@fruggr/zendesk-mcp-server 3.0.3 → 3.1.1

package/dist/token-persistence-BeetFqPF.js

@@ -0,0 +1,147 @@
+#!/usr/bin/env node
+import { n as readPackageInfo, p as readEnv, r as silentLogger } from "./index.js";
+import { createHash, randomBytes } from "node:crypto";
+import { dirname, join } from "node:path";
+import { chmodSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+//#region src/utils/html.ts
+/**
+* Escape a string for safe interpolation into HTML text/attribute context.
+* Both the stdio callback page and the HTTP consent page echo
+* attacker-controllable values (an OAuth `error_description`, a client name
+* from a fetched metadata document); without escaping these are an XSS sink.
+*/
+const escapeHtml = (value) => value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+//#endregion
+//#region src/auth/oauth-scopes.ts
+/**
+* The OAuth scope the server asks Zendesk for, and the one predicate that
+* decides whether a cached token's grant is still good enough.
+*
+* Both scope strings live here rather than in `constants.ts` on purpose: they
+* are behavioural strings whose mutants must be killed by assertions
+* (`docs/decisions/mutation-testing.md`, "OAuth parameters and scopes"), and
+* `src/auth/**` is inside the mutation scope while `constants.ts` is not.
+* Keeping them next to the predicate that consumes them keeps both under the
+* same gate.
+*/
+const READ_SCOPE = "read";
+const READ_WRITE_SCOPE = "read write";
+const WHITESPACE = /\s+/;
+const scopeTokens = (scope) => scope.split(WHITESPACE).filter((s) => s.length > 0);
+/**
+* The scope to request for a given tool surface. `--read-only` already filters
+* every write tool out of the surface, so asking Zendesk for `write` on top of
+* that would be requesting an authority the server cannot even exercise — and
+* an OAuth client whose allowed scopes stop at `read` rejects the whole
+* authorize request with `invalid_scope`, minting no token at all (#283).
+*/
+const requestedScope = (readOnly) => readOnly ? READ_SCOPE : READ_WRITE_SCOPE;
+/**
+* The same decision as a list, for the RFC 9728 / RFC 8414 `scopes_supported`
+* metadata. Derived from `requestedScope` so what the HTTP transport advertises
+* provably cannot drift from what the stdio flow requests.
+*/
+const supportedScopes = (readOnly) => scopeTokens(requestedScope(readOnly));
+/**
+* Whether a grant still covers what this process needs: a flat subset test.
+* Coverage, not equality, so a token Zendesk granted wider than requested stays
+* usable. A non-string `granted` is a pre-#283 record, i.e. `read write` — only
+* reachable now through a `OAUTH_TOKEN_FILE` aimed at one by hand, since the
+* default layout no longer names those files. No scope hierarchy: granular
+* scopes (#284) replace this.
+*/
+const grantCovers = (granted, requested) => {
+	if (typeof granted !== "string") return true;
+	const held = new Set(scopeTokens(granted));
+	return scopeTokens(requested).every((token) => held.has(token));
+};
+//#endregion
+//#region src/auth/pkce.ts
+const generateCodeVerifier = () => randomBytes(32).toString("base64url");
+const generateCodeChallenge = (verifier) => createHash("sha256").update(verifier).digest("base64url");
+//#endregion
+//#region src/auth/token-persistence.ts
+const isWindows = process.platform === "win32";
+/**
+* Config-dir segments derived from the *scoped* package name
+* (`@fruggr/zendesk-mcp-server` → `fruggr` + `zendesk-mcp-server`) so the path is
+* vendor-namespaced and can't collide with another `zendesk-mcp-server`.
+*/
+const SCOPED_PACKAGE_NAME = /^@([^/]+)\/(.+)$/;
+const appDirSegments = () => {
+	const { name } = readPackageInfo();
+	const scoped = SCOPED_PACKAGE_NAME.exec(name);
+	return scoped?.[1] && scoped[2] ? [scoped[1], scoped[2]] : [name];
+};
+const configDir = () => {
+	const segments = appDirSegments();
+	if (isWindows) {
+		const base = process.env["APPDATA"] ?? join(homedir(), "AppData", "Roaming");
+		return join(base, ...segments);
+	}
+	const base = process.env["XDG_CONFIG_HOME"] ?? join(homedir(), ".config");
+	return join(base, ...segments);
+};
+const safeName = (part) => part.replace(/[^a-z0-9-]/gi, "_");
+const READABLE_BUDGET = 120;
+const keyDigest = (key) => createHash("sha256").update(JSON.stringify([
+	key.subdomain,
+	key.oauthClientId,
+	key.scope
+])).digest("hex").slice(0, 8);
+/**
+* Path to the token file for one credential. Keyed on the whole `TokenKey`, so
+* a read-only server, a read-write one and one on another OAuth client each get
+* their own record instead of clobbering a shared file. Why that triple, and
+* why no migration from the old subdomain-only layout:
+* `docs/decisions/token-file-keying.md`.
+* `OAUTH_TOKEN_FILE` overrides with an explicit path — the way to separate
+* two Zendesk accounts that share a subdomain, client and scope.
+*/
+const resolveTokenPath = (key) => {
+	const { name, value: override } = readEnv("OAUTH_TOKEN_FILE");
+	if (override === "") throw new Error(`Empty ${name}. Set it to a value, or unset it entirely.`);
+	if (override) return override;
+	const readable = [
+		key.subdomain,
+		key.oauthClientId,
+		key.scope
+	].map(safeName).join("--").slice(0, READABLE_BUDGET);
+	return join(configDir(), `${readable}--${keyDigest(key)}.json`);
+};
+const writeFileAtomic = (path, record) => {
+	const dir = dirname(path);
+	mkdirSync(dir, { recursive: true });
+	const tmp = `${path}.${process.pid}.tmp`;
+	writeFileSync(tmp, JSON.stringify(record, null, 2), "utf8");
+	if (!isWindows) chmodSync(tmp, 384);
+	renameSync(tmp, path);
+	if (!isWindows) try {
+		chmodSync(dir, 448);
+	} catch {}
+};
+const loadToken = (path) => {
+	try {
+		const raw = JSON.parse(readFileSync(path, "utf8"));
+		if (raw && typeof raw === "object" && typeof raw.accessToken === "string") return raw;
+	} catch {}
+};
+const saveToken = (path, record, logger = silentLogger) => {
+	try {
+		writeFileAtomic(path, record);
+		logger.debug("token_persisted");
+	} catch (err) {
+		logger.warn("token_persist_failed", { error: err instanceof Error ? err.message : String(err) });
+	}
+};
+const clearToken = (path, logger = silentLogger) => {
+	try {
+		rmSync(path, { force: true });
+		logger.debug("token_cleared");
+	} catch (err) {
+		logger.warn("token_clear_failed", { error: err instanceof Error ? err.message : String(err) });
+	}
+};
+//#endregion
+export { saveToken as a, grantCovers as c, escapeHtml as d, resolveTokenPath as i, requestedScope as l, configDir as n, generateCodeChallenge as o, loadToken as r, generateCodeVerifier as s, clearToken as t, supportedScopes as u };