@lobu/gateway 3.0.9 → 3.0.13

package/src/auth/external/device-code-client.ts

@@ -1,235 +0,0 @@
-import { BaseOAuth2Client } from "../oauth/base-client";
-import type { OAuthCredentials } from "../oauth/credentials";
-
-export const DEVICE_CODE_GRANT_TYPE =
-  "urn:ietf:params:oauth:grant-type:device_code";
-
-export interface DeviceCodeClientConfig {
-  clientId: string;
-  clientSecret?: string;
-  tokenUrl: string;
-  deviceAuthorizationUrl: string;
-  scope: string;
-  /** RFC 8707 resource indicator included in token requests. */
-  resource?: string;
-  tokenEndpointAuthMethod?:
-    | "none"
-    | "client_secret_post"
-    | "client_secret_basic";
-}
-
-export interface DeviceAuthorizationStartResult {
-  deviceAuthId: string;
-  userCode: string;
-  verificationUri: string;
-  verificationUriComplete?: string;
-  interval: number;
-  expiresIn: number;
-}
-
-export type DeviceAuthorizationPollResult =
-  | {
-      status: "pending";
-      interval?: number;
-    }
-  | {
-      status: "complete";
-      credentials: OAuthCredentials;
-    }
-  | {
-      status: "error";
-      error: string;
-      errorCode?: string;
-    };
-
-interface DeviceAuthorizationResponse {
-  device_code: string;
-  user_code: string;
-  verification_uri: string;
-  verification_uri_complete?: string;
-  expires_in: number;
-  interval?: number;
-}
-
-interface DeviceTokenSuccessResponse {
-  access_token: string;
-  refresh_token?: string;
-  token_type?: string;
-  expires_in?: number;
-  scope?: string;
-}
-
-interface DeviceTokenErrorResponse {
-  error: string;
-  error_description?: string;
-}
-
-export class GenericDeviceCodeClient extends BaseOAuth2Client {
-  constructor(private readonly config: DeviceCodeClientConfig) {
-    super("external-device-code-client");
-  }
-
-  async requestDeviceCode(): Promise<DeviceAuthorizationStartResult> {
-    const params: Record<string, string> = {
-      client_id: this.config.clientId,
-      scope: this.config.scope,
-    };
-    if (this.config.resource) {
-      params.resource = this.config.resource;
-    }
-    const { headers, body } = this.buildAuthenticatedFormBody(params);
-
-    const response = await fetch(this.config.deviceAuthorizationUrl, {
-      method: "POST",
-      headers,
-      body: body.toString(),
-    });
-
-    const data = await this.parseJsonResponse<
-      DeviceAuthorizationResponse | DeviceTokenErrorResponse
-    >(response);
-
-    if (!response.ok || "error" in data) {
-      throw new Error(
-        this.formatOAuthError("Device authorization failed", data)
-      );
-    }
-
-    return {
-      deviceAuthId: data.device_code,
-      userCode: data.user_code,
-      verificationUri: data.verification_uri,
-      verificationUriComplete: data.verification_uri_complete,
-      interval: Math.max(data.interval ?? 5, 1),
-      expiresIn: data.expires_in,
-    };
-  }
-
-  async pollForToken(
-    deviceAuthId: string,
-    intervalSeconds?: number
-  ): Promise<DeviceAuthorizationPollResult> {
-    const params: Record<string, string> = {
-      grant_type: DEVICE_CODE_GRANT_TYPE,
-      device_code: deviceAuthId,
-      client_id: this.config.clientId,
-    };
-    if (this.config.resource) {
-      params.resource = this.config.resource;
-    }
-    const { headers, body } = this.buildAuthenticatedFormBody(params);
-
-    const response = await fetch(this.config.tokenUrl, {
-      method: "POST",
-      headers,
-      body: body.toString(),
-    });
-
-    const data = await this.parseJsonResponse<
-      DeviceTokenSuccessResponse | DeviceTokenErrorResponse
-    >(response);
-
-    if (!response.ok || "error" in data) {
-      if ("error" in data) {
-        if (data.error === "authorization_pending") {
-          return { status: "pending", interval: intervalSeconds };
-        }
-        if (data.error === "slow_down") {
-          return {
-            status: "pending",
-            interval: Math.max((intervalSeconds ?? 5) + 5, 1),
-          };
-        }
-        if (data.error === "expired_token" || data.error === "access_denied") {
-          return {
-            status: "error",
