@kya-os/mcp-i-cloudflare 1.6.1 → 1.6.2-canary.clientinfo.1764123720
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/adapter.d.ts +2 -1
- package/dist/adapter.d.ts.map +1 -1
- package/dist/adapter.js +14 -2
- package/dist/adapter.js.map +1 -1
- package/dist/agent.d.ts +31 -0
- package/dist/agent.d.ts.map +1 -1
- package/dist/agent.js +97 -0
- package/dist/agent.js.map +1 -1
- package/dist/app.d.ts.map +1 -1
- package/dist/app.js +76 -9
- package/dist/app.js.map +1 -1
- package/dist/services/kta-client-lookup.d.ts +59 -0
- package/dist/services/kta-client-lookup.d.ts.map +1 -0
- package/dist/services/kta-client-lookup.js +153 -0
- package/dist/services/kta-client-lookup.js.map +1 -0
- package/dist/types.d.ts +2 -0
- package/dist/types.d.ts.map +1 -1
- package/dist/utils/client-info.d.ts +69 -0
- package/dist/utils/client-info.d.ts.map +1 -0
- package/dist/utils/client-info.js +178 -0
- package/dist/utils/client-info.js.map +1 -0
- package/dist/utils/error-formatter.d.ts +103 -0
- package/dist/utils/error-formatter.d.ts.map +1 -0
- package/dist/utils/error-formatter.js +245 -0
- package/dist/utils/error-formatter.js.map +1 -0
- package/dist/utils/initialize-context.d.ts +91 -0
- package/dist/utils/initialize-context.d.ts.map +1 -0
- package/dist/utils/initialize-context.js +169 -0
- package/dist/utils/initialize-context.js.map +1 -0
- package/dist/utils/known-clients.d.ts +46 -0
- package/dist/utils/known-clients.d.ts.map +1 -0
- package/dist/utils/known-clients.js +114 -0
- package/dist/utils/known-clients.js.map +1 -0
- package/dist/utils/oauth-identity.d.ts +58 -0
- package/dist/utils/oauth-identity.d.ts.map +1 -0
- package/dist/utils/oauth-identity.js +215 -0
- package/dist/utils/oauth-identity.js.map +1 -0
- package/package.json +1 -1
- package/dist/services/oauth-service.d.ts +0 -66
- package/dist/services/oauth-service.d.ts.map +0 -1
- package/dist/services/oauth-service.js +0 -223
- package/dist/services/oauth-service.js.map +0 -1
- package/dist/services/tool-context-builder.d.ts +0 -55
- package/dist/services/tool-context-builder.d.ts.map +0 -1
- package/dist/services/tool-context-builder.js +0 -124
- package/dist/services/tool-context-builder.js.map +0 -1
- package/dist/types/tool-context.d.ts +0 -35
- package/dist/types/tool-context.d.ts.map +0 -1
- package/dist/types/tool-context.js +0 -13
- package/dist/types/tool-context.js.map +0 -1
|
@@ -0,0 +1,169 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Initialize Context Manager
|
|
3
|
+
*
|
|
4
|
+
* Manages MCP initialize context storage and retrieval for cross-request state.
|
|
5
|
+
* This allows us to preserve client info between initialize and handshake calls.
|
|
6
|
+
*/
|
|
7
|
+
// TTL for initialize contexts (60 seconds)
|
|
8
|
+
const INITIALIZE_CONTEXT_TTL_MS = 60_000;
|
|
9
|
+
/**
|
|
10
|
+
* Manages initialize contexts for session continuity
|
|
11
|
+
*/
|
|
12
|
+
export class InitializeContextManager {
|
|
13
|
+
contexts;
|
|
14
|
+
constructor() {
|
|
15
|
+
this.contexts = new Map();
|
|
16
|
+
}
|
|
17
|
+
/**
|
|
18
|
+
* Store initialize context for later use in handshake
|
|
19
|
+
*
|
|
20
|
+
* @param meta Request metadata for fingerprinting
|
|
21
|
+
* @param params Initialize request parameters
|
|
22
|
+
*/
|
|
23
|
+
store(meta, params) {
|
|
24
|
+
if (!meta?.fingerprint || !this.isRecord(params)) {
|
|
25
|
+
return;
|
|
26
|
+
}
|
|
27
|
+
const protocolVersion = params.protocolVersion;
|
|
28
|
+
const capabilities = params.capabilities;
|
|
29
|
+
const clientInfo = this.normalizeClientInfo(params.clientInfo);
|
|
30
|
+
const context = {
|
|
31
|
+
timestamp: Date.now(),
|
|
32
|
+
protocolVersion: typeof protocolVersion === "string" ? protocolVersion : undefined,
|
|
33
|
+
capabilities: this.cloneCapabilities(capabilities),
|
|
34
|
+
clientInfo,
|
|
35
|
+
};
|
|
36
|
+
this.contexts.set(meta.fingerprint, context);
|
|
37
|
+
this.prune();
|
|
38
|
+
}
|
|
39
|
+
/**
|
|
40
|
+
* Consume initialize context (removes it after retrieval)
|
|
41
|
+
*
|
|
42
|
+
* @param meta Request metadata for fingerprinting
