源码快照 @ 2026-09-02 (source-only, 剔除非源码素材)
This commit is contained in:
agent-radar
@@ -0,0 +1,17 @@
|
||||
diff --git a/dist/index.mjs b/dist/index.mjs
|
||||
--- a/dist/index.mjs
|
||||
+++ b/dist/index.mjs
|
||||
@@ -52,7 +52,12 @@ const drizzleAdapter = (db, config) => {
|
||||
}
|
||||
const withReturning = async (model, builder, data, where) => {
|
||||
if (config.provider !== "mysql") return (await builder.returning())[0];
|
||||
- await builder.execute();
|
||||
+ const mutationResult = await builder.execute();
|
||||
+ const mysqlResult = Array.isArray(mutationResult) ? mutationResult[0] : mutationResult;
|
||||
+ if (model === "oauthRefreshToken" && where?.some((w) => w.field === "revoked")) {
|
||||
+ const affectedRows = mysqlResult?.affectedRows ?? mysqlResult?.rowsAffected ?? mysqlResult?.changes;
|
||||
+ if (affectedRows === 0) return null;
|
||||
+ }
|
||||
const schemaModel = getSchema(model);
|
||||
const builderVal = builder.config?.values;
|
||||
if (where?.length) {
|
||||
@@ -0,0 +1,6 @@
|
||||
diff --git a/dist/index.mjs b/dist/index.mjs
|
||||
--- a/dist/index.mjs
|
||||
+++ b/dist/index.mjs
|
||||
@@ -1436 +1436 @@
|
||||
-const ADMIN_ROLES = ["owner", "admin"];
|
||||
+const ADMIN_ROLES = ["owner", "super-admin", "admin"];
|
||||
@@ -0,0 +1,42 @@
|
||||
diff --git a/dist/index.cjs b/dist/index.cjs
|
||||
index 635f1c0134274c89e7efbcae2adf3d9ecba575ee..700143e48595a767266869b6be9da5dead1d7ee8 100644
|
||||
--- a/dist/index.cjs
|
||||
+++ b/dist/index.cjs
|
||||
@@ -635,3 +635,13 @@ function determineScope(options) {
|
||||
- let effectiveScope = requestedScope || resourceMetadata?.scopes_supported?.join(" ") || clientMetadata.scope;
|
||||
- if (effectiveScope && authServerMetadata?.scopes_supported?.includes("offline_access") && !effectiveScope.split(" ").includes("offline_access") && clientMetadata.grant_types?.includes("refresh_token")) effectiveScope = `${effectiveScope} offline_access`;
|
||||
- return effectiveScope;
|
||||
+ const requiredScopes = requestedScope?.split(/\s+/).filter(Boolean) ?? [];
|
||||
+ const selectedScopes = clientMetadata.scope?.split(/\s+/).filter(Boolean) ?? [];
|
||||
+ const authorizationServerScopes = authServerMetadata?.scopes_supported;
|
||||
+ const resourceScopes = resourceMetadata?.scopes_supported;
|
||||
+ const advertisedScopes = [...new Set([...(authorizationServerScopes ?? []), ...(resourceScopes ?? [])])];
|
||||
+ if (advertisedScopes.length > 0) {
|
||||
+ const unsupportedScope = selectedScopes.find((selectedScope) => !advertisedScopes.includes(selectedScope));
|
||||
+ if (unsupportedScope) throw new Error(`The selected OAuth scope is not advertised by the authorization server or protected resource: ${unsupportedScope}`);
|
||||
+ }
|
||||
+ const effectiveScopes = [...new Set([...requiredScopes, ...selectedScopes])];
|
||||
+ if (effectiveScopes.length === 0) effectiveScopes.push(...new Set(resourceScopes ?? authorizationServerScopes ?? []));
|
||||
+ if (effectiveScopes.length > 0 && authServerMetadata?.scopes_supported?.includes("offline_access") && !effectiveScopes.includes("offline_access") && clientMetadata.grant_types?.includes("refresh_token")) effectiveScopes.push("offline_access");
