@ashx-j/lunr 0.1.0

package/dist/builtin-extensions/pi-mcp-adapter/mcp-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-auth.d.ts","sourceRoot":"","sources":["../../../src/builtin-extensions/pi-mcp-adapter/mcp-auth.ts"],"names":[],"mappings":"AACA;;;;;;;;GAQG;AAOH,iCAAiC;AACjC,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,mEAAmE;AACnE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,uCAAuC;AACvC,MAAM,WAAW,SAAS;IACxB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAmBD;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE/D;AAuCD;;GAEG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAEtE;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAW1F;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAM5F;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAkBxD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC1B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,YAAY,EACpB,SAAS,CAAC,EAAE,MAAM,GACjB,IAAI,CASN;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,gBAAgB,EAC5B,SAAS,CAAC,EAAE,MAAM,GACjB,IAAI,CASN;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CASrG;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAM1D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAS5F;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGpE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAMxD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAKjE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAG3D;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAE5D;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAMxD;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAMpD","sourcesContent":["// @ts-nocheck\n/**\n * MCP Auth Storage Module\n * \n * Handles secure storage of OAuth credentials, tokens, client information,\n * and PKCE state for MCP servers.\n * \n * Token storage location: $MCP_OAUTH_DIR/sha256-<server-hash>/tokens.json when set,\n * otherwise <Pi agent dir>/mcp-oauth/sha256-<server-hash>/tokens.json\n */\n\nimport { createHash } from 'crypto';\nimport { mkdirSync, readFileSync, writeFileSync, existsSync, rmSync } from 'fs';\nimport { join } from 'path';\nimport { getAgentPath } from './agent-dir.ts';\n\n/** OAuth token storage format */\nexport interface StoredTokens {\n  accessToken: string;\n  refreshToken?: string;\n  expiresAt?: number; // Unix timestamp in seconds\n  scope?: string;\n}\n\n/** OAuth client information from dynamic or static registration */\nexport interface StoredClientInfo {\n  clientId: string;\n  clientSecret?: string;\n  clientIdIssuedAt?: number;\n  clientSecretExpiresAt?: number;\n  redirectUris?: string[];\n}\n\n/** Complete auth entry for a server */\nexport interface AuthEntry {\n  tokens?: StoredTokens;\n  clientInfo?: StoredClientInfo;\n  codeVerifier?: string;\n  oauthState?: string;\n  serverUrl?: string; // Track the URL these credentials are for\n}\n\n// Base directory for auth storage - can be overridden via env var for testing\nfunction getAuthBaseDir(): string {\n  const override = process.env.MCP_OAUTH_DIR?.trim();\n  return override ? override : getAgentPath('mcp-oauth');\n}\n\n/**\n * Get the server-specific directory path.\n */\nfunction getServerDir(serverName: string): string {\n  if (typeof serverName !== 'string') {\n    throw new Error(`Invalid MCP server name: ${JSON.stringify(serverName)}`);\n  }\n  const storageKey = createHash('sha256').update(serverName, 'utf8').digest('hex');\n  return join(getAuthBaseDir(), `sha256-${storageKey}`);\n}\n\n/**\n * Get the tokens file path for a server.\n */\nexport function getAuthEntryFilePath(serverName: string): string {\n  return join(getServerDir(serverName), 'tokens.json');\n}\n\n/**\n * Ensure the server directory exists with secure permissions.\n */\nfunction ensureServerDir(serverName: string): void {\n  const dir = getServerDir(serverName);\n  if (!existsSync(dir)) {\n    mkdirSync(dir, { recursive: true, mode: 0o700 });\n  }\n}\n\n/**\n * Read the auth entry for a server from disk.\n * Returns undefined if file doesn't exist.\n */\nfunction readAuthEntry(serverName: string): AuthEntry | undefined {\n  const filePath = getAuthEntryFilePath(serverName);\n  try {\n    if (!existsSync(filePath)) {\n      return undefined;\n    }\n    const data = readFileSync(filePath, 'utf-8');\n    return JSON.parse(data) as AuthEntry;\n  } catch (error) {\n    console.error(`Failed to read auth entry for ${serverName}:`, error);\n    return undefined;\n  }\n}\n\n/**\n * Write the auth entry for a server to disk with secure permissions.\n */\nfunction writeAuthEntry(serverName: string, entry: AuthEntry): void {\n  ensureServerDir(serverName);\n  const filePath = getAuthEntryFilePath(serverName);\n  writeFileSync(filePath, JSON.stringify(entry, null, 2), { mode: 0o600 });\n}\n\n/**\n * Get auth entry for a server.\n */\nexport function getAuthEntry(serverName: string): AuthEntry | undefined {\n  return readAuthEntry(serverName);\n}\n\n/**\n * Get auth entry and validate it's for the correct URL.\n * Returns undefined if URL has changed (credentials are invalid).\n */\nexport function getAuthForUrl(serverName: string, serverUrl: string): AuthEntry | undefined {\n  const entry = getAuthEntry(serverName);\n  if (!entry) return undefined;\n\n  // If no serverUrl is stored, this is from an old version - consider it invalid\n  if (!entry.serverUrl) return undefined;\n\n  // If URL has changed, credentials are invalid\n  if (entry.serverUrl !== serverUrl) return undefined;\n\n  return entry;\n}\n\n/**\n * Save auth entry for a server.\n */\nexport function saveAuthEntry(serverName: string, entry: AuthEntry, serverUrl?: string): void {\n  // Always update serverUrl if provided\n  if (serverUrl) {\n    entry.serverUrl = serverUrl;\n  }\n  writeAuthEntry(serverName, entry);\n}\n\n/**\n * Remove auth entry for a server.\n * Also removes the server directory if empty.