@1mcp/agent 0.12.0 → 0.13.0

package/build/auth/sdkOAuthClientProvider.js

@@ -0,0 +1,199 @@
+import { randomUUID } from 'node:crypto';
+import logger from '../logger/logger.js';
+import { ClientSessionManager } from './clientSessionManager.js';
+import { AUTH_CONFIG } from '../constants.js';
+/**
+ * SDK-compatible OAuth client provider that replaces the custom implementation.
+ *
+ * This provider implements the OAuth 2.1 Authorization Code Grant flow using
+ * the SDK's OAuthClientProvider interface while maintaining compatibility with
+ * the existing session storage system.
+ */
+export class SDKOAuthClientProvider {
+    _clientMetadata;
+    _clientInfo;
+    _tokens;
+    _codeVerifier;
+    _state;
+    sessionManager;
+    serverName;
+    config;
+    _authorizationUrl;
+    constructor(serverName, config, sessionStoragePath) {
+        this.serverName = serverName;
+        this.config = config;
+        this.sessionManager = new ClientSessionManager(sessionStoragePath);
+        // Set up client metadata for registration with better defaults
+        this._clientMetadata = {
+            client_name: `1MCP Agent - ${serverName}`,
+            redirect_uris: [config.redirectUrl || ''],
+            grant_types: ['authorization_code', 'refresh_token'],
+            response_types: ['code'],
+            token_endpoint_auth_method: config.clientSecret ? 'client_secret_post' : 'none',
+            scope: config.scopes?.join(' ') || AUTH_CONFIG.CLIENT.OAUTH.DEFAULT_SCOPES.join(' '),
+        };
+        logger.debug(`OAuth client metadata: ${JSON.stringify(this._clientMetadata)}`);
+        // Load existing client info and tokens if available
+        this.loadPersistedData();
+    }
+    get redirectUrl() {
+        return this.config.redirectUrl || '';
+    }
+    get clientMetadata() {
+        return this._clientMetadata;
+    }
+    /**
+     * Returns current client registration information
+     */
+    clientInformation() {
+        return this._clientInfo;
+    }
+    /**
+     * Saves client registration information from dynamic registration
+     */
+    saveClientInformation(clientInfo) {
+        this._clientInfo = clientInfo;
+        this.persistAllData();
+        logger.info(`OAuth client registered for ${this.serverName}: ${clientInfo.client_id}`);
+    }
+    /**
+     * Returns current OAuth tokens
+     */
+    tokens() {
+        return this._tokens;
+    }
+    /**
+     * Saves OAuth tokens after successful authorization
+     */
+    saveTokens(tokens) {
+        this._tokens = tokens;
+        this.persistAllData();
+        logger.info(`OAuth tokens saved for ${this.serverName}`);
+    }
+    /**
+     * Stores authorization URL instead of prompting user in console
+     */
+    redirectToAuthorization(authorizationUrl) {
+        this._authorizationUrl = authorizationUrl.toString();
+    }
+    /**
+     * Gets the current authorization URL
+     */
+    getAuthorizationUrl() {
+        return this._authorizationUrl;
+    }
+    /**
+     * Clears the stored authorization URL
+     */
+    clearAuthorizationUrl() {
+        this._authorizationUrl = undefined;
+    }
+    /**
+     * Saves PKCE code verifier for the authorization session
+     */
+    saveCodeVerifier(codeVerifier) {
+        this._codeVerifier = codeVerifier;
+        this.persistAllData();
+    }
+    /**
+     * Returns the PKCE code verifier for token exchange
+     */
+    codeVerifier() {
+        return this._codeVerifier || '';
+    }
+    /**
+     * Returns the OAuth state parameter for CSRF protection
+     */
+    state() {
+        if (!this._state) {
+            this._state = randomUUID();
+            this.persistAllData();
+        }
+        return this._state;
+    }
+    /**
+     * Custom resource validation (optional)
+     */
+    async validateResourceURL(serverUrl, resource) {
+        const url = typeof serverUrl === 'string' ? new URL(serverUrl) : serverUrl;
+        // Basic validation - can be extended for specific requirements
