@gavdi/cap-mcp 0.9.3 → 0.9.4

package/lib/auth/utils.js

@@ -4,6 +4,8 @@ exports.isAuthEnabled = isAuthEnabled;
 exports.getAccessRights = getAccessRights;
 exports.registerAuthMiddleware = registerAuthMiddleware;
 const handler_1 = require("./handler");
+const proxyProvider_js_1 = require("@modelcontextprotocol/sdk/server/auth/providers/proxyProvider.js");
+const router_js_1 = require("@modelcontextprotocol/sdk/server/auth/router.js");
 /**
  * @fileoverview Authentication utilities for MCP-CAP integration.
  *
@@ -128,4 +130,83 @@ function registerAuthMiddleware(expressApp) {
     authMiddleware.push((0, handler_1.authHandlerFactory)());
     // Apply auth middleware to all /mcp routes EXCEPT health
     expressApp?.use(/^\/mcp(?!\/health).*/, ...authMiddleware);
+    // Then finally we add the oauth proxy to the xsuaa instance
+    configureOAuthProxy(expressApp);
+}
+/**
+ * Configures OAuth proxy middleware for enterprise authentication scenarios.
+ *
+ * This function sets up a proxy OAuth provider that integrates with SAP BTP
+ * authentication services (XSUAA/IAS) to enable MCP clients to authenticate
+ * through standard OAuth2 flows. The proxy handles:
+ *
+ * - OAuth2 authorization and token endpoints
+ * - Access token verification and validation
+ * - Client credential management
+ * - Integration with CAP authentication configuration
+ *
+ * The OAuth proxy is only configured for enterprise authentication types
+ * (jwt, xsuaa, ias) and skips configuration for basic auth types.
+ *
+ * @param expressApp - Express application instance to register OAuth routes on
+ *
+ * @throws {Error} When required OAuth credentials are missing or invalid
+ *
+ * @example
+ * ```typescript
+ * // Automatically called by registerAuthMiddleware()
+ * // Requires CAP auth configuration:
+ * // cds.env.requires.auth = {
+ * //   kind: 'xsuaa',
+ * //   credentials: {
+ * //     clientid: 'your-client-id',
+ * //     clientsecret: 'your-client-secret',
+ * //     url: 'https://your-tenant.authentication.sap.hana.ondemand.com'
+ * //   }
+ * // }
+ * ```
+ *
+ * @internal This function is called internally by registerAuthMiddleware()
+ * @since 1.0.0
+ */
+function configureOAuthProxy(expressApp) {
+    const config = cds.env.requires.auth;
+    const kind = config.kind;
+    const credentials = config.credentials;
+    // Safety guard - skip OAuth proxy for basic auth types
+    if (kind === "dummy" || kind === "mocked" || kind === "basic")
+        return;
+    else if (!credentials ||
+        !credentials.clientid ||
+        !credentials.clientsecret ||
+        !credentials.url) {
+        throw new Error("Invalid security credentials");
+    }
+    const proxyProvider = new proxyProvider_js_1.ProxyOAuthServerProvider({
+        endpoints: {
+            authorizationUrl: `${credentials.url}/oauth/authorize`,
+            tokenUrl: `${credentials.url}/oauth/token`,
+            revocationUrl: `${credentials.url}/oauth/revoke`,
+        },
+        verifyAccessToken: async (token) => {
+            return {
+                token,
+                clientId: credentials.clientid,
+                scopes: ["uaa.resource"],
+            };
+        },
+        getClient: async (client_id) => {
+            return {
+                client_secret: credentials.clientsecret,
+                client_id,
+                redirect_uris: ["http://localhost:3000/callback"], // Temporary value for now
+            };
+        },
+    });
+    expressApp.use((0, router_js_1.mcpAuthRouter)({
+        provider: proxyProvider,
+        issuerUrl: new URL(credentials.url),
+        //baseUrl: new URL(""), // I have left this out for the time being due to the defaulting to issuer
+        serviceDocumentationUrl: new URL("https://docs.cloudfoundry.org/api/uaa/version/77.34.0/index.html#authorization"),
+    }));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gavdi/cap-mcp",
-  "version": "0.9.3",
+  "version": "0.9.4",
   "description": "MCP Pluging for CAP",
   "keywords": [
     "MCP",
@@ -37,7 +37,7 @@
     "express": "^4"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.13.0",
+    "@modelcontextprotocol/sdk": "^1.17.1",
     "zod": "^3.25.67",
     "zod-to-json-schema": "^3.24.5"
   },