@danyow/lark-mcp 0.5.1

package/dist/auth/handler/handler.d.ts

@@ -0,0 +1,32 @@
+import { Express, Request, Response, NextFunction } from 'express';
+import { LarkOIDC2OAuthServerProvider, LarkOAuth2OAuthServerProvider } from '../provider';
+export interface LarkOAuthClientConfig {
+    port: number;
+    host: string;
+    domain: string;
+    appId: string;
+    appSecret: string;
+    scope?: string[];
+}
+export declare class LarkAuthHandler {
+    protected readonly app: Express;
+    protected readonly options: LarkOAuthClientConfig;
+    protected readonly provider: LarkOIDC2OAuthServerProvider | LarkOAuth2OAuthServerProvider;
+    get callbackUrl(): string;
+    get issuerUrl(): string;
+    constructor(app: Express, options: Partial<LarkOAuthClientConfig>);
+    protected callback(req: Request, res: Response): Promise<void>;
+    setupRoutes: () => void;
+    authenticateRequest(req: Request, res: Response, next: NextFunction): void;
+    refreshToken(accessToken: string): Promise<{
+        access_token: string;
+        token_type: string;
+        expires_in?: number | undefined;
+        scope?: string | undefined;
+        refresh_token?: string | undefined;
+    }>;
+    reAuthorize(accessToken?: string): Promise<{
+        accessToken: string;
+        authorizeUrl: string;
+    }>;
+}

