@duckmind/dm-windows-x64 0.63.6 → 0.63.9

package/extensions/dm-mcp-adapter/mcp-oauth-provider.js

@@ -0,0 +1,490 @@
+import {
+  UnauthorizedError
+} from "@modelcontextprotocol/client";
+import {
+  getAuthForUrl,
+  updateTokens,
+  updateClientInfo,
+  clearAllCredentials,
+  clearCodeVerifier,
+  invalidateAuthEntryCache
+} from "./mcp-auth.js";
+import { OAuthMetadataSchema, OpenIdProviderDiscoveryMetadataSchema } from "@modelcontextprotocol/core";
+import { resolveCommandSecret } from "./utils.js";
+import { getAppClientUri, getAppName } from "./agent-dir.js";
+function defaultClientName() {
+  const app = getAppName();
+  return app === "pi" ? "DM Coding Agent" : app;
+}
+function defaultClientUri() {
+  const declared = getAppClientUri();
+  if (declared)
+    return declared;
+  return getAppName() === "pi" ? "https://github.com/nicobailon/dm-mcp-adapter" : undefined;
+}
+function issuersMatch(first, second) {
+  return first === second || first.endsWith("/") && first.slice(0, -1) === second || second.endsWith("/") && second.slice(0, -1) === first;
+}
+function toOAuthTokens(tokens) {
+  const result = {
+    access_token: tokens.accessToken,
+    token_type: "Bearer"
+  };
+  if (tokens.refreshToken !== undefined)
+    result.refresh_token = tokens.refreshToken;
+  if (tokens.expiresAt !== undefined)
+    result.expires_in = Math.max(0, Math.floor(tokens.expiresAt - Date.now() / 1000));
+  if (tokens.scope !== undefined)
+    result.scope = tokens.scope;
+  if (tokens.issuer !== undefined)
+    result.issuer = tokens.issuer;
+  return result;
+}
+const DEFAULT_OAUTH_CALLBACK_PORT = 19876;
+const DEFAULT_OAUTH_CALLBACK_PATH = "/callback";
+let configuredOAuthCallbackPort = DEFAULT_OAUTH_CALLBACK_PORT;
+if (process.env.MCP_OAUTH_CALLBACK_PORT) {
+  const parsedPort = Number.parseInt(process.env.MCP_OAUTH_CALLBACK_PORT, 10);
+  if (Number.isInteger(parsedPort) && parsedPort > 0 && parsedPort <= 65535) {
+    configuredOAuthCallbackPort = parsedPort;
+  }
+}
+let oauthCallbackPort = configuredOAuthCallbackPort;
+let oauthCallbackPath = DEFAULT_OAUTH_CALLBACK_PATH;
+export function getConfiguredOAuthCallbackPort() {
+  return configuredOAuthCallbackPort;
+}
+export function getOAuthCallbackPort() {
+  return oauthCallbackPort;
+}
+export function setOAuthCallbackPort(port) {
+  oauthCallbackPort = port;
+}
+export function getOAuthCallbackPath() {
+  return oauthCallbackPath;
+}
+export function setOAuthCallbackPath(path) {
+  oauthCallbackPath = path.startsWith("/") ? path : `/${path}`;
+}
+const reservedAuthorizationParams = new Set([
+  "client_id",
+  "code_challenge",
+  "code_challenge_method",
+  "redirect_uri",
+  "resource",
+  "response_type",
+  "scope",
+  "state"
+]);
+function addAuthorizationParams(authorizationUrl, params) {
+  if (!params)
+    return authorizationUrl;
+  const nextUrl = new URL(authorizationUrl.toString());
+  for (const [key, value] of Object.entries(params)) {
+    if (reservedAuthorizationParams.has(key) || nextUrl.searchParams.has(key)) {
+      throw new Error(`OAuth authorizationParams.${key} cannot override an authorization flow parameter`);
+    }
+    nextUrl.searchParams.set(key, value);
+  }
+  return nextUrl;
+}
+function inferIssuerFromMetadataUrl(metadataUrl) {
+  const url = new URL(metadataUrl);
+  const pathname = url.pathname.replace(/\/+$/, "") || "/";
+  const oauthPrefix = "/.well-known/oauth-authorization-server";
+  if (pathname === oauthPrefix || pathname.startsWith(`${oauthPrefix}/`)) {
+    const issuerPath = pathname.slice(oauthPrefix.length) || "/";
+    return new URL(issuerPath, url.origin).toString();
+  }
+  const oidcPath = "/.well-known/openid-configuration";
+  if (pathname === oidcPath || pathname.startsWith(`${oidcPath}/`)) {
+    const issuerPath = pathname.slice(oidcPath.length) || "/";
+    return new URL(issuerPath, url.origin).toString();
+  }
+  if (pathname.endsWith(oidcPath)) {
+    const issuerPath = pathname.slice(0, -oidcPath.length) || "/";
+    return new URL(issuerPath, url.origin).toString();
+  }
+  return;
+}
+function validateConfiguredIssuer(metadataUrl, issuer, skipIssuerValidation) {
