tiny-http-mcp-server 0.1.34 → 0.1.35

package/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.34",
+      "version": "0.1.35",
       "license": "MIT"
     },
     {

package/node_modules/mcp-oauth/README.md

@@ -106,8 +106,13 @@ Select a separate persistence namespace for another scope profile. No scope is
 invented when the client does not configure one.
 
 Imported `initialGrant.tokens` use `accessToken`, optional `refreshToken`,
-`tokenType: "Bearer"`, `expiresAt` (Unix epoch milliseconds or `null` if unknown),
-and optional `scope`. A fresh imported token is used only for its resource.
+`tokenType: "Bearer"`, optional `expiresAt` (Unix epoch milliseconds or `null`
+if unknown), and optional `scope`. `expiresIn` is a lifetime in seconds and is
+anchored once at import. For a delayed import, provide the original `issuedAt`
+in epoch milliseconds or its real absolute `expiresAt`; a numeric absolute
+expiry takes precedence. Without either, the relative value means remaining
+lifetime at import. Omitted expiry stays unknown. A fresh imported token is
+used only for its resource.
 Discovery binds an expired or explicitly rejected grant before silent refresh,
 using the original configured client. Persisted sessions take precedence,
 including sessions whose tokens have been cleared; an import cannot revive them.
@@ -119,6 +124,14 @@ Explicit ID/secret values must agree with the imported response. Sessions and
 native registration stores retain arrays, issuance/expiry timestamps and JSON
 provider metadata. Registration input is copied, bounded to 64 KiB and 64
 levels, and rejects invalid standard field types and non-JSON extensions.
+An optional registration `issuer` must match discovery and the persisted
+authorization server exactly. Contradictory metadata fails without activating
+or redeeming the grant. `client_secret_expires_at` uses Unix epoch seconds;
+zero means no expiry. Live access tokens remain usable after secret expiry,
+but an expired secret is never submitted for refresh. Native DCR can replace
+an expired registration during explicit authorization; caller-owned imports
+must be updated. Headless requests retain the old record and report recovery
+is required without creating a pending refresh marker.
 Set `client.tokenEndpointAuthMethod` to `none`, `client_secret_post` or
 `client_secret_basic`; a full registration can supply the same field as
 `token_endpoint_auth_method`. Public clients never transmit a stored secret.

