@compass-ai/nova 1.0.72 → 1.0.74

package/dist/services/mcp-oauth-service.js

@@ -0,0 +1,892 @@
+/**
+ * MCP OAuth Service.
+ *
+ * Handles OAuth 2.0 authentication for MCP servers that require it.
+ * Features:
+ * - OAuth 2.0 authorization code flow
+ * - Token storage and refresh
+ * - Local callback server for OAuth redirects
+ * - Automatic token refresh
+ */
+import { createServer } from 'http';
+import { URL, URLSearchParams } from 'url';
+import { createHash, randomBytes } from 'crypto';
+import { logger } from '../utils/logger.js';
+import { safeReadFile, safeWriteFile, pathExists, ensureDir } from '../utils/file-system.js';
+import { getGlobalCompassDir } from '../utils/path.js';
+/**
+ * Built-in OAuth configurations for known MCP servers.
+ * These are bundled with Kore-CLI so users don't need to register their own OAuth apps.
+ *
+ * The client credentials here are for the "Kore-CLI" OAuth application registered
+ * with each service. Using PKCE, so client_secret exposure is acceptable for public clients.
+ *
+ * To add credentials:
+ * - Set via environment variables (FIGMA_MCP_CLIENT_ID, FIGMA_MCP_CLIENT_SECRET)
+ * - Or hardcode the values directly below for distribution
+ */
+const KNOWN_MCP_OAUTH_CONFIGS = {
+    // Figma MCP Server - uses Kore-CLI OAuth application
+    // Get your credentials from: https://www.figma.com/developers/apps
+    // Scopes reference: https://developers.figma.com/docs/rest-api/scopes/
+    'mcp.figma.com': {
+        clientId: process.env.FIGMA_MCP_CLIENT_ID || '7cLAcGuKlF257dbgakWp7O',
+        clientSecret: process.env.FIGMA_MCP_CLIENT_SECRET || 'zPgspJQf9J5WfDxXjYc0XxTB9fFOpL',
+        // OAuth URLs - see: https://developers.figma.com/docs/rest-api/authentication/
+        authorizationUrl: 'https://www.figma.com/oauth',
+        tokenUrl: 'https://api.figma.com/v1/oauth/token', // Note: api.figma.com, not www.figma.com
+        // Required scopes for Figma MCP - enable these in your Figma app settings:
+        // See: https://developers.figma.com/docs/rest-api/scopes/
+        scopes: [
+            'file_content:read', // Read the contents of files (nodes, editor type)
+            'file_metadata:read', // Read metadata of files
+            'file_dev_resources:read', // Read dev resources in files
+            'file_dev_resources:write', // Write dev resources to files
+            // Note: file_variables:read/write are Enterprise-only
+        ],
+    },
+    // Add more known MCP servers here as needed:
+    // 'mcp.example.com': {
+    //   clientId: process.env.EXAMPLE_MCP_CLIENT_ID || 'client-id',
+    //   clientSecret: process.env.EXAMPLE_MCP_CLIENT_SECRET || 'client-secret',
+    // },
+};
+/**
+ * Registry of known MCP providers with their authentication restrictions and fallbacks.
+ * This helps users when they encounter authentication issues with specific providers.
+ */
+const KNOWN_MCP_PROVIDERS = [
+    {
+        name: 'figma',
+        remoteUrlPattern: /^https?:\/\/(mcp\.)?figma\.com/i,
+        oauthRestricted: true,
+        approvedClients: ['VS Code', 'Cursor', 'Claude Code'],
+        fallback: {
+            name: 'Figma Desktop MCP Server',
+            reason: 'Figma restricts remote MCP OAuth to approved clients only. Use the local desktop server instead.',
+            config: {
+                type: 'http',
+                url: 'http://127.0.0.1:3845/mcp',
+                enabled: true,
+            },
+            requirements: [
+                'Figma desktop app installed and running',
+                'Logged in to your Figma account',
+                'A Design file open with Dev Mode enabled',
+            ],
+            setupInstructions: [
+                '1. Open Figma desktop app (ensure latest version)',
+                '2. Create or open a Design file',
+                '3. Enable Dev Mode (toolbar or Shift+D)',
+                '4. In the Inspect panel, enable MCP server',
+                '5. Update your .mcp.json to use: http://127.0.0.1:3845/mcp',
+            ],
+        },
+    },
+];
+/**
+ * Gets provider info for a server URL.
