tiny-http-mcp-server 0.1.64 → 0.1.65

package/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.64",
+      "version": "0.1.65",
       "license": "MIT"
     },
     {

package/node_modules/mcp-oauth/README.md

@@ -94,6 +94,13 @@ accept the same `redirectUri`, `signal` and `timeoutMs` options. Cancellation,
 timeout and explicit close settle pending code waits and release listeners.
 Always close a successful standalone session in `finally`.
 
+Native provider calls capture request option handles before host work. Unauthorized
+handling also owns complete discovery metadata, presented grant values, rejected
+request headers and the selected challenge error before reading persistence.
+A browser callback cannot redirect a later code exchange by changing caller
+metadata. Explicit authentication owns metadata when lazy discovery returns;
+the selected discovery method retains its original receiver and live host state.
+
 Provider request inputs accept an optional `signal`. It reaches callback waits,
 registration, token requests and bounded token-body reads. Cancellation retains
 its original reason and does not retry authorization. Native provider calls

package/node_modules/mcp-oauth/dist/client/default-oauth-client-provider.js

@@ -73,6 +73,7 @@ export function createDefaultOAuthClientProvider(options) {
     let initialGrantConsumed = false;
     return {
         async authenticate(input) {
+            input = { ...input, ...(input.discover === undefined ? {} : { discover: input.discover.bind(input) }) };
             input.signal?.throwIfAborted();
             assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
             const resource = canonicalizeResourceIndicator(input.requestUrl);
@@ -84,7 +85,7 @@ export function createDefaultOAuthClientProvider(options) {
                 return { ...initialGrant.tokens };
             if (input.discover === undefined)
                 return;
-            const discovery = await waitForOAuthOperation(input.discover(), input.signal);
+            const discovery = structuredClone(await waitForOAuthOperation(input.discover(), input.signal));
             input.signal?.throwIfAborted();
             assertRequestMatchesResource(resource, canonicalizeResourceIndicator(discovery.resource));
             session = await ensureAuthorizedSession(resource, discovery, input.fetch, true, false, input.signal);
@@ -93,6 +94,7 @@ export function createDefaultOAuthClientProvider(options) {
             return { ...session.tokens };
         },
         async authorizeRequest(input) {
+            input = { ...input };
             assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
             const requestUrl = canonicalizeResourceIndicator(input.requestUrl);
             const session = await ensureAuthorizedSession(requestUrl, undefined, input.fetch, false, false, input.signal);
@@ -113,8 +115,16 @@ export function createDefaultOAuthClientProvider(options) {
             return { ...session.tokens };
         },
         async handleUnauthorized(input) {
+            input = { ...input };
             try {
                 input.signal?.throwIfAborted();
+                const presented = input.presentedTokens == null ? input.presentedTokens : normalizeStoredTokens(input.presentedTokens);
+                if (input.presentedTokens != null && presented === undefined)
+                    throw new Error("OAuth rejected-request provenance does not match its authorization header");
+                const challengeError = input.challenge?.params.error;
+                input = { ...input, discovery: structuredClone(input.discovery),
+                    ...(input.requestHeaders === undefined ? {} : { requestHeaders: new Headers(input.requestHeaders) }),
+                    ...(presented === undefined ? {} : { presentedTokens: presented }) };
                 assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
                 const requestUrl = canonicalizeResourceIndicator(input.requestUrl);
                 const resource = canonicalizeResourceIndicator(input.discovery.resource);
@@ -126,16 +136,15 @@ export function createDefaultOAuthClientProvider(options) {
                 if (input.presentedTokens !== undefined) {
                     rejectedCurrentGrant = false;
                     if (input.presentedTokens !== null) {
-                        const presented = normalizeStoredTokens(input.presentedTokens);
+                        const presented = input.presentedTokens;
                         const header = input.requestHeaders?.get("Authorization") ?? "";
                         const separator = header.indexOf(" ");
-                        if (presented === undefined || header.slice(0, separator).toLowerCase() !== "bearer" || header.slice(separator + 1).trim() !== presented.accessToken)
+                        if (header.slice(0, separator).toLowerCase() !== "bearer" || header.slice(separator + 1).trim() !== presented.accessToken)
                             throw new Error("OAuth rejected-request provenance does not match its authorization header");
                         presentedTokens = presented;
                         rejectedCurrentGrant = currentTokens !== undefined && sameTokenGrant(currentTokens, presented);
                     }
                 }
-                const challengeError = input.challenge?.params.error;
                 const forceRefresh = rejectedCurrentGrant && (challengeError === "invalid_token" || (input.presentedTokens !== undefined && challengeError === undefined));
                 const session = await ensureAuthorizedSession(resource, {
                     ...input.discovery,

