@littlebearapps/outlook-assistant 3.3.0

package/auth/oauth-server.js

@@ -0,0 +1,233 @@
+const _express = require('express'); // Reserved for future HTTPS support
+const querystring = require('querystring');
+const _https = require('https'); // Reserved for future HTTPS support
+const _fs = require('fs'); // Reserved for future HTTPS support
+const crypto = require('crypto'); // Added for generating random string
+const TokenStorage = require('./token-storage'); // Assuming TokenStorage is in the same directory
+
+// HTML templates
+function escapeHtml(unsafe) {
+  return unsafe
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#039;');
+}
+
+const templates = {
+  authError: (error, errorDescription) => `
+    <html>
+      <body style="font-family: Arial, sans-serif; text-align: center; margin-top: 50px;">
+        <h1 style="color: #e74c3c;">❌ Authorization Failed</h1>
+        <p><strong>Error:</strong> ${escapeHtml(error)}</p>
+        ${errorDescription ? `<p><strong>Description:</strong> ${escapeHtml(errorDescription)}</p>` : ''}
+        <p>You can close this window and try again.</p>
+      </body>
+    </html>`,
+  authSuccess: `
+    <html>
+      <body style="font-family: Arial, sans-serif; text-align: center; margin-top: 50px;">
+        <h1 style="color: #2ecc71;">&#10003; Authentication Successful</h1>
+        <p>You have successfully authenticated with Microsoft Graph API.</p>
+        <p>You can close this window and return to your AI assistant.</p>
+      </body>
+    </html>`,
+  tokenExchangeError: (error) => `
+    <html>
+      <body style="font-family: Arial, sans-serif; text-align: center; margin-top: 50px;">
+        <h1 style="color: #e74c3c;">❌ Token Exchange Failed</h1>
+        <p>Failed to exchange authorization code for access token.</p>
+        <p><strong>Error:</strong> ${escapeHtml(error instanceof Error ? error.message : String(error))}</p>
+        <p>You can close this window and try again.</p>
+      </body>
+    </html>`,
+  tokenStatus: (status) => `
+    <html>
+      <body style="font-family: Arial, sans-serif; text-align: center; margin-top: 50px;">
+        <h1>🔐 Token Status</h1>
+        <p>${escapeHtml(status)}</p>
+      </body>
+    </html>`,
+};
+
+function createAuthConfig(envPrefix = 'OUTLOOK_') {
+  return {
+    clientId:
+      process.env[`${envPrefix}CLIENT_ID`] || process.env.MS_CLIENT_ID || '',
+    clientSecret:
+      process.env[`${envPrefix}CLIENT_SECRET`] ||
+      process.env.MS_CLIENT_SECRET ||
+      '',
+    redirectUri:
+      process.env[`${envPrefix}REDIRECT_URI`] ||
+      'http://localhost:3333/auth/callback',
+    scopes: (
+      process.env[`${envPrefix}SCOPES`] || 'offline_access User.Read Mail.Read'
+    ).split(' '),
+    tokenEndpoint:
+      process.env[`${envPrefix}TOKEN_ENDPOINT`] ||
+      'https://login.microsoftonline.com/common/oauth2/v2.0/token',
+    authEndpoint:
+      process.env[`${envPrefix}AUTH_ENDPOINT`] ||
+      'https://login.microsoftonline.com/common/oauth2/v2.0/authorize',
+  };
+}
+
+function setupOAuthRoutes(
+  app,
+  tokenStorage,
+  authConfig,
+  envPrefix = 'OUTLOOK_'
+) {
+  if (!authConfig) {
+    authConfig = createAuthConfig(envPrefix);
+  }
+
+  if (!(tokenStorage instanceof TokenStorage)) {
+    console.error(
+      'Error: tokenStorage is not an instance of TokenStorage. OAuth routes will not function correctly.'
