@mcp-z/oauth-microsoft 1.0.0 → 1.0.1

package/dist/cjs/providers/loopback-oauth.js

@@ -32,6 +32,7 @@ _export(exports, {
     }
 });
 var _oauth = require("@mcp-z/oauth");
+var _crypto = require("crypto");
 var _http = /*#__PURE__*/ _interop_require_wildcard(require("http"));
 var _open = /*#__PURE__*/ _interop_require_default(require("open"));
 var _fetchwithtimeoutts = require("../lib/fetch-with-timeout.js");
@@ -317,7 +318,7 @@ var LoopbackOAuthProvider = /*#__PURE__*/ function() {
    * @returns Access token for API requests
    */ _proto.getAccessToken = function getAccessToken(accountId) {
         return _async_to_generator(function() {
-            var _this_config, logger, service, tokenStore, effectiveAccountId, _tmp, storedToken, refreshedToken, error, headless, _this_config1, clientId, tenantId, scope, existingAccounts, hasOtherAccounts, authUrl, hint, baseDescriptor, descriptor, _ref, token, email;
+            var _this_config, logger, service, tokenStore, effectiveAccountId, _tmp, storedToken, refreshedToken, error, _this_config1, clientId, tenantId, scope, redirectUri, _generatePKCE, codeVerifier, codeChallenge, stateId, authUrl, _ref, token, email;
             return _ts_generator(this, function(_state) {
                 switch(_state.label){
                     case 0:
@@ -414,52 +415,49 @@ var LoopbackOAuthProvider = /*#__PURE__*/ function() {
                             9
                         ];
                     case 9:
-                        // No valid token or no account - check if we can start OAuth flow
-                        headless = this.config.headless;
-                        if (!headless) return [
+                        _this_config1 = this.config, clientId = _this_config1.clientId, tenantId = _this_config1.tenantId, scope = _this_config1.scope, redirectUri = _this_config1.redirectUri;
+                        if (!redirectUri) return [
                             3,
                             11
                         ];
-                        // In headless mode (production), cannot start OAuth flow
-                        // Throw AuthRequiredError with auth_url descriptor for MCP tool response
-                        _this_config1 = this.config, clientId = _this_config1.clientId, tenantId = _this_config1.tenantId, scope = _this_config1.scope;
+                        // Persistent callback mode (cloud deployment with configured redirect_uri)
+                        _generatePKCE = (0, _oauth.generatePKCE)(), codeVerifier = _generatePKCE.verifier, codeChallenge = _generatePKCE.challenge;
+                        stateId = (0, _crypto.randomUUID)();
+                        // Store PKCE verifier for callback (5 minute TTL)
                         return [
                             4,
-                            this.getExistingAccounts()
+                            tokenStore.set("".concat(service, ":pending:").concat(stateId), {
+                                codeVerifier: codeVerifier,
+                                createdAt: Date.now()
+                            }, 5 * 60 * 1000)
                         ];
                     case 10:
-                        existingAccounts = _state.sent();
-                        hasOtherAccounts = effectiveAccountId ? existingAccounts.length > 0 && !existingAccounts.includes(effectiveAccountId) : existingAccounts.length > 0;
-                        // Build informational OAuth URL for headless mode
-                        // Note: No redirect_uri included - user must use account-add tool which starts proper ephemeral server
+                        _state.sent();
+                        // Build auth URL with configured redirect_uri
                         authUrl = new URL("https://login.microsoftonline.com/".concat(tenantId, "/oauth2/v2.0/authorize"));
                         authUrl.searchParams.set('client_id', clientId);
+                        authUrl.searchParams.set('redirect_uri', redirectUri);
                         authUrl.searchParams.set('response_type', 'code');
                         authUrl.searchParams.set('scope', scope);
                         authUrl.searchParams.set('response_mode', 'query');
+                        authUrl.searchParams.set('code_challenge', codeChallenge);
+                        authUrl.searchParams.set('code_challenge_method', 'S256');
+                        authUrl.searchParams.set('state', stateId);
                         authUrl.searchParams.set('prompt', 'select_account');
-                        if (hasOtherAccounts) {
-                            hint = "Existing ".concat(service, " accounts found. Use account-list to view, account-switch to change account, or account-add to add new account");
-                        } else if (effectiveAccountId) {
-                            hint = "Use account-add to authenticate ".concat(effectiveAccountId);
-                        } else {
-                            hint = 'Use account-add to authenticate interactively';
-                        }
-                        baseDescriptor = {