+ */
+export function getProviderInfo(serverUrl) {
+    for (const provider of KNOWN_MCP_PROVIDERS) {
+        if (provider.remoteUrlPattern.test(serverUrl)) {
+            return provider;
+        }
+    }
+    return undefined;
+}
+/**
+ * Gets fallback configuration for a server URL if available.
+ */
+export function getFallbackConfig(serverUrl) {
+    const provider = getProviderInfo(serverUrl);
+    return provider?.fallback;
+}
+/**
+ * Checks if a server URL is for a provider with restricted OAuth.
+ */
+export function isOAuthRestricted(serverUrl) {
+    const provider = getProviderInfo(serverUrl);
+    return provider?.oauthRestricted ?? false;
+}
+/**
+ * Checks if the local Figma MCP server is available.
+ * Returns true if the server responds to a health check.
+ */
+export async function checkLocalFigmaServer() {
+    try {
+        const controller = new AbortController();
+        const timeoutId = setTimeout(() => controller.abort(), 2000);
+        const response = await fetch('http://127.0.0.1:3845/mcp', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                jsonrpc: '2.0',
+                id: 1,
+                method: 'initialize',
+                params: {
+                    protocolVersion: '2024-11-05',
+                    capabilities: {},
+                    clientInfo: { name: 'kore-cli', version: '1.0.0' },
+                },
+            }),
+            signal: controller.signal,
+        });
+        clearTimeout(timeoutId);
+        return response.ok;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Gets the built-in OAuth config for a known MCP server URL.
+ * Returns undefined if the server is not in the known registry or has placeholder credentials.
+ */
+function getKnownOAuthConfig(serverUrl) {
+    try {
+        const url = new URL(serverUrl);
+        const host = url.host.toLowerCase();
+        // Check for exact match or subdomain match
+        for (const [knownHost, config] of Object.entries(KNOWN_MCP_OAUTH_CONFIGS)) {
+            if (host === knownHost || host.endsWith(`.${knownHost}`)) {
+                // Only return if we have real credentials (not placeholders)
+                const hasRealClientId = config.clientId &&
+                    !config.clientId.includes('YOUR_') &&
+                    !config.clientId.includes('_HERE');
+                if (hasRealClientId) {
+                    logger.debug(`Found built-in OAuth config for ${knownHost}`);
+                    return config;
+                }
+                else {
+                    // Return URLs only (for discovery) if credentials are placeholders
+                    if (config.authorizationUrl || config.tokenUrl) {
+                        logger.debug(`Found built-in OAuth URLs (no credentials) for ${knownHost}`);
+                        return {
+                            authorizationUrl: config.authorizationUrl,
+                            tokenUrl: config.tokenUrl,
+                            scopes: config.scopes,
+                        };
+                    }
+                }
+            }
+        }
+    }
+    catch {
+        // Invalid URL, ignore
+    }
+    return undefined;
+}
+/**
+ * MCP OAuth Service class.
+ */
+class MCPOAuthService {
+    storage = { tokens: {} };
+    storagePath;
+    pendingAuths = new Map();
+    callbackServer = null;
+    callbackPort = 23456; // Default callback port
+    constructor() {
+        this.storagePath = `${getGlobalCompassDir()}/mcp-oauth.json`;
+    }
+    /**
+     * Loads stored OAuth tokens.
+     */
+    async load() {
+        try {
+            if (await pathExists(this.storagePath)) {
+                const content = await safeReadFile(this.storagePath);
+                this.storage = JSON.parse(content || '{"tokens":{}}');
+            }
+        }
+        catch (error) {
+            logger.warn('Failed to load OAuth storage', error);
+            this.storage = { tokens: {} };
+        }
+    }
+    /**
+     * Saves OAuth tokens.
+     */
+    async save() {
+        try {
+            await ensureDir(getGlobalCompassDir());
+            await safeWriteFile(this.storagePath, JSON.stringify(this.storage, null, 2));
+        }
+        catch (error) {
+            logger.error('Failed to save OAuth storage', error);
+        }
+    }
+    /**
+     * Gets authentication state for a server.