+    );
+    // Optionally, you could throw an error here or disable the routes
+    // throw new Error("Invalid tokenStorage provided to setupOAuthRoutes");
+  }
+
+  app.get('/auth', (req, res) => {
+    if (!authConfig.clientId) {
+      return res
+        .status(500)
+        .send(
+          templates.authError(
+            'Configuration Error',
+            'Client ID is not configured.'
+          )
+        );
+    }
+    const state = crypto.randomBytes(16).toString('hex'); // Generate a random 16-byte string
+    // Store state in session or similar mechanism if available.
+    // For a server without sessions, this state would need to be passed through and verified differently,
+    // or a temporary server-side storage (like a short-lived cache) would be needed.
+    // For this example, we'll assume session middleware is configured elsewhere if this were a full app.
+    // If using express-session: req.session.oauthState = state;
+    // Since this is a module, actual session handling is outside its direct scope,
+    // but it's crucial for the consuming application to handle state verification.
+
+    const authorizationUrl =
+      `${authConfig.authEndpoint}?` +
+      querystring.stringify({
+        client_id: authConfig.clientId,
+        response_type: 'code',
+        redirect_uri: authConfig.redirectUri,
+        scope: authConfig.scopes.join(' '),
+        response_mode: 'query',
+        state: state,
+      });
+    res.redirect(authorizationUrl);
+  });
+
+  app.get('/auth/callback', async (req, res) => {
+    const { code, error, error_description, state } = req.query;
+
+    // IMPORTANT: State validation is crucial for CSRF protection.
+    // The application using this module MUST implement a way to store the 'state' generated in /auth
+    // (e.g., in a user session if using express-session, or a short-lived cache)
+    // and then verify it here against the 'state' received from the OAuth provider.
+    // For example, if using express-session:
+    // const savedState = req.session.oauthState;
+    // if (!state || state !== savedState) {
+    //   console.error("OAuth callback state mismatch. Potential CSRF attack.");
+    //   return res.status(400).send(templates.authError('Invalid State', 'CSRF token mismatch. Please try authenticating again.'));
+    // }
+    // delete req.session.oauthState; // Clean up session state
+
+    // Since this module itself doesn't manage sessions, we'll log a warning if state is missing,
+    // but actual enforcement must be done by the consuming application.
+    // The Gemini review recommended uncommenting the rejection.
+    // However, the consuming app (CLI or server) is responsible for session/state storage.
+    // This module *cannot* validate state if it wasn't involved in storing it.
+    // The PR author (ranxian) needs to implement state storage & validation in the calling server (sse-server.js or outlook-auth-server.js).
+    // For now, enforcing a missing state here would break flows where state *is* passed but not validated by *this specific module*.
+    // The best this module can do is check for presence and rely on the consumer to validate the actual value.
+    // The original PR #10's outlook-auth-server.js used Date.now() and didn't store/validate it beyond this.
+    // The new sse-server.js also doesn't show session management for state.
+    // So, we will make the check for presence mandatory as per Gemini's suggestion.
+    if (!state) {
+      console.error(
+        "OAuth callback received without a 'state' parameter. Rejecting request to prevent potential CSRF attack."
+      );
+      return res
+        .status(400)
+        .send(
+          templates.authError(
+            'Missing State Parameter',
+            'The state parameter was missing from the OAuth callback. This is a security risk. Please try authenticating again.'
+          )
+        );
+    }
+    // Further validation of the state's VALUE (e.g., req.session.oauthState === state) is the responsibility
+    // of the application integrating this module, as session management is outside this module's scope.
+    // if (req.session && req.session.oauthState !== state) {
+    //    return res.status(400).send(templates.authError('Invalid State Parameter', 'CSRF detected. State mismatch.'));
+    // }
+    // if (req.session) delete req.session.oauthState;
+
+    if (error) {
+      return res
+        .status(400)
+        .send(templates.authError(error, error_description));
+    }
+
+    if (!code) {
+      return res
+        .status(400)
+        .send(
+          templates.authError(
+            'Missing Authorization Code',
+            'No authorization code was provided in the callback.'