\n */\nexport function removeAuthEntry(serverName: string): void {\n  try {\n    const filePath = getAuthEntryFilePath(serverName);\n    if (existsSync(filePath)) {\n      writeFileSync(filePath, '{}', { mode: 0o600 });\n    }\n    // Try to remove the directory\n    const dir = getServerDir(serverName);\n    if (existsSync(dir)) {\n      try {\n        rmSync(dir, { recursive: true });\n      } catch {\n        // Directory may not be empty, ignore\n      }\n    }\n  } catch (error) {\n    console.error(`Failed to remove auth entry for ${serverName}:`, error);\n  }\n}\n\n/**\n * Update tokens for a server.\n */\nexport function updateTokens(\n  serverName: string, \n  tokens: StoredTokens, \n  serverUrl?: string\n): void {\n  const entry = getAuthEntry(serverName) ?? {};\n  if (serverUrl && entry.serverUrl !== serverUrl) {\n    delete entry.clientInfo;\n    delete entry.codeVerifier;\n    delete entry.oauthState;\n  }\n  entry.tokens = tokens;\n  saveAuthEntry(serverName, entry, serverUrl);\n}\n\n/**\n * Update client info for a server.\n */\nexport function updateClientInfo(\n  serverName: string, \n  clientInfo: StoredClientInfo, \n  serverUrl?: string\n): void {\n  const entry = getAuthEntry(serverName) ?? {};\n  if (serverUrl && entry.serverUrl !== serverUrl) {\n    delete entry.tokens;\n    delete entry.codeVerifier;\n    delete entry.oauthState;\n  }\n  entry.clientInfo = clientInfo;\n  saveAuthEntry(serverName, entry, serverUrl);\n}\n\n/**\n * Update code verifier for a server.\n */\nexport function updateCodeVerifier(serverName: string, codeVerifier: string, serverUrl?: string): void {\n  const entry = getAuthEntry(serverName) ?? {};\n  if (serverUrl && entry.serverUrl !== serverUrl) {\n    delete entry.tokens;\n    delete entry.clientInfo;\n    delete entry.oauthState;\n  }\n  entry.codeVerifier = codeVerifier;\n  saveAuthEntry(serverName, entry, serverUrl);\n}\n\n/**\n * Clear code verifier for a server.\n */\nexport function clearCodeVerifier(serverName: string): void {\n  const entry = getAuthEntry(serverName);\n  if (entry) {\n    delete entry.codeVerifier;\n    saveAuthEntry(serverName, entry);\n  }\n}\n\n/**\n * Update OAuth state for a server.\n */\nexport function updateOAuthState(serverName: string, state: string, serverUrl?: string): void {\n  const entry = getAuthEntry(serverName) ?? {};\n  if (serverUrl && entry.serverUrl !== serverUrl) {\n    delete entry.tokens;\n    delete entry.clientInfo;\n    delete entry.codeVerifier;\n  }\n  entry.oauthState = state;\n  saveAuthEntry(serverName, entry, serverUrl);\n}\n\n/**\n * Get OAuth state for a server.\n */\nexport function getOAuthState(serverName: string): string | undefined {\n  const entry = getAuthEntry(serverName);\n  return entry?.oauthState;\n}\n\n/**\n * Clear OAuth state for a server.\n */\nexport function clearOAuthState(serverName: string): void {\n  const entry = getAuthEntry(serverName);\n  if (entry) {\n    delete entry.oauthState;\n    saveAuthEntry(serverName, entry);\n  }\n}\n\n/**\n * Check if stored tokens are expired.\n * Returns null if no tokens exist, false if no expiry or not expired, true if expired.\n */\nexport function isTokenExpired(serverName: string): boolean | null {\n  const entry = getAuthEntry(serverName);\n  if (!entry?.tokens) return null;\n  if (!entry.tokens.expiresAt) return false;\n  return entry.tokens.expiresAt < Date.now() / 1000;\n}\n\n/**\n * Check if a server has stored tokens.\n */\nexport function hasStoredTokens(serverName: string): boolean {\n  const entry = getAuthEntry(serverName);\n  return !!entry?.tokens;\n}\n\n/**\n * Clear all credentials for a server.\n */\nexport function clearAllCredentials(serverName: string): void {\n  removeAuthEntry(serverName);\n}\n\n/**\n * Clear only client info for a server.\n */\nexport function clearClientInfo(serverName: string): void {\n  const entry = getAuthEntry(serverName);\n  if (entry) {\n    delete entry.clientInfo;\n    saveAuthEntry(serverName, entry);\n  }\n}\n\n/**\n * Clear only tokens for a server.\n */\nexport function clearTokens(serverName: string): void {\n  const entry = getAuthEntry(serverName);\n  if (entry) {\n    delete entry.tokens;\n    saveAuthEntry(serverName, entry);\n  }\n}\n"]}

package/dist/builtin-extensions/pi-mcp-adapter/mcp-auth.js

@@ -0,0 +1,252 @@
+// @ts-nocheck
+/**
+ * MCP Auth Storage Module
+ *
+ * Handles secure storage of OAuth credentials, tokens, client information,
+ * and PKCE state for MCP servers.
+ *
+ * Token storage location: $MCP_OAUTH_DIR/sha256-<server-hash>/tokens.json when set,
+ * otherwise <Pi agent dir>/mcp-oauth/sha256-<server-hash>/tokens.json
+ */
+import { createHash } from 'crypto';
+import { mkdirSync, readFileSync, writeFileSync, existsSync, rmSync } from 'fs';
+import { join } from 'path';
+import { getAgentPath } from './agent-dir.js';
+// Base directory for auth storage - can be overridden via env var for testing
+function getAuthBaseDir() {
+    const override = process.env.MCP_OAUTH_DIR?.trim();
+    return override ? override : getAgentPath('mcp-oauth');
+}
+/**
+ * Get the server-specific directory path.
+ */
+function getServerDir(serverName) {
+    if (typeof serverName !== 'string') {
+        throw new Error(`Invalid MCP server name: ${JSON.stringify(serverName)}`);
+    }
+    const storageKey = createHash('sha256').update(serverName, 'utf8').digest('hex');
+    return join(getAuthBaseDir(), `sha256-${storageKey}`);
+}
+/**
+ * Get the tokens file path for a server.
+ */
+export function getAuthEntryFilePath(serverName) {
+    return join(getServerDir(serverName), 'tokens.json');
+}
+/**
+ * Ensure the server directory exists with secure permissions.
+ */
+function ensureServerDir(serverName) {
+    const dir = getServerDir(serverName);
+    if (!existsSync(dir)) {
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+    }
+}
+/**
+ * Read the auth entry for a server from disk.
