@marlinjai/email-mcp 1.7.0 → 1.7.1

package/dist/setup/wizard.js

@@ -2,7 +2,7 @@
 
 
 // src/setup/wizard.ts
-import crypto3 from "node:crypto";
+import crypto4 from "node:crypto";
 import { exec } from "node:child_process";
 
 // src/setup/prompts.ts
@@ -276,6 +276,7 @@ var OAuthCallbackServer = class {
   rejectCode = null;
   timeoutMs;
   timeoutHandle = null;
+  expectedState = null;
   constructor(timeoutMs = 12e4) {
     this.timeoutMs = timeoutMs;
   }
@@ -286,7 +287,12 @@ var OAuthCallbackServer = class {
         if (url.pathname === "/callback" || url.pathname === "/") {
           const code = url.searchParams.get("code");
           const error = url.searchParams.get("error");
-          if (code) {
+          const state = url.searchParams.get("state");
+          if (code && this.expectedState !== null && state !== this.expectedState) {
+            res.writeHead(400, { "Content-Type": "text/html" });
+            res.end(ERROR_HTML);
+            this.rejectCode?.(new Error("OAuth error: state mismatch, callback did not come from the authorization request we started"));
+          } else if (code) {
             res.writeHead(200, { "Content-Type": "text/html" });
             res.end(SUCCESS_HTML);
             this.resolveCode?.(code);
@@ -311,7 +317,13 @@ var OAuthCallbackServer = class {
       this.server.on("error", reject);
     });
   }
-  waitForCode() {
+  /**
+   * Resolve with the authorization code once the browser is redirected back.
+   * Pass the `state` that was put into the authorization URL: callbacks whose
+   * state does not match are rejected instead of resolved (CSRF protection).
+   */
+  waitForCode(expectedState) {
+    this.expectedState = expectedState ?? null;
     return new Promise((resolve, reject) => {
       this.resolveCode = (code) => {
         if (this.timeoutHandle) clearTimeout(this.timeoutHandle);
@@ -381,15 +393,17 @@ var GmailAuth = class {
   getAuthUrl(redirectUri, scopeMode) {
     const codeVerifier = crypto2.randomBytes(32).toString("base64url");
     const codeChallenge = crypto2.createHash("sha256").update(codeVerifier).digest("base64url");
+    const state = crypto2.randomBytes(16).toString("base64url");
     this.oauth2Client = new OAuth2Client(this.clientId, this.clientSecret, redirectUri);
     const url = this.oauth2Client.generateAuthUrl({
       access_type: "offline",
       scope: GMAIL_SCOPES[resolveScopeMode(scopeMode)],
       prompt: "consent",
       code_challenge: codeChallenge,
-      code_challenge_method: "S256"
+      code_challenge_method: "S256",
+      state
     });
-    return { url, codeVerifier };
+    return { url, codeVerifier, state };
   }
   async exchangeCode(code, codeVerifier) {
     const { tokens } = await this.oauth2Client.getToken({ code, codeVerifier });
@@ -421,6 +435,7 @@ var GmailAuth = class {
 };
 
 // src/providers/outlook/auth.ts
+import crypto3 from "node:crypto";
 import fs2 from "node:fs";
 import path2 from "node:path";
 import os2 from "node:os";
@@ -471,13 +486,15 @@ var OutlookAuth = class _OutlookAuth {
   }
   async getAuthUrl(redirectUri) {
     const { verifier, challenge } = await this.cryptoProvider.generatePkceCodes();
+    const state = crypto3.randomBytes(16).toString("base64url");
     const url = await this.pca.getAuthCodeUrl({
       scopes: _OutlookAuth.SCOPES,
       redirectUri,
       codeChallenge: challenge,
-      codeChallengeMethod: "S256"
+      codeChallengeMethod: "S256",
+      state
     });
-    return { url, codeVerifier: verifier };
+    return { url, codeVerifier: verifier, state };
   }
   async exchangeCode(code, codeVerifier, redirectUri) {
     const result = await this.pca.acquireTokenByCode({
@@ -2887,7 +2904,7 @@ async function setupGmail(scopeModeFlag) {
   const port = await server.start();
   const redirectUri = `http://localhost:${port}/callback`;
   const gmailAuth = new GmailAuth(GMAIL_CLIENT_ID, GMAIL_CLIENT_SECRET, redirectUri);
-  const { url, codeVerifier } = gmailAuth.getAuthUrl(redirectUri, scopeMode);
+  const { url, codeVerifier, state } = gmailAuth.getAuthUrl(redirectUri, scopeMode);
   console.log("\nOpening browser for Google authorization...");
   console.log(`If the browser does not open, visit:
 ${url}
@@ -2895,7 +2912,7 @@ ${url}
   openBrowser(url);
   let code;
   try {
-    code = await server.waitForCode();
+    code = await server.waitForCode(state);
   } catch (err) {
     server.shutdown();
     throw new Error(`OAuth flow failed: ${err.message}`);
@@ -2911,7 +2928,7 @@ ${url}
   if (!email) throw new Error("Could not retrieve Gmail address from profile");
   console.log(`Authenticated as ${email}`);
   const name = await promptAccountName("Gmail");
-  const id = crypto3.randomUUID();
+  const id = crypto4.randomUUID();
   const creds = {
     id,
     name,
@@ -2928,7 +2945,7 @@ async function setupOutlook() {
   const port = await server.start();
   const redirectUri = `http://localhost:${port}`;
   const outlookAuth = new OutlookAuth(OUTLOOK_CLIENT_ID);
-  const { url, codeVerifier } = await outlookAuth.getAuthUrl(redirectUri);
+  const { url, codeVerifier, state } = await outlookAuth.getAuthUrl(redirectUri);
   console.log("\nOpening browser for Microsoft authorization...");
   console.log(`If the browser does not open, visit:
 ${url}
@@ -2936,7 +2953,7 @@ ${url}
   openBrowser(url);
   let code;
   try {
-    code = await server.waitForCode();
+    code = await server.waitForCode(state);
   } catch (err) {
     server.shutdown();
     throw new Error(`OAuth flow failed: ${err.message}`);
@@ -2949,7 +2966,7 @@ ${url}
   if (!email) throw new Error("Could not retrieve email from Microsoft account");
   console.log(`Authenticated as ${email}`);
   const name = await promptAccountName("Outlook");
-  const id = crypto3.randomUUID();
+  const id = crypto4.randomUUID();
   const creds = {
     id,
     name,
@@ -2981,7 +2998,7 @@ async function setupICloud() {
     password = await askPassword("App-specific password:");
   }
   const name = await promptAccountName("iCloud");
-  const id = crypto3.randomUUID();
+  const id = crypto4.randomUUID();
   const creds = {
     id,
     name,
@@ -3022,7 +3039,7 @@ async function setupIMAP() {
     smtpPort = parseInt(smtpPortStr, 10);
   }
   const name = await promptAccountName("IMAP");
-  const id = crypto3.randomUUID();
+  const id = crypto4.randomUUID();
   const creds = {
     id,
     name,