@automattic/mcp-wordpress-remote 0.2.5 → 0.2.7

package/dist/proxy.js

@@ -34,6 +34,10 @@ var CONFIG = {
   // Resource Indicators (RFC 8707)
   OAUTH_RESOURCE_INDICATOR: process.env.OAUTH_RESOURCE_INDICATOR !== "false",
   // Resource parameter support
+  // OAuth Scopes Configuration
+  // OAUTH_SCOPES: Comma-separated list of OAuth scopes (e.g., "read,write" or "global")
+  // If empty, uses defaults: "global" for WordPress.com, "read,write" for self-hosted
+  OAUTH_SCOPES: process.env.OAUTH_SCOPES || "",
   // Timeout Configuration (in milliseconds)
   OAUTH_TIMEOUT: 3e4,
   // 30 seconds
@@ -52,6 +56,12 @@ var CONFIG = {
   // Environment
   NODE_ENV: process.env.NODE_ENV || "development"
 };
+function parseOAuthScopes(envScopes, defaultScopes) {
+  if (!envScopes || envScopes.trim() === "") {
+    return defaultScopes;
+  }
+  return envScopes.split(",").map((scope) => scope.trim()).filter((scope) => scope.length > 0);
+}
 function isWordPressComSite(url) {
   try {
     const siteUrl = new URL(url);
@@ -64,15 +74,18 @@ function isWordPressComSite(url) {
 }
 function getRecommendedOAuthConfig(siteUrl) {
   if (isWordPressComSite(siteUrl)) {
+    const defaultScopes = ["global"];
     return {
       flowType: "implicit",
       usePKCE: false,
       useResourceIndicator: false,
       authorizationEndpoint: "https://public-api.wordpress.com/oauth2/authorize",
       tokenEndpoint: "https://public-api.wordpress.com/oauth2/token",
+      scopes: parseOAuthScopes(CONFIG.OAUTH_SCOPES, defaultScopes),
       description: "WordPress.com OAuth2 (compatible mode)"
     };
   } else {
+    const defaultScopes = ["read", "write"];
     return {
       flowType: "authorization_code",
       usePKCE: true,
@@ -81,6 +94,7 @@ function getRecommendedOAuthConfig(siteUrl) {
       // Will be discovered
       tokenEndpoint: void 0,
       // Will be discovered
+      scopes: parseOAuthScopes(CONFIG.OAUTH_SCOPES, defaultScopes),
       description: "MCP-compliant OAuth 2.1"
     };
   }
@@ -707,9 +721,11 @@ var AUTHORIZATION_CODE_HTML = `
             document.getElementById('details').textContent = message;
         }
 
-        // Extract authorization code and state from URL query parameters (OAuth 2.1)
+        // Handle both OAuth 2.1 authorization code flow and implicit flow
         const urlParams = new URLSearchParams(window.location.search);
+        const hashParams = new URLSearchParams(window.location.hash.substring(1));
 