-            error: data.error_description || data.error,
-            errorCode: data.error,
-          };
-        }
-      }
-
-      throw new Error(
-        this.formatOAuthError("Device token polling failed", data)
-      );
-    }
-
-    const credentials = this.buildCredentials(data);
-    return {
-      status: "complete",
-      credentials,
-    };
-  }
-
-  private buildCredentials(
-    tokenData: DeviceTokenSuccessResponse
-  ): OAuthCredentials {
-    return {
-      accessToken: tokenData.access_token,
-      refreshToken: tokenData.refresh_token,
-      tokenType: tokenData.token_type || "Bearer",
-      expiresAt:
-        this.calculateExpiresAt(tokenData.expires_in) ?? Date.now() + 3_600_000,
-      scopes: this.parseScopes(tokenData.scope),
-    };
-  }
-
-  private buildAuthenticatedFormBody(params: Record<string, string>): {
-    headers: Record<string, string>;
-    body: URLSearchParams;
-  } {
-    const body = new URLSearchParams(params);
-    const headers: Record<string, string> = {
-      Accept: "application/json",
-      "Content-Type": "application/x-www-form-urlencoded",
-    };
-    const authMethod = this.config.tokenEndpointAuthMethod || "none";
-
-    if (authMethod === "client_secret_basic") {
-      headers.Authorization = `Basic ${Buffer.from(
-        `${this.config.clientId}:${this.config.clientSecret || ""}`
-      ).toString("base64")}`;
-    } else if (
-      authMethod === "client_secret_post" &&
-      this.config.clientSecret
-    ) {
-      body.set("client_secret", this.config.clientSecret);
-    }
-
-    return { headers, body };
-  }
-
-  private async parseJsonResponse<T>(response: Response): Promise<T> {
-    const contentType = response.headers.get("content-type") || "";
-    if (contentType.includes("application/json")) {
-      return (await response.json()) as T;
-    }
-
-    const text = await response.text();
-    try {
-      return JSON.parse(text) as T;
-    } catch {
-      return { error: text || response.statusText } as T;
-    }
-  }
-
-  private formatOAuthError(prefix: string, data: unknown): string {
-    if (data && typeof data === "object" && "error" in data) {
-      const record = data as {
-        error?: unknown;
-        error_description?: unknown;
-      };
-      const error =
-        typeof record.error === "string" ? record.error : "unknown_error";
-      const description =
-        typeof record.error_description === "string"
-          ? record.error_description
-          : undefined;
-      return description
-        ? `${prefix}: ${error} - ${description}`
-        : `${prefix}: ${error}`;
-    }
-
-    return prefix;
-  }
-}

package/src/auth/mcp/config-service.ts

@@ -1,420 +0,0 @@
-import {
-  type McpOAuthConfig,
-  createLogger,
-  verifyWorkerToken,
-} from "@lobu/core";
-import type { SystemConfigResolver } from "../../services/system-config-resolver";
-import type { AgentSettingsStore } from "../settings/agent-settings-store";
-
-const logger = createLogger("mcp-config-service");
-
-interface McpInput {
-  type: "promptString";
-  id: string;
-  description: string;
-}
-
-export interface HttpMcpServerConfig {
-  id: string;
-  upstreamUrl: string;
-  oauth?: McpOAuthConfig;
-  inputs?: McpInput[];
-  headers?: Record<string, string>;
-}
-
-interface WorkerMcpConfig {
-  mcpServers: Record<string, any>;
-}
-
-interface McpStatus {
-  id: string;
-  name: string;
-  requiresAuth: boolean;
-  requiresInput: boolean;
-}
-
-interface LoadedConfig {
-  rawServers: Record<string, any>;
-  httpServers: Map<string, HttpMcpServerConfig>;
-}
-
-interface McpConfigServiceOptions {
-  agentSettingsStore?: AgentSettingsStore;
-  configResolver?: SystemConfigResolver;
-}
-
-export class McpConfigService {
-  private cache?: LoadedConfig;
-  private agentSettingsStore?: AgentSettingsStore;
-  private configResolver?: SystemConfigResolver;
-
-  constructor(options: McpConfigServiceOptions = {}) {
-    this.agentSettingsStore = options.agentSettingsStore;
-    this.configResolver = options.configResolver;
-    logger.debug(`McpConfigService initialized`);
-  }
-
-  /**
-   * Register additional global MCP servers (e.g. from system skills).
