@chatroomcp/chatroom 0.1.3

package/dist/auth/auth-service.js

@@ -0,0 +1,222 @@
+/**
+ * Implements owner authentication and the OAuth Authorization Code + PKCE flow used for remote MCP access.
+ * Raw authorization codes and access tokens are never persisted; repositories receive only their hashes.
+ */
+import { createHash, randomBytes, randomUUID, timingSafeEqual, } from "node:crypto";
+import { ChatRoomError } from "../core/errors/chatroom-error.js";
+export class AuthService {
+    repository;
+    sessions;
+    config;
+    constructor(repository, sessions, config) {
+        this.repository = repository;
+        this.sessions = sessions;
+        this.config = config;
+        const now = new Date().toISOString();
+        repository.prune(now);
+        sessions.prune(now);
+    }
+    verifyOwnerToken(value) {
+        if (!this.config.ownerToken)
+            return false;
+        // Hash to fixed-length inputs before timingSafeEqual so differing token lengths do not short-circuit comparison.
+        return safeEqual(digest(value), digest(this.config.ownerToken));
+    }
+    registerClient(name, redirectUris) {
+        if (!name || redirectUris.length === 0)
+            throw new ChatRoomError("INVALID_INPUT", "client_name and redirect_uris are required");
+        for (const redirect of redirectUris)
+            this.validateRedirect(redirect);
+        const clientId = `client_${randomUUID()}`;
+        this.repository.createClient({
+            clientId,
+            name,
+            redirectUris,
+            createdAt: new Date().toISOString(),
+        });
+        return {
+            client_id: clientId,
+            client_name: name,
+            redirect_uris: redirectUris,
+            token_endpoint_auth_method: "none",
+            grant_types: ["authorization_code", "refresh_token"],
+            response_types: ["code"],
+        };
+    }
+    validateAuthorizationRequest(request) {
+        const client = this.repository.getClient(request.clientId);
+        if (!client)
+            throw new ChatRoomError("INVALID_INPUT", "Unknown OAuth client_id");
+        if (!client.redirectUris.includes(request.redirectUri))
+            throw new ChatRoomError("FORBIDDEN", "redirect_uri is not registered for this client");
+        this.validateRedirect(request.redirectUri);
+        // Only S256 is supported; plain PKCE would expose the verifier-equivalent value in the authorization request.
+        if (request.codeChallengeMethod !== "S256" ||
+            !/^[A-Za-z0-9_-]{43,128}$/.test(request.codeChallenge)) {
+            throw new ChatRoomError("INVALID_INPUT", "PKCE S256 is required");
+        }
+        const supported = new Set(["mcp"]);
+        if (!request.scopes.includes("mcp") ||
+            request.scopes.some((scope) => !supported.has(scope))) {
+            throw new ChatRoomError("INVALID_INPUT", "Unsupported OAuth scope");
+        }
+    }
+    approveAuthorization(request, providedOwnerToken) {
+        this.repository.prune(new Date().toISOString());
+        this.validateAuthorizationRequest(request);
+        if (!this.verifyOwnerToken(providedOwnerToken))
+            throw new ChatRoomError("FORBIDDEN", "Owner token is invalid");
+        const code = randomBytes(32).toString("base64url");
+        this.repository.createCode({
+            codeHash: digest(code),
+            clientId: request.clientId,
+            redirectUri: request.redirectUri,
+            codeChallenge: request.codeChallenge,
+            scope: request.scopes.join(" "),
+            expiresAt: new Date(Date.now() + 5 * 60 * 1000).toISOString(),
+            usedAt: null,
+        });
+        return code;
+    }
+    exchangeCode(input) {
+        if (!/^[A-Za-z0-9._~-]{43,128}$/.test(input.codeVerifier))
+            throw new ChatRoomError("INVALID_INPUT", "Invalid PKCE code_verifier");
+        const codeHash = digest(input.code);
+        const candidate = this.repository.getCode(codeHash);
+        if (!candidate ||
+            candidate.clientId !== input.clientId ||
+            candidate.redirectUri !== input.redirectUri ||
+            Date.parse(candidate.expiresAt) <= Date.now()) {
+            throw new ChatRoomError("FORBIDDEN", "Authorization code is invalid or expired");
+        }
+        const challenge = createHash("sha256")
+            .update(input.codeVerifier)
+            .digest("base64url");
+        if (!safeEqual(challenge, candidate.codeChallenge))
+            throw new ChatRoomError("FORBIDDEN", "PKCE verification failed");
+        // Consume only after all client, redirect, expiry, and PKCE checks pass so a bad verifier cannot burn the code.
+        const code = this.repository.consumeCode(codeHash, new Date().toISOString());
+        if (!code)
+            throw new ChatRoomError("FORBIDDEN", "Authorization code has already been used");
+        return this.issueOAuthTokens(input.clientId, candidate.scope);
+    }
