Authorize access

Signed in as ${escapeHtml(PERSONAL_USER.email)} (sub: ${escapeHtml(PERSONAL_USER.sub)})

Client ${escapeHtml(q.client_id)} is requesting:

${escapeHtml(q.scope || \"(no scopes requested)\")}

\n\n

`);\n});\n\napp.post(\"/authorize\", async (c) => {\n const form = await c.req.parseBody();\n const q: Record = {};\n for (const k of AUTHZ_PARAMS) if (typeof form[k] === \"string\") q[k] = form[k] as string;\n if (!q.client_id || !q.redirect_uri) {\n return c.json({ error: \"invalid_request\", error_description: \"client_id and redirect_uri are required\" }, 400);\n }\n const check = await checkAuthorizeRequest(q);\n if (!check.ok) {\n console.error(\"[as2] /authorize (POST) rejected:\", { ...check, client_id: q.client_id, redirect_uri: q.redirect_uri, resource: q.resource });\n return c.json({ error: check.error, error_description: check.description }, 400);\n }\n\n const code = await new jose.SignJWT({\n use: \"authorization_code\",\n client_id: q.client_id,\n redirect_uri: q.redirect_uri,\n resource: q.resource ?? RESOURCES[0],\n ...(q.scope ? { scope: q.scope } : {}),\n ...(q.code_challenge ? { code_challenge: q.code_challenge } : {}),\n })\n .setProtectedHeader({ alg: \"ES256\", kid: kp.kid })\n .setIssuer(URLS.as2)\n .setAudience(`${URLS.as2}/token`)\n .setSubject(PERSONAL_USER.sub)\n .setIssuedAt()\n .setExpirationTime(\"5m\")\n .sign(kp.privateKey);\n\n const target = new URL(q.redirect_uri);\n target.searchParams.set(\"code\", code);\n if (q.state) target.searchParams.set(\"state\", q.state);\n console.log(\"[as2] /authorize approved:\", { client_id: q.client_id, redirect_uri: q.redirect_uri, resource: q.resource, scope: q.scope });\n return c.redirect(target.toString(), 302);\n});\n\n// ─── /register — bring your own client_id ───────────────────────────────────\n// You bring the client_id your IdP will stamp in the JAG (for Okta: the\n// resource app's Okta-issued id; for the demo IdP: your idp_id_...). We give\n// you back a secret bound to (idp_issuer, that_client_id, resource). The\n// secret IS the trust decision — at /token we re-derive it from the JAG's\n// iss + client_id + resource and it has to match.\n\nconst RESOURCES = [`${URLS.rs2}/mcp`];\n\napp.get(\"/register\", (c) =>\n c.html(`Register — AS2\n\n

Register at AS2

You bring the client_id — whatever your IdP stamps in the JAG's client_id claim. For Okta that's the resource app's Okta client_id (e.g. 0oa10m6h81mEkTVXn698). For the demo IdP it's your idp_id_....

We bind a secret to (idp_issuer, client_id, resource). At /token we re-derive the secret from the JAG claims — that's the trust gate. No separate issuer allowlist.

