tiny-http-mcp-server 0.1.31 → 0.1.32

package/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.31",
+      "version": "0.1.32",
       "license": "MIT"
     },
     {

package/node_modules/mcp-oauth/README.md

@@ -96,7 +96,14 @@ on 401 even when the server omits `error="invalid_token"`. Invalid provenance
 fails without quoting token values.
 
 Configure `client.metadata.scope` to request a precise scope set; broader
-discovery metadata does not override it.
+discovery metadata does not override it. Explicit scopes must match the cached
+or imported grant's scope set; ordering, repeated spaces and duplicates are
+normalized. An imported grant must declare its scope when a scope is configured.
+Authorization records the requested set when the endpoint omits scope, and
+refresh retains the previous granted set. Mismatched responses never activate
+credentials; an unusable refresh response retains the pending refresh record.
+Select a separate persistence namespace for another scope profile. No scope is
+invented when the client does not configure one.
 
 Imported `initialGrant.tokens` use `accessToken`, optional `refreshToken`,
 `tokenType: "Bearer"`, `expiresAt` (Unix epoch milliseconds or `null` if unknown),

package/node_modules/mcp-oauth/dist/client/auth-store-session-store.js

@@ -144,6 +144,7 @@ function isStoredOAuthSession(value) {
         isNonBlankOwnString(value, "authorizationServer") &&
         isStoredOAuthClient(getOwnEntry(value, "client")) &&
         isStoredOAuthDiscovery(getOwnEntry(value, "discovery")) &&
+        (getOwnEntry(value, "requestedScope") === undefined || isNonBlankOwnString(value, "requestedScope")) &&
         (getOwnEntry(value, "refreshState") === undefined ||
             (getOwnEntry(value, "refreshState") === "pending" && getOwnEntry(value, "tokens") === undefined)) &&
         isStoredOAuthTokensOrMissing(getOwnEntry(value, "tokens")));