+ * Returns undefined if file doesn't exist.
+ */
+function readAuthEntry(serverName) {
+    const filePath = getAuthEntryFilePath(serverName);
+    try {
+        if (!existsSync(filePath)) {
+            return undefined;
+        }
+        const data = readFileSync(filePath, 'utf-8');
+        return JSON.parse(data);
+    }
+    catch (error) {
+        console.error(`Failed to read auth entry for ${serverName}:`, error);
+        return undefined;
+    }
+}
+/**
+ * Write the auth entry for a server to disk with secure permissions.
+ */
+function writeAuthEntry(serverName, entry) {
+    ensureServerDir(serverName);
+    const filePath = getAuthEntryFilePath(serverName);
+    writeFileSync(filePath, JSON.stringify(entry, null, 2), { mode: 0o600 });
+}
+/**
+ * Get auth entry for a server.
+ */
+export function getAuthEntry(serverName) {
+    return readAuthEntry(serverName);
+}
+/**
+ * Get auth entry and validate it's for the correct URL.
+ * Returns undefined if URL has changed (credentials are invalid).
+ */
+export function getAuthForUrl(serverName, serverUrl) {
+    const entry = getAuthEntry(serverName);
+    if (!entry)
+        return undefined;
+    // If no serverUrl is stored, this is from an old version - consider it invalid
+    if (!entry.serverUrl)
+        return undefined;
+    // If URL has changed, credentials are invalid
+    if (entry.serverUrl !== serverUrl)
+        return undefined;
+    return entry;
+}
+/**
+ * Save auth entry for a server.
+ */
+export function saveAuthEntry(serverName, entry, serverUrl) {
+    // Always update serverUrl if provided
+    if (serverUrl) {
+        entry.serverUrl = serverUrl;
+    }
+    writeAuthEntry(serverName, entry);
+}
+/**
+ * Remove auth entry for a server.
+ * Also removes the server directory if empty.
+ */
+export function removeAuthEntry(serverName) {
+    try {
+        const filePath = getAuthEntryFilePath(serverName);
+        if (existsSync(filePath)) {
+            writeFileSync(filePath, '{}', { mode: 0o600 });
+        }
+        // Try to remove the directory
+        const dir = getServerDir(serverName);
+        if (existsSync(dir)) {
+            try {
+                rmSync(dir, { recursive: true });
+            }
+            catch {
+                // Directory may not be empty, ignore
+            }
+        }
+    }
+    catch (error) {
+        console.error(`Failed to remove auth entry for ${serverName}:`, error);
+    }
+}
+/**
+ * Update tokens for a server.
+ */
+export function updateTokens(serverName, tokens, serverUrl) {
+    const entry = getAuthEntry(serverName) ?? {};
+    if (serverUrl && entry.serverUrl !== serverUrl) {
+        delete entry.clientInfo;
+        delete entry.codeVerifier;
+        delete entry.oauthState;
+    }
+    entry.tokens = tokens;
+    saveAuthEntry(serverName, entry, serverUrl);
+}
+/**
+ * Update client info for a server.
+ */
+export function updateClientInfo(serverName, clientInfo, serverUrl) {
+    const entry = getAuthEntry(serverName) ?? {};
+    if (serverUrl && entry.serverUrl !== serverUrl) {
+        delete entry.tokens;
+        delete entry.codeVerifier;
+        delete entry.oauthState;
+    }
+    entry.clientInfo = clientInfo;
+    saveAuthEntry(serverName, entry, serverUrl);
+}
+/**
+ * Update code verifier for a server.
+ */
+export function updateCodeVerifier(serverName, codeVerifier, serverUrl) {
+    const entry = getAuthEntry(serverName) ?? {};
+    if (serverUrl && entry.serverUrl !== serverUrl) {
+        delete entry.tokens;
+        delete entry.clientInfo;
+        delete entry.oauthState;
+    }
+    entry.codeVerifier = codeVerifier;
+    saveAuthEntry(serverName, entry, serverUrl);
+}
+/**
+ * Clear code verifier for a server.
+ */
+export function clearCodeVerifier(serverName) {
+    const entry = getAuthEntry(serverName);
+    if (entry) {
+        delete entry.codeVerifier;
+        saveAuthEntry(serverName, entry);
+    }
+}
+/**
+ * Update OAuth state for a server.
+ */
+export function updateOAuthState(serverName, state, serverUrl) {
+    const entry = getAuthEntry(serverName) ?? {};
+    if (serverUrl && entry.serverUrl !== serverUrl) {
+        delete entry.tokens;
+        delete entry.clientInfo;
+        delete entry.codeVerifier;
+    }
+    entry.oauthState = state;
+    saveAuthEntry(serverName, entry, serverUrl);
+}
+/**
+ * Get OAuth state for a server.
+ */
+export function getOAuthState(serverName) {
+    const entry = getAuthEntry(serverName);
+    return entry?.oauthState;
+}
+/**
+ * Clear OAuth state for a server.
+ */
+export function clearOAuthState(serverName) {
+    const entry = getAuthEntry(serverName);
+    if (entry) {
+        delete entry.oauthState;
+        saveAuthEntry(serverName, entry);
+    }
+}
+/**
+ * Check if stored tokens are expired.
+ * Returns null if no tokens exist, false if no expiry or not expired, true if expired.
+ */
+export function isTokenExpired(serverName) {
+    const entry = getAuthEntry(serverName);
+    if (!entry?.tokens)
+        return null;
+    if (!entry.tokens.expiresAt)
+        return false;
+    return entry.tokens.expiresAt < Date.now() / 1000;
+}
+/**
+ * Check if a server has stored tokens.
+ */
+export function hasStoredTokens(serverName) {
+    const entry = getAuthEntry(serverName);
+    return !!entry?.tokens;
+}
+/**
+ * Clear all credentials for a server.
+ */
+export function clearAllCredentials(serverName) {
+    removeAuthEntry(serverName);
+}
+/**
+ * Clear only client info for a server.
