@bugmole/cli 0.4.0

package/src/registry-worker/mcp/token.ts

@@ -0,0 +1,126 @@
+// Verifies the Aegis access tokens that ChatGPT, Claude and other MCP clients
+// send to the hosted MCP endpoint. Aegis issues them as RS256 JWTs whose
+// audience is this endpoint's URL (see Aegis docs/MCP_OAUTH.md).
+import { fromBase64 } from "../core.js";
+
+export const MCP_SCOPE = "bugmole:mcp";
+
+export type McpTokenEnv = {
+  AEGIS_ISSUER?: string;
+  /** Test hook, like the SSO module's. */
+  AEGIS_FETCH?: typeof fetch;
+};
+
+export type McpIdentity = {
+  aegisId: string;
+  email?: string;
+  emailVerified: boolean;
+  orgId?: string;
+  clientId?: string;
+  scopes: string[];
+  expiresAt: number;
+};
+
+type Jwk = JsonWebKey & { kid?: string; alg?: string; use?: string };
+type KeySet = { issuer: string; keys: Jwk[]; fetchedAt: number };
+
+const KEYSET_TTL_MS = 10 * 60 * 1000;
+/** A token with an unknown key id refetches the key set, at most this often. */
+const REFETCH_GAP_MS = 60 * 1000;
+const CLOCK_SKEW_SECONDS = 60;
+
+let keySet: KeySet | null = null;
+
+export function resetMcpKeyCache(): void {
+  keySet = null;
+}
+
+export function aegisIssuer(env: McpTokenEnv): string {
+  return (env.AEGIS_ISSUER || "https://id.theaiinc.com").replace(/\/+$/, "");
+}
+
+async function loadKeys(env: McpTokenEnv, force: boolean): Promise<Jwk[]> {
+  const issuer = aegisIssuer(env);
+  const now = Date.now();
+  const fresh = keySet && keySet.issuer === issuer && now - keySet.fetchedAt < KEYSET_TTL_MS;
+  const mayRefetch = !keySet || keySet.issuer !== issuer || now - keySet.fetchedAt > REFETCH_GAP_MS;
+  if (fresh && !(force && mayRefetch)) return keySet!.keys;
+  const res = await (env.AEGIS_FETCH ?? fetch)(`${issuer}/jwks`, { headers: { accept: "application/json" } });
+  if (!res.ok) {
+    if (keySet?.issuer === issuer) return keySet.keys;
+    throw new Error(`Aegis key set unavailable (${res.status})`);
+  }
+  const body = (await res.json()) as { keys?: Jwk[] };
+  keySet = { issuer, keys: Array.isArray(body.keys) ? body.keys : [], fetchedAt: now };
+  return keySet.keys;
+}
+
+function decodeJson(part: string): Record<string, unknown> | null {
+  try {
+    const value = JSON.parse(new TextDecoder().decode(fromBase64(part))) as unknown;
+    return value && typeof value === "object" && !Array.isArray(value) ? (value as Record<string, unknown>) : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Returns who the token belongs to, or null when it isn't a current Aegis
+ * access token for `resource` carrying the MCP scope.
+ */
+export async function verifyMcpToken(env: McpTokenEnv, token: string, resource: string): Promise<McpIdentity | null> {
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
+  const header = decodeJson(parts[0]);
+  const claims = decodeJson(parts[1]);
+  if (!header || !claims) return null;
+  // Only access tokens: an ID token (typ JWT, audience = a client id) never passes.
+  if (header.alg !== "RS256" || typeof header.kid !== "string") return null;
+  if (header.typ !== "at+jwt" && header.typ !== "application/at+jwt") return null;
+
+  let keys: Jwk[];
+  try {
+    keys = await loadKeys(env, false);
+    if (!keys.some((key) => key.kid === header.kid)) keys = await loadKeys(env, true);
+  } catch {
+    return null;
+  }
+  const jwk = keys.find((key) => key.kid === header.kid && key.kty === "RSA" && (!key.use || key.use === "sig"));
+  if (!jwk) return null;
+  let valid = false;
+  try {
+    const { kid: _kid, alg: _alg, use: _use, key_ops: _ops, ...material } = jwk;
+    const key = await crypto.subtle.importKey("jwk", material, { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }, false, ["verify"]);
+    valid = await crypto.subtle.verify(
+      "RSASSA-PKCS1-v1_5",
+      key,
+      fromBase64(parts[2]),
+      new TextEncoder().encode(`${parts[0]}.${parts[1]}`),
+    );
+  } catch {
+    return null;
+  }
+  if (!valid) return null;
+
+  const now = Math.floor(Date.now() / 1000);
+  if (claims.iss !== aegisIssuer(env)) return null;
+  const audiences = Array.isArray(claims.aud) ? claims.aud : [claims.aud];
+  const wanted = resource.replace(/\/+$/, "");
+  if (!audiences.some((aud) => typeof aud === "string" && aud.replace(/\/+$/, "") === wanted)) return null;
+  if (typeof claims.exp !== "number" || claims.exp + CLOCK_SKEW_SECONDS < now) return null;
+  if (typeof claims.nbf === "number" && claims.nbf - CLOCK_SKEW_SECONDS > now) return null;
+  if (typeof claims.sub !== "string" || !claims.sub) return null;
+  const scopes = typeof claims.scope === "string" ? claims.scope.split(/\s+/).filter(Boolean) : [];
+  if (!scopes.includes(MCP_SCOPE)) return null;
+
+  const email = typeof claims.email === "string" ? claims.email.trim().toLowerCase() : undefined;
+  return {
+    aegisId: claims.sub,
+    email: email && /^[^\s@]+@[^\s@]+$/.test(email) ? email : undefined,
+    emailVerified: claims.email_verified === true,
+    orgId: typeof claims.org_id === "string" ? claims.org_id : undefined,
+    clientId: typeof claims.client_id === "string" ? claims.client_id : undefined,
+    scopes,
+    expiresAt: claims.exp,
+  };
+}