-   */
-  registerGlobalServers(servers: Record<string, any>): void {
-    if (!this.cache) {
-      this.cache = {
-        rawServers: {},
-        httpServers: new Map(),
-      };
-    }
-
-    const normalized = normalizeConfig({ mcpServers: servers });
-    for (const [id, raw] of Object.entries(normalized.rawServers)) {
-      if (this.cache.rawServers[id]) continue;
-      this.cache.rawServers[id] = raw;
-    }
-    for (const [id, http] of normalized.httpServers) {
-      if (this.cache.httpServers.has(id)) continue;
-      this.cache.httpServers.set(id, http);
-    }
-
-    logger.info(
-      `Registered ${Object.keys(servers).length} global MCP(s) from system skills: ${Object.keys(servers).join(", ")}`
-    );
-  }
-
-  /**
-   * Return MCP config tailored for a worker request.
-   */
-  async getWorkerConfig(options: {
-    baseUrl: string;
-    workerToken: string;
-    deploymentName?: string;
-  }): Promise<WorkerMcpConfig> {
-    const { baseUrl, workerToken } = options;
-    const config = await this.loadConfig();
-    const workerConfig: WorkerMcpConfig = { mcpServers: {} };
-
-    const tokenData = verifyWorkerToken(workerToken);
-    if (!tokenData) {
-      logger.warn("Failed to verify worker token");
-      return workerConfig;
-    }
-
-    const { userId, agentId } = tokenData;
-    const effectiveAgentId = agentId || userId;
-    logger.info(`Building MCP config for user ${userId}`);
-
-    // Process global MCPs
-    for (const [id, serverConfig] of Object.entries(config.rawServers)) {
-      const cloned = cloneConfig(serverConfig);
-      const httpServer = config.httpServers.get(id);
-
-      if (httpServer) {
-        logger.info(`Configuring global MCP ${id}: baseUrl=${baseUrl}`);
-        cloned.url = baseUrl;
-        cloned.type = "sse";
-        cloned.headers = mergeHeaders(cloned.headers, workerToken, id);
-        logger.info(
-          `Including global MCP ${id} with URL=${cloned.url} and X-Mcp-Id header`
-        );
-      }
-
-      workerConfig.mcpServers[id] = cloned;
-    }
-
-    // Merge per-agent MCPs from live agent settings
-    const agentSettingsMcpServers =
-      (await this.getAgentMcpServers(effectiveAgentId)) || {};
-    for (const [id, serverConfig] of Object.entries(agentSettingsMcpServers)) {
-      if (workerConfig.mcpServers[id]) {
-        logger.warn(
-          `Per-agent MCP ${id} skipped - global MCP with same ID exists`
-        );
-        continue;
-      }
-
-      const cloned = cloneConfig(serverConfig);
-
-      if (cloned.enabled === false) {
-        logger.debug(`Skipping disabled per-agent MCP ${id}`);
-        continue;
-      }
-
-      if (cloned.url) {
-        logger.info(`Configuring per-agent HTTP MCP ${id}: baseUrl=${baseUrl}`);
-        cloned.originalUrl = cloned.url;
-        cloned.url = baseUrl;
-        cloned.type = "sse";
-        cloned.headers = mergeHeaders(cloned.headers, workerToken, id);
-        cloned.perAgent = true;
-        logger.info(`Including per-agent HTTP MCP ${id}`);
-      } else if (cloned.command) {
-        logger.info(`Including per-agent stdio MCP ${id}: ${cloned.command}`);
-      }
-
-      workerConfig.mcpServers[id] = cloned;
-    }
-
-    if (Object.keys(agentSettingsMcpServers).length > 0) {
-      logger.info(
-        `Merged ${Object.keys(agentSettingsMcpServers).length} per-agent MCPs from settings for agent ${effectiveAgentId}`
-      );
-    }
-
-    logger.info(
-      `Returning worker config with ${Object.keys(workerConfig.mcpServers).length} MCPs for user ${userId}:`,
-      {
-        mcpIds: Object.keys(workerConfig.mcpServers),
-        configs: Object.entries(workerConfig.mcpServers).map(([id, cfg]) => ({
-          id,
-          type: cfg.type,
-          hasUrl: !!cfg.url,
-          hasCommand: !!cfg.command,
-          perAgent: cfg.perAgent || false,
-        })),
-      }
-    );
-
-    return workerConfig;
-  }
-
-  /**
-   * Get status of all MCPs for a specific agent
-   */
-  async getMcpStatus(agentId: string): Promise<McpStatus[]> {
-    const httpServers = await this.getAllHttpServers(agentId);
-    const statuses: McpStatus[] = [];
-
-    for (const [id, httpServer] of httpServers) {
-      const requiresAuth = !!httpServer.oauth;
-      const requiresInput = !!(
-        httpServer.inputs && httpServer.inputs.length > 0
-      );
-
-      statuses.push({
-        id,
-        name: id,
-        requiresAuth,
-        requiresInput,
-      });
-    }
-
-    return statuses;
-  }
-
-  /**
-   * Get HTTP proxy metadata for a specific MCP server.
