update

node_modules/@modelcontextprotocol/sdk/dist/esm/server/auth/providers/proxyProvider.d.ts

@@ -0,0 +1,49 @@
+import { Response } from 'express';
+import { OAuthRegisteredClientsStore } from '../clients.js';
+import { OAuthClientInformationFull, OAuthTokenRevocationRequest, OAuthTokens } from '../../../shared/auth.js';
+import { AuthInfo } from '../types.js';
+import { AuthorizationParams, OAuthServerProvider } from '../provider.js';
+import { FetchLike } from '../../../shared/transport.js';
+export type ProxyEndpoints = {
+    authorizationUrl: string;
+    tokenUrl: string;
+    revocationUrl?: string;
+    registrationUrl?: string;
+};
+export type ProxyOptions = {
+    /**
+     * Individual endpoint URLs for proxying specific OAuth operations
+     */
+    endpoints: ProxyEndpoints;
+    /**
+     * Function to verify access tokens and return auth info
+     */
+    verifyAccessToken: (token: string) => Promise<AuthInfo>;
+    /**
+     * Function to fetch client information from the upstream server
+     */
+    getClient: (clientId: string) => Promise<OAuthClientInformationFull | undefined>;
+    /**
+     * Custom fetch implementation used for all network requests.
+     */
+    fetch?: FetchLike;
+};
+/**
+ * Implements an OAuth server that proxies requests to another OAuth server.
+ */
+export declare class ProxyOAuthServerProvider implements OAuthServerProvider {
+    protected readonly _endpoints: ProxyEndpoints;
+    protected readonly _verifyAccessToken: (token: string) => Promise<AuthInfo>;
+    protected readonly _getClient: (clientId: string) => Promise<OAuthClientInformationFull | undefined>;
+    protected readonly _fetch?: FetchLike;
+    skipLocalPkceValidation: boolean;
+    revokeToken?: (client: OAuthClientInformationFull, request: OAuthTokenRevocationRequest) => Promise<void>;
+    constructor(options: ProxyOptions);
+    get clientsStore(): OAuthRegisteredClientsStore;
+    authorize(client: OAuthClientInformationFull, params: AuthorizationParams, res: Response): Promise<void>;
+    challengeForAuthorizationCode(_client: OAuthClientInformationFull, _authorizationCode: string): Promise<string>;
+    exchangeAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string, codeVerifier?: string, redirectUri?: string, resource?: URL): Promise<OAuthTokens>;
+    exchangeRefreshToken(client: OAuthClientInformationFull, refreshToken: string, scopes?: string[], resource?: URL): Promise<OAuthTokens>;
+    verifyAccessToken(token: string): Promise<AuthInfo>;
+}
+//# sourceMappingURL=proxyProvider.d.ts.map

node_modules/@modelcontextprotocol/sdk/dist/esm/server/auth/providers/proxyProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxyProvider.d.ts","sourceRoot":"","sources":["../../../../../src/server/auth/providers/proxyProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EACH,0BAA0B,EAE1B,2BAA2B,EAC3B,WAAW,EAEd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE1E,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAEzD,MAAM,MAAM,cAAc,GAAG;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACvB;;OAEG;IACH,SAAS,EAAE,cAAc,CAAC;IAE1B;;OAEG;IACH,iBAAiB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAExD;;OAEG;IACH,SAAS,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC,CAAC;IAEjF;;OAEG;IACH,KAAK,CAAC,EAAE,SAAS,CAAC;CACrB,CAAC;AAEF;;GAEG;AACH,qBAAa,wBAAyB,YAAW,mBAAmB;IAChE,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IAC9C,SAAS,CAAC,QAAQ,CAAC,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5E,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC,CAAC;IACrG,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAEtC,uBAAuB,UAAQ;IAE/B,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,0BAA0B,EAAE,OAAO,EAAE,2BAA2B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;gBAE9F,OAAO,EAAE,YAAY;IAuCjC,IAAI,YAAY,IAAI,2BAA2B,CAwB9C;IAEK,SAAS,CAAC,MAAM,EAAE,0BAA0B,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBxG,6BAA6B,CAAC,OAAO,EAAE,0BAA0B,EAAE,kBAAkB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAM/G,yBAAyB,CAC3B,MAAM,EAAE,0BAA0B,EAClC,iBAAiB,EAAE,MAAM,EACzB,YAAY,CAAC,EAAE,MAAM,EACrB,WAAW,CAAC,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,GAAG,GACf,OAAO,CAAC,WAAW,CAAC;IAwCjB,oBAAoB,CACtB,MAAM,EAAE,0BAA0B,EAClC,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,MAAM,EAAE,EACjB,QAAQ,CAAC,EAAE,GAAG,GACf,OAAO,CAAC,WAAW,CAAC;IAoCjB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;CAG5D"}

node_modules/@modelcontextprotocol/sdk/dist/esm/server/auth/providers/proxyProvider.js