|
|
43
|
+
* @returns Initialize context if found and valid, undefined otherwise
|
|
44
|
+
*/
|
|
45
|
+
consume(meta) {
|
|
46
|
+
if (!meta?.fingerprint) {
|
|
47
|
+
return undefined;
|
|
48
|
+
}
|
|
49
|
+
const context = this.contexts.get(meta.fingerprint);
|
|
50
|
+
if (!context) {
|
|
51
|
+
return undefined;
|
|
52
|
+
}
|
|
53
|
+
if (Date.now() - context.timestamp > INITIALIZE_CONTEXT_TTL_MS) {
|
|
54
|
+
this.contexts.delete(meta.fingerprint);
|
|
55
|
+
return undefined;
|
|
56
|
+
}
|
|
57
|
+
// Remove after consumption to prevent cross-session leakage
|
|
58
|
+
this.contexts.delete(meta.fingerprint);
|
|
59
|
+
return context;
|
|
60
|
+
}
|
|
61
|
+
/**
|
|
62
|
+
* Prune expired contexts
|
|
63
|
+
*/
|
|
64
|
+
prune() {
|
|
65
|
+
const now = Date.now();
|
|
66
|
+
for (const [key, context] of this.contexts.entries()) {
|
|
67
|
+
if (now - context.timestamp > INITIALIZE_CONTEXT_TTL_MS) {
|
|
68
|
+
this.contexts.delete(key);
|
|
69
|
+
}
|
|
70
|
+
}
|
|
71
|
+
}
|
|
72
|
+
/**
|
|
73
|
+
* Normalize client info from various formats
|
|
74
|
+
*
|
|
75
|
+
* @param value Client info from request
|
|
76
|
+
* @returns Normalized client info or undefined
|
|
77
|
+
*/
|
|
78
|
+
normalizeClientInfo(value) {
|
|
79
|
+
if (!this.isRecord(value)) {
|
|
80
|
+
return undefined;
|
|
81
|
+
}
|
|
82
|
+
const normalized = {};
|
|
83
|
+
const record = value;
|
|
84
|
+
const name = record.name;
|
|
85
|
+
if (typeof name === "string" && name.trim().length > 0) {
|
|
86
|
+
normalized.name = name.trim();
|
|
87
|
+
}
|
|
88
|
+
const title = record.title;
|
|
89
|
+
if (typeof title === "string" && title.trim().length > 0) {
|
|
90
|
+
normalized.title = title.trim();
|
|
91
|
+
}
|
|
92
|
+
const version = record.version;
|
|
93
|
+
if (typeof version === "string" && version.trim().length > 0) {
|
|
94
|
+
normalized.version = version.trim();
|
|
95
|
+
}
|
|
96
|
+
const platform = record.platform;
|
|
97
|
+
if (typeof platform === "string" && platform.trim().length > 0) {
|
|
98
|
+
normalized.platform = platform.trim();
|
|
99
|
+
}
|
|
100
|
+
const vendor = record.vendor;
|
|
101
|
+
if (typeof vendor === "string" && vendor.trim().length > 0) {
|
|
102
|
+
normalized.vendor = vendor.trim();
|
|
103
|
+
}
|
|
104
|
+
const persistentId = record.persistentId;
|
|
105
|
+
if (typeof persistentId === "string" && persistentId.trim().length > 0) {
|
|
106
|
+
normalized.persistentId = persistentId.trim();
|
|
107
|
+
}
|
|
108
|
+
return Object.keys(normalized).length > 0 ? normalized : undefined;
|
|
109
|
+
}
|
|
110
|
+
/**
|
|
111
|
+
* Clone capabilities object (deep copy)
|
|
112
|
+
*
|
|
113
|
+
* @param capabilities Capabilities to clone
|
|
114
|
+
* @returns Cloned capabilities or undefined
|
|
115
|
+
*/
|
|
116
|
+
cloneCapabilities(capabilities) {
|
|
117
|
+
if (!this.isRecord(capabilities)) {
|
|
118
|
+
return undefined;
|
|
119
|
+
}
|
|
120
|
+
return JSON.parse(JSON.stringify(capabilities));
|
|
121
|
+
}
|
|
122
|
+
/**
|
|
123
|
+
* Type guard for record objects
|
|
124
|
+
*
|
|
125
|
+
* @param value Value to check
|
|
126
|
+
* @returns true if value is a record object
|
|
127
|
+
*/
|
|
128
|
+
isRecord(value) {
|
|
129
|
+
return typeof value === "object" && value !== null && !Array.isArray(value);
|
|
130
|
+
}
|
|
131
|
+
/**
|
|
132
|
+
* Get current size of context cache (for monitoring)
|
|
133
|
+
*
|
|
134
|
+
* @returns Number of stored contexts
|
|
135
|
+
*/
|
|
136
|
+
size() {
|
|
137
|
+
return this.contexts.size;
|
|
138
|
+
}
|
|
139
|
+
/**
|
|
140
|
+
* Clear all contexts (for testing)
|
|
141
|
+
*/
|
|
142
|
+
clear() {
|
|
143
|
+
this.contexts.clear();
|
|
144
|
+
}
|
|
145
|
+
}
|
|
146
|
+
/**
|
|
147
|
+
* Build request metadata from HTTP request
|
|
148
|
+
*
|
|
149
|
+
* @param request HTTP request
|
|
150
|
+
* @returns Request metadata with fingerprint
|
|
151
|
+
*/
|
|
152
|
+
export function buildRequestMeta(request) {
|
|
153
|
+
const ip = request.headers.get("cf-connecting-ip") ??
|
|
154
|
+
request.headers.get("x-forwarded-for") ??