package/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -1,3 +1,4 @@
+import { normalizeOAuthScope } from "./scope.js";
 import { isIP } from "node:net";
 import { fetchMcpResponse } from "../http-fetch.js";
 import { URL } from "node:url";
@@ -18,6 +19,8 @@ export function createOAuthClientProvider(options) {
 export function createDefaultOAuthClientProvider(options) {
     loopbackTarget(options.browser);
     assertPersistenceNamespace(options.persistenceNamespace);
+    const clientMetadata = getClientMetadata(options.client);
+    const requestedScope = clientMetadata?.scope;
     const sessionStore = options.sessionStore ?? createAuthStoreSessionStore(options.authStore, options.persistenceNamespace);
     const clientStore = options.authStore === undefined ? null : createAuthStoreClientStore(options.authStore, options.persistenceNamespace);
     const now = options.now ?? Date.now;
@@ -41,6 +44,8 @@ export function createDefaultOAuthClientProvider(options) {
     if (initialGrant !== undefined && (initialGrant.tokens === undefined || initialGrant.client === null))
         throw new Error("OAuth initial grant requires valid tokens and the original client ID");
     if (initialGrant?.tokens !== undefined) {
+        if (requestedScope !== undefined && initialGrant.tokens.scope !== requestedScope)
+            throw new Error("OAuth initial grant does not match the requested OAuth scope");
         try {
             new Headers({ Authorization: `Bearer ${initialGrant.tokens.accessToken}` });
         }
@@ -133,7 +138,8 @@ export function createDefaultOAuthClientProvider(options) {
                 initialGrant.tokens !== undefined && initialGrant.client !== null) {
                 assertSecureOAuthFlowEndpoints(discovery.authorizationServerMetadata);
                 session = { resource: canonicalResource, authorizationServer: discovery.authorizationServer,
-                    client: initialGrant.client, tokens: initialGrant.tokens, discovery: toStoredDiscovery(discovery) };
+                    client: initialGrant.client, tokens: initialGrant.tokens,
+                    ...(requestedScope === undefined ? {} : { requestedScope }), discovery: toStoredDiscovery(discovery) };
                 await saveSession(canonicalResource, session);
                 initialGrantConsumed = true;
                 signal?.throwIfAborted();
@@ -146,6 +152,8 @@ export function createDefaultOAuthClientProvider(options) {
                 if (configured === null || configured.clientId !== session.client.clientId || configured.clientSecret !== session.client.clientSecret)
                     throw new Error("Stored session belongs to a different OAuth client; use separate persistence or explicitly reset it");
             }
+            if (requestedScope !== undefined && session?.tokens !== undefined && normalizeOAuthScope(session.tokens.scope ?? session.requestedScope) !== requestedScope)
+                throw new Error("Stored session does not match the requested OAuth scope; authorize again or select separate persistence");
             if (session?.refreshState === "pending") {
                 if (!allowInteractive || options.allowInteractive === false || sessionDiscovery === undefined)
                     throw new Error("OAuth refresh outcome is unknown; authorize again before using this resource");
@@ -226,10 +234,13 @@ export function createDefaultOAuthClientProvider(options) {
             ...session,
             tokens: {
                 ...refreshedTokens,
-                refreshToken: refreshedTokens.refreshToken ?? session.tokens.refreshToken
+                refreshToken: refreshedTokens.refreshToken ?? session.tokens.refreshToken,
+                scope: refreshedTokens.scope ?? session.tokens.scope
             },
             discovery: toStoredDiscovery(discovery)
         };
+        if (requestedScope !== undefined && normalizeOAuthScope(updatedSession.tokens?.scope ?? session.requestedScope) !== requestedScope)
+            throw new Error("OAuth refresh response does not match the requested OAuth scope; authorize again");
         await saveSession(resource, updatedSession);
         return updatedSession;
     }
@@ -257,6 +268,7 @@ export function createDefaultOAuthClientProvider(options) {
                     resource,
                     authorizationServer: discovery.authorizationServer,
                     client: resolvedClient.client,
+                    ...(requestedScope === undefined ? {} : { requestedScope }),
                     discovery: toStoredDiscovery(discovery)
                 };
                 await saveSession(resource, sessionWithoutTokens);
@@ -268,7 +280,7 @@ export function createDefaultOAuthClientProvider(options) {
                     clientId: resolvedClient.client.clientId,
                     redirectUri: loopback.redirectUri,
                     codeChallenge: challenge,
-                    clientMetadata: getClientMetadata(options.client)
+                    clientMetadata
                 });
                 const code = await loopback.waitForCode(authorizationUrl);
                 const tokens = await exchangeAuthorizationCode({
@@ -282,6 +294,8 @@ export function createDefaultOAuthClientProvider(options) {
                     fetch, signal,
                     now
                 });
+                if (requestedScope !== undefined && tokens.scope !== undefined && normalizeOAuthScope(tokens.scope) !== requestedScope)
+                    throw new Error("OAuth authorization response does not match the requested OAuth scope");
                 const session = {
                     ...sessionWithoutTokens,
                     tokens
@@ -363,7 +377,7 @@ export function createDefaultOAuthClientProvider(options) {
                 };
             }
         }
-        const registrationBody = buildClientRegistrationBody(getClientMetadata(options.client), redirectUri);
+        const registrationBody = buildClientRegistrationBody(clientMetadata, redirectUri);
         const deadline = AbortSignal.timeout(30_000);
         const signal = parentSignal === undefined ? deadline : AbortSignal.any([parentSignal, deadline]);
         const response = await fetchMcpResponse(fetch, registrationEndpoint, {
@@ -526,10 +540,10 @@ function normalizeStoredTokens(value) {
     const tokenType = getOwnString(value, "tokenType");
     const expiresAt = getOwnEntry(value, "expiresAt");
     const refreshToken = getOwnEntry(value, "refreshToken");
-    const scope = getOwnString(value, "scope");
+    const scope = getOwnEntry(value, "scope");
     const normalizedAccessToken = accessToken?.trim();
     const normalizedRefreshToken = typeof refreshToken === "string" ? refreshToken.trim() : undefined;
-    const normalizedScope = scope?.trim();
+    const normalizedScope = normalizeOAuthScope(scope);
     if (accessToken === undefined ||
         normalizedAccessToken === undefined ||
         normalizedAccessToken.length === 0 ||
@@ -561,7 +575,7 @@ function getClientMetadata(client) {
     }
     return {
         clientName: normalizeOptionalOAuthString(client.metadata.clientName),
-        scope: normalizeOptionalOAuthString(client.metadata.scope),
+        scope: normalizeOAuthScope(client.metadata.scope),
         softwareId: normalizeOptionalOAuthString(client.metadata.softwareId),
         softwareVersion: normalizeOptionalOAuthString(client.metadata.softwareVersion)
     };

