Tanish Manku 4f2f082403 mcp: /connections manages personal tokens — create (re-confirmed), show once, list, revoke ...

A signed-in user names a token, picks 30 or 90 days, and confirms with their password
or Google; that sign-in becomes the token's own upstream session and must be the account
on the page. The secret is rendered once in the POST response (never a redirect URL);
the list shows label, hint, and dates only. Revoke is scoped to the user.

Claude-Session: https://claude.ai/code/session_01H3gfN2NCx3hBXSrZXYHUQ3

2026-08-25 00:38:15 -07:00

..

auth

mcp: personal tokens resolve at /mcp through resolveExternalToken

2026-08-25 00:32:01 -07:00

mcp

mcp: personal tokens resolve at /mcp through resolveExternalToken

2026-08-25 00:32:01 -07:00

pages

mcp: /connections manages personal tokens — create (re-confirmed), show once, list, revoke

2026-08-25 00:38:15 -07:00

tokens

mcp: personal tokens resolve at /mcp through resolveExternalToken

2026-08-25 00:32:01 -07:00

upstream

mcp: connections-page building blocks — KV page session, upstream sign-out, CSRF path

2026-08-24 23:50:40 -07:00

app.ts

mcp: landing page at /

2026-08-24 23:56:49 -07:00

config.ts

mcp: wire /authorize — consent page, CSRF, sign-in through the Authenticator, finishAuthorization

2026-08-24 21:04:48 -07:00

encoding.ts

mcp: personal token store — hashed keys, secret-derived record encryption, 90-day cap

2026-08-25 00:25:58 -07:00

index.ts

mcp: prove the full OAuth token loop end to end

2026-08-24 20:31:23 -07:00

oauth-env.d.ts

mcp: wire the OAuth provider — lazy 401, RFC 9728/8414 metadata, DCR, CIMD, validating /authorize

2026-08-24 20:29:23 -07:00

runtime.ts

mcp: wire the OAuth provider — lazy 401, RFC 9728/8414 metadata, DCR, CIMD, validating /authorize

2026-08-24 20:29:23 -07:00