@chatroomcp/chatroom 0.1.3

package/dist/presentation/http/oauth-router.js

@@ -0,0 +1,163 @@
+/** OAuth and owner-session HTTP routes backed by AuthService rather than protocol-specific persistence logic. */
+import { Router } from "express";
+import { asChatRoomError, ChatRoomError, } from "../../core/errors/chatroom-error.js";
+import { escapeHtml, requireString } from "./http-utils.js";
+export function createOAuthRouter(auth, ingress) {
+    const router = Router();
+    router.get("/.well-known/oauth-authorization-server", (req, res) => res.json(auth.authorizationServerMetadata(ingress.mcpBaseUrl(req))));
+    router.get("/.well-known/oauth-protected-resource", (req, res) => res.json(auth.protectedResourceMetadata(ingress.mcpBaseUrl(req))));
+    router.get("/.well-known/oauth-protected-resource/mcp", (req, res) => res.json(auth.protectedResourceMetadata(ingress.mcpBaseUrl(req))));
+    router.post("/oauth/register", (req, res) => {
+        const body = req.body;
+        const name = typeof body.client_name === "string" ? body.client_name : "MCP Client";
+        const redirects = Array.isArray(body.redirect_uris)
+            ? body.redirect_uris.filter((value) => typeof value === "string")
+            : [];
+        res.status(201).json(auth.registerClient(name, redirects));
+    });
+    router.get("/oauth/authorize", (req, res) => {
+        const request = authorizationRequest(req.query);
+        if (req.query.response_type !== "code")
+            throw new ChatRoomError("INVALID_INPUT", "Only response_type=code is supported");
+        auth.validateAuthorizationRequest(request);
+        res.type("html").send(authorizationPage(request));
+    });
+    router.post("/oauth/authorize", (req, res) => {
+        const body = req.body;
+        const request = authorizationRequest(body);
+        const code = auth.approveAuthorization(request, requireString(body.owner_token, "owner_token"));
+        const redirect = new URL(request.redirectUri);
+        redirect.searchParams.set("code", code);
+        if (request.state)
+            redirect.searchParams.set("state", request.state);
+        res.redirect(303, redirect.toString());
+    });
+    router.post("/oauth/token", (req, res) => {
+        const body = req.body;
+        let result;
+        if (body.grant_type === "authorization_code") {
+            result = auth.exchangeCode({
+                code: requireString(body.code, "code"),
+                clientId: requireString(body.client_id, "client_id"),
+                redirectUri: requireString(body.redirect_uri, "redirect_uri"),
+                codeVerifier: requireString(body.code_verifier, "code_verifier"),
+            });
+        }
+        else if (body.grant_type === "refresh_token") {
+            result = auth.exchangeRefreshToken({
+                refreshToken: requireString(body.refresh_token, "refresh_token"),
+                ...(typeof body.client_id === "string"
+                    ? { clientId: body.client_id }
+                    : {}),
+            });
+        }
+        else {
+            throw new ChatRoomError("INVALID_INPUT", "Unsupported OAuth grant_type");
+        }
+        res.setHeader("Cache-Control", "no-store");
+        res.json(result);
+    });
+    router.post("/oauth/revoke", (req, res) => {
+        const body = req.body;
+        const token = typeof body.token === "string" ? body.token : "";
+        if (token)
+            auth.revoke(token);
+        res.status(200).end();
+    });
+    router.use(oauthErrorMiddleware());
+    return router;
+}
+function oauthErrorMiddleware() {
+    return (error, req, res, _next) => {
+        const normalized = asChatRoomError(error);
+        let code = "invalid_request";
+        if (req.path === "/oauth/token" && normalized.code === "FORBIDDEN")
+            code = "invalid_grant";
+        else if (req.path === "/oauth/register" &&
+            /redirect/i.test(normalized.message))
+            code = "invalid_redirect_uri";
+        else if (normalized.code === "FORBIDDEN")
+            code = "access_denied";
+        res.setHeader("Cache-Control", "no-store");
+        res
+            .status(400)
+            .json({ error: code, error_description: normalized.message });
+    };
+}
+function authorizationRequest(value) {
+    const state = typeof value.state === "string" ? value.state : undefined;
+    const scopes = typeof value.scope === "string" && value.scope.trim()
+        ? [...new Set(value.scope.trim().split(/\s+/))]
+        : ["mcp"];
+    return {
+        clientId: requireString(value.client_id, "client_id"),
+        redirectUri: requireString(value.redirect_uri, "redirect_uri"),
+        codeChallenge: requireString(value.code_challenge, "code_challenge"),
+        codeChallengeMethod: requireString(value.code_challenge_method, "code_challenge_method"),
+        scopes,
+        ...(state ? { state } : {}),
+    };
+}
+function authorizationPage(request) {
+    const hidden = (name, value) => `<input type="hidden" name="${name}" value="${escapeHtml(value)}">`;
+    const fields = [
+        hidden("client_id", request.clientId),
+        hidden("redirect_uri", request.redirectUri),
+        hidden("code_challenge", request.codeChallenge),
+        hidden("code_challenge_method", request.codeChallengeMethod),
+        hidden("scope", request.scopes.join(" ")),
+        request.state ? hidden("state", request.state) : "",
+    ].join("");
+    return `<!doctype html>
+<html>
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width">
+  <title>Authorize ChatRoom</title>
+  <style>
+    body { font: 15px system-ui; margin: 0; background: #0b0d10; color: #edf1f5; display: grid; place-items: center; min-height: 100vh; }
+    .card {
+      width: min(440px, calc(100% - 32px));
+      background: #14181d;
+      border: 1px solid #2a3038;
+      border-radius: 14px;
+      padding: 24px;
+      box-sizing: border-box;
+    }
+    h1 { font-size: 20px; margin: 0 0 8px; }
+    p { color: #aeb8c4; line-height: 1.5; }
+    label { display: block; font-size: 12px; color: #aeb8c4; margin: 18px 0 7px; }
+    input[type=password] {
+      width: 100%;
+      box-sizing: border-box;
+      background: #0c0f13;
+      color: white;
+      border: 1px solid #39414b;
+      border-radius: 8px;
+      padding: 10px;
+    }
+    button {
+      margin-top: 16px;
+      width: 100%;
+      border: 0;
+      border-radius: 8px;
+      padding: 10px;
+      background: #edf1f5;
+      color: #111;
+      font-weight: 650;
+      cursor: pointer;
+    }
+  </style>
+</head>
+<body>
+  <form class="card" method="post" action="/oauth/authorize">
+    <h1>Authorize MCP client</h1>
+    <p>Approve this client to access ChatRoom through the MCP endpoint.</p>
+    ${fields}
+    <label for="owner_token">Owner token</label>
+    <input id="owner_token" name="owner_token" type="password" autocomplete="current-password" required>
+    <button type="submit">Authorize</button>
+  </form>
+</body>
+</html>`;
+}

