@marlinjai/email-mcp 1.7.0 → 1.7.2

package/dist/setup/wizard.js

@@ -2,7 +2,7 @@
 
 
 // src/setup/wizard.ts
-import crypto3 from "node:crypto";
+import crypto4 from "node:crypto";
 import { exec } from "node:child_process";
 
 // src/setup/prompts.ts
@@ -245,6 +245,18 @@ var CredentialStore = class {
     const data = this.read();
     return Object.values(data.accounts);
   }
+  /**
+   * The account already configured for this mailbox, if any. Provider plus
+   * address identifies a mailbox; the address comparison is case-insensitive
+   * because providers report it in varying case.
+   */
+  async findByProviderAndEmail(provider, email) {
+    const wanted = email.trim().toLowerCase();
+    const data = this.read();
+    return Object.values(data.accounts).find(
+      (a) => a.provider === provider && a.email.trim().toLowerCase() === wanted
+    ) ?? null;
+  }
   async remove(id) {
     const data = this.read();
     delete data.accounts[id];
@@ -276,6 +288,7 @@ var OAuthCallbackServer = class {
   rejectCode = null;
   timeoutMs;
   timeoutHandle = null;
+  expectedState = null;
   constructor(timeoutMs = 12e4) {
     this.timeoutMs = timeoutMs;
   }
@@ -286,7 +299,12 @@ var OAuthCallbackServer = class {
         if (url.pathname === "/callback" || url.pathname === "/") {
           const code = url.searchParams.get("code");
           const error = url.searchParams.get("error");
-          if (code) {
+          const state = url.searchParams.get("state");
+          if (code && this.expectedState !== null && state !== this.expectedState) {
+            res.writeHead(400, { "Content-Type": "text/html" });
+            res.end(ERROR_HTML);
+            this.rejectCode?.(new Error("OAuth error: state mismatch, callback did not come from the authorization request we started"));
+          } else if (code) {
             res.writeHead(200, { "Content-Type": "text/html" });
             res.end(SUCCESS_HTML);
             this.resolveCode?.(code);
@@ -311,7 +329,13 @@ var OAuthCallbackServer = class {
       this.server.on("error", reject);
     });
   }
-  waitForCode() {
+  /**
+   * Resolve with the authorization code once the browser is redirected back.
+   * Pass the `state` that was put into the authorization URL: callbacks whose
+   * state does not match are rejected instead of resolved (CSRF protection).
+   */
+  waitForCode(expectedState) {
+    this.expectedState = expectedState ?? null;
     return new Promise((resolve, reject) => {
       this.resolveCode = (code) => {
         if (this.timeoutHandle) clearTimeout(this.timeoutHandle);
@@ -381,15 +405,17 @@ var GmailAuth = class {
   getAuthUrl(redirectUri, scopeMode) {
     const codeVerifier = crypto2.randomBytes(32).toString("base64url");
     const codeChallenge = crypto2.createHash("sha256").update(codeVerifier).digest("base64url");
+    const state = crypto2.randomBytes(16).toString("base64url");
     this.oauth2Client = new OAuth2Client(this.clientId, this.clientSecret, redirectUri);
     const url = this.oauth2Client.generateAuthUrl({
       access_type: "offline",
       scope: GMAIL_SCOPES[resolveScopeMode(scopeMode)],
       prompt: "consent",
       code_challenge: codeChallenge,
-      code_challenge_method: "S256"
+      code_challenge_method: "S256",
+      state
     });
-    return { url, codeVerifier };
+    return { url, codeVerifier, state };
   }
   async exchangeCode(code, codeVerifier) {
     const { tokens } = await this.oauth2Client.getToken({ code, codeVerifier });
@@ -421,6 +447,7 @@ var GmailAuth = class {
 };
 
