@lobu/gateway 3.0.5 → 3.0.7

package/src/auth/external/device-code-client.ts

@@ -0,0 +1,225 @@
+import { BaseOAuth2Client } from "../oauth/base-client";
+import type { OAuthCredentials } from "../oauth/credentials";
+
+export const DEVICE_CODE_GRANT_TYPE =
+  "urn:ietf:params:oauth:grant-type:device_code";
+
+export interface DeviceCodeClientConfig {
+  clientId: string;
+  clientSecret?: string;
+  tokenUrl: string;
+  deviceAuthorizationUrl: string;
+  scope: string;
+  tokenEndpointAuthMethod?:
+    | "none"
+    | "client_secret_post"
+    | "client_secret_basic";
+}
+
+export interface DeviceAuthorizationStartResult {
+  deviceAuthId: string;
+  userCode: string;
+  verificationUri: string;
+  verificationUriComplete?: string;
+  interval: number;
+  expiresIn: number;
+}
+
+export type DeviceAuthorizationPollResult =
+  | {
+      status: "pending";
+      interval?: number;
+    }
+  | {
+      status: "complete";
+      credentials: OAuthCredentials;
+    }
+  | {
+      status: "error";
+      error: string;
+      errorCode?: string;
+    };
+
+interface DeviceAuthorizationResponse {
+  device_code: string;
+  user_code: string;
+  verification_uri: string;
+  verification_uri_complete?: string;
+  expires_in: number;
+  interval?: number;
+}
+
+interface DeviceTokenSuccessResponse {
+  access_token: string;
+  refresh_token?: string;
+  token_type?: string;
+  expires_in?: number;
+  scope?: string;
+}
+
+interface DeviceTokenErrorResponse {
+  error: string;
+  error_description?: string;
+}
+
+export class GenericDeviceCodeClient extends BaseOAuth2Client {
+  constructor(private readonly config: DeviceCodeClientConfig) {
+    super("external-device-code-client");
+  }
+
+  async requestDeviceCode(): Promise<DeviceAuthorizationStartResult> {
+    const { headers, body } = this.buildAuthenticatedFormBody({
+      client_id: this.config.clientId,
+      scope: this.config.scope,
+    });
+
+    const response = await fetch(this.config.deviceAuthorizationUrl, {
+      method: "POST",
+      headers,
+      body: body.toString(),
+    });
+
+    const data = await this.parseJsonResponse<
+      DeviceAuthorizationResponse | DeviceTokenErrorResponse
+    >(response);
+
+    if (!response.ok || "error" in data) {
+      throw new Error(
+        this.formatOAuthError("Device authorization failed", data)
+      );
+    }
+
+    return {
+      deviceAuthId: data.device_code,
+      userCode: data.user_code,
+      verificationUri: data.verification_uri,
+      verificationUriComplete: data.verification_uri_complete,
+      interval: Math.max(data.interval ?? 5, 1),
+      expiresIn: data.expires_in,
+    };
+  }
+
+  async pollForToken(
+    deviceAuthId: string,
+    intervalSeconds?: number
+  ): Promise<DeviceAuthorizationPollResult> {
+    const { headers, body } = this.buildAuthenticatedFormBody({
+      grant_type: DEVICE_CODE_GRANT_TYPE,
+      device_code: deviceAuthId,
+      client_id: this.config.clientId,
+    });
+
+    const response = await fetch(this.config.tokenUrl, {
+      method: "POST",
+      headers,
+      body: body.toString(),
+    });
+
+    const data = await this.parseJsonResponse<
+      DeviceTokenSuccessResponse | DeviceTokenErrorResponse
+    >(response);
+
+    if (!response.ok || "error" in data) {
+      if ("error" in data) {
+        if (data.error === "authorization_pending") {
+          return { status: "pending", interval: intervalSeconds };
+        }
+        if (data.error === "slow_down") {
+          return {
+            status: "pending",
+            interval: Math.max((intervalSeconds ?? 5) + 5, 1),
+          };
+        }
+        if (data.error === "expired_token" || data.error === "access_denied") {
+          return {
+            status: "error",
+            error: data.error_description || data.error,
+            errorCode: data.error,
+          };
+        }
+      }
+
+      throw new Error(
+        this.formatOAuthError("Device token polling failed", data)
