@payloadcms/plugin-mcp 4.0.0-internal.21664f3 → 4.0.0-internal.22d1431

package/src/endpoint/oauthServer.ts

@@ -0,0 +1,396 @@
+import type {
+  OAuthClientInformationFull,
+  OAuthTokens,
+  OpenIdProviderDiscoveryMetadata,
+} from '@modelcontextprotocol/server'
+import type { Endpoint, PayloadHandler, PayloadRequest } from 'payload'
+
+import { OAuthErrorCode } from '@modelcontextprotocol/server'
+import { createHash } from 'crypto'
+import { formatAdminURL } from 'payload/shared'
+
+import type { MCPBuiltinOAuthConfig, MCPOAuthTokens } from '../types.js'
+
+import { getPluginConfig } from '../utils/getPluginConfig.js'
+import { seal, unseal } from '../utils/seal.js'
+import { getMCPURL } from './oauth.js'
+import { issueLoginToken, refreshLoginToken } from './oauthLoginToken.js'
+
+type Client = { name: string; redirectURIs: string[] }
+
+type Consent = {
+  clientID: string
+  codeChallenge: string
+  collection: string
+  redirectURI: string
+  state: null | string
+  userID: number | string
+}
+
+type Code = {
+  clientID: string
+  codeChallenge: string
+  redirectURI: string
+  tokens: MCPOAuthTokens
+}
+
+type RefreshToken = {
+  clientID: string
+  refreshToken: string
+}
+
+/**
+ * Turns Payload into the OAuth authorization server for MCP clients when `oauth.type` is
+ * `'builtin'`. Clients register, the user allows them after logging in to the admin panel, and
+ * the client receives the tokens `issueToken` creates.
+ *
+ * Clients, consent forms, authorization codes, and refresh tokens are encrypted and handed to the
+ * client instead of being stored. Only the default tokens write to the database, to the user's
+ * login sessions.
+ */
+export const oauthServerEndpoints: Endpoint[] = [
+  {
+    disableAuth: true,
+    handler: (req) => withIssuer(req, (issuer) => metadataResponse(issuer)),
+    method: 'get',
+    // OpenID discovery is the only metadata location MCP clients check below the issuer's path,
+    // which lets this work under /api without a route at the site root
+    path: '/mcp/oauth/.well-known/openid-configuration',
+  },
+  {
+    disableAuth: true,
+    handler: (req) => withIssuer(req, () => Response.json({ keys: [] })),
+    method: 'get',
+    path: '/mcp/oauth/jwks',
+  },
+  {
+    disableAuth: true,
+    handler: (req) => withIssuer(req, () => register(req)),
+    method: 'post',
+    path: '/mcp/oauth/register',
+  },
+  {
+    handler: (req) => withIssuer(req, () => authorize(req)),
+    method: 'get',
+    path: '/mcp/oauth/authorize',
+  },
+  {
+    handler: (req) => withIssuer(req, () => approve(req)),
+    method: 'post',
+    path: '/mcp/oauth/authorize',
+  },
+  {
+    disableAuth: true,
+    handler: (req) => withIssuer(req, () => token(req)),
+    method: 'post',
+    path: '/mcp/oauth/token',
+  },
+]
+
+/** The authorization server URL, or `undefined` when Payload isn't the authorization server. */
+const getIssuer = (req: PayloadRequest): string | undefined =>
+  getPluginConfig({ config: req.payload.config }).oauth?.type === 'builtin'
+    ? `${getMCPURL({ config: req.payload.config, url: req.url! })}/oauth`
+    : undefined
+
+const withIssuer = (
+  req: PayloadRequest,
+  handler: (issuer: string) => Promise<Response> | Response,
+): Promise<Response> | Response => {
+  const issuer = getIssuer(req)
+  return issuer ? handler(issuer) : new Response(null, { status: 404 })
+}
+
+/**
+ * The user logged in to this browser, who can allow MCP clients. Tokens and API keys in the
+ * `Authorization` header can't, or an MCP client could use its access token to approve itself a
+ * new, separate login.
+ */
+const getBrowserUser = (req: PayloadRequest): PayloadRequest['user'] =>
+  req.headers.has('Authorization') ? null : req.user
+
+const metadataResponse = (issuer: string): Response =>
+  Response.json(
+    {
+      authorization_endpoint: `${issuer}/authorize`,
+      code_challenge_methods_supported: ['S256'],
+      grant_types_supported: ['authorization_code', 'refresh_token'],
+      // Required by OpenID discovery. No ID tokens are issued.
+      id_token_signing_alg_values_supported: ['RS256'],
+      issuer,