package/node_modules/mcp-oauth/dist/client/scope.d.ts

@@ -0,0 +1,2 @@
+/** Compare OAuth scope sets without accepting controls or changing token case. */
+export declare function normalizeOAuthScope(scope: unknown): string | undefined;

package/node_modules/mcp-oauth/dist/client/scope.js

@@ -0,0 +1,9 @@
+/** Compare OAuth scope sets without accepting controls or changing token case. */
+export function normalizeOAuthScope(scope) {
+    if (scope === undefined)
+        return undefined;
+    if (typeof scope !== "string" || [...scope].some(char => char.charCodeAt(0) < 32 || char.charCodeAt(0) > 126 || char === '"' || char === "\\"))
+        throw new Error("Invalid OAuth scope syntax");
+    const normalized = [...new Set(scope.split(" ").filter(Boolean))].sort().join(" ");
+    return normalized || undefined;
+}

package/node_modules/mcp-oauth/dist/client/token-endpoint.js

@@ -1,6 +1,7 @@
 import { canonicalizeResourceIndicator } from "../resource-indicator.js";
 import { readBoundedResponseText } from "../http-response.js";
 import { fetchMcpResponse } from "../http-fetch.js";
+import { normalizeOAuthScope } from "./scope.js";
 const MAX_JS_DATE_MS = 8_640_000_000_000_000;
 export class OAuthError extends Error {
     error;
@@ -117,7 +118,9 @@ async function requestTokens(input) {
     const normalizedRefreshToken = typeof refreshToken === "string" && refreshToken.trim().length > 0
         ? refreshToken.trim()
         : undefined;
-    const normalizedScope = typeof scope === "string" && scope.trim().length > 0 ? scope.trim() : undefined;
+    const normalizedScope = normalizeOAuthScope(scope);
+    if (scope !== undefined && normalizedScope === undefined)
+        throw new Error("Invalid OAuth scope syntax in token response");
     return {
         accessToken: normalizedAccessToken,
         refreshToken: normalizedRefreshToken === undefined ? undefined : normalizedRefreshToken,

package/node_modules/mcp-oauth/dist/client/types.d.ts

@@ -80,6 +80,8 @@ export interface StoredOAuthSession {
     tokens?: StoredOAuthTokens;
     /** A refresh was begun; its winning response may not have been persisted. */
     refreshState?: "pending";
+    /** Canonical explicitly requested scope set when the server omits token scope. */
+    requestedScope?: string;
     discovery: {
         resourceMetadataUrl: string;
         resourceMetadata: Record<string, unknown>;

package/node_modules/tiny-mcp-client/dist/index.d.ts

@@ -183,6 +183,8 @@ interface StoredOAuthSession {
     tokens?: StoredOAuthTokens;
     /** A refresh was begun; its winning response may not have been persisted. */
     refreshState?: "pending";
+    /** Canonical explicitly requested scope set when the server omits token scope. */
+    requestedScope?: string;
     discovery: {
         resourceMetadataUrl: string;
         resourceMetadata: Record<string, unknown>;

package/node_modules/tiny-mcp-client/dist/index.js

@@ -4201,7 +4201,7 @@ function isStoredOAuthSession(value) {
   if (!isObjectRecord(value)) {
     return false;
   }
-  return isNonBlankOwnString(value, "resource") && isNonBlankOwnString(value, "authorizationServer") && isStoredOAuthClient(getOwnEntry3(value, "client")) && isStoredOAuthDiscovery(getOwnEntry3(value, "discovery")) && (getOwnEntry3(value, "refreshState") === void 0 || getOwnEntry3(value, "refreshState") === "pending" && getOwnEntry3(value, "tokens") === void 0) && isStoredOAuthTokensOrMissing(getOwnEntry3(value, "tokens"));
+  return isNonBlankOwnString(value, "resource") && isNonBlankOwnString(value, "authorizationServer") && isStoredOAuthClient(getOwnEntry3(value, "client")) && isStoredOAuthDiscovery(getOwnEntry3(value, "discovery")) && (getOwnEntry3(value, "requestedScope") === void 0 || isNonBlankOwnString(value, "requestedScope")) && (getOwnEntry3(value, "refreshState") === void 0 || getOwnEntry3(value, "refreshState") === "pending" && getOwnEntry3(value, "tokens") === void 0) && isStoredOAuthTokensOrMissing(getOwnEntry3(value, "tokens"));
 }
 function isStoredOAuthClient(value) {
   if (!isObjectRecord(value) || !isNonBlankOwnString(value, "clientId")) {
@@ -4242,6 +4242,16 @@ function isNonBlankOwnString(record2, key2) {
   return value !== void 0 && value.trim().length > 0;
 }
 
