@openephemeris/mcp-server 3.13.9 → 3.13.10

package/dist/oauth/token.js

@@ -0,0 +1,213 @@
+/**
+ * src/oauth/token.ts — OAuth 2.1 Token endpoint.
+ *
+ * POST /oauth/token
+ *
+ * Supports:
+ *   - grant_type=authorization_code (with PKCE S256 verification)
+ *   - grant_type=refresh_token (with rotation enforcement)
+ *
+ * Token issuance strategy:
+ *   1. In-memory store validates code/PKCE/redirect_uri
+ *   2. If Supabase env vars are set AND the stored code has a user_id,
+ *      issue a real Supabase JWT via supabase-jwt.ts
+ *   3. Otherwise fall back to local placeholder tokens (test path)
+ *
+ * The Supabase path is never attempted unless BOTH SUPABASE_URL and
+ * SUPABASE_SERVICE_ROLE_KEY are set. Tests run without either.
+ */
+import express from "express";
+import { timingSafeEqual } from "node:crypto";
+import { verifyCodeChallenge } from "./pkce.js";
+import { issueSupabaseJWT, refreshSupabaseSession } from "./supabase-jwt.js";
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+/**
+ * Timing-safe string comparison for redirect URI validation.
+ */
+function timingSafeStringEqual(a, b) {
+    const bufA = Buffer.from(a, "utf8");
+    const bufB = Buffer.from(b, "utf8");
+    if (bufA.length !== bufB.length)
+        return false;
+    return timingSafeEqual(bufA, bufB);
+}
+// ---------------------------------------------------------------------------
+// Token Router Factory
+// ---------------------------------------------------------------------------
+export function oauthTokenRouter(store) {
+    const router = express.Router();
+    router.post("/oauth/token", async (req, res) => {
+        const grant_type = req.body.grant_type;
+        if (grant_type === "authorization_code") {
+            await handleAuthorizationCode(req, res, store);
+        }
+        else if (grant_type === "refresh_token") {
+            await handleRefreshToken(req, res, store);
+        }
+        else {
+            res.status(400).json({
+                error: "unsupported_grant_type",
+                error_description: `Expected "authorization_code" or "refresh_token".`,
+            });
+        }
+    });
+    return router;
+}
+// ---------------------------------------------------------------------------
+// Authorization Code Exchange
+// ---------------------------------------------------------------------------
+async function handleAuthorizationCode(req, res, store) {
+    const { code, code_verifier, redirect_uri, client_id } = req.body;
+    if (!code) {
+        res.status(400).json({
+            error: "invalid_request",
+            error_description: "Missing authorization code.",
+        });
+        return;
+    }
+    if (!code_verifier) {
+        res.status(400).json({
+            error: "invalid_request",
+            error_description: "Missing code_verifier (PKCE required).",
+        });
+        return;
+    }
+    // Consume the authorization code (single-use).
+    // consumeCodeAsync works with both Supabase (production) and in-memory (tests).
+    const stored = await store.consumeCodeAsync(code);
+    if (!stored) {
+        res.status(400).json({
+            error: "invalid_grant",
+            error_description: "Authorization code is invalid, expired, or already used.",
+        });
+        return;
+    }
+    // Verify PKCE challenge
+    if (!verifyCodeChallenge(code_verifier, stored.code_challenge)) {
+        res.status(400).json({
+            error: "invalid_grant",
+            error_description: "PKCE code_verifier does not match the stored code_challenge.",
+        });
+        return;
+    }
+    // Verify redirect_uri exact match
+    if (redirect_uri && !timingSafeStringEqual(redirect_uri, stored.redirect_uri)) {
+        res.status(400).json({
+            error: "invalid_grant",
+            error_description: "redirect_uri does not match the value used during authorization.",
+        });
+        return;
+    }
+    // ---------------------------------------------------------------------------
+    // Token issuance — prefer Supabase JWT, fall back to placeholder
+    // ---------------------------------------------------------------------------
+    // If the authorization code was issued with a user_id (consent page stores it),
+    // attempt to issue a real Supabase JWT that the Go sidecar can validate.