+                        logger.info('OAuth required - persistent callback mode', {
+                            service: service,
+                            redirectUri: redirectUri
+                        });
+                        throw new _typests.AuthRequiredError({
                             kind: 'auth_url',
-                            provider: 'microsoft',
-                            url: authUrl.toString(),
-                            hint: hint
-                        };
-                        descriptor = effectiveAccountId ? _object_spread_props(_object_spread({}, baseDescriptor), {
-                            accountId: effectiveAccountId
-                        }) : baseDescriptor;
-                        throw new _typests.AuthRequiredError(descriptor);
+                            provider: service,
+                            url: authUrl.toString()
+                        });
                     case 11:
-                        // Interactive mode - start ephemeral OAuth flow
+                        // Ephemeral callback mode (local development)
                         logger.info('Starting ephemeral OAuth flow', {
                             service: service,
-                            headless: headless
+                            headless: this.config.headless
                         });
                         return [
                             4,
@@ -467,7 +465,6 @@ var LoopbackOAuthProvider = /*#__PURE__*/ function() {
                         ];
                     case 12:
                         _ref = _state.sent(), token = _ref.token, email = _ref.email;
-                        // Store token with email as accountId
                         return [
                             4,
                             (0, _oauth.setToken)(tokenStore, {
@@ -477,7 +474,6 @@ var LoopbackOAuthProvider = /*#__PURE__*/ function() {
                         ];
                     case 13:
                         _state.sent();
-                        // Register account in account management system
                         return [
                             4,
                             (0, _oauth.addAccount)(tokenStore, {
@@ -487,7 +483,6 @@ var LoopbackOAuthProvider = /*#__PURE__*/ function() {
                         ];
                     case 14:
                         _state.sent();
-                        // Set as active account so subsequent getAccessToken() calls find it
                         return [
                             4,
                             (0, _oauth.setActiveAccount)(tokenStore, {
@@ -497,7 +492,6 @@ var LoopbackOAuthProvider = /*#__PURE__*/ function() {
                         ];
                     case 15:
                         _state.sent();
-                        // Store account metadata (email, added timestamp)
                         return [
                             4,
                             (0, _oauth.setAccountInfo)(tokenStore, {
@@ -538,86 +532,6 @@ var LoopbackOAuthProvider = /*#__PURE__*/ function() {
         };
     };
     /**
-   * Authenticate new account with OAuth flow
-   * Triggers account selection, stores token, registers account
-   *
-   * @returns Email address of newly authenticated account
-   * @throws Error in headless mode (cannot open browser for OAuth)
-   */ _proto.authenticateNewAccount = function authenticateNewAccount() {
-        return _async_to_generator(function() {
-            var _this_config, logger, headless, service, tokenStore, _ref, token, email;
-            return _ts_generator(this, function(_state) {
-                switch(_state.label){
-                    case 0:
-                        _this_config = this.config, logger = _this_config.logger, headless = _this_config.headless, service = _this_config.service, tokenStore = _this_config.tokenStore;
-                        if (headless) {
-                            throw new Error('Cannot authenticate new account in headless mode - interactive OAuth required');
-                        }
-                        logger.info('Starting new account authentication', {
-                            service: service
-                        });
-                        return [
-                            4,
-                            this.performEphemeralOAuthFlow()
-                        ];
-                    case 1:
-                        _ref = _state.sent(), token = _ref.token, email = _ref.email;
-                        // Store token
-                        return [
-                            4,
-                            (0, _oauth.setToken)(tokenStore, {
-                                accountId: email,
-                                service: service
-                            }, token)
-                        ];
-                    case 2:
-                        _state.sent();
-                        // Register account
-                        return [
-                            4,
-                            (0, _oauth.addAccount)(tokenStore, {
