tiny-http-mcp-server 0.1.34 → 0.1.36

package/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.34",
+      "version": "0.1.36",
       "license": "MIT"
     },
     {

package/node_modules/mcp-oauth/README.md

@@ -106,8 +106,13 @@ Select a separate persistence namespace for another scope profile. No scope is
 invented when the client does not configure one.
 
 Imported `initialGrant.tokens` use `accessToken`, optional `refreshToken`,
-`tokenType: "Bearer"`, `expiresAt` (Unix epoch milliseconds or `null` if unknown),
-and optional `scope`. A fresh imported token is used only for its resource.
+`tokenType: "Bearer"`, optional `expiresAt` (Unix epoch milliseconds or `null`
+if unknown), and optional `scope`. `expiresIn` is a lifetime in seconds and is
+anchored once at import. For a delayed import, provide the original `issuedAt`
+in epoch milliseconds or its real absolute `expiresAt`; a numeric absolute
+expiry takes precedence. Without either, the relative value means remaining
+lifetime at import. Omitted expiry stays unknown. A fresh imported token is
+used only for its resource.
 Discovery binds an expired or explicitly rejected grant before silent refresh,
 using the original configured client. Persisted sessions take precedence,
 including sessions whose tokens have been cleared; an import cannot revive them.
@@ -119,6 +124,22 @@ Explicit ID/secret values must agree with the imported response. Sessions and
 native registration stores retain arrays, issuance/expiry timestamps and JSON
 provider metadata. Registration input is copied, bounded to 64 KiB and 64
 levels, and rejects invalid standard field types and non-JSON extensions.
+An optional registration `issuer` must match discovery and the persisted
+authorization server exactly. Contradictory metadata fails without activating
+or redeeming the grant. `client_secret_expires_at` uses Unix epoch seconds;
+zero means no expiry. Live access tokens remain usable after secret expiry,
+but an expired secret is never submitted for refresh. Native DCR can replace
+an expired registration during explicit authorization; caller-owned imports
+must be updated. Headless requests retain the old record and report recovery
+is required without creating a pending refresh marker.
+Native registrations retain `requestedRedirectUri`, the actual listener URI
+submitted to DCR, separately from the full response metadata. Fresh responses
+may normalize a loopback port or represent IPv4 loopback as portless localhost;
+host, path, scheme, query and fragment differences outside that boundary fail.
+Authorization and code exchange always use the actual listener URI. Silent
+refresh keeps its original client regardless of callback changes. At interactive
+authorization, a native registration with an obsolete captured callback is
+replaced; caller-owned full registration imports retain their original identity.
 Set `client.tokenEndpointAuthMethod` to `none`, `client_secret_post` or
 `client_secret_basic`; a full registration can supply the same field as
 `token_endpoint_auth_method`. Public clients never transmit a stored secret.

package/node_modules/mcp-oauth/dist/client/client-registration.d.ts

@@ -2,3 +2,5 @@ import type { OAuthClientRegistration, StoredOAuthClient } from "./types.js";
 /** Validate and copy a bounded JSON DCR response without quoting credential input. */
 export declare function parseOAuthClientRegistration(value: unknown): OAuthClientRegistration;
 export declare function normalizeStoredOAuthClient(value: unknown): StoredOAuthClient | null;
+/** Fresh DCR may describe a normalized loopback port; saved identity stays exact. */
+export declare function registrationMatchesRedirect(client: StoredOAuthClient, requestedUri: string, fresh?: boolean): boolean;