\n`));\n\napp.post(\"/register\", async (c) => {\n const contentType = c.req.header(\"Content-Type\") ?? \"\";\n\n // RFC 7591 DCR (JSON) — toolbox hits this via get_or_register_client_credentials.\n // We don't know the issuer or resource from a standard DCR body, so assume\n // claude.ai + the single RS we front. The derived secret is stateless and\n // will re-derive identically at /token from (JAG.iss, client_id, body.resource).\n if (contentType.includes(\"application/json\")) {\n const body = await c.req.json(); // consume + ignore body (redirect_uris, grant_types, etc.)\n const clientId = `claude_${crypto.randomUUID().slice(0, 12)}`;\n const resource = RESOURCES[0];\n const clientSecret = await deriveAs2Secret(CLAUDE_AI_ISS, clientId, resource);\n return c.json({\n client_id: clientId,\n client_secret: clientSecret,\n client_id_issued_at: Math.floor(Date.now() / 1000),\n grant_types: [JWT_BEARER_GRANT],\n redirect_uris: body.redirect_uris ?? [],\n token_endpoint_auth_method: \"client_secret_post\",\n // echoed so the caller can sanity-check the binding if they care\n _issuer_binding: CLAUDE_AI_ISS,\n _resource_binding: resource,\n }, 201);\n }\n\n // Form POST — manual registration (Okta / demo-IdP path)\n const body = await c.req.parseBody();\n const idpIssuer = (body.idp_issuer as string)?.replace(/\\/$/, \"\");\n const jagClientId = body.jag_client_id as string;\n const resource = body.resource as string;\n if (!idpIssuer || !jagClientId || !resource) {\n return c.json({ error: \"invalid_request\", error_description: \"idp_issuer, jag_client_id, resource required\" }, 400);\n }\n const client_secret = await deriveAs2Secret(idpIssuer, jagClientId, resource);\n return c.json({ client_id: jagClientId, client_secret, idp_issuer: idpIssuer, resource });\n});\n\n// ─── /token — jwt-bearer ────────────────────────────────────────────────────\n// The secret IS the trust decision. Re-derive from JAG.iss + authenticating\n// client_id + resource; if the presented secret matches, you registered for\n// exactly this tuple. Then verify the JAG sig against that issuer's JWKS.\n\napp.post(\"/token\", async (c) => {\n const body = await c.req.parseBody();\n\n // ── authorization_code + PKCE — the CIMD path. The code is the JWT we\n // signed at /authorize, so verification is local; nothing to look up.\n if (body.grant_type === \"authorization_code\") {\n // Client auth on this grant is client_id binding only (the code is bound\n // to client_id; PKCE is the proof) — secrets aren't verified, so the\n // STATIC_TEST_CLIENT pair works here too.\n let cimdClientId = body.client_id as string | undefined;\n const basicAuthz = c.req.header(\"Authorization\");\n if (!cimdClientId && basicAuthz?.startsWith(\"Basic \")) {\n cimdClientId = decodeURIComponent(atob(basicAuthz.slice(6)).split(\":\")[0]);\n }\n const code = body.code as string | undefined;\n if (!cimdClientId || !code) {\n return c.json({ error: \"invalid_request\", error_description: \"client_id and code are required\" }, 400);\n }\n let codeClaims: jose.JWTPayload;\n try {\n ({ payload: codeClaims } = await jose.jwtVerify(code, kp.publicKey, {\n issuer: URLS.as2,\n audience: `${URLS.as2}/token`,\n }));\n } catch (e) {\n return c.json({ error: \"invalid_grant\", error_description: `invalid or expired code: ${e instanceof Error ? e.message : e}` }, 400);\n }\n if (codeClaims.client_id !== cimdClientId) {\n return c.json({ error: \"invalid_grant\", error_description: \"code was issued to a different client_id\" }, 400);\n }\n if (body.redirect_uri && body.redirect_uri !