-                                service: service,
-                                accountId: email
-                            })
-                        ];
-                    case 3:
-                        _state.sent();
-                        // Set as active account
-                        return [
-                            4,
-                            (0, _oauth.setActiveAccount)(tokenStore, {
-                                service: service,
-                                accountId: email
-                            })
-                        ];
-                    case 4:
-                        _state.sent();
-                        // Store account metadata
-                        return [
-                            4,
-                            (0, _oauth.setAccountInfo)(tokenStore, {
-                                service: service,
-                                accountId: email
-                            }, {
-                                email: email,
-                                addedAt: new Date().toISOString()
-                            })
-                        ];
-                    case 5:
-                        _state.sent();
-                        logger.info('New account authenticated', {
-                            service: service,
-                            email: email
-                        });
-                        return [
-                            2,
-                            email
-                        ];
-                }
-            });
-        }).call(this);
-    };
-    /**
    * Get user email from Microsoft Graph API (pure query)
    * Used to query email for existing authenticated account
    *
@@ -677,24 +591,6 @@ var LoopbackOAuthProvider = /*#__PURE__*/ function() {
             });
         }).call(this);
     };
-    /**
-   * Check for existing accounts in token storage (incremental OAuth detection)
-   *
-   * Uses key-utils helper for forward compatibility with key format changes.
-   *
-   * @returns Array of account IDs that have tokens for this service
-   */ _proto.getExistingAccounts = function getExistingAccounts() {
-        return _async_to_generator(function() {
-            var _this_config, service, tokenStore;
-            return _ts_generator(this, function(_state) {
-                _this_config = this.config, service = _this_config.service, tokenStore = _this_config.tokenStore;
-                return [
-                    2,
-                    (0, _oauth.listAccountIds)(tokenStore, service)
-                ];
-            });
-        }).call(this);
-    };
     _proto.isTokenValid = function isTokenValid(token) {
         if (!token.expiresAt) return true; // No expiry = assume valid
         return Date.now() < token.expiresAt - 60000; // 1 minute buffer
@@ -754,46 +650,50 @@ var LoopbackOAuthProvider = /*#__PURE__*/ function() {
     };
     _proto.performEphemeralOAuthFlow = function performEphemeralOAuthFlow() {
         return _async_to_generator(function() {
-            var _this, _this_config, clientId, tenantId, scope, headless, logger, configRedirectUri, targetHost, targetPort, targetProtocol, callbackPath, useConfiguredUri, parsed;
+            var _this, _this_config, clientId, tenantId, scope, headless, logger, configRedirectUri, listenHost, listenPort, callbackPath, useConfiguredUri, parsed, isLoopback, envPort;
             return _ts_generator(this, function(_state) {
                 _this = this;
                 _this_config = this.config, clientId = _this_config.clientId, tenantId = _this_config.tenantId, scope = _this_config.scope, headless = _this_config.headless, logger = _this_config.logger, configRedirectUri = _this_config.redirectUri;
-                // Parse redirectUri if provided to extract host, protocol, port, and path
-                targetHost = 'localhost'; // Default: localhost (Microsoft requires exact match with registered redirect URI)
-                targetPort = 0; // Default: OS-assigned ephemeral port
-                targetProtocol = 'http:'; // Default: http
+                // Server listen configuration (where ephemeral server binds)
+                listenHost = 'localhost'; // Default: localhost for ephemeral loopback
+                listenPort = 0; // Default: OS-assigned ephemeral port
+                // Redirect URI configuration (what goes in auth URL and token exchange)
                 callbackPath = '/callback'; // Default callback path
                 useConfiguredUri = false;
                 if (configRedirectUri) {
                     try {
                         parsed = new URL(configRedirectUri);
-                        // Use configured redirect URI as-is for production deployments
-                        targetHost = parsed.hostname;
-                        targetProtocol = parsed.protocol;
-                        // Extract port from URL (use default ports if not specified)
-                        if (parsed.port) {
-                            targetPort = Number.parseInt(parsed.port, 10);