|
||||
+ return effectiveScopes.length > 0 ? effectiveScopes.join(" ") : void 0;
|
||||
diff --git a/dist/index.mjs b/dist/index.mjs
|
||||
index f02ce3ca394e826fc27c9848dbe9a214bf6ba7a9..cc0b4f30a209297213e1897fc9ff34680066c59b 100644
|
||||
--- a/dist/index.mjs
|
||||
+++ b/dist/index.mjs
|
||||
@@ -632,3 +632,13 @@ function determineScope(options) {
|
||||
- let effectiveScope = requestedScope || resourceMetadata?.scopes_supported?.join(" ") || clientMetadata.scope;
|
||||
- if (effectiveScope && authServerMetadata?.scopes_supported?.includes("offline_access") && !effectiveScope.split(" ").includes("offline_access") && clientMetadata.grant_types?.includes("refresh_token")) effectiveScope = `${effectiveScope} offline_access`;
|
||||
- return effectiveScope;
|
||||
+ const requiredScopes = requestedScope?.split(/\s+/).filter(Boolean) ?? [];
|
||||
+ const selectedScopes = clientMetadata.scope?.split(/\s+/).filter(Boolean) ?? [];
|
||||
+ const authorizationServerScopes = authServerMetadata?.scopes_supported;
|
||||
+ const resourceScopes = resourceMetadata?.scopes_supported;
|
||||
+ const advertisedScopes = [...new Set([...(authorizationServerScopes ?? []), ...(resourceScopes ?? [])])];
|
||||
+ if (advertisedScopes.length > 0) {
|
||||
+ const unsupportedScope = selectedScopes.find((selectedScope) => !advertisedScopes.includes(selectedScope));
|
||||
+ if (unsupportedScope) throw new Error(`The selected OAuth scope is not advertised by the authorization server or protected resource: ${unsupportedScope}`);
|
||||
+ }
|
||||
+ const effectiveScopes = [...new Set([...requiredScopes, ...selectedScopes])];
|
||||
+ if (effectiveScopes.length === 0) effectiveScopes.push(...new Set(resourceScopes ?? authorizationServerScopes ?? []));
|
||||
+ if (effectiveScopes.length > 0 && authServerMetadata?.scopes_supported?.includes("offline_access") && !effectiveScopes.includes("offline_access") && clientMetadata.grant_types?.includes("refresh_token")) effectiveScopes.push("offline_access");
|
||||
+ return effectiveScopes.length > 0 ? effectiveScopes.join(" ") : void 0;
|
||||
@@ -0,0 +1,157 @@
|
||||
diff --git a/dist/cjs/client/auth.js b/dist/cjs/client/auth.js
|
||||
index c2e4fa91d26f5336889f6afa416147db75fc4872..a100af7bbf30bbddbd799b291f21917d9455f8fb 100644
|
||||
--- a/dist/cjs/client/auth.js
|
||||
+++ b/dist/cjs/client/auth.js
|
||||
@@ -246,7 +246,33 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
|
||||
// 2. PRM scopes_supported
|
||||
// 3. Client metadata scope (user-configured fallback)
|
||||
// The resolved scope is used consistently for both DCR and the authorization request.
|
||||
- const resolvedScope = scope || resourceMetadata?.scopes_supported?.join(' ') || provider.clientMetadata.scope;
|
||||
+ // Treat scopes_supported as an availability declaration, never as the
|
||||
+ // permission set to request. Combine challenge-required scopes with the
|
||||
+ // client-selected least-privilege set and add offline_access only when the
|
||||
+ // server advertises both that scope and refresh-token support.