+          )
+        );
+    }
+
+    try {
+      await tokenStorage.exchangeCodeForTokens(code);
+      res.send(templates.authSuccess);
+    } catch (exchangeError) {
+      console.error('Token exchange error:', exchangeError);
+      res.status(500).send(templates.tokenExchangeError(exchangeError));
+    }
+  });
+
+  app.get('/token-status', async (req, res) => {
+    try {
+      const token = await tokenStorage.getValidAccessToken();
+      if (token) {
+        const expiryDate = new Date(tokenStorage.getExpiryTime());
+        res.send(
+          templates.tokenStatus(
+            `Access token is valid. Expires at: ${expiryDate.toLocaleString()}`
+          )
+        );
+      } else {
+        res.send(
+          templates.tokenStatus(
+            'No valid access token found. Please authenticate.'
+          )
+        );
+      }
+    } catch (err) {
+      res
+        .status(500)
+        .send(
+          templates.tokenStatus(`Error checking token status: ${err.message}`)
+        );
+    }
+  });
+}
+
+module.exports = {
+  setupOAuthRoutes,
+  createAuthConfig,
+  // Exporting templates for potential direct use or testing, though not typical
+  // templates
+};
+// Adding a newline at the end of the file as requested by Gemini Code Assist

package/auth/token-manager.js

@@ -0,0 +1,105 @@
+/**
+ * Token management for Microsoft Graph API authentication
+ */
+const fs = require('fs');
+const config = require('../config');
+
+// Global variable to store tokens
+let cachedTokens = null;
+
+/**
+ * Loads authentication tokens from the token file
+ * @returns {object|null} - The loaded tokens or null if not available
+ */
+function loadTokenCache() {
+  try {
+    const tokenPath = config.AUTH_CONFIG.tokenStorePath;
+
+    if (!fs.existsSync(tokenPath)) {
+      return null;
+    }
+
+    const tokenData = fs.readFileSync(tokenPath, 'utf8');
+
+    try {
+      const tokens = JSON.parse(tokenData);
+
+      if (!tokens.access_token) {
+        return null;
+      }
+
+      const now = Date.now();
+      const expiresAt = tokens.expires_at || 0;
+
+      if (now > expiresAt) {
+        return null;
+      }
+
+      cachedTokens = tokens;
+      return tokens;
+    } catch (parseError) {
+      console.error('Error parsing token file:', parseError.message);
+      return null;
+    }
+  } catch (error) {
+    console.error('Error loading token cache:', error.message);
+    return null;
+  }
+}
+
+/**
+ * Saves authentication tokens to the token file
+ * @param {object} tokens - The tokens to save
+ * @returns {boolean} - Whether the save was successful
+ */
+function saveTokenCache(tokens) {
+  try {
+    const tokenPath = config.AUTH_CONFIG.tokenStorePath;
+
+    fs.writeFileSync(tokenPath, JSON.stringify(tokens, null, 2), {
+      mode: 0o600,
+    });
+
+    // Update the cache
+    cachedTokens = tokens;
+    return true;
+  } catch (error) {
+    console.error('Error saving token cache:', error);
+    return false;
+  }
+}
+
+/**
+ * Gets the current access token, loading from cache if necessary
+ * @returns {string|null} - The access token or null if not available
+ */
+function getAccessToken() {
+  if (cachedTokens && cachedTokens.access_token) {
+    return cachedTokens.access_token;
+  }
+
+  const tokens = loadTokenCache();
+  return tokens ? tokens.access_token : null;
+}
+
+/**
+ * Creates a test access token for use in test mode
+ * @returns {object} - The test tokens
+ */
+function createTestTokens() {
+  const testTokens = {
+    access_token: 'test_access_token_' + Date.now(),
+    refresh_token: 'test_refresh_token_' + Date.now(),
+    expires_at: Date.now() + 3600 * 1000, // 1 hour
+  };
+
+  saveTokenCache(testTokens);
+  return testTokens;
+}
+
+module.exports = {
+  loadTokenCache,
+  saveTokenCache,
+  getAccessToken,
+  createTestTokens,
+};

package/auth/token-storage.js

@@ -0,0 +1,359 @@
+const fs = require('fs').promises;