+     */
+    getAuthState(serverName, oauthConfig) {
+        const tokens = this.storage.tokens[serverName];
+        const authenticated = !!tokens && this.isTokenValid(tokens);
+        return {
+            serverName,
+            required: !!oauthConfig,
+            authenticated,
+            oauth: oauthConfig,
+            tokens: authenticated ? tokens : undefined,
+            method: oauthConfig ? 'oauth' : 'none',
+        };
+    }
+    /**
+     * Checks if tokens are valid (not expired).
+     */
+    isTokenValid(tokens) {
+        if (!tokens.expiresAt) {
+            return true; // No expiration means always valid
+        }
+        const expiresAt = new Date(tokens.expiresAt);
+        const now = new Date();
+        // Consider token expired 5 minutes early to allow for refresh
+        return expiresAt.getTime() - 5 * 60 * 1000 > now.getTime();
+    }
+    /**
+     * Gets stored tokens for a server.
+     */
+    getTokens(serverName) {
+        return this.storage.tokens[serverName];
+    }
+    /**
+     * Starts the OAuth authorization flow.
+     */
+    async startAuthFlow(serverName, oauthConfig) {
+        if (!oauthConfig.authorizationUrl || !oauthConfig.clientId) {
+            return {
+                authUrl: '',
+                error: 'OAuth configuration incomplete: missing authorizationUrl or clientId',
+            };
+        }
+        try {
+            // Start callback server if not running
+            await this.startCallbackServer();
+            // Generate PKCE code verifier and challenge
+            const codeVerifier = this.generateCodeVerifier();
+            const codeChallenge = this.generateCodeChallenge(codeVerifier);
+            // Generate state for CSRF protection
+            const state = randomBytes(16).toString('hex');
+            // Store pending auth state
+            this.pendingAuths.set(state, {
+                serverName,
+                state,
+                codeVerifier,
+                createdAt: new Date(),
+            });
+            // Build authorization URL
+            const authUrl = new URL(oauthConfig.authorizationUrl);
+            authUrl.searchParams.set('client_id', oauthConfig.clientId);
+            authUrl.searchParams.set('response_type', 'code');
+            authUrl.searchParams.set('redirect_uri', this.getRedirectUri());
+            authUrl.searchParams.set('state', state);
+            authUrl.searchParams.set('code_challenge', codeChallenge);
+            authUrl.searchParams.set('code_challenge_method', 'S256');
+            if (oauthConfig.scopes?.length) {
+                authUrl.searchParams.set('scope', oauthConfig.scopes.join(' '));
+            }
+            logger.info(`Starting OAuth flow for ${serverName}`);
+            return { authUrl: authUrl.toString() };
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            logger.error(`Failed to start OAuth flow for ${serverName}:`, error);
+            return { authUrl: '', error: errorMessage };
+        }
+    }
+    /**
+     * Starts the local callback server for OAuth redirects.
+     */
+    async startCallbackServer() {
+        if (this.callbackServer) {
+            return;
+        }
+        return new Promise((resolve, reject) => {
+            this.callbackServer = createServer(this.handleCallback.bind(this));
+            this.callbackServer.on('error', (error) => {
+                if (error.code === 'EADDRINUSE') {
+                    // Try next port
+                    this.callbackPort++;
+                    this.callbackServer = null;
+                    this.startCallbackServer().then(resolve).catch(reject);
+                }
+                else {
+                    reject(error);
+                }
+            });
+            this.callbackServer.listen(this.callbackPort, '127.0.0.1', () => {
+                logger.debug(`OAuth callback server listening on port ${this.callbackPort}`);
+                resolve();
+            });
+        });
+    }
+    /**
+     * Handles OAuth callback requests.
