@context-engine-bridge/context-engine-mcp-bridge 0.0.86 → 0.0.88

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@context-engine-bridge/context-engine-mcp-bridge",
-  "version": "0.0.86",
+  "version": "0.0.88",
   "description": "Context Engine MCP bridge (http/stdio proxy combining indexer + memory servers)",
   "bin": {
     "ctxce": "bin/ctxce.js",
@@ -17,6 +17,7 @@
     "test:e2e:ui": "playwright test --ui"
   },
   "dependencies": {
+    "@context-engine-bridge/context-engine-mcp-bridge": "^0.0.87",
     "@modelcontextprotocol/sdk": "^1.24.3",
     "ignore": "^7.0.5",
     "tar": "^7.5.9",

package/src/oauthHandler.js

@@ -458,6 +458,9 @@ export function handleOAuthStoreSession(req, res) {
         code_challenge_method,
         client_id,
       } = data;
+      const normalizedCodeChallengeMethod = code_challenge
+        ? (code_challenge_method || "S256")
+        : (code_challenge_method || null);
 
       if (!session_id || !backend_url) {
         res.statusCode = 400;
@@ -488,6 +491,15 @@ export function handleOAuthStoreSession(req, res) {
         return;
       }
 
+      if (code_challenge && normalizedCodeChallengeMethod !== "S256") {
+        res.statusCode = 400;
+        res.end(JSON.stringify({
+          error: "invalid_request",
+          error_description: "Unsupported code_challenge_method",
+        }));
+        return;
+      }
+
       // Additional CSRF protection: verify request came from a local browser origin
       // Require Origin or Referer header to be present and from localhost
       const origin = req.headers["origin"] || req.headers["referer"];
@@ -528,7 +540,7 @@ export function handleOAuthStoreSession(req, res) {
         sessionId: session_id,
         backendUrl: backend_url,
         codeChallenge: code_challenge,
-        codeChallengeMethod: code_challenge_method,
+        codeChallengeMethod: normalizedCodeChallengeMethod,
         redirectUri: redirect_uri,
         createdAt: Date.now(),
       });
@@ -560,8 +572,7 @@ export function handleOAuthToken(req, res) {
       const code = data.get("code");
       const redirectUri = data.get("redirect_uri");
       const clientId = data.get("client_id");
-      // PKCE code_verifier - extracted but not validated yet (local bridge, trusted)
-      data.get("code_verifier");
+      const codeVerifier = data.get("code_verifier");
       const grantType = data.get("grant_type");
 
       res.setHeader("Content-Type", "application/json");
@@ -605,24 +616,33 @@ export function handleOAuthToken(req, res) {
         return;
       }
 
-      // TODO: PKCE validation - disabled for now, no clients implement it yet
-      // if (pendingData.codeChallenge && pendingData.codeChallengeMethod === "S256") {
-      //   const codeVerifier = data.get("code_verifier");
-      //   if (!codeVerifier) {
-      //     pendingCodes.delete(code);
-      //     res.statusCode = 400;
-      //     res.end(JSON.stringify({ error: "invalid_grant", error_description: "code_verifier required for PKCE" }));
-      //     return;
-      //   }
-      //   const crypto = await import("node:crypto");
-      //   const expectedChallenge = crypto.createHash("sha256").update(codeVerifier).digest("base64url");
-      //   if (expectedChallenge !== pendingData.codeChallenge) {
-      //     pendingCodes.delete(code);
-      //     res.statusCode = 400;
-      //     res.end(JSON.stringify({ error: "invalid_grant", error_description: "code_verifier validation failed" }));
-      //     return;
-      //   }
-      // }
+      // PKCE validation (RFC 7636)
+      if (pendingData.codeChallenge) {
+        const codeChallengeMethod = pendingData.codeChallengeMethod || "S256";
+        if (codeChallengeMethod !== "S256") {
+          pendingCodes.delete(code);
+          res.statusCode = 400;
+          res.end(JSON.stringify({
+            error: "invalid_grant",
+            error_description: "Unsupported code_challenge_method",
+          }));
+          return;
+        }
+        if (!codeVerifier) {
+          pendingCodes.delete(code);
+          res.statusCode = 400;
+          res.end(JSON.stringify({ error: "invalid_grant", error_description: "code_verifier required for PKCE" }));
+          return;
+        }
+        const crypto = await import("node:crypto");
+        const expectedChallenge = crypto.createHash("sha256").update(codeVerifier).digest("base64url");
+        if (expectedChallenge !== pendingData.codeChallenge) {
+          pendingCodes.delete(code);
+          res.statusCode = 400;
+          res.end(JSON.stringify({ error: "invalid_grant", error_description: "code_verifier validation failed" }));
+          return;
+        }
+      }
 
       // Clean up expired tokens periodically to prevent unbounded growth
       cleanupExpiredTokens();