package/dist/auth/handler/handler.js

@@ -0,0 +1,117 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LarkAuthHandler = void 0;
+const bearerAuth_js_1 = require("@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js");
+const router_js_1 = require("@modelcontextprotocol/sdk/server/auth/router.js");
+const provider_1 = require("../provider");
+const store_1 = require("../store");
+const pkce_1 = require("../utils/pkce");
+const logger_1 = require("../../utils/logger");
+class LarkAuthHandler {
+    get callbackUrl() {
+        return `http://${this.options.host}:${this.options.port}/callback`;
+    }
+    get issuerUrl() {
+        return `http://${this.options.host}:${this.options.port}`;
+    }
+    constructor(app, options) {
+        var _a;
+        this.app = app;
+        this.setupRoutes = () => {
+            logger_1.logger.info(`[LarkAuthHandler] setupRoutes: issuerUrl: ${this.issuerUrl}`);
+            this.app.use((0, router_js_1.mcpAuthRouter)({ provider: this.provider, issuerUrl: new URL(this.issuerUrl) }));
+            this.app.get('/callback', (req, res) => this.callback(req, res));
+        };
+        const { port, host, domain, appId, appSecret } = options;
+        if (!port || !host || !domain || !appId || !appSecret) {
+            throw new Error('[Lark MCP]  appId, and appSecret are required');
+        }
+        this.options = options;
+        const params = {
+            domain,
+            host,
+            port,
+            appId,
+            appSecret,
+            callbackUrl: this.callbackUrl,
+        };
+        if (!((_a = this.options.scope) === null || _a === void 0 ? void 0 : _a.length)) {
+            this.provider = new provider_1.LarkOIDC2OAuthServerProvider(params);
+        }
+        else {
+            this.provider = new provider_1.LarkOAuth2OAuthServerProvider(params);
+        }
+    }
+    async callback(req, res) {
+        const redirectUri = req.query.redirect_uri;
+        const finalRedirectUri = new URL(redirectUri);
+        finalRedirectUri.searchParams.set('code', req.query.code);
+        finalRedirectUri.searchParams.set('state', req.query.state);
+        res.redirect(finalRedirectUri.toString());
+        if (req.query.state === 'reauthorize') {
+            if (!req.query.code || typeof req.query.code !== 'string') {
+                logger_1.logger.error(`[LarkAuthHandler] Failed to exchange authorization code: ${req.query.code}`);
+                res.end('error, failed to exchange authorization code, please try again');
+                return;
+            }
+            const codeVerifier = store_1.authStore.getCodeVerifier('reauthorize');
+            if (!codeVerifier) {
+                logger_1.logger.error(`[LarkAuthHandler] Code verifier not found`);
+                res.end('error: code_verifier not found, please try again');
+                return;
+            }
+            await this.provider.exchangeAuthorizationCode({ client_id: 'LOCAL', redirect_uris: [] }, req.query.code, codeVerifier, this.callbackUrl);
+            store_1.authStore.removeCodeVerifier('reauthorize');
+            logger_1.logger.info(`[LarkAuthHandler] callback: Successfully exchanged authorization code`);
+            res.end('success, you can close this page now');
+        }
+    }
+    authenticateRequest(req, res, next) {
+        (0, bearerAuth_js_1.requireBearerAuth)({ verifier: this.provider, requiredScopes: [] })(req, res, next);
+    }
+    async refreshToken(accessToken) {
+        var _a, _b;
+        const token = await store_1.authStore.getToken(accessToken);
+        if (!token) {
+            logger_1.logger.error(`[LarkAuthHandler] refreshToken: No local access token found`);
+            throw new Error('No local access token found');
+        }
+        if (!((_a = token.extra) === null || _a === void 0 ? void 0 : _a.refreshToken)) {
+            logger_1.logger.error(`[LarkAuthHandler] refreshToken: No refresh token found`);
+            throw new Error('No refresh token found');
+        }
+        const newToken = await this.provider.exchangeRefreshToken({ client_id: token.clientId, redirect_uris: [this.callbackUrl] }, (_b = token.extra) === null || _b === void 0 ? void 0 : _b.refreshToken, token.scopes);
+        logger_1.logger.info(`[LarkAuthHandler] refreshToken: Successfully refreshed token`);
+        await store_1.authStore.removeToken(accessToken);
+        return newToken;
+    }
+    async reAuthorize(accessToken) {
+        if (!accessToken) {
+            logger_1.logger.error(`[LarkAuthHandler] reAuthorize: Invalid access token, please reconnect the mcp server`);
+            throw new Error('Invalid access token, please reconnect the mcp server');
+        }
+        const token = await store_1.authStore.getToken(accessToken);
+        if (!token) {
+            logger_1.logger.error(`[LarkAuthHandler] reAuthorize: Invalid access token, please reconnect the mcp server`);
+            throw new Error('Invalid access token, please reconnect the mcp server');
+        }
+        const { clientId } = token;
+        const { codeVerifier, codeChallenge } = (0, pkce_1.generatePKCEPair)();
+        store_1.authStore.storeCodeVerifier('reauthorize', codeVerifier);
+        const authorizeUrl = new URL(`http://${this.options.host}:${this.options.port}/authorize`);
+        authorizeUrl.searchParams.set('client_id', clientId);
+        authorizeUrl.searchParams.set('response_type', 'code');
+        authorizeUrl.searchParams.set('code_challenge', codeChallenge);
+        authorizeUrl.searchParams.set('code_challenge_method', 'S256');
+        authorizeUrl.searchParams.set('redirect_uri', this.callbackUrl);
+        authorizeUrl.searchParams.set('state', 'reauthorize');
+        if (this.options.scope) {
+            authorizeUrl.searchParams.set('scope', this.options.scope.join(' '));
+        }
+        return {
+            accessToken: '',
+            authorizeUrl: authorizeUrl.toString(),
+        };
+    }
+}
+exports.LarkAuthHandler = LarkAuthHandler;

package/dist/auth/handler/index.d.ts

@@ -0,0 +1,2 @@
+export * from './handler-local';
+export * from './handler';

package/dist/auth/handler/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./handler-local"), exports);
+__exportStar(require("./handler"), exports);

package/dist/auth/index.d.ts

@@ -0,0 +1,4 @@
+export * from './provider';
+export * from './store';
+export * from './handler';
+export * from './utils';

package/dist/auth/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./provider"), exports);
+__exportStar(require("./store"), exports);
+__exportStar(require("./handler"), exports);
+__exportStar(require("./utils"), exports);

package/dist/auth/provider/index.d.ts

@@ -0,0 +1,3 @@
+export * from './oauth';
+export * from './oidc';
+export * from './types';

package/dist/auth/provider/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./oauth"), exports);
+__exportStar(require("./oidc"), exports);
+__exportStar(require("./types"), exports);

