@marlinjai/email-mcp 1.7.0 → 1.7.1

package/README.md

@@ -1,5 +1,7 @@
 # @marlinjai/email-mcp
 
+<p align="center"><img src="assets/icon-512.png" width="120" height="120" alt="email-mcp logo"></p>
+
 A unified MCP server for email access across Gmail, Outlook, iCloud, and generic IMAP providers.
 
 ## Features

package/dist/index.js

@@ -7710,15 +7710,17 @@ var init_auth = __esm({
       getAuthUrl(redirectUri, scopeMode) {
         const codeVerifier = crypto2.randomBytes(32).toString("base64url");
         const codeChallenge = crypto2.createHash("sha256").update(codeVerifier).digest("base64url");
+        const state = crypto2.randomBytes(16).toString("base64url");
         this.oauth2Client = new OAuth2Client2(this.clientId, this.clientSecret, redirectUri);
         const url2 = this.oauth2Client.generateAuthUrl({
           access_type: "offline",
           scope: GMAIL_SCOPES[resolveScopeMode(scopeMode)],
           prompt: "consent",
           code_challenge: codeChallenge,
-          code_challenge_method: "S256"
+          code_challenge_method: "S256",
+          state
         });
-        return { url: url2, codeVerifier };
+        return { url: url2, codeVerifier, state };
       }
       async exchangeCode(code, codeVerifier) {
         const { tokens } = await this.oauth2Client.getToken({ code, codeVerifier });
@@ -8369,6 +8371,7 @@ var init_adapter2 = __esm({
 });
 
 // src/providers/outlook/auth.ts
+import crypto3 from "node:crypto";
 import fs2 from "node:fs";
 import path2 from "node:path";
 import os2 from "node:os";
@@ -8423,13 +8426,15 @@ var init_auth2 = __esm({
       }
       async getAuthUrl(redirectUri) {
         const { verifier, challenge } = await this.cryptoProvider.generatePkceCodes();
+        const state = crypto3.randomBytes(16).toString("base64url");
         const url2 = await this.pca.getAuthCodeUrl({
           scopes: _OutlookAuth.SCOPES,
           redirectUri,
           codeChallenge: challenge,
-          codeChallengeMethod: "S256"
+          codeChallengeMethod: "S256",
+          state
         });
-        return { url: url2, codeVerifier: verifier };
+        return { url: url2, codeVerifier: verifier, state };
       }
       async exchangeCode(code, codeVerifier, redirectUri) {
         const result = await this.pca.acquireTokenByCode({
@@ -9660,6 +9665,7 @@ var init_oauth_server = __esm({
       rejectCode = null;
       timeoutMs;
       timeoutHandle = null;
+      expectedState = null;
       constructor(timeoutMs = 12e4) {
         this.timeoutMs = timeoutMs;
       }
@@ -9670,7 +9676,12 @@ var init_oauth_server = __esm({
             if (url2.pathname === "/callback" || url2.pathname === "/") {
               const code = url2.searchParams.get("code");
               const error48 = url2.searchParams.get("error");
-              if (code) {
+              const state = url2.searchParams.get("state");
+              if (code && this.expectedState !== null && state !== this.expectedState) {
+                res.writeHead(400, { "Content-Type": "text/html" });
+                res.end(ERROR_HTML);
+                this.rejectCode?.(new Error("OAuth error: state mismatch, callback did not come from the authorization request we started"));
+              } else if (code) {
                 res.writeHead(200, { "Content-Type": "text/html" });
                 res.end(SUCCESS_HTML);
                 this.resolveCode?.(code);
@@ -9695,7 +9706,13 @@ var init_oauth_server = __esm({
           this.server.on("error", reject);
         });
       }
-      waitForCode() {
+      /**
+       * Resolve with the authorization code once the browser is redirected back.
+       * Pass the `state` that was put into the authorization URL: callbacks whose
+       * state does not match are rejected instead of resolved (CSRF protection).
+       */
+      waitForCode(expectedState) {
+        this.expectedState = expectedState ?? null;
         return new Promise((resolve, reject) => {
           this.resolveCode = (code) => {
             if (this.timeoutHandle) clearTimeout(this.timeoutHandle);
@@ -9727,7 +9744,7 @@ var init_oauth_server = __esm({
 