+      );
+    }
+
+    const credentials = this.buildCredentials(data);
+    return {
+      status: "complete",
+      credentials,
+    };
+  }
+
+  private buildCredentials(
+    tokenData: DeviceTokenSuccessResponse
+  ): OAuthCredentials {
+    return {
+      accessToken: tokenData.access_token,
+      refreshToken: tokenData.refresh_token,
+      tokenType: tokenData.token_type || "Bearer",
+      expiresAt:
+        this.calculateExpiresAt(tokenData.expires_in) ?? Date.now() + 3_600_000,
+      scopes: this.parseScopes(tokenData.scope),
+    };
+  }
+
+  private buildAuthenticatedFormBody(params: Record<string, string>): {
+    headers: Record<string, string>;
+    body: URLSearchParams;
+  } {
+    const body = new URLSearchParams(params);
+    const headers: Record<string, string> = {
+      Accept: "application/json",
+      "Content-Type": "application/x-www-form-urlencoded",
+    };
+    const authMethod = this.config.tokenEndpointAuthMethod || "none";
+
+    if (authMethod === "client_secret_basic") {
+      headers.Authorization = `Basic ${Buffer.from(
+        `${this.config.clientId}:${this.config.clientSecret || ""}`
+      ).toString("base64")}`;
+    } else if (
+      authMethod === "client_secret_post" &&
+      this.config.clientSecret
+    ) {
+      body.set("client_secret", this.config.clientSecret);
+    }
+
+    return { headers, body };
+  }
+
+  private async parseJsonResponse<T>(response: Response): Promise<T> {
+    const contentType = response.headers.get("content-type") || "";
+    if (contentType.includes("application/json")) {
+      return (await response.json()) as T;
+    }
+
+    const text = await response.text();
+    try {
+      return JSON.parse(text) as T;
+    } catch {
+      return { error: text || response.statusText } as T;
+    }
+  }
+
+  private formatOAuthError(prefix: string, data: unknown): string {
+    if (data && typeof data === "object" && "error" in data) {
+      const record = data as {
+        error?: unknown;
+        error_description?: unknown;
+      };
+      const error =
+        typeof record.error === "string" ? record.error : "unknown_error";
+      const description =
+        typeof record.error_description === "string"
+          ? record.error_description
+          : undefined;
+      return description
+        ? `${prefix}: ${error} - ${description}`
+        : `${prefix}: ${error}`;
+    }
+
+    return prefix;
+  }
+}

package/src/auth/mcp/config-service.ts

@@ -0,0 +1,392 @@
+import { createLogger, verifyWorkerToken } from "@lobu/core";
+import type { SystemConfigResolver } from "../../services/system-config-resolver";
+import type { AgentSettingsStore } from "../settings/agent-settings-store";
+
+const logger = createLogger("mcp-config-service");
+
+interface McpInput {
+  type: "promptString";
+  id: string;
+  description: string;
+}
+
+interface HttpMcpServerConfig {
+  id: string;
+  upstreamUrl: string;
+  oauth?: unknown;
+  inputs?: McpInput[];
+  headers?: Record<string, string>;
+  loginUrl?: string;
+  resource?: string;
+}
+
+interface WorkerMcpConfig {
+  mcpServers: Record<string, any>;
+}
+
+interface McpStatus {
+  id: string;
+  name: string;
+  requiresAuth: boolean;
+  requiresInput: boolean;
+}
+
+interface LoadedConfig {
+  rawServers: Record<string, any>;
+  httpServers: Map<string, HttpMcpServerConfig>;
+}
+
+interface McpConfigServiceOptions {
+  agentSettingsStore?: AgentSettingsStore;
+  configResolver?: SystemConfigResolver;
+}
+
+export class McpConfigService {
+  private cache?: LoadedConfig;
+  private agentSettingsStore?: AgentSettingsStore;
+  private configResolver?: SystemConfigResolver;
+
+  constructor(options: McpConfigServiceOptions = {}) {
+    this.agentSettingsStore = options.agentSettingsStore;
+    this.configResolver = options.configResolver;
+    logger.debug(`McpConfigService initialized`);
+  }
+
+  /**
+   * Register additional global MCP servers (e.g. from system skills).