+      jwks_uri: `${issuer}/jwks`,
+      registration_endpoint: `${issuer}/register`,
+      response_types_supported: ['code'],
+      subject_types_supported: ['public'],
+      token_endpoint: `${issuer}/token`,
+      token_endpoint_auth_methods_supported: ['none'],
+    } satisfies OpenIdProviderDiscoveryMetadata,
+    // Not cached, since without `serverURL` its URLs come from the request
+    { headers: { 'Access-Control-Allow-Origin': '*', 'Cache-Control': 'no-store' } },
+  )
+
+const register: PayloadHandler = async (req) => {
+  const { client_name, redirect_uris } = await req.json!().catch(() => ({}))
+
+  if (
+    !Array.isArray(redirect_uris) ||
+    !redirect_uris.length ||
+    !redirect_uris.every(
+      (uri) => typeof uri === 'string' && URL.canParse(uri) && !uri.includes('#'),
+    )
+  ) {
+    return Response.json({ error: OAuthErrorCode.InvalidRedirectUri }, { status: 400 })
+  }
+
+  const client: Client = {
+    name: typeof client_name === 'string' ? client_name : 'An MCP client',
+    redirectURIs: redirect_uris,
+  }
+
+  return Response.json(
+    {
+      client_id: seal({ type: 'client', data: client, req }),
+      client_name: client.name,
+      grant_types: ['authorization_code', 'refresh_token'],
+      redirect_uris: client.redirectURIs,
+      response_types: ['code'],
+      token_endpoint_auth_method: 'none',
+    } satisfies OAuthClientInformationFull,
+    { status: 201 },
+  )
+}
+
+const authorize: PayloadHandler = (req) => {
+  const url = new URL(req.url!)
+  const params = url.searchParams
+  const clientID = params.get('client_id')
+  const client = unseal<Client>({ type: 'client', req, value: clientID })
+  const redirectURI = params.get('redirect_uri')
+
+  // Never redirect to an address the client didn't register
+  if (!client || !redirectURI || !client.redirectURIs.includes(redirectURI)) {
+    return page({
+      content: '<p>Start the sign-in again from your MCP client.</p>',
+      status: 400,
+      title: 'This sign-in link is invalid',
+    })
+  }
+
+  const state = params.get('state')
+  const codeChallenge = params.get('code_challenge')
+
+  if (
+    params.get('response_type') !== 'code' ||
+    params.get('code_challenge_method') !== 'S256' ||
+    !codeChallenge
+  ) {
+    return redirect({ params: { error: OAuthErrorCode.InvalidRequest, state }, redirectURI })
+  }
+
+  const user = getBrowserUser(req)
+
+  if (!user) {
+    const loginURL = formatAdminURL({ adminRoute: req.payload.config.routes.admin, path: '/login' })
+
+    return new Response(null, {
+      headers: {
+        Location: `${loginURL}?redirect=${encodeURIComponent(url.pathname + url.search)}`,
+      },
+      status: 302,
+    })
+  }
+
+  const consent: Consent = {
+    clientID: clientID!,
+    codeChallenge,
+    collection: user.collection,
+    redirectURI,
+    state,
+    userID: user.id,
+  }
+
+  return page({
+    content: `<p>It will be able to use this app's MCP tools as ${escapeHTML(String(user.email ?? user.id))}, and you will return to ${escapeHTML(new URL(redirectURI).host || redirectURI)}.</p>
+<form method="post">
+<input name="consent" type="hidden" value="${seal({ type: 'consent', data: consent, expiresIn: 20 * 60 * 60, req })}">
+<button name="decision" type="submit" value="allow">Allow</button>
+<button name="decision" type="submit" value="deny">Deny</button>
+</form>`,
+    status: 200,
+    title: `Allow ${client.name} to use your account?`,
+  })
+}
+
+const approve: PayloadHandler = async (req) => {
+  const form = new URLSearchParams(await req.text!())
+  const consent = unseal<Consent>({ type: 'consent', req, value: form.get('consent') })
+  const user = getBrowserUser(req)
+
+  // The form is only valid for the user it was shown to
+  if (!consent || user?.id !== consent.userID || user.collection !== consent.collection) {
+    return page({
+      content: '<p>Start the sign-in again from your MCP client.</p>',
+      status: 400,
+      title: 'This sign-in request expired',
+    })
+  }
+
+  const { clientID, codeChallenge, redirectURI, state } = consent
+
+  if (form.get('decision') !== 'allow') {
