationCode({
-                        tokenEndpoint: requireOwnString(discovery.authorizationServerMetadata, "token_endpoint", "Authorization server metadata"),
-                        clientId: resolvedClient.client.clientId,
-                        clientSecret: resolvedClient.client.clientSecret,
-                        code,
-                        codeVerifier: verifier,
-                        redirectUri: loopback.redirectUri,
-                        resource,
-                        fetch, signal,
-                        now
-                    });
-                    const session = {
-                        ...sessionWithoutTokens,
-                        tokens
-                    };
-                    await saveSession(resource, session);
-                    return session;
-                }
-                catch (error) {
-                    signal?.throwIfAborted();
-                    if (shouldReRegisterStoredDynamicClient(error, resolvedClient, reRegistrationAttempted)) {
-                        reRegistrationAttempted = true;
-                        await clearRegisteredClient(discovery.authorizationServer);
-                        await clearSession(resource);
-                        currentSession = null;
-                        continue;
-                    }
-                    if (!transientRetryAttempted && isRetryableOAuthError(error)) {
-                        transientRetryAttempted = true;
-                        await clearSession(resource);
-                        currentSession = null;
-                        continue;
-                    }
-                    throw error;
+                const code = await loopback.waitForCode(authorizationUrl);
+                const tokens = await exchangeAuthorizationCode({
+                    tokenEndpoint: requireOwnString(discovery.authorizationServerMetadata, "token_endpoint", "Authorization server metadata"),
+                    clientId: resolvedClient.client.clientId,
+                    clientSecret: resolvedClient.client.clientSecret,
+                    code,
+                    codeVerifier: verifier,
+                    redirectUri: loopback.redirectUri,
+                    resource,
+                    fetch, signal,
+                    now
+                });
+                const session = {
+                    ...sessionWithoutTokens,
+                    tokens
+                };
+                await saveSession(resource, session);
+                return session;
+            }
+            catch (error) {
+                signal?.throwIfAborted();
+                if (shouldReRegisterStoredDynamicClient(error, resolvedClient, reRegistrationAttempted)) {
+                    reRegistrationAttempted = true;
+                    await clearRegisteredClient(discovery.authorizationServer);
+                    await clearSession(resource);
+                    currentSession = null;
+                    continue;
                 }
-                finally {
-                    loopback.close();
+                if (!transientRetryAttempted && isRetryableOAuthError(error)) {
+                    transientRetryAttempted = true;
+                    await clearSession(resource);
+                    currentSession = null;
+                    continue;
                 }
+                throw error;
             }
-        })();
-        const finalPromise = promise.finally(() => {
-            authorizationPromises.delete(resource);
-        });
-        authorizationPromises.set(resource, finalPromise);
-        return finalPromise;
+            finally {
+                loopback.close();
+            }
+        }
     }
     async function resolveClient(existingSession, discovery, redirectUri, fetch, parentSignal) {
         parentSignal?.throwIfAborted();

package/node_modules/mcp-oauth/dist/client/session-transaction.d.ts

@@ -0,0 +1,6 @@
+import type { OAuthSessionStore } from "./types.js";
+/** Serialize the complete read/redeem/write operation, with independent cancellation for waiters. */
+export declare function withOAuthSessionTransaction<T>(store: OAuthSessionStore, resource: string, operation: () => Promise<T>, options?: {
+    signal?: AbortSignal;
+    timeoutMs?: number;
+}): Promise<T>;

package/node_modules/mcp-oauth/dist/client/session-transaction.js

@@ -0,0 +1,42 @@
+const queues = new WeakMap();
+/** Serialize the complete read/redeem/write operation, with independent cancellation for waiters. */
+export async function withOAuthSessionTransaction(store, resource, operation, options = {}) {
+    const timeoutMs = options.timeoutMs ?? 30_000;
+    if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2_147_483_647)
+        throw new Error("sessionLockTimeoutMs must be an integer from 1 to 2147483647 milliseconds");
+    options.signal?.throwIfAborted();
+    const started = performance.now();
+    const pending = queues.get(store) ?? new Map();
+    queues.set(store, pending);
+    const previous = pending.get(resource) ?? Promise.resolve();
+    let release;
+    const current = new Promise(resolve => { release = resolve; });
+    const tail = previous.then(() => current);
+    pending.set(resource, tail);
+    try {
+        let timer;
+        let rejectWait;
+        const waiting = new Promise((resolve, reject) => { rejectWait = reject; previous.then(resolve, reject); });
+        const abort = () => rejectWait(options.signal?.reason);
+        try {
+            timer = setTimeout(() => rejectWait(new Error("Timed out waiting for OAuth session transaction lock")), timeoutMs);
+            options.signal?.addEventListener("abort", abort, { once: true });
+            if (options.signal?.aborted)
+                abort();
+            await waiting;
+        }
+        finally {
+            clearTimeout(timer);
+            options.signal?.removeEventListener("abort", abort);
+        }
+        options.signal?.throwIfAborted();
+        return store.withLock === undefined ? await operation() : await store.withLock(resource, operation, {
+            signal: options.signal, timeoutMs: Math.max(0, timeoutMs - (performance.now() - started))
+        });
+    }
+    finally {
+        release();
+        void tail.then(() => { if (pending.get(resource) === tail)
+            pending.delete(resource); });
+    }
+}