 // src/providers/outlook/auth.ts
+import crypto3 from "node:crypto";
 import fs2 from "node:fs";
 import path2 from "node:path";
 import os2 from "node:os";
@@ -471,13 +498,15 @@ var OutlookAuth = class _OutlookAuth {
   }
   async getAuthUrl(redirectUri) {
     const { verifier, challenge } = await this.cryptoProvider.generatePkceCodes();
+    const state = crypto3.randomBytes(16).toString("base64url");
     const url = await this.pca.getAuthCodeUrl({
       scopes: _OutlookAuth.SCOPES,
       redirectUri,
       codeChallenge: challenge,
-      codeChallengeMethod: "S256"
+      codeChallengeMethod: "S256",
+      state
     });
-    return { url, codeVerifier: verifier };
+    return { url, codeVerifier: verifier, state };
   }
   async exchangeCode(code, codeVerifier, redirectUri) {
     const result = await this.pca.acquireTokenByCode({
@@ -2864,6 +2893,14 @@ async function testAndSave(creds) {
 async function promptAccountName(defaultName) {
   return askText("Account name:", defaultName);
 }
+async function resolveAccountIdentity(provider, email, defaultName) {
+  const existing = await store.findByProviderAndEmail(provider, email);
+  if (existing) {
+    console.log(`An account for ${email} already exists ("${existing.name}"), updating it in place.`);
+    return { id: existing.id, name: await promptAccountName(existing.name) };
+  }
+  return { id: crypto4.randomUUID(), name: await promptAccountName(defaultName) };
+}
 async function setupGmail(scopeModeFlag) {
   console.log("\n--- Gmail Setup ---");
   if (process.env.EMAIL_MCP_GMAIL_CLIENT_ID) {
@@ -2887,7 +2924,7 @@ async function setupGmail(scopeModeFlag) {
   const port = await server.start();
   const redirectUri = `http://localhost:${port}/callback`;
   const gmailAuth = new GmailAuth(GMAIL_CLIENT_ID, GMAIL_CLIENT_SECRET, redirectUri);
-  const { url, codeVerifier } = gmailAuth.getAuthUrl(redirectUri, scopeMode);
+  const { url, codeVerifier, state } = gmailAuth.getAuthUrl(redirectUri, scopeMode);
   console.log("\nOpening browser for Google authorization...");
   console.log(`If the browser does not open, visit:
 ${url}
@@ -2895,7 +2932,7 @@ ${url}
   openBrowser(url);
   let code;
   try {
-    code = await server.waitForCode();
+    code = await server.waitForCode(state);
   } catch (err) {
     server.shutdown();
     throw new Error(`OAuth flow failed: ${err.message}`);
@@ -2910,8 +2947,7 @@ ${url}
   const email = profile.emailAddress ?? "";
   if (!email) throw new Error("Could not retrieve Gmail address from profile");
   console.log(`Authenticated as ${email}`);
-  const name = await promptAccountName("Gmail");
-  const id = crypto3.randomUUID();
+  const { id, name } = await resolveAccountIdentity(ProviderType.Gmail, email.trim(), "Gmail");
   const creds = {
     id,
     name,
@@ -2928,7 +2964,7 @@ async function setupOutlook() {
   const port = await server.start();
   const redirectUri = `http://localhost:${port}`;
   const outlookAuth = new OutlookAuth(OUTLOOK_CLIENT_ID);
-  const { url, codeVerifier } = await outlookAuth.getAuthUrl(redirectUri);
+  const { url, codeVerifier, state } = await outlookAuth.getAuthUrl(redirectUri);
   console.log("\nOpening browser for Microsoft authorization...");
   console.log(`If the browser does not open, visit:
 ${url}
@@ -2936,7 +2972,7 @@ ${url}
   openBrowser(url);
   let code;
   try {
-    code = await server.waitForCode();
+    code = await server.waitForCode(state);
   } catch (err) {
     server.shutdown();
     throw new Error(`OAuth flow failed: ${err.message}`);
@@ -2948,8 +2984,7 @@ ${url}
   const email = account?.username ?? "";
   if (!email) throw new Error("Could not retrieve email from Microsoft account");
   console.log(`Authenticated as ${email}`);
-  const name = await promptAccountName("Outlook");
-  const id = crypto3.randomUUID();
+  const { id, name } = await resolveAccountIdentity(ProviderType.Outlook, email.trim(), "Outlook");
   const creds = {
     id,
     name,
@@ -2980,8 +3015,7 @@ async function setupICloud() {
     console.log("  Password is required");
     password = await askPassword("App-specific password:");
   }
-  const name = await promptAccountName("iCloud");
-  const id = crypto3.randomUUID();
+  const { id, name } = await resolveAccountIdentity(ProviderType.ICloud, email.trim(), "iCloud");
   const creds = {
     id,
     name,
@@ -3021,8 +3055,7 @@ async function setupIMAP() {
     const smtpPortStr = await askValidated("SMTP port:", "587", portValidator);
     smtpPort = parseInt(smtpPortStr, 10);
   }
-  const name = await promptAccountName("IMAP");
-  const id = crypto3.randomUUID();
+  const { id, name } = await resolveAccountIdentity(ProviderType.IMAP, email.trim(), "IMAP");
   const creds = {
     id,
     name,