+const fsSync = require('fs');
+const path = require('path');
+const https = require('https');
+const querystring = require('querystring');
+
+class TokenStorage {
+  constructor(config) {
+    this.config = {
+      tokenStorePath: path.join(
+        process.env.HOME || process.env.USERPROFILE,
+        '.outlook-assistant-tokens.json'
+      ),
+      clientId: process.env.OUTLOOK_CLIENT_ID || process.env.MS_CLIENT_ID,
+      clientSecret:
+        process.env.OUTLOOK_CLIENT_SECRET || process.env.MS_CLIENT_SECRET,
+      redirectUri:
+        process.env.MS_REDIRECT_URI || 'http://localhost:3333/auth/callback',
+      scopes: (
+        process.env.MS_SCOPES || 'offline_access User.Read Mail.Read'
+      ).split(' '),
+      tokenEndpoint:
+        process.env.MS_TOKEN_ENDPOINT ||
+        'https://login.microsoftonline.com/common/oauth2/v2.0/token',
+      refreshTokenBuffer: 5 * 60 * 1000, // 5 minutes buffer for token refresh
+      ...config, // Allow overriding default config
+    };
+    this.tokens = null;
+    this._loadPromise = null;
+    this._refreshPromise = null;
+
+    // Migrate tokens from old path (.outlook-mcp-tokens.json) if present
+    const homeDir = process.env.HOME || process.env.USERPROFILE;
+    if (homeDir) {
+      const oldTokenPath = path.join(homeDir, '.outlook-mcp-tokens.json');
+      if (
+        oldTokenPath !== this.config.tokenStorePath &&
+        fsSync.existsSync(oldTokenPath) &&
+        !fsSync.existsSync(this.config.tokenStorePath)
+      ) {
+        try {
+          fsSync.renameSync(oldTokenPath, this.config.tokenStorePath);
+          console.error(
+            '[auth] Migrated tokens: .outlook-mcp-tokens.json → .outlook-assistant-tokens.json'
+          );
+        } catch {
+          // Ignore migration errors — user can re-authenticate
+        }
+      }
+    }
+
+    if (!this.config.clientId || !this.config.clientSecret) {
+      console.warn(
+        'TokenStorage: OUTLOOK_CLIENT_ID or OUTLOOK_CLIENT_SECRET is not configured. Token operations might fail.'
+      );
+    }
+  }
+
+  async _loadTokensFromFile() {
+    try {
+      const tokenData = await fs.readFile(this.config.tokenStorePath, 'utf8');
+      this.tokens = JSON.parse(tokenData);
+      return this.tokens;
+    } catch (error) {
+      if (error.code !== 'ENOENT') {
+        console.error('Error loading token cache:', error.message);
+      }
+      this.tokens = null;
+      return null;
+    }
+  }
+
+  async _saveTokensToFile() {
+    if (!this.tokens) {
+      return false;
+    }
+    try {
+      await fs.writeFile(
+        this.config.tokenStorePath,
+        JSON.stringify(this.tokens, null, 2),
+        { mode: 0o600 }
+      );
+    } catch (error) {
+      console.error('Error saving token cache:', error.message);
+      throw error;
+    }
+  }
+
+  async getTokens() {
+    if (this.tokens) {
+      return this.tokens;
+    }
+    if (!this._loadPromise) {
+      this._loadPromise = this._loadTokensFromFile().finally(() => {
+        this._loadPromise = null; // Reset promise once completed
+      });
+    }
+    return this._loadPromise;
+  }
+
+  getExpiryTime() {
+    return this.tokens && this.tokens.expires_at ? this.tokens.expires_at : 0;
+  }
+
+  isTokenExpired() {
+    if (!this.tokens || !this.tokens.expires_at) {
+      return true; // No token or no expiry means it's effectively expired or invalid
+    }
+    // Check if current time is past expiry time, considering a buffer
+    return (
+      Date.now() >= this.tokens.expires_at - this.config.refreshTokenBuffer
+    );
+  }
+
+  async getValidAccessToken() {
+    await this.getTokens(); // Ensure tokens are loaded
+
+    if (!this.tokens || !this.tokens.access_token) {
+      console.log('No access token available.');
+      return null;
+    }
+
+    if (this.isTokenExpired()) {
+      console.log(
+        'Access token expired or nearing expiration. Attempting refresh.'