+ */
+export function clearClientInfo(serverName) {
+    const entry = getAuthEntry(serverName);
+    if (entry) {
+        delete entry.clientInfo;
+        saveAuthEntry(serverName, entry);
+    }
+}
+/**
+ * Clear only tokens for a server.
+ */
+export function clearTokens(serverName) {
+    const entry = getAuthEntry(serverName);
+    if (entry) {
+        delete entry.tokens;
+        saveAuthEntry(serverName, entry);
+    }
+}
+//# sourceMappingURL=mcp-auth.js.map

package/dist/builtin-extensions/pi-mcp-adapter/mcp-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-auth.js","sourceRoot":"","sources":["../../../src/builtin-extensions/pi-mcp-adapter/mcp-auth.ts"],"names":[],"mappings":"AAAA,cAAc;AACd;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAChF,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AA4B9C,8EAA8E;AAC9E,SAAS,cAAc,GAAW;IAChC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IACnD,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;AAAA,CACxD;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,UAAkB,EAAU;IAChD,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjF,OAAO,IAAI,CAAC,cAAc,EAAE,EAAE,UAAU,UAAU,EAAE,CAAC,CAAC;AAAA,CACvD;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB,EAAU;IAC/D,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC,CAAC;AAAA,CACtD;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,UAAkB,EAAQ;IACjD,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,CAAC;AAAA,CACF;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,UAAkB,EAAyB;IAChE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAc,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,iCAAiC,UAAU,GAAG,EAAE,KAAK,CAAC,CAAC;QACrE,OAAO,SAAS,CAAC;IACnB,CAAC;AAAA,CACF;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,UAAkB,EAAE,KAAgB,EAAQ;IAClE,eAAe,CAAC,UAAU,CAAC,CAAC;IAC5B,MAAM,QAAQ,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAClD,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAAA,CAC1E;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,UAAkB,EAAyB;IACtE,OAAO,aAAa,CAAC,UAAU,CAAC,CAAC;AAAA,CAClC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,UAAkB,EAAE,SAAiB,EAAyB;IAC1F,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAE7B,+EAA+E;IAC/E,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IAEvC,8CAA8C;IAC9C,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAEpD,OAAO,KAAK,CAAC;AAAA,CACd;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,UAAkB,EAAE,KAAgB,EAAE,SAAkB,EAAQ;IAC5F,sCAAsC;IACtC,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;IAC9B,CAAC;IACD,cAAc,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AAAA,CACnC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkB,EAAQ;IACxD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,8BAA8B;QAC9B,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QACrC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACP,qCAAqC;YACvC,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,mCAAmC,UAAU,GAAG,EAAE,KAAK,CAAC,CAAC;IACzE,CAAC;AAAA,CACF;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAC1B,UAAkB,EAClB,MAAoB,EACpB,SAAkB,EACZ;IACN,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC7C,IAAI,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC,UAAU,CAAC;QACxB,OAAO,KAAK,CAAC,YAAY,CAAC;QAC1B,OAAO,KAAK,CAAC,UAAU,CAAC;IAC1B,CAAC;IACD,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;IACtB,aAAa,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;AAAA,CAC7C;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAAkB,EAClB,UAA4B,EAC5B,SAAkB,EACZ;IACN,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC7C,IAAI,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC,MAAM,CAAC;QACpB,OAAO,KAAK,CAAC,YAAY,CAAC;QAC1B,OAAO,KAAK,CAAC,UAAU,CAAC;IAC1B,CAAC;IACD,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;IAC9B,aAAa,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;AAAA,CAC7C;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB,EAAE,YAAoB,EAAE,SAAkB,EAAQ;IACrG,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC7C,IAAI,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC,MAAM,CAAC;QACpB,OAAO,KAAK,CAAC,UAAU,CAAC;QACxB,OAAO,KAAK,CAAC,UAAU,CAAC;IAC1B,CAAC;IACD,KAAK,CAAC,YAAY,GAAG,YAAY,CAAC;IAClC,aAAa,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;AAAA,CAC7C;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAkB,EAAQ;IAC1D,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACvC,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,KAAK,CAAC,YAAY,CAAC;QAC1B,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;AAAA,CACF;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAkB,EAAE,KAAa,EAAE,SAAkB,EAAQ;IAC5F,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC7C,IAAI,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC,MAAM,CAAC;QACpB,OAAO,KAAK,CAAC,UAAU,CAAC;QACxB,OAAO,KAAK,CAAC,YAAY,CAAC;IAC5B,CAAC;IACD,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC;IACzB,aAAa,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;AAAA,CAC7C;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,UAAkB,EAAsB;IACpE,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACvC,OAAO,KAAK,EAAE,UAAU,CAAC;AAAA,CAC1B;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkB,EAAQ;IACxD,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACvC,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,KAAK,CAAC,UAAU,CAAC;QACxB,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;AAAA,CACF;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,UAAkB,EAAkB;IACjE,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK,EAAE,MAAM;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAAA,CACnD;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkB,EAAW;IAC3D,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACvC,OAAO,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC;AAAA,CACxB;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAkB,EAAQ;IAC5D,eAAe,CAAC,UAAU,CAAC,CAAC;AAAA,CAC7B;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkB,EAAQ;IACxD,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACvC,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,KAAK,CAAC,UAAU,CAAC;QACxB,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;AAAA,CACF;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,UAAkB,EAAQ;IACpD,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACvC,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,KAAK,CAAC,MAAM,CAAC;QACpB,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;AAAA,CACF","sourcesContent":["// @ts-nocheck\n/**\n * MCP Auth Storage Module\n * \n * Handles secure storage of OAuth credentials, tokens, client information,\n * and PKCE state for MCP servers.