package/dist/auth/provider/oauth.d.ts

@@ -0,0 +1,18 @@
+import { Response } from 'express';
+import { OAuthRegisteredClientsStore } from '@modelcontextprotocol/sdk/server/auth/clients.js';
+import { OAuthClientInformationFull, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
+import { AuthorizationParams, OAuthServerProvider } from '@modelcontextprotocol/sdk/server/auth/provider.js';
+import { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types.js';
+import { LarkProxyOAuthServerProviderOptions } from './types';
+export declare class LarkOAuth2OAuthServerProvider implements OAuthServerProvider {
+    private readonly _endpoints;
+    private readonly _options;
+    skipLocalPkceValidation: boolean;
+    constructor(options: LarkProxyOAuthServerProviderOptions);
+    get clientsStore(): OAuthRegisteredClientsStore;
+    authorize(_client: OAuthClientInformationFull, params: AuthorizationParams, res: Response): Promise<void>;
+    challengeForAuthorizationCode(_client: OAuthClientInformationFull, _authorizationCode: string): Promise<string>;
+    exchangeAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string, codeVerifier?: string, redirectUri?: string): Promise<OAuthTokens>;
+    exchangeRefreshToken(client: OAuthClientInformationFull, refreshToken: string, scopes?: string[]): Promise<OAuthTokens>;
+    verifyAccessToken(token: string): Promise<AuthInfo>;
+}

