Toolcraft: add a production MCP OAuth authorization-server adapter

[kamilio]

Problem

toolcraft/http can protect an MCP resource with oauth, publish RFC 9728 metadata, and verify access tokens, but Toolcraft currently does not provide a production OAuth 2.1 authorization-server adapter for applications that need to authorize their own users.

A multi-user Baby Daybook MCP deployment needs each MCP caller to authorize a separate upstream account. A shared server credential or static bearer token is not acceptable. The MCP client must be able to discover and complete a standards-based authorization-code flow, and Toolcraft's verified context.auth.subject must then select the caller's request-scoped service.

The bundled mcp-oauth package is client-focused. tiny-http-mcp-server accepts an external authorization server/verifier but does not create the authorization server.

Requested capability

Please add a supported production authorization-server package/adapter that composes with createHTTPMCPServer / runHTTPMCP, including:

• OAuth 2.1 authorization code with PKCE
• authorization-server metadata
• dynamic client registration for MCP clients
• exact redirect URI validation
• resource indicators / audience-bound access tokens
• short-lived signed access tokens and JWKS publication
• refresh-token rotation and replay detection
• revocation
• durable storage interfaces for clients, grants, codes, tokens, and user authorization transactions
• hooks for application-owned browser authorization UI
• CSRF/state/nonce helpers and secure cookie defaults
• request-scoped subject propagation compatible with Toolcraft requestServices
• production security documentation and conformance/interoperability tests

Application hook required

The authorization interaction must support an application-defined, one-time credential completion step. For Baby Daybook Apple accounts, Apple redirects through Baby Daybook's registered endpoint and returns an Android intent://callback?... credential. The hosted authorization page needs to let the user paste that one-time callback, validate its state against the pending OAuth transaction, exchange it immediately, and never log or persist the callback itself.

Email/password users can authenticate through the same application hook; the password is exchanged and discarded, while only an encrypted upstream refresh token is retained per OAuth subject.

Security invariant

Two OAuth subjects must never be able to load, refresh, invoke tools with, revoke, or otherwise access each other's upstream sessions. There must be no fallback to a shared environment credential.

[kamilio]

Validated downstream integration details:

• A loopback-only Apple intent completion proof now succeeds against the real Baby Daybook Firebase account.
• The transaction uses a fresh Apple state, loopback host binding, SameSite HttpOnly CSRF cookie, hidden CSRF token, bounded form body, exact intent://callback validation, single consumption, no-store/CSP/referrer protections, immediate Firebase exchange, and no callback persistence.
• The resulting per-user Firebase refresh session can be persisted independently after the callback is discarded.
• Live SDK access, attachments, and all current Firestore/Storage paths are verified.

Checked toolcraft@0.0.124 (published July 7, 2026): it still exposes protected-resource metadata/token verification and bundles client-oriented mcp-oauth, but provides no production authorization server, authorization/token/registration endpoints, durable grants, rotation/revocation store, or application authorization-interaction hook.

The downstream public service remains destroyed/offline. We cannot deploy without either this supported adapter or violating the repository rule against local Toolcraft workarounds. The intent-paste interaction is ready to plug into the requested application-owned authorization hook once available.

[kamilio]

Resolved by 23c1689 with release correction b2b993f. Toolcraft now includes a supported production OAuth authorization-server adapter through toolcraft/http: authorization code + mandatory PKCE S256, RFC 8414 metadata, DCR, exact redirect matching, RFC 8707 resource binding, signed short-lived at+jwt tokens and JWKS, atomic refresh rotation with replay family revocation, token/grant revocation, durable storage interfaces, application-owned authorization interactions, CSRF/state/nonce helpers, bounded request bodies, subject propagation, and per-subject isolation tests. The README documents secure one-time Apple intent callback handling without callback persistence. Verified 16,914 full unit tests, Node 18.18 import, package/workflow/type lint, standalone packing, and external JWKS verifier interoperability. toolcraft@0.0.126 (gitHead b2b993f) exports the adapter and bundles the private server with anonymized package identity; release runs 28891427293, 28891427309, and 28891427491 all succeeded.