tiny-http-mcp-server 0.1.35 → 0.1.37

package/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.35",
+      "version": "0.1.37",
       "license": "MIT"
     },
     {

package/node_modules/mcp-oauth/README.md

@@ -102,6 +102,15 @@ normalized. An imported grant must declare its scope when a scope is configured.
 Authorization records the requested set when the endpoint omits scope, and
 refresh retains the previous granted set. Mismatched responses never activate
 credentials; an unusable refresh response retains the pending refresh record.
+`resourceIdentity` selects a native-owned logical server within its optional
+persistence namespace. One encrypted, locked document owns that identity's
+current resource URL, sessions and registrations. Changing the URL retires its
+credentials permanently; returning to the old URL does not restore them.
+Retired identities also withhold stale initial grants; authorize again or select
+a fresh explicit profile to import a new grant. This option requires native persistence; custom
+session stores own their durable resource trust policy. Without it, the native
+client retains its existing resource-URL cache behavior.
+
 Select a separate persistence namespace for another scope profile. No scope is
 invented when the client does not configure one.
 
@@ -132,6 +141,14 @@ but an expired secret is never submitted for refresh. Native DCR can replace
 an expired registration during explicit authorization; caller-owned imports
 must be updated. Headless requests retain the old record and report recovery
 is required without creating a pending refresh marker.
+Native registrations retain `requestedRedirectUri`, the actual listener URI
+submitted to DCR, separately from the full response metadata. Fresh responses
+may normalize a loopback port or represent IPv4 loopback as portless localhost;
+host, path, scheme, query and fragment differences outside that boundary fail.
+Authorization and code exchange always use the actual listener URI. Silent
+refresh keeps its original client regardless of callback changes. At interactive
+authorization, a native registration with an obsolete captured callback is
+replaced; caller-owned full registration imports retain their original identity.
 Set `client.tokenEndpointAuthMethod` to `none`, `client_secret_post` or
 `client_secret_basic`; a full registration can supply the same field as
 `token_endpoint_auth_method`. Public clients never transmit a stored secret.

package/node_modules/mcp-oauth/dist/client/auth-store-session-store.d.ts

@@ -1,5 +1,5 @@
-import { type CreateSecretStoreInput } from "auth-store";
-import type { OAuthSessionStore, StoredOAuthClient } from "./types.js";
+import { type CreateSecretStoreInput, type SecretStore } from "auth-store";
+import type { OAuthSessionStore, StoredOAuthSession, StoredOAuthClient } from "./types.js";
 export interface OAuthClientStore {
     load(issuer: string): Promise<StoredOAuthClient | null>;
     save(issuer: string, client: StoredOAuthClient): Promise<void>;
@@ -7,4 +7,11 @@ export interface OAuthClientStore {
 }
 export declare function createAuthStoreSessionStore(options?: CreateSecretStoreInput, namespace?: string): OAuthSessionStore;
 export declare function createAuthStoreClientStore(options: CreateSecretStoreInput, namespace?: string): OAuthClientStore;
+export declare function createNamedSecretStore(key: string, options: CreateSecretStoreInput, defaults: {
+    salt: string;
+    directory: string;
+    service: string;
+    accountPrefix: string;
+}, namespace?: string): SecretStore;
 export declare function assertPersistenceNamespace(namespace: string | undefined): void;
+export declare function isStoredOAuthSession(value: unknown): value is StoredOAuthSession;

package/node_modules/mcp-oauth/dist/client/auth-store-session-store.js

@@ -79,7 +79,7 @@ export function createAuthStoreClientStore(options, namespace) {
         }
     };
 }
-function createNamedSecretStore(key, options, defaults, namespace) {
+export function createNamedSecretStore(key, options, defaults, namespace) {
     const hash = crypto.createHash("sha256").update(namespace === undefined ? key : JSON.stringify([namespace, key])).digest("hex");
     const configuredFilePath = options.fileStore?.filePath;
     const parsedFilePath = configuredFilePath === undefined ? null : path.parse(configuredFilePath);
@@ -132,7 +132,7 @@ function getOwnString(record, key) {
     const value = getOwnEntry(record, key);
     return typeof value === "string" ? value : undefined;
 }
-function isStoredOAuthSession(value) {
+export function isStoredOAuthSession(value) {
     if (!isObjectRecord(value)) {
         return false;
     }