+     */
+    async handleCallback(req, res) {
+        try {
+            const url = new URL(req.url || '', `http://127.0.0.1:${this.callbackPort}`);
+            if (url.pathname !== '/oauth/callback') {
+                res.writeHead(404);
+                res.end('Not found');
+                return;
+            }
+            const code = url.searchParams.get('code');
+            const state = url.searchParams.get('state');
+            const error = url.searchParams.get('error');
+            if (error) {
+                res.writeHead(400);
+                res.end(`OAuth error: ${error}`);
+                return;
+            }
+            if (!code || !state) {
+                res.writeHead(400);
+                res.end('Missing code or state parameter');
+                return;
+            }
+            const pendingAuth = this.pendingAuths.get(state);
+            if (!pendingAuth) {
+                res.writeHead(400);
+                res.end('Invalid state parameter');
+                return;
+            }
+            // Clean up pending auth
+            this.pendingAuths.delete(state);
+            // Display success page
+            res.writeHead(200, { 'Content-Type': 'text/html' });
+            res.end(`
+        <!DOCTYPE html>
+        <html>
+          <head>
+            <title>Compass CLI - OAuth Success</title>
+            <style>
+              body { font-family: -apple-system, BlinkMacSystemFont, sans-serif; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background: #1a1a2e; color: #eee; }
+              .container { text-align: center; padding: 2rem; }
+              h1 { color: #4ade80; }
+              p { color: #9ca3af; }
+            </style>
+          </head>
+          <body>
+            <div class="container">
+              <h1>Authentication Successful</h1>
+              <p>You can close this window and return to Compass CLI.</p>
+            </div>
+          </body>
+        </html>
+      `);
+            // Store the auth code for later exchange
+            // The code exchange happens separately via completeAuthFlow
+            this.pendingAuths.set(`code:${pendingAuth.serverName}`, {
+                ...pendingAuth,
+                state: code, // Temporarily store code in state field
+            });
+            logger.info(`OAuth callback received for ${pendingAuth.serverName}`);
+        }
+        catch (error) {
+            logger.error('Error handling OAuth callback:', error);
+            res.writeHead(500);
+            res.end('Internal server error');
+        }
+    }
+    /**
+     * Completes the OAuth flow by exchanging the code for tokens.
+     */
+    async completeAuthFlow(serverName, oauthConfig) {
+        const pendingKey = `code:${serverName}`;
+        const pendingAuth = this.pendingAuths.get(pendingKey);
+        if (!pendingAuth) {
+            return {
+                success: false,
+                error: 'No pending OAuth flow for this server',
+            };
+        }
+        const code = pendingAuth.state;
+        const codeVerifier = pendingAuth.codeVerifier;
+        this.pendingAuths.delete(pendingKey);
+        if (!oauthConfig.tokenUrl) {
+            return {
+                success: false,
+                error: 'OAuth configuration incomplete: missing tokenUrl',
+            };
+        }
+        try {
+            // Exchange code for tokens
+            const tokenParams = new URLSearchParams();
+            tokenParams.set('grant_type', 'authorization_code');
+            tokenParams.set('client_id', oauthConfig.clientId || '');
+            tokenParams.set('code', code);
+            tokenParams.set('redirect_uri', this.getRedirectUri());
+            tokenParams.set('code_verifier', codeVerifier);
+            if (oauthConfig.clientSecret) {
+                tokenParams.set('client_secret', oauthConfig.clientSecret);
+            }
+            const response = await fetch(oauthConfig.tokenUrl, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                },
+                body: tokenParams.toString(),
+            });
+            if (!response.ok) {
+                const errorText = await response.text();
+                return {
+                    success: false,
+                    error: `Token exchange failed: ${response.status} ${errorText}`,
+                };
+            }
+            const tokenData = (await response.json());
+            // Store tokens
+            const tokens = {
+                accessToken: tokenData.access_token,
+                tokenType: tokenData.token_type || 'Bearer',
+                refreshToken: tokenData.refresh_token,
+                expiresAt: tokenData.expires_in
+                    ? new Date(Date.now() + tokenData.expires_in * 1000)
+                    : undefined,
+                scopes: tokenData.scope?.split(' '),
+            };
+            this.storage.tokens[serverName] = tokens;
+            await this.save();
+            logger.info(`OAuth flow completed for ${serverName}`);
+            return { success: true };
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            logger.error(`Failed to complete OAuth flow for ${serverName}:`, error);
+            return { success: false, error: errorMessage };
+        }
+    }
+    /**
+     * Refreshes tokens for a server.