\n * \n * Token storage location: $MCP_OAUTH_DIR/sha256-<server-hash>/tokens.json when set,\n * otherwise <Pi agent dir>/mcp-oauth/sha256-<server-hash>/tokens.json\n */\n\nimport { createHash } from 'crypto';\nimport { mkdirSync, readFileSync, writeFileSync, existsSync, rmSync } from 'fs';\nimport { join } from 'path';\nimport { getAgentPath } from './agent-dir.ts';\n\n/** OAuth token storage format */\nexport interface StoredTokens {\n  accessToken: string;\n  refreshToken?: string;\n  expiresAt?: number; // Unix timestamp in seconds\n  scope?: string;\n}\n\n/** OAuth client information from dynamic or static registration */\nexport interface StoredClientInfo {\n  clientId: string;\n  clientSecret?: string;\n  clientIdIssuedAt?: number;\n  clientSecretExpiresAt?: number;\n  redirectUris?: string[];\n}\n\n/** Complete auth entry for a server */\nexport interface AuthEntry {\n  tokens?: StoredTokens;\n  clientInfo?: StoredClientInfo;\n  codeVerifier?: string;\n  oauthState?: string;\n  serverUrl?: string; // Track the URL these credentials are for\n}\n\n// Base directory for auth storage - can be overridden via env var for testing\nfunction getAuthBaseDir(): string {\n  const override = process.env.MCP_OAUTH_DIR?.trim();\n  return override ? override : getAgentPath('mcp-oauth');\n}\n\n/**\n * Get the server-specific directory path.\n */\nfunction getServerDir(serverName: string): string {\n  if (typeof serverName !== 'string') {\n    throw new Error(`Invalid MCP server name: ${JSON.stringify(serverName)}`);\n  }\n  const storageKey = createHash('sha256').update(serverName, 'utf8').digest('hex');\n  return join(getAuthBaseDir(), `sha256-${storageKey}`);\n}\n\n/**\n * Get the tokens file path for a server.\n */\nexport function getAuthEntryFilePath(serverName: string): string {\n  return join(getServerDir(serverName), 'tokens.json');\n}\n\n/**\n * Ensure the server directory exists with secure permissions.\n */\nfunction ensureServerDir(serverName: string): void {\n  const dir = getServerDir(serverName);\n  if (!existsSync(dir)) {\n    mkdirSync(dir, { recursive: true, mode: 0o700 });\n  }\n}\n\n/**\n * Read the auth entry for a server from disk.\n * Returns undefined if file doesn't exist.\n */\nfunction readAuthEntry(serverName: string): AuthEntry | undefined {\n  const filePath = getAuthEntryFilePath(serverName);\n  try {\n    if (!existsSync(filePath)) {\n      return undefined;\n    }\n    const data = readFileSync(filePath, 'utf-8');\n    return JSON.parse(data) as AuthEntry;\n  } catch (error) {\n    console.error(`Failed to read auth entry for ${serverName}:`, error);\n    return undefined;\n  }\n}\n\n/**\n * Write the auth entry for a server to disk with secure permissions.\n */\nfunction writeAuthEntry(serverName: string, entry: AuthEntry): void {\n  ensureServerDir(serverName);\n  const filePath = getAuthEntryFilePath(serverName);\n  writeFileSync(filePath, JSON.stringify(entry, null, 2), { mode: 0o600 });\n}\n\n/**\n * Get auth entry for a server.\n */\nexport function getAuthEntry(serverName: string): AuthEntry | undefined {\n  return readAuthEntry(serverName);\n}\n\n/**\n * Get auth entry and validate it's for the correct URL.\n * Returns undefined if URL has changed (credentials are invalid).\n */\nexport function getAuthForUrl(serverName: string, serverUrl: string): AuthEntry | undefined {\n  const entry = getAuthEntry(serverName);\n  if (!entry) return undefined;\n\n  // If no serverUrl is stored, this is from an old version - consider it invalid\n  if (!entry.serverUrl) return undefined;\n\n  // If URL has changed, credentials are invalid\n  if (entry.serverUrl !== serverUrl) return undefined;\n\n  return entry;\n}\n\n/**\n * Save auth entry for a server.\n */\nexport function saveAuthEntry(serverName: string, entry: AuthEntry, serverUrl?: string): void {\n  // Always update serverUrl if provided\n  if (serverUrl) {\n    entry.serverUrl = serverUrl;\n  }\n  writeAuthEntry(serverName, entry);\n}\n\n/**\n * Remove auth entry for a server.\n * Also removes the server directory if empty.\n */\nexport function removeAuthEntry(serverName: string): void {\n  try {\n    const filePath = getAuthEntryFilePath(serverName);\n    if (existsSync(filePath)) {\n      writeFileSync(filePath, '{}', { mode: 0o600 });\n    }\n    // Try to remove the directory\n    const dir = getServerDir(serverName);\n    if (existsSync(dir)) {\n      try {\n        rmSync(dir, { recursive: true });\n      } catch {\n        // Directory may not be empty, ignore\n      }\n    }\n  } catch (error) {\n    console.error(`Failed to remove auth entry for ${serverName}:`, error);\n  }\n}\n\n/**\n * Update tokens for a server.\n */\nexport function updateTokens(\n  serverName: string, \n  tokens: StoredTokens, \n  serverUrl?: string\n): void {\n  const entry = getAuthEntry(serverName) ?? {};\n  if (serverUrl && entry.serverUrl !== serverUrl) {\n    delete entry.clientInfo;\n    delete entry.codeVerifier;\n    delete entry.oauthState;\n  }\n  entry.tokens = tokens;\n  saveAuthEntry(serverName, entry, serverUrl);\n}\n\n/**\n * Update client info for a server.\n */\nexport function updateClientInfo(\n  serverName: string, \n  clientInfo: StoredClientInfo, \n  serverUrl?: string\n): void {\n  const entry = getAuthEntry(serverName) ?? {};\n  if (serverUrl && entry.serverUrl !