@marlinjai/email-mcp 1.7.0 → 1.7.2

package/README.md

@@ -1,5 +1,7 @@
 # @marlinjai/email-mcp
 
+<p align="center"><img src="assets/icon-512.png" width="120" height="120" alt="email-mcp logo"></p>
+
 A unified MCP server for email access across Gmail, Outlook, iCloud, and generic IMAP providers.
 
 ## Features

package/dist/index.js

@@ -175,6 +175,18 @@ var init_credential_store = __esm({
         const data = this.read();
         return Object.values(data.accounts);
       }
+      /**
+       * The account already configured for this mailbox, if any. Provider plus
+       * address identifies a mailbox; the address comparison is case-insensitive
+       * because providers report it in varying case.
+       */
+      async findByProviderAndEmail(provider, email3) {
+        const wanted = email3.trim().toLowerCase();
+        const data = this.read();
+        return Object.values(data.accounts).find(
+          (a) => a.provider === provider && a.email.trim().toLowerCase() === wanted
+        ) ?? null;
+      }
       async remove(id) {
         const data = this.read();
         delete data.accounts[id];
@@ -7710,15 +7722,17 @@ var init_auth = __esm({
       getAuthUrl(redirectUri, scopeMode) {
         const codeVerifier = crypto2.randomBytes(32).toString("base64url");
         const codeChallenge = crypto2.createHash("sha256").update(codeVerifier).digest("base64url");
+        const state = crypto2.randomBytes(16).toString("base64url");
         this.oauth2Client = new OAuth2Client2(this.clientId, this.clientSecret, redirectUri);
         const url2 = this.oauth2Client.generateAuthUrl({
           access_type: "offline",
           scope: GMAIL_SCOPES[resolveScopeMode(scopeMode)],
           prompt: "consent",
           code_challenge: codeChallenge,
-          code_challenge_method: "S256"
+          code_challenge_method: "S256",
+          state
         });
-        return { url: url2, codeVerifier };
+        return { url: url2, codeVerifier, state };
       }
       async exchangeCode(code, codeVerifier) {
         const { tokens } = await this.oauth2Client.getToken({ code, codeVerifier });
@@ -8369,6 +8383,7 @@ var init_adapter2 = __esm({
 });
 
 // src/providers/outlook/auth.ts
+import crypto3 from "node:crypto";
 import fs2 from "node:fs";
 import path2 from "node:path";
 import os2 from "node:os";
@@ -8423,13 +8438,15 @@ var init_auth2 = __esm({
       }
       async getAuthUrl(redirectUri) {
         const { verifier, challenge } = await this.cryptoProvider.generatePkceCodes();
+        const state = crypto3.randomBytes(16).toString("base64url");
         const url2 = await this.pca.getAuthCodeUrl({
           scopes: _OutlookAuth.SCOPES,
           redirectUri,
           codeChallenge: challenge,
-          codeChallengeMethod: "S256"
+          codeChallengeMethod: "S256",
+          state
         });
-        return { url: url2, codeVerifier: verifier };
+        return { url: url2, codeVerifier: verifier, state };
       }
       async exchangeCode(code, codeVerifier, redirectUri) {
         const result = await this.pca.acquireTokenByCode({
@@ -9660,6 +9677,7 @@ var init_oauth_server = __esm({
       rejectCode = null;
       timeoutMs;
       timeoutHandle = null;
+      expectedState = null;
       constructor(timeoutMs = 12e4) {
         this.timeoutMs = timeoutMs;
       }
@@ -9670,7 +9688,12 @@ var init_oauth_server = __esm({
             if (url2.pathname === "/callback" || url2.pathname === "/") {
               const code = url2.searchParams.get("code");
               const error48 = url2.searchParams.get("error");
-              if (code) {
+              const state = url2.searchParams.get("state");
+              if (code && this.expectedState !== null && state !== this.expectedState) {
+                res.writeHead(400, { "Content-Type": "text/html" });
+                res.end(ERROR_HTML);
+                this.rejectCode?.(new Error("OAuth error: state mismatch, callback did not come from the authorization request we started"));
+              } else if (code) {
                 res.writeHead(200, { "Content-Type": "text/html" });
                 res.end(SUCCESS_HTML);
                 this.resolveCode?.(code);
@@ -9695,7 +9718,13 @@ var init_oauth_server = __esm({
           this.server.on("error", reject);
         });
       }
-      waitForCode() {
+      /**
+       * Resolve with the authorization code once the browser is redirected back.
+       * Pass the `state` that was put into the authorization URL: callbacks whose
+       * state does not match are rejected instead of resolved (CSRF protection).
+       */
+      waitForCode(expectedState) {
+        this.expectedState = expectedState ?? null;
         return new Promise((resolve, reject) => {
           this.resolveCode = (code) => {
             if (this.timeoutHandle) clearTimeout(this.timeoutHandle);
@@ -9727,7 +9756,7 @@ var init_oauth_server = __esm({
 
 // src/setup/wizard.ts
 var wizard_exports = {};
-import crypto4 from "node:crypto";
+import crypto5 from "node:crypto";
 import { exec } from "node:child_process";
 function openBrowser(url2) {
   const platform = process.platform;
@@ -9771,6 +9800,14 @@ async function testAndSave(creds) {
 async function promptAccountName(defaultName) {
   return askText("Account name:", defaultName);
 }
+async function resolveAccountIdentity(provider, email3, defaultName) {
+  const existing = await store.findByProviderAndEmail(provider, email3);
+  if (existing) {
+    console.log(`An account for ${email3} already exists ("${existing.name}"), updating it in place.`);
+    return { id: existing.id, name: await promptAccountName(existing.name) };
+  }
+  return { id: crypto5.randomUUID(), name: await promptAccountName(defaultName) };
+}
 async function setupGmail(scopeModeFlag) {
   console.log("\n--- Gmail Setup ---");
   if (process.env.EMAIL_MCP_GMAIL_CLIENT_ID) {
@@ -9794,7 +9831,7 @@ async function setupGmail(scopeModeFlag) {
   const port = await server.start();
   const redirectUri = `http://localhost:${port}/callback`;
   const gmailAuth = new GmailAuth(GMAIL_CLIENT_ID, GMAIL_CLIENT_SECRET, redirectUri);
-  const { url: url2, codeVerifier } = gmailAuth.getAuthUrl(redirectUri, scopeMode);
+  const { url: url2, codeVerifier, state } = gmailAuth.getAuthUrl(redirectUri, scopeMode);
   console.log("\nOpening browser for Google authorization...");
   console.log(`If the browser does not open, visit:
 ${url2}
@@ -9802,7 +9839,7 @@ ${url2}
   openBrowser(url2);
   let code;
   try {
-    code = await server.waitForCode();
+    code = await server.waitForCode(state);
   } catch (err) {
     server.shutdown();
     throw new Error(`OAuth flow failed: ${err.message}`);
@@ -9817,8 +9854,7 @@ ${url2}
   const email3 = profile.emailAddress ?? "";
   if (!email3) throw new Error("Could not retrieve Gmail address from profile");
   console.log(`Authenticated as ${email3}`);
-  const name = await promptAccountName("Gmail");
-  const id = crypto4.randomUUID();
+  const { id, name } = await resolveAccountIdentity(ProviderType.Gmail, email3.trim(), "Gmail");
   const creds = {
     id,
     name,
@@ -9835,7 +9871,7 @@ async function setupOutlook() {
   const port = await server.start();
   const redirectUri = `http://localhost:${port}`;
   const outlookAuth = new OutlookAuth(OUTLOOK_CLIENT_ID);
-  const { url: url2, codeVerifier } = await outlookAuth.getAuthUrl(redirectUri);
+  const { url: url2, codeVerifier, state } = await outlookAuth.getAuthUrl(redirectUri);
   console.log("\nOpening browser for Microsoft authorization...");
   console.log(`If the browser does not open, visit:
 ${url2}
@@ -9843,7 +9879,7 @@ ${url2}
   openBrowser(url2);
   let code;
   try {
-    code = await server.waitForCode();
+    code = await server.waitForCode(state);
   } catch (err) {
     server.shutdown();
     throw new Error(`OAuth flow failed: ${err.message}`);
@@ -9855,8 +9891,7 @@ ${url2}
   const email3 = account?.username ?? "";
   if (!email3) throw new Error("Could not retrieve email from Microsoft account");
   console.log(`Authenticated as ${email3}`);
-  const name = await promptAccountName("Outlook");
-  const id = crypto4.randomUUID();
+  const { id, name } = await resolveAccountIdentity(ProviderType.Outlook, email3.trim(), "Outlook");
   const creds = {
     id,
     name,
@@ -9887,8 +9922,7 @@ async function setupICloud() {
     console.log("  Password is required");
     password = await askPassword("App-specific password:");
   }
-  const name = await promptAccountName("iCloud");
-  const id = crypto4.randomUUID();
+  const { id, name } = await resolveAccountIdentity(ProviderType.ICloud, email3.trim(), "iCloud");
   const creds = {
     id,
     name,
@@ -9928,8 +9962,7 @@ async function setupIMAP() {
     const smtpPortStr = await askValidated("SMTP port:", "587", portValidator);
     smtpPort = parseInt(smtpPortStr, 10);
   }
-  const name = await promptAccountName("IMAP");
-  const id = crypto4.randomUUID();
+  const { id, name } = await resolveAccountIdentity(ProviderType.IMAP, email3.trim(), "IMAP");
   const creds = {
     id,
     name,
@@ -33215,7 +33248,7 @@ var StdioServerTransport = class {
 init_account_manager();
 
 // src/tools/accounts.ts
-import crypto3 from "node:crypto";
+import crypto4 from "node:crypto";
 function jsonResult(data) {
   return { content: [{ type: "text", text: JSON.stringify(data) }] };
 }
@@ -33270,7 +33303,7 @@ function registerAccountTools(server, accountManager) {
             error: "IMAP host and port are required for non-iCloud providers"
           });
         }
-        const accountId = crypto3.randomUUID();
+        const accountId = crypto4.randomUUID();
         const creds = {
           id: accountId,
           name: args.name,