== codeClaims.redirect_uri) {\n return c.json({ error: \"invalid_grant\", error_description: \"redirect_uri mismatch\" }, 400);\n }\n if (codeClaims.code_challenge) {\n const verifier = body.code_verifier as string | undefined;\n if (!verifier) {\n return c.json({ error: \"invalid_grant\", error_description: \"code_verifier is required (PKCE)\" }, 400);\n }\n const digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(verifier));\n if (b64url(digest) !== codeClaims.code_challenge) {\n return c.json({ error: \"invalid_grant\", error_description: \"PKCE verification failed\" }, 400);\n }\n }\n const aud = (codeClaims.resource as string | undefined) ?? (body.resource as string | undefined) ?? RESOURCES[0];\n const scope = codeClaims.scope as string | undefined;\n const accessToken = await new jose.SignJWT({ client_id: cimdClientId, ...(scope ? { scope } : {}) })\n .setProtectedHeader({ alg: \"ES256\", kid: kp.kid })\n .setIssuer(URLS.as2)\n .setAudience(aud)\n .setSubject(codeClaims.sub!)\n .setIssuedAt()\n .setExpirationTime(\"1h\")\n .sign(kp.privateKey);\n console.log(\"[as2] /token authorization_code (CIMD):\", { client_id: cimdClientId, aud, scope });\n return c.json({ access_token: accessToken, token_type: \"Bearer\", expires_in: 3600, ...(scope ? { scope } : {}) });\n }\n\n if (body.grant_type !== JWT_BEARER_GRANT) {\n return c.json({ error: \"unsupported_grant_type\", error_description: String(body.grant_type) }, 400);\n }\n\n let clientId: string | undefined, clientSecret: string | undefined;\n const authz = c.req.header(\"Authorization\");\n if (authz?.startsWith(\"Basic \")) {\n const decoded = atob(authz.slice(6));\n const sep = decoded.indexOf(\":\");\n clientId = decodeURIComponent(decoded.slice(0, sep));\n clientSecret = decodeURIComponent(decoded.slice(sep + 1));\n } else {\n clientId = body.client_id as string;\n clientSecret = body.client_secret as string;\n }\n // CIMD clients (client_id = https URL) are public — no secret to present.\n const isCimdClient = !!clientId && !clientSecret && isCimdClientId(clientId);\n if (!clientId || (!clientSecret && !isCimdClient)) {\n return c.json({ error: \"invalid_client\", error_description: \"missing client credentials\" }, 401);\n }\n console.log(\"[as2] /token client auth:\", {\n via: isCimdClient ? \"cimd\" : authz?.startsWith(\"Basic \") ? \"basic\" : \"body\",\n client_id: clientId,\n secret_prefix: clientSecret ? clientSecret.slice(0, 12) + \"…\" : \"(none)\",\n body_resource: body.resource,\n body_scope: body.scope,\n });\n\n const assertion = body.assertion as string;\n if (!assertion) {\n return c.json({ error: \"invalid_request\", error_description: \"missing assertion\" }, 400);\n }\n\n // Spec draft says `typ: oauth-id-jag+jwt`. Okta sets it. PyJWT (toolbox)\n // defaults to `typ: JWT` — neither wrong per RFC 7523. Accept either or absent.\n const header = jose.decodeProtectedHeader(assertion);\n if (header.typ && header.typ !== ID_JAG_TYP && header.typ.toLowerCase() !== \"jwt\") {\n return c.json({ error: \"invalid_grant\", error_description: `typ must be ${ID_JAG_TYP} or JWT, got ${header.typ}` }, 400);\n }\n\n // Unsafe decode — sig verified below, AFTER the secret check proves we\n // trust this issuer for this client.\n const unverified = jose.decodeJwt(assertion);\n console.log(\"[as2] /token ID-JAG claims:\", { header: { typ: header.typ, alg: header.alg, kid: header.kid }, payload: unverified });\n const iss = (unverified.iss ?? \"\").replace(/\\/$/, \"\");\n if (!iss) {\n return c.json({ error: \"invalid_grant\", error_description: \"ID-JAG missing iss\" }, 400);\n }\n // Spec §3.1: `resource` in the JAG is OPTIONAL. Okta may omit it.\n // Fall back to the RFC 8707 request param — CC always sends it.\n const jagResource = (unverified.resource as string | undefined) ?? (body.resource as string | undefined);\n if (!jagResource) {\n return c.json({ error: \"invalid_grant\", error_description: \"no resource: ID-JAG omits the claim and request lacks the parameter\" }, 400);\n }\n\n // Spec binding — JAG says it's for client_id X, you must be authing as X.