@@ -0,0 +1,155 @@
+import { OAuthClientInformationFullSchema, OAuthTokensSchema } from '../../../shared/auth.js';
+import { ServerError } from '../errors.js';
+/**
+ * Implements an OAuth server that proxies requests to another OAuth server.
+ */
+export class ProxyOAuthServerProvider {
+    constructor(options) {
+        this.skipLocalPkceValidation = true;
+        this._endpoints = options.endpoints;
+        this._verifyAccessToken = options.verifyAccessToken;
+        this._getClient = options.getClient;
+        this._fetch = options.fetch;
+        if (options.endpoints?.revocationUrl) {
+            this.revokeToken = async (client, request) => {
+                const revocationUrl = this._endpoints.revocationUrl;
+                if (!revocationUrl) {
+                    throw new Error('No revocation endpoint configured');
+                }
+                const params = new URLSearchParams();
+                params.set('token', request.token);
+                params.set('client_id', client.client_id);
+                if (client.client_secret) {
+                    params.set('client_secret', client.client_secret);
+                }
+                if (request.token_type_hint) {
+                    params.set('token_type_hint', request.token_type_hint);
+                }
+                const response = await (this._fetch ?? fetch)(revocationUrl, {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/x-www-form-urlencoded'
+                    },
+                    body: params.toString()
+                });
+                await response.body?.cancel();
+                if (!response.ok) {
+                    throw new ServerError(`Token revocation failed: ${response.status}`);
+                }
+            };
+        }
+    }
+    get clientsStore() {
+        const registrationUrl = this._endpoints.registrationUrl;
+        return {
+            getClient: this._getClient,
+            ...(registrationUrl && {
+                registerClient: async (client) => {
+                    const response = await (this._fetch ?? fetch)(registrationUrl, {
+                        method: 'POST',
+                        headers: {
+                            'Content-Type': 'application/json'
+                        },
+                        body: JSON.stringify(client)
+                    });
+                    if (!response.ok) {
+                        await response.body?.cancel();
+                        throw new ServerError(`Client registration failed: ${response.status}`);
+                    }
+                    const data = await response.json();
+                    return OAuthClientInformationFullSchema.parse(data);
+                }
+            })
+        };
+    }
+    async authorize(client, params, res) {
+        // Start with required OAuth parameters
+        const targetUrl = new URL(this._endpoints.authorizationUrl);
+        const searchParams = new URLSearchParams({
+            client_id: client.client_id,
+            response_type: 'code',
+            redirect_uri: params.redirectUri,
+            code_challenge: params.codeChallenge,
+            code_challenge_method: 'S256'
+        });
+        // Add optional standard OAuth parameters
+        if (params.state)
+            searchParams.set('state', params.state);
+        if (params.scopes?.length)
+            searchParams.set('scope', params.scopes.join(' '));
+        if (params.resource)
+            searchParams.set('resource', params.resource.href);
+        targetUrl.search = searchParams.toString();
+        res.redirect(targetUrl.toString());
+    }
+    async challengeForAuthorizationCode(_client, _authorizationCode) {
+        // In a proxy setup, we don't store the code challenge ourselves
+        // Instead, we proxy the token request and let the upstream server validate it
+        return '';
+    }
+    async exchangeAuthorizationCode(client, authorizationCode, codeVerifier, redirectUri, resource) {
+        const params = new URLSearchParams({
+            grant_type: 'authorization_code',
+            client_id: client.client_id,
+            code: authorizationCode
+        });
+        if (client.client_secret) {
+            params.append('client_secret', client.client_secret);
+        }
+        if (codeVerifier) {
+            params.append('code_verifier', codeVerifier);
+        }
+        if (redirectUri) {
+            params.append('redirect_uri', redirectUri);
+        }
+        if (resource) {
+            params.append('resource', resource.href);
+        }
+        const response = await (this._fetch ?? fetch)(this._endpoints.tokenUrl, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded'
+            },
+            body: params.toString()
+        });
+        if (!response.ok) {
+            await response.body?.cancel();
+            throw new ServerError(`Token exchange failed: ${response.status}`);
+        }
+        const data = await response.json();
+        return OAuthTokensSchema.parse(data);
+    }
+    async exchangeRefreshToken(client, refreshToken, scopes, resource) {
+        const params = new URLSearchParams({
+            grant_type: 'refresh_token',
+            client_id: client.client_id,
+            refresh_token: refreshToken
+        });
+        if (client.client_secret) {
+            params.set('client_secret', client.client_secret);
+        }
+        if (scopes?.length) {
+            params.set('scope', scopes.join(' '));
+        }
+        if (resource) {
+            params.set('resource', resource.href);
+        }
+        const response = await (this._fetch ?? fetch)(this._endpoints.tokenUrl, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded'
+            },
+            body: params.toString()
+        });
+        if (!response.ok) {
+            await response.body?.cancel();
+            throw new ServerError(`Token refresh failed: ${response.status}`);
+        }
+        const data = await response.json();
+        return OAuthTokensSchema.parse(data);
+    }
+    async verifyAccessToken(token) {
+        return this._verifyAccessToken(token);
+    }
+}
+//# sourceMappingURL=proxyProvider.js.map