Mattsson
16164ea14c
* feat(voucher): add create voucher and correct entry previews; update commit methods * feat: add support for pending operations in API key scopes and OAuth client management - Introduced new API key scopes for reading and approving pending operations. - Updated the scope groups to include pending operations. - Added new tools for listing and managing pending operations. - Implemented OAuth client registration and revocation endpoints. - Created a UI panel for managing OAuth clients, including registration and revocation. - Added tests for pending operations tools and OAuth allowlist functionality. - Implemented a database migration for OAuth client registrations with appropriate policies and constraints. * feat: Implement OAuth client registration rate limiting and enhance security measures - Added IP-based rate limiting to the OAuth client registration endpoint to prevent enumeration attacks. - Introduced a service-role client for allowlist lookups, ensuring trust boundaries are maintained. - Updated error responses to be uniform across different types of redirect URI validation failures. - Enhanced tests to reflect changes in OAuth scope handling, ensuring fallback to read-only scopes when no scopes are provided. - Improved handling of high-risk pending operations, requiring explicit confirmation for approvals. - Added audit logging for OAuth client revocations and pending operation approvals/rejections to maintain a security audit trail. - Refactored API key scope management to include default read-only scopes for OAuth-issued keys and added segregation-of-duties checks.
28 lines
1.2 KiB
TypeScript
28 lines
1.2 KiB
TypeScript
import { NextResponse } from 'next/server'
|
|
import { PUBLIC_OAUTH_METADATA_SCOPES } from '@/lib/auth/api-keys'
|
|
|
|
/**
|
|
* RFC 8414 — OAuth 2.0 Authorization Server Metadata.
|
|
* Tells MCP clients where the authorize/token endpoints are.
|
|
*/
|
|
export async function GET() {
|
|
const appUrl = process.env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000'
|
|
|
|
return NextResponse.json({
|
|
issuer: appUrl,
|
|
authorization_endpoint: `${appUrl}/api/mcp-oauth/authorize`,
|
|
token_endpoint: `${appUrl}/api/mcp-oauth/token`,
|
|
registration_endpoint: `${appUrl}/api/mcp-oauth/register`,
|
|
response_types_supported: ['code'],
|
|
grant_types_supported: ['authorization_code', 'refresh_token'],
|
|
code_challenge_methods_supported: ['S256'],
|
|
token_endpoint_auth_methods_supported: ['none', 'client_secret_post'],
|
|
// Advertise only the safe read-only default scopes plus the coarse
|
|
// `mcp` marker. Destructive scopes (*:write, pending_operations:approve,
|
|
// bookkeeping:write) are still accepted by /authorize when requested
|
|
// explicitly, but enumerating them in public discovery aids
|
|
// scope-escalation reconnaissance (CC6.1, defense-in-depth).
|
|
scopes_supported: ['mcp', ...PUBLIC_OAUTH_METADATA_SCOPES],
|
|
})
|
|
}
|