+                        isLoopback = parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1';
+                        if (isLoopback) {
+                            // Local development: Listen on specific loopback address/port
+                            listenHost = parsed.hostname;
+                            listenPort = parsed.port ? Number.parseInt(parsed.port, 10) : 0;
                         } else {
-                            targetPort = parsed.protocol === 'https:' ? 443 : 80;
+                            // Cloud deployment: Listen on 0.0.0.0 with PORT from environment
+                            // The redirectUri is the PUBLIC URL (e.g., https://example.com/oauth/callback)
+                            // The server listens on 0.0.0.0:PORT and the load balancer routes to it
+                            listenHost = '0.0.0.0';
+                            envPort = process.env.PORT ? Number.parseInt(process.env.PORT, 10) : undefined;
+                            listenPort = envPort && Number.isFinite(envPort) ? envPort : 8080;
                         }
-                        // Extract path (default to /callback if URL has no path or just '/')
+                        // Extract callback path from URL
                         if (parsed.pathname && parsed.pathname !== '/') {
                             callbackPath = parsed.pathname;
                         }
                         useConfiguredUri = true;
                         logger.debug('Using configured redirect URI', {
-                            host: targetHost,
-                            protocol: targetProtocol,
-                            port: targetPort,
-                            path: callbackPath,
-                            redirectUri: configRedirectUri
+                            listenHost: listenHost,
+                            listenPort: listenPort,
+                            callbackPath: callbackPath,
+                            redirectUri: configRedirectUri,
+                            isLoopback: isLoopback
                         });
                     } catch (error) {
                         logger.warn('Failed to parse redirectUri, using ephemeral defaults', {
                             redirectUri: configRedirectUri,
                             error: _instanceof(error, Error) ? error.message : String(error)
                         });
-                    // Continue with defaults (127.0.0.1, port 0, http, /callback)
+                    // Continue with defaults (localhost, port 0, http, /callback)
                     }
                 }
                 return [
@@ -928,8 +828,11 @@ var LoopbackOAuthProvider = /*#__PURE__*/ function() {
                                 });
                             }).call(_this);
                         });
-                        // Listen on targetPort (0 for OS assignment, or custom port from redirectUri)
-                        server.listen(targetPort, targetHost, function() {
+                        // Listen on configured host/port
+                        // - For loopback (default): localhost with OS-assigned port
+                        // - For configured loopback: specific localhost port from redirectUri
+                        // - For cloud deployment: 0.0.0.0:${PORT} from environment
+                        server.listen(listenPort, listenHost, function() {
                             var address = server === null || server === void 0 ? void 0 : server.address();
                             if (!address || typeof address === 'string') {
                                 server === null || server === void 0 ? void 0 : server.close();
@@ -939,11 +842,11 @@ var LoopbackOAuthProvider = /*#__PURE__*/ function() {
                             serverPort = address.port;
                             // Construct final redirect URI
                             if (useConfiguredUri && configRedirectUri) {
-                                // Use configured redirect URI as-is for production
+                                // Use configured redirect URI as-is (public URL for cloud, or specific local URL)
                                 finalRedirectUri = configRedirectUri;
                             } else {
-                                // Construct ephemeral redirect URI with actual server port
-                                finalRedirectUri = "".concat(targetProtocol, "//").concat(targetHost, ":").concat(serverPort).concat(callbackPath);
+                                // Construct ephemeral redirect URI with actual server port (default local behavior)
+                                finalRedirectUri = "http://localhost:".concat(serverPort).concat(callbackPath);
                             }
                             // Build Microsoft auth URL
                             var authUrl = new URL("https://login.microsoftonline.com/".concat(tenantId, "/oauth2/v2.0/authorize"));
@@ -1111,6 +1014,137 @@ var LoopbackOAuthProvider = /*#__PURE__*/ function() {
         }).call(this);
     };
     /**
+   * Handle OAuth callback from persistent endpoint.