+   */
+  registerGlobalServers(servers: Record<string, any>): void {
+    if (!this.cache) {
+      this.cache = {
+        rawServers: {},
+        httpServers: new Map(),
+      };
+    }
+
+    const normalized = normalizeConfig({ mcpServers: servers });
+    for (const [id, raw] of Object.entries(normalized.rawServers)) {
+      if (this.cache.rawServers[id]) continue;
+      this.cache.rawServers[id] = raw;
+    }
+    for (const [id, http] of normalized.httpServers) {
+      if (this.cache.httpServers.has(id)) continue;
+      this.cache.httpServers.set(id, http);
+    }
+
+    logger.info(
+      `Registered ${Object.keys(servers).length} global MCP(s) from system skills: ${Object.keys(servers).join(", ")}`
+    );
+  }
+
+  /**
+   * Return MCP config tailored for a worker request.
+   */
+  async getWorkerConfig(options: {
+    baseUrl: string;
+    workerToken: string;
+    deploymentName?: string;
+  }): Promise<WorkerMcpConfig> {
+    const { baseUrl, workerToken } = options;
+    const config = await this.loadConfig();
+    const workerConfig: WorkerMcpConfig = { mcpServers: {} };
+
+    const tokenData = verifyWorkerToken(workerToken);
+    if (!tokenData) {
+      logger.warn("Failed to verify worker token");
+      return workerConfig;
+    }
+
+    const { userId, agentId } = tokenData;
+    const effectiveAgentId = agentId || userId;
+    logger.info(`Building MCP config for user ${userId}`);
+
+    // Process global MCPs
+    for (const [id, serverConfig] of Object.entries(config.rawServers)) {
+      const cloned = cloneConfig(serverConfig);
+      const httpServer = config.httpServers.get(id);
+
+      if (httpServer) {
+        logger.info(`Configuring global MCP ${id}: baseUrl=${baseUrl}`);
+        cloned.url = baseUrl;
+        cloned.type = "sse";
+        cloned.headers = mergeHeaders(cloned.headers, workerToken, id);
+        logger.info(
+          `Including global MCP ${id} with URL=${cloned.url} and X-Mcp-Id header`
+        );
+      }
+
+      workerConfig.mcpServers[id] = cloned;
+    }
+
+    // Merge per-agent MCPs from live agent settings
+    const agentSettingsMcpServers =
+      (await this.getAgentMcpServers(effectiveAgentId)) || {};
+    for (const [id, serverConfig] of Object.entries(agentSettingsMcpServers)) {
+      if (workerConfig.mcpServers[id]) {
+        logger.warn(
+          `Per-agent MCP ${id} skipped - global MCP with same ID exists`
+        );
+        continue;
+      }
+
+      const cloned = cloneConfig(serverConfig);
+
+      if (cloned.enabled === false) {
+        logger.debug(`Skipping disabled per-agent MCP ${id}`);
+        continue;
+      }
+
+      if (cloned.url) {
+        logger.info(`Configuring per-agent HTTP MCP ${id}: baseUrl=${baseUrl}`);
+        cloned.originalUrl = cloned.url;