package/node_modules/mcp-oauth/dist/client/client-registration.js

@@ -1,3 +1,4 @@
+import { loopbackTarget } from "./loopback-authorization.js";
 import { normalizeOAuthScope } from "./scope.js";
 import { normalizeOAuthTokenEndpointAuthMethod } from "./token-auth-method.js";
 /** Validate and copy a bounded JSON DCR response without quoting credential input. */
@@ -84,6 +85,18 @@ export function normalizeStoredOAuthClient(value) {
         (clientSecret !== undefined && (typeof clientSecret !== "string" || clientSecret.trim() === "")))
         return null;
     const client = { clientId: clientId.trim(), ...(clientSecret === undefined ? {} : { clientSecret: clientSecret.trim() }) };
+    const requestedRedirectUri = Object.hasOwn(record, "requestedRedirectUri") ? record.requestedRedirectUri : undefined;
+    if (requestedRedirectUri !== undefined) {
+        try {
+            if (typeof requestedRedirectUri !== "string")
+                throw new Error("Invalid redirect identity");
+            loopbackTarget({ redirectUri: requestedRedirectUri });
+        }
+        catch {
+            throw new Error("Invalid stored OAuth registration redirect identity");
+        }
+        client.requestedRedirectUri = requestedRedirectUri;
+    }
     const method = normalizeOAuthTokenEndpointAuthMethod(Object.hasOwn(record, "tokenEndpointAuthMethod") ? record.tokenEndpointAuthMethod : undefined);
     if (Object.hasOwn(record, "registration") && record.registration !== undefined) {
         const registration = parseOAuthClientRegistration(record.registration);
@@ -101,3 +114,35 @@ export function normalizeStoredOAuthClient(value) {
         client.tokenEndpointAuthMethod = method;
     return client;
 }
+/** Fresh DCR may describe a normalized loopback port; saved identity stays exact. */
+export function registrationMatchesRedirect(client, requestedUri, fresh = false) {
+    if (client.requestedRedirectUri !== undefined)
+        return client.requestedRedirectUri === requestedUri;
+    const redirects = client.registration?.redirect_uris;
+    if (redirects === undefined || redirects === null || redirects.length === 0)
+        return true;
+    return redirects.some(returnedUri => {
+        if (returnedUri === requestedUri)
+            return true;
+        if (!fresh)
+            return false;
+        let returned, requested;
+        try {
+            returned = new URL(returnedUri);
+            requested = new URL(requestedUri);
+        }
+        catch {
+            return false;
+        }
+        if (requested.protocol !== "http:" || returned.protocol !== "http:" ||
+            !["127.0.0.1", "[::1]", "localhost"].includes(requested.hostname))
+            return false;
+        const sameHost = returned.hostname === requested.hostname;
+        const normalizedIpv4 = requested.hostname === "127.0.0.1" && returned.hostname === "localhost" && returned.port === "";
+        if (!sameHost && !normalizedIpv4)
+            return false;
+        returned.hostname = requested.hostname;
+        returned.port = requested.port;
+        return returned.href === requested.href;
+    });
+}