package/dist/auth/provider/oauth.js

@@ -0,0 +1,147 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LarkOAuth2OAuthServerProvider = void 0;
+const auth_js_1 = require("@modelcontextprotocol/sdk/shared/auth.js");
+const store_1 = require("../store");
+const is_token_valid_1 = require("../utils/is-token-valid");
+const http_instance_1 = require("../../utils/http-instance");
+const logger_1 = require("../../utils/logger");
+class LarkOAuth2OAuthServerProvider {
+    constructor(options) {
+        this.skipLocalPkceValidation = true;
+        const { domain } = options;
+        this._endpoints = {
+            authorizationUrl: `${domain}/open-apis/authen/v1/authorize`,
+            tokenUrl: `${domain}/open-apis/authen/v2/oauth/token`,
+            registrationUrl: `${domain}/open-apis/authen/v1/index`,
+        };
+        this._options = options;
+    }
+    get clientsStore() {
+        return store_1.authStore;
+    }
+    async authorize(_client, params, res) {
+        var _a;
+        const targetUrl = new URL(this._endpoints.authorizationUrl);
+        const searchParams = new URLSearchParams({
+            client_id: this._options.appId,
+            response_type: 'code',
+            redirect_uri: this._options.callbackUrl + '?redirect_uri=' + _client.redirect_uris[0],
+            code_challenge: params.codeChallenge,
+            code_challenge_method: 'S256',
+        });
+        if (params.state) {
+            searchParams.set('state', params.state);
+        }
+        if ((_a = params.scopes) === null || _a === void 0 ? void 0 : _a.length) {
+            searchParams.set('scope', params.scopes.join(' '));
+        }
+        targetUrl.search = searchParams.toString();
+        logger_1.logger.info(`[LarkOAuth2OAuthServerProvider] Authorizing client ${_client.client_id} Redirecting to authorization URL: ${targetUrl.toString()}`);
+        res.redirect(targetUrl.toString());
+    }
+    async challengeForAuthorizationCode(_client, _authorizationCode) {
+        return '';
+    }
+    async exchangeAuthorizationCode(client, authorizationCode, codeVerifier, redirectUri) {
+        var _a, _b, _c, _d, _e;
+        const params = {
+            grant_type: 'authorization_code',
+            client_id: this._options.appId,
+            client_secret: this._options.appSecret,
+            code: authorizationCode,
+            redirect_uri: this._options.callbackUrl + '?redirect_uri=' + redirectUri,
+            code_verifier: codeVerifier,
+        };
+        try {
+            logger_1.logger.info(`[LarkOAuth2OAuthServerProvider] Exchanging authorization code for client ${client.client_id}; appId: ${this._options.appId}`);
+            const response = await http_instance_1.commonHttpInstance.post(this._endpoints.tokenUrl, params, {
+                headers: { 'Content-Type': 'application/json; charset=utf-8' },
+            });
+            const data = response.data;
+            const parseResult = auth_js_1.OAuthTokensSchema.safeParse(data);
+            if (!parseResult.success) {
+                throw new Error(`Token parse failed: invalid response: ${data === null || data === void 0 ? void 0 : data.code}, ${data === null || data === void 0 ? void 0 : data.msg}`);
+            }
+            const token = parseResult.data;
+            const expiresAt = token.expires_in ? token.expires_in + Date.now() / 1000 : undefined;
+            await store_1.authStore.storeToken({
+                clientId: client.client_id,
+                token: token.access_token,
+                scopes: ((_a = token.scope) === null || _a === void 0 ? void 0 : _a.split(' ')) || [],
+                expiresAt,
+                extra: {
+                    token,
+                    refreshToken: token.refresh_token,
+                    appId: this._options.appId,
+                    appSecret: this._options.appSecret,
+                },
+            });
+            logger_1.logger.info(`[LarkOAuth2OAuthServerProvider] Successfully exchanged authorization code for client ${client.client_id}; appId: ${this._options.appId}; token: ${Boolean(token.access_token)}; refreshToken: ${Boolean(token.refresh_token)};expiresAt: ${expiresAt} `);
+            return token;
+        }
+        catch (error) {
+            logger_1.logger.error(`[LarkOAuth2OAuthServerProvider] Token exchange failed: ${((_b = error.response) === null || _b === void 0 ? void 0 : _b.status) || error.status} ${((_c = error.response) === null || _c === void 0 ? void 0 : _c.data) || error.message}`);
+            throw new Error(`Token exchange failed: ${((_d = error.response) === null || _d === void 0 ? void 0 : _d.status) || error.status} ${((_e = error.response) === null || _e === void 0 ? void 0 : _e.data) || error.message}`);
+        }
+    }
+    async exchangeRefreshToken(client, refreshToken, scopes) {
+        var _a, _b, _c, _d, _e, _f, _g;
+        const originalToken = await store_1.authStore.getTokenByRefreshToken(refreshToken);
+        if (!originalToken) {
+            logger_1.logger.error(`[LarkOAuth2OAuthServerProvider] refresh token is invalid, cannot get original token`);
+            throw new Error('refresh token is invalid');
+        }
+        const appId = ((_a = originalToken.extra) === null || _a === void 0 ? void 0 : _a.app_id) || this._options.appId;
+        const appSecret = ((_b = originalToken.extra) === null || _b === void 0 ? void 0 : _b.app_secret) || this._options.appSecret;
+        const params = {
+            grant_type: 'refresh_token',
+            client_id: appId,
+            client_secret: appSecret,
+            refresh_token: refreshToken,
+        };
+        if (scopes === null || scopes === void 0 ? void 0 : scopes.length) {
+            params.scope = scopes.join(' ');
+        }
+        try {
+            logger_1.logger.info(`[LarkOAuth2OAuthServerProvider] Refreshing token for client ${client.client_id}; appId: ${appId}`);
+            const response = await http_instance_1.commonHttpInstance.post(this._endpoints.tokenUrl, params, {
+                headers: { 'Content-Type': 'application/json; charset=utf-8' },
+            });
+            const data = response.data;
+            const parseResult = auth_js_1.OAuthTokensSchema.safeParse(data);
+            if (!parseResult.success) {
+                throw new Error(`Token parse failed: invalid response: ${data === null || data === void 0 ? void 0 : data.code}, ${data === null || data === void 0 ? void 0 : data.msg}`);
+            }
+            const token = parseResult.data;
+            const expiresAt = token.expires_in ? token.expires_in + Date.now() / 1000 : undefined;
+            await store_1.authStore.storeToken({
+                clientId: client.client_id,
+                token: token.access_token,
+                scopes: ((_c = token.scope) === null || _c === void 0 ? void 0 : _c.split(' ')) || [],
+                expiresAt,
+                extra: { refreshToken: token.refresh_token, token, appId, appSecret },
+            });
+            logger_1.logger.info(`[LarkOAuth2OAuthServerProvider] Successfully refreshed token for client ${client.client_id}; appId: ${appId}; token: ${Boolean(token.access_token)}; refreshToken: ${Boolean(token.refresh_token)};expiresAt: ${expiresAt}`);
+            return token;
+        }
+        catch (error) {
+            logger_1.logger.error(`[LarkOAuth2OAuthServerProvider] Token refresh failed: ${((_d = error.response) === null || _d === void 0 ? void 0 : _d.status) || error.status} ${((_e = error.response) === null || _e === void 0 ? void 0 : _e.data) || error.message}`);
+            throw new Error(`Token refresh failed: ${((_f = error.response) === null || _f === void 0 ? void 0 : _f.status) || error.status} ${((_g = error.response) === null || _g === void 0 ? void 0 : _g.data) || error.message}`);
+        }
+    }
+    async verifyAccessToken(token) {
+        const { valid, token: storedToken } = await (0, is_token_valid_1.isTokenValid)(token);
+        if (!valid) {
+            return {
+                token: (storedToken === null || storedToken === void 0 ? void 0 : storedToken.token) || '',
+                clientId: (storedToken === null || storedToken === void 0 ? void 0 : storedToken.clientId) || '',
+                scopes: (storedToken === null || storedToken === void 0 ? void 0 : storedToken.scopes) || [],
+                expiresAt: (storedToken === null || storedToken === void 0 ? void 0 : storedToken.expiresAt) || 1,
+                extra: (storedToken === null || storedToken === void 0 ? void 0 : storedToken.extra) || {},
+            };
+        }
+        return storedToken;
+    }
+}
+exports.LarkOAuth2OAuthServerProvider = LarkOAuth2OAuthServerProvider;

