@deadragdoll/tellymcp 0.0.13 → 0.0.14

package/dist/services/features/telegram-mcp/src/app/http.js

@@ -3,15 +3,19 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveMcpHttpAuthorization = resolveMcpHttpAuthorization;
+exports.isMcpHttpRequestAuthorized = isMcpHttpRequestAuthorized;
 exports.createMcpHttpHandler = createMcpHttpHandler;
 const node_crypto_1 = require("node:crypto");
 const streamableHttp_js_1 = require("@modelcontextprotocol/sdk/server/streamableHttp.js");
 const ws_1 = __importDefault(require("ws"));
+const oauthFacade_1 = require("./oauthFacade");
 const auth_1 = require("./webapp/auth");
 const relay_1 = require("./webapp/relay");
 const assets_1 = require("./webapp/assets");
 const client_1 = require("../shared/integrations/terminal/client");
 const terminal_1 = require("./webapp/terminal");
+const bodyLimits_1 = require("../shared/lib/bodyLimits");
 function formatTerminalHttpError(error, fallback) {
     if ((0, terminal_1.isTerminalUnavailableError)(error)) {
         return "terminal runtime is unavailable";
@@ -32,6 +36,13 @@ function isInitializeRequest(body) {
     const method = Reflect.get(body, "method");
     return method === "initialize";
 }
+function readMcpRpcMethod(body) {
+    if (!body || typeof body !== "object") {
+        return undefined;
+    }
+    const method = Reflect.get(body, "method");
+    return typeof method === "string" ? method : undefined;
+}
 function readHeader(req, headerName) {
     const value = req.headers[headerName];
     if (Array.isArray(value)) {
@@ -44,24 +55,21 @@ async function readJsonBody(req) {
     if (knownParams &&
         typeof knownParams === "object" &&
         Object.keys(knownParams).length > 0) {
+        (0, bodyLimits_1.assertSerializedBodySize)(knownParams);
         return knownParams;
     }
     const knownBody = req.body;
     if (knownBody !== undefined) {
+        (0, bodyLimits_1.assertSerializedBodySize)(knownBody);
         return knownBody;
     }
-    const chunks = [];
-    for await (const chunk of req) {
-        chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
-    }
-    if (chunks.length === 0) {
-        return undefined;
-    }
-    const raw = Buffer.concat(chunks).toString("utf8").trim();
-    if (!raw) {
-        return undefined;
+    return (0, bodyLimits_1.readLimitedJsonBody)(req);
+}
+function ignoreInvalidJsonBody(error) {
+    if ((0, bodyLimits_1.isBodySizeLimitError)(error)) {
+        throw error;
     }
-    return JSON.parse(raw);
+    return undefined;
 }
 function writeJson(res, statusCode, payload) {
     const body = JSON.stringify(payload);
@@ -103,6 +111,19 @@ function readBearerToken(req) {
     }
     return header.slice("Bearer ".length).trim() || null;
 }
+function resolveMcpHttpAuthorization(req, internalBearerToken, oauthFacade) {
+    if (!internalBearerToken && !oauthFacade) {
+        return "public";
+    }
+    if (internalBearerToken && isAuthorized(req, internalBearerToken)) {
+        return "internal_bearer";
+    }
+    const token = readBearerToken(req);
+    return token && oauthFacade?.verifyAccessToken(token) ? "oauth" : null;
+}
+function isMcpHttpRequestAuthorized(req, internalBearerToken, oauthFacade) {
+    return resolveMcpHttpAuthorization(req, internalBearerToken, oauthFacade) !== null;
+}
 function isDuplicateSseStreamError(error) {
     const message = error instanceof Error ? (error.stack ?? error.message) : String(error);
     return message.includes("Only one SSE stream is allowed per session");
@@ -143,7 +164,10 @@ function isRelayTerminalUnavailableMessage(error) {
 function createMcpHttpHandler(runtime, input) {
     const transports = new Map();
     const webAppSessions = new auth_1.WebAppSessionRegistry();
-    const liveWsServer = new WebSocketServer({ noServer: true });
+    const liveWsServer = new WebSocketServer({
+        noServer: true,
+        maxPayload: bodyLimits_1.MAX_BODY_SIZE_BYTES,
+    });
     const webAppBasePath = runtime.config.webapp.basePath.replace(/\/+$/u, "") || "/webapp";
     const rootPrefix = normalizeBasePath(process.env.ROOT_PREFIX || "/api");
     const publicWebAppBasePath = rootPrefix === "/"
@@ -153,6 +177,13 @@ function createMcpHttpHandler(runtime, input) {
     const webAppLivePrefix = `${webAppBasePath}/live/`;
     const telegramWebhookPath = runtime.config.telegram.webhook.path.replace(/\/+$/u, "") ||
         "/telegram/webhook";
+    const mcpHttpPath = runtime.config.mcp.httpPath.replace(/\/+$/u, "") || "/mcp";
+    const oauthFacade = runtime.config.oauth
+        ? (0, oauthFacade_1.createOAuthFacade)(runtime.config.oauth, mcpHttpPath, runtime.logger)
+        : null;
+    if (oauthFacade?.ephemeralSigningKey) {
+        runtime.logger.warn("OAuth connector is using an ephemeral signing key; access tokens will stop working after restart");
+    }
     const closeSessionEntry = async (entry) => {
         await entry.close();
     };
@@ -220,6 +251,11 @@ function createMcpHttpHandler(runtime, input) {
             socket.on("close", () => {
                 void cleanup();
             });
+            socket.on("error", (error) => {
+                runtime.logger.warn("Telegram WebApp live WS socket error", {