|
|
155
|
+
undefined;
|
|
156
|
+
const userAgent = request.headers.get("user-agent") ?? undefined;
|
|
157
|
+
const cfRay = request.headers.get("cf-ray") ?? undefined;
|
|
158
|
+
const origin = request.headers.get("origin") ?? undefined;
|
|
159
|
+
const secChUa = request.headers.get("sec-ch-ua") ?? undefined;
|
|
160
|
+
const fingerprintParts = [ip, userAgent, cfRay, origin, secChUa].filter((value) => typeof value === "string" && value.length > 0);
|
|
161
|
+
return {
|
|
162
|
+
fingerprint: fingerprintParts.length > 0 ? fingerprintParts.join("|") : undefined,
|
|
163
|
+
ip,
|
|
164
|
+
userAgent,
|
|
165
|
+
cfRay,
|
|
166
|
+
request, // Include request for cookie access
|
|
167
|
+
};
|
|
168
|
+
}
|
|
169
|
+
//# sourceMappingURL=initialize-context.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"initialize-context.js","sourceRoot":"","sources":["../../src/utils/initialize-context.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA0BH,2CAA2C;AAC3C,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEzC;;GAEG;AACH,MAAM,OAAO,wBAAwB;IAC3B,QAAQ,CAAiC;IAEjD;QACE,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAC;IAC5B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,IAA6B,EAAE,MAAe;QAClD,IAAI,CAAC,IAAI,EAAE,WAAW,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACjD,OAAO;QACT,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;QAC/C,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QACzC,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAE/D,MAAM,OAAO,GAAsB;YACjC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,eAAe,EACb,OAAO,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;YACnE,YAAY,EAAE,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC;YAClD,UAAU;SACX,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAAC,IAA6B;QACnC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,GAAG,yBAAyB,EAAE,CAAC;YAC/D,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACvC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,4DAA4D;QAC5D,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACvC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACK,KAAK;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YACrD,IAAI,GAAG,GAAG,OAAO,CAAC,SAAS,GAAG,yBAAyB,EAAE,CAAC;gBACxD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,mBAAmB,CACzB,KAAc;QAEd,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,UAAU,GAA+B,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,KAAgC,CAAC;QAEhD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvD,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAChC,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzD,UAAU,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAClC,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7D,UAAU,CAAC,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QACtC,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACjC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/D,UAAU,CAAC,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QACxC,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3D,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QACpC,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QACzC,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvE,UAAU,CAAC,YAAY,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC;QAChD,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,CAAC;IAED;;;;;OAKG;IACK,iBAAiB,CACvB,YAAqB;QAErB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACjC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAA0B,CAAC;IAC3E,CAAC;IAED;;;;;OAKG;IACK,QAAQ,CAAC,KAAc;QAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9E,CAAC;IAED;;;;OAIG;IACH,IAAI;QACF,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,MAAM,EAAE,GACN,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACvC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QACtC,SAAS,CAAC;IACZ,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC;IACjE,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;IAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC;IAE9D,MAAM,gBAAgB,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,CACrE,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAC1E,CAAC;IAEF,OAAO;QACL,WAAW,EACT,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QACtE,EAAE;QACF,SAAS;QACT,KAAK;QACL,OAAO,EAAE,oCAAoC;KAC9C,CAAC;AACJ,CAAC"}
|
|
@@ -0,0 +1,46 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Known MCP Clients Registry
|
|
3
|
+
*
|
|
4
|
+
* Maps known MCP client names to their official Know That AI (KTA) DIDs.
|
|
5
|
+
* When a known client connects, we use its pre-registered DID instead of generating one.
|
|
6
|
+
*/
|
|
7
|
+
export interface KnownClientConfig {
|
|
8
|
+
/** Possible client name variations (case-insensitive matching) */
|
|
9
|
+
names: string[];
|
|
10
|
+
/** Know That AI registered DID for this client (null if not yet registered) */
|
|
11
|
+
ktaDid: string | null;
|
|
12
|
+
/** Display name for logging */
|
|
13
|
+
displayName: string;
|
|
14
|
+
/** Optional vendor/organization */
|
|
15
|
+
vendor?: string;
|
|
16
|
+
}
|
|
17
|
+
/**
|
|
18
|
+
* Registry of known MCP clients
|
|
19
|
+
*
|
|
20
|
+
* Each entry maps a canonical client ID to its configuration.
|
|
21
|
+
* The `names` array contains possible variations of the client name
|
|
22
|
+
* that might appear in the MCP initialize message's clientInfo.name field.
|
|
23
|
+
*/
|
|
24
|
+
export declare const KNOWN_MCP_CLIENTS: Record<string, KnownClientConfig>;
|
|
25
|
+
/**
|
|
26
|
+
* Find a known client by name (case-insensitive)
|
|
27
|
+
*
|
|
28
|
+
* @param clientName - The client name from MCP initialize message
|
|
29
|
+
* @returns The known client config if found, undefined otherwise
|
|
30
|
+
*/
|
|
31
|
+
export declare function findKnownClient(clientName: string | undefined): (KnownClientConfig & {
|
|
32
|
+
id: string;
|
|
33
|
+
}) | undefined;
|
|
34
|
+
/**
|
|
35
|
+
* Check if a client name corresponds to a known client
|
|
36
|
+
*/
|
|
37
|
+
export declare function isKnownClient(clientName: string | undefined): boolean;
|
|
38
|
+
/**
|
|
39
|
+
* Get the DID for a known client, if registered
|
|
40
|
+
*/
|
|
41
|
+
export declare function getKnownClientDid(clientName: string | undefined): string | null;
|
|
42
|
+
/**
|
|
43
|
+
* Get all known client IDs
|
|
44
|
+
*/
|
|
45
|
+
export declare function getKnownClientIds(): string[];
|
|
46
|
+
//# sourceMappingURL=known-clients.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"known-clients.d.ts","sourceRoot":"","sources":["../../src/utils/known-clients.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,WAAW,iBAAiB;IAChC,kEAAkE;IAClE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,+EAA+E;IAC/E,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CA6D/D,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,CAAC,iBAAiB,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,SAAS,CAclD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAErE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,MAAM,GAAG,IAAI,CAGf;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,EAAE,CAE5C"}
|
|
@@ -0,0 +1,114 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Known MCP Clients Registry
|
|
3
|
+
*
|
|
4
|
+
* Maps known MCP client names to their official Know That AI (KTA) DIDs.
