[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_174":175,"_176":177},"routes/_app.x.$handle.$name",{"_99":98,"_32":50,"_107":89,"_27":108,"_13":14,"_109":-5,"_11":110,"_111":112,"_113":114,"_115":116,"_117":118,"_21":-5,"_119":-5,"_120":-5,"_121":25,"_122":123,"_124":125,"_126":-5,"_127":-5,"_128":129},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_48":49,"_32":50,"_36":51,"_52":-5,"_53":25,"_54":55,"_56":55,"_57":-5,"_58":-5,"_18":59,"_60":-5,"_61":25,"_62":-5,"_63":-5,"_64":65,"_66":67,"_68":-5,"_69":-5,"_70":-5,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":25},"version",2,"changes",[19,20],"aiChatInfo","userId",{"_21":41,"_23":-7,"_24":25,"_26":25,"_27":42,"_29":42},{"_21":22,"_23":-7,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":-5,"_36":37,"_38":14,"_39":40,"_24":25},"previous","deleted",false,"deletedHere","path","shared","latestPath","fileId","d7b61624-e0e0-44e2-bbf1-c0a82a4b3c07","name","fileType","directory","content","createdAt",["D",1772721389556],"branchVersion","branchId","b21dfade-18a0-11f1-8e30-42dde27851f2",{"_30":43,"_32":44,"_33":45,"_35":46,"_36":47,"_38":14,"_39":40,"_24":25},"shared/config.ts","b29e4aae-18a0-11f1-855c-42dde27851f2","config.ts","script","/**\n * Wiring for the XAA demo stack. Client creds are NOT hardcoded — they\n * come from /register (see register.ts). The IdP and AS issue distinct\n * client_ids because each bakes its own issuer into the HMAC input.\n */\n\nexport const DEMO_USER = {\n sub: \"demo@example.com\",\n email: \"demo@example.com\",\n name: \"Demo User\",\n};\n\n// \"Am I on val.town?\" — esm.town serves deployed code\nexport const ON_VALTOWN = import.meta.url.startsWith(\"https://esm.town\");\n\nexport const URLS = ON_VALTOWN\n ? {\n idp: \"https://xaa-mcp-idp.val.run\",\n as: \"https://xaa-mcp-as.val.run\",\n rs: \"https://xaa-mcp-rs.val.run\",\n cal: \"https://xaa-mcp-cal.val.run\",\n as2: \"https://xaa-mcp-as2.val.run\",\n rs2: \"https://xaa-mcp-rs2.val.run\",\n }\n : {\n idp: \"http://localhost:3001\",\n as: \"http://localhost:3002\",\n rs: \"http://localhost:3000\",\n cal: \"http://localhost:3003\",\n as2: \"http://localhost:3005\",\n rs2: \"http://localhost:3004\",\n };\n",["D",1772721389556],"id","b21da020-18a0-11f1-8e30-42dde27851f2","xaa-mcp-as2",["D",1772721388727],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","f4518a30-f52b-4b12-891c-a8fffb7240f8","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","1d3af61b-92b3-4fbf-b22a-ca08b2122f4d","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_99":98,"_106":102},"org",{"_99":98,"_100":-5,"_101":102,"_18":59,"_103":104,"_105":25},"branch",{"_13":88,"_32":89,"_48":40,"_90":49,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":50,"_97":98},"isOwned",20,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","pcarleton","handle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18yZjg2YXM0MEVRM0hKQzVqcFJ5aHZteXUxUjUifQ","tier","pro","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_48":49,"_32":50,"_36":170,"_52":-5,"_53":25,"_54":55,"_56":55,"_57":-5,"_58":-5,"_18":59,"_60":-5,"_61":25,"_62":-5,"_63":-5,"_64":65,"_66":67,"_68":-5,"_69":-5,"_70":-5,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":171,"_83":172,"_85":173,"_87":25},"tree",[156,158],"files",[156,157,158],"counts",{"_146":65,"_147":136,"_148":136,"_149":150