@kya-os/mcp-i-core 1.7.0 → 1.8.1

package/dist/services/oauth-service.js

@@ -1,442 +0,0 @@
-"use strict";
-/**
- * OAuth Service
- *
- * Handles OAuth token exchange and refresh using PKCE (Proof Key for Code Exchange).
- * Supports both direct PKCE exchange with OAuth providers and proxy mode via AgentShield.
- *
- * MCP-I Provider Registry Model:
- * - Client secrets are NOT sent via the API response
- * - Agents receive metadata.clientSecretName from AgentShield
- * - Secrets are resolved at runtime from secure storage (Cloudflare Worker env)
- * - The SecretResolver interface enables platform-specific secret resolution
- *
- * @package @kya-os/mcp-i-core
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.OAuthService = exports.defaultSecretResolver = void 0;
-/**
- * Default secret resolver that uses environment variables
- * Used when no custom resolver is provided
- */
-exports.defaultSecretResolver = {
-    async resolveSecret(secretName) {
-        // For Node.js environments, check process.env
-        if (typeof process !== "undefined" && process.env) {
-            return process.env[secretName];
-        }
-        return undefined;
-    },
-};
-/**
- * Service for OAuth token exchange and refresh
- */
-class OAuthService {
-    config;
-    constructor(config) {
-        this.config = {
-            configService: config.configService,
-            fetchProvider: config.fetchProvider,
-            agentShieldApiUrl: config.agentShieldApiUrl,
-            agentShieldApiKey: config.agentShieldApiKey,
-            projectId: config.projectId,
-            logger: config.logger || (() => { }),
-            secretResolver: config.secretResolver || exports.defaultSecretResolver,
-        };
-    }
-    /**
-     * Resolve client secret for a provider using the MCP-I provider-registry model
-     *
-     * Resolution order:
-     * 1. If metadata.clientSecretName exists, resolve from secure storage
-     * 2. Fall back to clientSecret field (legacy/backward compatibility)
-     *
-     * @param providerConfig - The OAuth provider configuration
-     * @returns The resolved client secret, or undefined if not available
-     */
-    async resolveClientSecret(providerConfig) {
-        // MCP-I Provider Registry model: resolve secret by name
-        if (providerConfig.metadata?.clientSecretName) {
-            const secretName = providerConfig.metadata.clientSecretName;
-            this.config.logger("[OAuthService] Resolving client secret by name", {
-                secretName,
-                version: providerConfig.metadata.clientSecretVersion,
-            });
-            const secret = await this.config.secretResolver.resolveSecret(secretName);
-            if (secret) {
-                this.config.logger("[OAuthService] Client secret resolved successfully", {
-                    secretName,
-                });
-                return secret;
-            }
-            this.config.logger("[OAuthService] Client secret not found in secure storage", {
-                secretName,
-            });
-            // Fall through to try clientSecret field
-        }
-        // Legacy model: use clientSecret directly (if provided)
-        // DEPRECATED: This path is for backward compatibility only
-        // New deployments should use metadata.clientSecretName with secure storage
-        if (providerConfig.clientSecret) {
-            this.config.logger("[OAuthService] DEPRECATED: Using legacy clientSecret field - " +
-                "migrate to metadata.clientSecretName for better security", {
-                telemetry: {
-                    event: "oauth.deprecated_client_secret_used",
-                    hasMetadata: !!providerConfig.metadata,
-                    hasSecretName: !!providerConfig.metadata?.clientSecretName,
-                },
-            });
-            return providerConfig.clientSecret;
-        }
-        return undefined;
-    }
-    /**
-     * Exchange authorization code for IDP tokens using PKCE
-     *
-     * For PKCE providers: Exchanges code directly with OAuth provider (no client secret)
-     * For proxy mode: Exchanges code via AgentShield API
-     *
-     * @param provider - OAuth provider name (e.g., "github", "google")
-     * @param code - Authorization code from OAuth callback
-     * @param codeVerifier - PKCE code verifier (optional for non-PKCE providers in proxy mode)
-     * @param redirectUri - Redirect URI used in authorization request
-     * @returns IDP tokens (access_token, refresh_token, expires_at, etc.)