== serverUrl) {\n    delete entry.tokens;\n    delete entry.codeVerifier;\n    delete entry.oauthState;\n  }\n  entry.clientInfo = clientInfo;\n  saveAuthEntry(serverName, entry, serverUrl);\n}\n\n/**\n * Update code verifier for a server.\n */\nexport function updateCodeVerifier(serverName: string, codeVerifier: string, serverUrl?: string): void {\n  const entry = getAuthEntry(serverName) ?? {};\n  if (serverUrl && entry.serverUrl !== serverUrl) {\n    delete entry.tokens;\n    delete entry.clientInfo;\n    delete entry.oauthState;\n  }\n  entry.codeVerifier = codeVerifier;\n  saveAuthEntry(serverName, entry, serverUrl);\n}\n\n/**\n * Clear code verifier for a server.\n */\nexport function clearCodeVerifier(serverName: string): void {\n  const entry = getAuthEntry(serverName);\n  if (entry) {\n    delete entry.codeVerifier;\n    saveAuthEntry(serverName, entry);\n  }\n}\n\n/**\n * Update OAuth state for a server.\n */\nexport function updateOAuthState(serverName: string, state: string, serverUrl?: string): void {\n  const entry = getAuthEntry(serverName) ?? {};\n  if (serverUrl && entry.serverUrl !== serverUrl) {\n    delete entry.tokens;\n    delete entry.clientInfo;\n    delete entry.codeVerifier;\n  }\n  entry.oauthState = state;\n  saveAuthEntry(serverName, entry, serverUrl);\n}\n\n/**\n * Get OAuth state for a server.\n */\nexport function getOAuthState(serverName: string): string | undefined {\n  const entry = getAuthEntry(serverName);\n  return entry?.oauthState;\n}\n\n/**\n * Clear OAuth state for a server.\n */\nexport function clearOAuthState(serverName: string): void {\n  const entry = getAuthEntry(serverName);\n  if (entry) {\n    delete entry.oauthState;\n    saveAuthEntry(serverName, entry);\n  }\n}\n\n/**\n * Check if stored tokens are expired.\n * Returns null if no tokens exist, false if no expiry or not expired, true if expired.\n */\nexport function isTokenExpired(serverName: string): boolean | null {\n  const entry = getAuthEntry(serverName);\n  if (!entry?.tokens) return null;\n  if (!entry.tokens.expiresAt) return false;\n  return entry.tokens.expiresAt < Date.now() / 1000;\n}\n\n/**\n * Check if a server has stored tokens.\n */\nexport function hasStoredTokens(serverName: string): boolean {\n  const entry = getAuthEntry(serverName);\n  return !!entry?.tokens;\n}\n\n/**\n * Clear all credentials for a server.\n */\nexport function clearAllCredentials(serverName: string): void {\n  removeAuthEntry(serverName);\n}\n\n/**\n * Clear only client info for a server.\n */\nexport function clearClientInfo(serverName: string): void {\n  const entry = getAuthEntry(serverName);\n  if (entry) {\n    delete entry.clientInfo;\n    saveAuthEntry(serverName, entry);\n  }\n}\n\n/**\n * Clear only tokens for a server.\n */\nexport function clearTokens(serverName: string): void {\n  const entry = getAuthEntry(serverName);\n  if (entry) {\n    delete entry.tokens;\n    saveAuthEntry(serverName, entry);\n  }\n}\n"]}

package/dist/builtin-extensions/pi-mcp-adapter/mcp-callback-server.d.ts

@@ -0,0 +1,45 @@
+/**
+ * MCP OAuth Callback Server
+ *
+ * HTTP server that handles OAuth callbacks from the authorization server.
+ * Uses Node.js http module for compatibility.
+ */
+interface EnsureCallbackServerOptions {
+    strictPort?: boolean;
+    port?: number;
+    callbackHost?: string;
+    callbackPath?: string;
+    oauthState?: string;
+    reserveState?: boolean;
+}
+/**
+ * Ensure the callback server is running.
+ * If strictPort is true, requires binding on the configured callback port.
+ * If strictPort is false, asks the OS for an available local port.
+ */
+export declare function ensureCallbackServer(options?: EnsureCallbackServerOptions): Promise<void>;
+export declare function reserveCallbackServer(oauthState: string): void;
+export declare function releaseCallbackServer(oauthState: string): void;
+/**
+ * Wait for a callback with the given OAuth state.
+ * Returns a promise that resolves with the authorization code.
+ */
+export declare function waitForCallback(oauthState: string): Promise<string>;
+/**
+ * Cancel a pending authorization by state.
+ */
+export declare function cancelPendingCallback(oauthState: string): void;
+/**
+ * Stop the callback server and reject all pending authorizations.
+ */
+export declare function stopCallbackServer(): Promise<void>;
+/**
+ * Check if the callback server is running.
+ */
+export declare function isCallbackServerRunning(): boolean;
+/**
+ * Get the number of pending authorizations.
+ */
+export declare function getPendingAuthCount(): number;
+export {};
+//# sourceMappingURL=mcp-callback-server.d.ts.map

package/dist/builtin-extensions/pi-mcp-adapter/mcp-callback-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-callback-server.d.ts","sourceRoot":"","sources":["../../../src/builtin-extensions/pi-mcp-adapter/mcp-callback-server.ts"],"names":[],"mappings":"AACA;;;;;GAKG;AA+EH,UAAU,2BAA2B;IACnC,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB;AAiFD;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,GAAE,2BAAgC,GAAG,OAAO,CAAC,IAAI,CAAC,CAcnG;AAoGD,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAE9D;AAED,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAE9D;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAYnE;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAQ9D;AAED;;GAEG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAwBxD;AAED;;GAEG;AACH,wBAAgB,uBAAuB,IAAI,OAAO,CAEjD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C","sourcesContent":["// @ts-nocheck\n/**\n * MCP OAuth Callback Server\n * \n * HTTP server that handles OAuth callbacks from the authorization server.\n * Uses Node.js http module for compatibility.