package/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -1,4 +1,4 @@
-import { normalizeStoredOAuthClient, parseOAuthClientRegistration } from "./client-registration.js";
+import { normalizeStoredOAuthClient, parseOAuthClientRegistration, registrationMatchesRedirect } from "./client-registration.js";
 import { normalizeOAuthScope } from "./scope.js";
 import { normalizeOAuthTokenEndpointAuthMethod } from "./token-auth-method.js";
 import { isIP } from "node:net";
@@ -43,7 +43,7 @@ export function createDefaultOAuthClientProvider(options) {
     }
     const initialGrant = options.initialGrant === undefined ? undefined : {
         resource: canonicalizeResourceIndicator(options.initialGrant.resource),
-        tokens: normalizeStoredTokens(options.initialGrant.tokens),
+        tokens: normalizeImportedTokens(options.initialGrant.tokens, now),
         client: configuredClient
     };
     if (initialGrant !== undefined && (initialGrant.tokens === undefined || initialGrant.client === null))
@@ -127,6 +127,10 @@ export function createDefaultOAuthClientProvider(options) {
         const canonicalResource = canonicalizeResourceIndicator(resource);
         return withOAuthSessionTransaction(sessionStore, canonicalResource, async () => {
             let session = await loadSession(canonicalResource);
+            if (session !== null)
+                assertRegistrationIssuer(session.client, session.authorizationServer);
+            if (configuredClient !== null && discovery !== undefined)
+                assertRegistrationIssuer(configuredClient, discovery.authorizationServer);
             if (session !== null && initialGrant?.resource === canonicalResource)
                 initialGrantConsumed = true;
             signal?.throwIfAborted();
@@ -173,6 +177,11 @@ export function createDefaultOAuthClientProvider(options) {
             if (session?.tokens?.refreshToken !== undefined &&
                 sessionDiscovery !== undefined &&
                 (forceRefresh || isExpired(session.tokens, now))) {
+                if (hasExpiredClientSecret(session.client, now)) {
+                    if (!allowInteractive || options.allowInteractive === false || options.client.mode === "static" || configuredClient?.registration !== undefined)
+                        throw new Error("OAuth client secret has expired; authorize again or update the imported registration");
+                    return authorizeSession(canonicalResource, clearSessionTokens(session), sessionDiscovery, fetch, signal);
+                }
                 session = await refreshSession(canonicalResource, session, sessionDiscovery, fetch, signal);
                 if (session?.tokens !== undefined && !isExpired(session.tokens, now)) {
                     return session;
@@ -343,6 +352,9 @@ export function createDefaultOAuthClientProvider(options) {
             if (configuredClient === null) {
                 throw new Error("OAuth client_id must not be blank");
             }
+            assertRegistrationIssuer(configuredClient, discovery.authorizationServer);
+            if (hasExpiredClientSecret(configuredClient, now))
+                throw new Error("OAuth client secret has expired; update the imported registration");
             return {
                 kind: "static",
                 fromStoredRegistration: false,
@@ -357,7 +369,14 @@ export function createDefaultOAuthClientProvider(options) {
                 client: configuredClient
             };
         }
-        const storedClient = await loadRegisteredClient(discovery.authorizationServer);
+        let storedClient = await loadRegisteredClient(discovery.authorizationServer);
+        if (storedClient !== null) {
+            assertRegistrationIssuer(storedClient, discovery.authorizationServer);
+            if (hasExpiredClientSecret(storedClient, now) || !registrationMatchesRedirect(storedClient, redirectUri)) {
+                await clearRegisteredClient(discovery.authorizationServer);
+                storedClient = null;
+            }
+        }
         if (storedClient !== null) {
             return {
                 kind: "dynamic",
@@ -366,7 +385,7 @@ export function createDefaultOAuthClientProvider(options) {
             };
         }
         if (registrationEndpoint === undefined) {
-            if (existingSession !== null && existingSession.client.clientId.length > 0) {
+            if (existingSession !== null && existingSession.client.clientId.length > 0 && !hasExpiredClientSecret(existingSession.client, now) && registrationMatchesRedirect(existingSession.client, redirectUri)) {
                 return {
                     kind: "dynamic",
                     fromStoredRegistration: true,
@@ -375,7 +394,7 @@ export function createDefaultOAuthClientProvider(options) {
             }
             throw new Error("Authorization server metadata is missing registration_endpoint");
         }
-        if (existingSession !== null && existingSession.client.clientId.length > 0) {
+        if (existingSession !== null && existingSession.client.clientId.length > 0 && !hasExpiredClientSecret(existingSession.client, now) && registrationMatchesRedirect(existingSession.client, redirectUri)) {
             const isConfiguredStaticFallback = configuredClient !== null &&
                 existingSession.client.clientId === configuredClient.clientId &&
                 existingSession.client.clientSecret === configuredClient.clientSecret;
@@ -415,11 +434,17 @@ export function createDefaultOAuthClientProvider(options) {
             ...(responseMethod === undefined ? {} : { tokenEndpointAuthMethod: responseMethod }),
             registration
         };
-        await saveRegisteredClient(discovery.authorizationServer, registeredClient);
+        assertRegistrationIssuer(registeredClient, discovery.authorizationServer);
+        if (hasExpiredClientSecret(registeredClient, now))
+            throw new Error("OAuth client secret has expired in the registration response");
+        if (!registrationMatchesRedirect(registeredClient, redirectUri, true))
+            throw new Error("OAuth registration response does not match the requested redirect URI");
+        const clientWithRedirect = { ...registeredClient, requestedRedirectUri: redirectUri };
+        await saveRegisteredClient(discovery.authorizationServer, clientWithRedirect);
         return {
             kind: "dynamic",
             fromStoredRegistration: false,
-            client: registeredClient
+            client: clientWithRedirect
         };
     }
     async function loadSession(resource) {
@@ -528,6 +553,21 @@ function normalizeLoadedSession(session) {
         tokens: normalizeStoredTokens(getOwnEntry(session, "tokens"))
     };
 }
+function normalizeImportedTokens(value, now) {
+    if (!isObjectRecord(value))
+        return undefined;
+    const absolute = getOwnEntry(value, "expiresAt");
+    const lifetime = getOwnEntry(value, "expiresIn");
+    const issuedAt = getOwnEntry(value, "issuedAt");
+    if (lifetime !== undefined && (typeof lifetime !== "number" || !Number.isSafeInteger(lifetime) || lifetime < 0))
+        throw new Error("OAuth initial grant has invalid relative expiry");
+    if (issuedAt !== undefined && (typeof issuedAt !== "number" || !Number.isSafeInteger(issuedAt) ||
+        Math.abs(issuedAt) > MAX_JS_DATE_MS))
+        throw new Error("OAuth initial grant has invalid issuance time");
+    const expiresAt = absolute !== undefined && absolute !== null ? absolute :
+        lifetime === undefined ? null : (issuedAt === undefined ? now() : issuedAt) + lifetime * 1000;
+    return normalizeStoredTokens({ ...value, expiresAt });
+}
 function normalizeStoredTokens(value) {
     if (value === undefined || !isObjectRecord(value)) {
         return undefined;
@@ -689,6 +729,17 @@ function assertRequestMatchesResource(requestUrl, resource) {
         throw new Error(`OAuth request URL ${requestUrl} does not match discovered resource ${resource}`);
     }
 }
+function assertRegistrationIssuer(client, issuer) {
+    const registrationIssuer = client.registration === undefined ? undefined : getOwnString(client.registration, "issuer");
+    if (registrationIssuer !== undefined && registrationIssuer !== issuer)
+        throw new Error("OAuth client registration issuer does not match the authorization server");
+}
+function hasExpiredClientSecret(client, now) {
+    if (client.clientSecret === undefined || client.tokenEndpointAuthMethod === "none" || client.registration === undefined)
+        return false;
+    const expiry = getOwnEntry(client.registration, "client_secret_expires_at");
+    return typeof expiry === "number" && expiry !== 0 && expiry <= now() / 1000;
+}
 function getSupportedTokenAuthMethods(metadata) {
     const value = getOwnEntry(metadata, "token_endpoint_auth_methods_supported");
     if (value === undefined)