package/dist/web/assets/chatroom-B5p-5n3y.svg

@@ -0,0 +1,15 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 48 48" width="48" height="48">
+  <defs>
+    <linearGradient id="grad3" x1="0%" y1="0%" x2="100%" y2="100%">
+      <stop offset="0%" stop-color="#4F46E5" />
+      <stop offset="100%" stop-color="#0EA5E9" />
+    </linearGradient>
+  </defs>
+  <circle cx="24" cy="24" r="22" fill="#F8FAFC" />
+  <path d="M 16 34 L 16 22 Q 16 16 24 16 Q 32 16 32 22 L 32 34 Z" fill="url(#grad3)" opacity="0.1" />
+  <path d="M 12 22 L 36 22" stroke="url(#grad3)" stroke-width="3" stroke-linecap="round" />
+  <circle cx="19" cy="28" r="3" fill="url(#grad3)" />
+  <circle cx="28" cy="28" r="3" fill="url(#grad3)" />
+  <path d="M 33 26 Q 36 28 33 32" stroke="url(#grad3)" stroke-width="2.5" stroke-linecap="round" fill="none" />
+  <path d="M 36 23 Q 40 28 36 34" stroke="url(#grad3)" stroke-width="2" stroke-linecap="round" fill="none" opacity="0.6" />
+</svg>