+// ../mcp-oauth/dist/client/scope.js
+function normalizeOAuthScope(scope) {
+  if (scope === void 0)
+    return void 0;
+  if (typeof scope !== "string" || [...scope].some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) > 126 || char === '"' || char === "\\"))
+    throw new Error("Invalid OAuth scope syntax");
+  const normalized = [...new Set(scope.split(" ").filter(Boolean))].sort().join(" ");
+  return normalized || void 0;
+}
+
 // ../mcp-oauth/dist/client/default-oauth-client-provider.js
 import { isIP } from "node:net";
 
@@ -4726,7 +4736,9 @@ async function requestTokens(input) {
   const refreshToken = getOwnEntry5(payload, "refresh_token");
   const scope = getOwnEntry5(payload, "scope");
   const normalizedRefreshToken = typeof refreshToken === "string" && refreshToken.trim().length > 0 ? refreshToken.trim() : void 0;
-  const normalizedScope = typeof scope === "string" && scope.trim().length > 0 ? scope.trim() : void 0;
+  const normalizedScope = normalizeOAuthScope(scope);
+  if (scope !== void 0 && normalizedScope === void 0)
+    throw new Error("Invalid OAuth scope syntax in token response");
   return {
     accessToken: normalizedAccessToken,
     refreshToken: normalizedRefreshToken === void 0 ? void 0 : normalizedRefreshToken,
@@ -4847,6 +4859,8 @@ function createOAuthClientProvider(options) {
 function createDefaultOAuthClientProvider(options) {
   loopbackTarget(options.browser);
   assertPersistenceNamespace(options.persistenceNamespace);
+  const clientMetadata = getClientMetadata(options.client);
+  const requestedScope = clientMetadata?.scope;
   const sessionStore = options.sessionStore ?? createAuthStoreSessionStore(options.authStore, options.persistenceNamespace);
   const clientStore = options.authStore === void 0 ? null : createAuthStoreClientStore(options.authStore, options.persistenceNamespace);
   const now = options.now ?? Date.now;
@@ -4869,6 +4883,8 @@ function createDefaultOAuthClientProvider(options) {
   if (initialGrant !== void 0 && (initialGrant.tokens === void 0 || initialGrant.client === null))
     throw new Error("OAuth initial grant requires valid tokens and the original client ID");
   if (initialGrant?.tokens !== void 0) {
+    if (requestedScope !== void 0 && initialGrant.tokens.scope !== requestedScope)
+      throw new Error("OAuth initial grant does not match the requested OAuth scope");
     try {
       new Headers({ Authorization: `Bearer ${initialGrant.tokens.accessToken}` });
     } catch {
@@ -4956,6 +4972,7 @@ function createDefaultOAuthClientProvider(options) {
           authorizationServer: discovery.authorizationServer,
           client: initialGrant.client,
           tokens: initialGrant.tokens,
+          ...requestedScope === void 0 ? {} : { requestedScope },
           discovery: toStoredDiscovery(discovery)
         };
         await saveSession(canonicalResource, session);
@@ -4970,6 +4987,8 @@ function createDefaultOAuthClientProvider(options) {
         if (configured === null || configured.clientId !== session.client.clientId || configured.clientSecret !== session.client.clientSecret)
           throw new Error("Stored session belongs to a different OAuth client; use separate persistence or explicitly reset it");
       }
+      if (requestedScope !== void 0 && session?.tokens !== void 0 && normalizeOAuthScope(session.tokens.scope ?? session.requestedScope) !== requestedScope)
+        throw new Error("Stored session does not match the requested OAuth scope; authorize again or select separate persistence");
       if (session?.refreshState === "pending") {
         if (!allowInteractive || options.allowInteractive === false || sessionDiscovery === void 0)
           throw new Error("OAuth refresh outcome is unknown; authorize again before using this resource");
@@ -5046,10 +5065,13 @@ function createDefaultOAuthClientProvider(options) {
       ...session,
       tokens: {
         ...refreshedTokens,