package/node_modules/tiny-mcp-client/dist/index.js

@@ -5335,6 +5335,7 @@ function createDefaultOAuthClientProvider(options) {
   let initialGrantConsumed = false;
   return {
     async authenticate(input) {
+      input = { ...input, ...input.discover === void 0 ? {} : { discover: input.discover.bind(input) } };
       input.signal?.throwIfAborted();
       assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
       const resource = canonicalizeResourceIndicator(input.requestUrl);
@@ -5345,7 +5346,7 @@ function createDefaultOAuthClientProvider(options) {
         return { ...initialGrant.tokens };
       if (input.discover === void 0)
         return;
-      const discovery = await waitForOAuthOperation(input.discover(), input.signal);
+      const discovery = structuredClone(await waitForOAuthOperation(input.discover(), input.signal));
       input.signal?.throwIfAborted();
       assertRequestMatchesResource(resource, canonicalizeResourceIndicator(discovery.resource));
       session = await ensureAuthorizedSession(resource, discovery, input.fetch, true, false, input.signal);
@@ -5354,6 +5355,7 @@ function createDefaultOAuthClientProvider(options) {
       return { ...session.tokens };
     },
     async authorizeRequest(input) {
+      input = { ...input };
       assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
       const requestUrl = canonicalizeResourceIndicator(input.requestUrl);
       const session = await ensureAuthorizedSession(requestUrl, void 0, input.fetch, false, false, input.signal);
@@ -5370,8 +5372,19 @@ function createDefaultOAuthClientProvider(options) {
       return { ...session.tokens };
     },
     async handleUnauthorized(input) {
+      input = { ...input };
       try {
         input.signal?.throwIfAborted();
+        const presented = input.presentedTokens == null ? input.presentedTokens : normalizeStoredTokens(input.presentedTokens);
+        if (input.presentedTokens != null && presented === void 0)
+          throw new Error("OAuth rejected-request provenance does not match its authorization header");
+        const challengeError = input.challenge?.params.error;
+        input = {
+          ...input,
+          discovery: structuredClone(input.discovery),
+          ...input.requestHeaders === void 0 ? {} : { requestHeaders: new Headers(input.requestHeaders) },
+          ...presented === void 0 ? {} : { presentedTokens: presented }
+        };
         assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
         const requestUrl = canonicalizeResourceIndicator(input.requestUrl);
         const resource = canonicalizeResourceIndicator(input.discovery.resource);
@@ -5383,16 +5396,15 @@ function createDefaultOAuthClientProvider(options) {
         if (input.presentedTokens !== void 0) {
           rejectedCurrentGrant = false;
           if (input.presentedTokens !== null) {
-            const presented = normalizeStoredTokens(input.presentedTokens);
+            const presented2 = input.presentedTokens;
             const header = input.requestHeaders?.get("Authorization") ?? "";
             const separator = header.indexOf(" ");
-            if (presented === void 0 || header.slice(0, separator).toLowerCase() !== "bearer" || header.slice(separator + 1).trim() !== presented.accessToken)
+            if (header.slice(0, separator).toLowerCase() !== "bearer" || header.slice(separator + 1).trim() !== presented2.accessToken)
               throw new Error("OAuth rejected-request provenance does not match its authorization header");
-            presentedTokens = presented;
-            rejectedCurrentGrant = currentTokens !== void 0 && sameTokenGrant(currentTokens, presented);
+            presentedTokens = presented2;
+            rejectedCurrentGrant = currentTokens !== void 0 && sameTokenGrant(currentTokens, presented2);
           }
         }
-        const challengeError = input.challenge?.params.error;
         const forceRefresh = rejectedCurrentGrant && (challengeError === "invalid_token" || input.presentedTokens !== void 0 && challengeError === void 0);
         const session = await ensureAuthorizedSession(resource, {
           ...input.discovery,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.64",
+  "version": "0.1.65",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",