\n // Cheap check; do it before crypto.\n if (unverified.client_id !== clientId) {\n return c.json({\n error: \"invalid_grant\",\n error_description: `ID-JAG client_id (${unverified.client_id}) != authenticating client (${clientId})`,\n }, 400);\n }\n\n // Trust gate. CIMD clients have no registration step — the client_id binding\n // check above plus the JAG signature check below carry the trust, and the\n // metadata document has to dereference. Registered clients keep the\n // re-derived-secret gate: a match means you registered for exactly this tuple.\n if (clientId === STATIC_TEST_CLIENT.client_id && clientSecret === STATIC_TEST_CLIENT.client_secret) {\n // static test creds — tuple-independent; the JAG client_id binding above still applies\n } else if (isCimdClient) {\n try {\n await fetchCimd(clientId);\n } catch (e) {\n return c.json({ error: \"invalid_client\", error_description: `client metadata document fetch failed: ${e instanceof Error ? e.message : e}` }, 401);\n }\n } else if (clientSecret !== await deriveAs2Secret(iss, clientId, jagResource)) {\n return c.json({\n error: \"invalid_client\",\n error_description: `secret not bound to (iss=${iss}, client_id, resource). Register at ${URLS.as2}/register`,\n }, 401);\n }\n\n // Now we trust `iss` enough to fetch its keys.\n let claims: jose.JWTPayload;\n try {\n const { payload } = await jose.jwtVerify(assertion, await jwksFor(iss), {\n issuer: iss,\n // RFC 7523 §3 says token-endpoint URL MAY be the aud. Okta uses the\n // issuer URL; toolbox uses the token endpoint; tenanted discovery may\n // derive a path-scoped variant (/). Tenants are\n // open-ended, so check manually instead of an exact-match list.\n clockTolerance: 30,\n });\n const audList = Array.isArray(payload.aud) ? payload.aud : payload.aud ? [payload.aud] : [];\n if (!audList.some((a) => a === URLS.as2 || a.startsWith(`${URLS.as2}/`))) {\n throw new Error(`unexpected aud ${JSON.stringify(payload.aud)}`);\n }\n claims = payload;\n } catch (e) {\n // DEBUG: jose errors are terse — log header vs configured-key so kid/alg\n // mismatches and double-wrapped JWKS are obvious in the val logs.\n let cfg: unknown;\n try { cfg = CLAUDE_AI_JWK ? JSON.parse(CLAUDE_AI_JWK) : undefined; } catch { cfg = \"\"; }\n console.error(\"[as2] ID-JAG verify failed\", {\n iss,\n tokenHeader: header, // alg + kid the token was signed with\n configuredClaudeJwk: iss === CLAUDE_AI_ISS ? cfg : \"\",\n err: { name: (e as Error)?.name, code: (e as { code?: string })?.code, message: (e as Error)?.message },\n });\n return c.json({ error: \"invalid_grant\", error_description: `ID-JAG verify failed (iss=${iss}): ${e instanceof Error ? e.message : e}` }, 400);\n }\n\n // RBAC×EMA: surface every scope source so upstream changes are observable.\n // Access token currently carries no scope claim — grant-through is TODO.\n console.log(\"[as2] /token jwt-bearer scopes:\", {\n request_param: body.scope, // RFC 6749 scope param on the token POST\n jag_scope: claims.scope, // space-delimited string form\n jag_scp: claims.scp, // array form (Okta)\n });\n\n const accessToken = await new jose.SignJWT({})\n .setProtectedHeader({ alg: \"ES256\", kid: kp.kid })\n .setIssuer(URLS.as2)\n .setAudience(jagResource)\n .setSubject(claims.sub!)