-     */
-    async exchangeToken(provider, code, codeVerifier, redirectUri) {
-        // Fetch provider config
-        const oauthConfig = await this.config.configService.getOAuthConfig(this.config.projectId);
-        const providerConfig = oauthConfig.providers[provider];
-        if (!providerConfig) {
-            throw new Error(`Provider "${provider}" not configured for project "${this.config.projectId}"`);
-        }
-        // For PKCE providers, require codeVerifier
-        if (providerConfig.supportsPKCE && !providerConfig.proxyMode) {
-            if (!codeVerifier) {
-                throw new Error(`Provider "${provider}" requires PKCE code_verifier for token exchange`);
-            }
-            return this.exchangeTokenPKCE(providerConfig, code, codeVerifier, redirectUri || "");
-        }
-        // For proxy mode, codeVerifier is optional (only included if PKCE is supported)
-        if (providerConfig.proxyMode) {
-            return this.exchangeTokenProxy(providerConfig, code, codeVerifier, redirectUri || "");
-        }
-        throw new Error(`Provider "${provider}" configuration is invalid: must support PKCE or use proxy mode`);
-    }
-    /**
-     * Exchange token directly with OAuth provider using PKCE
-     */
-    async exchangeTokenPKCE(providerConfig, code, codeVerifier, redirectUri) {
-        // Resolve client secret using MCP-I provider-registry model
-        const clientSecret = await this.resolveClientSecret(providerConfig);
-        this.config.logger("[OAuthService] Exchanging token with PKCE", {
-            provider: providerConfig.authorizationUrl,
-            tokenUrl: providerConfig.tokenUrl,
-            hasClientSecret: !!clientSecret,
-            resolvedViaSecretName: !!providerConfig.metadata?.clientSecretName,
-        });
-        // Build token exchange parameters
-        // Note: GitHub OAuth Apps require client_secret even with PKCE
-        // (GitHub Apps can use PKCE without client_secret, but OAuth Apps cannot)
-        const params = {
-            grant_type: "authorization_code",
-            code,
-            redirect_uri: redirectUri,
-            client_id: providerConfig.clientId,
-            code_verifier: codeVerifier,
-        };
-        // Include client_secret if resolved (either from secure storage or legacy field)
-        // This is required for GitHub OAuth Apps and other providers that need it
-        if (clientSecret) {
-            params.client_secret = clientSecret;
-        }
-        const response = await this.config.fetchProvider.fetch(providerConfig.tokenUrl, {
-            method: "POST",
-            headers: {
-                "Content-Type": "application/x-www-form-urlencoded",
-                Accept: "application/json",
-            },
-            body: new URLSearchParams(params).toString(),
-        });
-        if (!response.ok) {
-            const errorText = await response.text().catch(() => "Unknown error");
-            let errorData;
-            try {
-                errorData = JSON.parse(errorText);
-            }
-            catch {
-                errorData = { error: errorText };
-            }
-            const errorMessage = errorData.error_description || errorData.error || errorText;
-            this.config.logger("[OAuthService] Token exchange failed", {
-                status: response.status,
-                error: errorMessage,
-                provider: providerConfig.tokenUrl,
-            });
-            throw new Error(`Token exchange failed: ${errorMessage} (${response.status})`);
-        }
-        const tokens = await response.json();
-        // GitHub returns errors with 200 status - check for error field first
-        if (tokens.error) {
-            this.config.logger("[OAuthService] Token exchange returned error (200 status)", {
-                error: tokens.error,
-                errorDescription: tokens.error_description,
-                errorUri: tokens.error_uri,
-                provider: providerConfig.tokenUrl,
-                responseKeys: Object.keys(tokens),
-            });
-            throw new Error(`Token exchange failed: ${tokens.error_description || tokens.error}`);
-        }
-        // Validate required fields
-        if (!tokens.access_token) {
-            this.config.logger("[OAuthService] Token response missing access_token", {
-                responseKeys: Object.keys(tokens),
-                provider: providerConfig.tokenUrl,
-            });
-            throw new Error("Token response missing access_token");
-        }
-        // Calculate expiration timestamp
-        const expiresIn = tokens.expires_in || 3600; // Default 1 hour
-        const expiresAt = Date.now() + expiresIn * 1000;
-        const idpTokens = {
-            access_token: tokens.access_token,
-            refresh_token: tokens.refresh_token,
-            expires_in: expiresIn,
-            expires_at: expiresAt,
-            token_type: tokens.token_type || "Bearer",
-            scope: tokens.scope,
-        };
-        this.config.logger("[OAuthService] Token exchange successful", {
-            provider: providerConfig.tokenUrl,
-            expiresAt: new Date(expiresAt).toISOString(),
-            hasRefreshToken: !!idpTokens.refresh_token,
-        });
-        return idpTokens;
-    }
-    /**
-     * Exchange token via AgentShield proxy (for providers that require proxy mode)
-     *
-     * Note: For Phase 3 two-step flow, OAuth tokens are retrieved separately via
-     * OAuthTokenRetrievalService in the callback handler. This method maintains
-     * backward compatibility for direct proxy mode usage.