\n */\n\nimport { createServer, type Server, type IncomingMessage, type ServerResponse } from \"http\"\nimport {\n  DEFAULT_OAUTH_CALLBACK_PATH,\n  getConfiguredOAuthCallbackPort,\n  getOAuthCallbackPath,\n  getOAuthCallbackPort,\n  setOAuthCallbackPath,\n  setOAuthCallbackPort,\n} from \"./mcp-oauth-provider.ts\"\n\n// HTML templates for callback responses\nconst HTML_SUCCESS = `<!DOCTYPE html>\n<html>\n<head>\n  <title>Pi - Authorization Successful</title>\n  <style>\n    body { font-family: system-ui, -apple-system, sans-serif; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background: #1a1a2e; color: #eee; }\n    .container { text-align: center; padding: 2rem; }\n    h1 { color: #4ade80; margin-bottom: 1rem; }\n    p { color: #aaa; }\n  </style>\n</head>\n<body>\n  <div class=\"container\">\n    <h1>Authorization Successful</h1>\n    <p>You can close this window and return to Pi.</p>\n  </div>\n  <script>setTimeout(() => window.close(), 2000);</script>\n</body>\n</html>`\n\nfunction escapeHtml(value: string): string {\n  return value\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\")\n    .replace(/\"/g, \"&quot;\")\n    .replace(/'/g, \"&#39;\")\n}\n\nconst HTML_ERROR = (error: string) => `<!DOCTYPE html>\n<html>\n<head>\n  <title>Pi - Authorization Failed</title>\n  <style>\n    body { font-family: system-ui, -apple-system, sans-serif; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background: #1a1a2e; color: #eee; }\n    .container { text-align: center; padding: 2rem; }\n    h1 { color: #f87171; margin-bottom: 1rem; }\n    p { color: #aaa; }\n    .error { color: #fca5a5; font-family: monospace; margin-top: 1rem; padding: 1rem; background: rgba(248,113,113,0.1); border-radius: 0.5rem; }\n  </style>\n</head>\n<body>\n  <div class=\"container\">\n    <h1>Authorization Failed</h1>\n    <p>An error occurred during authorization.</p>\n    <div class=\"error\">${escapeHtml(error)}</div>\n  </div>\n</body>\n</html>`\n\n/** Pending authorization request */\ninterface PendingAuth {\n  resolve: (code: string) => void\n  reject: (error: Error) => void\n  timeout: ReturnType<typeof setTimeout>\n}\n\n/** Server singleton state */\nlet server: Server | undefined\nlet bindingPromise: Promise<void> | undefined\nconst pendingAuths = new Map<string, PendingAuth>()\nconst reservedAuthStates = new Set<string>()\n\n/** Timeout for callback completion (5 minutes) */\nconst CALLBACK_TIMEOUT_MS = 5 * 60 * 1000\n\ninterface EnsureCallbackServerOptions {\n  strictPort?: boolean\n  port?: number\n  callbackHost?: string\n  callbackPath?: string\n  oauthState?: string\n  reserveState?: boolean\n}\n\nconst DEFAULT_OAUTH_CALLBACK_HOST = \"localhost\"\nlet callbackServerHost = DEFAULT_OAUTH_CALLBACK_HOST\n\n/**\n * Handle incoming HTTP requests to the callback server.\n */\nfunction handleRequest(req: IncomingMessage, res: ServerResponse): void {\n  const url = new URL(req.url || \"/\", `http://${req.headers.host}`)\n\n  // Only handle the callback path\n  if (url.pathname !== getOAuthCallbackPath()) {\n    res.writeHead(404, { \"Content-Type\": \"text/plain\" })\n    res.end(\"Not found\")\n    return\n  }\n\n  const code = url.searchParams.get(\"code\")\n  const state = url.searchParams.get(\"state\")\n  const error = url.searchParams.get(\"error\")\n  const errorDescription = url.searchParams.get(\"error_description\")\n\n  // Enforce state parameter presence for CSRF protection\n  if (!state) {\n    const errorMsg = \"Missing required state parameter - potential CSRF attack\"\n    res.writeHead(400, { \"Content-Type\": \"text/html\" })\n    res.end(HTML_ERROR(errorMsg))\n    return\n  }\n\n  const pending = pendingAuths.get(state)\n  const isReserved = reservedAuthStates.has(state)\n\n  // Handle OAuth errors only for a state that belongs to an active flow.\n  if (error) {\n    if (!pending && !isReserved) {\n      const errorMsg = \"Invalid or expired state parameter - potential CSRF attack\"\n      res.writeHead(400, { \"Content-Type\": \"text/html\" })\n      res.end(HTML_ERROR(errorMsg))\n      return\n    }\n\n    const errorMsg = errorDescription || error\n    // Send HTTP response first before rejecting promise\n    res.writeHead(200, { \"Content-Type\": \"text/html\" })\n    res.end(HTML_ERROR(errorMsg))\n    reservedAuthStates.delete(state)\n    // Reject promise after response is sent (defer to allow test to attach handler)\n    if (pending) {\n      clearTimeout(pending.timeout)\n      pendingAuths.delete(state)\n      setTimeout(() => pending.reject(new Error(errorMsg)), 0)\n    }\n    return\n  }\n\n  // Validate state parameter\n  if (!pending) {\n    const errorMsg = \"Invalid or expired state parameter - potential CSRF attack\"\n    res.writeHead(400, { \"Content-Type\": \"text/html\" })\n    res.end(HTML_ERROR(errorMsg))\n    return\n  }\n\n  // Require authorization code\n  if (!code) {\n    res.writeHead(400, { \"Content-Type\": \"text/html\" })\n    res.end(HTML_ERROR(\"No authorization code provided\"))\n    return\n  }\n\n  // Clear timeout and resolve the pending promise\n  clearTimeout(pending.timeout)\n  pendingAuths.delete(state)\n  pending.resolve(code)\n\n  res.writeHead(200, { \"Content-Type\": \"text/html\" })\n  res.end(HTML_SUCCESS)\n}\n\n/**\n * Ensure the callback server is running.\n * If strictPort is true, requires binding on the configured callback port.\n * If strictPort is false, asks the OS for an available local port.