-   */
-  async getHttpServer(
-    id: string,
-    agentId?: string
-  ): Promise<HttpMcpServerConfig | undefined> {
-    const httpServers = await this.getAllHttpServers(agentId);
-    return httpServers.get(id);
-  }
-
-  /**
-   * Get all HTTP proxy metadata for all MCP servers.
-   */
-  async getAllHttpServers(
-    agentId?: string
-  ): Promise<Map<string, HttpMcpServerConfig>> {
-    const config = await this.loadConfig();
-    const merged = new Map(config.httpServers);
-
-    if (agentId) {
-      const agentMcpServers = await this.getAgentMcpServers(agentId);
-      for (const [id, serverConfig] of Object.entries(agentMcpServers)) {
-        if (merged.has(id)) continue;
-        const httpServer = toHttpServerConfig(id, serverConfig);
-        if (httpServer) {
-          merged.set(id, httpServer);
-        }
-      }
-    }
-
-    return merged;
-  }
-
-  /**
-   * Return global MCP server configs in settings-compatible format.
-   */
-  async getGlobalMcpServers(): Promise<
-    Record<string, { url?: string; type?: "sse" | "stdio" }>
-  > {
-    const config = await this.loadConfig();
-    const result: Record<string, { url?: string; type?: "sse" | "stdio" }> = {};
-    for (const [id, raw] of Object.entries(config.rawServers)) {
-      const type = raw.type === "stdio" ? ("stdio" as const) : ("sse" as const);
-      result[id] = { url: raw.url, type };
-    }
-    return result;
-  }
-
-  private async getAgentMcpServers(
-    agentId: string
-  ): Promise<Record<string, any>> {
-    if (!this.agentSettingsStore) {
-      return {};
-    }
-
-    try {
-      const settings = await this.agentSettingsStore.getSettings(agentId);
-      return settings?.mcpServers || {};
-    } catch (error) {
-      logger.warn(`Failed to load per-agent MCP settings for ${agentId}`, {
-        error,
-      });
-      return {};
-    }
-  }
-
-  private async loadConfig(): Promise<LoadedConfig> {
-    if (!this.cache) {
-      let globalMcpServers: Record<string, any> = {};
-      if (this.configResolver) {
-        globalMcpServers = await this.configResolver.getGlobalMcpServers();
-      }
-      const normalized = normalizeConfig({ mcpServers: globalMcpServers });
-      this.cache = normalized;
-    }
-    return this.cache;
-  }
-}
-
-/**
- * Parse and validate an oauth config from raw MCP server config.
- * Handles backward compat: migrates top-level `resource` into `oauth.resource`,
- * and treats `loginUrl` presence as `oauth: {}` (requiresAuth flag).