-     */
-    async exchangeTokenProxy(providerConfig, code, codeVerifier, redirectUri) {
-        // Exchange via AgentShield proxy endpoint
-        const proxyUrl = `${this.config.agentShieldApiUrl}/api/v1/oauth/token`;
-        this.config.logger("[OAuthService] Exchanging token via proxy", {
-            proxyUrl,
-            provider: providerConfig.authorizationUrl,
-            hasCodeVerifier: !!codeVerifier,
-            supportsPKCE: providerConfig.supportsPKCE,
-        });
-        // Build request body - only include code_verifier if PKCE is supported and provided
-        const requestBody = {
-            grant_type: "authorization_code",
-            code,
-            redirect_uri: redirectUri || "",
-            provider: providerConfig.authorizationUrl,
-            project_id: this.config.projectId,
-        };
-        // Include code_verifier only if provider supports PKCE and verifier is provided
-        if (providerConfig.supportsPKCE && codeVerifier) {
-            requestBody.code_verifier = codeVerifier;
-        }
-        const response = await this.config.fetchProvider.fetch(proxyUrl, {
-            method: "POST",
-            headers: {
-                "Content-Type": "application/json",
-                Authorization: `Bearer ${this.config.agentShieldApiKey}`,
-            },
-            body: JSON.stringify(requestBody),
-        });
-        if (!response.ok) {
-            const errorText = await response.text().catch(() => "Unknown error");
-            let errorData;
-            try {
-                errorData = JSON.parse(errorText);
-            }
-            catch {
-                errorData = { error: errorText };
-            }
-            const errorMessage = errorData.error_description || errorData.error || errorText;
-            this.config.logger("[OAuthService] Proxy token exchange failed", {
-                status: response.status,
-                error: errorMessage,
-                proxyUrl,
-            });
-            throw new Error(`Proxy token exchange failed: ${errorMessage} (${response.status})`);
-        }
-        const result = await response.json();
-        const tokens = result.data || result;
-        // Validate required fields
-        if (!tokens.access_token) {
-            throw new Error("Proxy token response missing access_token");
-        }
-        // Calculate expiration timestamp
-        const expiresIn = tokens.expires_in || 3600; // Default 1 hour
-        const expiresAt = Date.now() + expiresIn * 1000;
-        const idpTokens = {
-            access_token: tokens.access_token,
-            refresh_token: tokens.refresh_token,
-            expires_in: expiresIn,
-            expires_at: expiresAt,
-            token_type: tokens.token_type || "Bearer",
-            scope: tokens.scope,
-        };
-        this.config.logger("[OAuthService] Proxy token exchange successful", {
-            proxyUrl,
-            expiresAt: new Date(expiresAt).toISOString(),
-            hasRefreshToken: !!idpTokens.refresh_token,
-        });
-        return idpTokens;
-    }
-    /**
-     * Refresh IDP access token using refresh token
-     *
-     * For PKCE providers: Refreshes directly with OAuth provider
-     * For proxy mode: Refreshes via AgentShield API
-     *
-     * @param provider - OAuth provider name
-     * @param refreshToken - Refresh token from previous token exchange
-     * @returns New IDP tokens or null if refresh failed
-     */
-    async refreshToken(provider, refreshToken) {
-        // Fetch provider config
-        const oauthConfig = await this.config.configService.getOAuthConfig(this.config.projectId);
-        const providerConfig = oauthConfig.providers[provider];
-        if (!providerConfig) {
-            this.config.logger("[OAuthService] Provider not found for refresh", {
