${opts.name}

\n${rows}\n

`;\n}\n",[],[160,188],{"_106":196,"_97":197,"_161":198,"_163":162,"_164":146,"_165":199,"_167":168,"_108":200,"_102":33,"_170":182,"_172":201,"_173":22,"_174":-5,"_175":202,"_100":203},"ce3ca81e-17d8-11f1-a7f9-42dde27851f2","keys.ts","ce3ca90e-17d8-11f1-a7f9-42dde27851f2",3,["D",1772635536555],"/**\n * Keypair persistence. Val.town is stateless per-request; keys must survive.\n *\n * - On val.town: blob storage (getJSON/setJSON the private JWK)\n * - Local dev: in-memory (process lifetime — fine for --watch; ephemeral\n * means restarting one server invalidates tokens the others hold, which is\n * an acceptable dev quirk)\n */\n\nimport * as jose from \"npm:jose@5\";\nimport { ON_VALTOWN } from \"./config.ts\";\n\nexport interface Keypair {\n privateKey: jose.KeyLike;\n publicKey: jose.KeyLike;\n publicJwk: jose.JWK;\n kid: string;\n}\n\nconst localCache = new Map();\n\nasync function materialize(privateJwk: jose.JWK): Promise {\n const privateKey = await jose.importJWK(privateJwk, \"ES256\") as jose.KeyLike;\n // Public JWK = private JWK minus the private component\n const { d: _d, ...pub } = privateJwk;\n const publicJwk = pub as jose.JWK;\n const publicKey = await jose.importJWK(publicJwk, \"ES256\") as jose.KeyLike;\n const kid = await jose.calculateJwkThumbprint(publicJwk);\n return { privateKey, publicKey, publicJwk: { ...publicJwk, kid, use: \"sig\", alg: \"ES256\" }, kid };\n}\n\nasync function generate(): Promise {\n const { privateKey } = await jose.generateKeyPair(\"ES256\", { extractable: true });\n return await jose.exportJWK(privateKey);\n}\n\nexport async function getOrCreateKeypair(blobKey: string): Promise {\n if (ON_VALTOWN) {\n const { blob } = await import(\"https://esm.town/v/std/blob\");\n let jwk = await blob.getJSON(blobKey) as jose.JWK | undefined;\n if (!jwk) {\n jwk = await generate();\n await blob.setJSON(blobKey, jwk);\n }\n return materialize(jwk);\n }\n\n // Local: cache for process lifetime\n const cached = localCache.get(blobKey);\n if (cached) return cached;\n const kp = await materialize(await generate());\n localCache.set(blobKey, kp);\n console.warn(`[keys] ${blobKey}: ephemeral key (kid=${kp.kid.slice(0, 12)}…), lives until process restart`);\n return kp;\n}\n",[],[160,197],[160],{"_106":206,"_97":101,"_161":207,"_163":-5,"_164":146,"_165":103,"_167":22,"_108":208,"_102":209,"_170":210,"_172":211,"_173":22,"_174":98,"_175":212,"_100":213},"b8cc6368-17e0-11f1-af3f-42dde27851f2","cdc80a5e-17d8-11f1-bdf7-42dde27851f2",["D",1772638936559],1,"http","import { Hono } from \"npm:hono@3\";\nimport { cors } from \"npm:hono@3/cors\";\nimport * as jose from \"npm:jose@5\";\nimport { URLS, DEMO_USER } from \"./shared/config.ts\";\nimport { getOrCreateKeypair } from \"./shared/keys.ts\";\nimport { indexPage } from \"./shared/html.ts\";\nimport {\n register,\n validateSecret,\n validateRedirect,\n deriveAsClientIdFor,\n debugCreds,\n DEBUG_REDIRECT_URI,\n IDP_PREFIX,\n} from \"./shared/register.ts\";\n\nconst ID_JAG_TOKEN_TYPE = \"urn:ietf:params:oauth:token-type:id-jag\";\nconst ID_TOKEN_TYPE = \"urn:ietf:params:oauth:token-type:id_token\";\nconst TOKEN_EXCHANGE_GRANT = \"urn:ietf:params:oauth:grant-type:token-exchange\";\n\nconst kp = await getOrCreateKeypair(\"xaa_idp_signing_key_v1\");\n\nconst app = new Hono();\napp.use(\"*\", cors({\n origin: \"*\",\n allowMethods: [\"GET\", \"POST\", \"OPTIONS\"],\n allowHeaders: [\"Content-Type\", \"Authorization\", \"mcp-protocol-version\"],\n}));\n\n// ─── OIDC discovery + JWKS ──────────────────────────────────────────────────\n\napp.get(\"/.well-known/openid-configuration\", (c) =>\n c.json({\n issuer: URLS.idp,\n authorization_endpoint: `${URLS.idp}/authorize`,\n token_endpoint: `${URLS.idp}/token`,\n jwks_uri: `${URLS.idp}/.well-known/jwks.json`,\n registration_endpoint: `${URLS.idp}/register`,\n response_types_supported: [\"code\"],\n subject_types_supported: [\"public\"],\n id_token_signing_alg_values_supported: [\"ES256\"],\n grant_types_supported: [\"authorization_code\", TOKEN_EXCHANGE_GRANT],\n code_challenge_methods_supported: [\"S256\"],\n token_endpoint_auth_methods_supported: [\"client_secret_post\", \"none\"],\n }));\n\napp.get(\"/.well-known/jwks.json\", (c) => c.json({ keys: [kp.publicJwk] }));\n\n// ─── /register — stateless HMAC derivation ──────────────────────────────────\n\napp.get(\"/register\", (c) =>\n c.html(`Register — IdP\n\n