package/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -43,7 +43,7 @@ export function createDefaultOAuthClientProvider(options) {
     }
     const initialGrant = options.initialGrant === undefined ? undefined : {
         resource: canonicalizeResourceIndicator(options.initialGrant.resource),
-        tokens: normalizeStoredTokens(options.initialGrant.tokens),
+        tokens: normalizeImportedTokens(options.initialGrant.tokens, now),
         client: configuredClient
     };
     if (initialGrant !== undefined && (initialGrant.tokens === undefined || initialGrant.client === null))
@@ -127,6 +127,10 @@ export function createDefaultOAuthClientProvider(options) {
         const canonicalResource = canonicalizeResourceIndicator(resource);
         return withOAuthSessionTransaction(sessionStore, canonicalResource, async () => {
             let session = await loadSession(canonicalResource);
+            if (session !== null)
+                assertRegistrationIssuer(session.client, session.authorizationServer);
+            if (configuredClient !== null && discovery !== undefined)
+                assertRegistrationIssuer(configuredClient, discovery.authorizationServer);
             if (session !== null && initialGrant?.resource === canonicalResource)
                 initialGrantConsumed = true;
             signal?.throwIfAborted();
@@ -173,6 +177,11 @@ export function createDefaultOAuthClientProvider(options) {
             if (session?.tokens?.refreshToken !== undefined &&
                 sessionDiscovery !== undefined &&
                 (forceRefresh || isExpired(session.tokens, now))) {
+                if (hasExpiredClientSecret(session.client, now)) {
+                    if (!allowInteractive || options.allowInteractive === false || options.client.mode === "static" || configuredClient?.registration !== undefined)
+                        throw new Error("OAuth client secret has expired; authorize again or update the imported registration");
+                    return authorizeSession(canonicalResource, clearSessionTokens(session), sessionDiscovery, fetch, signal);
+                }
                 session = await refreshSession(canonicalResource, session, sessionDiscovery, fetch, signal);
                 if (session?.tokens !== undefined && !isExpired(session.tokens, now)) {
                     return session;
@@ -343,6 +352,9 @@ export function createDefaultOAuthClientProvider(options) {
             if (configuredClient === null) {
                 throw new Error("OAuth client_id must not be blank");
             }
+            assertRegistrationIssuer(configuredClient, discovery.authorizationServer);
+            if (hasExpiredClientSecret(configuredClient, now))
+                throw new Error("OAuth client secret has expired; update the imported registration");
             return {
                 kind: "static",
                 fromStoredRegistration: false,
@@ -357,7 +369,14 @@ export function createDefaultOAuthClientProvider(options) {
                 client: configuredClient
             };
         }
-        const storedClient = await loadRegisteredClient(discovery.authorizationServer);
+        let storedClient = await loadRegisteredClient(discovery.authorizationServer);
+        if (storedClient !== null) {
+            assertRegistrationIssuer(storedClient, discovery.authorizationServer);
+            if (hasExpiredClientSecret(storedClient, now)) {
+                await clearRegisteredClient(discovery.authorizationServer);
+                storedClient = null;
+            }
+        }
         if (storedClient !== null) {
             return {
                 kind: "dynamic",
@@ -366,7 +385,7 @@ export function createDefaultOAuthClientProvider(options) {
             };
         }
         if (registrationEndpoint === undefined) {
-            if (existingSession !== null && existingSession.client.clientId.length > 0) {
+            if (existingSession !== null && existingSession.client.clientId.length > 0 && !hasExpiredClientSecret(existingSession.client, now)) {
                 return {
                     kind: "dynamic",
                     fromStoredRegistration: true,
@@ -375,7 +394,7 @@ export function createDefaultOAuthClientProvider(options) {
             }
             throw new Error("Authorization server metadata is missing registration_endpoint");
         }
-        if (existingSession !== null && existingSession.client.clientId.length > 0) {
+        if (existingSession !== null && existingSession.client.clientId.length > 0 && !hasExpiredClientSecret(existingSession.client, now)) {
             const isConfiguredStaticFallback = configuredClient !== null &&
                 existingSession.client.clientId === configuredClient.clientId &&
                 existingSession.client.clientSecret === configuredClient.clientSecret;
@@ -415,6 +434,9 @@ export function createDefaultOAuthClientProvider(options) {
             ...(responseMethod === undefined ? {} : { tokenEndpointAuthMethod: responseMethod }),
             registration
         };
+        assertRegistrationIssuer(registeredClient, discovery.authorizationServer);
+        if (hasExpiredClientSecret(registeredClient, now))
+            throw new Error("OAuth client secret has expired in the registration response");
         await saveRegisteredClient(discovery.authorizationServer, registeredClient);
         return {
             kind: "dynamic",
@@ -528,6 +550,21 @@ function normalizeLoadedSession(session) {
         tokens: normalizeStoredTokens(getOwnEntry(session, "tokens"))
     };
 }
+function normalizeImportedTokens(value, now) {
+    if (!isObjectRecord(value))
+        return undefined;
+    const absolute = getOwnEntry(value, "expiresAt");
+    const lifetime = getOwnEntry(value, "expiresIn");
+    const issuedAt = getOwnEntry(value, "issuedAt");
+    if (lifetime !== undefined && (typeof lifetime !== "number" || !Number.isSafeInteger(lifetime) || lifetime < 0))
+        throw new Error("OAuth initial grant has invalid relative expiry");
+    if (issuedAt !== undefined && (typeof issuedAt !== "number" || !Number.isSafeInteger(issuedAt) ||
+        Math.abs(issuedAt) > MAX_JS_DATE_MS))
+        throw new Error("OAuth initial grant has invalid issuance time");
+    const expiresAt = absolute !== undefined && absolute !== null ? absolute :
+        lifetime === undefined ? null : (issuedAt === undefined ? now() : issuedAt) + lifetime * 1000;
+    return normalizeStoredTokens({ ...value, expiresAt });
+}
 function normalizeStoredTokens(value) {
     if (value === undefined || !isObjectRecord(value)) {
         return undefined;
@@ -689,6 +726,17 @@ function assertRequestMatchesResource(requestUrl, resource) {
         throw new Error(`OAuth request URL ${requestUrl} does not match discovered resource ${resource}`);
     }
 }
+function assertRegistrationIssuer(client, issuer) {
+    const registrationIssuer = client.registration === undefined ? undefined : getOwnString(client.registration, "issuer");
+    if (registrationIssuer !== undefined && registrationIssuer !== issuer)
+        throw new Error("OAuth client registration issuer does not match the authorization server");
+}
+function hasExpiredClientSecret(client, now) {
+    if (client.clientSecret === undefined || client.tokenEndpointAuthMethod === "none" || client.registration === undefined)
+        return false;
+    const expiry = getOwnEntry(client.registration, "client_secret_expires_at");
+    return typeof expiry === "number" && expiry !== 0 && expiry <= now() / 1000;
+}
 function getSupportedTokenAuthMethods(metadata) {
     const value = getOwnEntry(metadata, "token_endpoint_auth_methods_supported");
     if (value === undefined)