\n .setIssuedAt()\n .setExpirationTime(\"1h\")\n .sign(kp.privateKey);\n\n return c.json({ access_token: accessToken, token_type: \"Bearer\", expires_in: 3600 });\n});\n\n// ─── Debug — demo-IdP path only (can't mint Okta id_tokens) ─────────────────\n\napp.get(\"/debug/context\", async (c) => {\n const idToken = await fetch(`${URLS.idp}/debug/mint-id-token`).then((r) => r.text());\n const { idp, as } = await debugCredsAs2();\n return c.json({\n client_id: as.client_id,\n client_secret: as.client_secret,\n idp_client_id: idp.client_id,\n idp_client_secret: idp.client_secret,\n idp_id_token: idToken,\n idp_token_endpoint: `${URLS.idp}/token`,\n });\n});\n\n// ─── Index ──────────────────────────────────────────────────────────────────\n\napp.get(\"/\", (c) =>\n c.html(indexPage({\n role: \"AS\",\n name: \"xaa-mcp-as2\",\n endpoints: [\n { method: \"GET\", path: \"/.well-known/oauth-authorization-server\" },\n { method: \"GET\", path: \"/.well-known/jwks.json\" },\n { method: \"GET\", path: \"/demo-client-metadata.json\", note: \"sample CIMD document — use its URL as client_id to try the flow\" },\n { method: \"GET\", path: \"/authorize\", note: \"authorization_code + PKCE; CIMD (https URL) or DCR client_ids; consent page approves as the demo user\" },\n { method: \"GET\", path: \"/register\", note: \"bring your own client_id; we bind a secret to (iss, id, resource). CIMD clients skip this\" },\n { method: \"POST\", path: \"/token\", note: \"authorization_code + jwt-bearer; CIMD or secret-as-trust\" },\n { method: \"GET\", path: \"/debug/context\", note: \"conformance ctx (demo-IdP path)\" },\n ],\n })));\n\napp.onError((err) => { throw err; });\n\nexport default app.fetch;\nif (import.meta.main) Deno.serve({ port: 3005 }, app.fetch);\n","deleted","label","xaa-mcp-as2-jlu",[127],"5a999e3e-4a56-11f1-8b70-ee650bb23af1","shared","019e0434-9c35-77e8-8c2a-fef4caef2a80",1,["D",1778187017209],"directory",[144],"pulls","forks","envVars",{"_156":146,"_158":146},"connections",{"_156":53,"_157":53},"count","unfilledCount","emptyCount",{"_20":143,"_13":144,"_128":145,"_130":-5,"_131":21,"_132":146,"_133":113,"_22":199,"_29":53,"_135":148,"_137":-5,"_139":40,"_140":-5,"_166":200,"_92":201},{"_20":191,"_13":192,"_128":193,"_130":145,"_131":21,"_132":194,"_133":113,"_22":195,"_29":146,"_135":173,"_137":196,"_139":40,"_140":-5,"_166":197,"_92":198},{"_20":184,"_13":185,"_128":186,"_130":145,"_131":21,"_132":146,"_133":113,"_22":187,"_29":53,"_135":173,"_137":188,"_139":40,"_140":-5,"_166":189,"_92":190},{"_20":177,"_13":178,"_128":179,"_130":145,"_131":21,"_132":146,"_133":113,"_22":180,"_29":53,"_135":173,"_137":181,"_139":40,"_140":-5,"_166":182,"_92":183},{"_20":169,"_13":170,"_128":171,"_130":145,"_131":21,"_132":146,"_133":113,"_22":172,"_29":53,"_135":173,"_137":174,"_139":40,"_140":-5,"_166":175,"_92":176},{"_20":126,"_13":127,"_128":129,"_130":-5,"_131":21,"_132":30,"_133":113,"_22":165,"_29":34,"_135":136,"_137":138,"_139":40,"_140":141,"_166":167,"_92":168},["D",1789426951132],"children",[],[127],"5a997d50-4a56-11f1-8b70-ee650bb23af1","register.ts","019e0434-9c34-729f-86c9-0cc43b780ec6",["D",1778187017209],"script","/**\n * Stateless client registration via HMAC.\n *\n * client_id = _id_\n * client_secret = _sec_\n *\n * The prefix makes it obvious at a glance which server issued which cred.\n * Secret is keyed off the full client_id (prefix included) so the prefix\n * is authenticated — you can't swap an idp_id_ for an as1_id_ and have\n * the secret still validate.\n *\n * Nothing is stored. Validation is re-derivation. The redirect_uri is the\n * account key: register the same URI at IdP and AS → two distinct IDs, but\n * the IdP can re-derive the AS one because it knows both issuers and the URI.\n */\n\nimport { URLS } from \"./config.ts\";\n\n// Per-server prefixes. The IdP needs to know the AS's prefix too — it's part\n// of what deriveAsClientIdFor uses to match what the AS /register emitted.\nexport const IDP_PREFIX = \"idp\";\nexport const AS_PREFIX = \"as1\";\n\nconst KEY = \"xaa-demo-hmac-key-not-secret\";\nconst enc = new TextEncoder();\n\nlet hmacKey: CryptoKey | undefined;\nasync function key(): Promise {\n return hmacKey ??