@mmerterden/multi-agent-pipeline 8.6.0

package/pipeline/skills/figma-common/figma-setup/scripts/fetch-mcp-token.py

@@ -0,0 +1,592 @@
+#!/usr/bin/env python3
+"""
+Figma Remote MCP Token Fetcher
+
+Retrieves or refreshes a Figma MCP OAuth token. Three modes:
+
+MODE 1 — Extract (default):
+    Reads existing token from Keychain or Claude Code credentials.
+    python3 fetch-mcp-token.py
+
+MODE 2 — OAuth (--oauth):
+    Runs full OAuth flow. Opens browser for Figma consent, runs local
+    callback server, exchanges code for token. Works from ANY terminal.
+    python3 fetch-mcp-token.py --oauth --client-id X --client-secret Y --save-keychain
+
+    Credentials are extracted from Claude Code keychain if available,
+    or must be provided via --client-id and --client-secret.
+
+COMMON FLAGS:
+    --save-keychain   Save token to macOS Keychain as FIGMA_MCP_TOKEN
+    --verify          Verify token against Figma MCP server
+    --quiet           Only print the token to stdout
+    --port PORT       Local callback server port (default: 8923)
+    --client-id       OAuth client ID (required for --oauth if no Claude Code)
+    --client-secret   OAuth client secret (required for --oauth if no Claude Code)
+    --show-clients    Show OAuth clients from Claude Code credentials
+"""
+
+import argparse
+import base64
+import hashlib
+import http.server
+import json
+import os
+import re
+import secrets
+import subprocess
+import sys
+import threading
+import time
+import urllib.parse
+import urllib.request
+
+# ─── Configuration ──────────────────────────────────────────────────────────
+
+KEYCHAIN_SERVICE = "FIGMA_MCP_TOKEN"
+KEYCHAIN_REFRESH_SERVICE = "FIGMA_MCP_REFRESH_TOKEN"
+KEYCHAIN_CLIENT_ID_SERVICE = "FIGMA_MCP_CLIENT_ID"
+KEYCHAIN_CLIENT_SECRET_SERVICE = "FIGMA_MCP_CLIENT_SECRET"
+CLAUDE_CREDENTIALS_SERVICE = "Claude Code-credentials"
+MCP_SERVER_URL = "https://mcp.figma.com/mcp"
+AUTH_ENDPOINT = "https://www.figma.com/oauth/mcp"
+TOKEN_ENDPOINT = "https://api.figma.com/v1/oauth/token"
+REFRESH_ENDPOINT = "https://api.figma.com/v1/oauth/refresh"
+DEFAULT_PORT = 8923
+
+
+# ─── Helpers ────────────────────────────────────────────────────────────────
+
+def log(msg):
+    print(f"[fetch-mcp-token] {msg}", file=sys.stderr)
+
+
+def get_claude_credentials_raw():
+    """Read raw Claude Code credentials from Keychain."""
+    try:
+        return subprocess.check_output(
+            ["security", "find-generic-password", "-s", CLAUDE_CREDENTIALS_SERVICE,
+             "-a", os.environ["USER"], "-w"],
+            stderr=subprocess.DEVNULL
+        ).decode()
+    except (subprocess.CalledProcessError, KeyError):
+        return None
+
+
+# ─── Token Sources ──────────────────────────────────────────────────────────
+
+def get_from_dedicated_keychain():
+    """Source 1: Dedicated FIGMA_MCP_TOKEN keychain entry."""
+    try:
+        token = subprocess.check_output(
+            ["security", "find-generic-password", "-a", os.environ["USER"],
+             "-s", KEYCHAIN_SERVICE, "-w"],
+            stderr=subprocess.DEVNULL
+        ).decode().strip()
+        if token and token.startswith("figu_"):
+            return token, "keychain:FIGMA_MCP_TOKEN"
+    except (subprocess.CalledProcessError, KeyError):
+        pass
+    return None, None
+
+
+def get_from_claude_credentials():
+    """Source 2: Extract accessToken from Claude Code's credential store."""
+    raw = get_claude_credentials_raw()
+    if not raw:
+        return None, None
+    match = re.search(
+        r'"figma-remote\|[^"]+":\{[^}]*"accessToken":"([^"]+)"', raw
+    )
+    if match:
+        token = match.group(1)
+        if token.startswith("figu_"):
+            return token, "keychain:Claude Code-credentials"
+    return None, None
+
+
+def get_expiry_from_claude_credentials():
+    """Extract expiresAt from Claude Code credentials."""