-        refreshToken: refreshedTokens.refreshToken ?? session.tokens.refreshToken
+        refreshToken: refreshedTokens.refreshToken ?? session.tokens.refreshToken,
+        scope: refreshedTokens.scope ?? session.tokens.scope
       },
       discovery: toStoredDiscovery(discovery)
     };
+    if (requestedScope !== void 0 && normalizeOAuthScope(updatedSession.tokens?.scope ?? session.requestedScope) !== requestedScope)
+      throw new Error("OAuth refresh response does not match the requested OAuth scope; authorize again");
     await saveSession(resource, updatedSession);
     return updatedSession;
   }
@@ -5077,6 +5099,7 @@ function createDefaultOAuthClientProvider(options) {
           resource,
           authorizationServer: discovery.authorizationServer,
           client: resolvedClient.client,
+          ...requestedScope === void 0 ? {} : { requestedScope },
           discovery: toStoredDiscovery(discovery)
         };
         await saveSession(resource, sessionWithoutTokens);
@@ -5088,7 +5111,7 @@ function createDefaultOAuthClientProvider(options) {
           clientId: resolvedClient.client.clientId,
           redirectUri: loopback.redirectUri,
           codeChallenge: challenge,
-          clientMetadata: getClientMetadata(options.client)
+          clientMetadata
         });
         const code = await loopback.waitForCode(authorizationUrl);
         const tokens = await exchangeAuthorizationCode({
@@ -5103,6 +5126,8 @@ function createDefaultOAuthClientProvider(options) {
           signal,
           now
         });
+        if (requestedScope !== void 0 && tokens.scope !== void 0 && normalizeOAuthScope(tokens.scope) !== requestedScope)
+          throw new Error("OAuth authorization response does not match the requested OAuth scope");
         const session = {
           ...sessionWithoutTokens,
           tokens
@@ -5180,7 +5205,7 @@ function createDefaultOAuthClientProvider(options) {
         };
       }
     }
-    const registrationBody = buildClientRegistrationBody(getClientMetadata(options.client), redirectUri);
+    const registrationBody = buildClientRegistrationBody(clientMetadata, redirectUri);
     const deadline = AbortSignal.timeout(3e4);
     const signal = parentSignal === void 0 ? deadline : AbortSignal.any([parentSignal, deadline]);
     const response = await fetchMcpResponse(fetch2, registrationEndpoint, {
@@ -5335,10 +5360,10 @@ function normalizeStoredTokens(value) {
   const tokenType = getOwnString2(value, "tokenType");
   const expiresAt = getOwnEntry6(value, "expiresAt");
   const refreshToken = getOwnEntry6(value, "refreshToken");
-  const scope = getOwnString2(value, "scope");
+  const scope = getOwnEntry6(value, "scope");
   const normalizedAccessToken = accessToken?.trim();
   const normalizedRefreshToken = typeof refreshToken === "string" ? refreshToken.trim() : void 0;
-  const normalizedScope = scope?.trim();
+  const normalizedScope = normalizeOAuthScope(scope);
   if (accessToken === void 0 || normalizedAccessToken === void 0 || normalizedAccessToken.length === 0 || tokenType !== "Bearer" || !(expiresAt === null || typeof expiresAt === "number" && Number.isSafeInteger(expiresAt) && expiresAt <= MAX_JS_DATE_MS3 && Number.isFinite(new Date(expiresAt).getTime())) || refreshToken !== void 0 && (typeof refreshToken !== "string" || normalizedRefreshToken === void 0 || normalizedRefreshToken.length === 0)) {
     return void 0;
   }
@@ -5356,7 +5381,7 @@ function getClientMetadata(client) {
   }
   return {
     clientName: normalizeOptionalOAuthString(client.metadata.clientName),
-    scope: normalizeOptionalOAuthString(client.metadata.scope),
+    scope: normalizeOAuthScope(client.metadata.scope),
     softwareId: normalizeOptionalOAuthString(client.metadata.softwareId),
     softwareVersion: normalizeOptionalOAuthString(client.metadata.softwareVersion)
   };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.31",
+  "version": "0.1.32",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",