+   * Used by HTTP servers with configured redirectUri.
+   *
+   * @param params - OAuth callback parameters
+   * @returns Email and cached token
+   */ _proto.handleOAuthCallback = function handleOAuthCallback(params) {
+        return _async_to_generator(function() {
+            var code, state, _this_config, logger, service, tokenStore, redirectUri, pendingKey, pendingAuth, tokenResponse, cachedToken, email;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        code = params.code, state = params.state;
+                        _this_config = this.config, logger = _this_config.logger, service = _this_config.service, tokenStore = _this_config.tokenStore, redirectUri = _this_config.redirectUri;
+                        if (!state) {
+                            throw new Error('Missing state parameter in OAuth callback');
+                        }
+                        if (!redirectUri) {
+                            throw new Error('handleOAuthCallback requires configured redirectUri');
+                        }
+                        // Load pending auth (includes PKCE verifier)
+                        pendingKey = "".concat(service, ":pending:").concat(state);
+                        return [
+                            4,
+                            tokenStore.get(pendingKey)
+                        ];
+                    case 1:
+                        pendingAuth = _state.sent();
+                        if (!pendingAuth) {
+                            throw new Error('Invalid or expired OAuth state. Please try again.');
+                        }
+                        if (!(Date.now() - pendingAuth.createdAt > 5 * 60 * 1000)) return [
+                            3,
+                            3
+                        ];
+                        return [
+                            4,
+                            tokenStore.delete(pendingKey)
+                        ];
+                    case 2:
+                        _state.sent();
+                        throw new Error('OAuth state expired. Please try again.');
+                    case 3:
+                        logger.info('Processing OAuth callback', {
+                            service: service,
+                            state: state
+                        });
+                        return [
+                            4,
+                            this.exchangeCodeForToken(code, pendingAuth.codeVerifier, redirectUri)
+                        ];
+                    case 4:
+                        tokenResponse = _state.sent();
+                        // Create cached token
+                        cachedToken = _object_spread({
+                            accessToken: tokenResponse.access_token,
+                            refreshToken: tokenResponse.refresh_token,
+                            expiresAt: tokenResponse.expires_in ? Date.now() + tokenResponse.expires_in * 1000 : undefined
+                        }, tokenResponse.scope !== undefined && {
+                            scope: tokenResponse.scope
+                        });
+                        return [
+                            4,
+                            this.fetchUserEmailFromToken(tokenResponse.access_token)
+                        ];
+                    case 5:
+                        email = _state.sent();
+                        // Store token
+                        return [
+                            4,
+                            (0, _oauth.setToken)(tokenStore, {
+                                accountId: email,
+                                service: service
+                            }, cachedToken)
+                        ];
+                    case 6:
+                        _state.sent();
+                        // Add account and set as active
+                        return [
+                            4,
+                            (0, _oauth.addAccount)(tokenStore, {
+                                service: service,
+                                accountId: email
+                            })
+                        ];
+                    case 7:
+                        _state.sent();
+                        return [
+                            4,
+                            (0, _oauth.setActiveAccount)(tokenStore, {
+                                service: service,
+                                accountId: email
+                            })
+                        ];
+                    case 8:
+                        _state.sent();
+                        // Store account metadata
+                        return [
+                            4,
+                            (0, _oauth.setAccountInfo)(tokenStore, {
+                                service: service,
+                                accountId: email
+                            }, {
+                                email: email,
+                                addedAt: new Date().toISOString()
+                            })
+                        ];
+                    case 9:
+                        _state.sent();
+                        // Clean up pending auth
+                        return [
+                            4,
+                            tokenStore.delete(pendingKey)
+                        ];
+                    case 10:
+                        _state.sent();
+                        logger.info('OAuth callback completed', {
+                            service: service,
+                            email: email
+                        });
+                        return [
+                            2,
+                            {
+                                email: email,
+                                token: cachedToken
+                            }
+                        ];
+                }
+            });
+        }).call(this);
+    };
+    /**
    * Create auth middleware for single-user context (single active account per service)
    *
    * Single-user mode: