@mmerterden/multi-agent-pipeline 11.2.0 → 11.3.0

package/pipeline/skills/figma-common/figma-setup/scripts/fetch-mcp-token.py

@@ -1,592 +0,0 @@
-#!/usr/bin/env python3
-"""
-Figma Remote MCP Token Fetcher
-
-Retrieves or refreshes a Figma MCP OAuth token. Three modes:
-
-MODE 1  -  Extract (default):
-    Reads existing token from Keychain or Claude Code credentials.
-    python3 fetch-mcp-token.py
-
-MODE 2  -  OAuth (--oauth):
-    Runs full OAuth flow. Opens browser for Figma consent, runs local
-    callback server, exchanges code for token. Works from ANY terminal.
-    python3 fetch-mcp-token.py --oauth --client-id X --client-secret Y --save-keychain
-
-    Credentials are extracted from Claude Code keychain if available,
-    or must be provided via --client-id and --client-secret.
-
-COMMON FLAGS:
-    --save-keychain   Save token to macOS Keychain as FIGMA_MCP_TOKEN
-    --verify          Verify token against Figma MCP server
-    --quiet           Only print the token to stdout
-    --port PORT       Local callback server port (default: 8923)
-    --client-id       OAuth client ID (required for --oauth if no Claude Code)
-    --client-secret   OAuth client secret (required for --oauth if no Claude Code)
-    --show-clients    Show OAuth clients from Claude Code credentials
-"""
-
-import argparse
-import base64
-import hashlib
-import http.server
-import json
-import os
-import re
-import secrets
-import subprocess
-import sys
-import threading
-import time
-import urllib.parse
-import urllib.request
-
-# ─── Configuration ──────────────────────────────────────────────────────────
-
-KEYCHAIN_SERVICE = "FIGMA_MCP_TOKEN"
-KEYCHAIN_REFRESH_SERVICE = "FIGMA_MCP_REFRESH_TOKEN"
-KEYCHAIN_CLIENT_ID_SERVICE = "FIGMA_MCP_CLIENT_ID"
-KEYCHAIN_CLIENT_SECRET_SERVICE = "FIGMA_MCP_CLIENT_SECRET"
-CLAUDE_CREDENTIALS_SERVICE = "Claude Code-credentials"
-MCP_SERVER_URL = "https://mcp.figma.com/mcp"
-AUTH_ENDPOINT = "https://www.figma.com/oauth/mcp"
-TOKEN_ENDPOINT = "https://api.figma.com/v1/oauth/token"
-REFRESH_ENDPOINT = "https://api.figma.com/v1/oauth/refresh"
-DEFAULT_PORT = 8923
-
-
-# ─── Helpers ────────────────────────────────────────────────────────────────
-
-def log(msg):
-    print(f"[fetch-mcp-token] {msg}", file=sys.stderr)
-
-
-def get_claude_credentials_raw():
-    """Read raw Claude Code credentials from Keychain."""
-    try:
-        return subprocess.check_output(
-            ["security", "find-generic-password", "-s", CLAUDE_CREDENTIALS_SERVICE,
-             "-a", os.environ["USER"], "-w"],
-            stderr=subprocess.DEVNULL
-        ).decode()
-    except (subprocess.CalledProcessError, KeyError):
-        return None
-
-
-# ─── Token Sources ──────────────────────────────────────────────────────────
-
-def get_from_dedicated_keychain():
-    """Source 1: Dedicated FIGMA_MCP_TOKEN keychain entry."""
-    try:
-        token = subprocess.check_output(
-            ["security", "find-generic-password", "-a", os.environ["USER"],
-             "-s", KEYCHAIN_SERVICE, "-w"],
-            stderr=subprocess.DEVNULL
-        ).decode().strip()
-        if token and token.startswith("figu_"):
-            return token, "keychain:FIGMA_MCP_TOKEN"
-    except (subprocess.CalledProcessError, KeyError):
-        pass
-    return None, None
-
-
-def get_from_claude_credentials():
-    """Source 2: Extract accessToken from Claude Code's credential store."""
-    raw = get_claude_credentials_raw()
-    if not raw:
-        return None, None
-    match = re.search(
-        r'"figma-remote\|[^"]+":\{[^}]*"accessToken":"([^"]+)"', raw
-    )
-    if match:
-        token = match.group(1)
-        if token.startswith("figu_"):
-            return token, "keychain:Claude Code-credentials"
-    return None, None
-
-
-def get_expiry_from_claude_credentials():
-    """Extract expiresAt from Claude Code credentials."""