+    raw = get_claude_credentials_raw()
+    if not raw:
+        return None
+    match = re.search(
+        r'"figma-remote\|[^"]+":\{[^}]*"expiresAt":(\d+)', raw
+    )
+    if match:
+        import datetime
+        ts = int(match.group(1)) / 1000
+        return datetime.datetime.fromtimestamp(ts).isoformat()
+    return None
+
+
+def get_client_credentials_from_claude():
+    """Extract clientId + clientSecret from Claude Code credentials."""
+    raw = get_claude_credentials_raw()
+    if not raw:
+        return []
+    clients = []
+    # Find all clientRegistration blocks with their parent server context
+    for m in re.finditer(r'"clientId":"([^"]+)"', raw):
+        cid = m.group(1)
+        # Look for clientSecret right after
+        after = raw[m.end():m.end() + 200]
+        sec_match = re.search(r'"clientSecret":"([^"]+)"', after)
+        # Look backwards for serverName
+        before = raw[max(0, m.start() - 500):m.start()]
+        srv_match = re.search(r'"serverName":"([^"]+)"', before)
+        url_match = re.search(r'"serverUrl":"([^"]+)"', before)
+        clients.append({
+            "clientId": cid,
+            "clientSecret": sec_match.group(1) if sec_match else None,
+            "serverName": srv_match.group(1) if srv_match else "unknown",
+            "serverUrl": url_match.group(1) if url_match else "unknown",
+        })
+    return clients
+
+
+# ─── Keychain & Verify ──────────────────────────────────────────────────────
+
+def save_to_keychain(token, service=KEYCHAIN_SERVICE):
+    """Save token to macOS Keychain."""
+    user = os.environ.get("USER", "")
+    subprocess.run(
+        ["security", "delete-generic-password", "-a", user, "-s", service],
+        capture_output=True
+    )
+    result = subprocess.run(
+        ["security", "add-generic-password", "-a", user, "-s", service, "-w", token],
+        capture_output=True
+    )
+    return result.returncode == 0
+
+
+def get_refresh_token_from_keychain():
+    """Read refresh token from macOS Keychain."""
+    try:
+        return subprocess.check_output(
+            ["security", "find-generic-password", "-a", os.environ["USER"],
+             "-s", KEYCHAIN_REFRESH_SERVICE, "-w"],
+            stderr=subprocess.DEVNULL
+        ).decode().strip() or None
+    except (subprocess.CalledProcessError, KeyError):
+        return None
+
+
+def get_client_credentials_from_keychain():
+    """Read client_id and client_secret from macOS Keychain."""
+    try:
+        cid = subprocess.check_output(
+            ["security", "find-generic-password", "-a", os.environ["USER"],
+             "-s", KEYCHAIN_CLIENT_ID_SERVICE, "-w"],
+            stderr=subprocess.DEVNULL
+        ).decode().strip()
+        csec = subprocess.check_output(
+            ["security", "find-generic-password", "-a", os.environ["USER"],
+             "-s", KEYCHAIN_CLIENT_SECRET_SERVICE, "-w"],
+            stderr=subprocess.DEVNULL
+        ).decode().strip()
+        if cid and csec:
+            return cid, csec
+    except (subprocess.CalledProcessError, KeyError):
+        pass
+    return None, None
+
+
+def refresh_access_token(refresh_token, client_id, client_secret):
+    """Use refresh_token to obtain a new access_token from Figma."""
+    auth_str = base64.b64encode(f"{client_id}:{client_secret}".encode()).decode()
+    body = urllib.parse.urlencode({"refresh_token": refresh_token}).encode()
+    req = urllib.request.Request(
+        REFRESH_ENDPOINT,
+        data=body,
+        headers={
+            "Content-Type": "application/x-www-form-urlencoded",
+            "Authorization": f"Basic {auth_str}",
+        },
+        method="POST",
+    )
+    try:
+        with urllib.request.urlopen(req) as resp:
+            result = json.loads(resp.read().decode())
+    except urllib.error.HTTPError as e:
+        body_text = e.read().decode()
+        log(f"Refresh failed (HTTP {e.code}): {body_text}")
+        return None
+
+    new_token = result.get("access_token")
+    expires_in = result.get("expires_in", "unknown")
+    if new_token:
+        log(f"Token refreshed: {new_token[:10]}...{new_token[-6:]}")
+        log(f"Expires in: {expires_in}s")
+    else:
+        log(f"No access_token in refresh response: {json.dumps(result, indent=2)}")
+    return new_token
+
+
+def verify_token(token):
+    """Verify token against Figma MCP server."""