= await crypto.subtle.importKey(\n \"raw\", enc.encode(KEY), { name: \"HMAC\", hash: \"SHA-256\" }, false, [\"sign\"],\n );\n}\n\nasync function hmacHex(input: string): Promise {\n const sig = await crypto.subtle.sign(\"HMAC\", await key(), enc.encode(input));\n return Array.from(new Uint8Array(sig), (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\n/**\n * `resource` (RS URL) is the per-RS dimension: same redirect_uri + same AS,\n * different resource → different client_id. The IdP has all three inputs at\n * token-exchange time (reg_uri in id_token, audience + resource in request).\n * For the IdP's own client_ids it's empty — the IdP doesn't front a resource.\n */\nexport async function deriveClientId(prefix: string, issuer: string, redirectUri: string, resource = \"\"): Promise {\n return `${prefix}_id_${(await hmacHex(`${issuer}|${redirectUri}|${resource}`)).slice(0, 12)}`;\n}\n\nexport async function deriveClientSecret(clientId: string): Promise {\n // Secret keys off the full client_id — prefix is bound, not cosmetic.\n const prefix = clientId.split(\"_id_\")[0];\n return `${prefix}_sec_${(await hmacHex(clientId)).slice(0, 16)}`;\n}\n\n/** /register: inputs in, creds out. Same inputs → same creds (idempotent). */\nexport async function register(prefix: string, issuer: string, redirectUri: string, resource = \"\") {\n const client_id = await deriveClientId(prefix, issuer, redirectUri, resource);\n const client_secret = await deriveClientSecret(client_id);\n return { client_id, client_secret, redirect_uri: redirectUri, ...(resource && { resource }) };\n}\n\n/** Validate a (client_id, client_secret) pair without knowing the redirect_uri. */\nexport async function validateSecret(clientId: string, clientSecret: string): Promise {\n return clientSecret === await deriveClientSecret(clientId);\n}\n\n/** Validate that a client_id was issued for a given redirect_uri at a given issuer. */\nexport async function validateRedirect(prefix: string, issuer: string, clientId: string, redirectUri: string): Promise {\n return clientId === await deriveClientId(prefix, issuer, redirectUri);\n}\n\n/**\n * The IdP's \"what client_id do I stamp in the JAG\" decision. Depends on how\n * the target AS models clients:\n *\n * - as1: AS mints its own IDs. IdP re-derives by running the same HMAC\n * the AS ran at /register, keyed on the client's redirect_uri.\n *\n * - as2: Client brings their own ID — whatever their IdP knows them as.\n * (Matches Okta's model: the catalog app stamps its own Okta client_id.)\n * The demo IdP plays along by stamping the requester's IdP client_id,\n * which it has right there in the token-exchange request body. The AS\n * never re-derives the id; it re-derives the *secret*, which is bound\n * to (iss, client_id, resource).\n */\nconst AS_REGISTRY: Record = {\n [URLS.as]: { mode: \"derive\", prefix: AS_PREFIX },\n [URLS.as2]: { mode: \"passthrough\" },\n};\n\nexport async function deriveAsClientIdFor(\n asIssuer: string,\n redirectUri: string,\n resource: string,\n requesterClientId: string,\n): Promise {\n const spec = AS_REGISTRY[asIssuer] ?? AS_REGISTRY[asIssuer.replace(/\\/$/, \"\")];\n if (!spec) throw new Error(`unknown AS audience: ${asIssuer}`);\n if (spec.mode === \"passthrough\") return requesterClientId;\n return deriveClientId(spec.prefix, asIssuer, redirectUri, resource);\n}\n\n/**\n * as2 secret derivation. Binds the secret to the full (issuer, client_id,\n * resource) tuple — the secret IS the trust decision. The client_id is\n * IdP-controlled (whatever Okta stamps); the secret is us-controlled.