+    exchangeRefreshToken(input) {
+        this.repository.prune(new Date().toISOString());
+        const consumed = this.repository.consumeRefreshToken(digest(input.refreshToken), input.clientId);
+        if (!consumed)
+            throw new ChatRoomError("FORBIDDEN", "Refresh token is invalid or expired");
+        return this.issueOAuthTokens(consumed.clientId, consumed.scope);
+    }
+    createWebSession(providedOwnerToken, remember = true) {
+        if (!this.verifyOwnerToken(providedOwnerToken))
+            throw new ChatRoomError("FORBIDDEN", "Owner token is invalid");
+        return this.issueWebSession(remember);
+    }
+    createPasskeyWebSession(remember = true) {
+        return this.issueWebSession(remember);
+    }
+    issueWebSession(remember) {
+        this.sessions.prune(new Date().toISOString());
+        const lifetimeSeconds = remember ? 30 * 24 * 60 * 60 : 8 * 60 * 60;
+        const token = randomBytes(32).toString("base64url");
+        const expiresAt = new Date(Date.now() + lifetimeSeconds * 1000).toISOString();
+        this.sessions.create(digest(token), expiresAt);
+        return {
+            token,
+            expiresAt,
+            maxAgeSeconds: remember ? lifetimeSeconds : null,
+        };
+    }
+    verifyWebSession(token) {
+        return this.sessions.valid(digest(token), new Date().toISOString());
+    }
+    revokeWebSession(token) {
+        this.sessions.revoke(digest(token));
+    }
+    verifyToken(token, requiredScope) {
+        const info = this.repository.tokenInfo(digest(token));
+        if (!info)
+            return null;
+        if (requiredScope && !info.scope.split(/\s+/).includes(requiredScope))
+            return null;
+        return info;
+    }
+    verifyMcpToken(token) {
+        const info = this.verifyToken(token, "mcp");
+        if (!info)
+            return null;
+        return {
+            token,
+            clientId: info.clientId,
+            scopes: info.scope.split(/\s+/),
+            expiresAt: Math.floor(Date.parse(info.expiresAt) / 1000),
+        };
+    }
+    revoke(token) {
+        this.repository.revokeToken(digest(token));
+    }
+    authorizationServerMetadata(baseUrl) {
+        return {
+            issuer: baseUrl,
+            authorization_endpoint: `${baseUrl}/oauth/authorize`,
+            token_endpoint: `${baseUrl}/oauth/token`,
+            registration_endpoint: `${baseUrl}/oauth/register`,
+            revocation_endpoint: `${baseUrl}/oauth/revoke`,
+            response_types_supported: ["code"],
+            grant_types_supported: ["authorization_code", "refresh_token"],
+            code_challenge_methods_supported: ["S256"],
+            token_endpoint_auth_methods_supported: ["none"],
+            scopes_supported: ["mcp"],
+        };
+    }
+    protectedResourceMetadata(baseUrl) {
+        return {
+            resource: `${baseUrl}/mcp`,
+            authorization_servers: [baseUrl],
+            scopes_supported: ["mcp"],
+            bearer_methods_supported: ["header"],
+        };
+    }
+    issueAccessToken(clientId, scope, seconds) {
+        const token = randomBytes(32).toString("base64url");
+        this.repository.createToken(digest(token), clientId, scope, new Date(Date.now() + seconds * 1000).toISOString());
+        return {
+            access_token: token,
+            token_type: "Bearer",
+            expires_in: seconds,
+            scope,
+        };
+    }
+    issueOAuthTokens(clientId, scope) {
+        this.repository.prune(new Date().toISOString());
+        const access = this.issueAccessToken(clientId, scope, 60 * 60);
+        const refreshToken = randomBytes(48).toString("base64url");
+        this.repository.createRefreshToken(digest(refreshToken), clientId, scope, new Date(Date.now() + 90 * 24 * 60 * 60 * 1000).toISOString());
+        return { ...access, refresh_token: refreshToken };
+    }
+    validateRedirect(value) {
+        let url;
+        try {
+            url = new URL(value);
+        }
+        catch {
+            throw new ChatRoomError("INVALID_INPUT", "Invalid redirect_uri");
+        }
+        // OAuth permits HTTP only for loopback development redirects; all remote redirects must use HTTPS.
+        const loopback = url.hostname === "localhost" ||
+            url.hostname === "127.0.0.1" ||
+            url.hostname === "::1";
+        if (url.protocol !== "https:" && !loopback)
+            throw new ChatRoomError("FORBIDDEN", "OAuth redirects must use HTTPS unless loopback");
+        if (!this.config.allowedRedirectHosts.includes(url.hostname))
+            throw new ChatRoomError("FORBIDDEN", `OAuth redirect host is not allowed: ${url.hostname}`);
+    }
+}
+function digest(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+function safeEqual(a, b) {
+    const left = Buffer.from(a);
+    const right = Buffer.from(b);
+    return left.length === right.length && timingSafeEqual(left, right);
+}