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            });
             socket.on("message", (raw) => {
                 void (async () => {
                     const parsed = raw && typeof raw === "string"
@@ -288,6 +324,15 @@ function createMcpHttpHandler(runtime, input) {
                         }
                         if (resolved.session?.terminalTarget && (0, client_1.isStreamableTerminalTarget)(resolved.session.terminalTarget)) {
                             (0, client_1.resizeForegroundTerminal)(resolved.session.terminalTarget, Math.max(20, Math.min(400, Math.round(cols))), Math.max(5, Math.min(200, Math.round(rows))));
+                            return;
+                        }
+                        if (resolved.relayTarget) {
+                            await input.getGatewaySocketService?.()?.requestLiveRelay?.({
+                                clientUuid: resolved.relayTarget.clientUuid,
+                                localSessionId: resolved.relayTarget.localSessionId,
+                                requestType: "resize",
+                                payload: { cols, rows },
+                            });
                         }
                     }
                 })().catch((error) => {
@@ -356,11 +401,39 @@ function createMcpHttpHandler(runtime, input) {
             socket.close(1011, "Live stream bootstrap failed");
         });
     });
-    const handleRequest = async (req, res, pathname) => {
+    const handleRequestInternal = async (req, res, pathname) => {
         const method = req.method ?? "GET";
         const normalizedPathname = normalizePrefixedPathname(pathname);
         const requestUrl = new URL(req.url ?? normalizedPathname, `http://gateway.local`);
         requestUrl.pathname = normalizedPathname;
+        if (runtime.temporaryFileLinkStore &&
+            (await runtime.temporaryFileLinkStore.handleRequest(req, res, requestUrl.pathname))) {
+            return;
+        }
+        if (oauthFacade) {
+            const authorizationHeader = readHeader(req, "authorization");
+            const connectorRequestContext = {
+                method,
+                rawPath: pathname,
+                path: requestUrl.pathname,
+                queryParameters: [...requestUrl.searchParams.keys()],
+                userAgent: readHeader(req, "user-agent"),
+                accept: readHeader(req, "accept"),
+                contentType: readHeader(req, "content-type"),
+                authorizationHeaderPresent: Boolean(authorizationHeader),
+                authorizationScheme: authorizationHeader?.split(/\s+/u, 1)[0],
+                mcpSessionId: readHeader(req, "mcp-session-id"),
+                remoteAddress: req.socket.remoteAddress,
+            };
+            runtime.logger.info("OAuth connector HTTP request received", connectorRequestContext);
+            res.once("finish", () => {
+                runtime.logger.info("OAuth connector HTTP response completed", {
+                    ...connectorRequestContext,
+                    statusCode: res.statusCode,
+                    responseContentType: String(res.getHeader("content-type") ?? ""),
+                });
+            });
+        }
         if (requestUrl.pathname === "/healthz") {
             writeJson(res, 200, {
                 ok: true,
@@ -369,6 +442,10 @@ function createMcpHttpHandler(runtime, input) {
             });
             return;
         }
+        if (oauthFacade &&
+            (await oauthFacade.handleRequest(req, res, requestUrl.pathname))) {
+            return;
+        }
         if (runtime.config.telegram.webhook.enabled &&
             requestUrl.pathname === telegramWebhookPath) {
             if (method !== "POST") {
@@ -457,7 +534,7 @@ function createMcpHttpHandler(runtime, input) {
                     method,
                     path: requestUrl.pathname,
                 });
-                const body = await readJsonBody(req).catch(() => undefined);
+                const body = await readJsonBody(req).catch(ignoreInvalidJsonBody);
                 let sessionId = body &&
                     typeof body === "object" &&
                     typeof Reflect.get(body, "sessionId") === "string"
@@ -529,7 +606,6 @@ function createMcpHttpHandler(runtime, input) {
                             session_id: relayBootstrap.session_id,
                             session_label: relayBootstrap.session_label,
                             terminal_target: relayBootstrap.terminal_target,
-                            poll_interval_ms: relayBootstrap.poll_interval_ms,
                             expires_at: new Date(record.expiresAtMs).toISOString(),
                         });
                         if (trustedTelegramUserId !== null) {
@@ -569,17 +645,6 @@ function createMcpHttpHandler(runtime, input) {
                 }
                 try {
                     const validated = (0, auth_1.validateTelegramWebAppInitData)(initDataRaw, initDataUnsafe, requireTelegramBotToken(runtime, "validate Telegram WebApp bootstrap"), runtime.config.webapp.initDataTtlSeconds);
-                    runtime.logger.info("Telegram WebApp initData validation debug", {