package/node_modules/mcp-oauth/dist/client/client-registration.d.ts

@@ -2,3 +2,5 @@ import type { OAuthClientRegistration, StoredOAuthClient } from "./types.js";
 /** Validate and copy a bounded JSON DCR response without quoting credential input. */
 export declare function parseOAuthClientRegistration(value: unknown): OAuthClientRegistration;
 export declare function normalizeStoredOAuthClient(value: unknown): StoredOAuthClient | null;
+/** Fresh DCR may describe a normalized loopback port; saved identity stays exact. */
+export declare function registrationMatchesRedirect(client: StoredOAuthClient, requestedUri: string, fresh?: boolean): boolean;

package/node_modules/mcp-oauth/dist/client/client-registration.js

@@ -1,3 +1,4 @@
+import { loopbackTarget } from "./loopback-authorization.js";
 import { normalizeOAuthScope } from "./scope.js";
 import { normalizeOAuthTokenEndpointAuthMethod } from "./token-auth-method.js";
 /** Validate and copy a bounded JSON DCR response without quoting credential input. */
@@ -84,6 +85,18 @@ export function normalizeStoredOAuthClient(value) {
         (clientSecret !== undefined && (typeof clientSecret !== "string" || clientSecret.trim() === "")))
         return null;
     const client = { clientId: clientId.trim(), ...(clientSecret === undefined ? {} : { clientSecret: clientSecret.trim() }) };
+    const requestedRedirectUri = Object.hasOwn(record, "requestedRedirectUri") ? record.requestedRedirectUri : undefined;
+    if (requestedRedirectUri !== undefined) {
+        try {
+            if (typeof requestedRedirectUri !== "string")
+                throw new Error("Invalid redirect identity");
+            loopbackTarget({ redirectUri: requestedRedirectUri });
+        }
+        catch {
+            throw new Error("Invalid stored OAuth registration redirect identity");
+        }
+        client.requestedRedirectUri = requestedRedirectUri;
+    }
     const method = normalizeOAuthTokenEndpointAuthMethod(Object.hasOwn(record, "tokenEndpointAuthMethod") ? record.tokenEndpointAuthMethod : undefined);
     if (Object.hasOwn(record, "registration") && record.registration !== undefined) {
         const registration = parseOAuthClientRegistration(record.registration);
@@ -101,3 +114,35 @@ export function normalizeStoredOAuthClient(value) {
         client.tokenEndpointAuthMethod = method;
     return client;
 }
+/** Fresh DCR may describe a normalized loopback port; saved identity stays exact. */
+export function registrationMatchesRedirect(client, requestedUri, fresh = false) {
+    if (client.requestedRedirectUri !== undefined)
+        return client.requestedRedirectUri === requestedUri;
+    const redirects = client.registration?.redirect_uris;
+    if (redirects === undefined || redirects === null || redirects.length === 0)
+        return true;
+    return redirects.some(returnedUri => {
+        if (returnedUri === requestedUri)
+            return true;
+        if (!fresh)
+            return false;
+        let returned, requested;
+        try {
+            returned = new URL(returnedUri);
+            requested = new URL(requestedUri);
+        }
+        catch {
+            return false;
+        }
+        if (requested.protocol !== "http:" || returned.protocol !== "http:" ||
+            !["127.0.0.1", "[::1]", "localhost"].includes(requested.hostname))
+            return false;
+        const sameHost = returned.hostname === requested.hostname;
+        const normalizedIpv4 = requested.hostname === "127.0.0.1" && returned.hostname === "localhost" && returned.port === "";
+        if (!sameHost && !normalizedIpv4)
+            return false;
+        returned.hostname = requested.hostname;
+        returned.port = requested.port;
+        return returned.href === requested.href;
+    });
+}