+        if (resource && !resource.startsWith(url.origin)) {
+            return undefined;
+        }
+        return url;
+    }
+    /**
+     * Load persisted OAuth data from unified client session storage
+     */
+    loadPersistedData() {
+        const clientSession = this.sessionManager.getClientSession(this.serverName);
+        if (clientSession) {
+            // Load client info
+            if (clientSession.clientInfo) {
+                this._clientInfo = JSON.parse(clientSession.clientInfo);
+            }
+            // Load tokens
+            if (clientSession.tokens) {
+                this._tokens = JSON.parse(clientSession.tokens);
+                // Check if tokens are expired
+                if (this._tokens && this.isTokenExpired(this._tokens)) {
+                    logger.warn(`OAuth tokens expired for ${this.serverName}, clearing`);
+                    this._tokens = undefined;
+                    this.persistAllData();
+                }
+            }
+            // Load code verifier
+            if (clientSession.codeVerifier) {
+                this._codeVerifier = clientSession.codeVerifier;
+            }
+            // Load state
+            if (clientSession.state) {
+                this._state = clientSession.state;
+            }
+        }
+    }
+    /**
+     * Persist all OAuth data to unified client session storage
+     */
+    persistAllData() {
+        // Calculate the longest TTL based on the data we have
+        let maxTtl = AUTH_CONFIG.CLIENT.OAUTH.TTL_MS; // Default to 30 days
+        // If we have tokens, use their expiry time
+        if (this._tokens && this._tokens.expires_in) {
+            const tokenTtl = this._tokens.expires_in * 1000;
+            maxTtl = Math.max(maxTtl, tokenTtl);
+        }
+        // Code verifier and state have shorter TTL, but we keep them for completeness
+        const clientSessionData = {
+            serverName: this.serverName,
+            clientInfo: this._clientInfo ? JSON.stringify(this._clientInfo) : undefined,
+            tokens: this._tokens ? JSON.stringify(this._tokens) : undefined,
+            codeVerifier: this._codeVerifier,
+            state: this._state,
+            expires: Date.now() + maxTtl,
+            createdAt: Date.now(),
+        };
+        this.sessionManager.createClientSession(this.serverName, clientSessionData);
+    }
+    /**
+     * Check if OAuth tokens are expired
+     */
+    isTokenExpired(tokens) {
+        if (!tokens.expires_in) {
+            return false; // No expiration info, assume valid
+        }
+        // This is a simple check - in practice, you might want to store the issued_at time
+        // For now, we'll rely on the session storage TTL for expiration
+        return false;
+    }
+    /**
+     * Clean up resources
+     */
+    shutdown() {
+        // Clean up temporary session data by clearing verifier and state
+        this._codeVerifier = undefined;
+        this._state = undefined;
+        this.persistAllData();
+    }
+}
+//# sourceMappingURL=sdkOAuthClientProvider.js.map

package/build/auth/sdkOAuthClientProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdkOAuthClientProvider.js","sourceRoot":"","sources":["../../src/auth/sdkOAuthClientProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAOzC,OAAO,MAAM,MAAM,qBAAqB,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAa9C;;;;;;GAMG;AACH,MAAM,OAAO,sBAAsB;IACzB,eAAe,CAAsB;IACrC,WAAW,CAA8B;IACzC,OAAO,CAAe;IACtB,aAAa,CAAU;IACvB,MAAM,CAAU;IAChB,cAAc,CAAuB;IACrC,UAAU,CAAS;IACnB,MAAM,CAAoB;IAC1B,iBAAiB,CAAU;IAEnC,YAAY,UAAkB,EAAE,MAAyB,EAAE,kBAA2B;QACpF,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,cAAc,GAAG,IAAI,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;QAEnE,+DAA+D;QAC/D,IAAI,CAAC,eAAe,GAAG;YACrB,WAAW,EAAE,gBAAgB,UAAU,EAAE;YACzC,aAAa,EAAE,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;YACzC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,0BAA0B,