+  let parsedIssuer;
+  try {
+    parsedIssuer = new URL(issuer);
+  } catch (error) {
+    throw new Error("OAuth authorization-server metadata issuer must be an absolute URL", { cause: error });
+  }
+  if (parsedIssuer.protocol !== "http:" && parsedIssuer.protocol !== "https:") {
+    throw new Error("OAuth authorization-server metadata issuer must use http:// or https://");
+  }
+  const expectedIssuer = inferIssuerFromMetadataUrl(metadataUrl);
+  if (skipIssuerValidation)
+    return;
+  if (expectedIssuer !== undefined && !issuersMatch(expectedIssuer, issuer)) {
+    throw new Error(`OAuth authorization-server metadata issuer does not match authServerMetadataUrl: expected ${expectedIssuer}`);
+  }
+  if (expectedIssuer === undefined && !issuersMatch(new URL(metadataUrl).origin, issuer)) {
+    throw new Error(`OAuth authorization-server metadata issuer does not match authServerMetadataUrl origin: expected ${new URL(metadataUrl).origin}`);
+  }
+}
+async function loadConfiguredDiscoveryState(metadataUrl, serverUrl, skipIssuerValidation, signal) {
+  const response = await fetch(metadataUrl, {
+    headers: { accept: "application/json" },
+    ...signal !== undefined ? { signal } : {}
+  });
+  if (!response.ok) {
+    await response.text().catch(() => {});
+    throw new Error(`OAuth authServerMetadataUrl request failed with HTTP ${response.status}`);
+  }
+  const payload = await response.json();
+  const oauthResult = OAuthMetadataSchema.safeParse(payload);
+  const metadata = oauthResult.success ? oauthResult.data : OpenIdProviderDiscoveryMetadataSchema.parse(payload);
+  validateConfiguredIssuer(metadataUrl, metadata.issuer, skipIssuerValidation);
+  const resource = new URL(serverUrl);
+  resource.hash = "";
+  return {
+    authorizationServerUrl: metadata.issuer,
+    authorizationServerMetadata: metadata,
+    resourceMetadata: { resource: resource.toString() }
+  };
+}
+
+export class McpOAuthProvider {
+  serverName;
+  serverUrl;
+  config;
+  callbacks;
+  storageOptions;
+  runtimeSignal;
+  redirectUrlSnapshot;
+  active = true;
+  flowClientInfo;
+  flowCodeVerifier;
+  flowDiscoveryState;
+  flowIssuerMismatch = false;
+  flowState;
+  invalidatedAccessToken;
+  invalidatedClientId;
+  lastObservedClientId;
+  lastSavedAccessToken;
+  pendingAuthAccessToken;
+  constructor(serverName, serverUrl, config, callbacks, storageOptions = {}, runtimeSignal, initialState) {
+    this.serverName = serverName;
+    this.serverUrl = serverUrl;
+    this.config = config;
+    this.callbacks = callbacks;
+    this.storageOptions = storageOptions;
+    this.runtimeSignal = runtimeSignal;
+    this.flowState = initialState;
+    this.redirectUrlSnapshot = config.grantType === "client_credentials" ? undefined : config.redirectUri ?? `http://localhost:${getOAuthCallbackPort()}${getOAuthCallbackPath()}`;
+  }
+  get usesClientCredentials() {
+    return this.config.grantType === "client_credentials";
+  }
+  get discoveredIssuer() {
+    return this.flowDiscoveryState?.authorizationServerMetadata?.issuer ?? this.flowDiscoveryState?.authorizationServerUrl;
+  }
+  deactivate() {
+    this.active = false;
+    this.invalidatedAccessToken = undefined;
+    this.invalidatedClientId = undefined;
+    this.lastObservedClientId = undefined;
+    this.lastSavedAccessToken = undefined;
+    this.pendingAuthAccessToken = undefined;
+  }
+  assertStoredIssuerBindings(entry, issuer) {
+    if (this.flowIssuerMismatch) {
+      throw new Error(`OAuth authorization server issuer changed for ${this.serverName}; clear credentials before authenticating again`);
+    }
+    if (!entry || !issuer)
+      return;
+    const storedIssuers = [entry.clientInfo?.issuer, entry.tokens?.issuer].filter((storedIssuer) => storedIssuer !== undefined);
+    if (storedIssuers.some((storedIssuer) => !issuersMatch(storedIssuer, issuer))) {
+      this.flowIssuerMismatch = true;
+      throw new Error(`OAuth authorization server issuer changed for ${this.serverName}; clear credentials before authenticating again`);
+    }
+  }
+  throwIfInactive() {
+    if (!this.active)