Register at the IdP

Enter your OAuth redirect URI. You'll get a client_id + secret derived from it — no storage, pure HMAC. Register the same URI at the AS so the IdP can bind the two identities in the ID-JAG.

\n`));\n\napp.post(\"/register\", async (c) => {\n const body = await c.req.parseBody();\n const redirectUri = body.redirect_uri as string;\n if (!redirectUri) return c.json({ error: \"invalid_request\", error_description: \"redirect_uri required\" }, 400);\n return c.json(await register(IDP_PREFIX, URLS.idp, redirectUri));\n});\n\n// ─── id_token minting ───────────────────────────────────────────────────────\n// reg_uri is the redirect_uri the client registered with — it's our account\n// key. At token-exchange we use it to derive the client's ID at the target AS.\n\nasync function mintIdToken(sub: string, email: string, clientId: string, regUri: string): Promise {\n return await new jose.SignJWT({ email, reg_uri: regUri })\n .setProtectedHeader({ alg: \"ES256\", kid: kp.kid })\n .setIssuer(URLS.idp)\n .setAudience(clientId)\n .setSubject(sub)\n .setIssuedAt()\n .setExpirationTime(\"1h\")\n .sign(kp.privateKey);\n}\n\n// ─── /token ─────────────────────────────────────────────────────────────────\n\napp.post(\"/token\", async (c) => {\n const body = await c.req.parseBody();\n const grantType = body.grant_type as string;\n\n if (grantType === TOKEN_EXCHANGE_GRANT) return handleTokenExchange(c, body);\n if (grantType === \"authorization_code\") return handleAuthCode(c, body);\n return c.json({ error: \"unsupported_grant_type\", error_description: grantType }, 400);\n});\n\n/**\n * RFC 8693 Token Exchange: id_token → ID-JAG.\n *\n * The app<>app binding: the id_token's `aud` is the client's IdP client_id,\n * and its `reg_uri` is the redirect_uri they registered. We derive what their\n * client_id at the AS would be (for the `audience` they're requesting) by\n * running the same HMAC the AS ran at /register. That goes into the ID-JAG's\n * `client_id` claim, which the AS will check against the Basic-auth client.\n */\nasync function handleTokenExchange(c: any, body: Record) {\n const subjectToken = body.subject_token as string;\n const subjectTokenType = body.subject_token_type as string;\n const requestedTokenType = body.requested_token_type as string;\n const audience = body.audience as string;\n const resource = body.resource as string;\n const clientId = body.client_id as string;\n const clientSecret = body.client_secret as string | undefined;\n\n if (subjectTokenType !== ID_TOKEN_TYPE) {\n return c.json({ error: \"invalid_request\", error_description: `subject_token_type must be ${ID_TOKEN_TYPE}` }, 400);\n }\n if (requestedTokenType !== ID_JAG_TOKEN_TYPE) {\n return c.json({ error: \"invalid_request\", error_description: `requested_token_type must be ${ID_JAG_TOKEN_TYPE}` }, 400);\n }\n if (!audience || !resource) {\n return c.json({ error: \"invalid_request\", error_description: \"audience and resource are required\" }, 400);\n }\n\n // Client auth: secret must re-derive from presented client_id\n if (!clientSecret || !(await validateSecret(clientId, clientSecret))) {\n return c.json({ error: \"invalid_client\", error_description: \"client authentication failed\" }, 401);\n }\n\n // Verify the id_token: signed by us, aud = this client\n let sub: string, regUri: string;\n try {\n const { payload } = await jose.jwtVerify(subjectToken, kp.publicKey, {\n issuer: URLS.idp,\n audience: clientId,\n });\n sub = payload.sub!;\n regUri = payload.reg_uri as string;\n if (!regUri) throw new Error(\"id_token missing reg_uri claim\");\n } catch (e) {\n return c.json({ error: \"invalid_grant\", error_description: `id_token verification failed: ${e instanceof Error ? e.message : e}` }, 400);\n }\n\n // Derive the client's ID at the requested AS. The AS derived this same\n // value when they POSTed /register there with this reg_uri.