package/dist/auth/ingress-policy.d.ts

@@ -0,0 +1,21 @@
+import type { Request } from "express";
+import type { ChatRoomConfig } from "../config/types.js";
+import type { ExternalAccessRegistry } from "../app/external-access-registry.js";
+export interface WebAuthnOrigin {
+    origin: string;
+    rpId: string;
+}
+/** Classifies ingress exclusively from configured/registered public hosts. */
+export declare class IngressPolicy {
+    private readonly config;
+    private readonly externalAccess;
+    constructor(config: ChatRoomConfig, externalAccess: ExternalAccessRegistry);
+    allowedHosts(): ReadonlySet<string>;
+    requiresWebAuth(req: Request): boolean;
+    requiresMcpAuth(req: Request): boolean;
+    secureWebCookie(req: Request): boolean;
+    expectedWebOrigin(req: Request): string | null;
+    webAuthnOrigin(req: Request): WebAuthnOrigin | null;
+    mcpBaseUrl(req: Request): string;
+    private externalBaseUrl;
+}

package/dist/auth/ingress-policy.js

@@ -0,0 +1,57 @@
+/** Classifies ingress exclusively from configured/registered public hosts. */
+export class IngressPolicy {
+    config;
+    externalAccess;
+    constructor(config, externalAccess) {
+        this.config = config;
+        this.externalAccess = externalAccess;
+    }
+    allowedHosts() {
+        const allowed = new Set(["localhost", "127.0.0.1", "::1"]);
+        if (this.config.server.host !== "0.0.0.0" &&
+            this.config.server.host !== "::")
+            allowed.add(this.config.server.host);
+        for (const host of this.externalAccess.hosts())
+            allowed.add(host);
+        return allowed;
+    }
+    requiresWebAuth(req) {
+        if (this.externalAccess.matches("web", req.hostname))
+            return true;
+        return this.config.auth.localWebAuth;
+    }
+    requiresMcpAuth(req) {
+        return this.externalAccess.matches("mcp", req.hostname);
+    }
+    secureWebCookie(req) {
+        const base = this.externalBaseUrl(req, "web");
+        if (!base)
+            return req.secure;
+        return new URL(base).protocol === "https:";
+    }
+    expectedWebOrigin(req) {
+        const base = this.externalBaseUrl(req, "web");
+        return base ? new URL(base).origin : null;
+    }
+    webAuthnOrigin(req) {
+        const base = this.externalBaseUrl(req, "web");
+        if (!base)
+            return null;
+        const url = new URL(base);
+        const loopback = url.hostname === "localhost" ||
+            url.hostname === "127.0.0.1" ||
+            url.hostname === "::1";
+        if (url.protocol !== "https:" && !loopback)
+            return null;
+        return { origin: url.origin, rpId: url.hostname };
+    }
+    mcpBaseUrl(req) {
+        const external = this.externalBaseUrl(req, "mcp");
+        if (external)
+            return external;
+        return `${req.protocol}://${req.get("host") ?? `${this.config.server.host}:${this.config.server.port}`}`.replace(/\/$/, "");
+    }
+    externalBaseUrl(req, kind) {
+        return this.externalAccess.baseUrlForHost(kind, req.hostname);
+    }
+}