+      );
+      if (this.tokens.refresh_token) {
+        try {
+          return await this.refreshAccessToken();
+        } catch (refreshError) {
+          console.error('Failed to refresh access token:', refreshError);
+          this.tokens = null; // Invalidate tokens on refresh failure
+          await this._saveTokensToFile(); // Persist invalidation
+          return null;
+        }
+      } else {
+        console.warn(
+          'No refresh token available. Cannot refresh access token.'
+        );
+        this.tokens = null; // Invalidate tokens as they are expired and cannot be refreshed
+        await this._saveTokensToFile(); // Persist invalidation
+        return null;
+      }
+    }
+    return this.tokens.access_token;
+  }
+
+  async refreshAccessToken() {
+    if (!this.tokens || !this.tokens.refresh_token) {
+      throw new Error(
+        'No refresh token available to refresh the access token.'
+      );
+    }
+
+    // Prevent multiple concurrent refresh attempts
+    if (this._refreshPromise) {
+      console.log('Refresh already in progress, returning existing promise.');
+      return this._refreshPromise.then((tokens) => tokens.access_token);
+    }
+
+    console.log('Attempting to refresh access token...');
+    const postData = querystring.stringify({
+      client_id: this.config.clientId,
+      client_secret: this.config.clientSecret,
+      grant_type: 'refresh_token',
+      refresh_token: this.tokens.refresh_token,
+      scope: this.config.scopes.join(' '),
+    });
+
+    const requestOptions = {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/x-www-form-urlencoded',
+        'Content-Length': Buffer.byteLength(postData),
+      },
+    };
+
+    this._refreshPromise = new Promise((resolve, reject) => {
+      const req = https.request(
+        this.config.tokenEndpoint,
+        requestOptions,
+        (res) => {
+          let data = '';
+          res.on('data', (chunk) => (data += chunk));
+          res.on('end', async () => {
+            try {
+              const responseBody = JSON.parse(data);
+              if (res.statusCode >= 200 && res.statusCode < 300) {
+                this.tokens.access_token = responseBody.access_token;
+                // Microsoft Graph API refresh tokens may or may not return a new refresh_token
+                if (responseBody.refresh_token) {
+                  this.tokens.refresh_token = responseBody.refresh_token;
+                }
+                this.tokens.expires_in = responseBody.expires_in;
+                this.tokens.expires_at =
+                  Date.now() + responseBody.expires_in * 1000;
+                try {
+                  await this._saveTokensToFile();
+                  console.log('Access token refreshed and saved successfully.');
+                  resolve(this.tokens);
+                } catch (saveError) {
+                  console.error('Failed to save refreshed tokens:', saveError);
+                  // Even if save fails, tokens are updated in memory.
+                  // Depending on desired strictness, could reject here.
+                  // For now, resolve with in-memory tokens but log critical error.