\n const asClientId = await deriveAsClientIdFor(audience, regUri);\n\n const idJag = await new jose.SignJWT({ resource, client_id: asClientId })\n .setProtectedHeader({ alg: \"ES256\", typ: \"oauth-id-jag+jwt\", kid: kp.kid })\n .setIssuer(URLS.idp)\n .setAudience(audience)\n .setSubject(sub)\n .setIssuedAt()\n .setExpirationTime(\"5m\")\n .setJti(crypto.randomUUID())\n .sign(kp.privateKey);\n\n return c.json({\n access_token: idJag,\n issued_token_type: ID_JAG_TOKEN_TYPE,\n token_type: \"N_A\",\n expires_in: 300,\n });\n}\n\n/**\n * OIDC authorization_code grant. Auth code is itself a JWT carrying PKCE\n * challenge + redirect_uri + client_id — no database needed.\n */\nasync function handleAuthCode(c: any, body: Record) {\n const code = body.code as string;\n const codeVerifier = body.code_verifier as string;\n const redirectUri = body.redirect_uri as string;\n const clientId = body.client_id as string;\n const clientSecret = body.client_secret as string | undefined;\n\n if (!clientSecret || !(await validateSecret(clientId, clientSecret))) {\n return c.json({ error: \"invalid_client\", error_description: \"invalid client credentials\" }, 401);\n }\n\n let claims: jose.JWTPayload;\n try {\n const { payload } = await jose.jwtVerify(code, kp.publicKey, {\n issuer: URLS.idp,\n audience: `${URLS.idp}/token`,\n });\n claims = payload;\n } catch (e) {\n return c.json({ error: \"invalid_grant\", error_description: `code invalid or expired: ${e instanceof Error ? e.message : e}` }, 400);\n }\n\n // Tie the code to this specific client_id + redirect_uri\n if (claims.client_id !== clientId || claims.redirect_uri !== redirectUri) {\n return c.json({ error: \"invalid_grant\", error_description: \"code was issued to a different client or redirect_uri\" }, 400);\n }\n\n // PKCE S256\n const hash = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(codeVerifier));\n const actualChallenge = btoa(String.fromCharCode(...new Uint8Array(hash)))\n .replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n if (actualChallenge !== claims.code_challenge) {\n return c.json({ error: \"invalid_grant\", error_description: \"PKCE verification failed\" }, 400);\n }\n\n const idToken = await mintIdToken(claims.sub!, claims.email as string, clientId, redirectUri);\n return c.json({\n access_token: \"idp-access-token-unused\",\n id_token: idToken,\n token_type: \"Bearer\",\n expires_in: 3600,\n });\n}\n\n// ─── /authorize — validates client_id ↔ redirect_uri binding ────────────────\n\napp.get(\"/authorize\", async (c) => {\n const q = c.req.query();\n const { client_id, redirect_uri, state, code_challenge, code_challenge_method } = q;\n\n if (!redirect_uri || !code_challenge || code_challenge_method !== \"S256\") {\n return c.text(\"invalid_request: redirect_uri, code_challenge, code_challenge_method=S256 required\", 400);\n }\n // The HMAC binding: this client_id was derived from this exact redirect_uri.\n // Wrong URI → different HMAC → no match → you didn't register this.\n if (!(await validateRedirect(IDP_PREFIX, URLS.idp, client_id, redirect_uri))) {\n return c.text(`invalid_client: client_id does not match redirect_uri (register at ${URLS.idp}/register)`, 400);\n }\n\n const hidden = Object.entries({ client_id, redirect_uri, state, code_challenge })\n .filter(([, v]) => v)\n .map(([k, v]) => ``)\n .join(\"\");\n\n return c.html(`Demo IdP\n\n