\n */\nexport async function deriveAs2Secret(idpIssuer: string, clientId: string, resource: string): Promise {\n return `as2_sec_${(await hmacHex(`${idpIssuer}|${clientId}|${resource}`)).slice(0, 16)}`;\n}\n\n/** Canonical redirect_uri for /debug endpoints — matches CC's default port. */\nexport const DEBUG_REDIRECT_URI = \"http://localhost:52118/callback\";\n\n/**\n * Pre-derived creds for /debug/context. AS creds are bound to the todos RS —\n * to get creds for cal, POST /register at the AS with resource=.\n */\nexport async function debugCreds() {\n const idp = await register(IDP_PREFIX, URLS.idp, DEBUG_REDIRECT_URI);\n const as = await register(AS_PREFIX, URLS.as, DEBUG_REDIRECT_URI, `${URLS.rs}/mcp`);\n return { idp, as };\n}\n\n/**\n * Creds for conformance against as2 via the demo IdP. The AS client_id IS the\n * IdP client_id (that's what the demo IdP stamps in the JAG — passthrough mode).\n */\nexport async function debugCredsAs2() {\n const idp = await register(IDP_PREFIX, URLS.idp, DEBUG_REDIRECT_URI);\n const as = {\n client_id: idp.client_id,\n client_secret: await deriveAs2Secret(URLS.idp, idp.client_id, `${URLS.rs2}/mcp`),\n };\n return { idp, as };\n}\n",[],[144,170],"5a997080-4a56-11f1-8b70-ee650bb23af1","keys.ts","019e0434-9c34-729f-86c9-098f981b2310",["D",1778187017209],"/**\n * Keypair persistence. Val.town is stateless per-request; keys must survive.\n *\n * - On val.town: blob storage (getJSON/setJSON the private JWK)\n * - Local dev: in-memory (process lifetime — fine for --watch; ephemeral\n * means restarting one server invalidates tokens the others hold, which is\n * an acceptable dev quirk)\n */\n\nimport * as jose from \"npm:jose@5\";\nimport { ON_VALTOWN } from \"./config.ts\";\n\nexport interface Keypair {\n privateKey: jose.KeyLike;\n publicKey: jose.KeyLike;\n publicJwk: jose.JWK;\n kid: string;\n}\n\nconst localCache = new Map();\n\nasync function materialize(privateJwk: jose.JWK): Promise {\n const privateKey = await jose.importJWK(privateJwk, \"ES256\") as jose.KeyLike;\n // Public JWK = private JWK minus the private component\n const { d: _d, ...pub } = privateJwk;\n const publicJwk = pub as jose.JWK;\n const publicKey = await jose.importJWK(publicJwk, \"ES256\") as jose.KeyLike;\n const kid = await jose.calculateJwkThumbprint(publicJwk);\n return { privateKey, publicKey, publicJwk: { ...publicJwk, kid, use: \"sig\", alg: \"ES256\" }, kid };\n}\n\nasync function generate(): Promise {\n const { privateKey } = await jose.generateKeyPair(\"ES256\", { extractable: true });\n return await jose.exportJWK(privateKey);\n}\n\nexport async function getOrCreateKeypair(blobKey: string): Promise {\n if (ON_VALTOWN) {\n const { blob } = await import(\"https://esm.town/v/std/blob\");\n let jwk = await blob.getJSON(blobKey) as jose.JWK | undefined;\n if (!jwk) {\n jwk = await generate();\n await blob.setJSON(blobKey, jwk);\n }\n return materialize(jwk);\n }\n\n // Local: cache for process lifetime\n const cached = localCache.get(blobKey);\n if (cached) return cached;\n const kp = await materialize(await generate());\n localCache.set(blobKey, kp);\n console.warn(`[keys] ${blobKey}: ephemeral key (kid=${kp.kid.slice(0, 12)}…), lives until process restart`);\n return kp;\n}\n",[],[144,178],"5a99506e-4a56-11f1-8b70-ee650bb23af1","html.ts","019e0434-9c34-729f-86c9-05b9594baea1",["D",1778187017209],"/** Shared HTML templates. */\n\nconst esc = (s: string) => s.replace(/[&<>\"']/g, (c) => `&#${c.charCodeAt(0)};`);\n\n/**\n * Informational stub for an AS /authorize endpoint. XAA AS's are jwt-bearer\n * only — there is no interactive code flow — but SDK schema validation forces\n * us to advertise an authorization_endpoint. Rather than 404 or (worse) point\n * at the IdP's real /authorize, we land you here and explain.\n */\nexport function xaaAuthorizeStub(asUrl: string, query: Record): string {\n const rows = Object.entries(query)\n .map(([k, v]) => `${esc(k)}${esc(v)}`)\n .join(\"\");\n return `/authorize — not supported\n\n