+      throw new Error("OAuth flow is no longer active");
+    this.runtimeSignal?.throwIfAborted();
+  }
+  get redirectUrl() {
+    return this.redirectUrlSnapshot;
+  }
+  get clientUri() {
+    return this.config.clientUri ?? defaultClientUri();
+  }
+  get clientMetadata() {
+    if (this.usesClientCredentials) {
+      return {
+        client_name: this.config.clientName ?? defaultClientName(),
+        ...this.clientUri !== undefined ? { client_uri: this.clientUri } : {},
+        ...this.config.logoUri !== undefined ? { logo_uri: this.config.logoUri } : {},
+        redirect_uris: [],
+        grant_types: ["client_credentials"],
+        token_endpoint_auth_method: this.config.clientSecret ? "client_secret_post" : "none"
+      };
+    }
+    const redirectUrl = this.redirectUrl;
+    if (!redirectUrl) {
+      throw new Error("redirectUrl is required for authorization_code flow");
+    }
+    return {
+      redirect_uris: [redirectUrl],
+      client_name: this.config.clientName ?? defaultClientName(),
+      ...this.clientUri !== undefined ? { client_uri: this.clientUri } : {},
+      ...this.config.logoUri !== undefined ? { logo_uri: this.config.logoUri } : {},
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      token_endpoint_auth_method: this.config.clientSecret ? "client_secret_post" : "none",
+      ...this.config.scope !== undefined ? { scope: this.config.scope } : {}
+    };
+  }
+  async clientInformation() {
+    if (this.invalidatedClientId !== undefined) {
+      invalidateAuthEntryCache(this.serverName);
+    }
+    const issuer = this.discoveredIssuer;
+    const stored = await getAuthForUrl(this.serverName, this.serverUrl, this.storageOptions);
+    this.assertStoredIssuerBindings(stored, issuer);
+    if (this.config.clientId) {
+      const storedClient = stored?.clientInfo?.clientId === this.config.clientId ? stored.clientInfo : undefined;
+      if (issuer && (storedClient?.issuer !== issuer || storedClient.configPreRegistered !== true)) {
+        updateClientInfo(this.serverName, { clientId: this.config.clientId, issuer, configPreRegistered: true }, this.serverUrl, this.storageOptions);
+      }
+      const clientSecret = this.config.clientSecret?.startsWith("!") ? resolveCommandSecret(this.config.clientSecret, `MCP server "${this.serverName}" OAuth clientSecret`) : this.config.clientSecret;
+      return {
+        client_id: this.config.clientId,
+        client_secret: clientSecret,
+        ...issuer !== undefined ? { issuer } : {}
+      };
+    }
+    const clientInfo = this.flowClientInfo ?? stored?.clientInfo;
+    if (clientInfo?.clientId === this.invalidatedClientId)
+      return;
+    if (clientInfo) {
+      this.invalidatedClientId = undefined;
+      const isConfigStub = clientInfo.configPreRegistered === true || clientInfo.clientSecret === undefined && clientInfo.clientIdIssuedAt === undefined && clientInfo.clientSecretExpiresAt === undefined && clientInfo.redirectUris === undefined;
+      if (isConfigStub) {
+        return;
+      }
+      if (clientInfo.clientSecretExpiresAt && clientInfo.clientSecretExpiresAt < Date.now() / 1000) {
+        return;
+      }
+      if (issuer && clientInfo.issuer && !issuersMatch(clientInfo.issuer, issuer)) {
+        return;
+      }
+      if (issuer && clientInfo.issuer === undefined) {
+        clientInfo.issuer = issuer;
+        this.flowClientInfo = clientInfo;
+        updateClientInfo(this.serverName, clientInfo, this.serverUrl, this.storageOptions);
+      }
+      this.lastObservedClientId = clientInfo.clientId;
+      return {
+        client_id: clientInfo.clientId,
+        client_secret: clientInfo.clientSecret,
+        ...clientInfo.clientIdIssuedAt !== undefined ? { client_id_issued_at: clientInfo.clientIdIssuedAt } : {},
+        ...clientInfo.clientSecretExpiresAt !== undefined ? { client_secret_expires_at: clientInfo.clientSecretExpiresAt } : {},
+        ...clientInfo.redirectUris !== undefined ? { redirect_uris: clientInfo.redirectUris } : {},
+        ...clientInfo.issuer !== undefined ? { issuer: clientInfo.issuer } : {}
+      };
+    }
+    return;
+  }