package/dist/auth/provider/oidc.d.ts

@@ -0,0 +1,18 @@
+import { Response } from 'express';
+import { OAuthRegisteredClientsStore } from '@modelcontextprotocol/sdk/server/auth/clients.js';
+import { OAuthClientInformationFull, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
+import { AuthorizationParams, OAuthServerProvider } from '@modelcontextprotocol/sdk/server/auth/provider.js';
+import { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types.js';
+import { LarkProxyOAuthServerProviderOptions } from './types';
+export declare class LarkOIDC2OAuthServerProvider implements OAuthServerProvider {
+    private readonly _endpoints;
+    private readonly _options;
+    skipLocalPkceValidation: boolean;
+    constructor(options: LarkProxyOAuthServerProviderOptions);
+    get clientsStore(): OAuthRegisteredClientsStore;
+    authorize(client: OAuthClientInformationFull, params: AuthorizationParams, res: Response): Promise<void>;
+    challengeForAuthorizationCode(_client: OAuthClientInformationFull, _authorizationCode: string): Promise<string>;
+    exchangeAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string, codeVerifier?: string, _redirectUri?: string): Promise<OAuthTokens>;
+    exchangeRefreshToken(client: OAuthClientInformationFull, refreshToken: string, _scopes?: string[]): Promise<OAuthTokens>;
+    verifyAccessToken(token: string): Promise<AuthInfo>;
+}