package/dist/auth/passkey-service.d.ts

@@ -0,0 +1,39 @@
+import { type AuthenticationResponseJSON, type RegistrationResponseJSON } from "@simplewebauthn/server";
+import type { PasskeyRepository } from "../core/auth/passkey-repository.js";
+import type { WebAuthnOrigin } from "./ingress-policy.js";
+export declare class PasskeyService {
+    private readonly repository;
+    private readonly challenges;
+    constructor(repository: PasskeyRepository);
+    list(): {
+        id: string;
+        name: string;
+        lastUsedAt: string;
+    }[];
+    remove(credentialId: string): void;
+    registrationOptions(origin: WebAuthnOrigin | null): Promise<{
+        challengeId: string;
+        options: import("@simplewebauthn/server").PublicKeyCredentialCreationOptionsJSON;
+    }>;
+    verifyRegistration(input: {
+        challengeId: string;
+        response: RegistrationResponseJSON;
+        name?: string;
+    }): Promise<{
+        registered: boolean;
+        credentialId: string;
+    }>;
+    authenticationOptions(origin: WebAuthnOrigin | null): Promise<{
+        challengeId: string;
+        options: import("@simplewebauthn/server").PublicKeyCredentialRequestOptionsJSON;
+    }>;
+    verifyAuthentication(input: {
+        challengeId: string;
+        response: AuthenticationResponseJSON;
+    }): Promise<{
+        credentialId: string;
+    }>;
+    private storeChallenge;
+    private consumeChallenge;
+    private pruneChallenges;
+}

package/dist/auth/passkey-service.js

@@ -0,0 +1,145 @@
+import { randomUUID } from "node:crypto";
+import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse, } from "@simplewebauthn/server";
+import { ChatRoomError } from "../core/errors/chatroom-error.js";
+export class PasskeyService {
+    repository;
+    challenges = new Map();
+    constructor(repository) {
+        this.repository = repository;
+    }
+    list() {
+        return this.repository.list().map((item) => ({
+            id: item.credentialId,
+            name: item.name,
+            lastUsedAt: item.lastUsedAt,
+        }));
+    }
+    remove(credentialId) {
+        this.repository.remove(credentialId);
+    }
+    async registrationOptions(origin) {
+        const expected = requireOrigin(origin);
+        const passkeys = this.repository.list();
+        const options = await generateRegistrationOptions({
+            rpName: "ChatRoom",
+            rpID: expected.rpId,
+            userName: "chatroom-owner",
+            userDisplayName: "ChatRoom Owner",
+            userID: Buffer.from("chatroom-owner"),
+            attestationType: "none",
+            excludeCredentials: passkeys.map((item) => ({
+                id: item.credentialId,
+                transports: item.transports,
+            })),
+            authenticatorSelection: {
+                residentKey: "required",
+                userVerification: "required",
+            },
+        });
+        const challengeId = this.storeChallenge("registration", options.challenge, expected);
+        return { challengeId, options };
+    }
+    async verifyRegistration(input) {
+        const record = this.consumeChallenge(input.challengeId, "registration");
+        if (!record)
+            throw new ChatRoomError("FORBIDDEN", "Passkey challenge is invalid or expired");
+        const verification = await verifyRegistrationResponse({
+            response: input.response,
+            expectedChallenge: record.challenge,
+            expectedOrigin: record.origin,
+            expectedRPID: record.rpId,
+            requireUserVerification: true,
+        });
+        if (!verification.verified)
+            throw new ChatRoomError("FORBIDDEN", "Passkey registration could not be verified");
+        const now = new Date().toISOString();
+        const credential = verification.registrationInfo.credential;
+        this.repository.upsert({
+            credentialId: credential.id,
+            publicKey: credential.publicKey,
+            counter: credential.counter,
+            transports: credential.transports ?? input.response.response.transports ?? [],
+            deviceType: verification.registrationInfo.credentialDeviceType,
+            backedUp: verification.registrationInfo.credentialBackedUp,
+            name: input.name?.trim().slice(0, 80) || "Passkey",
+            createdAt: now,
+            lastUsedAt: now,
+        });
+        return { registered: true, credentialId: credential.id };
+    }
+    async authenticationOptions(origin) {
+        const expected = requireOrigin(origin);
+        const passkeys = this.repository.list();
+        if (!passkeys.length)
+            throw new ChatRoomError("NOT_FOUND", "No passkeys are registered");
+        const options = await generateAuthenticationOptions({
+            rpID: expected.rpId,
+            userVerification: "required",
+        });
+        const challengeId = this.storeChallenge("authentication", options.challenge, expected);
+        return { challengeId, options };
+    }
+    async verifyAuthentication(input) {
+        const record = this.consumeChallenge(input.challengeId, "authentication");
+        if (!record)
+            throw new ChatRoomError("FORBIDDEN", "Passkey challenge is invalid or expired");
+        const passkey = this.repository.get(input.response.id);
+        if (!passkey)
+            throw new ChatRoomError("FORBIDDEN", "Unknown passkey credential");
+        const publicKey = new Uint8Array(passkey.publicKey.byteLength);
+        publicKey.set(passkey.publicKey);
+        const verification = await verifyAuthenticationResponse({
+            response: input.response,
+            expectedChallenge: record.challenge,
+            expectedOrigin: record.origin,
+            expectedRPID: record.rpId,
+            credential: {
+                id: passkey.credentialId,
+                publicKey,
+                counter: passkey.counter,
+                transports: passkey.transports,
+            },
+            requireUserVerification: true,
+        });
+        if (!verification.verified)
+            throw new ChatRoomError("FORBIDDEN", "Passkey authentication could not be verified");
+        this.repository.updateCounter(passkey.credentialId, verification.authenticationInfo.newCounter);
+        return { credentialId: passkey.credentialId };
+    }
+    storeChallenge(kind, challenge, origin) {
+        this.pruneChallenges();
+        while (this.challenges.size >= 64) {
+            const oldest = this.challenges.keys().next().value;
+            if (!oldest)
+                break;
+            this.challenges.delete(oldest);
+        }
+        const id = `pkc_${randomUUID()}`;
+        this.challenges.set(id, {
+            kind,
+            challenge,
+            origin: origin.origin,
+            rpId: origin.rpId,
+            expiresAt: Date.now() + 5 * 60 * 1000,
+        });
+        return id;
+    }
+    consumeChallenge(id, kind) {
+        const record = this.challenges.get(id);
+        this.challenges.delete(id);
+        if (!record || record.kind !== kind || record.expiresAt <= Date.now())
+            return null;
+        return record;
+    }
+    pruneChallenges() {
+        const now = Date.now();
+        for (const [id, record] of this.challenges)
+            if (record.expiresAt <= now)
+                this.challenges.delete(id);
+    }
+}
+function requireOrigin(origin) {
+    if (!origin)
+        throw new ChatRoomError("UNSUPPORTED", "Passkeys require a secure public WebUI origin");
+    return origin;
+}