,"_151":152},"contents",[130,131],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_48":143,"_32":28,"_30":31,"_135":-5,"_39":40,"_38":14,"_137":125,"_36":144,"_13":65,"_33":34,"_35":-5,"_24":25,"_141":-5,"_27":145},{"_48":132,"_32":133,"_30":134,"_135":-5,"_39":40,"_38":136,"_137":25,"_36":138,"_13":65,"_33":139,"_35":140,"_24":25,"_141":50,"_27":142},"b25f36c0-18a0-11f1-8f13-42dde27851f2","http.ts","b25f3774-18a0-11f1-8f13-42dde27851f2","parentId",1,"latest",["D",1772721389152],"http","import { Hono } from \"npm:hono@3\";\nimport { cors } from \"npm:hono@3/cors\";\nimport * as jose from \"npm:jose@5\";\nimport { URLS } from \"./shared/config.ts\";\nimport { getOrCreateKeypair } from \"./shared/keys.ts\";\nimport { indexPage } from \"./shared/html.ts\";\nimport { register, validateSecret, deriveClientId, debugCredsAs2, AS2_PREFIX } from \"./shared/register.ts\";\n\nconst JWT_BEARER_GRANT = \"urn:ietf:params:oauth:grant-type:jwt-bearer\";\nconst ID_JAG_TYP = \"oauth-id-jag+jwt\";\n\nconst kp = await getOrCreateKeypair(\"xaa_as2_signing_key_v1\");\n\n// No static JWKS. Discovered per-issuer via OIDC, lazily, cached for\n// process/val lifetime. Works for both the demo IdP (idp.ts:37 advertises\n// jwks_uri) and Okta (serves /oauth2/v1/keys behind discovery).\nconst jwksCache = new Map>();\nasync function jwksFor(issuer: string) {\n let jwks = jwksCache.get(issuer);\n if (jwks) return jwks;\n const res = await fetch(`${issuer}/.well-known/openid-configuration`);\n if (!res.ok) throw new Error(`OIDC discovery failed for ${issuer}: HTTP ${res.status}`);\n const { jwks_uri } = await res.json();\n if (!jwks_uri) throw new Error(`${issuer} OIDC config missing jwks_uri`);\n jwks = jose.createRemoteJWKSet(new URL(jwks_uri));\n jwksCache.set(issuer, jwks);\n return jwks;\n}\n\nconst app = new Hono();\napp.use(\"*\", cors({\n origin: \"*\",\n allowMethods: [\"GET\", \"POST\", \"OPTIONS\"],\n allowHeaders: [\"Content-Type\", \"Authorization\", \"mcp-protocol-version\"],\n}));\n\n// ─── Metadata + JWKS ────────────────────────────────────────────────────────\n\napp.get(\"/.well-known/oauth-authorization-server\", (c) =>\n c.json({\n issuer: URLS.as2,\n token_endpoint: `${URLS.as2}/token`,\n authorization_endpoint: `${URLS.idp}/authorize`, // dummy, never used — SDK Zod wants it\n registration_endpoint: `${URLS.as2}/register`,\n response_types_supported: [\"code\"],\n grant_types_supported: [JWT_BEARER_GRANT],\n token_endpoint_auth_methods_supported: [\"client_secret_basic\", \"client_secret_post\"],\n }));\n\napp.get(\"/.well-known/jwks.json\", (c) => c.json({ keys: [kp.publicJwk] }));\n\n// ─── /register — IdP issuer IS the binding key ──────────────────────────────\n// client_id = hmac(as2, this-AS, idp_issuer, resource). At /token we re-derive\n// from the JAG's iss+resource; if it matches your authenticating client_id,\n// that issuer is trusted for you. No separate TRUSTED_ISSUERS set.\n\nconst RESOURCES = [`${URLS.rs2}/mcp`];\n\napp.get(\"/register\", (c) =>\n c.html(`Register — AS2\n\n

Register at AS2

Your IdP issuer URL is the binding key. The client_id you get back is an HMAC of it — at /token we re-derive from the JAG's iss and it has to match. That's the trust decision.

For Okta: also paste this client_id into the Okta XAA mapping so Okta stamps it in the JAG's client_id claim.