-    raw = get_claude_credentials_raw()
-    if not raw:
-        return None
-    match = re.search(
-        r'"figma-remote\|[^"]+":\{[^}]*"expiresAt":(\d+)', raw
-    )
-    if match:
-        import datetime
-        ts = int(match.group(1)) / 1000
-        return datetime.datetime.fromtimestamp(ts).isoformat()
-    return None
-
-
-def get_client_credentials_from_claude():
-    """Extract clientId + clientSecret from Claude Code credentials."""
-    raw = get_claude_credentials_raw()
-    if not raw:
-        return []
-    clients = []
-    # Find all clientRegistration blocks with their parent server context
-    for m in re.finditer(r'"clientId":"([^"]+)"', raw):
-        cid = m.group(1)
-        # Look for clientSecret right after
-        after = raw[m.end():m.end() + 200]
-        sec_match = re.search(r'"clientSecret":"([^"]+)"', after)
-        # Look backwards for serverName
-        before = raw[max(0, m.start() - 500):m.start()]
-        srv_match = re.search(r'"serverName":"([^"]+)"', before)
-        url_match = re.search(r'"serverUrl":"([^"]+)"', before)
-        clients.append({
-            "clientId": cid,
-            "clientSecret": sec_match.group(1) if sec_match else None,
-            "serverName": srv_match.group(1) if srv_match else "unknown",
-            "serverUrl": url_match.group(1) if url_match else "unknown",
-        })
-    return clients
-
-
-# ─── Keychain & Verify ──────────────────────────────────────────────────────
-
-def save_to_keychain(token, service=KEYCHAIN_SERVICE):
-    """Save token to macOS Keychain."""
-    user = os.environ.get("USER", "")
-    subprocess.run(
-        ["security", "delete-generic-password", "-a", user, "-s", service],
-        capture_output=True
-    )
-    result = subprocess.run(
-        ["security", "add-generic-password", "-a", user, "-s", service, "-w", token],
-        capture_output=True
-    )
-    return result.returncode == 0
-
-
-def get_refresh_token_from_keychain():
-    """Read refresh token from macOS Keychain."""
-    try:
-        return subprocess.check_output(
-            ["security", "find-generic-password", "-a", os.environ["USER"],
-             "-s", KEYCHAIN_REFRESH_SERVICE, "-w"],
-            stderr=subprocess.DEVNULL
-        ).decode().strip() or None
-    except (subprocess.CalledProcessError, KeyError):
-        return None
-
-
-def get_client_credentials_from_keychain():
-    """Read client_id and client_secret from macOS Keychain."""
-    try:
-        cid = subprocess.check_output(
-            ["security", "find-generic-password", "-a", os.environ["USER"],
-             "-s", KEYCHAIN_CLIENT_ID_SERVICE, "-w"],
-            stderr=subprocess.DEVNULL
-        ).decode().strip()
-        csec = subprocess.check_output(
-            ["security", "find-generic-password", "-a", os.environ["USER"],
-             "-s", KEYCHAIN_CLIENT_SECRET_SERVICE, "-w"],
-            stderr=subprocess.DEVNULL
-        ).decode().strip()
-        if cid and csec:
-            return cid, csec
-    except (subprocess.CalledProcessError, KeyError):
-        pass
-    return None, None
-
-
-def refresh_access_token(refresh_token, client_id, client_secret):
-    """Use refresh_token to obtain a new access_token from Figma."""
-    auth_str = base64.b64encode(f"{client_id}:{client_secret}".encode()).decode()
-    body = urllib.parse.urlencode({"refresh_token": refresh_token}).encode()
-    req = urllib.request.Request(
-        REFRESH_ENDPOINT,
-        data=body,
-        headers={
-            "Content-Type": "application/x-www-form-urlencoded",
-            "Authorization": f"Basic {auth_str}",
-        },
-        method="POST",
-    )
-    try:
-        with urllib.request.urlopen(req) as resp:
-            result = json.loads(resp.read().decode())
-    except urllib.error.HTTPError as e:
-        body_text = e.read().decode()
-        log(f"Refresh failed (HTTP {e.code}): {body_text}")
-        return None
-
-    new_token = result.get("access_token")
-    expires_in = result.get("expires_in", "unknown")
-    if new_token:
-        log(f"Token refreshed: {new_token[:10]}...{new_token[-6:]}")
-        log(f"Expires in: {expires_in}s")
-    else:
-        log(f"No access_token in refresh response: {json.dumps(result, indent=2)}")
-    return new_token
-
-
-def verify_token(token):
-    """Verify token against Figma MCP server."""