\n */\nexport async function ensureCallbackServer(options: EnsureCallbackServerOptions = {}): Promise<void> {\n  while (bindingPromise) {\n    await bindingPromise\n  }\n\n  const operation = ensureCallbackServerLocked(options)\n  bindingPromise = operation\n  try {\n    await operation\n  } finally {\n    if (bindingPromise === operation) {\n      bindingPromise = undefined\n    }\n  }\n}\n\nasync function ensureCallbackServerLocked(options: EnsureCallbackServerOptions = {}): Promise<void> {\n  const requiredPort = options.port ?? getConfiguredOAuthCallbackPort()\n  const strictPort = options.strictPort === true\n  const requestedHost = options.callbackHost ?? DEFAULT_OAUTH_CALLBACK_HOST\n  const rawRequestedPath = options.callbackPath ?? DEFAULT_OAUTH_CALLBACK_PATH\n  const requestedPath = rawRequestedPath.startsWith(\"/\") ? rawRequestedPath : `/${rawRequestedPath}`\n  if (options.reserveState && !options.oauthState) {\n    throw new Error(\"OAuth callback reservation requires an oauthState\")\n  }\n  let reservedState: string | undefined\n\n  const previousServer = server\n  const needsStrictRebind = Boolean(previousServer && strictPort && getOAuthCallbackPort() !== requiredPort)\n  const needsHostSwitch = Boolean(previousServer && callbackServerHost !== requestedHost)\n  const needsPathSwitch = Boolean(previousServer && getOAuthCallbackPath() !== requestedPath)\n\n  if (previousServer) {\n    if (!needsStrictRebind && !needsHostSwitch) {\n      if (needsPathSwitch) {\n        if (pendingAuths.size > 0 || reservedAuthStates.size > 0) {\n          throw new Error(\n            `OAuth callback server is using path ${getOAuthCallbackPath()}, but callback path ${requestedPath} is required and cannot be switched while authorizations are pending`\n          )\n        }\n        setOAuthCallbackPath(requestedPath)\n      }\n      if (options.reserveState && options.oauthState) {\n        reservedAuthStates.add(options.oauthState)\n        reservedState = options.oauthState\n      }\n      return\n    }\n\n    if (pendingAuths.size > 0 || reservedAuthStates.size > 0) {\n      throw new Error(\n        `OAuth callback server is running on ${callbackServerHost}:${getOAuthCallbackPort()}, but strict callback endpoint ${requestedHost}:${requiredPort} is required and cannot be switched while authorizations are pending`\n      )\n    }\n  }\n\n  const candidateServer = createServer(handleRequest)\n  const listenPort = strictPort ? requiredPort : 0\n\n  try {\n    await new Promise<void>((resolve, reject) => {\n      candidateServer.once(\"error\", (err) => {\n        reject(err)\n      })\n\n      candidateServer.listen(listenPort, requestedHost, () => {\n        resolve()\n      })\n    })\n\n    if (strictPort) {\n      setOAuthCallbackPort(requiredPort)\n    } else {\n      const address = candidateServer.address()\n      if (!address || typeof address === \"string\" || typeof address.port !== \"number\") {\n        throw new Error(\"OAuth callback server did not report an assigned port\")\n      }\n      setOAuthCallbackPort(address.port)\n    }\n\n    if (previousServer && (needsStrictRebind || needsHostSwitch)) {\n      await new Promise<void>((resolve) => {\n        previousServer.close(() => resolve())\n      })\n    }\n\n    callbackServerHost = requestedHost\n    setOAuthCallbackPath(requestedPath)\n    server = candidateServer\n    if (options.reserveState && options.oauthState) {\n      reservedAuthStates.add(options.oauthState)\n      reservedState = options.oauthState\n    }\n    server.unref()\n  } catch (error) {\n    if (reservedState) {\n      reservedAuthStates.delete(reservedState)\n    }\n    const nodeError = error as NodeJS.ErrnoException\n    await new Promise<void>((resolve) => {\n      candidateServer.close(() => resolve())\n    })\n\n    if (strictPort && nodeError.code === \"EADDRINUSE\") {\n      throw new Error(\n        `OAuth callback port ${requiredPort} is already in use. Pre-registered OAuth clients require an exact redirect URI; set MCP_OAUTH_CALLBACK_PORT to your registered port or free port ${requiredPort}`,\n        { cause: error }\n      )\n    }\n\n    throw error\n  }\n}\n\nexport function reserveCallbackServer(oauthState: string): void {\n  reservedAuthStates.add(oauthState)\n}\n\nexport function releaseCallbackServer(oauthState: string): void {\n  reservedAuthStates.delete(oauthState)\n}\n\n/**\n * Wait for a callback with the given OAuth state.\n * Returns a promise that resolves with the authorization code.\n */\nexport function waitForCallback(oauthState: string): Promise<string> {\n  reservedAuthStates.delete(oauthState)\n  return new Promise((resolve, reject) => {\n    const timeout = setTimeout(() => {\n      if (pendingAuths.has(oauthState)) {\n        pendingAuths.delete(oauthState)\n        reject(new Error(\"OAuth callback timeout - authorization took too long\"))\n      }\n    }, CALLBACK_TIMEOUT_MS)\n\n    pendingAuths.set(oauthState, { resolve, reject, timeout })\n  })\n}\n\n/**\n * Cancel a pending authorization by state.\n */\nexport function cancelPendingCallback(oauthState: string): void {\n  reservedAuthStates.delete(oauthState)\n  const pending = pendingAuths.get(oauthState)\n  if (pending) {\n    clearTimeout(pending.timeout)\n    pendingAuths.delete(oauthState)\n    pending.reject(new Error(\"Authorization cancelled\"))\n  }\n}\n\n/**\n * Stop the callback server and reject all pending authorizations.\n */\nexport async function stopCallbackServer(): Promise<void> {\n  if (server) {\n    await new Promise<void>((resolve) => {\n      server!.close(() => {\n        resolve()\n      })\n    })\n    server = undefined\n  }\n\n  setOAuthCallbackPort(getConfiguredOAuthCallbackPort())\n  callbackServerHost = DEFAULT_OAUTH_CALLBACK_HOST\n  setOAuthCallbackPath(DEFAULT_OAUTH_CALLBACK_PATH)\n\n  // Reject all pending auths (defer to allow any pending operations to complete)\n  const pendingList = Array.from(pendingAuths.entries())\n  pendingAuths.clear()\n  reservedAuthStates.clear()\n  setTimeout(() => {\n    for (const [, pending] of pendingList) {\n      clearTimeout(pending.timeout)\n      pending.reject(new Error(\"OAuth callback server stopped\"))\n    }\n  }, 0)\n}\n\n/**\n * Check if the callback server is running.\n */\nexport function isCallbackServerRunning(): boolean {\n  return server !== undefined\n}\n\n/**\n * Get the number of pending authorizations.\n */\nexport function getPendingAuthCount(): number {\n  return pendingAuths.size\n}\n"]}