package/node_modules/mcp-oauth/dist/client/types.d.ts

@@ -70,6 +70,14 @@ export interface StoredOAuthTokens {
     expiresAt: number | null;
     scope?: string;
 }
+/** Import-time lifetimes are normalized once into persisted epoch milliseconds. */
+export interface ImportedOAuthTokens extends Omit<StoredOAuthTokens, "expiresAt"> {
+    expiresAt?: number | null;
+    /** Remaining lifetime at import, or total lifetime when issuedAt is provided. */
+    expiresIn?: number;
+    /** Original issuance time in Unix epoch milliseconds. */
+    issuedAt?: number;
+}
 /** Full RFC 7591 response, including JSON provider extensions. */
 export interface OAuthClientRegistration extends Record<string, unknown> {
     client_id: string;
@@ -84,6 +92,8 @@ export interface OAuthClientRegistration extends Record<string, unknown> {
 }
 export interface StoredOAuthClient {
     clientId: string;
+    /** Actual listener URI submitted when this native client was registered. */
+    requestedRedirectUri?: string;
     clientSecret?: string;
     registration?: OAuthClientRegistration;
     tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
@@ -140,7 +150,7 @@ export interface DefaultOAuthClientProviderOptions {
     /** Import an existing grant for one resource. Persisted sessions take precedence. */
     initialGrant?: {
         resource: string;
-        tokens: StoredOAuthTokens;
+        tokens: ImportedOAuthTokens;
     };
     browser: {
         openBrowser?(url: string): Promise<void>;