package/node_modules/mcp-oauth/dist/client/types.d.ts

@@ -70,6 +70,14 @@ export interface StoredOAuthTokens {
     expiresAt: number | null;
     scope?: string;
 }
+/** Import-time lifetimes are normalized once into persisted epoch milliseconds. */
+export interface ImportedOAuthTokens extends Omit<StoredOAuthTokens, "expiresAt"> {
+    expiresAt?: number | null;
+    /** Remaining lifetime at import, or total lifetime when issuedAt is provided. */
+    expiresIn?: number;
+    /** Original issuance time in Unix epoch milliseconds. */
+    issuedAt?: number;
+}
 /** Full RFC 7591 response, including JSON provider extensions. */
 export interface OAuthClientRegistration extends Record<string, unknown> {
     client_id: string;
@@ -140,7 +148,7 @@ export interface DefaultOAuthClientProviderOptions {
     /** Import an existing grant for one resource. Persisted sessions take precedence. */
     initialGrant?: {
         resource: string;
-        tokens: StoredOAuthTokens;
+        tokens: ImportedOAuthTokens;
     };
     browser: {
         openBrowser?(url: string): Promise<void>;

package/node_modules/mcp-oauth/dist/index.d.ts

@@ -6,7 +6,7 @@ export { generateCodeChallenge, generateCodeVerifier, } from "./client/pkce.js";
 export { OAuthError, } from "./client/token-endpoint.js";
 export { canonicalizeResourceIndicator, } from "./resource-indicator.js";
 export { createJwksTokenVerifier, } from "./server/jwks-token-verifier.js";
-export type { DefaultOAuthClientProviderOptions, OAuthAuthorizationServerMetadata, OAuthClientMetadata, OAuthClientRegistration, OAuthClientProvider, OAuthClientProviderOptions, OAuthDiscoveryResult, OAuthMetadataFetch, OAuthProtectedResourceMetadata, OAuthSessionStore, OAuthUnauthorizedChallenge, OAuthTokenEndpointAuthMethod, StoredOAuthSession, StoredOAuthClient, StoredOAuthTokens, } from "./client/types.js";
+export type { DefaultOAuthClientProviderOptions, OAuthAuthorizationServerMetadata, OAuthClientMetadata, OAuthClientRegistration, OAuthClientProvider, OAuthClientProviderOptions, OAuthDiscoveryResult, OAuthMetadataFetch, OAuthProtectedResourceMetadata, OAuthSessionStore, OAuthUnauthorizedChallenge, OAuthTokenEndpointAuthMethod, StoredOAuthSession, StoredOAuthClient, StoredOAuthTokens, ImportedOAuthTokens, } from "./client/types.js";
 export type { JwksTokenVerifier, JwksTokenVerifierOptions, JwksVerifiedAccessToken, } from "./server/jwks-token-verifier.js";
 export type { LoopbackAuthorizationOptions, LoopbackAuthorizationSession, OAuthLandingPage, } from "./client/loopback-authorization.js";
 export { readBoundedResponseText } from "./http-response.js";