+     */
+    async refreshTokens(serverName, oauthConfig) {
+        const existingTokens = this.storage.tokens[serverName];
+        if (!existingTokens?.refreshToken) {
+            return {
+                success: false,
+                error: 'No refresh token available',
+            };
+        }
+        if (!oauthConfig.tokenUrl) {
+            return {
+                success: false,
+                error: 'OAuth configuration incomplete: missing tokenUrl',
+            };
+        }
+        try {
+            const tokenParams = new URLSearchParams();
+            tokenParams.set('grant_type', 'refresh_token');
+            tokenParams.set('client_id', oauthConfig.clientId || '');
+            tokenParams.set('refresh_token', existingTokens.refreshToken);
+            if (oauthConfig.clientSecret) {
+                tokenParams.set('client_secret', oauthConfig.clientSecret);
+            }
+            const response = await fetch(oauthConfig.tokenUrl, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                },
+                body: tokenParams.toString(),
+            });
+            if (!response.ok) {
+                const errorText = await response.text();
+                return {
+                    success: false,
+                    error: `Token refresh failed: ${response.status} ${errorText}`,
+                };
+            }
+            const tokenData = (await response.json());
+            // Update tokens
+            this.storage.tokens[serverName] = {
+                accessToken: tokenData.access_token,
+                tokenType: tokenData.token_type || 'Bearer',
+                refreshToken: tokenData.refresh_token || existingTokens.refreshToken,
+                expiresAt: tokenData.expires_in
+                    ? new Date(Date.now() + tokenData.expires_in * 1000)
+                    : undefined,
+                scopes: tokenData.scope?.split(' ') || existingTokens.scopes,
+            };
+            await this.save();
+            logger.debug(`Tokens refreshed for ${serverName}`);
+            return { success: true };
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            logger.error(`Failed to refresh tokens for ${serverName}:`, error);
+            return { success: false, error: errorMessage };
+        }
+    }
+    /**
+     * Clears authentication for a server.
+     */
+    async clearAuth(serverName) {
+        delete this.storage.tokens[serverName];
+        if (this.storage.apiTokens) {
+            delete this.storage.apiTokens[serverName];
+        }
+        await this.save();
+        logger.info(`Cleared authentication for ${serverName}`);
+    }
+    /**
+     * Sets a simple API token for a server (non-OAuth authentication).
+     * Used for servers that accept Bearer tokens or API keys directly.
+     */
+    async setApiToken(serverName, token) {
+        if (!this.storage.apiTokens) {
+            this.storage.apiTokens = {};
+        }
+        this.storage.apiTokens[serverName] = token;
+        await this.save();
+        logger.info(`Stored API token for ${serverName}`);
+    }
+    /**
+     * Gets a simple API token for a server.
+     */
+    getApiToken(serverName) {
+        return this.storage.apiTokens?.[serverName];
+    }
+    /**
+     * Checks if a server has any form of stored authentication (OAuth or API token).
+     */
+    hasStoredAuth(serverName) {
+        const hasOAuth = !!this.storage.tokens[serverName] && this.isTokenValid(this.storage.tokens[serverName]);
+        const hasApiToken = !!this.storage.apiTokens?.[serverName];
+        return hasOAuth || hasApiToken;
+    }
+    /**
+     * Gets the OAuth redirect URI.
+     */
+    getRedirectUri() {
+        return `http://127.0.0.1:${this.callbackPort}/oauth/callback`;
+    }
+    /**
+     * Generates a PKCE code verifier.
+     */
+    generateCodeVerifier() {
+        return randomBytes(32)
+            .toString('base64')
+            .replace(/\+/g, '-')
+            .replace(/\//g, '_')
+            .replace(/=/g, '');
+    }
+    /**
+     * Generates a PKCE code challenge from verifier.
+     */
+    generateCodeChallenge(verifier) {
+        return createHash('sha256')
+            .update(verifier)
+            .digest('base64')
+            .replace(/\+/g, '-')
+            .replace(/\//g, '_')
+            .replace(/=/g, '');
+    }
+    /**
+     * Gets authorization header for a server.
+     * Checks OAuth tokens first, then falls back to simple API tokens.