package/node_modules/mcp-oauth/dist/index.d.ts

@@ -6,7 +6,7 @@ export { generateCodeChallenge, generateCodeVerifier, } from "./client/pkce.js";
 export { OAuthError, } from "./client/token-endpoint.js";
 export { canonicalizeResourceIndicator, } from "./resource-indicator.js";
 export { createJwksTokenVerifier, } from "./server/jwks-token-verifier.js";
-export type { DefaultOAuthClientProviderOptions, OAuthAuthorizationServerMetadata, OAuthClientMetadata, OAuthClientRegistration, OAuthClientProvider, OAuthClientProviderOptions, OAuthDiscoveryResult, OAuthMetadataFetch, OAuthProtectedResourceMetadata, OAuthSessionStore, OAuthUnauthorizedChallenge, OAuthTokenEndpointAuthMethod, StoredOAuthSession, StoredOAuthClient, StoredOAuthTokens, } from "./client/types.js";
+export type { DefaultOAuthClientProviderOptions, OAuthAuthorizationServerMetadata, OAuthClientMetadata, OAuthClientRegistration, OAuthClientProvider, OAuthClientProviderOptions, OAuthDiscoveryResult, OAuthMetadataFetch, OAuthProtectedResourceMetadata, OAuthSessionStore, OAuthUnauthorizedChallenge, OAuthTokenEndpointAuthMethod, StoredOAuthSession, StoredOAuthClient, StoredOAuthTokens, ImportedOAuthTokens, } from "./client/types.js";
 export type { JwksTokenVerifier, JwksTokenVerifierOptions, JwksVerifiedAccessToken, } from "./server/jwks-token-verifier.js";
 export type { LoopbackAuthorizationOptions, LoopbackAuthorizationSession, OAuthLandingPage, } from "./client/loopback-authorization.js";
 export { readBoundedResponseText } from "./http-response.js";

package/node_modules/tiny-mcp-client/dist/index.d.ts

@@ -173,6 +173,14 @@ interface StoredOAuthTokens {
     expiresAt: number | null;
     scope?: string;
 }
+/** Import-time lifetimes are normalized once into persisted epoch milliseconds. */
+interface ImportedOAuthTokens extends Omit<StoredOAuthTokens, "expiresAt"> {
+    expiresAt?: number | null;
+    /** Remaining lifetime at import, or total lifetime when issuedAt is provided. */
+    expiresIn?: number;
+    /** Original issuance time in Unix epoch milliseconds. */
+    issuedAt?: number;
+}
 /** Full RFC 7591 response, including JSON provider extensions. */
 interface OAuthClientRegistration extends Record<string, unknown> {
     client_id: string;
@@ -187,6 +195,8 @@ interface OAuthClientRegistration extends Record<string, unknown> {
 }
 interface StoredOAuthClient {
     clientId: string;
+    /** Actual listener URI submitted when this native client was registered. */
+    requestedRedirectUri?: string;
     clientSecret?: string;
     registration?: OAuthClientRegistration;
     tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
@@ -243,7 +253,7 @@ interface DefaultOAuthClientProviderOptions {
     /** Import an existing grant for one resource. Persisted sessions take precedence. */
     initialGrant?: {
         resource: string;
-        tokens: StoredOAuthTokens;
+        tokens: ImportedOAuthTokens;
     };
     browser: {
         openBrowser?(url: string): Promise<void>;