|
|
5
|
+
* When a known client connects, we use its pre-registered DID instead of generating one.
|
|
6
|
+
*/
|
|
7
|
+
/**
|
|
8
|
+
* Registry of known MCP clients
|
|
9
|
+
*
|
|
10
|
+
* Each entry maps a canonical client ID to its configuration.
|
|
11
|
+
* The `names` array contains possible variations of the client name
|
|
12
|
+
* that might appear in the MCP initialize message's clientInfo.name field.
|
|
13
|
+
*/
|
|
14
|
+
export const KNOWN_MCP_CLIENTS = {
|
|
15
|
+
"claude-desktop": {
|
|
16
|
+
names: [
|
|
17
|
+
"Claude Desktop",
|
|
18
|
+
"claude-desktop",
|
|
19
|
+
"Claude",
|
|
20
|
+
"claude",
|
|
21
|
+
"Anthropic Claude",
|
|
22
|
+
],
|
|
23
|
+
ktaDid: null, // To be registered with Know That AI
|
|
24
|
+
displayName: "Claude Desktop",
|
|
25
|
+
vendor: "Anthropic",
|
|
26
|
+
},
|
|
27
|
+
"chatgpt": {
|
|
28
|
+
names: [
|
|
29
|
+
"ChatGPT",
|
|
30
|
+
"chatgpt",
|
|
31
|
+
"chatgpt-app",
|
|
32
|
+
"ChatGPT App",
|
|
33
|
+
"OpenAI ChatGPT",
|
|
34
|
+
],
|
|
35
|
+
ktaDid: null, // To be registered with Know That AI
|
|
36
|
+
displayName: "ChatGPT",
|
|
37
|
+
vendor: "OpenAI",
|
|
38
|
+
},
|
|
39
|
+
"mcp-inspector": {
|
|
40
|
+
names: [
|
|
41
|
+
"MCP Inspector",
|
|
42
|
+
"mcp-inspector",
|
|
43
|
+
"@anthropic/mcp-inspector",
|
|
44
|
+
"@modelcontextprotocol/inspector",
|
|
45
|
+
"Inspector",
|
|
46
|
+
],
|
|
47
|
+
ktaDid: null, // To be registered with Know That AI
|
|
48
|
+
displayName: "MCP Inspector",
|
|
49
|
+
vendor: "Anthropic",
|
|
50
|
+
},
|
|
51
|
+
cursor: {
|
|
52
|
+
names: ["Cursor", "cursor", "cursor-ai", "Cursor AI", "Cursor IDE"],
|
|
53
|
+
ktaDid: null, // To be registered with Know That AI
|
|
54
|
+
displayName: "Cursor",
|
|
55
|
+
vendor: "Cursor Inc",
|
|
56
|
+
},
|
|
57
|
+
windsurf: {
|
|
58
|
+
names: ["Windsurf", "windsurf", "Codeium Windsurf"],
|
|
59
|
+
ktaDid: null, // To be registered with Know That AI
|
|
60
|
+
displayName: "Windsurf",
|
|
61
|
+
vendor: "Codeium",
|
|
62
|
+
},
|
|
63
|
+
cline: {
|
|
64
|
+
names: ["Cline", "cline", "VS Code Cline", "vscode-cline"],
|
|
65
|
+
ktaDid: null, // To be registered with Know That AI
|
|
66
|
+
displayName: "Cline",
|
|
67
|
+
vendor: "Cline",
|
|
68
|
+
},
|
|
69
|
+
zed: {
|
|
70
|
+
names: ["Zed", "zed", "Zed Editor", "zed-editor"],
|
|
71
|
+
ktaDid: null, // To be registered with Know That AI
|
|
72
|
+
displayName: "Zed",
|
|
73
|
+
vendor: "Zed Industries",
|
|
74
|
+
},
|
|
75
|
+
};
|
|
76
|
+
/**
|
|
77
|
+
* Find a known client by name (case-insensitive)
|
|
78
|
+
*
|
|
79
|
+
* @param clientName - The client name from MCP initialize message
|
|
80
|
+
* @returns The known client config if found, undefined otherwise
|
|
81
|
+
*/
|
|
82
|
+
export function findKnownClient(clientName) {
|
|
83
|
+
if (!clientName)
|
|
84
|
+
return undefined;
|
|
85
|
+
const normalizedName = clientName.toLowerCase().trim();
|
|
86
|
+
for (const [id, config] of Object.entries(KNOWN_MCP_CLIENTS)) {
|
|
87
|
+
for (const name of config.names) {
|
|
88
|
+
if (name.toLowerCase() === normalizedName) {
|
|
89
|
+
return { ...config, id };
|
|
90
|
+
}
|
|
91
|
+
}
|
|
92
|
+
}
|
|
93
|
+