+  async saveClientInformation(info) {
+    this.throwIfInactive();
+    const issuer = this.discoveredIssuer ?? info.issuer;
+    if (this.config.clientId && info.client_id === this.config.clientId) {
+      updateClientInfo(this.serverName, {
+        clientId: info.client_id,
+        ...issuer !== undefined ? { issuer } : {},
+        configPreRegistered: true
+      }, this.serverUrl, this.storageOptions);
+      return;
+    }
+    const redirectUris = ("redirect_uris" in info ? info.redirect_uris : undefined) ?? (this.redirectUrl ? [this.redirectUrl] : undefined);
+    const clientInfo = {
+      clientId: info.client_id,
+      ...info.client_secret !== undefined ? { clientSecret: info.client_secret } : {},
+      ...info.client_id_issued_at !== undefined ? { clientIdIssuedAt: info.client_id_issued_at } : {},
+      ...info.client_secret_expires_at !== undefined ? { clientSecretExpiresAt: info.client_secret_expires_at } : {},
+      ...redirectUris !== undefined ? { redirectUris } : {},
+      ...issuer !== undefined ? { issuer } : {}
+    };
+    this.flowClientInfo = clientInfo;
+    this.invalidatedClientId = undefined;
+    this.lastObservedClientId = clientInfo.clientId;
+    updateClientInfo(this.serverName, clientInfo, this.serverUrl, this.storageOptions);
+  }
+  async tokens(ctx) {
+    if (this.invalidatedAccessToken !== undefined) {
+      invalidateAuthEntryCache(this.serverName);
+    }
+    const entry = await getAuthForUrl(this.serverName, this.serverUrl, this.storageOptions);
+    if (!entry?.tokens || entry.tokens.accessToken === this.invalidatedAccessToken)
+      return;
+    this.invalidatedAccessToken = undefined;
+    const issuer = this.discoveredIssuer;
+    this.assertStoredIssuerBindings(entry, issuer);
+    if (issuer && entry.tokens.issuer === undefined) {
+      entry.tokens.issuer = issuer;
+      updateTokens(this.serverName, entry.tokens, this.serverUrl, this.storageOptions);
+    }
+    if (ctx !== undefined) {
+      this.pendingAuthAccessToken = entry.tokens.accessToken;
+    }
+    return toOAuthTokens(entry.tokens);
+  }
+  async saveTokens(tokens) {
+    const issuer = this.discoveredIssuer ?? tokens.issuer;
+    const storedTokens = {
+      accessToken: tokens.access_token,
+      ...tokens.refresh_token !== undefined ? { refreshToken: tokens.refresh_token } : {},
+      ...tokens.expires_in !== undefined ? { expiresAt: Date.now() / 1000 + tokens.expires_in } : {},
+      ...tokens.scope !== undefined ? { scope: tokens.scope } : {},
+      ...issuer !== undefined ? { issuer } : {}
+    };
+    this.throwIfInactive();
+    updateTokens(this.serverName, storedTokens, this.serverUrl, this.storageOptions);
+    this.invalidatedAccessToken = undefined;
+    this.lastSavedAccessToken = storedTokens.accessToken;
+    this.flowDiscoveryState = undefined;
+  }
+  async redirectToAuthorization(authorizationUrl) {
+    if (this.usesClientCredentials) {
+      throw new Error("redirectToAuthorization is not used for client_credentials flow");
+    }
+    this.throwIfInactive();
+    if (!this.flowState) {
+      throw new UnauthorizedError(`Re-authentication required for MCP server: ${this.serverName}`);
+    }
+    await this.callbacks.onRedirect(addAuthorizationParams(authorizationUrl, this.config.authorizationParams));
+  }
+  async saveCodeVerifier(codeVerifier) {
+    this.throwIfInactive();
+    this.flowCodeVerifier = codeVerifier;
+  }
+  async codeVerifier() {
+    if (this.usesClientCredentials) {
+      throw new Error("codeVerifier is not used for client_credentials flow");
+    }
+    this.throwIfInactive();
+    if (!this.flowCodeVerifier) {
+      throw new Error(`No code verifier saved for MCP server: ${this.serverName}`);
+    }
+    return this.flowCodeVerifier;
+  }
+  async saveDiscoveryState(state) {
+    this.throwIfInactive();
+    this.flowDiscoveryState = structuredClone(state);
+  }
+  async discoveryState() {
+    this.throwIfInactive();
+    if (!this.flowDiscoveryState && this.config.authServerMetadataUrl !== undefined) {
+      this.flowDiscoveryState = await loadConfiguredDiscoveryState(this.config.authServerMetadataUrl, this.serverUrl, this.config.skipIssuerMetadataValidation === true, this.runtimeSignal);