+        cloned.url = baseUrl;
+        cloned.type = "sse";
+        cloned.headers = mergeHeaders(cloned.headers, workerToken, id);
+        cloned.perAgent = true;
+        logger.info(`Including per-agent HTTP MCP ${id}`);
+      } else if (cloned.command) {
+        logger.info(`Including per-agent stdio MCP ${id}: ${cloned.command}`);
+      }
+
+      workerConfig.mcpServers[id] = cloned;
+    }
+
+    if (Object.keys(agentSettingsMcpServers).length > 0) {
+      logger.info(
+        `Merged ${Object.keys(agentSettingsMcpServers).length} per-agent MCPs from settings for agent ${effectiveAgentId}`
+      );
+    }
+
+    logger.info(
+      `Returning worker config with ${Object.keys(workerConfig.mcpServers).length} MCPs for user ${userId}:`,
+      {
+        mcpIds: Object.keys(workerConfig.mcpServers),
+        configs: Object.entries(workerConfig.mcpServers).map(([id, cfg]) => ({
+          id,
+          type: cfg.type,
+          hasUrl: !!cfg.url,
+          hasCommand: !!cfg.command,
+          perAgent: cfg.perAgent || false,
+        })),
+      }
+    );
+
+    return workerConfig;
+  }
+
+  /**
+   * Get status of all MCPs for a specific agent
+   */
+  async getMcpStatus(agentId: string): Promise<McpStatus[]> {
+    const httpServers = await this.getAllHttpServers(agentId);
+    const statuses: McpStatus[] = [];
+
+    for (const [id, httpServer] of httpServers) {
+      const hasOAuth = !!httpServer.oauth;
+      const hasLoginUrl = !!httpServer.loginUrl;
+      const requiresAuth = hasOAuth || hasLoginUrl;
+      const requiresInput = !!(
+        httpServer.inputs && httpServer.inputs.length > 0
+      );
+
+      statuses.push({
+        id,
+        name: id,
+        requiresAuth,
+        requiresInput,
+      });
+    }
+
+    return statuses;
+  }
+
+  /**
+   * Get HTTP proxy metadata for a specific MCP server.
+   */
+  async getHttpServer(
+    id: string,
+    agentId?: string
+  ): Promise<HttpMcpServerConfig | undefined> {
+    const httpServers = await this.getAllHttpServers(agentId);
+    return httpServers.get(id);
+  }
+
+  /**
+   * Get all HTTP proxy metadata for all MCP servers.
+   */
+  async getAllHttpServers(
+    agentId?: string
+  ): Promise<Map<string, HttpMcpServerConfig>> {
+    const config = await this.loadConfig();
+    const merged = new Map(config.httpServers);
+
+    if (agentId) {
+      const agentMcpServers = await this.getAgentMcpServers(agentId);
+      for (const [id, serverConfig] of Object.entries(agentMcpServers)) {
+        if (merged.has(id)) continue;
+        const httpServer = toHttpServerConfig(id, serverConfig);
+        if (httpServer) {
+          merged.set(id, httpServer);
+        }
+      }
+    }
+
+    return merged;
+  }
+
+  /**
+   * Return global MCP server configs in settings-compatible format.