package/node_modules/tiny-mcp-client/dist/index.d.ts

@@ -173,6 +173,14 @@ interface StoredOAuthTokens {
     expiresAt: number | null;
     scope?: string;
 }
+/** Import-time lifetimes are normalized once into persisted epoch milliseconds. */
+interface ImportedOAuthTokens extends Omit<StoredOAuthTokens, "expiresAt"> {
+    expiresAt?: number | null;
+    /** Remaining lifetime at import, or total lifetime when issuedAt is provided. */
+    expiresIn?: number;
+    /** Original issuance time in Unix epoch milliseconds. */
+    issuedAt?: number;
+}
 /** Full RFC 7591 response, including JSON provider extensions. */
 interface OAuthClientRegistration extends Record<string, unknown> {
     client_id: string;
@@ -243,7 +251,7 @@ interface DefaultOAuthClientProviderOptions {
     /** Import an existing grant for one resource. Persisted sessions take precedence. */
     initialGrant?: {
         resource: string;
-        tokens: StoredOAuthTokens;
+        tokens: ImportedOAuthTokens;
     };
     browser: {
         openBrowser?(url: string): Promise<void>;

package/node_modules/tiny-mcp-client/dist/index.js

@@ -4999,7 +4999,7 @@ function createDefaultOAuthClientProvider(options) {
   }
   const initialGrant = options.initialGrant === void 0 ? void 0 : {
     resource: canonicalizeResourceIndicator(options.initialGrant.resource),
-    tokens: normalizeStoredTokens(options.initialGrant.tokens),
+    tokens: normalizeImportedTokens(options.initialGrant.tokens, now),
     client: configuredClient
   };
   if (initialGrant !== void 0 && (initialGrant.tokens === void 0 || initialGrant.client === null))
@@ -5077,6 +5077,10 @@ function createDefaultOAuthClientProvider(options) {
     const canonicalResource = canonicalizeResourceIndicator(resource);
     return withOAuthSessionTransaction(sessionStore, canonicalResource, async () => {
       let session = await loadSession(canonicalResource);
+      if (session !== null)
+        assertRegistrationIssuer(session.client, session.authorizationServer);
+      if (configuredClient !== null && discovery !== void 0)
+        assertRegistrationIssuer(configuredClient, discovery.authorizationServer);
       if (session !== null && initialGrant?.resource === canonicalResource)
         initialGrantConsumed = true;
       signal?.throwIfAborted();
@@ -5122,6 +5126,11 @@ function createDefaultOAuthClientProvider(options) {
         return session;
       }
       if (session?.tokens?.refreshToken !== void 0 && sessionDiscovery !== void 0 && (forceRefresh || isExpired(session.tokens, now))) {
+        if (hasExpiredClientSecret(session.client, now)) {
+          if (!allowInteractive || options.allowInteractive === false || options.client.mode === "static" || configuredClient?.registration !== void 0)
+            throw new Error("OAuth client secret has expired; authorize again or update the imported registration");
+          return authorizeSession(canonicalResource, clearSessionTokens(session), sessionDiscovery, fetch2, signal);
+        }
         session = await refreshSession(canonicalResource, session, sessionDiscovery, fetch2, signal);
         if (session?.tokens !== void 0 && !isExpired(session.tokens, now)) {
           return session;
@@ -5289,6 +5298,9 @@ function createDefaultOAuthClientProvider(options) {
       if (configuredClient === null) {
         throw new Error("OAuth client_id must not be blank");
       }
+      assertRegistrationIssuer(configuredClient, discovery.authorizationServer);
+      if (hasExpiredClientSecret(configuredClient, now))
+        throw new Error("OAuth client secret has expired; update the imported registration");
       return {
         kind: "static",
         fromStoredRegistration: false,
@@ -5303,7 +5315,14 @@ function createDefaultOAuthClientProvider(options) {
         client: configuredClient
       };
     }
-    const storedClient = await loadRegisteredClient(discovery.authorizationServer);
+    let storedClient = await loadRegisteredClient(discovery.authorizationServer);
+    if (storedClient !== null) {
+      assertRegistrationIssuer(storedClient, discovery.authorizationServer);
+      if (hasExpiredClientSecret(storedClient, now)) {
