@igoruehara/canvas-flow 0.1.0

package/server/mcp-oauth/mcp-oauth-schema.js

@@ -0,0 +1,148 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CanvasMcpOAuthConnectionEntity = exports.EntitySchema = void 0;
+const mongoose_1 = require("@nestjs/mongoose");
+const mongoose = require("mongoose");
+const mongoose_2 = require("mongoose");
+const mcp_oauth_constants_model_1 = require("./mcp-oauth-constants-model");
+exports.EntitySchema = new mongoose.Schema({
+    key: { type: String, required: true, unique: true, index: true },
+    organizationId: { type: String, index: true },
+    agentId: { type: String, index: true },
+    connectionScope: { type: String, enum: ['agent', 'user'], default: 'agent', index: true },
+    oauthUserId: { type: String, index: true },
+    serverUrl: { type: String, required: true },
+    serverUrlHash: { type: String, required: true, index: true },
+    label: String,
+    scope: String,
+    redirectUrl: String,
+    state: { type: String, index: true },
+    authorizationUrl: String,
+    status: { type: String, enum: ['pending', 'connected', 'error'], default: 'pending', index: true },
+    error: String,
+    clientMetadata: { type: mongoose.Schema.Types.Mixed },
+    clientInformation: String,
+    tokens: String,
+    codeVerifier: String,
+    discoveryState: String,
+    expiresAt: Date,
+    authenticatedAt: Date,
+    createdBy: String,
+    updatedBy: String,
+}, {
+    collection: mcp_oauth_constants_model_1.COLLECTION_NAME,
+    timestamps: true,
+});
+exports.EntitySchema.index({ organizationId: 1, agentId: 1, connectionScope: 1, oauthUserId: 1, serverUrlHash: 1 }, { name: 'mcp_oauth_scope_lookup' });
+exports.EntitySchema.index({ state: 1 }, { sparse: true });
+let CanvasMcpOAuthConnectionEntity = class CanvasMcpOAuthConnectionEntity extends mongoose_2.Document {
+};
+exports.CanvasMcpOAuthConnectionEntity = CanvasMcpOAuthConnectionEntity;
+__decorate([
+    (0, mongoose_1.Prop)({ required: true, unique: true }),
+    __metadata("design:type", String)
+], CanvasMcpOAuthConnectionEntity.prototype, "key", void 0);
+__decorate([
+    (0, mongoose_1.Prop)(),
+    __metadata("design:type", String)
+], CanvasMcpOAuthConnectionEntity.prototype, "organizationId", void 0);
+__decorate([
+    (0, mongoose_1.Prop)(),
+    __metadata("design:type", String)
+], CanvasMcpOAuthConnectionEntity.prototype, "agentId", void 0);
+__decorate([
+    (0, mongoose_1.Prop)({ default: 'agent' }),
+    __metadata("design:type", String)
+], CanvasMcpOAuthConnectionEntity.prototype, "connectionScope", void 0);
+__decorate([
+    (0, mongoose_1.Prop)(),
+    __metadata("design:type", String)
+], CanvasMcpOAuthConnectionEntity.prototype, "oauthUserId", void 0);
+__decorate([
+    (0, mongoose_1.Prop)({ required: true }),
+    __metadata("design:type", String)
+], CanvasMcpOAuthConnectionEntity.prototype, "serverUrl", void 0);
+__decorate([
+    (0, mongoose_1.Prop)({ required: true }),
+    __metadata("design:type", String)
+], CanvasMcpOAuthConnectionEntity.prototype, "serverUrlHash", void 0);
+__decorate([
+    (0, mongoose_1.Prop)(),
+    __metadata("design:type", String)
+], CanvasMcpOAuthConnectionEntity.prototype, "label", void 0);
+__decorate([
+    (0, mongoose_1.Prop)(),
+    __metadata("design:type", String)
+], CanvasMcpOAuthConnectionEntity.prototype, "scope", void 0);
+__decorate([
+    (0, mongoose_1.Prop)(),
+    __metadata("design:type", String)
+], CanvasMcpOAuthConnectionEntity.prototype, "redirectUrl", void 0);
+__decorate([
+    (0, mongoose_1.Prop)(),
+    __metadata("design:type", String)
+], CanvasMcpOAuthConnectionEntity.prototype, "state", void 0);
+__decorate([
+    (0, mongoose_1.Prop)(),
+    __metadata("design:type", String)
+], CanvasMcpOAuthConnectionEntity.prototype, "authorizationUrl", void 0);
+__decorate([