package/dist/cli/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli/index.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+import { asChatRoomError } from "../core/errors/chatroom-error.js";
+import { runChatRoomCli } from "./run-cli.js";
+void runChatRoomCli().catch((error) => {
+    const normalized = asChatRoomError(error);
+    console.error(`[${normalized.code}] ${normalized.message}`);
+    if (normalized.details)
+        console.error(normalized.details);
+    process.exitCode = 1;
+});

package/dist/cli/run-cli.d.ts

@@ -0,0 +1 @@
+export declare function runChatRoomCli(argv?: string[]): Promise<void>;

package/dist/cli/run-cli.js

@@ -0,0 +1,42 @@
+/** ChatRoom CLI host. */
+import { initializeConfig, loadConfig } from "../config/load-config.js";
+import { ApplicationLifecycle } from "../app/lifecycle.js";
+export async function runChatRoomCli(argv = process.argv.slice(2)) {
+    const [command = "help"] = argv;
+    if (command === "init")
+        return init();
+    if (command === "serve")
+        return serve();
+    printHelp();
+}
+async function init() {
+    const result = await initializeConfig();
+    console.log(`ChatRoom initialized: ${result.configPath}`);
+    console.log(`Allowed roots: ${result.config.allowedRoots.join(", ")}`);
+    console.log(`Owner token: ${result.config.auth.ownerToken}`);
+    console.log("Local loopback WebUI does not require authentication by default. Keep the owner token private for public access.");
+}
+async function serve() {
+    const config = await loadConfig();
+    const lifecycle = new ApplicationLifecycle(config);
+    await lifecycle.start();
+    console.log(`ChatRoom listening on http://${config.server.host}:${config.server.port}`);
+    let closing = false;
+    const shutdown = () => {
+        if (closing)
+            return;
+        closing = true;
+        void lifecycle
+            .shutdown()
+            .then(() => process.exit(0))
+            .catch((error) => {
+            console.error(error);
+            process.exit(1);
+        });
+    };
+    process.once("SIGINT", shutdown);
+    process.once("SIGTERM", shutdown);
+}
+function printHelp() {
+    console.log("ChatRoom\n\nUsage:\n  chatroom init\n  chatroom serve");
+}

package/dist/config/load-config.d.ts

@@ -0,0 +1,7 @@
+import type { ChatRoomConfig } from "./types.js";
+export declare function defaultConfig(): ChatRoomConfig;
+export declare function loadConfig(configPath?: string): Promise<ChatRoomConfig>;
+export declare function initializeConfig(): Promise<{
+    config: ChatRoomConfig;
+    configPath: string;
+}>;