|
||||
+ const requiredScopes = scope?.split(/\s+/).filter(Boolean) ?? [];
|
||||
+ const selectedScopes = provider.clientMetadata.scope?.split(/\s+/).filter(Boolean) ?? [];
|
||||
+ const advertisedScopes = metadata?.scopes_supported ?? resourceMetadata?.scopes_supported;
|
||||
+ if (advertisedScopes) {
|
||||
+ const unsupportedScope = selectedScopes.find(selectedScope => !advertisedScopes.includes(selectedScope));
|
||||
+ if (unsupportedScope) {
|
||||
+ throw new Error(`The selected OAuth scope is not advertised by the authorization server or protected resource: ${unsupportedScope}`);
|
||||
+ }
|
||||
+ }
|
||||
+ const resolvedScopes = [...new Set([...requiredScopes, ...selectedScopes])];
|
||||
+ // Some providers publish the only workable permission set in discovery
|
||||
+ // and omit scope from their 401 challenge. Preserve least-privilege
|
||||
+ // selection when configured, but restore the SDK's advertised fallback
|
||||
+ // when neither the provider challenge nor the admin selected scopes.
|
||||
+ if (resolvedScopes.length === 0 && advertisedScopes) {
|
||||
+ resolvedScopes.push(...new Set(advertisedScopes));
|
||||
+ }
|
||||
+ if (resolvedScopes.includes('offline_access') &&
|
||||
+ !requiredScopes.includes('offline_access') &&
|
||||
+ (!advertisedScopes?.includes('offline_access') || !metadata?.grant_types_supported?.includes('refresh_token'))) {
|
||||
+ resolvedScopes.splice(resolvedScopes.indexOf('offline_access'), 1);
|
||||
+ }
|
||||
+ const resolvedScope = resolvedScopes.length > 0 ? resolvedScopes.join(' ') : undefined;
|
||||
// Handle client registration if needed
|
||||
let clientInformation = await Promise.resolve(provider.clientInformation());
|
||||
if (!clientInformation) {
|
||||
diff --git a/dist/cjs/client/index.d.ts b/dist/cjs/client/index.d.ts
|
||||
index 6f567a193626587a2730b5a49293ca5dfd4181ea..e42d261b43ae1cc60f6de9d014401f69c52b4dc7 100644
|
||||
--- a/dist/cjs/client/index.d.ts
|
||||
+++ b/dist/cjs/client/index.d.ts
|
||||
@@ -20,6 +20,11 @@ export declare function getSupportedElicitationModes(capabilities: ClientCapabil
|
||||
supportsUrlMode: boolean;
|
||||
};
|
||||
export type ClientOptions = ProtocolOptions & {
|
||||
+ /**
|
||||
+ * Protocol version to send in the initialize request.
|
||||
+ * @default LATEST_PROTOCOL_VERSION
|
||||
+ */
|
||||
+ protocolVersion?: string;
|
||||
/**
|
||||
* Capabilities to advertise as being supported by this client.