+    (0, mongoose_1.Prop)({ default: 'pending' }),
+    __metadata("design:type", String)
+], CanvasMcpOAuthConnectionEntity.prototype, "status", void 0);
+__decorate([
+    (0, mongoose_1.Prop)(),
+    __metadata("design:type", String)
+], CanvasMcpOAuthConnectionEntity.prototype, "error", void 0);
+__decorate([
+    (0, mongoose_1.Prop)({ type: mongoose.Schema.Types.Mixed }),
+    __metadata("design:type", Object)
+], CanvasMcpOAuthConnectionEntity.prototype, "clientMetadata", void 0);
+__decorate([
+    (0, mongoose_1.Prop)(),
+    __metadata("design:type", String)
+], CanvasMcpOAuthConnectionEntity.prototype, "clientInformation", void 0);
+__decorate([
+    (0, mongoose_1.Prop)(),
+    __metadata("design:type", String)
+], CanvasMcpOAuthConnectionEntity.prototype, "tokens", void 0);
+__decorate([
+    (0, mongoose_1.Prop)(),
+    __metadata("design:type", String)
+], CanvasMcpOAuthConnectionEntity.prototype, "codeVerifier", void 0);
+__decorate([
+    (0, mongoose_1.Prop)(),
+    __metadata("design:type", String)
+], CanvasMcpOAuthConnectionEntity.prototype, "discoveryState", void 0);
+__decorate([
+    (0, mongoose_1.Prop)(),
+    __metadata("design:type", Date)
+], CanvasMcpOAuthConnectionEntity.prototype, "expiresAt", void 0);
+__decorate([
+    (0, mongoose_1.Prop)(),
+    __metadata("design:type", Date)
+], CanvasMcpOAuthConnectionEntity.prototype, "authenticatedAt", void 0);
+__decorate([
+    (0, mongoose_1.Prop)(),
+    __metadata("design:type", String)
+], CanvasMcpOAuthConnectionEntity.prototype, "createdBy", void 0);
+__decorate([
+    (0, mongoose_1.Prop)(),
+    __metadata("design:type", String)
+], CanvasMcpOAuthConnectionEntity.prototype, "updatedBy", void 0);
+exports.CanvasMcpOAuthConnectionEntity = CanvasMcpOAuthConnectionEntity = __decorate([
+    (0, mongoose_1.Schema)({
+        collection: mcp_oauth_constants_model_1.COLLECTION_NAME,
+        timestamps: true,
+    })
+], CanvasMcpOAuthConnectionEntity);
+//# sourceMappingURL=mcp-oauth-schema.js.map

package/server/mcp-oauth/mcp-oauth-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-schema.js","sourceRoot":"","sources":["../../src/mcp-oauth/mcp-oauth-schema.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,+CAAgD;AAChD,qCAAqC;AACrC,uCAAoC;AACpC,2EAA8D;AAEjD,QAAA,YAAY,GAAG,IAAI,QAAQ,CAAC,MAAM,CAC7C;IACE,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;IAChE,cAAc,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE;IAC7C,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE;IACtC,eAAe,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE;IACzF,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE;IAC1C,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC3C,aAAa,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;IAC5D,KAAK,EAAE,MAAM;IACb,KAAK,EAAE,MAAM;IACb,WAAW,EAAE,MAAM;IACnB,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE;IACpC,gBAAgB,EAAE,MAAM;IACxB,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE;IAClG,KAAK,EAAE,MAAM;IACb,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE;IACrD,iBAAiB,EAAE,MAAM;IACzB,MAAM,EAAE,MAAM;IACd,YAAY,EAAE,MAAM;IACpB,cAAc,EAAE,MAAM;IACtB,SAAS,EAAE,IAAI;IACf,eAAe,EAAE,IAAI;IACrB,SAAS,EAAE,MAAM;IACjB,SAAS,EAAE,MAAM;CAClB,EACD;IACE,UAAU,EAAE,2CAAe;IAC3B,UAAU,EAAE,IAAI;CACjB,CACF,CAAC;AAEF,oBAAY,CAAC,KAAK,CAChB,EAAE,cAAc,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,EACvF,EAAE,IAAI,EAAE,wBAAwB,EAAE,CACnC,CAAC;AACF,oBAAY,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAM5C,IAAM,8BAA8B,GAApC,MAAM,8BAA+B,SAAQ,mBAAQ;CAwE3D,CAAA;AAxEY,wEAA8B;AAEzC;IADC,IAAA,eAAI,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;;2DAC3B;AAGZ;IADC,IAAA,eAAI,GAAE;;sEACiB;AAGxB;IADC,IAAA,eAAI,GAAE;;+DACU;AAGjB;IADC,IAAA,eAAI,EAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;;uEACQ;AAGnC;IADC,IAAA,eAAI,GAAE;;mEACc;AAGrB;IADC,IAAA,eAAI,