package/dist/auth/provider/oidc.js

@@ -0,0 +1,172 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LarkOIDC2OAuthServerProvider = void 0;
+const store_1 = require("../store");
+const is_token_valid_1 = require("../utils/is-token-valid");
+const pkce_1 = require("../utils/pkce");
+const zod_1 = require("zod");
+const http_instance_1 = require("../../utils/http-instance");
+const logger_1 = require("../../utils/logger");
+const LarkOIDCTokenSchema = zod_1.z.object({
+    code: zod_1.z.number(),
+    msg: zod_1.z.string().optional(),
+    data: zod_1.z.object({
+        access_token: zod_1.z.string(),
+        token_type: zod_1.z.string(),
+        refresh_token: zod_1.z.string().optional(),
+        expires_in: zod_1.z.number().optional(),
+        refresh_expires_in: zod_1.z.number().optional(),
+        scope: zod_1.z.string().optional(),
+    }),
+});
+class LarkOIDC2OAuthServerProvider {
+    constructor(options) {
+        this.skipLocalPkceValidation = true;
+        const { domain } = options;
+        this._endpoints = {
+            appAccessTokenUrl: `${domain}/open-apis/auth/v3/app_access_token/internal`,
+            authorizationUrl: `${domain}/open-apis/authen/v1/index`,
+            tokenUrl: `${domain}/open-apis/authen/v1/oidc/access_token`,
+            refreshTokenUrl: `${domain}/open-apis/authen/v1/oidc/refresh_access_token`,
+            registrationUrl: `${domain}/open-apis/authen/v1/index`,
+        };
+        this._options = options;
+    }
+    get clientsStore() {
+        return store_1.authStore;
+    }
+    async authorize(client, params, res) {
+        const targetUrl = new URL(this._endpoints.authorizationUrl);
+        const searchParams = new URLSearchParams({
+            app_id: this._options.appId,
+            redirect_uri: this._options.callbackUrl + '?redirect_uri=' + client.redirect_uris[0],
+        });
+        if (params.state) {
+            searchParams.set('state', params.state);
+        }
+        if (params.codeChallenge) {
+            store_1.authStore.storeCodeVerifier(`challenge_${client.client_id}`, params.codeChallenge);
+        }
+        targetUrl.search = searchParams.toString();
+        logger_1.logger.info(`[LarkOIDC2OAuthServerProvider] Redirecting to authorization URL: ${targetUrl.toString()}`);
+        res.redirect(targetUrl.toString());
+    }
+    async challengeForAuthorizationCode(_client, _authorizationCode) {
+        return '';
+    }
+    async exchangeAuthorizationCode(client, authorizationCode, codeVerifier, _redirectUri) {
+        var _a, _b, _c, _d, _e;
+        if (codeVerifier) {
+            const storedChallenge = store_1.authStore.getCodeVerifier(`challenge_${client.client_id}`);
+            if (!storedChallenge) {
+                logger_1.logger.error(`[LarkOIDC2OAuthServerProvider] exchangeAuthorizationCode: PKCE validation failed: code challenge not found`);
+                throw new Error('PKCE validation failed: code challenge not found');
+            }
+            const expectedChallenge = (0, pkce_1.generateCodeChallenge)(codeVerifier);
+            if (expectedChallenge !== storedChallenge) {
+                logger_1.logger.error(`[LarkOIDC2OAuthServerProvider] exchangeAuthorizationCode: PKCE validation failed: code verifier does not match challenge`);
+                throw new Error('PKCE validation failed: code verifier does not match challenge');
+            }
+            store_1.authStore.removeCodeVerifier(`challenge_${client.client_id}`);
+        }
+        const params = {
+            grant_type: 'authorization_code',
+            code: authorizationCode,
+        };
+        try {
+            logger_1.logger.info(`[LarkOIDC2OAuthServerProvider] Exchanging authorization code for client ${client.client_id}; appId: ${this._options.appId}`);
+            const appAccessTokenResponse = await http_instance_1.commonHttpInstance.post(this._endpoints.appAccessTokenUrl, { app_id: this._options.appId, app_secret: this._options.appSecret }, { headers: { 'Content-Type': 'application/json; charset=utf-8' } });
+            const { app_access_token: appAccessToken } = appAccessTokenResponse.data;
+            const response = await http_instance_1.commonHttpInstance.post(this._endpoints.tokenUrl, params, {
+                headers: { 'Content-Type': 'application/json; charset=utf-8', Authorization: `Bearer ${appAccessToken}` },
+            });
+            const data = response.data;
+            const parseResult = LarkOIDCTokenSchema.safeParse(data);
+            if (!parseResult.success) {
+                throw new Error(`Token parse failed: invalid response: ${data === null || data === void 0 ? void 0 : data.code}, ${data === null || data === void 0 ? void 0 : data.msg}`);
+            }
+            const token = parseResult.data;
+            const expiresAt = token.data.expires_in ? token.data.expires_in + Date.now() / 1000 : undefined;
+            await store_1.authStore.storeToken({
+                clientId: client.client_id,
+                token: token.data.access_token,
+                scopes: ((_a = token.data.scope) === null || _a === void 0 ? void 0 : _a.split(' ')) || [],
+                expiresAt,
+                extra: {
+                    refreshToken: token.data.refresh_token,
+                    token,
+                    appId: this._options.appId,
+                    appSecret: this._options.appSecret,
+                },
+            });