-                provider,
-            });
-            return null;
-        }
-        // For PKCE providers, refresh directly with OAuth provider
-        if (providerConfig.supportsPKCE && !providerConfig.proxyMode) {
-            return this.refreshTokenPKCE(providerConfig, refreshToken);
-        }
-        // For proxy mode, refresh via AgentShield
-        if (providerConfig.proxyMode) {
-            return this.refreshTokenProxy(providerConfig, refreshToken);
-        }
-        return null;
-    }
-    /**
-     * Refresh token directly with OAuth provider using PKCE
-     */
-    async refreshTokenPKCE(providerConfig, refreshToken) {
-        this.config.logger("[OAuthService] Refreshing token with PKCE", {
-            provider: providerConfig.tokenUrl,
-        });
-        try {
-            const response = await this.config.fetchProvider.fetch(providerConfig.tokenUrl, {
-                method: "POST",
-                headers: {
-                    "Content-Type": "application/x-www-form-urlencoded",
-                    Accept: "application/json",
-                },
-                body: new URLSearchParams({
-                    grant_type: "refresh_token",
-                    refresh_token: refreshToken,
-                    client_id: providerConfig.clientId,
-                }).toString(),
-            });
-            if (!response.ok) {
-                this.config.logger("[OAuthService] Token refresh failed", {
-                    status: response.status,
-                    provider: providerConfig.tokenUrl,
-                });
-                return null;
-            }
-            const tokens = await response.json();
-            if (!tokens.access_token) {
-                this.config.logger("[OAuthService] Token refresh response missing access_token");
-                return null;
-            }
-            // Calculate expiration timestamp
-            const expiresIn = tokens.expires_in || 3600; // Default 1 hour
-            const expiresAt = Date.now() + expiresIn * 1000;
-            const idpTokens = {
-                access_token: tokens.access_token,
-                refresh_token: tokens.refresh_token || refreshToken, // Use new refresh token if provided, otherwise keep old one
-                expires_in: expiresIn,
-                expires_at: expiresAt,
-                token_type: tokens.token_type || "Bearer",
-                scope: tokens.scope,
-            };
-            this.config.logger("[OAuthService] Token refresh successful", {
-                provider: providerConfig.tokenUrl,
-                expiresAt: new Date(expiresAt).toISOString(),
-            });
-            return idpTokens;
-        }
-        catch (error) {
-            this.config.logger("[OAuthService] Token refresh error", {
-                error: error instanceof Error ? error.message : String(error),
-                provider: providerConfig.tokenUrl,
-            });
-            return null;
-        }
-    }
-    /**
-     * Refresh token via AgentShield proxy
-     */
-    async refreshTokenProxy(providerConfig, refreshToken) {
-        const proxyUrl = `${this.config.agentShieldApiUrl}/api/v1/oauth/token`;
-        this.config.logger("[OAuthService] Refreshing token via proxy", {
-            proxyUrl,
-            provider: providerConfig.authorizationUrl,
-        });
-        try {
-            const response = await this.config.fetchProvider.fetch(proxyUrl, {
-                method: "POST",
-                headers: {
-                    "Content-Type": "application/json",
-                    Authorization: `Bearer ${this.config.agentShieldApiKey}`,
-                },
-                body: JSON.stringify({
-                    grant_type: "refresh_token",
-                    refresh_token: refreshToken,