Demo IdP

Client ${client_id} wants to sign you in.
redirect_uri ✓ verified

\n`);\n});\n\napp.post(\"/authorize/grant\", async (c) => {\n const body = await c.req.parseBody();\n const redirectUri = body.redirect_uri as string;\n const state = body.state as string | undefined;\n\n const code = await new jose.SignJWT({\n client_id: body.client_id as string,\n redirect_uri: redirectUri,\n code_challenge: body.code_challenge as string,\n email: DEMO_USER.email,\n })\n .setProtectedHeader({ alg: \"ES256\", kid: kp.kid })\n .setIssuer(URLS.idp)\n .setAudience(`${URLS.idp}/token`)\n .setSubject(DEMO_USER.sub)\n .setIssuedAt()\n .setExpirationTime(\"5m\")\n .sign(kp.privateKey);\n\n const dest = new URL(redirectUri);\n dest.searchParams.set(\"code\", code);\n if (state) dest.searchParams.set(\"state\", state);\n return new Response(null, { status: 302, headers: { Location: dest.toString() } });\n});\n\n// ─── Debug — wide open ──────────────────────────────────────────────────────\n\napp.get(\"/debug/mint-id-token\", async (c) => {\n const { idp } = await debugCreds();\n return c.text(await mintIdToken(DEMO_USER.sub, DEMO_USER.email, idp.client_id, DEBUG_REDIRECT_URI));\n});\n\n// Full MCP_CONFORMANCE_SERVER_CONTEXT, ready to pipe into the scenario.\napp.get(\"/debug/context\", async (c) => {\n const { idp, as } = await debugCreds();\n const idToken = await mintIdToken(DEMO_USER.sub, DEMO_USER.email, idp.client_id, DEBUG_REDIRECT_URI);\n return c.json({\n client_id: as.client_id,\n client_secret: as.client_secret,\n idp_client_id: idp.client_id,\n idp_client_secret: idp.client_secret,\n idp_id_token: idToken,\n idp_token_endpoint: `${URLS.idp}/token`,\n });\n});\n\n// ─── Index ──────────────────────────────────────────────────────────────────\n\napp.get(\"/\", (c) =>\n c.html(indexPage({\n role: \"IdP\",\n name: \"xaa-mcp-idp\",\n endpoints: [\n { method: \"GET\", path: \"/.well-known/openid-configuration\" },\n { method: \"GET\", path: \"/.well-known/jwks.json\" },\n { method: \"GET\", path: \"/register\", note: \"stateless — HMAC of your redirect_uri\" },\n { method: \"GET\", path: \"/authorize\", note: \"one-click demo login\" },\n { method: \"POST\", path: \"/token\", note: \"authorization_code + token-exchange\" },\n { method: \"GET\", path: \"/debug/mint-id-token\", note: \"skip login entirely\" },\n { method: \"GET\", path: \"/debug/context\", note: \"full MCP_CONFORMANCE_SERVER_CONTEXT\" },\n ],\n })));\n\napp.onError((err) => { throw err; });\n\nexport