-                        sessionId: sessionId || null,
-                        telegramUserId: validated.user.id,
-                        providedHash: validated.validationDebug.providedHash,
-                        officialRawMatches: validated.validationDebug.officialRaw.matches,
-                        officialRawCheckString: validated.validationDebug.officialRaw.checkString,
-                        officialRawComputedHash: validated.validationDebug.officialRaw.computedHash,
-                        userFieldsMatches: validated.validationDebug.userFields?.matches ?? null,
-                        userFieldsCheckString: validated.validationDebug.userFields?.checkString ?? null,
-                        userFieldsComputedHash: validated.validationDebug.userFields?.computedHash ?? null,
-                    });
                     if (!sessionId) {
                         sessionId =
                             (await runtime.bindingStore.getActiveSessionIdForTelegramUser(validated.user.id)) ?? "";
@@ -615,7 +680,6 @@ function createMcpHttpHandler(runtime, input) {
                         session_id: sessionId,
                         session_label: session?.label ?? null,
                         terminal_target: Boolean(session?.terminalTarget),
-                        poll_interval_ms: runtime.config.webapp.pollIntervalMs,
                         expires_at: new Date(record.expiresAtMs).toISOString(),
                     });
                     if (launchRecord?.telegramChatId !== undefined &&
@@ -640,7 +704,6 @@ function createMcpHttpHandler(runtime, input) {
                     runtime.logger.warn("Telegram WebApp bootstrap rejected", {
                         sessionId,
                         initDataLength: initDataRaw.length,
-                        initDataPreview: initDataRaw.slice(0, 160),
                         hasUnsafeUser: Boolean(initDataUnsafe?.user) &&
                             typeof initDataUnsafe?.user?.id === "number",
                         error: error instanceof Error
@@ -651,74 +714,6 @@ function createMcpHttpHandler(runtime, input) {
                 }
                 return;
             }
-            if (requestUrl.pathname === `${webAppBasePath}/api/view`) {
-                if (method !== "GET") {
-                    writeText(res, 405, "Method not allowed");
-                    return;
-                }
-                const token = readBearerToken(req);
-                const webAppSession = token ? webAppSessions.get(token) : null;
-                if (!webAppSession) {
-                    writeText(res, 401, "Unauthorized");
-                    return;
-                }
-                const relayTarget = (0, relay_1.parseLiveRelaySessionId)(webAppSession.sessionId);
-                if (relayTarget) {
-                    try {
-                        const result = await runtime.gatewayHttpService.requestLiveRelayView({
-                            clientUuid: relayTarget.clientUuid,
-                            localSessionId: relayTarget.localSessionId,
-                        });
-                        writeJson(res, 200, result);
-                    }
-                    catch (error) {
-                        runtime.logger.error("Telegram WebApp relay visible buffer capture failed", {
-                            sessionId: webAppSession.sessionId,
-                            clientUuid: relayTarget.clientUuid,
-                            localSessionId: relayTarget.localSessionId,
-                            error: error instanceof Error
-                                ? (error.stack ?? error.message)
-                                : String(error),
-                        });
-                        writeText(res, isRelayTerminalUnavailableMessage(error) ? 503 : 500, error instanceof Error ? error.message : "Failed to capture relay terminal buffer");
-                    }
-                    return;
-                }
-                const binding = await runtime.bindingStore.getBinding(webAppSession.sessionId);
-                if (!binding ||
-                    binding.telegramUserId !== webAppSession.telegramUserId) {
-                    writeText(res, 403, "Session binding is no longer valid");
-                    return;
-                }
-                const session = await runtime.sessionStore.getSession(webAppSession.sessionId);
-                if (!session?.terminalTarget) {
-                    writeText(res, 409, "terminal target is not configured for this session");
-                    return;
-                }
-                try {
-                    const terminalSize = await (0, terminal_1.getTerminalWindowSize)(runtime.config.terminal, session.terminalTarget);
-                    const content = await (0, terminal_1.captureVisibleTerminal)(runtime.config.terminal, session.terminalTarget, runtime.config.terminal.captureLines, runtime.config.webapp.visibleScreens);
-                    const ansi = await (0, terminal_1.captureVisibleTerminalAnsi)(runtime.config.terminal, session.terminalTarget, runtime.config.terminal.captureLines, runtime.config.webapp.visibleScreens);