return undefined;
|
|
94
|
+
}
|
|
95
|
+
/**
|
|
96
|
+
* Check if a client name corresponds to a known client
|
|
97
|
+
*/
|
|
98
|
+
export function isKnownClient(clientName) {
|
|
99
|
+
return findKnownClient(clientName) !== undefined;
|
|
100
|
+
}
|
|
101
|
+
/**
|
|
102
|
+
* Get the DID for a known client, if registered
|
|
103
|
+
*/
|
|
104
|
+
export function getKnownClientDid(clientName) {
|
|
105
|
+
const known = findKnownClient(clientName);
|
|
106
|
+
return known?.ktaDid ?? null;
|
|
107
|
+
}
|
|
108
|
+
/**
|
|
109
|
+
* Get all known client IDs
|
|
110
|
+
*/
|
|
111
|
+
export function getKnownClientIds() {
|
|
112
|
+
return Object.keys(KNOWN_MCP_CLIENTS);
|
|
113
|
+
}
|
|
114
|
+
//# sourceMappingURL=known-clients.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"known-clients.js","sourceRoot":"","sources":["../../src/utils/known-clients.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAaH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAsC;IAClE,gBAAgB,EAAE;QAChB,KAAK,EAAE;YACL,gBAAgB;YAChB,gBAAgB;YAChB,QAAQ;YACR,QAAQ;YACR,kBAAkB;SACnB;QACD,MAAM,EAAE,IAAI,EAAE,qCAAqC;QACnD,WAAW,EAAE,gBAAgB;QAC7B,MAAM,EAAE,WAAW;KACpB;IACD,SAAS,EAAE;QACT,KAAK,EAAE;YACL,SAAS;YACT,SAAS;YACT,aAAa;YACb,aAAa;YACb,gBAAgB;SACjB;QACD,MAAM,EAAE,IAAI,EAAE,qCAAqC;QACnD,WAAW,EAAE,SAAS;QACtB,MAAM,EAAE,QAAQ;KACjB;IACD,eAAe,EAAE;QACf,KAAK,EAAE;YACL,eAAe;YACf,eAAe;YACf,0BAA0B;YAC1B,iCAAiC;YACjC,WAAW;SACZ;QACD,MAAM,EAAE,IAAI,EAAE,qCAAqC;QACnD,WAAW,EAAE,eAAe;QAC5B,MAAM,EAAE,WAAW;KACpB;IACD,MAAM,EAAE;QACN,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,CAAC;QACnE,MAAM,EAAE,IAAI,EAAE,qCAAqC;QACnD,WAAW,EAAE,QAAQ;QACrB,MAAM,EAAE,YAAY;KACrB;IACD,QAAQ,EAAE;QACR,KAAK,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,kBAAkB,CAAC;QACnD,MAAM,EAAE,IAAI,EAAE,qCAAqC;QACnD,WAAW,EAAE,UAAU;QACvB,MAAM,EAAE,SAAS;KAClB;IACD,KAAK,EAAE;QACL,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,cAAc,CAAC;QAC1D,MAAM,EAAE,IAAI,EAAE,qCAAqC;QACnD,WAAW,EAAE,OAAO;QACpB,MAAM,EAAE,OAAO;KAChB;IACD,GAAG,EAAE;QACH,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,CAAC;QACjD,MAAM,EAAE,IAAI,EAAE,qCAAqC;QACnD,WAAW,EAAE,KAAK;QAClB,MAAM,EAAE,gBAAgB;KACzB;CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,UAA8B;IAE9B,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAElC,MAAM,cAAc,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAEvD,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC7D,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAChC,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,cAAc,EAAE,CAAC;gBAC1C,OAAO,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,UAA8B;IAC1D,OAAO,eAAe,CAAC,UAAU,CAAC,KAAK,SAAS,CAAC;AACnD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAA8B;IAE9B,MAAM,KAAK,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC1C,OAAO,KAAK,EAAE,MAAM,IAAI,IAAI,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;AACxC,CAAC"}
|
|
@@ -0,0 +1,58 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* OAuth Identity Utilities
|
|
3
|
+
*
|
|
4
|
+
* Handles OAuth identity extraction and validation from HTTP requests.
|
|
5
|
+
* This module consolidates OAuth-related logic that was previously in the adapter.