+    return redirect({ params: { error: OAuthErrorCode.AccessDenied, state }, redirectURI })
+  }
+
+  const code: Code = {
+    clientID,
+    codeChallenge,
+    redirectURI,
+    tokens: await getTokenHooks(req).issueToken({ req }),
+  }
+
+  return redirect({
+    params: { code: seal({ type: 'code', data: code, expiresIn: 60, req }), state },
+    redirectURI,
+  })
+}
+
+const token: PayloadHandler = async (req) => {
+  const form = new URLSearchParams(await req.text!())
+  const clientID = form.get('client_id')
+  const tokens =
+    clientID &&
+    (form.get('grant_type') === 'refresh_token'
+      ? await refresh({ clientID, form, req })
+      : redeemCode({ clientID, form, req }))
+
+  if (!clientID || !tokens) {
+    return Response.json({ error: OAuthErrorCode.InvalidGrant }, { status: 400 })
+  }
+
+  return Response.json(
+    {
+      access_token: tokens.accessToken,
+      expires_in: tokens.expiresIn,
+      refresh_token:
+        tokens.refreshToken &&
+        seal({
+          type: 'refresh',
+          data: { clientID, refreshToken: tokens.refreshToken } satisfies RefreshToken,
+          req,
+        }),
+      token_type: 'Bearer',
+    } satisfies OAuthTokens,
+    { headers: { 'Cache-Control': 'no-store' } },
+  )
+}
+
+const redeemCode = ({
+  clientID,
+  form,
+  req,
+}: {
+  clientID: string
+  form: URLSearchParams
+  req: PayloadRequest
+}): MCPOAuthTokens | undefined => {
+  const code = unseal<Code>({ type: 'code', req, value: form.get('code') })
+
+  if (
+    form.get('grant_type') === 'authorization_code' &&
+    code?.clientID === clientID &&
+    code.redirectURI === form.get('redirect_uri') &&
+    // PKCE: only the client that started the sign-in knows the verifier
+    createHash('sha256')
+      .update(form.get('code_verifier') ?? '')
+      .digest('base64url') === code.codeChallenge
+  ) {
+    return code.tokens
+  }
+}
+
+const refresh = async ({
+  clientID,
+  form,
+  req,
+}: {
+  clientID: string
+  form: URLSearchParams
+  req: PayloadRequest
+}): Promise<MCPOAuthTokens | null | undefined> => {
+  const refreshToken = unseal<RefreshToken>({
+    type: 'refresh',
+    req,
+    value: form.get('refresh_token'),
+  })
+
+  // Only the client a refresh token was issued to can use it
+  if (refreshToken?.clientID === clientID) {
+    return await getTokenHooks(req).refreshToken?.({
+      refreshToken: refreshToken.refreshToken,
+      req,
+    })
+  }
+}
+
+/** `issueToken` and `refreshToken`, or the defaults for Payload login tokens. */
+const getTokenHooks = (req: PayloadRequest) => {
+  const oauth = getPluginConfig({ config: req.payload.config }).oauth as MCPBuiltinOAuthConfig
+
+  return oauth.issueToken
+    ? { issueToken: oauth.issueToken, refreshToken: oauth.refreshToken }
+    : { issueToken: issueLoginToken, refreshToken: refreshLoginToken }
+}
+
+const redirect = ({
+  params,
+  redirectURI,
+}: {
+  params: Record<string, null | string>
+  redirectURI: string
+}): Response => {
+  const location = new URL(redirectURI)
+
+  for (const [key, value] of Object.entries(params)) {
+    if (value) {
+      location.searchParams.set(key, value)
+    }
+  }
+
+  return new Response(null, { headers: { Location: location.href }, status: 302 })
+}
+
+const page = ({
+  content,
+  status,
+  title,
+}: {
+  content: string
+  status: number
+  title: string
+}): Response =>
+  new Response(
+    `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${escapeHTML(title)}</title>
+<style>
+body { font-family: system-ui, sans-serif; margin: 4rem auto; max-width: 32rem; overflow-wrap: anywhere; padding: 0 1rem }
+button { font: inherit; margin-inline-end: 0.5rem; padding: 0.5rem 1rem }
+</style>
+</head>
+<body><h1>${escapeHTML(title)}</h1>${content}</body>
+</html>`,
+    {
+      headers: {
+        // Stop other sites from framing the page to trick users into clicking Allow
+        'Content-Security-Policy': "frame-ancestors 'none'",
+        'Content-Type': 'text/html; charset=utf-8',
+      },
+      status,
+    },
+  )
+
+const escapeHTML = (value: string): string =>
+  value.replace(/[&<>"']/g, (character) => `&#${character.charCodeAt(0)};`)