+    }
+    return this.flowDiscoveryState ? structuredClone(this.flowDiscoveryState) : undefined;
+  }
+  async saveState(state) {
+    this.throwIfInactive();
+    this.flowState = state;
+  }
+  async state() {
+    if (this.usesClientCredentials) {
+      throw new Error("state is not used for client_credentials flow");
+    }
+    this.throwIfInactive();
+    if (!this.flowState) {
+      throw new UnauthorizedError(`Re-authentication required for MCP server: ${this.serverName}`);
+    }
+    return this.flowState;
+  }
+  async invalidateCredentials(type) {
+    this.throwIfInactive();
+    switch (type) {
+      case "all":
+        this.flowClientInfo = undefined;
+        this.flowCodeVerifier = undefined;
+        this.flowDiscoveryState = undefined;
+        this.flowIssuerMismatch = false;
+        this.flowState = undefined;
+        this.invalidatedAccessToken = undefined;
+        this.invalidatedClientId = undefined;
+        this.lastObservedClientId = undefined;
+        this.lastSavedAccessToken = undefined;
+        this.pendingAuthAccessToken = undefined;
+        clearAllCredentials(this.serverName, this.storageOptions);
+        break;
+      case "client":
+        this.invalidatedClientId = this.lastObservedClientId;
+        this.lastObservedClientId = undefined;
+        this.flowClientInfo = undefined;
+        invalidateAuthEntryCache(this.serverName);
+        break;
+      case "tokens":
+        this.invalidatedAccessToken = this.pendingAuthAccessToken ?? this.lastSavedAccessToken;
+        this.lastSavedAccessToken = undefined;
+        this.pendingAuthAccessToken = undefined;
+        invalidateAuthEntryCache(this.serverName);
+        break;
+      case "verifier":
+        clearCodeVerifier(this.serverName, this.storageOptions);
+        break;
+      case "discovery":
+        this.flowDiscoveryState = undefined;
+        break;
+    }
+  }
+  addClientAuthentication = async (headers, params, _url, metadata) => {
+    this.throwIfInactive();
+    if (params.get("grant_type") === "authorization_code" && !params.has("scope") && this.config.scope) {
+      params.set("scope", this.config.scope);
+    }
+    const clientInfo = await this.clientInformation();
+    this.throwIfInactive();
+    if (!clientInfo) {
+      return;
+    }
+    const supportedMethods = metadata?.token_endpoint_auth_methods_supported ?? [];
+    const hasClientSecret = clientInfo.client_secret !== undefined;
+    let authMethod;
+    if (supportedMethods.length === 0) {
+      authMethod = hasClientSecret ? "client_secret_post" : "none";
+    } else if (hasClientSecret && supportedMethods.includes("client_secret_basic")) {
+      authMethod = "client_secret_basic";
+    } else if (hasClientSecret && supportedMethods.includes("client_secret_post")) {
+      authMethod = "client_secret_post";
+    } else if (supportedMethods.includes("none")) {
+      authMethod = "none";
+    } else {
+      authMethod = hasClientSecret ? "client_secret_post" : "none";
+    }
+    if (authMethod === "client_secret_basic") {
+      if (!clientInfo.client_secret) {
+        throw new Error("client_secret_basic authentication requires a client_secret");
+      }
+      headers.set("Authorization", `Basic ${Buffer.from(`${clientInfo.client_id}:${clientInfo.client_secret}`).toString("base64")}`);
+      return;
+    }
+    if (!params.has("client_id")) {
+      params.set("client_id", clientInfo.client_id);
+    }
+    if (authMethod === "client_secret_post" && clientInfo.client_secret && !params.has("client_secret")) {
+      params.set("client_secret", clientInfo.client_secret);
+    }
+  };
+  prepareTokenRequest(scope) {
+    if (!this.usesClientCredentials) {
+      return;
+    }
+    const params = new URLSearchParams({ grant_type: "client_credentials" });
+    const requestedScope = scope ?? this.config.scope;
+    if (requestedScope) {
+      params.set("scope", requestedScope);
+    }
+    return params;
+  }
+}
+
+export { DEFAULT_OAUTH_CALLBACK_PORT, DEFAULT_OAUTH_CALLBACK_PATH };