|
|
6
|
+
*/
|
|
7
|
+
import type { OAuthIdentity } from "@kya-os/contracts/consent";
|
|
8
|
+
/**
|
|
9
|
+
* OAuth identity validation result
|
|
10
|
+
*/
|
|
11
|
+
export interface OAuthValidationResult {
|
|
12
|
+
valid: boolean;
|
|
13
|
+
reason?: string;
|
|
14
|
+
}
|
|
15
|
+
/**
|
|
16
|
+
* Extract OAuth identity from request cookies
|
|
17
|
+
*
|
|
18
|
+
* @param request - HTTP Request object
|
|
19
|
+
* @returns OAuthIdentity or null if not found/invalid
|
|
20
|
+
*/
|
|
21
|
+
export declare function extractOAuthIdentityFromRequest(request: Request): OAuthIdentity | null;
|
|
22
|
+
/**
|
|
23
|
+
* Validate OAuth identity format and content
|
|
24
|
+
*
|
|
25
|
+
* Ensures:
|
|
26
|
+
* - Provider is non-empty string (1-50 chars)
|
|
27
|
+
* - Subject is non-empty string (1-255 chars)
|
|
28
|
+
* - Provider matches expected format (alphanumeric, hyphens, underscores)
|
|
29
|
+
* - Subject matches expected format (non-empty, reasonable length)
|
|
30
|
+
*
|
|
31
|
+
* @param identity - Parsed OAuth identity object
|
|
32
|
+
* @returns Validation result
|
|
33
|
+
*/
|
|
34
|
+
export declare function validateOAuthIdentity(identity: unknown): OAuthValidationResult;
|
|
35
|
+
/**
|
|
36
|
+
* Lookup User DID from OAuth identity mapping
|
|
37
|
+
*
|
|
38
|
+
* @param oauthIdentity OAuth identity to lookup
|
|
39
|
+
* @param delegationStorage KV namespace for storage
|
|
40
|
+
* @returns User DID or null if not found
|
|
41
|
+
*/
|
|
42
|
+
export declare function lookupUserDidFromOAuth(oauthIdentity: OAuthIdentity, delegationStorage: any): Promise<string | null>;
|
|
43
|
+
/**
|
|
44
|
+
* Create a redacted OAuth identity for storage (PII protection)
|
|
45
|
+
*
|
|
46
|
+
* @param oauthIdentity Original OAuth identity
|
|
47
|
+
* @returns Redacted identity safe for storage
|
|
48
|
+
*/
|
|
49
|
+
export declare function redactOAuthIdentityForStorage(oauthIdentity: OAuthIdentity | null): any;
|
|
50
|
+
/**
|
|
51
|
+
* Test if an OAuth cookie value is valid
|
|
52
|
+
* Helper function for testing and debugging
|
|
53
|
+
*
|
|
54
|
+
* @param cookieValue Encoded cookie value
|
|
55
|
+
* @returns true if valid OAuth identity, false otherwise
|
|
56
|
+
*/
|
|
57
|
+
export declare function isValidOAuthCookie(cookieValue: string): boolean;
|
|
58
|
+
//# sourceMappingURL=oauth-identity.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"oauth-identity.d.ts","sourceRoot":"","sources":["../../src/utils/oauth-identity.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE/D;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,OAAO,GAAG,aAAa,GAAG,IAAI,CAoCtF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,OAAO,GAAG,qBAAqB,CAkH9E;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,aAAa,EAAE,aAAa,EAC5B,iBAAiB,EAAE,GAAG,GACrB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA+BxB;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,aAAa,EAAE,aAAa,GAAG,IAAI,GAAG,GAAG,CAUtF;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAQ/D"}
|
|
@@ -0,0 +1,215 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* OAuth Identity Utilities
|
|
3
|
+
*
|
|
4
|
+
* Handles OAuth identity extraction and validation from HTTP requests.
|
|
5
|
+
* This module consolidates OAuth-related logic that was previously in the adapter.
|
|
6
|
+
*/
|
|
7
|
+
/**
|
|
8
|
+
* Extract OAuth identity from request cookies
|
|
9
|
+
*
|
|
10
|
+
* @param request - HTTP Request object
|
|
11
|
+
* @returns OAuthIdentity or null if not found/invalid
|
|
12
|
+
*/
|
|
13
|
+
export function extractOAuthIdentityFromRequest(request) {
|
|
14
|
+
try {
|
|
15
|
+
const cookieHeader = request.headers.get("Cookie");
|
|
16
|
+
if (!cookieHeader)
|
|
17
|
+
return null;
|
|
18
|
+
const cookies = cookieHeader.split("; ").map((c) => c.trim());
|
|
19
|
+
const oauthCookie = cookies.find((c) => c.startsWith("oauth_identity="));
|
|
20
|
+
if (!oauthCookie)
|
|
21
|
+
return null;
|
|
22
|
+
// Extract cookie value properly handling cases where value contains '='
|
|
23
|
+
// Find the first '=' which separates key from value, then take everything after it
|
|
24
|
+
const equalsIndex = oauthCookie.indexOf("=");
|
|
25
|
+
if (equalsIndex === -1)
|
|
26
|
+
return null;
|
|
27
|
+
const cookieValue = oauthCookie.substring(equalsIndex + 1);
|
|
28
|
+
const parsed = JSON.parse(decodeURIComponent(cookieValue));
|
|
29
|
+
// ✅ SECURITY: Validate OAuth identity format and content
|
|
30
|
+
const validationResult = validateOAuthIdentity(parsed);
|
|
31
|
+
if (!validationResult.valid) {
|
|
32
|
+
console.warn("[OAuth] ⚠️ OAuth identity validation failed:", validationResult.reason, { parsed });
|
|
33
|
+
return null;
|
|
34
|
+
}
|
|
35
|
+
return parsed;
|
|
36
|
+
}
|
|
37
|
+
catch (error) {
|
|
38
|
+
console.warn("[OAuth] Failed to extract OAuth identity from cookies:", error);
|
|
39
|
+
}
|
|
40
|
+
return null;
|
|
41
|
+
}
|
|
42
|
+
/**
|
|
43
|
+
* Validate OAuth identity format and content
|
|
44
|
+
*
|
|
45
|
+
* Ensures:
|
|
46
|
+
* - Provider is non-empty string (1-50 chars)
|
|
47
|
+
* - Subject is non-empty string (1-255 chars)
|
|
48
|
+