-                    provider: providerConfig.authorizationUrl,
-                    project_id: this.config.projectId,
-                }),
-            });
-            if (!response.ok) {
-                this.config.logger("[OAuthService] Proxy token refresh failed", {
-                    status: response.status,
-                    proxyUrl,
-                });
-                return null;
-            }
-            const result = await response.json();
-            const tokens = result.data || result;
-            if (!tokens.access_token) {
-                this.config.logger("[OAuthService] Proxy token refresh response missing access_token");
-                return null;
-            }
-            // Calculate expiration timestamp
-            const expiresIn = tokens.expires_in || 3600; // Default 1 hour
-            const expiresAt = Date.now() + expiresIn * 1000;
-            const idpTokens = {
-                access_token: tokens.access_token,
-                refresh_token: tokens.refresh_token || refreshToken,
-                expires_in: expiresIn,
-                expires_at: expiresAt,
-                token_type: tokens.token_type || "Bearer",
-                scope: tokens.scope,
-            };
-            this.config.logger("[OAuthService] Proxy token refresh successful", {
-                proxyUrl,
-                expiresAt: new Date(expiresAt).toISOString(),
-            });
-            return idpTokens;
-        }
-        catch (error) {
-            this.config.logger("[OAuthService] Proxy token refresh error", {
-                error: error instanceof Error ? error.message : String(error),
-                proxyUrl,
-            });
-            return null;
-        }
-    }
-}
-exports.OAuthService = OAuthService;
-//# sourceMappingURL=oauth-service.js.map

package/dist/services/oauth-token-retrieval.service.d.ts

@@ -1,49 +0,0 @@
-/**
- * OAuth Token Retrieval Service
- *
- * Retrieves OAuth tokens from AgentShield after receiving delegation token.
- * Implements the two-step token flow for Phase 3 custom IDP support.
- *
- * @package @kya-os/mcp-i-core
- */
-import type { IdpTokens } from "@kya-os/contracts/config";
-/**
- * Configuration for OAuthTokenRetrievalService
- */
-export interface OAuthTokenRetrievalServiceConfig {
-    /** AgentShield API base URL */
-    baseUrl: string;
-    /** Fetch implementation */
-    fetchProvider: typeof fetch;
-    /** Optional logger callback */
-    logger?: (message: string, data?: any) => void;
-    /** Optional retry configuration */
-    retryConfig?: {
-        maxRetries?: number;
-        retryDelay?: number;
-        retryBackoff?: number;
-    };
-}
-/**
- * Service for retrieving OAuth tokens from AgentShield
- */
-export declare class OAuthTokenRetrievalService {
-    private config;
-    constructor(config: OAuthTokenRetrievalServiceConfig);
-    /**
-     * Retrieve OAuth tokens from AgentShield
-     *
-     * @param delegationId - Delegation ID from token exchange response
-     * @param delegationToken - Delegation token (JWT) for authorization
-     * @returns OAuth tokens mapped to IdpTokens format, or null if unavailable
-     */
-    retrieveTokens(delegationId: string, delegationToken: string): Promise<IdpTokens | null>;
-    /**
-     * Map AgentShield response to IdpTokens format
-     *
-     * @param data - Response data from AgentShield
-     * @returns IdpTokens object
-     */
-    private mapToIdpTokens;
-}
-//# sourceMappingURL=oauth-token-retrieval.service.d.ts.map

package/dist/services/oauth-token-retrieval.service.js

@@ -1,150 +0,0 @@
-"use strict";
-/**
- * OAuth Token Retrieval Service
- *
- * Retrieves OAuth tokens from AgentShield after receiving delegation token.
- * Implements the two-step token flow for Phase 3 custom IDP support.