This AS doesn't do `/authorize`

${esc(asUrl)} is an XAA (cross-app access) authorization server. It only supports\ngrant_type=urn:ietf:params:oauth:grant-type:jwt-bearer at\n/token — there's no interactive authorization-code flow.

The authorization_endpoint in our metadata exists only because some client schemas\nrequire the field. If your client redirected you here, it's trying to run a code flow against an\nAS that can't issue codes — check that it's using the jwt-bearer grant.

Request parameters received

\n${rows ? `${rows}

` : `

(none)

`}\n`;\n}\n\nexport function indexPage(opts: {\n role: \"IdP\" | \"AS\" | \"RS\";\n name: string;\n endpoints: { method: string; path: string; note?: string }[];\n}): string {\n const colors = {\n IdP: { bg: \"#fef3c7\", accent: \"#f59e0b\" },\n AS: { bg: \"#dbeafe\", accent: \"#3b82f6\" },\n RS: { bg: \"#d1fae5\", accent: \"#10b981\" },\n }[opts.role];\n\n const rows = opts.endpoints\n .map((e) => {\n const label = `${e.method} ${e.path}`;\n const link = e.method === \"GET\" ? `${label}` : label;\n return `

${link}${e.note ? ` — ${e.note}` : \"\"}

`;\n })\n .join(\"\\n\");\n\n return `\n${opts.name}

${opts.role}

${opts.name}

\n${rows}\n

`;\n}\n",[],[144,185],"2254ac5a-5b16-11f1-b16b-ee650bb23af1","config.ts","019e0434-9c34-729f-86c9-02204c03f726",2,["D",1780028604779],"/**\n * Wiring for the XAA demo stack. Client creds are NOT hardcoded — they\n * come from /register (see register.ts). The IdP and AS issue distinct\n * client_ids because each bakes its own issuer into the HMAC input.\n */\n\nexport const OKTA_ISSUER = \"https://integrator-7089468.okta.com\";\n\nexport const DEMO_USER = {\n sub: \"demo@example.com\",\n email: \"demo@example.com\",\n name: \"Demo User\",\n};\n\n// \"Am I on val.town?\" — esm.town serves deployed code\nexport const ON_VALTOWN = import.meta.url.startsWith(\"https://esm.town\");\n\nexport const URLS = ON_VALTOWN\n ? {\n idp: \"https://xaa-mcp-idp.val.run\",\n as: \"https://xaa-mcp-as.val.run\",\n rs: \"https://xaa-mcp-rs.val.run\",\n cal: \"https://xaa-mcp-cal.val.run\",\n as2: \"https://xaa-mcp-as2-jlu.val.run\",\n rs2: \"https://xaa-mcp-rs2-jlu.val.run\",\n }\n : {\n idp: \"http://localhost:3001\",\n as: \"http://localhost:3002\",\n rs: \"http://localhost:3000\",\n cal: \"http://localhost:3003\",\n as2: \"http://localhost:3005\",\n rs2: \"http://localhost:3004\",\n };\n",[],[144,192],["D",1778187017209],[160,161,162,163],[144],["D",1778187017209],{"_11":12,"_90":86},{"_11":12,"_83":84,"_85":86,"_46":47,"_87":88,"_89":40},{"_29":30,"_13":26,"_20":21,"_27":28,"_31":32,"_33":34,"_76":42,"_77":78,"_79":80,"_81":14,"_82":12},"ctx",{"_69":-5,"_115":239,"_240":241,"_242":243,"_244":40,"_245":40,"_246":40,"_247":113,"_248":-5,"_249":-7,"_250":-7,"_251":53,"_252":40,"_253":40,"_254":-5,"_255":40,"_256":40,"_257":40,"_258":-5},"ENV",{"_210":211,"_212":213,"_214":26,"_215":216,"_217":218,"_219":220,"_221":222,"_223":224,"_225":226,"_227":228,"_229":230,"_231":232,"_233":234,"_235":236,"_237":238},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Authorize access

Register at AS2

This AS doesn't do /authorize

Request parameters received

${opts.name}

This AS doesn't do `/authorize`

Branches1

Branches
1