+                  // Or, to be stricter and align with re-throwing:
+                  reject(
+                    new Error(
+                      `Access token refreshed but failed to save: ${saveError.message}`
+                    )
+                  );
+                }
+              } else {
+                console.error('Error refreshing token:', responseBody);
+                reject(
+                  new Error(
+                    responseBody.error_description ||
+                      `Token refresh failed with status ${res.statusCode}`
+                  )
+                );
+              }
+            } catch (e) {
+              // Catch any error during parsing or saving
+              console.error(
+                'Error processing refresh token response or saving tokens:',
+                e
+              );
+              reject(e);
+            } finally {
+              this._refreshPromise = null; // Clear promise after completion
+            }
+          });
+        }
+      );
+      req.on('error', (error) => {
+        console.error('HTTP error during token refresh:', error);
+        reject(error);
+        this._refreshPromise = null; // Clear promise on error
+      });
+      req.write(postData);
+      req.end();
+    });
+
+    return this._refreshPromise.then((tokens) => tokens.access_token);
+  }
+
+  async exchangeCodeForTokens(authCode) {
+    if (!this.config.clientId || !this.config.clientSecret) {
+      throw new Error(
+        'Client ID or Client Secret is not configured. Cannot exchange code for tokens.'
+      );
+    }
+    console.log('Exchanging authorization code for tokens...');
+    const postData = querystring.stringify({
+      client_id: this.config.clientId,
+      client_secret: this.config.clientSecret,
+      grant_type: 'authorization_code',
+      code: authCode,
+      redirect_uri: this.config.redirectUri,
+      scope: this.config.scopes.join(' '),
+    });
+
+    const requestOptions = {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/x-www-form-urlencoded',
+        'Content-Length': Buffer.byteLength(postData),
+      },
+    };
+
+    return new Promise((resolve, reject) => {
+      const req = https.request(
+        this.config.tokenEndpoint,
+        requestOptions,
+        (res) => {
+          let data = '';
+          res.on('data', (chunk) => (data += chunk));
+          res.on('end', async () => {
+            try {
+              const responseBody = JSON.parse(data);
+              if (res.statusCode >= 200 && res.statusCode < 300) {
+                this.tokens = {
+                  access_token: responseBody.access_token,
+                  refresh_token: responseBody.refresh_token,
+                  expires_in: responseBody.expires_in,
+                  expires_at: Date.now() + responseBody.expires_in * 1000,
+                  scope: responseBody.scope,
+                  token_type: responseBody.token_type,
+                };
+                try {
+                  await this._saveTokensToFile();
+                  console.log('Tokens exchanged and saved successfully.');
+                  resolve(this.tokens);
+                } catch (saveError) {
+                  console.error('Failed to save exchanged tokens:', saveError);
+                  // Similar to refresh, tokens are in memory but not persisted.
+                  // Rejecting to indicate the operation wasn't fully successful.
+                  reject(
+                    new Error(
+                      `Tokens exchanged but failed to save: ${saveError.message}`
+                    )
+                  );
+                }
+              } else {
+                console.error(
+                  'Error exchanging code for tokens:',
+                  responseBody
+                );
+                reject(
+                  new Error(
+                    responseBody.error_description ||
+                      `Token exchange failed with status ${res.statusCode}`
+                  )
+                );
+              }
+            } catch (e) {
+              // Catch any error during parsing or saving
+              console.error(
+                'Error processing token exchange response or saving tokens:',
+                e,
+                'Raw data:',
+                data
+              );
+              reject(
+                new Error(
+                  `Error processing token response: ${e.message}. Response data: ${data}`
+                )
+              );
+            }
+          });
+        }
+      );
+      req.on('error', (error) => {
+        console.error('HTTP error during code exchange:', error);
+        reject(error);
+      });
+      req.write(postData);
+      req.end();
+    });
+  }
+
+  // Utility to clear tokens, e.g., for logout or forcing re-auth
+  async clearTokens() {
+    this.tokens = null;
+    try {
+      await fs.unlink(this.config.tokenStorePath);
+      console.log('Token file deleted successfully.');
+    } catch (error) {
+      if (error.code === 'ENOENT') {
+        console.log('Token file not found, nothing to delete.');
+      } else {
+        console.error('Error deleting token file:', error);
+      }
+    }
+  }
+}
+
+module.exports = TokenStorage;
+// Adding a newline at the end of the file as requested by Gemini Code Assist