\n`));\n\napp.post(\"/register\", async (c) => {\n const body = await c.req.parseBody();\n const idpIssuer = body.idp_issuer as string;\n const resource = body.resource as string;\n if (!idpIssuer || !resource) {\n return c.json({ error: \"invalid_request\", error_description: \"idp_issuer and resource required\" }, 400);\n }\n const normalized = idpIssuer.replace(/\\/$/, \"\");\n return c.json(await register(AS2_PREFIX, URLS.as2, normalized, resource));\n});\n\n// ─── /token — jwt-bearer ────────────────────────────────────────────────────\n// Four checks: (1) secret, (2) client_id derives from JAG iss+resource\n// (implicit trust gate), (3) sig via issuer's JWKS, (4) JAG client_id claim\n// matches you (spec binding; requires Okta admin config).\n\napp.post(\"/token\", async (c) => {\n const body = await c.req.parseBody();\n if (body.grant_type !== JWT_BEARER_GRANT) {\n return c.json({ error: \"unsupported_grant_type\", error_description: String(body.grant_type) }, 400);\n }\n\n // Check 1 — client auth (basic or post)\n let clientId: string | undefined, clientSecret: string | undefined;\n const authz = c.req.header(\"Authorization\");\n if (authz?.startsWith(\"Basic \")) {\n const decoded = atob(authz.slice(6));\n const sep = decoded.indexOf(\":\");\n clientId = decodeURIComponent(decoded.slice(0, sep));\n clientSecret = decodeURIComponent(decoded.slice(sep + 1));\n } else {\n clientId = body.client_id as string;\n clientSecret = body.client_secret as string;\n }\n if (!clientId || !clientSecret || !(await validateSecret(clientId, clientSecret))) {\n return c.json({ error: \"invalid_client\", error_description: \"client authentication failed\" }, 401);\n }\n\n const assertion = body.assertion as string;\n if (!assertion) {\n return c.json({ error: \"invalid_request\", error_description: \"missing assertion\" }, 400);\n }\n\n const header = jose.decodeProtectedHeader(assertion);\n if (header.typ !== ID_JAG_TYP) {\n return c.json({ error: \"invalid_grant\", error_description: `typ must be ${ID_JAG_TYP}, got ${header.typ}` }, 400);\n }\n\n // Unsafe decode — sig verified below, AFTER we know whose keys to use.\n const unverified = jose.decodeJwt(assertion);\n const iss = (unverified.iss ?? \"\").replace(/\\/$/, \"\");\n if (!iss) {\n return c.json({ error: \"invalid_grant\", error_description: \"ID-JAG missing iss\" }, 400);\n }\n // Spec §3.1: `resource` in the JAG is OPTIONAL. Okta may omit it.\n // Fall back to the RFC 8707 request param — CC always sends it.\n const jagResource = (unverified.resource as string | undefined) ?? (body.resource as string | undefined);\n if (!jagResource) {\n return c.json({ error: \"invalid_grant\", error_description: \"no resource: ID-JAG omits the claim and request lacks the parameter\" }, 400);\n }\n\n // Check 2 — implicit trust. Your client_id MUST derive from this JAG's\n // (iss, resource). If not, you're presenting a JAG from an issuer you\n // never registered with.\n const expectedClientId = await deriveClientId(AS2_PREFIX, URLS.as2, iss, jagResource);\n if (clientId !== expectedClientId) {\n return c.json({\n error: \"invalid_grant\",\n error_description: `client_id not bound to this issuer+resource (JAG iss=${iss}). Register at ${URLS.as2}/register`,\n }, 400);\n }\n\n // Check 3 — sig + iss/aud/clock, against the issuer's discovered JWKS.