Refactors
- Updated all imports and type references to use zod/v4.
- Replaced deprecated or changed Zod APIs and options across the codebase.
- Adjusted validation schemas and error messages to match Zod v4 requirements.
- Updated dependencies and lockfiles to use Zod v4.
* feat(mcp): add support for public clients with PKCE authentication
- Add conditional client authentication based on client type
- Support public clients using PKCE without client_secret requirement
- Add "none" to supported token endpoint authentication methods
- Make clientSecret optional in database schema for public clients
- Update client registration to handle public clients automatically
- Maintain backward compatibility with confidential clients
Fixes authentication issues with Claude.ai and other public OAuth clients
that use PKCE (Proof Key for Code Exchange) without client secrets.
Resolves#2813
* style: format code with prettier and fix trailing commas
* fix: resolve TypeScript errors in MCP plugin and tests
- Fix missing loginPage in oidcConfig for MCP tests
- Add type assertions for unknown response data types
- Handle optional clientSecret with null coalescing operators
- Update OIDC provider to support "none" auth method in metadata
- Fix type compatibility issues between public and confidential clients
* fix: resolve TypeScript, Vitest, and CI compatibility issues
- Fix missing loginPage in oidcConfig for MCP tests
- Add type assertions for unknown response data types
- Handle optional clientSecret with null coalescing operators
- Update OIDC provider to support "none" auth method in metadata
- Fix async describe callback to use synchronous setup with beforeAll
- Use ephemeral port allocation to prevent CI port conflicts
- Add explicit type annotations to avoid implicit any errors
* OpenAPI Schema Contract Fixed
* fix: resolve lint
* fix: ensure OAuth 2.0 spec compliance for public client registration
- Fix public client registration to omit client_secret field entirely
- Public clients now receive no client_secret property (was empty string)
- Maintains backward compatibility with confidential clients
- Addresses OAuth 2.0 Dynamic Client Registration (RFC 7591) requirements
* update docs
* remove any
* dont return secret on public client oidc
* remove any
* conditionally verify client secret
* update test
---------
Co-authored-by: Bereket Engida <Bekacru@gmail.com>
* fix(api-key): API Keys with expiresAt not null
The `deleteAllExpiredApiKeys` function in the apiKey plugin deletes API keys where `expiresAt` is `null`, despite these keys being intended as non-expiring.
This occurs because the deleteMany query does not explicitly exclude null values in the expiresAt condition.
This leads to unexpected key deletions, affecting keys like
`{ "_id": "6876ba254c23e91c05c9e95b", "expiresAt": null }`.
* Update index.ts
* chore: lint
---------
Co-authored-by: ping-maxwell <maxwell.multinite@gmail.com>
* feat(oidc): add refresh token support to discovery document and token endpoint
* types(oidc): ensure grant_types_supported is non-empty tuple
* fix(oidc): format grant_types_supported array for better readability
* fix(auth): implement standard Base64 encoding for HTTP Basic Auth in token refresh and validation
- Updated `refreshAccessToken` and `validateAuthorizationCode` functions to use standard Base64 encoding instead of URL-safe encoding for HTTP Basic Authentication.
- Ensured compatibility with providers like Notion and Twitter by adhering to OAuth2 specifications (RFC 7617).
- Set default authentication method to "basic" in the generic OAuth plugin for better consistency.
* fix(auth): utilize utility function for standard Base64 encoding in token refresh and validation
- Refactored `refreshAccessToken` and `validateAuthorizationCode` functions to use `encodeBasicAuthHeader` utility for standard Base64 encoding of HTTP Basic Authentication.
- This change enhances compatibility with providers like Notion and Twitter, adhering to OAuth2 specifications (RFC 7617).
- Simplifies the code by removing direct Buffer usage for encoding.
* use better auth utils
* fix base 64 code api
---------
Co-authored-by: Bereket Engida <Bekacru@gmail.com>
* refactor: remove useless variable assignment
* refactor: remove unused param
* docs: extend rate limit docs to include info about connecting ip address and how it's used
* fix: linting
`signUpEmail` destructures the optional `image` field from the request body and uses it when creating the user, but the field isn’t in the `requestBody` schema or the `$Infer` `body` type
We throw errors on both code paths despite it not being used when linking. Move the error to after the link case so that we only bail on missing info if that missing info is actually needed.
KinfeMichael TarikuandGitHub
Fraol LemechaandGitHub
MaxwellandGitHub
Kinfe123
LamiandGitHub
AbdallahandGitHub
ShubhamandGitHub
DannyandGitHub
Andrew PattonandGitHub
Alec LarsonandGitHub
Alexander LyonandGitHub