|
||||
*/
|
||||
diff --git a/dist/cjs/client/index.js b/dist/cjs/client/index.js
|
||||
index 6ac1da14dc7f6211ae70f7711c124b76098816d8..075e4475f51aec1332b8d333a3c9972ac6875bce 100644
|
||||
--- a/dist/cjs/client/index.js
|
||||
+++ b/dist/cjs/client/index.js
|
||||
@@ -109,6 +109,7 @@ class Client extends protocol_js_1.Protocol {
|
||||
this._cachedRequiredTaskTools = new Set();
|
||||
this._listChangedDebounceTimers = new Map();
|
||||
this._capabilities = options?.capabilities ?? {};
|
||||
+ this._protocolVersion = options?.protocolVersion ?? types_js_1.LATEST_PROTOCOL_VERSION;
|
||||
this._jsonSchemaValidator = options?.jsonSchemaValidator ?? new ajv_provider_js_1.AjvJsonSchemaValidator();
|
||||
// Store list changed config for setup after connection (when we know server capabilities)
|
||||
if (options?.listChanged) {
|
||||
@@ -297,7 +298,7 @@ class Client extends protocol_js_1.Protocol {
|
||||
const result = await this.request({
|
||||
method: 'initialize',
|
||||
params: {
|
||||
- protocolVersion: types_js_1.LATEST_PROTOCOL_VERSION,
|
||||
+ protocolVersion: this._protocolVersion,
|
||||
capabilities: this._capabilities,
|
||||
clientInfo: this._clientInfo
|
||||
}
|
||||
diff --git a/dist/esm/client/auth.js b/dist/esm/client/auth.js
|
||||
index e183040fc2bba22ca1ccc784984f3310854403b7..57ef181b35a629f966085a0c0a39064590b597ef 100644
|
||||
--- a/dist/esm/client/auth.js
|
||||
+++ b/dist/esm/client/auth.js
|
||||
@@ -216,12 +216,33 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
|
||||
});
|
||||
}
|
||||
const resource = await selectResourceURL(serverUrl, provider, resourceMetadata);
|
||||
- // Apply scope selection strategy (SEP-835):
|
||||
- // 1. WWW-Authenticate scope (passed via `scope` param)
|
||||
- // 2. PRM scopes_supported
|
||||
- // 3. Client metadata scope (user-configured fallback)
|
||||
- // The resolved scope is used consistently for both DCR and the authorization request.
|
||||
- const resolvedScope = scope || resourceMetadata?.scopes_supported?.join(' ') || provider.clientMetadata.scope;
|
||||
+ // Treat scopes_supported as an availability declaration, never as the
|
||||
+ // permission set to request. Combine challenge-required scopes with the
|
||||
+ // client-selected least-privilege set and add offline_access only when the
|
||||
+ // server advertises both that scope and refresh-token support.
|
||||
+ const requiredScopes = scope?.split(/\s+/).filter(Boolean) ?? [];
|
||||
+ const selectedScopes = provider.clientMetadata.scope?.split(/\s+/).filter(Boolean) ?? [];
|
||||
+ const advertisedScopes = metadata?.scopes_supported ?? resourceMetadata?.scopes_supported;
|
||||
+ if (advertisedScopes) {
|
||||
+ const unsupportedScope = selectedScopes.find(selectedScope => !advertisedScopes.includes(selectedScope));
|
||||
+ if (unsupportedScope) {
|
||||
+ throw new Error(`The selected OAuth scope is not advertised by the authorization server or protected resource: ${unsupportedScope}`);
|
||||
+ }
|
||||
+ }
|
||||
+ const resolvedScopes = [...new Set([...requiredScopes, ...selectedScopes])];
|
||||
+ // Some providers publish the only workable permission set in discovery
|
||||
+ // and omit scope from their 401 challenge. Preserve least-privilege
|
||||
+ // selection when configured, but restore the SDK's advertised fallback
|
||||
+ // when neither the provider challenge nor the admin selected scopes.
|
||||
+ if (resolvedScopes.length === 0 && advertisedScopes) {
|
||||
+ resolvedScopes.push(...new Set(advertisedScopes));
|
||||
+ }
|
||||
+ if (resolvedScopes.includes('offline_access') &&
|
||||
+ !requiredScopes.includes('offline_access') &&
|
||||
+ (!advertisedScopes?.includes('offline_access') || !metadata?.grant_types_supported?.includes('refresh_token'))) {
|
||||
+ resolvedScopes.splice(resolvedScopes.indexOf('offline_access'), 1);
|
||||
+ }
|
||||
+ const resolvedScope = resolvedScopes.length > 0 ? resolvedScopes.join(' ') : undefined;
|
||||
// Handle client registration if needed
|
||||
let clientInformation = await Promise.resolve(provider.clientInformation());
|
||||
if (!clientInformation) {
|
||||
diff --git a/dist/esm/client/index.d.ts b/dist/esm/client/index.d.ts
|
||||
index 6f567a193626587a2730b5a49293ca5dfd4181ea..e42d261b43ae1cc60f6de9d014401f69c52b4dc7 100644
|
||||
--- a/dist/esm/client/index.d.ts
|
||||
+++ b/dist/esm/client/index.d.ts
|
||||
@@ -20,6 +20,11 @@ export declare function getSupportedElicitationModes(capabilities: ClientCapabil
|
||||
supportsUrlMode: boolean;
|
||||
};
|
||||
export type ClientOptions = ProtocolOptions & {
|
||||
+ /**
|
||||
+ * Protocol version to send in the initialize request.