+    try:
+        req = urllib.request.Request(
+            MCP_SERVER_URL,
+            data=json.dumps({
+                "jsonrpc": "2.0",
+                "method": "initialize",
+                "params": {
+                    "capabilities": {},
+                    "clientInfo": {"name": "token-verify", "version": "1.0.0"},
+                    "protocolVersion": "2025-03-26"
+                },
+                "id": 1
+            }).encode(),
+            headers={
+                "Content-Type": "application/json",
+                "Accept": "application/json, text/event-stream",
+                "Authorization": f"Bearer {token}"
+            },
+            method="POST"
+        )
+        with urllib.request.urlopen(req) as resp:
+            return resp.status == 200
+    except urllib.error.HTTPError as e:
+        if e.code == 401:
+            return False
+        raise
+    except Exception:
+        return False
+
+
+# ─── OAuth Flow ─────────────────────────────────────────────────────────────
+
+class OAuthCallbackHandler(http.server.BaseHTTPRequestHandler):
+    """HTTP handler that captures the OAuth callback."""
+    auth_code = None
+    auth_state = None
+    error = None
+
+    def do_GET(self):
+        parsed = urllib.parse.urlparse(self.path)
+        params = urllib.parse.parse_qs(parsed.query)
+        if parsed.path == "/callback":
+            if "error" in params:
+                OAuthCallbackHandler.error = params["error"][0]
+                self._respond(200, "<h2>Authorization failed.</h2><p>You can close this tab.</p>")
+            elif "code" in params:
+                OAuthCallbackHandler.auth_code = params["code"][0]
+                OAuthCallbackHandler.auth_state = params.get("state", [None])[0]
+                self._respond(200, "<h2>Authorization successful!</h2><p>Return to your terminal.</p>")
+            else:
+                self._respond(400, "Missing code parameter")
+        else:
+            self._respond(404, "Not found")
+
+    def _respond(self, code, body):
+        self.send_response(code)
+        self.send_header("Content-Type", "text/html")
+        self.end_headers()
+        self.wfile.write(f"<html><body>{body}</body></html>".encode())
+
+    def log_message(self, format, *args):
+        pass
+
+
+def generate_pkce():
+    """Generate PKCE code_verifier and code_challenge (S256)."""
+    verifier = secrets.token_urlsafe(64)[:128]
+    digest = hashlib.sha256(verifier.encode("ascii")).digest()
+    challenge = base64.urlsafe_b64encode(digest).rstrip(b"=").decode("ascii")
+    return verifier, challenge
+
+
+def run_oauth_flow(client_id, client_secret, port):
+    """Run the full OAuth 2.0 + PKCE flow and return access_token."""
+    redirect_uri = f"http://localhost:{port}/callback"
+
+    # Reset handler state
+    OAuthCallbackHandler.auth_code = None
+    OAuthCallbackHandler.auth_state = None
+    OAuthCallbackHandler.error = None
+
+    # Generate PKCE
+    code_verifier, code_challenge = generate_pkce()
+    state = secrets.token_urlsafe(32)
+
+    # Start callback server
+    log(f"Starting callback server on port {port}...")
+    server = http.server.HTTPServer(("localhost", port), OAuthCallbackHandler)
+    server_thread = threading.Thread(target=server.serve_forever, daemon=True)
+    server_thread.start()
+
+    # Build authorization URL
+    auth_params = urllib.parse.urlencode({
+        "client_id": client_id,
+        "redirect_uri": redirect_uri,
+        "response_type": "code",
+        "scope": "mcp:connect",
+        "state": state,
+        "code_challenge": code_challenge,
+        "code_challenge_method": "S256",
+    })
+    auth_url = f"{AUTH_ENDPOINT}?{auth_params}"
+
+    log("Opening browser for Figma authorization...")
+    log(f"  If browser doesn't open, visit:")
+    log(f"  {auth_url}")
+
+    import webbrowser
+    webbrowser.open(auth_url)
+
+    # Wait for callback
+    log("Waiting for authorization (120s timeout)...")
+    timeout = 120
+    start = time.time()
+    while OAuthCallbackHandler.auth_code is None and OAuthCallbackHandler.error is None:
+        if time.time() - start > timeout:
+            server.shutdown()
+            log("Timeout waiting for authorization.")
+            return None
+        time.sleep(0.5)
+
+    server.shutdown()
+
+    if OAuthCallbackHandler.error:
+        log(f"Authorization error: {OAuthCallbackHandler.error}")
+        return None
+
+    if OAuthCallbackHandler.auth_state != state:
+        log("State mismatch — possible CSRF.")