+        await clearRegisteredClient(discovery.authorizationServer);
+        storedClient = null;
+      }
+    }
     if (storedClient !== null) {
       return {
         kind: "dynamic",
@@ -5312,7 +5331,7 @@ function createDefaultOAuthClientProvider(options) {
       };
     }
     if (registrationEndpoint === void 0) {
-      if (existingSession !== null && existingSession.client.clientId.length > 0) {
+      if (existingSession !== null && existingSession.client.clientId.length > 0 && !hasExpiredClientSecret(existingSession.client, now)) {
         return {
           kind: "dynamic",
           fromStoredRegistration: true,
@@ -5321,7 +5340,7 @@ function createDefaultOAuthClientProvider(options) {
       }
       throw new Error("Authorization server metadata is missing registration_endpoint");
     }
-    if (existingSession !== null && existingSession.client.clientId.length > 0) {
+    if (existingSession !== null && existingSession.client.clientId.length > 0 && !hasExpiredClientSecret(existingSession.client, now)) {
       const isConfiguredStaticFallback = configuredClient !== null && existingSession.client.clientId === configuredClient.clientId && existingSession.client.clientSecret === configuredClient.clientSecret;
       if (!isConfiguredStaticFallback) {
         await saveRegisteredClient(discovery.authorizationServer, existingSession.client);
@@ -5357,6 +5376,9 @@ function createDefaultOAuthClientProvider(options) {
       ...responseMethod === void 0 ? {} : { tokenEndpointAuthMethod: responseMethod },
       registration
     };
+    assertRegistrationIssuer(registeredClient, discovery.authorizationServer);
+    if (hasExpiredClientSecret(registeredClient, now))
+      throw new Error("OAuth client secret has expired in the registration response");
     await saveRegisteredClient(discovery.authorizationServer, registeredClient);
     return {
       kind: "dynamic",
@@ -5464,6 +5486,19 @@ function normalizeLoadedSession(session) {
     tokens: normalizeStoredTokens(getOwnEntry6(session, "tokens"))
   };
 }
+function normalizeImportedTokens(value, now) {
+  if (!isObjectRecord3(value))
+    return void 0;
+  const absolute = getOwnEntry6(value, "expiresAt");
+  const lifetime = getOwnEntry6(value, "expiresIn");
+  const issuedAt = getOwnEntry6(value, "issuedAt");
+  if (lifetime !== void 0 && (typeof lifetime !== "number" || !Number.isSafeInteger(lifetime) || lifetime < 0))
+    throw new Error("OAuth initial grant has invalid relative expiry");
+  if (issuedAt !== void 0 && (typeof issuedAt !== "number" || !Number.isSafeInteger(issuedAt) || Math.abs(issuedAt) > MAX_JS_DATE_MS3))
+    throw new Error("OAuth initial grant has invalid issuance time");
+  const expiresAt = absolute !== void 0 && absolute !== null ? absolute : lifetime === void 0 ? null : (issuedAt === void 0 ? now() : issuedAt) + lifetime * 1e3;
+  return normalizeStoredTokens({ ...value, expiresAt });
+}
 function normalizeStoredTokens(value) {
   if (value === void 0 || !isObjectRecord3(value)) {
     return void 0;
@@ -5604,6 +5639,17 @@ function assertRequestMatchesResource(requestUrl, resource) {
     throw new Error(`OAuth request URL ${requestUrl} does not match discovered resource ${resource}`);
   }
 }
+function assertRegistrationIssuer(client, issuer) {
+  const registrationIssuer = client.registration === void 0 ? void 0 : getOwnString2(client.registration, "issuer");
+  if (registrationIssuer !== void 0 && registrationIssuer !== issuer)
+    throw new Error("OAuth client registration issuer does not match the authorization server");
+}
+function hasExpiredClientSecret(client, now) {
+  if (client.clientSecret === void 0 || client.tokenEndpointAuthMethod === "none" || client.registration === void 0)
+    return false;
+  const expiry = getOwnEntry6(client.registration, "client_secret_expires_at");
+  return typeof expiry === "number" && expiry !== 0 && expiry <= now() / 1e3;
+}
 function getSupportedTokenAuthMethods(metadata) {
   const value = getOwnEntry6(metadata, "token_endpoint_auth_methods_supported");
   if (value === void 0)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.34",
+  "version": "0.1.35",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",