- *
- * @package @kya-os/mcp-i-core
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.OAuthTokenRetrievalService = void 0;
-/**
- * Service for retrieving OAuth tokens from AgentShield
- */
-class OAuthTokenRetrievalService {
-    config;
-    constructor(config) {
-        const defaultRetryConfig = {
-            maxRetries: 3,
-            retryDelay: 1000,
-            retryBackoff: 2,
-        };
-        this.config = {
-            ...config,
-            logger: config.logger || (() => { }),
-            retryConfig: {
-                ...defaultRetryConfig,
-                ...config.retryConfig,
-            },
-        };
-    }
-    /**
-     * Retrieve OAuth tokens from AgentShield
-     *
-     * @param delegationId - Delegation ID from token exchange response
-     * @param delegationToken - Delegation token (JWT) for authorization
-     * @returns OAuth tokens mapped to IdpTokens format, or null if unavailable
-     */
-    async retrieveTokens(delegationId, delegationToken) {
-        const endpoint = `${this.config.baseUrl}/api/v1/bouncer/delegations/${delegationId}/tokens`;
-        this.config.logger("[OAuthTokenRetrievalService] Retrieving OAuth tokens", {
-            delegationId,
-            endpoint,
-        });
-        let lastError = null;
-        let attempt = 0;
-        // Retry logic for transient failures
-        while (attempt <= this.config.retryConfig.maxRetries) {
-            try {
-                const response = await this.config.fetchProvider(endpoint, {
-                    method: "GET",
-                    headers: {
-                        Authorization: `Bearer ${delegationToken}`,
-                        Accept: "application/json",
-                    },
-                });
-                if (!response.ok) {
-                    const errorData = await response.json().catch(() => ({}));
-                    if (response.status === 404 || response.status === 401) {
-                        // Token unavailable or unauthorized - don't retry
-                        this.config.logger("[OAuthTokenRetrievalService] Tokens unavailable", {
-                            status: response.status,
-                            delegationId,
-                            error: errorData,
-                        });
-                        return null;
-                    }
-                    // Transient error - retry
-                    const errorMessage = errorData.error?.message ||
-                        errorData.error ||
-                        errorData.message ||
-                        `HTTP ${response.status}`;
-                    throw new Error(`Token retrieval failed: ${errorMessage}`);
-                }
-                const result = (await response.json());
-                if (!result.success) {
-                    this.config.logger("[OAuthTokenRetrievalService] Token retrieval error response", {
-                        delegationId,
-                        error: result.error,
-                    });
-                    return null;
-                }
-                // Map response to IdpTokens format
-                const tokens = this.mapToIdpTokens(result.data);
-                this.config.logger("[OAuthTokenRetrievalService] OAuth tokens retrieved successfully", {
-                    delegationId,
-                    expiresAt: new Date(tokens.expires_at).toISOString(),
-                    hasRefreshToken: !!tokens.refresh_token,
-                });
-                return tokens;
-            }
-            catch (error) {
-                lastError = error instanceof Error ? error : new Error(String(error));
-                if (attempt < this.config.retryConfig.maxRetries) {
-                    const delay = this.config.retryConfig.retryDelay *
-                        Math.pow(this.config.retryConfig.retryBackoff, attempt);
-                    this.config.logger("[OAuthTokenRetrievalService] Retry attempt failed, retrying", {
-                        attempt: attempt + 1,
-                        maxRetries: this.config.retryConfig.maxRetries,
-                        delay,
-                        error: lastError.message,
-                    });
-                    await new Promise((resolve) => setTimeout(resolve, delay));
-                    attempt++;
-                }
-                else {
-                    // Max retries exceeded
-                    this.config.logger("[OAuthTokenRetrievalService] Max retries exceeded", {
-                        delegationId,
-                        error: lastError.message,
-                        attempts: attempt + 1,
-                    });
-                    // Return null instead of throwing - delegation token still valid
-                    return null;
-                }
-            }
-        }
-        return null;
-    }
-    /**
-     * Map AgentShield response to IdpTokens format
-     *
-     * @param data - Response data from AgentShield
-     * @returns IdpTokens object
-     */
-    mapToIdpTokens(data) {
-        // Convert ISO 8601 string to milliseconds timestamp
-        let expiresAt;
-        if (data.oauth_expires_at) {
-            expiresAt = new Date(data.oauth_expires_at).getTime();
-        }
-        else if (data.oauth_expires_in) {
-            expiresAt = Date.now() + data.oauth_expires_in * 1000;
-        }
-        else {
-            // Default to 1 hour if neither provided
-            expiresAt = Date.now() + 3600 * 1000;
-        }
-        return {
-            access_token: data.oauth_access_token,
-            refresh_token: data.oauth_refresh_token || undefined,
-            expires_in: data.oauth_expires_in || undefined,
-            expires_at: expiresAt,
-            token_type: data.oauth_token_type || "Bearer",
-            scope: data.oauth_scope || undefined,
-        };
-    }
-}
-exports.OAuthTokenRetrievalService = OAuthTokenRetrievalService;
-//# sourceMappingURL=oauth-token-retrieval.service.js.map