+        return None
+
+    auth_code = OAuthCallbackHandler.auth_code
+    log("Authorization code received. Exchanging for token...")
+
+    # Exchange code for token
+    token_data = urllib.parse.urlencode({
+        "grant_type": "authorization_code",
+        "code": auth_code,
+        "redirect_uri": redirect_uri,
+        "client_id": client_id,
+        "client_secret": client_secret,
+        "code_verifier": code_verifier,
+    }).encode()
+
+    req = urllib.request.Request(
+        TOKEN_ENDPOINT,
+        data=token_data,
+        headers={"Content-Type": "application/x-www-form-urlencoded"},
+        method="POST",
+    )
+
+    try:
+        with urllib.request.urlopen(req) as resp:
+            result = json.loads(resp.read().decode())
+    except urllib.error.HTTPError as e:
+        body = e.read().decode()
+        log(f"Token exchange failed (HTTP {e.code}): {body}")
+        return None
+
+    access_token = result.get("access_token")
+    refresh_token = result.get("refresh_token")
+    expires_in = result.get("expires_in", "unknown")
+
+    if access_token:
+        log(f"Token obtained: {access_token[:10]}...{access_token[-6:]}")
+        log(f"Expires in: {expires_in}s")
+        if refresh_token:
+            log(f"Refresh token obtained: {refresh_token[:10]}...{refresh_token[-6:]}")
+    else:
+        log(f"No access_token in response: {json.dumps(result, indent=2)}")
+
+    return access_token, refresh_token
+
+
+# ─── Main ───────────────────────────────────────────────────────────────────
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Retrieve or refresh Figma MCP OAuth token"
+    )
+    parser.add_argument("--oauth", action="store_true",
+                        help="Run full OAuth flow (opens browser)")
+    parser.add_argument("--client-id",
+                        help="OAuth client ID (extracted from Claude Code or provided manually)")
+    parser.add_argument("--client-secret",
+                        help="OAuth client secret")
+    parser.add_argument("--show-clients", action="store_true",
+                        help="Show registered OAuth clients from Claude Code credentials")
+    parser.add_argument("--save-keychain", action="store_true",
+                        help=f"Save token to macOS Keychain as {KEYCHAIN_SERVICE}")
+    parser.add_argument("--verify", action="store_true",
+                        help="Verify token against Figma MCP server")
+    parser.add_argument("--quiet", action="store_true",
+                        help="Only print the token to stdout")
+    parser.add_argument("--port", type=int, default=DEFAULT_PORT,
+                        help=f"Callback server port (default: {DEFAULT_PORT})")
+    args = parser.parse_args()
+
+    # ── Show clients mode ───────────────────────────────────────────────
+    if args.show_clients:
+        clients = get_client_credentials_from_claude()
+        if not clients:
+            log("No OAuth clients found in Claude Code credentials.")
+            sys.exit(1)
+        for i, c in enumerate(clients):
+            print(f"Client {i+1}:")
+            print(f"  Server:       {c['serverName']}")
+            print(f"  URL:          {c['serverUrl']}")
+            print(f"  clientId:     {c['clientId']}")
+            print(f"  clientSecret: {c['clientSecret']}")
+            print()
+        log(f"Found {len(clients)} registered client(s).")
+        log("Use with: --oauth --client-id <id> --client-secret <secret>")
+        sys.exit(0)
+
+    # ── OAuth mode ──────────────────────────────────────────────────────
+    if args.oauth:
+        client_id = args.client_id
+        client_secret = args.client_secret
+
+        # Auto-extract from Claude Code credentials if not provided
+        if not client_id or not client_secret:
+            clients = get_client_credentials_from_claude()
+            figma_clients = [c for c in clients if "figma" in c.get("serverUrl", "")]
+            if figma_clients:
+                client_id = client_id or figma_clients[0]["clientId"]
+                client_secret = client_secret or figma_clients[0]["clientSecret"]
+            else:
+                log("No client credentials provided and none found in Claude Code.")
+                log("Use: --client-id <id> --client-secret <secret>")
+                sys.exit(1)
+
+        if not args.quiet:
+            log(f"Using client credentials ({client_id})")
+
+        token, refresh_token = run_oauth_flow(client_id, client_secret, args.port)
+        if not token:
+            sys.exit(1)
+
+        if args.verify:
+            if not args.quiet:
+                log("Verifying token...")
+            if verify_token(token):
+                if not args.quiet:
+                    log("Token is VALID.")