-                    writeJson(res, 200, {
-                        session_id: session.sessionId,
-                        session_label: session.label ?? null,
-                        captured_at: new Date().toISOString(),
-                        content,
-                        ansi,
-                        ...(terminalSize ? terminalSize : {}),
-                    });
-                }
-                catch (error) {
-                    runtime.logger.error("Telegram WebApp visible buffer capture failed", {
-                        sessionId: webAppSession.sessionId,
-                        error: error instanceof Error
-                            ? (error.stack ?? error.message)
-                            : String(error),
-                    });
-                    writeText(res, (0, terminal_1.isTerminalUnavailableError)(error) ? 503 : 500, formatTerminalHttpError(error, "Failed to capture visible terminal buffer"));
-                }
-                return;
-            }
             if (requestUrl.pathname === `${webAppBasePath}/api/action`) {
                 if (method !== "POST") {
                     writeText(res, 405, "Method not allowed");
@@ -730,7 +725,7 @@ function createMcpHttpHandler(runtime, input) {
                     writeText(res, 401, "Unauthorized");
                     return;
                 }
-                const body = await readJsonBody(req).catch(() => undefined);
+                const body = await readJsonBody(req).catch(ignoreInvalidJsonBody);
                 const action = body &&
                     typeof body === "object" &&
                     typeof Reflect.get(body, "action") === "string"
@@ -921,16 +916,22 @@ function createMcpHttpHandler(runtime, input) {
             });
             return;
         }
-        if (requestUrl.pathname !== runtime.config.mcp.httpPath) {
+        if (requestUrl.pathname !== mcpHttpPath &&
+            requestUrl.pathname !== `${mcpHttpPath}/`) {
             writeText(res, 404, "Not found");
             return;
         }
-        if (!isAuthorized(req, runtime.config.mcp.bearerToken)) {
+        const authorizationMode = resolveMcpHttpAuthorization(req, runtime.config.mcp.bearerToken, oauthFacade);
+        if (!authorizationMode) {
+            const authorizationHeader = readHeader(req, "authorization");
             runtime.logger.warn("Unauthorized MCP HTTP request rejected", {
                 method,
                 path: requestUrl.pathname,
                 remoteAddress: req.socket.remoteAddress,
+                authorizationHeaderPresent: Boolean(authorizationHeader),
+                authorizationScheme: authorizationHeader?.split(/\s+/u, 1)[0],
             });
+            oauthFacade?.writeMcpChallenge(res);
             writeText(res, 401, "Unauthorized");
             return;
         }
@@ -938,12 +939,33 @@ function createMcpHttpHandler(runtime, input) {
         const parsedBody = method === "POST" || method === "DELETE"
             ? await readJsonBody(req)
             : undefined;
+        const rpcMethod = readMcpRpcMethod(parsedBody);
         runtime.logger.debug("MCP HTTP request received", {
             method,
             path: requestUrl.pathname,
             sessionId,
+            authorizationMode,
+            rpcMethod,
             hasBody: parsedBody !== undefined,
         });
+        if (rpcMethod === "initialize" || rpcMethod === "tools/list") {
+            runtime.logger.info("Chat connector MCP handshake request received", {
+                rpcMethod,
+                authorizationMode,
+                sessionId,
+                userAgent: readHeader(req, "user-agent"),
+            });
+            res.once("finish", () => {
+                runtime.logger.info("Chat connector MCP handshake response completed", {
+                    rpcMethod,
+                    authorizationMode,
+                    statusCode: res.statusCode,
+                    sessionId: readHeader(req, "mcp-session-id") ??
+                        (String(res.getHeader("mcp-session-id") ?? "") || undefined),
+                    contentType: String(res.getHeader("content-type") ?? ""),
+                });
+            });
+        }
         try {
             if (method === "POST") {
                 if (sessionId) {
@@ -1090,6 +1112,24 @@ function createMcpHttpHandler(runtime, input) {
             }
         }
     };
+    const handleRequest = async (req, res, pathname) => {
+        try {
+            await handleRequestInternal(req, res, pathname);
+        }
+        catch (error) {
+            if (!(0, bodyLimits_1.isBodySizeLimitError)(error)) {
+                throw error;
+            }
+            if (!res.headersSent) {
+                writeJson(res, 413, {
+                    error: `Request body exceeds the ${bodyLimits_1.MAX_BODY_SIZE} MiB limit`,
+                });
+            }
+            else if (!res.writableEnded) {
+                res.end();
+            }
+        }
+    };
     let shuttingDown = false;
     const handleUpgrade = async (req, socket, head, pathname) => {
         const normalizedPathname = normalizePrefixedPathname(pathname);