 // src/setup/wizard.ts
 var wizard_exports = {};
-import crypto4 from "node:crypto";
+import crypto5 from "node:crypto";
 import { exec } from "node:child_process";
 function openBrowser(url2) {
   const platform = process.platform;
@@ -9794,7 +9811,7 @@ async function setupGmail(scopeModeFlag) {
   const port = await server.start();
   const redirectUri = `http://localhost:${port}/callback`;
   const gmailAuth = new GmailAuth(GMAIL_CLIENT_ID, GMAIL_CLIENT_SECRET, redirectUri);
-  const { url: url2, codeVerifier } = gmailAuth.getAuthUrl(redirectUri, scopeMode);
+  const { url: url2, codeVerifier, state } = gmailAuth.getAuthUrl(redirectUri, scopeMode);
   console.log("\nOpening browser for Google authorization...");
   console.log(`If the browser does not open, visit:
 ${url2}
@@ -9802,7 +9819,7 @@ ${url2}
   openBrowser(url2);
   let code;
   try {
-    code = await server.waitForCode();
+    code = await server.waitForCode(state);
   } catch (err) {
     server.shutdown();
     throw new Error(`OAuth flow failed: ${err.message}`);
@@ -9818,7 +9835,7 @@ ${url2}
   if (!email3) throw new Error("Could not retrieve Gmail address from profile");
   console.log(`Authenticated as ${email3}`);
   const name = await promptAccountName("Gmail");
-  const id = crypto4.randomUUID();
+  const id = crypto5.randomUUID();
   const creds = {
     id,
     name,
@@ -9835,7 +9852,7 @@ async function setupOutlook() {
   const port = await server.start();
   const redirectUri = `http://localhost:${port}`;
   const outlookAuth = new OutlookAuth(OUTLOOK_CLIENT_ID);
-  const { url: url2, codeVerifier } = await outlookAuth.getAuthUrl(redirectUri);
+  const { url: url2, codeVerifier, state } = await outlookAuth.getAuthUrl(redirectUri);
   console.log("\nOpening browser for Microsoft authorization...");
   console.log(`If the browser does not open, visit:
 ${url2}
@@ -9843,7 +9860,7 @@ ${url2}
   openBrowser(url2);
   let code;
   try {
-    code = await server.waitForCode();
+    code = await server.waitForCode(state);
   } catch (err) {
     server.shutdown();
     throw new Error(`OAuth flow failed: ${err.message}`);
@@ -9856,7 +9873,7 @@ ${url2}
   if (!email3) throw new Error("Could not retrieve email from Microsoft account");
   console.log(`Authenticated as ${email3}`);
   const name = await promptAccountName("Outlook");
-  const id = crypto4.randomUUID();
+  const id = crypto5.randomUUID();
   const creds = {
     id,
     name,
@@ -9888,7 +9905,7 @@ async function setupICloud() {
     password = await askPassword("App-specific password:");
   }
   const name = await promptAccountName("iCloud");
-  const id = crypto4.randomUUID();
+  const id = crypto5.randomUUID();
   const creds = {
     id,
     name,
@@ -9929,7 +9946,7 @@ async function setupIMAP() {
     smtpPort = parseInt(smtpPortStr, 10);
   }
   const name = await promptAccountName("IMAP");
-  const id = crypto4.randomUUID();
+  const id = crypto5.randomUUID();
   const creds = {
     id,
     name,
@@ -33215,7 +33232,7 @@ var StdioServerTransport = class {
 init_account_manager();
 
 // src/tools/accounts.ts
-import crypto3 from "node:crypto";
+import crypto4 from "node:crypto";
 function jsonResult(data) {
   return { content: [{ type: "text", text: JSON.stringify(data) }] };
 }
@@ -33270,7 +33287,7 @@ function registerAccountTools(server, accountManager) {
             error: "IMAP host and port are required for non-iCloud providers"
           });
         }
-        const accountId = crypto3.randomUUID();
+        const accountId = crypto4.randomUUID();
         const creds = {
           id: accountId,
           name: args.name,