+            logger_1.logger.info(`[LarkOIDC2OAuthServerProvider] Successfully exchanged authorization code for client ${client.client_id}; appId: ${this._options.appId}; token: ${Boolean(token.data.access_token)}; refreshToken: ${Boolean(token.data.refresh_token)};expiresAt: ${expiresAt}`);
+            return {
+                access_token: token.data.access_token,
+                token_type: token.data.token_type,
+                expires_in: token.data.expires_in,
+                scope: token.data.scope,
+                refresh_token: token.data.refresh_token,
+            };
+        }
+        catch (error) {
+            logger_1.logger.error(`[LarkOIDC2OAuthServerProvider] exchangeAuthorizationCode: Token exchange failed: ${((_b = error.response) === null || _b === void 0 ? void 0 : _b.status) || error.status} ${((_c = error.response) === null || _c === void 0 ? void 0 : _c.data) || error.message}`);
+            throw new Error(`Token exchange failed: ${((_d = error.response) === null || _d === void 0 ? void 0 : _d.status) || error.status} ${((_e = error.response) === null || _e === void 0 ? void 0 : _e.data) || error.message}`);
+        }
+    }
+    async exchangeRefreshToken(client, refreshToken, _scopes) {
+        var _a, _b, _c, _d, _e, _f, _g;
+        const originalToken = await store_1.authStore.getTokenByRefreshToken(refreshToken);
+        if (!originalToken) {
+            logger_1.logger.error(`[LarkOIDC2OAuthServerProvider] exchangeRefreshToken: Refresh token is invalid`);
+            throw new Error('refresh token is invalid');
+        }
+        const appId = ((_a = originalToken.extra) === null || _a === void 0 ? void 0 : _a.app_id) || this._options.appId;
+        const appSecret = ((_b = originalToken.extra) === null || _b === void 0 ? void 0 : _b.app_secret) || this._options.appSecret;
+        try {
+            logger_1.logger.info(`[LarkOIDC2OAuthServerProvider] Refreshing token for client ${client.client_id}`);
+            const appAccessTokenResponse = await http_instance_1.commonHttpInstance.post(this._endpoints.appAccessTokenUrl, { app_id: appId, app_secret: appSecret }, { headers: { 'Content-Type': 'application/json; charset=utf-8' } });
+            const { app_access_token: appAccessToken } = appAccessTokenResponse.data;
+            const response = await http_instance_1.commonHttpInstance.post(this._endpoints.refreshTokenUrl, { grant_type: 'refresh_token', refresh_token: refreshToken }, { headers: { 'Content-Type': 'application/json; charset=utf-8', Authorization: `Bearer ${appAccessToken}` } });
+            const data = response.data;
+            const parseResult = LarkOIDCTokenSchema.safeParse(data);
+            if (!parseResult.success) {
+                throw new Error(`Token parse failed: invalid response: ${data === null || data === void 0 ? void 0 : data.code}, ${data === null || data === void 0 ? void 0 : data.msg}`);
+            }
+            const token = parseResult.data;
+            const expiresAt = token.data.expires_in ? token.data.expires_in + Date.now() / 1000 : undefined;
+            await store_1.authStore.storeToken({
+                clientId: client.client_id,
+                token: token.data.access_token,
+                scopes: ((_c = token.data.scope) === null || _c === void 0 ? void 0 : _c.split(' ')) || [],
+                expiresAt,
+                extra: { refreshToken: token.data.refresh_token, token, appId, appSecret },
+            });
+            logger_1.logger.info(`[LarkOIDC2OAuthServerProvider] Successfully refreshed token for client ${client.client_id}; appId: ${appId}; token: ${Boolean(token.data.access_token)}; refreshToken: ${Boolean(token.data.refresh_token)};expiresAt: ${expiresAt}`);
+            return {
+                access_token: token.data.access_token,
+                token_type: token.data.token_type,
+                expires_in: token.data.expires_in,
+                scope: token.data.scope,
+                refresh_token: token.data.refresh_token,
+            };
+        }
+        catch (error) {
+            logger_1.logger.error(`[LarkOIDC2OAuthServerProvider] exchangeRefreshToken: Token refresh failed: ${((_d = error.response) === null || _d === void 0 ? void 0 : _d.status) || error.status} ${((_e = error.response) === null || _e === void 0 ? void 0 : _e.data) || error.message}`);
+            throw new Error(`Token refresh failed: ${((_f = error.response) === null || _f === void 0 ? void 0 : _f.status) || error.status} ${((_g = error.response) === null || _g === void 0 ? void 0 : _g.data) || error.message}`);
+        }
+    }
+    async verifyAccessToken(token) {
+        const { valid, token: storedToken } = await (0, is_token_valid_1.isTokenValid)(token);
+        if (!valid) {
+            return {
+                token: (storedToken === null || storedToken === void 0 ? void 0 : storedToken.token) || '',
+                clientId: (storedToken === null || storedToken === void 0 ? void 0 : storedToken.clientId) || '',
+                scopes: (storedToken === null || storedToken === void 0 ? void 0 : storedToken.scopes) || [],
+                expiresAt: (storedToken === null || storedToken === void 0 ? void 0 : storedToken.expiresAt) || 1,
+                extra: (storedToken === null || storedToken === void 0 ? void 0 : storedToken.extra) || {},
+            };
+        }
+        return storedToken;
+    }
+}
+exports.LarkOIDC2OAuthServerProvider = LarkOIDC2OAuthServerProvider;