-    try:
-        req = urllib.request.Request(
-            MCP_SERVER_URL,
-            data=json.dumps({
-                "jsonrpc": "2.0",
-                "method": "initialize",
-                "params": {
-                    "capabilities": {},
-                    "clientInfo": {"name": "token-verify", "version": "1.0.0"},
-                    "protocolVersion": "2025-03-26"
-                },
-                "id": 1
-            }).encode(),
-            headers={
-                "Content-Type": "application/json",
-                "Accept": "application/json, text/event-stream",
-                "Authorization": f"Bearer {token}"
-            },
-            method="POST"
-        )
-        with urllib.request.urlopen(req) as resp:
-            return resp.status == 200
-    except urllib.error.HTTPError as e:
-        if e.code == 401:
-            return False
-        raise
-    except Exception:
-        return False
-
-
-# ─── OAuth Flow ─────────────────────────────────────────────────────────────
-
-class OAuthCallbackHandler(http.server.BaseHTTPRequestHandler):
-    """HTTP handler that captures the OAuth callback."""
-    auth_code = None
-    auth_state = None
-    error = None
-
-    def do_GET(self):
-        parsed = urllib.parse.urlparse(self.path)
-        params = urllib.parse.parse_qs(parsed.query)
-        if parsed.path == "/callback":
-            if "error" in params:
-                OAuthCallbackHandler.error = params["error"][0]
-                self._respond(200, "<h2>Authorization failed.</h2><p>You can close this tab.</p>")
-            elif "code" in params:
-                OAuthCallbackHandler.auth_code = params["code"][0]
-                OAuthCallbackHandler.auth_state = params.get("state", [None])[0]
-                self._respond(200, "<h2>Authorization successful!</h2><p>Return to your terminal.</p>")
-            else:
-                self._respond(400, "Missing code parameter")
-        else:
-            self._respond(404, "Not found")
-
-    def _respond(self, code, body):
-        self.send_response(code)
-        self.send_header("Content-Type", "text/html")
-        self.end_headers()
-        self.wfile.write(f"<html><body>{body}</body></html>".encode())
-
-    def log_message(self, format, *args):
-        pass
-
-
-def generate_pkce():
-    """Generate PKCE code_verifier and code_challenge (S256)."""
-    verifier = secrets.token_urlsafe(64)[:128]
-    digest = hashlib.sha256(verifier.encode("ascii")).digest()
-    challenge = base64.urlsafe_b64encode(digest).rstrip(b"=").decode("ascii")
-    return verifier, challenge
-
-
-def run_oauth_flow(client_id, client_secret, port):
-    """Run the full OAuth 2.0 + PKCE flow and return access_token."""
-    redirect_uri = f"http://localhost:{port}/callback"
-
-    # Reset handler state
-    OAuthCallbackHandler.auth_code = None
-    OAuthCallbackHandler.auth_state = None
-    OAuthCallbackHandler.error = None
-
-    # Generate PKCE
-    code_verifier, code_challenge = generate_pkce()
-    state = secrets.token_urlsafe(32)
-
-    # Start callback server
-    log(f"Starting callback server on port {port}...")
-    server = http.server.HTTPServer(("localhost", port), OAuthCallbackHandler)
-    server_thread = threading.Thread(target=server.serve_forever, daemon=True)
-    server_thread.start()
-
-    # Build authorization URL
-    auth_params = urllib.parse.urlencode({
-        "client_id": client_id,
-        "redirect_uri": redirect_uri,
-        "response_type": "code",
-        "scope": "mcp:connect",
-        "state": state,
-        "code_challenge": code_challenge,
-        "code_challenge_method": "S256",
-    })
-    auth_url = f"{AUTH_ENDPOINT}?{auth_params}"
-
-    log("Opening browser for Figma authorization...")
-    log(f"  If browser doesn't open, visit:")
-    log(f"  {auth_url}")
-
-    import webbrowser
-    webbrowser.open(auth_url)
-
-    # Wait for callback
-    log("Waiting for authorization (120s timeout)...")
-    timeout = 120
-    start = time.time()
-    while OAuthCallbackHandler.auth_code is None and OAuthCallbackHandler.error is None:
-        if time.time() - start > timeout:
-            server.shutdown()
-            log("Timeout waiting for authorization.")
-            return None
-        time.sleep(0.5)
-
-    server.shutdown()
-
-    if OAuthCallbackHandler.error:
-        log(f"Authorization error: {OAuthCallbackHandler.error}")
-        return None
-
-    if OAuthCallbackHandler.auth_state != state:
-        log("State mismatch  -  possible CSRF.")