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM;YAC/E,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;SACrF,CAAC;QAEF,MAAM,CAAC,KAAK,CAAC,0BAA0B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAE/E,oDAAoD;QACpD,IAAI,CAAC,iBAAiB,EAAE,CAAC;IAC3B,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;IACvC,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,qBAAqB,CAAC,UAAsC;QAC1D,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC;QAC9B,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,+BAA+B,IAAI,CAAC,UAAU,KAAK,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;IACzF,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,MAAmB;QAC5B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,0BAA0B,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,uBAAuB,CAAC,gBAAqB;QAC3C,IAAI,CAAC,iBAAiB,GAAG,gBAAgB,CAAC,QAAQ,EAAE,CAAC;IACvD,CAAC;IAED;;OAEG;IACH,mBAAmB;QACjB,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,qBAAqB;QACnB,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,YAAoB;QACnC,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;QAClC,IAAI,CAAC,cAAc,EAAE,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,mBAAmB,CAAC,SAAuB,EAAE,QAAiB;QAClE,MAAM,GAAG,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,+DAA+D;QAC/D,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACjD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;OAEG;IACK,iBAAiB;QACvB,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAE5E,IAAI,aAAa,EAAE,CAAC;YAClB,mBAAmB;YACnB,IAAI,aAAa,CAAC,UAAU,EAAE,CAAC;gBAC7B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;YAC1D,CAAC;YAED,cAAc;YACd,IAAI,aAAa,CAAC,MAAM,EAAE,CAAC;gBACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;gBAEhD,8BAA8B;gBAC9B,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBACtD,MAAM,CAAC,IAAI,CAAC,4BAA4B,IAAI,CAAC,UAAU,YAAY,CAAC,CAAC;oBACrE,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;oBACzB,IAAI,CAAC,cAAc,EAAE,CAAC;gBACxB,CAAC;YACH,CAAC;YAED,qBAAqB;YACrB,IAAI,aAAa,CAAC,YAAY,EAAE,CAAC;gBAC/B,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC,YAAY,CAAC;YAClD,CAAC;YAED,aAAa;YACb,IAAI,aAAa,CAAC,KAAK,EAAE,CAAC;gBACxB,IAAI,CAAC,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACK,cAAc;QACpB,sDAAsD;QACtD,IAAI,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,qBAAqB;QAEnE,2CAA2C;QAC3C,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;YAChD,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACtC,CAAC;QAED,8EAA8E;QAC9E,MAAM,iBAAiB,GAAsB;YAC3C,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;YAC3E,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;YAC/D,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,KAAK,EAAE,IAAI,CAAC,MAAM;YAClB,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM;YAC5B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QAEF,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;IAC9E,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,MAAmB;QACxC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC,CAAC,mCAAmC;QACnD,CAAC;QAED,mFAAmF;QACnF,gEAAgE;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,iEAAiE;QACjE,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,IAAI,CAAC,cAAc,EAAE,CAAC;IACxB,CAAC;CACF"}

package/build/auth/sdkOAuthServerProvider.d.ts

@@ -0,0 +1,63 @@
+import type { Response } from 'express';
+import type { OAuthServerProvider, AuthorizationParams } from '@modelcontextprotocol/sdk/server/auth/provider.js';
+import type { OAuthRegisteredClientsStore } from '@modelcontextprotocol/sdk/server/auth/clients.js';
+import type { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types.js';
+import type { OAuthClientInformationFull, OAuthTokens, OAuthTokenRevocationRequest } from '@modelcontextprotocol/sdk/shared/auth.js';
+/**
+ * Implementation of SDK's OAuthServerProvider interface using existing SessionManager.
+ *
+ * This provider implements OAuth 2.1 server functionality using the MCP SDK's interfaces
+ * while maintaining compatibility with the existing session storage system.