* - Provider matches expected format (alphanumeric, hyphens, underscores)
|
|
49
|
+
* - Subject matches expected format (non-empty, reasonable length)
|
|
50
|
+
*
|
|
51
|
+
* @param identity - Parsed OAuth identity object
|
|
52
|
+
* @returns Validation result
|
|
53
|
+
*/
|
|
54
|
+
export function validateOAuthIdentity(identity) {
|
|
55
|
+
// Check if identity is an object
|
|
56
|
+
if (!identity || typeof identity !== "object") {
|
|
57
|
+
return { valid: false, reason: "OAuth identity must be an object" };
|
|
58
|
+
}
|
|
59
|
+
const oauth = identity;
|
|
60
|
+
// Validate provider
|
|
61
|
+
if (!oauth.provider || typeof oauth.provider !== "string") {
|
|
62
|
+
return {
|
|
63
|
+
valid: false,
|
|
64
|
+
reason: "OAuth provider is required and must be a string",
|
|
65
|
+
};
|
|
66
|
+
}
|
|
67
|
+
const provider = oauth.provider.trim();
|
|
68
|
+
if (provider.length === 0) {
|
|
69
|
+
return { valid: false, reason: "OAuth provider cannot be empty" };
|
|
70
|
+
}
|
|
71
|
+
if (provider.length > 50) {
|
|
72
|
+
return {
|
|
73
|
+
valid: false,
|
|
74
|
+
reason: "OAuth provider must be 50 characters or less",
|
|
75
|
+
};
|
|
76
|
+
}
|
|
77
|
+
// Provider format: alphanumeric, hyphens, underscores, dots (e.g., "google", "microsoft", "github", "custom-provider")
|
|
78
|
+
const providerPattern = /^[a-zA-Z0-9._-]+$/;
|
|
79
|
+
if (!providerPattern.test(provider)) {
|
|
80
|
+
return {
|
|
81
|
+
valid: false,
|
|
82
|
+
reason: `OAuth provider must match pattern [a-zA-Z0-9._-]: "${provider}"`,
|
|
83
|
+
};
|
|
84
|
+
}
|
|
85
|
+
// Validate subject
|
|
86
|
+
if (!oauth.subject || typeof oauth.subject !== "string") {
|
|
87
|
+
return {
|
|
88
|
+
valid: false,
|
|
89
|
+
reason: "OAuth subject is required and must be a string",
|
|
90
|
+
};
|
|
91
|
+
}
|
|
92
|
+
const subject = oauth.subject.trim();
|
|
93
|
+
if (subject.length === 0) {
|
|
94
|
+
return { valid: false, reason: "OAuth subject cannot be empty" };
|
|
95
|
+
}
|
|
96
|
+
if (subject.length > 255) {
|
|
97
|
+
return {
|
|
98
|
+
valid: false,
|
|
99
|
+
reason: "OAuth subject must be 255 characters or less",
|
|
100
|
+
};
|
|
101
|
+
}
|
|
102
|
+
// Subject format: non-empty, reasonable characters (allows most Unicode, but prevents control chars)
|
|
103
|
+
// OAuth subjects can be numeric IDs, email-like strings, or other identifiers
|
|
104
|
+
const subjectPattern = /^[\S]+$/; // At least one non-whitespace character
|
|
105
|
+
if (!subjectPattern.test(subject)) {
|
|
106
|
+
return {
|
|
107
|
+
valid: false,
|
|
108
|
+
reason: `OAuth subject contains invalid characters: "${subject.substring(0, 20)}..."`,
|
|
109
|
+
};
|
|
110
|
+
}
|
|
111
|
+
// Validate optional email if present
|
|
112
|
+
if (oauth.email !== undefined) {
|
|
113
|
+
if (typeof oauth.email !== "string") {
|
|
114
|
+
return {
|
|
115
|
+
valid: false,
|
|
116
|
+
reason: "OAuth email must be a string if provided",
|
|
117
|
+
};
|
|
118
|
+
}
|
|
119
|
+
const email = oauth.email.trim();
|
|
120
|
+
if (email.length > 0) {
|
|
121
|
+
// Basic email format validation
|
|
122
|
+
const emailPattern = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
|
|
123
|
+
if (!emailPattern.test(email)) {
|
|
124
|
+
return {
|
|
125
|
+
valid: false,
|
|
126
|
+
reason: `OAuth email format invalid: "${email}"`,
|
|
127
|
+
};
|
|
128
|
+
}
|
|
129
|
+
if (email.length > 255) {
|
|
130
|
+
return {
|
|
131
|
+
valid: false,
|
|
132
|
+
reason: "OAuth email must be 255 characters or less",
|
|
133
|
+
};
|
|
134
|
+
}
|
|
135
|
+
}
|
|
136
|
+
}
|
|
137
|
+
// Validate optional name if present
|
|
138
|
+
if (oauth.name !== undefined) {
|
|
139
|
+
if (typeof oauth.name !== "string") {
|
|
140
|
+
return {
|
|
141
|
+
valid: false,
|
|
142
|
+
reason: "OAuth name must be a string if provided",
|
|
143
|
+
};
|
|
144
|
+
}
|
|
145
|
+
if (oauth.name.length > 255) {
|
|
146
|
+
return {
|
|
147
|
+
valid: false,
|
|
148
|
+
reason: "OAuth name must be 255 characters or less",
|
|
149
|
+
};
|
|
150
|
+
}
|
|
151
|
+
}
|
|
152
|
+
return { valid: true };
|
|
153
|
+
}
|
|
154
|
+
/**
|
|
155
|
+
* Lookup User DID from OAuth identity mapping
|
|
156
|
+
*
|
|
157
|
+
* @param oauthIdentity OAuth identity to lookup
|
|
158
|
+
* @param delegationStorage KV namespace for storage
|
|
159
|
+
* @returns User DID or null if not found
|
|
160
|
+
*/
|
|
161
|
+
export async function lookupUserDidFromOAuth(oauthIdentity, delegationStorage) {
|
|
162
|
+
if (!delegationStorage || !oauthIdentity?.provider || !oauthIdentity?.subject) {
|
|
163
|
+
return null;
|
|
164
|
+
}
|
|
165
|
+
try {
|
|
166
|
+
const { STORAGE_KEYS } = await import("../constants/storage-keys");
|
|
167
|
+
const oauthKey = STORAGE_KEYS.oauthIdentity(oauthIdentity.provider, oauthIdentity.subject);
|
|
168
|
+
const userDid = await delegationStorage.get(oauthKey, "text");
|
|
169
|
+
if (userDid) {
|
|
170
|
+
console.log("[OAuth] ✅ Retrieved persistent userDid from OAuth mapping:", {
|
|
171
|
+
provider: oauthIdentity.provider,
|
|
172
|
+
userDid: userDid.slice(0, 20) + "...",
|
|
173
|
+
});
|
|
174
|
+
}
|
|
175
|
+
return userDid;
|
|
176
|
+
}
|
|
177
|
+
catch (error) {
|
|
178
|
+