package/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -1,4 +1,5 @@
-import { normalizeStoredOAuthClient, parseOAuthClientRegistration } from "./client-registration.js";
+import { createResourceBoundOAuthStores } from "./resource-bound-store.js";
+import { normalizeStoredOAuthClient, parseOAuthClientRegistration, registrationMatchesRedirect } from "./client-registration.js";
 import { normalizeOAuthScope } from "./scope.js";
 import { normalizeOAuthTokenEndpointAuthMethod } from "./token-auth-method.js";
 import { isIP } from "node:net";
@@ -26,8 +27,13 @@ export function createDefaultOAuthClientProvider(options) {
     const configuredClient = normalizeConfiguredClient(options.client);
     const requestedTokenMethod = normalizeOAuthTokenEndpointAuthMethod(options.client.tokenEndpointAuthMethod);
     const configuredTokenMethod = requestedTokenMethod ?? configuredClient?.tokenEndpointAuthMethod;
-    const sessionStore = options.sessionStore ?? createAuthStoreSessionStore(options.authStore, options.persistenceNamespace);
-    const clientStore = options.authStore === undefined ? null : createAuthStoreClientStore(options.authStore, options.persistenceNamespace);
+    if (options.resourceIdentity !== undefined && options.sessionStore !== undefined)
+        throw new Error("OAuth resourceIdentity requires native-owned persistence; custom stores own their resource trust policy");
+    const resourceStores = options.resourceIdentity === undefined ? undefined :
+        createResourceBoundOAuthStores(options.authStore ?? {}, options.persistenceNamespace, options.resourceIdentity);
+    const sessionStore = resourceStores?.sessionStore ?? options.sessionStore ?? createAuthStoreSessionStore(options.authStore, options.persistenceNamespace);
+    const clientStore = resourceStores?.clientStore ??
+        (options.authStore === undefined ? null : createAuthStoreClientStore(options.authStore, options.persistenceNamespace));
     const now = options.now ?? Date.now;
     const registeredClients = new Map();
     if (options.initialGrant !== undefined) {
@@ -127,6 +133,11 @@ export function createDefaultOAuthClientProvider(options) {
         const canonicalResource = canonicalizeResourceIndicator(resource);
         return withOAuthSessionTransaction(sessionStore, canonicalResource, async () => {
             let session = await loadSession(canonicalResource);
+            if (resourceStores !== undefined) {
+                registeredClients.clear();
+                if (!resourceStores.initialGrantAllowed)
+                    initialGrantConsumed = true;
+            }
             if (session !== null)
                 assertRegistrationIssuer(session.client, session.authorizationServer);
             if (configuredClient !== null && discovery !== undefined)
@@ -372,7 +383,7 @@ export function createDefaultOAuthClientProvider(options) {
         let storedClient = await loadRegisteredClient(discovery.authorizationServer);
         if (storedClient !== null) {
             assertRegistrationIssuer(storedClient, discovery.authorizationServer);
-            if (hasExpiredClientSecret(storedClient, now)) {
+            if (hasExpiredClientSecret(storedClient, now) || !registrationMatchesRedirect(storedClient, redirectUri)) {
                 await clearRegisteredClient(discovery.authorizationServer);
                 storedClient = null;
             }
@@ -385,7 +396,7 @@ export function createDefaultOAuthClientProvider(options) {
             };
         }
         if (registrationEndpoint === undefined) {
-            if (existingSession !== null && existingSession.client.clientId.length > 0 && !hasExpiredClientSecret(existingSession.client, now)) {
+            if (existingSession !== null && existingSession.client.clientId.length > 0 && !hasExpiredClientSecret(existingSession.client, now) && registrationMatchesRedirect(existingSession.client, redirectUri)) {
                 return {
                     kind: "dynamic",
                     fromStoredRegistration: true,
@@ -394,7 +405,7 @@ export function createDefaultOAuthClientProvider(options) {
             }
             throw new Error("Authorization server metadata is missing registration_endpoint");
         }
-        if (existingSession !== null && existingSession.client.clientId.length > 0 && !hasExpiredClientSecret(existingSession.client, now)) {
+        if (existingSession !== null && existingSession.client.clientId.length > 0 && !hasExpiredClientSecret(existingSession.client, now) && registrationMatchesRedirect(existingSession.client, redirectUri)) {
             const isConfiguredStaticFallback = configuredClient !== null &&
                 existingSession.client.clientId === configuredClient.clientId &&
                 existingSession.client.clientSecret === configuredClient.clientSecret;
@@ -437,11 +448,14 @@ export function createDefaultOAuthClientProvider(options) {
         assertRegistrationIssuer(registeredClient, discovery.authorizationServer);
         if (hasExpiredClientSecret(registeredClient, now))
             throw new Error("OAuth client secret has expired in the registration response");
-        await saveRegisteredClient(discovery.authorizationServer, registeredClient);
+        if (!registrationMatchesRedirect(registeredClient, redirectUri, true))
+            throw new Error("OAuth registration response does not match the requested redirect URI");
+        const clientWithRedirect = { ...registeredClient, requestedRedirectUri: redirectUri };
+        await saveRegisteredClient(discovery.authorizationServer, clientWithRedirect);
         return {
             kind: "dynamic",
             fromStoredRegistration: false,
-            client: registeredClient
+            client: clientWithRedirect
         };
     }
     async function loadSession(resource) {