+ */
+export declare class SDKOAuthServerProvider implements OAuthServerProvider {
+    private sessionManager;
+    private configManager;
+    private _clientsStore;
+    constructor(sessionStoragePath?: string);
+    get clientsStore(): OAuthRegisteredClientsStore;
+    /**
+     * Handles the authorization request with scope validation and user consent
+     */
+    authorize(client: OAuthClientInformationFull, params: AuthorizationParams, res: Response): Promise<void>;
+    /**
+     * Determines if user consent is required for the authorization
+     */
+    private requiresUserConsent;
+    /**
+     * Renders the consent page for scope selection
+     */
+    private renderConsentPage;
+    /**
+     * Approves the authorization and redirects back to client
+     */
+    approveAuthorization(client: OAuthClientInformationFull, params: AuthorizationParams, grantedScopes: string[], res: Response): Promise<void>;
+    /**
+     * Generates the HTML for the consent page
+     */
+    private generateConsentPageHtml;
+    /**
+     * Retrieves the PKCE challenge for an authorization code
+     */
+    challengeForAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string): Promise<string>;
+    /**
+     * Exchanges authorization code for access token
+     */
+    exchangeAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string, _codeVerifier?: string, redirectUri?: string, resource?: URL): Promise<OAuthTokens>;
+    /**
+     * Exchanges refresh token for new access token (not implemented)
+     */
+    exchangeRefreshToken(_client: OAuthClientInformationFull, _refreshToken: string, _scopes?: string[], _resource?: URL): Promise<OAuthTokens>;
+    /**
+     * Verifies access token and returns auth info with granted scopes
+     */
+    verifyAccessToken(token: string): Promise<AuthInfo>;
+    /**
+     * Revokes a token
+     */
+    revokeToken(client: OAuthClientInformationFull, request: OAuthTokenRevocationRequest): Promise<void>;
+    /**
+     * Graceful shutdown
+     */
+    shutdown(): void;
+}
+//# sourceMappingURL=sdkOAuthServerProvider.d.ts.map

package/build/auth/sdkOAuthServerProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdkOAuthServerProvider.d.ts","sourceRoot":"","sources":["../../src/auth/sdkOAuthServerProvider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,mDAAmD,CAAC;AAClH,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AACpG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,KAAK,EACV,0BAA0B,EAC1B,WAAW,EACX,2BAA2B,EAC5B,MAAM,0CAA0C,CAAC;AA2FlD;;;;;GAKG;AACH,qBAAa,sBAAuB,YAAW,mBAAmB;IAChE,OAAO,CAAC,cAAc,CAAuB;IAC7C,OAAO,CAAC,aAAa,CAAqB;IAC1C,OAAO,CAAC,aAAa,CAA8B;gBAEvC,kBAAkB,CAAC,EAAE,MAAM;IAMvC,IAAI,YAAY,IAAI,2BAA2B,CAE9C;IAED;;OAEG;IACG,SAAS,CAAC,MAAM,EAAE,0BAA0B,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAkD9G;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAO3B;;OAEG;YACW,iBAAiB;IAgB/B;;OAEG;IACU,oBAAoB,CAC/B,MAAM,EAAE,0BAA0B,EAClC,MAAM,EAAE,mBAAmB,EAC3B,aAAa,EAAE,MAAM,EAAE,EACvB,GAAG,EAAE,QAAQ,GACZ,OAAO,CAAC,IAAI,CAAC;IAyChB;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAyF/B;;OAEG;IACG,6BAA6B,CAAC,MAAM,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAgBnH;;OAEG;IACG,yBAAyB,CAC7B,MAAM,EAAE,0BAA0B,EAClC,iBAAiB,EAAE,MAAM,EAGzB,aAAa,CAAC,EAAE,MAAM,EACtB,WAAW,CAAC,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,GAAG,GACb,OAAO,CAAC,WAAW,CAAC;IAgEvB;;OAEG;IACG,oBAAoB,CACxB,OAAO,EAAE,0BAA0B,EACnC,aAAa,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE,MAAM,EAAE,EAClB,SAAS,CAAC,EAAE,GAAG,GACd,OAAO,CAAC,WAAW,CAAC;IAIvB;;OAEG;IACG,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IA+CzD;;OAEG;IACG,WAAW,CAAC,MAAM,EAAE,0BAA0B,EAAE,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC;IAoB1G;;OAEG;IACH,QAAQ,IAAI,IAAI;CAGjB"}