console.warn("[OAuth] Failed to lookup userDid from OAuth mapping:", error);
|
|
179
|
+
return null;
|
|
180
|
+
}
|
|
181
|
+
}
|
|
182
|
+
/**
|
|
183
|
+
* Create a redacted OAuth identity for storage (PII protection)
|
|
184
|
+
*
|
|
185
|
+
* @param oauthIdentity Original OAuth identity
|
|
186
|
+
* @returns Redacted identity safe for storage
|
|
187
|
+
*/
|
|
188
|
+
export function redactOAuthIdentityForStorage(oauthIdentity) {
|
|
189
|
+
if (!oauthIdentity) {
|
|
190
|
+
return undefined;
|
|
191
|
+
}
|
|
192
|
+
return {
|
|
193
|
+
provider: oauthIdentity.provider,
|
|
194
|
+
subjectHash: oauthIdentity.subject.substring(0, 8), // Redact full subject
|
|
195
|
+
// Don't store email, name, or full subject for PII protection
|
|
196
|
+
};
|
|
197
|
+
}
|
|
198
|
+
/**
|
|
199
|
+
* Test if an OAuth cookie value is valid
|
|
200
|
+
* Helper function for testing and debugging
|
|
201
|
+
*
|
|
202
|
+
* @param cookieValue Encoded cookie value
|
|
203
|
+
* @returns true if valid OAuth identity, false otherwise
|
|
204
|
+
*/
|
|
205
|
+
export function isValidOAuthCookie(cookieValue) {
|
|
206
|
+
try {
|
|
207
|
+
const parsed = JSON.parse(decodeURIComponent(cookieValue));
|
|
208
|
+
const result = validateOAuthIdentity(parsed);
|
|
209
|
+
return result.valid;
|
|
210
|
+
}
|
|
211
|
+
catch {
|
|
212
|
+
return false;
|
|
213
|
+
}
|
|
214
|
+
}
|
|
215
|
+
//# sourceMappingURL=oauth-identity.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"oauth-identity.js","sourceRoot":"","sources":["../../src/utils/oauth-identity.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAYH;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAAC,OAAgB;IAC9D,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC;QAE/B,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9D,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QAE9B,wEAAwE;QACxE,mFAAmF;QACnF,MAAM,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,WAAW,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,WAAW,GAAG,WAAW,CAAC,SAAS,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAC;QAE3D,yDAAyD;QACzD,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CACV,8CAA8C,EAC9C,gBAAgB,CAAC,MAAM,EACvB,EAAE,MAAM,EAAE,CACX,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,MAAuB,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CACV,wDAAwD,EACxD,KAAK,CACN,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAiB;IACrD,iCAAiC;IACjC,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;IACtE,CAAC;IAED,MAAM,KAAK,GAAG,QAAmC,CAAC;IAElD,oBAAoB;IACpB,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,iDAAiD;SAC1D,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IACpE,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACzB,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,8CAA8C;SACvD,CAAC;IACJ,CAAC;IAED,uHAAuH;IACvH,MAAM,eAAe,GAAG,mBAAmB,CAAC;IAC5C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,sDAAsD,QAAQ,GAAG;SAC1E,CAAC;IACJ,CAAC;IAED,mBAAmB;IACnB,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACxD,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,gDAAgD;SACzD,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;IACnE,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACzB,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,8CAA8C;SACvD,CAAC;IACJ,CAAC;IAED,qGAAqG;IACrG,8EAA8E;IAC9E,MAAM,cAAc,GAAG,SAAS,CAAC,CAAC,wCAAwC;IAC1E,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,+CAA+C,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM;SACtF,CAAC;IACJ,CAAC;IAED,qCAAqC;IACrC,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,0CAA0C;aACnD,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,gCAAgC;YAChC,MAAM,YAAY,GAAG,4BAA4B,CAAC;YAClD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9B,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,gCAAgC,KAAK,GAAG;iBACjD,CAAC;YACJ,CAAC;YAED,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBACvB,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,4CAA4C;iBACrD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,oCAAoC;IACpC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,yCAAyC;aAClD,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC5B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,2CAA2C;aACpD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,aAA4B,EAC5B,iBAAsB;IAEtB,IAAI,CAAC,iBAAiB,IAAI,CAAC,aAAa,EAAE,QAAQ,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,aAAa,CACzC,aAAa,CAAC,QAAQ,EACtB,aAAa,CAAC,OAAO,CACtB,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAE9D,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,CACT,4DAA4D,EAC5D;gBACE,QAAQ,EAAE,aAAa,CAAC,QAAQ;gBAChC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;aACtC,CACF,CAAC;QACJ,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CACV,sDAAsD,EACtD,KAAK,CACN,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAAC,aAAmC;IAC/E,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,aAAa,CAAC,QAAQ;QAChC,WAAW,EAAE,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,sBAAsB;QAC1E,8DAA8D;KAC/D,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAmB;IACpD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC7C,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
|