package/node_modules/mcp-oauth/dist/client/resource-bound-store.d.ts

@@ -0,0 +1,9 @@
+import type { CreateSecretStoreInput } from "auth-store";
+import { type OAuthClientStore } from "./auth-store-session-store.js";
+import type { OAuthSessionStore } from "./types.js";
+/** One locked document owns a logical server's URL history, grant and clients. */
+export declare function createResourceBoundOAuthStores(options: CreateSecretStoreInput, namespace: string | undefined, identity: string): {
+    sessionStore: OAuthSessionStore;
+    clientStore: OAuthClientStore;
+    initialGrantAllowed: boolean;
+};

package/node_modules/mcp-oauth/dist/client/resource-bound-store.js

@@ -0,0 +1,108 @@
+import { canonicalizeResourceIndicator } from "../resource-indicator.js";
+import { assertPersistenceNamespace, createNamedSecretStore, isStoredOAuthSession } from "./auth-store-session-store.js";
+import { normalizeStoredOAuthClient } from "./client-registration.js";
+/** One locked document owns a logical server's URL history, grant and clients. */
+export function createResourceBoundOAuthStores(options, namespace, identity) {
+    assertPersistenceNamespace(identity);
+    const store = createNamedSecretStore(identity, options, { salt: "poe-code:mcp-oauth:resources:v1",
+        directory: ".poe-code/mcp-oauth/resources", service: "poe-code-mcp-oauth-resources", accountPrefix: "resource" }, namespace);
+    const result = { initialGrantAllowed: true, sessionStore: {}, clientStore: {} };
+    async function read() {
+        const raw = await store.get();
+        if (raw === null)
+            return null;
+        let value;
+        try {
+            value = JSON.parse(raw);
+        }
+        catch {
+            throw new Error("Stored OAuth resource identity must be valid JSON; reset explicitly to recover");
+        }
+        if (typeof value !== "object" || value === null || Array.isArray(value))
+            throw new Error("Invalid stored OAuth resource identity");
+        const record = value;
+        if (!["version", "resource", "generation", "session", "clients"].every(key => Object.hasOwn(record, key)) || record.version !== 1 || typeof record.resource !== "string" || record.resource !== canonicalizeResourceIndicator(record.resource) ||
+            !Number.isSafeInteger(record.generation) || record.generation < 0 ||
+            (record.session !== null && (!isStoredOAuthSession(record.session) || record.session.resource !== record.resource)) ||
+            typeof record.clients !== "object" || record.clients === null || Array.isArray(record.clients))
+            throw new Error("Invalid stored OAuth resource identity; reset explicitly to recover");
+        let resourceUrl;
+        try {
+            resourceUrl = new URL(record.resource);
+        }
+        catch {
+            throw new Error("Invalid stored OAuth resource identity URL");
+        }
+        if (!["http:", "https:"].includes(resourceUrl.protocol) || resourceUrl.username || resourceUrl.password || resourceUrl.hash)
+            throw new Error("Invalid stored OAuth resource identity URL");
+        for (const [issuer, client] of Object.entries(record.clients)) {
+            const normalized = normalizeStoredOAuthClient(client);
+            let url;
+            try {
+                url = new URL(issuer);
+            }
+            catch {
+                throw new Error("Invalid stored OAuth resource client issuer");
+            }
+            if (normalized === null || !["http:", "https:"].includes(url.protocol) || url.username || url.password || url.hash)
+                throw new Error("Invalid stored OAuth resource client");
+            Object.defineProperty(record.clients, issuer, { value: normalized, enumerable: true, configurable: true, writable: true });
+        }
+        return record;
+    }
+    async function reconcile(resource) {
+        resource = canonicalizeResourceIndicator(resource);
+        const existing = await read();
+        if (existing?.resource === resource) {
+            result.initialGrantAllowed = existing.generation === 0;
+            return existing;
+        }
+        const record = { version: 1, resource, generation: existing === null ? 0 : existing.generation + 1, session: null, clients: {} };
+        if (!Number.isSafeInteger(record.generation))
+            throw new Error("OAuth resource identity generation limit exceeded");
+        await store.set(JSON.stringify(record));
+        result.initialGrantAllowed = record.generation === 0;
+        return record;
+    }
+    result.sessionStore = {
+        async withLock(_resource, operation, options) {
+            if (store.withLock === undefined)
+                throw new Error("OAuth resource identity backend must support transaction locks");
+            return store.withLock(operation, options);
+        },
+        async load(resource) { return (await reconcile(resource)).session; },
+        async save(resource, session) {
+            const record = await reconcile(resource);
+            if (canonicalizeResourceIndicator(session.resource) !== record.resource)
+                throw new Error("OAuth session does not match its resource identity");
+            record.session = session;
+            await store.set(JSON.stringify(record));
+        },
+        async clear(resource) {
+            const record = await reconcile(resource);
+            record.session = null;
+            // Preserve a tombstone so environment grants cannot revive a cleared family.
+            record.generation = Math.max(1, record.generation);
+            result.initialGrantAllowed = false;
+            await store.set(JSON.stringify(record));
+        }
+    };
+    result.clientStore = {
+        async load(issuer) { const record = await read(); return record !== null && Object.hasOwn(record.clients, issuer) ? record.clients[issuer] : null; },
+        async save(issuer, client) {
+            const record = await read();
+            if (record === null)
+                throw new Error("OAuth resource identity must be bound before registering a client");
+            Object.defineProperty(record.clients, issuer, { value: client, enumerable: true, configurable: true, writable: true });
+            await store.set(JSON.stringify(record));
+        },
+        async clear(issuer) {
+            const record = await read();
+            if (record === null || !Object.hasOwn(record.clients, issuer))
+                return;
+            delete record.clients[issuer];
+            await store.set(JSON.stringify(record));
+        }
+    };
+    return result;
+}