\n let claims: jose.JWTPayload;\n try {\n const { payload } = await jose.jwtVerify(assertion, await jwksFor(iss), {\n issuer: iss,\n audience: [URLS.as2, `${URLS.as2}/`],\n clockTolerance: 30,\n });\n claims = payload;\n } catch (e) {\n return c.json({ error: \"invalid_grant\", error_description: `ID-JAG verify failed (iss=${iss}): ${e instanceof Error ? e.message : e}` }, 400);\n }\n\n // Check 4 — spec binding. IdP says this JAG is for client_id X; X must\n // equal who authenticated. Demo IdP derives this correctly on its own.\n // Okta must be told (admin console, XAA mapping).\n if (claims.client_id !== clientId) {\n return c.json({\n error: \"invalid_grant\",\n error_description: `ID-JAG client_id (${claims.client_id}) != authenticating client (${clientId}). For Okta: configure the XAA mapping to stamp this value.`,\n }, 400);\n }\n\n const accessToken = await new jose.SignJWT({})\n .setProtectedHeader({ alg: \"ES256\", kid: kp.kid })\n .setIssuer(URLS.as2)\n .setAudience(jagResource)\n .setSubject(claims.sub!)\n .setIssuedAt()\n .setExpirationTime(\"1h\")\n .sign(kp.privateKey);\n\n return c.json({ access_token: accessToken, token_type: \"Bearer\", expires_in: 3600 });\n});\n\n// ─── Debug — demo-IdP path only (can't mint Okta id_tokens) ─────────────────\n\napp.get(\"/debug/context\", async (c) => {\n const idToken = await fetch(`${URLS.idp}/debug/mint-id-token`).then((r) => r.text());\n const { idp, as } = await debugCredsAs2();\n return c.json({\n client_id: as.client_id,\n client_secret: as.client_secret,\n idp_client_id: idp.client_id,\n idp_client_secret: idp.client_secret,\n idp_id_token: idToken,\n idp_token_endpoint: `${URLS.idp}/token`,\n });\n});\n\n// ─── Index ──────────────────────────────────────────────────────────────────\n\napp.get(\"/\", (c) =>\n c.html(indexPage({\n role: \"AS\",\n name: \"xaa-mcp-as2\",\n endpoints: [\n { method: \"GET\", path: \"/.well-known/oauth-authorization-server\" },\n { method: \"GET\", path: \"/.well-known/jwks.json\" },\n { method: \"GET\", path: \"/register\", note: \"binding key = your IdP issuer URL\" },\n { method: \"POST\", path: \"/token\", note: \"jwt-bearer; trust is per-client (no static issuer list)\" },\n { method: \"GET\", path: \"/debug/context\", note: \"conformance ctx (demo-IdP path)\" },\n ],\n })));\n\napp.onError((err) => { throw err; });\n\nexport default app.fetch;\nif (import.meta.main) Deno.serve({ port: 3005 }, app.fetch);\n","label",[133],"b29e761e-18a0-11f1-855c-42dde27851f2",["D",1772721389556],[28],"pulls","branches","forks","envVars",{"_153":136,"_155":65},"connections",{"_153":65,"_154":65},"count","unfilledCount","emptyCount",{"_48":143,"_32":28,"_30":31,"_135":-5,"_39":40,"_38":14,"_137":125,"_36":167,"_13":65,"_33":34,"_35":-5,"_24":25,"_141":-5,"_160":168,"_27":169},{"_48":163,"_32":44,"_30":43,"_135":31,"_39":40,"_38":14,"_137":25,"_36":164,"_13":65,"_33":45,"_35":46,"_24":25,"_141":-5,"_160":165,"_27":166},{"_48":132,"_32":133,"_30":134,"_135":-5,"_39":40,"_38":136,"_137":25,"_36":159,"_13":65,"_33":139,"_35":140,"_24":25,"_141":50,"_160":161,"_27":162},["D",1772721389152],"children",[],[133],"b29e49dc-18a0-11f1-855c-42dde27851f2",["D",1772721389556],[],[28,44],["D",1772721389556],[157],[28],["D",1772721388727],{"_99":98,"_106":102},{"_99":98,"_100":-5,"_101":102,"_18":59,"_103":104,"_105":25},{"_13":88,"_32":89,"_48":40,"_90":49,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":50,"_97":98},"ctx",{"_81":-5,"_127":207,"_208":209,"_210":211,"_212":25,"_213":25,"_214":25,"_215":125,"_216":-5,"_217":-7,"_218":-7,"_219":65,"_220":25,"_221":25,"_222":-5,"_223":25,"_224":25,"_225":25,"_226":-5},"ENV",{"_178":179,"_180":181,"_182":89,"_183":184,"_185":186,"_187":188,"_189":190,"_191":192,"_193":194,"_195":196,"_197":198,"_199":200,"_201":202,"_203":204,"_205":206},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v2