+   */
+  async getGlobalMcpServers(): Promise<
+    Record<string, { url?: string; type?: "sse" | "stdio" }>
+  > {
+    const config = await this.loadConfig();
+    const result: Record<string, { url?: string; type?: "sse" | "stdio" }> = {};
+    for (const [id, raw] of Object.entries(config.rawServers)) {
+      const type = raw.type === "stdio" ? ("stdio" as const) : ("sse" as const);
+      result[id] = { url: raw.url, type };
+    }
+    return result;
+  }
+
+  private async getAgentMcpServers(
+    agentId: string
+  ): Promise<Record<string, any>> {
+    if (!this.agentSettingsStore) {
+      return {};
+    }
+
+    try {
+      const settings = await this.agentSettingsStore.getSettings(agentId);
+      return settings?.mcpServers || {};
+    } catch (error) {
+      logger.warn(`Failed to load per-agent MCP settings for ${agentId}`, {
+        error,
+      });
+      return {};
+    }
+  }
+
+  private async loadConfig(): Promise<LoadedConfig> {
+    if (!this.cache) {
+      let globalMcpServers: Record<string, any> = {};
+      if (this.configResolver) {
+        globalMcpServers = await this.configResolver.getGlobalMcpServers();
+      }
+      const normalized = normalizeConfig({ mcpServers: globalMcpServers });
+      this.cache = normalized;
+    }
+    return this.cache;
+  }
+}
+
+function normalizeConfig(config: { mcpServers: Record<string, any> }) {
+  const rawServers: Record<string, any> = {};
+  const httpServers = new Map<string, HttpMcpServerConfig>();
+
+  for (const [id, serverConfig] of Object.entries(config.mcpServers)) {
+    if (!serverConfig || typeof serverConfig !== "object") {
+      continue;
+    }
+
+    const cloned = cloneConfig(serverConfig);
+    rawServers[id] = cloned;
+
+    if (typeof cloned.url === "string" && isHttpUrl(cloned.url)) {
+      httpServers.set(id, {
+        id,
+        upstreamUrl: cloned.url,
+        oauth:
+          cloned.oauth && typeof cloned.oauth === "object"
+            ? cloned.oauth
+            : undefined,
+        inputs: Array.isArray(cloned.inputs)
+          ? cloned.inputs.filter(
+              (input: any) =>
+                input &&
+                typeof input === "object" &&
+                input.type === "promptString"
+            )
+          : undefined,
+        headers:
+          cloned.headers && typeof cloned.headers === "object"
+            ? cloned.headers
+            : undefined,
+        loginUrl:
+          typeof cloned.loginUrl === "string" ? cloned.loginUrl : undefined,
+        resource:
+          typeof cloned.resource === "string" ? cloned.resource : undefined,
+      });
+    }
+  }
+
+  return { rawServers, httpServers };
+}
+
+function toHttpServerConfig(
+  id: string,
+  serverConfig: any
+): HttpMcpServerConfig | null {
+  if (!serverConfig || typeof serverConfig !== "object") {
+    return null;
+  }
+
+  if (serverConfig.enabled === false) {
+    return null;
+  }
+
+  const cloned = cloneConfig(serverConfig);
+  if (typeof cloned.url !== "string" || !isHttpUrl(cloned.url)) {
+    return null;
+  }
+
+  return {
+    id,
+    upstreamUrl: cloned.url,
+    oauth:
+      cloned.oauth && typeof cloned.oauth === "object"
+        ? cloned.oauth
+        : undefined,
+    inputs: Array.isArray(cloned.inputs)
+      ? cloned.inputs.filter(
+          (input: any) =>
+            input && typeof input === "object" && input.type === "promptString"
+        )
+      : undefined,
+    headers:
+      cloned.headers && typeof cloned.headers === "object"
+        ? cloned.headers
+        : undefined,
+    loginUrl: typeof cloned.loginUrl === "string" ? cloned.loginUrl : undefined,
+  };
+}
+
+function cloneConfig(config: any) {
+  return JSON.parse(JSON.stringify(config));
+}
+
+function isHttpUrl(candidate: string): boolean {
+  return candidate.startsWith("http://") || candidate.startsWith("https://");
+}
+
+function mergeHeaders(
+  existingHeaders: unknown,
+  workerToken: string,
+  mcpId: string
+): Record<string, string> {
+  const normalized: Record<string, string> = {};
+
+  if (existingHeaders && typeof existingHeaders === "object") {
+    for (const [key, value] of Object.entries(existingHeaders as any)) {
+      if (typeof value === "string") {
+        normalized[key] = value;
+      } else if (value != null) {
+        normalized[key] = String(value);
+      }
+    }
+  }
+
+  normalized.Authorization = `Bearer ${workerToken}`;
+  normalized["X-Mcp-Id"] = mcpId;
+  return normalized;
+}