+     */
+    getAuthHeader(serverName) {
+        logger.debug(`getAuthHeader called for server: ${serverName}`);
+        logger.debug(`Available token keys: ${Object.keys(this.storage.tokens || {}).join(', ') || 'none'}`);
+        logger.debug(`Available API token keys: ${Object.keys(this.storage.apiTokens || {}).join(', ') || 'none'}`);
+        // First check OAuth tokens
+        const tokens = this.storage.tokens[serverName];
+        if (tokens) {
+            logger.debug(`Found OAuth token for ${serverName}, valid: ${this.isTokenValid(tokens)}`);
+            if (this.isTokenValid(tokens)) {
+                // Normalize token type to "Bearer" (capitalized) as per RFC 6750
+                // Some servers return lowercase "bearer" but expect capitalized in requests
+                const tokenType = tokens.tokenType?.toLowerCase() === 'bearer' ? 'Bearer' : tokens.tokenType;
+                logger.debug(`Returning OAuth auth header for ${serverName} with tokenType: ${tokenType}`);
+                return `${tokenType} ${tokens.accessToken}`;
+            }
+        }
+        // Fall back to simple API token
+        const apiToken = this.storage.apiTokens?.[serverName];
+        if (apiToken) {
+            logger.debug(`Returning API token auth header for ${serverName}`);
+            return `Bearer ${apiToken}`;
+        }
+        logger.debug(`No auth header found for ${serverName}`);
+        return undefined;
+    }
+    /**
+     * Discovers OAuth configuration from a server URL using RFC 8414.
+     * Tries multiple well-known endpoints to find OAuth metadata.
+     */
+    async discoverOAuthConfig(serverUrl) {
+        const baseUrl = new URL(serverUrl);
+        const origin = baseUrl.origin;
+        // Try different well-known OAuth discovery endpoints
+        const discoveryEndpoints = [
+            `${origin}/.well-known/oauth-authorization-server`,
+            `${origin}/.well-known/openid-configuration`,
+        ];
+        for (const endpoint of discoveryEndpoints) {
+            try {
+                logger.debug(`Trying OAuth discovery at: ${endpoint}`);
+                const response = await fetch(endpoint, {
+                    method: 'GET',
+                    headers: { 'Accept': 'application/json' },
+                });
+                if (response.ok) {
+                    const metadata = (await response.json());
+                    logger.debug(`OAuth discovery response from ${endpoint}: ${JSON.stringify(metadata)}`);
+                    if (metadata.authorization_endpoint && metadata.token_endpoint) {
+                        logger.info(`Discovered OAuth config from ${endpoint}`);
+                        return {
+                            authorizationUrl: metadata.authorization_endpoint,
+                            tokenUrl: metadata.token_endpoint,
+                            scopes: metadata.scopes_supported,
+                            // Note: clientId needs to be registered or dynamically obtained
+                            // Some servers support dynamic client registration
+                        };
+                    }
+                }
+            }
+            catch (error) {
+                logger.debug(`OAuth discovery failed at ${endpoint}:`, error);
+            }
+        }
+        return null;
+    }
+    /**
+     * Starts OAuth flow with automatic discovery if no config is provided.
+     * This handles servers that support standard OAuth discovery.