- */
-function parseOAuthConfig(raw: any): McpOAuthConfig | undefined {
-  const hasLoginUrl = typeof raw.loginUrl === "string";
-  const hasOAuth = raw.oauth && typeof raw.oauth === "object";
-
-  if (!hasOAuth && !hasLoginUrl && typeof raw.resource !== "string") {
-    return undefined;
-  }
-
-  const config: McpOAuthConfig = {};
-
-  if (hasOAuth) {
-    const obj = raw.oauth;
-    if (typeof obj.authUrl === "string") config.authUrl = obj.authUrl;
-    if (typeof obj.tokenUrl === "string") config.tokenUrl = obj.tokenUrl;
-    if (typeof obj.clientId === "string") config.clientId = obj.clientId;
-    if (typeof obj.clientSecret === "string")
-      config.clientSecret = obj.clientSecret;
-    if (Array.isArray(obj.scopes))
-      config.scopes = obj.scopes.filter((s: unknown) => typeof s === "string");
-    if (typeof obj.deviceAuthorizationUrl === "string")
-      config.deviceAuthorizationUrl = obj.deviceAuthorizationUrl;
-    if (typeof obj.registrationUrl === "string")
-      config.registrationUrl = obj.registrationUrl;
-    if (typeof obj.resource === "string") config.resource = obj.resource;
-  }
-
-  // Migrate top-level resource into oauth.resource (backward compat)
-  if (typeof raw.resource === "string" && !config.resource) {
-    config.resource = raw.resource;
-  }
-
-  return config;
-}
-
-function normalizeConfig(config: { mcpServers: Record<string, any> }) {
-  const rawServers: Record<string, any> = {};
-  const httpServers = new Map<string, HttpMcpServerConfig>();
-
-  for (const [id, serverConfig] of Object.entries(config.mcpServers)) {
-    if (!serverConfig || typeof serverConfig !== "object") {
-      continue;
-    }
-
-    const cloned = cloneConfig(serverConfig);
-    rawServers[id] = cloned;
-
-    if (typeof cloned.url === "string" && isHttpUrl(cloned.url)) {
-      httpServers.set(id, {
-        id,
-        upstreamUrl: cloned.url,
-        oauth: parseOAuthConfig(cloned),
-        inputs: Array.isArray(cloned.inputs)
-          ? cloned.inputs.filter(
-              (input: any) =>
-                input &&
-                typeof input === "object" &&
-                input.type === "promptString"
-            )
-          : undefined,
-        headers:
-          cloned.headers && typeof cloned.headers === "object"
-            ? cloned.headers
-            : undefined,
-      });
-    }
-  }
-
-  return { rawServers, httpServers };
-}
-
-function toHttpServerConfig(
-  id: string,
-  serverConfig: any
-): HttpMcpServerConfig | null {
-  if (!serverConfig || typeof serverConfig !== "object") {
-    return null;
-  }
-
-  if (serverConfig.enabled === false) {
-    return null;
-  }
-
-  const cloned = cloneConfig(serverConfig);
-  if (typeof cloned.url !== "string" || !isHttpUrl(cloned.url)) {
-    return null;
-  }
-
-  return {
-    id,
-    upstreamUrl: cloned.url,
-    oauth: parseOAuthConfig(cloned),
-    inputs: Array.isArray(cloned.inputs)
-      ? cloned.inputs.filter(
-          (input: any) =>
-            input && typeof input === "object" && input.type === "promptString"
-        )
-      : undefined,
-    headers:
-      cloned.headers && typeof cloned.headers === "object"
-        ? cloned.headers
-        : undefined,
-  };
-}
-
-function cloneConfig(config: any) {
-  return JSON.parse(JSON.stringify(config));
-}
-
-function isHttpUrl(candidate: string): boolean {
-  return candidate.startsWith("http://") || candidate.startsWith("https://");
-}
-
-function mergeHeaders(
-  existingHeaders: unknown,
-  workerToken: string,
-  mcpId: string
-): Record<string, string> {
-  const normalized: Record<string, string> = {};
-
-  if (existingHeaders && typeof existingHeaders === "object") {
-    for (const [key, value] of Object.entries(existingHeaders as any)) {
-      if (typeof value === "string") {
-        normalized[key] = value;
-      } else if (value != null) {
-        normalized[key] = String(value);
-      }
-    }
-  }
-
-  normalized.Authorization = `Bearer ${workerToken}`;
-  normalized["X-Mcp-Id"] = mcpId;
-  return normalized;
-}