+            else:
+                if not args.quiet:
+                    log("Token is INVALID.")
+                sys.exit(2)
+
+        if args.save_keychain:
+            if save_to_keychain(token):
+                if not args.quiet:
+                    log(f"Saved to Keychain as '{KEYCHAIN_SERVICE}'.")
+            else:
+                if not args.quiet:
+                    log("Failed to save to Keychain.")
+                sys.exit(3)
+            # Save refresh_token alongside access_token
+            if refresh_token:
+                if save_to_keychain(refresh_token, service=KEYCHAIN_REFRESH_SERVICE):
+                    if not args.quiet:
+                        log(f"Saved refresh token to Keychain as '{KEYCHAIN_REFRESH_SERVICE}'.")
+                else:
+                    if not args.quiet:
+                        log("Failed to save refresh token to Keychain.")
+            # Save client credentials for future auto-refresh
+            save_to_keychain(client_id, service=KEYCHAIN_CLIENT_ID_SERVICE)
+            save_to_keychain(client_secret, service=KEYCHAIN_CLIENT_SECRET_SERVICE)
+            if not args.quiet:
+                log("Saved client credentials to Keychain for future auto-refresh.")
+
+        print(token)
+        sys.exit(0)
+
+    # ── Extract mode (default) ──────────────────────────────────────────
+    token, source = get_from_dedicated_keychain()
+    if not token:
+        token, source = get_from_claude_credentials()
+
+    if not token:
+        if not args.quiet:
+            log("No Figma MCP token found.")
+            log("")
+            log("Options:")
+            log("  1. Run with --oauth to get a new token via browser")
+            log("  2. Use an MCP-enabled session to trigger OAuth first")
+            log("  3. Get credentials from a colleague: --show-clients")
+        sys.exit(1)
+
+    if not args.quiet:
+        log(f"Token from: {source}")
+        log(f"Token: {token[:10]}...{token[-6:]}")
+        expiry = get_expiry_from_claude_credentials()
+        if expiry:
+            log(f"Expires: {expiry}")
+
+    if args.verify:
+        if not args.quiet:
+            log("Verifying...")
+        if verify_token(token):
+            if not args.quiet:
+                log("Token is VALID.")
+        else:
+            # Token invalid — try auto-refresh before giving up
+            if not args.quiet:
+                log("Token is INVALID or EXPIRED. Attempting auto-refresh...")
+            refresh_tok = get_refresh_token_from_keychain()
+            refreshed = False
+            if refresh_tok:
+                # Need client credentials for refresh
+                cid = args.client_id
+                csec = args.client_secret
+                # Try Keychain first (saved during --oauth --save-keychain)
+                if not cid or not csec:
+                    kc_cid, kc_csec = get_client_credentials_from_keychain()
+                    cid = cid or kc_cid
+                    csec = csec or kc_csec
+                # Fall back to Claude Code credentials
+                if not cid or not csec:
+                    clients = get_client_credentials_from_claude()
+                    figma_clients = [c for c in clients if "figma" in c.get("serverUrl", "")]
+                    if figma_clients:
+                        cid = cid or figma_clients[0]["clientId"]
+                        csec = csec or figma_clients[0]["clientSecret"]
+                if cid and csec:
+                    new_token = refresh_access_token(refresh_tok, cid, csec)
+                    if new_token and verify_token(new_token):
+                        token = new_token
+                        refreshed = True
+                        if not args.quiet:
+                            log("Token refreshed successfully.")
+                        if args.save_keychain or source == f"keychain:{KEYCHAIN_SERVICE}":
+                            save_to_keychain(token)
+                            if not args.quiet:
+                                log(f"Updated Keychain '{KEYCHAIN_SERVICE}'.")
+                    else:
+                        if not args.quiet:
+                            log("Refresh failed — token or credentials expired.")
+                else:
+                    if not args.quiet:
+                        log("No client credentials available for refresh.")
+            else:
+                if not args.quiet:
+                    log("No refresh token in Keychain.")
+            if not refreshed:
+                if not args.quiet:
+                    log("Try --oauth to get a new token via browser.")
+                sys.exit(2)
+
+    if args.save_keychain and source != f"keychain:{KEYCHAIN_SERVICE}":
+        if save_to_keychain(token):
+            if not args.quiet:
+                log(f"Saved to Keychain as '{KEYCHAIN_SERVICE}'.")
+        else:
+            if not args.quiet:
+                log("Failed to save to Keychain.")
+            sys.exit(3)
+
+    print(token)
+
+
+if __name__ == "__main__":
+    main()