package/node_modules/mcp-oauth/dist/client/types.d.ts

@@ -92,6 +92,8 @@ export interface OAuthClientRegistration extends Record<string, unknown> {
 }
 export interface StoredOAuthClient {
     clientId: string;
+    /** Actual listener URI submitted when this native client was registered. */
+    requestedRedirectUri?: string;
     clientSecret?: string;
     registration?: OAuthClientRegistration;
     tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
@@ -145,6 +147,8 @@ export interface DefaultOAuthClientProviderOptions {
     sessionLockTimeoutMs?: number;
     /** Isolate native persisted sessions and registrations for a named profile. */
     persistenceNamespace?: string;
+    /** Native-owned durable logical server identity; changing URL retires its credentials. */
+    resourceIdentity?: string;
     /** Import an existing grant for one resource. Persisted sessions take precedence. */
     initialGrant?: {
         resource: string;

package/node_modules/tiny-mcp-client/dist/index.d.ts

@@ -195,6 +195,8 @@ interface OAuthClientRegistration extends Record<string, unknown> {
 }
 interface StoredOAuthClient {
     clientId: string;
+    /** Actual listener URI submitted when this native client was registered. */
+    requestedRedirectUri?: string;
     clientSecret?: string;
     registration?: OAuthClientRegistration;
     tokenEndpointAuthMethod?: OAuthTokenEndpointAuthMethod;
@@ -248,6 +250,8 @@ interface DefaultOAuthClientProviderOptions {
     sessionLockTimeoutMs?: number;
     /** Isolate native persisted sessions and registrations for a named profile. */
     persistenceNamespace?: string;
+    /** Native-owned durable logical server identity; changing URL retires its credentials. */
+    resourceIdentity?: string;
     /** Import an existing grant for one resource. Persisted sessions take precedence. */
     initialGrant?: {
         resource: string;