package/node_modules/mcp-oauth/dist/client/types.d.ts

@@ -88,6 +88,11 @@ export interface OAuthSessionStore {
     load(resource: string): Promise<StoredOAuthSession | null>;
     save(resource: string, session: StoredOAuthSession): Promise<void>;
     clear(resource: string): Promise<void>;
+    /** Backend-wide lock covering a complete read/redeem/write transaction. */
+    withLock?<T>(resource: string, operation: () => Promise<T>, options: {
+        signal?: AbortSignal;
+        timeoutMs: number;
+    }): Promise<T>;
 }
 export interface DefaultOAuthClientProviderOptions {
     client: {
@@ -103,6 +108,8 @@ export interface DefaultOAuthClientProviderOptions {
     };
     /** Disable interactive authorization while allowing cached tokens and silent refresh. */
     allowInteractive?: boolean;
+    /** Maximum wait to acquire a session transaction lock (default 30,000 ms). */
+    sessionLockTimeoutMs?: number;
     /** Import an existing grant for one resource. Persisted sessions take precedence. */
     initialGrant?: {
         resource: string;

package/node_modules/tiny-mcp-client/dist/index.d.ts

@@ -20,11 +20,31 @@ interface McpSubscription {
     cancel(): void;
 }
 
+interface SecretStoreLockFileSystem {
+    mkdir(path: string, options?: {
+        recursive?: boolean;
+        mode?: number;
+    }): Promise<unknown>;
+    readdir(path: string): Promise<string[]>;
+    readFile(path: string, encoding: BufferEncoding): Promise<string>;
+    writeFile(path: string, value: string, options: {
+        encoding: BufferEncoding;
+        flag: string;
+        mode: number;
+    }): Promise<void>;
+    rename(from: string, to: string): Promise<void>;
+    unlink(path: string): Promise<void>;
+    lstat(path: string): Promise<{
+        isSymbolicLink(): boolean;
+    }>;
+}
+
 interface MachineIdentity {
     hostname: string;
     username: string;
 }
 interface EncryptedFileStoreFileSystem {
+    readdir?(path: string): Promise<string[]>;
     readFile(path: string, encoding: BufferEncoding): Promise<string>;
     writeFile(path: string, data: string | NodeJS.ArrayBufferView, options?: {
         encoding?: BufferEncoding;
@@ -65,6 +85,10 @@ interface KeychainStoreInput {
     runCommand?: KeychainCommandRunner;
     service: string;
     account: string;
+    lock?: {
+        fs?: SecretStoreLockFileSystem;
+        directory?: string;
+    };
 }
 
 type StoreBackend = "file" | "keychain";
@@ -165,6 +189,11 @@ interface OAuthSessionStore {
     load(resource: string): Promise<StoredOAuthSession | null>;
     save(resource: string, session: StoredOAuthSession): Promise<void>;
     clear(resource: string): Promise<void>;
+    /** Backend-wide lock covering a complete read/redeem/write transaction. */
+    withLock?<T>(resource: string, operation: () => Promise<T>, options: {
+        signal?: AbortSignal;
+        timeoutMs: number;
+    }): Promise<T>;
 }
 interface DefaultOAuthClientProviderOptions {
     client: {
@@ -180,6 +209,8 @@ interface DefaultOAuthClientProviderOptions {
     };
     /** Disable interactive authorization while allowing cached tokens and silent refresh. */
     allowInteractive?: boolean;
+    /** Maximum wait to acquire a session transaction lock (default 30,000 ms). */
+    sessionLockTimeoutMs?: number;
     /** Import an existing grant for one resource. Persisted sessions take precedence. */
     initialGrant?: {
         resource: string;