-        return None
-
-    auth_code = OAuthCallbackHandler.auth_code
-    log("Authorization code received. Exchanging for token...")
-
-    # Exchange code for token
-    token_data = urllib.parse.urlencode({
-        "grant_type": "authorization_code",
-        "code": auth_code,
-        "redirect_uri": redirect_uri,
-        "client_id": client_id,
-        "client_secret": client_secret,
-        "code_verifier": code_verifier,
-    }).encode()
-
-    req = urllib.request.Request(
-        TOKEN_ENDPOINT,
-        data=token_data,
-        headers={"Content-Type": "application/x-www-form-urlencoded"},
-        method="POST",
-    )
-
-    try:
-        with urllib.request.urlopen(req) as resp:
-            result = json.loads(resp.read().decode())
-    except urllib.error.HTTPError as e:
-        body = e.read().decode()
-        log(f"Token exchange failed (HTTP {e.code}): {body}")
-        return None
-
-    access_token = result.get("access_token")
-    refresh_token = result.get("refresh_token")
-    expires_in = result.get("expires_in", "unknown")
-
-    if access_token:
-        log(f"Token obtained: {access_token[:10]}...{access_token[-6:]}")
-        log(f"Expires in: {expires_in}s")
-        if refresh_token:
-            log(f"Refresh token obtained: {refresh_token[:10]}...{refresh_token[-6:]}")
-    else:
-        log(f"No access_token in response: {json.dumps(result, indent=2)}")
-
-    return access_token, refresh_token
-
-
-# ─── Main ───────────────────────────────────────────────────────────────────
-
-def main():
-    parser = argparse.ArgumentParser(
-        description="Retrieve or refresh Figma MCP OAuth token"
-    )
-    parser.add_argument("--oauth", action="store_true",
-                        help="Run full OAuth flow (opens browser)")
-    parser.add_argument("--client-id",
-                        help="OAuth client ID (extracted from Claude Code or provided manually)")
-    parser.add_argument("--client-secret",
-                        help="OAuth client secret")
-    parser.add_argument("--show-clients", action="store_true",
-                        help="Show registered OAuth clients from Claude Code credentials")
-    parser.add_argument("--save-keychain", action="store_true",
-                        help=f"Save token to macOS Keychain as {KEYCHAIN_SERVICE}")
-    parser.add_argument("--verify", action="store_true",
-                        help="Verify token against Figma MCP server")
-    parser.add_argument("--quiet", action="store_true",
-                        help="Only print the token to stdout")
-    parser.add_argument("--port", type=int, default=DEFAULT_PORT,
-                        help=f"Callback server port (default: {DEFAULT_PORT})")
-    args = parser.parse_args()
-
-    # ── Show clients mode ───────────────────────────────────────────────
-    if args.show_clients:
-        clients = get_client_credentials_from_claude()
-        if not clients:
-            log("No OAuth clients found in Claude Code credentials.")
-            sys.exit(1)
-        for i, c in enumerate(clients):
-            print(f"Client {i+1}:")
-            print(f"  Server:       {c['serverName']}")
-            print(f"  URL:          {c['serverUrl']}")
-            print(f"  clientId:     {c['clientId']}")
-            print(f"  clientSecret: {c['clientSecret']}")
-            print()
-        log(f"Found {len(clients)} registered client(s).")
-        log("Use with: --oauth --client-id <id> --client-secret <secret>")
-        sys.exit(0)
-
-    # ── OAuth mode ──────────────────────────────────────────────────────
-    if args.oauth:
-        client_id = args.client_id
-        client_secret = args.client_secret
-
-        # Auto-extract from Claude Code credentials if not provided
-        if not client_id or not client_secret:
-            clients = get_client_credentials_from_claude()
-            figma_clients = [c for c in clients if "figma" in c.get("serverUrl", "")]
-            if figma_clients:
-                client_id = client_id or figma_clients[0]["clientId"]
-                client_secret = client_secret or figma_clients[0]["clientSecret"]
-            else:
-                log("No client credentials provided and none found in Claude Code.")
-                log("Use: --client-id <id> --client-secret <secret>")
-                sys.exit(1)
-
-        if not args.quiet:
-            log(f"Using client credentials ({client_id})")
-
-        token, refresh_token = run_oauth_flow(client_id, client_secret, args.port)
-        if not token:
-            sys.exit(1)
-
-        if args.verify:
-            if not args.quiet:
-                log("Verifying token...")
-            if verify_token(token):
-                if not args.quiet:
-                    log("Token is VALID.")