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;iEACP;AAGlB;IADC,IAAA,eAAI,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;qEACH;AAGtB;IADC,IAAA,eAAI,GAAE;;6DACQ;AAGf;IADC,IAAA,eAAI,GAAE;;6DACQ;AAGf;IADC,IAAA,eAAI,GAAE;;mEACc;AAGrB;IADC,IAAA,eAAI,GAAE;;6DACQ;AAGf;IADC,IAAA,eAAI,GAAE;;wEACmB;AAG1B;IADC,IAAA,eAAI,EAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;;8DACa;AAG1C;IADC,IAAA,eAAI,GAAE;;6DACQ;AAGf;IADC,IAAA,eAAI,EAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;;sEACP;AAGrC;IADC,IAAA,eAAI,GAAE;;yEACoB;AAG3B;IADC,IAAA,eAAI,GAAE;;8DACS;AAGhB;IADC,IAAA,eAAI,GAAE;;oEACe;AAGtB;IADC,IAAA,eAAI,GAAE;;sEACiB;AAGxB;IADC,IAAA,eAAI,GAAE;8BACK,IAAI;iEAAC;AAGjB;IADC,IAAA,eAAI,GAAE;8BACW,IAAI;uEAAC;AAGvB;IADC,IAAA,eAAI,GAAE;;iEACY;AAGnB;IADC,IAAA,eAAI,GAAE;;iEACY;yCApER,8BAA8B;IAJ1C,IAAA,iBAAM,EAAC;QACN,UAAU,EAAE,2CAAe;QAC3B,UAAU,EAAE,IAAI;KACjB,CAAC;GACW,8BAA8B,CAwE1C"}

package/server/mcp-oauth/mcp-oauth-service.d.ts

@@ -0,0 +1,189 @@
+import { ConfigService } from '@nestjs/config';
+import { OAuthClientProvider, type OAuthDiscoveryState } from '@modelcontextprotocol/sdk/client/auth.js';
+import type { OAuthClientInformationMixed, OAuthClientMetadata, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
+import { Model } from 'mongoose';
+import { CanvasMcpOAuthConnectionEntity } from './mcp-oauth-schema';
+type OAuthStatus = 'pending' | 'connected' | 'error';
+export type McpOAuthConnectionScope = 'agent' | 'user';
+export interface McpOAuthScope {
+    organizationId?: string;
+    agentId?: string;
+    connectionScope?: McpOAuthConnectionScope;
+    oauthUserId?: string;
+}
+declare class PersistentMcpOAuthProvider implements OAuthClientProvider {
+    private readonly service;
+    private readonly key;
+    private readonly redirectUrlValue;
+    private readonly clientMetadataValue;
+    latestAuthorizationUrl: string;
+    constructor(service: McpOAuthService, key: string, redirectUrlValue: string, clientMetadataValue: OAuthClientMetadata);
+    get redirectUrl(): string;
+    get clientMetadata(): {
+        redirect_uris: string[];
+        token_endpoint_auth_method?: string;
+        grant_types?: string[];
+        response_types?: string[];
+        client_name?: string;
+        client_uri?: string;
+        logo_uri?: string;
+        scope?: string;
+        contacts?: string[];
+        tos_uri?: string;
+        policy_uri?: string;
+        jwks_uri?: string;
+        jwks?: any;
+        software_id?: string;
+        software_version?: string;
+        software_statement?: string;
+    };
+    state(): Promise<string>;
+    clientInformation(): Promise<OAuthClientInformationMixed>;
+    saveClientInformation(clientInformation: OAuthClientInformationMixed): Promise<void>;
+    tokens(): Promise<{
+        access_token: string;
+        token_type: string;
+        id_token?: string;
+        expires_in?: number;
+        scope?: string;
+        refresh_token?: string;
+    }>;
+    saveTokens(tokens: OAuthTokens): Promise<void>;
+    redirectToAuthorization(authorizationUrl: URL): Promise<void>;
+    saveCodeVerifier(codeVerifier: string): Promise<void>;
+    codeVerifier(): Promise<string>;
+    saveDiscoveryState(state: OAuthDiscoveryState): Promise<void>;
+    discoveryState(): Promise<OAuthDiscoveryState>;
+    invalidateCredentials(scope: 'all' | 'client' | 'tokens' | 'verifier' | 'discovery'): Promise<void>;
+}
+export declare class McpOAuthService {
+    private model;
+    private readonly configService;
+    constructor(model: Model<CanvasMcpOAuthConnectionEntity>, configService: ConfigService);
+    private normalizeAgentId;
+    private normalizeOrganizationId;
+    private normalizeConnectionScope;
+    private normalizeOAuthUserId;
+    normalizeServerUrl(value: string): string;
+    private serverUrlHash;
+    private connectionKey;
+    private secretKey;
+    private encryptText;
+    private decryptText;
+    private encryptJson;
+    private decryptJson;
+    private assertDbReady;
+    private buildCallbackUrl;
+    private buildClientMetadata;
+    private defaultScopeForServer;
+    private isFigmaServer;
+    private isAtlassianServer;
+    private getStaticClientInformation;
+    private formatStartError;
+    private inspectStoredTokens;
+    private sanitize;
+    getConnectionByKey(key: string): Promise<import("mongoose").FlattenMaps<CanvasMcpOAuthConnectionEntity> & Required<{
+        _id: import("mongoose").Types.ObjectId;
+    }> & {
+        __v: number;
+    }>;
+    getEncryptedJson<T>(key: string, field: 'clientInformation' | 'tokens' | 'codeVerifier' | 'discoveryState'): Promise<T>;
+    saveEncryptedJson(key: string, field: 'clientInformation' | 'tokens' | 'codeVerifier' | 'discoveryState', value: any): Promise<void>;
+    saveTokens(key: string, tokens: OAuthTokens): Promise<void>;
+    setAuthorizationUrl(key: string, authorizationUrl: string): Promise<void>;
+    invalidateCredentials(key: string, scope: 'all' | 'client' | 'tokens' | 'verifier' | 'discovery'): Promise<void>;
+    private createProvider;
+    startAuthorization(params: {
+        serverUrl: string;
+        agentId?: string;
+        organizationId?: string;
+        userId?: string;
+        connectionScope?: McpOAuthConnectionScope;
+        oauthUserId?: string;
+        baseUrl?: string;
+        label?: string;
+        scope?: string;
+        clientName?: string;
+    }): Promise<{
+        connected: boolean;
+        status: OAuthStatus;
+        serverUrl: any;
+        agentId: any;
+        organizationId: any;
+        connectionScope: McpOAuthConnectionScope;
+        label: any;
+        scope: any;
+        authorizationUrl: any;
+        expiresAt: string;
+        authenticatedAt: string;
+        updatedAt: string;
+        error: any;
+    }>;
+    finishAuthorization(params: {
+        state: string;
+        code?: string;
+        error?: string;
+    }): Promise<{
+        connected: boolean;
+        status: OAuthStatus;
+        serverUrl: any;
+        agentId: any;
+        organizationId: any;
+        connectionScope: McpOAuthConnectionScope;
+        label: any;
+        scope: any;
+        authorizationUrl: any;
+        expiresAt: string;
+        authenticatedAt: string;
+        updatedAt: string;
+        error: any;
+    }>;
+    getStatus(params: McpOAuthScope & {
+        serverUrl: string;
+    }): Promise<{
+        connected: boolean;
+        status: OAuthStatus;
+        serverUrl: any;
+        agentId: any;
+        organizationId: any;
+        connectionScope: McpOAuthConnectionScope;
+        label: any;
+        scope: any;
+        authorizationUrl: any;
+        expiresAt: string;
+        authenticatedAt: string;
+        updatedAt: string;
+        error: any;
+    } | {
+        connected: boolean;
+        status: string;
+        error: string;
+        serverUrl?: undefined;
+        agentId?: undefined;
+        organizationId?: undefined;
+        connectionScope?: undefined;
+    } | {
+        connected: false;
+        status: "pending";
+        serverUrl: string;
+        agentId: string;
+        organizationId: string;
+        connectionScope: McpOAuthConnectionScope;
+        error: string;
+    }>;
+    disconnect(params: McpOAuthScope & {
+        serverUrl: string;
+    }): Promise<{
+        connected: boolean;
+        status: string;
+        serverUrl: string;
+        agentId: string;
+        organizationId: string;
+        connectionScope: McpOAuthConnectionScope;
+        error: string;
+    }>;
+    createRuntimeProvider(params: McpOAuthScope & {
+        serverUrl: string;
+    }): Promise<PersistentMcpOAuthProvider>;
+}
+export {};