+     *
+     * Config priority (highest to lowest):
+     * 1. User-provided config in .mcp.json
+     * 2. Built-in known config for the server (Kore-CLI registered apps)
+     * 3. Discovered config from server's well-known endpoint
+     */
+    async startAuthFlowWithDiscovery(serverName, serverUrl, providedConfig) {
+        // Check for built-in known OAuth config for this server
+        const knownConfig = getKnownOAuthConfig(serverUrl);
+        if (knownConfig) {
+            logger.info(`Using built-in Kore-CLI OAuth credentials for ${serverName}`);
+        }
+        // Merge configs: user-provided > known > discovered
+        // Start with provided config as base
+        let oauthConfig = providedConfig;
+        // If no OAuth URLs provided, try to discover them
+        if (!oauthConfig?.authorizationUrl) {
+            logger.info(`Discovering OAuth endpoints for ${serverName}...`);
+            const discovered = await this.discoverOAuthConfig(serverUrl);
+            if (discovered) {
+                // Merge priority: discovered URLs/scopes > known credentials > user overrides
+                // Key: Use discovered URLs and scopes, but use our clientId/clientSecret
+                oauthConfig = {
+                    // Start with known credentials (clientId, clientSecret)
+                    clientId: knownConfig?.clientId,
+                    clientSecret: knownConfig?.clientSecret,
+                    // Use discovered URLs and scopes (server-specific)
+                    authorizationUrl: discovered.authorizationUrl,
+                    tokenUrl: discovered.tokenUrl,
+                    scopes: discovered.scopes, // Use server's supported scopes
+                    // Allow user overrides for everything
+                    ...providedConfig,
+                };
+                logger.debug(`Merged OAuth config: authUrl=${oauthConfig.authorizationUrl}, scopes=${oauthConfig.scopes?.join(',')}`);
+                logger.info(`Using discovered OAuth config for ${serverName}`);
+            }
+            else if (knownConfig?.clientId) {
+                // No discovery, but we have known credentials - use hardcoded URLs as fallback
+                oauthConfig = { ...knownConfig, ...providedConfig };
+                logger.debug(`Using hardcoded OAuth config for ${serverName}`);
+            }
+            else {
+                return {
+                    authUrl: '',
+                    error: 'Could not discover OAuth configuration. Server may require manual token authentication.',
+                };
+            }
+        }
+        else {
+            // User provided URLs, just merge with known credentials if available
+            oauthConfig = {
+                clientId: knownConfig?.clientId,
+                clientSecret: knownConfig?.clientSecret,
+                ...providedConfig,
+            };
+        }
+        // Check if we have the minimum required config
+        if (!oauthConfig.authorizationUrl) {
+            return {
+                authUrl: '',
+                error: 'OAuth configuration incomplete: missing authorizationUrl',
+            };
+        }
+        // For servers without a pre-registered client, we may need dynamic registration
+        // or the server may accept requests without a client_id (public client)
+        const clientId = oauthConfig.clientId || 'compass-cli';
+        try {
+            // Start callback server if not running
+            await this.startCallbackServer();
+            // Generate PKCE code verifier and challenge
+            const codeVerifier = this.generateCodeVerifier();
+            const codeChallenge = this.generateCodeChallenge(codeVerifier);
+            // Generate state for CSRF protection
+            const state = randomBytes(16).toString('hex');
+            // Store pending auth state
+            this.pendingAuths.set(state, {
+                serverName,
+                state,
+                codeVerifier,
+                createdAt: new Date(),
+            });
+            // Build authorization URL
+            const authUrl = new URL(oauthConfig.authorizationUrl);
+            authUrl.searchParams.set('client_id', clientId);
+            authUrl.searchParams.set('response_type', 'code');
+            authUrl.searchParams.set('redirect_uri', this.getRedirectUri());
+            authUrl.searchParams.set('state', state);
+            authUrl.searchParams.set('code_challenge', codeChallenge);
+            authUrl.searchParams.set('code_challenge_method', 'S256');
+            if (oauthConfig.scopes?.length) {
+                authUrl.searchParams.set('scope', oauthConfig.scopes.join(' '));
+            }
+            logger.info(`Starting OAuth flow for ${serverName}`);
+            return {
+                authUrl: authUrl.toString(),
+                discoveredConfig: oauthConfig,
+            };
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            logger.error(`Failed to start OAuth flow for ${serverName}:`, error);
+            return { authUrl: '', error: errorMessage };
+        }
+    }
+    /**
+     * Completes OAuth flow with discovered config.
