gitfor/platform

import { env } from "cloudflare:workers";
import { z } from "zod";
import { run } from "../db";
import { accountDb } from "../scoped-db";
import { forgetLocator, registerLocator } from "../scoped-db/locators";
import { randomToken, sha256Hex } from "../crypto";
import {
  CODE_PREFIX,
  holderOf,
  REFRESH_PREFIX,
  REFRESH_TTL_MS,
  refreshTokenInsert,
  secretFor,
  storeRefreshToken,
  type StoredGrant,
} from "./oauth-store";
import { consumeAuthToken, storeAuthToken } from "../auth-tokens";
import { loadActiveUserById, PAT_PREFIX, toViewer, viewerFromSessionCookie } from "../auth";

import { hasPermission, loadRepo, loadRepoById, repoPermission } from "../repos";
import { enforceRateLimit, requestIp } from "../limits";
import { MCP_AUDIENCE, parseTokenPermissions } from "../token-scope";
import { deleteAccessToken, mintFineGrainedToken, purgeExpiredOAuthTokens, rotateAccessToken } from "./grants";
import { OAuthError, redirectMatches, registerClient, resolveClient } from "./oauth-clients";
import type { OAuthClient } from "./oauth-clients";
import { consentPage, errorPage, signInPage } from "./oauth-consent";
import { EMAIL_UNVERIFIED_MESSAGE, canWriteAsViewer } from "~/lib/email-verification";
import { formatScope, parseScope, SCOPES_SUPPORTED } from "./scopes";
import type { Viewer } from "~/lib/types";

const ACCESS_TTL_MS = 60 * 60 * 1000;
const CODE_TTL_MS = 60 * 1000;
const PENDING_TTL_SECONDS = 600;
const PKCE_VERIFIER = /^[A-Za-z0-9._~-]{43,128}$/;

export const MCP_PATH = "/mcp";

export function resourceUrl(origin: string): string {
  return `${origin}${MCP_PATH}`;
}