+        // Check for authorization code first (OAuth 2.1 flow)
         if (urlParams.has('code')) {
             const authData = {
                 code: urlParams.get('code'),
@@ -745,13 +761,63 @@ var AUTHORIZATION_CODE_HTML = `
                 displayStatus('\u274C Error completing authorization', 'error');
                 displayDetails(error.message + '. Please try again.');
             });
-        } else if (urlParams.has('error')) {
+        } 
+        // Check for access token in URL fragment (implicit flow - WordPress.com)
+        else if (hashParams.has('access_token')) {
+            const tokens = {
+                access_token: hashParams.get('access_token'),
+                token_type: hashParams.get('token_type') || 'Bearer',
+                expires_in: hashParams.get('expires_in') ? parseInt(hashParams.get('expires_in')) : 3600,
+                scope: hashParams.get('scope'),
+                state: hashParams.get('state'),
+                obtained_at: Date.now()
+            };
+
+            // Send tokens to server for storage
+            fetch('/oauth/tokens', {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json'
+                },
+                body: JSON.stringify(tokens)
+            })
+            .then(response => {
+                if (response.ok) {
+                    displayStatus('\u2705 Authorization successful!', 'success');
+                    displayDetails('WordPress.com OAuth authentication completed. You can now close this window.');
+                    // Auto-close after 3 seconds
+                    setTimeout(() => {
+                        displayDetails('Closing window...');
+                        setTimeout(() => window.close(), 1000);
+                    }, 3000);
+                } else {
+                    return response.json().then(err => {
+                        throw new Error(err.error || 'Failed to store access token');
+                    });
+                }
+            })
+            .catch(error => {
+                displayStatus('\u274C Error completing authorization', 'error');
+                displayDetails(error.message + '. Please try again.');
+            });
+        } 
+        // Check for errors in query parameters
+        else if (urlParams.has('error')) {
             const error = urlParams.get('error');
             const errorDescription = urlParams.get('error_description');
             displayStatus('\u274C Authorization failed', 'error');
             displayDetails(\`Error: \${error}\${errorDescription ? ' - ' + errorDescription : ''}\`);
-        } else {
-            displayStatus('\u274C No authorization code received', 'error');
+        } 
+        // Check for errors in URL fragment (implicit flow errors)
+        else if (hashParams.has('error')) {
+            const error = hashParams.get('error');
+            const errorDescription = hashParams.get('error_description');
+            displayStatus('\u274C Authorization failed', 'error');
+            displayDetails(\`Error: \${error}\${errorDescription ? ' - ' + errorDescription : ''}\`);
+        } 
+        // No authorization code or access token found
+        else {
+            displayStatus('\u274C No authorization code or access token received', 'error');
             displayDetails('Please try the authorization process again.');
         }
     </script>
@@ -889,15 +955,17 @@ var MCPOAuthProvider = class {
     // Discovered metadata
     this.authServerMetadata = null;
     this.resourceMetadata = null;
+    const serverUrl = options.serverUrl || CONFIG.WP_API_URL;
+    const recommendedConfig = getRecommendedOAuthConfig(serverUrl);
     this.config = {
-      serverUrl: options.serverUrl || CONFIG.WP_API_URL,
-      resource: generateCanonicalResourceURI(options.serverUrl || CONFIG.WP_API_URL),
+      serverUrl,
+      resource: generateCanonicalResourceURI(serverUrl),
       responseType: "code",
       // OAuth 2.1 uses authorization code flow
       usePKCE: true,
       // PKCE is required for OAuth 2.1
       redirectUri: `http://${CONFIG.OAUTH_HOST}:${CONFIG.OAUTH_CALLBACK_PORT}/oauth/callback`,
-      scopes: options.scopes || ["read", "write"],
+      scopes: options.scopes || recommendedConfig.scopes,
       clientId: options.clientId || CONFIG.WP_OAUTH_CLIENT_ID,
       callbackPort: CONFIG.OAUTH_CALLBACK_PORT,
       host: CONFIG.OAUTH_HOST,
@@ -1260,6 +1328,7 @@ import { EventEmitter as EventEmitter2 } from "node:events";
 var WP_PERSISTENT_CONFIG = {
   authorizeEndpoint: "/wp-admin/admin.php?page=mcp-oauth-authorize",
   scopes: ["read", "write"],
+  // Default for self-hosted, will be overridden for WordPress.com
   callbackPort: CONFIG.OAUTH_CALLBACK_PORT,
   host: CONFIG.OAUTH_HOST
 };
@@ -1270,7 +1339,9 @@ var PersistentWPOAuthClientProvider = class {
     const recommendedConfig = getRecommendedOAuthConfig(options.serverUrl || "");
     this.options = {
       ...WP_PERSISTENT_CONFIG,
-      ...options
+      ...options,
+      // Use recommended scopes for the site type
+      scopes: options.scopes || recommendedConfig.scopes
     };
     if (isWpCom && recommendedConfig.authorizationEndpoint) {
       this.options.authorizeEndpoint = recommendedConfig.authorizationEndpoint;
@@ -1911,10 +1982,11 @@ async function getOAuthTokens() {
     const shouldUseMCPFlow = !isWPCom && CONFIG.OAUTH_FLOW_TYPE === "authorization_code" && CONFIG.OAUTH_USE_PKCE;
     if (shouldUseMCPFlow) {
       if (!mcpOAuthProvider) {
+        const recommendedConfig2 = getRecommendedOAuthConfig(serverUrl);
         mcpOAuthProvider = new MCPOAuthProvider({
           serverUrl,
           clientId: CONFIG.WP_OAUTH_CLIENT_ID,
-          scopes: ["read", "write"]
+          scopes: recommendedConfig2.scopes
         });
       }
       logger.auth("Using MCP-compliant OAuth 2.1 authorization code flow with PKCE");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@automattic/mcp-wordpress-remote",
-  "version": "0.2.5",
+  "version": "0.2.7",
   "description": "MCP WordPress Remote proxy server",
   "engines": {
     "node": ">=22.0.0"