+     */
+    async completeAuthFlowWithConfig(serverName, oauthConfig) {
+        const pendingKey = `code:${serverName}`;
+        const pendingAuth = this.pendingAuths.get(pendingKey);
+        if (!pendingAuth) {
+            return {
+                success: false,
+                error: 'No pending OAuth flow for this server',
+            };
+        }
+        const code = pendingAuth.state;
+        const codeVerifier = pendingAuth.codeVerifier;
+        this.pendingAuths.delete(pendingKey);
+        if (!oauthConfig.tokenUrl) {
+            return {
+                success: false,
+                error: 'OAuth configuration incomplete: missing tokenUrl',
+            };
+        }
+        const clientId = oauthConfig.clientId || 'compass-cli';
+        try {
+            // Exchange code for tokens
+            const tokenParams = new URLSearchParams();
+            tokenParams.set('grant_type', 'authorization_code');
+            tokenParams.set('code', code);
+            tokenParams.set('redirect_uri', this.getRedirectUri());
+            tokenParams.set('code_verifier', codeVerifier);
+            // Build headers - use Basic Auth if we have client credentials (required by some servers like Figma)
+            const headers = {
+                'Content-Type': 'application/x-www-form-urlencoded',
+            };
+            if (oauthConfig.clientId && oauthConfig.clientSecret) {
+                // Use HTTP Basic Authentication for client credentials
+                const credentials = Buffer.from(`${clientId}:${oauthConfig.clientSecret}`).toString('base64');
+                headers['Authorization'] = `Basic ${credentials}`;
+            }
+            else {
+                // Fallback: include client_id in body for servers that don't use Basic Auth
+                tokenParams.set('client_id', clientId);
+                if (oauthConfig.clientSecret) {
+                    tokenParams.set('client_secret', oauthConfig.clientSecret);
+                }
+            }
+            const response = await fetch(oauthConfig.tokenUrl, {
+                method: 'POST',
+                headers,
+                body: tokenParams.toString(),
+            });
+            if (!response.ok) {
+                const errorText = await response.text();
+                return {
+                    success: false,
+                    error: `Token exchange failed: ${response.status} ${errorText}`,
+                };
+            }
+            const tokenData = (await response.json());
+            // Store tokens
+            const tokens = {
+                accessToken: tokenData.access_token,
+                tokenType: tokenData.token_type || 'Bearer',
+                refreshToken: tokenData.refresh_token,
+                expiresAt: tokenData.expires_in
+                    ? new Date(Date.now() + tokenData.expires_in * 1000)
+                    : undefined,
+                scopes: tokenData.scope?.split(' '),
+            };
+            this.storage.tokens[serverName] = tokens;
+            await this.save();
+            logger.info(`OAuth flow completed for ${serverName}`);
+            logger.debug(`Stored token for ${serverName}, tokenType: ${tokens.tokenType}, hasAccessToken: ${!!tokens.accessToken}`);
+            logger.debug(`Current storage token keys: ${Object.keys(this.storage.tokens).join(', ')}`);
+            return { success: true };
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            logger.error(`Failed to complete OAuth flow for ${serverName}:`, error);
+            return { success: false, error: errorMessage };
+        }
+    }
+    /**
+     * Stops the callback server.
+     */
+    async stopCallbackServer() {
+        if (this.callbackServer) {
+            return new Promise((resolve) => {
+                this.callbackServer.close(() => {
+                    this.callbackServer = null;
+                    logger.debug('OAuth callback server stopped');
+                    resolve();
+                });
+            });
+        }
+    }
+    /**
+     * Cleans up expired pending auth states.
+     */
+    cleanupPendingAuths() {
+        const now = new Date();
+        const maxAge = 10 * 60 * 1000; // 10 minutes
+        for (const [key, pending] of this.pendingAuths) {
+            if (now.getTime() - pending.createdAt.getTime() > maxAge) {
+                this.pendingAuths.delete(key);
+            }
+        }
+    }
+    /**
+     * Gets all servers with stored authentication.
+     */
+    getAuthenticatedServers() {
+        return Object.keys(this.storage.tokens).filter((name) => this.isTokenValid(this.storage.tokens[name]));
+    }
+}
+// Singleton instance
+let mcpOAuthServiceInstance = null;
+/**
+ * Gets the singleton MCPOAuthService instance.
+ */
+export async function getMCPOAuthService() {
+    if (!mcpOAuthServiceInstance) {
+        mcpOAuthServiceInstance = new MCPOAuthService();
+        await mcpOAuthServiceInstance.load();
+    }
+    return mcpOAuthServiceInstance;
+}
+/**
+ * Creates a new MCPOAuthService instance.
+ */
+export function createMCPOAuthService() {
+    return new MCPOAuthService();
+}
+export { MCPOAuthService };
+//# sourceMappingURL=mcp-oauth-service.js.map