-            else:
-                if not args.quiet:
-                    log("Token is INVALID.")
-                sys.exit(2)
-
-        if args.save_keychain:
-            if save_to_keychain(token):
-                if not args.quiet:
-                    log(f"Saved to Keychain as '{KEYCHAIN_SERVICE}'.")
-            else:
-                if not args.quiet:
-                    log("Failed to save to Keychain.")
-                sys.exit(3)
-            # Save refresh_token alongside access_token
-            if refresh_token:
-                if save_to_keychain(refresh_token, service=KEYCHAIN_REFRESH_SERVICE):
-                    if not args.quiet:
-                        log(f"Saved refresh token to Keychain as '{KEYCHAIN_REFRESH_SERVICE}'.")
-                else:
-                    if not args.quiet:
-                        log("Failed to save refresh token to Keychain.")
-            # Save client credentials for future auto-refresh
-            save_to_keychain(client_id, service=KEYCHAIN_CLIENT_ID_SERVICE)
-            save_to_keychain(client_secret, service=KEYCHAIN_CLIENT_SECRET_SERVICE)
-            if not args.quiet:
-                log("Saved client credentials to Keychain for future auto-refresh.")
-
-        print(token)
-        sys.exit(0)
-
-    # ── Extract mode (default) ──────────────────────────────────────────
-    token, source = get_from_dedicated_keychain()
-    if not token:
-        token, source = get_from_claude_credentials()
-
-    if not token:
-        if not args.quiet:
-            log("No Figma MCP token found.")
-            log("")
-            log("Options:")
-            log("  1. Run with --oauth to get a new token via browser")
-            log("  2. Use an MCP-enabled session to trigger OAuth first")
-            log("  3. Get credentials from a colleague: --show-clients")
-        sys.exit(1)
-
-    if not args.quiet:
-        log(f"Token from: {source}")
-        log(f"Token: {token[:10]}...{token[-6:]}")
-        expiry = get_expiry_from_claude_credentials()
-        if expiry:
-            log(f"Expires: {expiry}")
-
-    if args.verify:
-        if not args.quiet:
-            log("Verifying...")
-        if verify_token(token):
-            if not args.quiet:
-                log("Token is VALID.")
-        else:
-            # Token invalid  -  try auto-refresh before giving up
-            if not args.quiet:
-                log("Token is INVALID or EXPIRED. Attempting auto-refresh...")
-            refresh_tok = get_refresh_token_from_keychain()
-            refreshed = False
-            if refresh_tok:
-                # Need client credentials for refresh
-                cid = args.client_id
-                csec = args.client_secret
-                # Try Keychain first (saved during --oauth --save-keychain)
-                if not cid or not csec:
-                    kc_cid, kc_csec = get_client_credentials_from_keychain()
-                    cid = cid or kc_cid
-                    csec = csec or kc_csec
-                # Fall back to Claude Code credentials
-                if not cid or not csec:
-                    clients = get_client_credentials_from_claude()
-                    figma_clients = [c for c in clients if "figma" in c.get("serverUrl", "")]
-                    if figma_clients:
-                        cid = cid or figma_clients[0]["clientId"]
-                        csec = csec or figma_clients[0]["clientSecret"]
-                if cid and csec:
-                    new_token = refresh_access_token(refresh_tok, cid, csec)
-                    if new_token and verify_token(new_token):
-                        token = new_token
-                        refreshed = True
-                        if not args.quiet:
-                            log("Token refreshed successfully.")
-                        if args.save_keychain or source == f"keychain:{KEYCHAIN_SERVICE}":
-                            save_to_keychain(token)
-                            if not args.quiet:
-                                log(f"Updated Keychain '{KEYCHAIN_SERVICE}'.")
-                    else:
-                        if not args.quiet:
-                            log("Refresh failed  -  token or credentials expired.")
-                else:
-                    if not args.quiet:
-                        log("No client credentials available for refresh.")
-            else:
-                if not args.quiet:
-                    log("No refresh token in Keychain.")
-            if not refreshed:
-                if not args.quiet:
-                    log("Try --oauth to get a new token via browser.")
-                sys.exit(2)
-
-    if args.save_keychain and source != f"keychain:{KEYCHAIN_SERVICE}":
-        if save_to_keychain(token):
-            if not args.quiet:
-                log(f"Saved to Keychain as '{KEYCHAIN_SERVICE}'.")
-        else:
-            if not args.quiet:
-                log("Failed to save to Keychain.")
-            sys.exit(3)
-
-    print(token)
-
-
-if __name__ == "__main__":
-    main()