|
||||
+ * @default LATEST_PROTOCOL_VERSION
|
||||
+ */
|
||||
+ protocolVersion?: string;
|
||||
/**
|
||||
* Capabilities to advertise as being supported by this client.
|
||||
*/
|
||||
diff --git a/dist/esm/client/index.js b/dist/esm/client/index.js
|
||||
index 49b12c6cd918c457420fef7ad5528a9443d1a191..cb70263ab608c9f4a426f72362ec208215bc6ea7 100644
|
||||
--- a/dist/esm/client/index.js
|
||||
+++ b/dist/esm/client/index.js
|
||||
@@ -105,6 +105,7 @@ export class Client extends Protocol {
|
||||
this._cachedRequiredTaskTools = new Set();
|
||||
this._listChangedDebounceTimers = new Map();
|
||||
this._capabilities = options?.capabilities ?? {};
|
||||
+ this._protocolVersion = options?.protocolVersion ?? LATEST_PROTOCOL_VERSION;
|
||||
this._jsonSchemaValidator = options?.jsonSchemaValidator ?? new AjvJsonSchemaValidator();
|
||||
// Store list changed config for setup after connection (when we know server capabilities)
|
||||
if (options?.listChanged) {
|
||||
@@ -293,7 +294,7 @@ export class Client extends Protocol {
|
||||
const result = await this.request({
|
||||
method: 'initialize',
|
||||
params: {
|
||||
- protocolVersion: LATEST_PROTOCOL_VERSION,
|
||||
+ protocolVersion: this._protocolVersion,
|
||||
capabilities: this._capabilities,
|
||||
clientInfo: this._clientInfo
|
||||
}
|
||||
@@ -0,0 +1,20 @@
|
||||
diff --git a/dist/index.d.ts b/dist/index.d.ts
|
||||
index 2acf9f2213ac91f71bf844c53bf63be28ce7d79d..49eac35140e3e004963ad5f9b2ffe315a740339f 100644
|
||||
--- a/dist/index.d.ts
|
||||
+++ b/dist/index.d.ts
|
||||
@@ -1,4 +1,5 @@
|
||||
export * from "./routers/index.js";
|
||||
+export * from "./routers/index.js";
|
||||
export * from "./components.jsx";
|
||||
export * from "./lifecycle.js";
|
||||
export { useHref, useIsRouting, useLocation, useMatch, useCurrentMatches, useNavigate, useParams, useResolvedPath, useSearchParams, useBeforeLeave, usePreloadRoute } from "./routing.js";
|
||||
diff --git a/dist/index.jsx b/dist/index.jsx
|
||||
index c9079ba9cf5244de3c4a3fe938d33c67ab13fc00..305f052987ae0b2aec0edb163fec6d0dcf663581 100644
|
||||
--- a/dist/index.jsx
|
||||
+++ b/dist/index.jsx
|
||||
@@ -1,4 +1,5 @@
|
||||
export * from "./routers/index.js";
|
||||
+export * from "./routers/index.js";
|
||||
export * from "./components.jsx";
|
||||
export * from "./lifecycle.js";
|
||||
export { useHref, useIsRouting, useLocation, useMatch, useCurrentMatches, useNavigate, useParams, useResolvedPath, useSearchParams, useBeforeLeave, usePreloadRoute } from "./routing.js";
|
||||
Reference in New Issue
Block a user