+    if (stored.user_id) {
+        const supabaseTokens = await issueSupabaseJWT(stored.user_id);
+        if (supabaseTokens) {
+            // Store refresh token mapping for rotation enforcement
+            const oauthRefreshToken = store.generateRefreshToken();
+            store.storeRefreshToken(oauthRefreshToken, {
+                client_id: stored.client_id,
+                user_id: stored.user_id,
+                // Keep the Supabase refresh token for downstream refresh
+                supabase_refresh_token: supabaseTokens.refresh_token,
+            });
+            console.info(`[token] Supabase JWT issued for user ${stored.user_id}`);
+            res.json({
+                access_token: supabaseTokens.access_token,
+                refresh_token: oauthRefreshToken,
+                token_type: "Bearer",
+                expires_in: supabaseTokens.expires_in,
+            });
+            return;
+        }
+        // Supabase JWT issuance failed — log a warning but continue to placeholder
+        console.warn(`[token] Supabase JWT issuance failed for user ${stored.user_id}, falling back to placeholder`);
+    }
+    // Fallback: local placeholder tokens (test/dev path)
+    const refreshToken = store.generateRefreshToken();
+    store.storeRefreshToken(refreshToken, { client_id: stored.client_id });
+    res.json({
+        access_token: `oe_access_${Date.now()}`,
+        refresh_token: refreshToken,
+        token_type: "Bearer",
+        expires_in: 3600,
+    });
+}
+// ---------------------------------------------------------------------------
+// Refresh Token Exchange
+// ---------------------------------------------------------------------------
+async function handleRefreshToken(req, res, store) {
+    const { refresh_token } = req.body;
+    if (!refresh_token) {
+        res.status(400).json({
+            error: "invalid_request",
+            error_description: "Missing refresh_token.",
+        });
+        return;
+    }
+    // Consume from local store (rotation enforcement)
+    const storedMeta = store.consumeRefreshToken(refresh_token);
+    if (!storedMeta) {
+        res.status(400).json({
+            error: "invalid_grant",
+            error_description: "Invalid or expired refresh token.",
+        });
+        return;
+    }
+    // ---------------------------------------------------------------------------
+    // Refresh — prefer Supabase, fall back to placeholder
+    // ---------------------------------------------------------------------------
+    const userId = storedMeta.user_id;
+    const supabaseRefresh = storedMeta.supabase_refresh_token;
+    // Try Supabase refresh first
+    if (supabaseRefresh) {
+        const refreshed = await refreshSupabaseSession(supabaseRefresh);
+        if (refreshed) {
+            // Issue rotated OAuth refresh token
+            const newRefreshToken = store.generateRefreshToken();
+            store.storeRefreshToken(newRefreshToken, {
+                ...storedMeta,
+                supabase_refresh_token: refreshed.refresh_token,
+            });
+            res.json({
+                access_token: refreshed.access_token,
+                refresh_token: newRefreshToken,
+                token_type: "Bearer",
+                expires_in: refreshed.expires_in,
+            });
+            return;
+        }
+    }
+    // If Supabase refresh failed but we have a user_id, try issuing a fresh JWT
+    if (userId) {
+        const freshTokens = await issueSupabaseJWT(userId);
+        if (freshTokens) {
+            const newRefreshToken = store.generateRefreshToken();
+            store.storeRefreshToken(newRefreshToken, {
+                ...storedMeta,
+                supabase_refresh_token: freshTokens.refresh_token,
+            });
+            res.json({
+                access_token: freshTokens.access_token,
+                refresh_token: newRefreshToken,
+                token_type: "Bearer",
+                expires_in: freshTokens.expires_in,
+            });
+            return;
+        }
+    }
+    // Fallback: placeholder tokens
+    const newRefreshToken = store.generateRefreshToken();
+    store.storeRefreshToken(newRefreshToken, storedMeta);
+    res.json({
+        access_token: `oe_access_${Date.now()}`,
+        refresh_token: newRefreshToken,
+        token_type: "Bearer",
+        expires_in: 3600,
+    });
+}