package/dist/auth/provider/types.d.ts

@@ -0,0 +1,8 @@
+export interface LarkProxyOAuthServerProviderOptions {
+    domain: string;
+    host: string;
+    port: number;
+    appId: string;
+    appSecret: string;
+    callbackUrl: string;
+}

package/dist/auth/provider/types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/auth/store.d.ts

@@ -0,0 +1,39 @@
+import { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types.js';
+import { OAuthClientInformationFull } from '@modelcontextprotocol/sdk/shared/auth.js';
+import { OAuthRegisteredClientsStore } from '@modelcontextprotocol/sdk/server/auth/clients.js';
+export declare class AuthStore implements OAuthRegisteredClientsStore {
+    private storageDataCache;
+    private codeVerifiers;
+    private initializePromise;
+    private fileWatcher;
+    private isReloading;
+    private isInitializedStorageSuccess;
+    constructor();
+    private initialize;
+    private performInitialization;
+    private setupFileWatcher;
+    private handleFileChange;
+    private loadFromStorage;
+    private saveToStorage;
+    private clearExpiredTokens;
+    storeToken(token: AuthInfo): Promise<AuthInfo>;
+    removeToken(accessToken: string): Promise<void>;
+    getToken(accessToken: string): Promise<AuthInfo | undefined>;
+    getTokenByRefreshToken(refreshToken: string): Promise<AuthInfo | undefined>;
+    getLocalAccessToken(appId: string): Promise<string | undefined>;
+    storeLocalAccessToken(accessToken: string, appId: string): Promise<string>;
+    removeLocalAccessToken(appId: string): Promise<void>;
+    removeAllLocalAccessTokens(): Promise<void>;
+    getAllLocalAccessTokens(): Promise<{
+        [appId: string]: string;
+    }>;
+    registerClient(client: OAuthClientInformationFull): Promise<OAuthClientInformationFull>;
+    getClient(id: string): Promise<OAuthClientInformationFull | undefined>;
+    removeClient(clientId: string): Promise<void>;
+    storeCodeVerifier(key: string, codeVerifier: string): void;
+    getCodeVerifier(key: string): string | undefined;
+    removeCodeVerifier(key: string): void;
+    clearExpiredCodeVerifiers(): void;
+    destroy(): void;
+}
+export declare const authStore: AuthStore;