default app.fetch;\nif (import.meta.main) Deno.serve({ port: 3001 }, app.fetch);\n",[],[101],"files",[158,177,186,195,205],"counts",{"_218":33,"_219":209,"_220":33,"_221":222,"_225":226},"pulls","branches","forks","envVars",{"_223":33,"_224":33},"count","emptyCount","connections",{"_223":33,"_227":33},"unfilledCount","contents",[],"file",{"_106":206,"_97":101,"_161":207,"_163":-5,"_164":146,"_165":103,"_167":22,"_108":232,"_102":209,"_170":210,"_172":211,"_173":22,"_174":98,"_100":233},["D",1772638936559],[101],"upstreamProject","upstreamBranch","emptyEnvVars","isNew","flags",[],"routes/_app.x.$handle.$name.branch.$branch.version.$version.code.$",{"_95":96,"_97":98,"_99":45,"_102":103,"_100":101,"_104":242,"_156":247,"_214":263,"_230":264,"_228":266,"_267":-5,"_268":-5,"_269":-5,"_270":-5,"_271":272,"_221":-5},{"_106":107,"_97":98,"_108":243,"_110":-5,"_111":22,"_112":113,"_114":-5,"_115":-5,"_14":116,"_117":-5,"_118":22,"_119":-5,"_120":-5,"_121":33,"_16":122,"_123":-5,"_124":-5,"_125":-5,"_126":127,"_128":127,"_129":130,"_131":130,"_132":130,"_133":127,"_134":127,"_23":244,"_138":245,"_143":246,"_155":22},["D",1772635535432],{"_95":96,"_136":137},{"_95":96,"_140":137,"_14":116,"_141":142},{"_102":145,"_97":45,"_106":146,"_147":107,"_148":-5,"_149":-5,"_150":-5,"_151":-5,"_152":-5,"_153":98,"_154":96},[248,260],{"_106":159,"_97":160,"_161":162,"_163":-5,"_164":146,"_165":166,"_167":168,"_108":169,"_102":33,"_170":171,"_172":-5,"_173":22,"_174":-5,"_175":249,"_100":259},[250,253,256],{"_106":178,"_97":179,"_161":180,"_163":162,"_164":146,"_165":166,"_167":22,"_108":181,"_102":33,"_170":182,"_172":183,"_173":22,"_174":-5,"_175":251,"_100":252},[],[160,179],{"_106":187,"_97":188,"_161":189,"_163":162,"_164":146,"_165":190,"_167":168,"_108":191,"_102":33,"_170":182,"_172":192,"_173":22,"_174":-5,"_175":254,"_100":255},[],[160,188],{"_106":196,"_97":197,"_161":198,"_163":162,"_164":146,"_165":199,"_167":168,"_108":200,"_102":33,"_170":182,"_172":201,"_173":22,"_174":-5,"_175":257,"_100":258},[],[160,197],[160],{"_106":206,"_97":101,"_161":207,"_163":-5,"_164":146,"_165":103,"_167":22,"_108":208,"_102":209,"_170":210,"_172":211,"_173":22,"_174":98,"_175":261,"_100":262},[],[101],[248,250,253,256,260],{"_106":206,"_97":101,"_161":207,"_163":-5,"_164":146,"_165":103,"_167":22,"_108":232,"_102":209,"_170":210,"_172":211,"_173":22,"_174":98,"_100":265},[101],[],"upstream","pull","ahead","behind","templates",[],"actionData","errors"]

pcarleton

xaa-mcp-idp