package/src/index.ts

@@ -1,8 +1,18 @@
 import { definePlugin } from 'payload'
 
-import type { AuthorizedMCP, MCPPluginConfig, SanitizedMCPPluginConfig } from './types.js'
+import type {
+  AuthorizedMCP,
+  MCPBuiltinOAuthConfig,
+  MCPExternalOAuthConfig,
+  MCPOAuthConfig,
+  MCPOAuthTokens,
+  MCPPluginConfig,
+  SanitizedMCPPluginConfig,
+} from './types.js'
 
 import { mcpEndpoint } from './endpoint/index.js'
+import { oauthProtectedResourceEndpoint } from './endpoint/oauth.js'
+import { oauthServerEndpoints } from './endpoint/oauthServer.js'
 import { sanitizeMCPConfig } from './mcp/sanitizeMCPConfig.js'
 
 declare module 'payload' {
@@ -13,11 +23,27 @@ declare module 'payload' {
     /** After the plugin's `plugin` callback runs, `options` holds the sanitized config. */
     '@payloadcms/plugin-mcp': MCPPluginConfig
   }
+  export interface RequestContext {
+    /** Set on MCP requests before they're authenticated. */
+    mcp?: {
+      /** The MCP endpoint's address, which OAuth access tokens for MCP are issued for. */
+      resource: string
+    }
+  }
 }
 
-export type { AuthorizedMCP, MCPPluginConfig, SanitizedMCPPluginConfig }
+export type {
+  AuthorizedMCP,
+  MCPBuiltinOAuthConfig,
+  MCPExternalOAuthConfig,
+  MCPOAuthConfig,
+  MCPOAuthTokens,
+  MCPPluginConfig,
+  SanitizedMCPPluginConfig,
+}
 
 export { defineCollectionTool, defineGlobalTool, definePrompt, defineTool } from './defineTool.js'
+export { oauthProtectedResourceHandler } from './endpoint/oauth.js'
 
 export const mcpPlugin = definePlugin<MCPPluginConfig>({
   slug: '@payloadcms/plugin-mcp',
@@ -29,7 +55,7 @@ export const mcpPlugin = definePlugin<MCPPluginConfig>({
     const registered = plugins['@payloadcms/plugin-mcp']
     if (registered) {
       // @ts-expect-error
-      registered.sanitizedOptions = pluginConfig as unknown as typeof registered.options
+      registered.sanitizedOptions = pluginConfig
     }
 
     if (pluginConfig.disabled) {
@@ -40,15 +66,24 @@ export const mcpPlugin = definePlugin<MCPPluginConfig>({
       ...config,
       endpoints: [
         ...(config.endpoints ?? []),
-        // Payload prefixes /api, so the full path is /api/mcp.
-        { handler: mcpEndpoint, method: 'post', path: '/mcp' },
+        // Payload prefixes /api, so the full path is /api/mcp. getAuthorizedMCP authenticates the
+        // request with dev auto-login turned off, so Payload doesn't authenticate it first.
+        { disableAuth: true, handler: mcpEndpoint, method: 'post', path: '/mcp' },
         // Streamable HTTP's optional server=>client GET stream. We don't offer
         // one, so answer 405 per spec-— clients then skip it cleanly
         {
+          disableAuth: true,
           handler: () => new Response(null, { headers: { Allow: 'POST' }, status: 405 }),
           method: 'get',
           path: '/mcp',
         },
+        {
+          disableAuth: true,
+          handler: oauthProtectedResourceEndpoint,
+          method: 'get',
+          path: '/mcp/oauth-protected-resource',
+        },
+        ...oauthServerEndpoints,
       ],
     }
   },

package/src/mcp/buildMcpServer.ts

@@ -1,6 +1,7 @@
+import type { PayloadRequest } from 'payload'
+
 import { McpServer, type ServerContext } from '@modelcontextprotocol/server'
-import { APIError, type PayloadRequest } from 'payload'
-import { z } from 'zod'
+import { APIError, strictObject, z } from 'payload'
 
 import type {
   AuthorizedMCP,
@@ -24,7 +25,7 @@ import { toStandardSchema } from '../utils/toStandardSchema.js'
  *
  * `req` is the request context handlers see. For HTTP it's the live
  * `PayloadRequest` derived from the incoming HTTP request; for stdio it's a
- * synthesized one built via `createLocalReq`.
+ * synthesized one built via `createPayloadRequest`.
  */
 export const buildMcpServer = ({
   authorizedMCP,
@@ -35,6 +36,8 @@ export const buildMcpServer = ({
   pluginConfig: SanitizedMCPPluginConfig
   req: PayloadRequest
 }): McpServer => {
+  z.config(z.locales.en())
+
   const serverOptions = pluginConfig.mcp?.serverOptions || {}
   const server = new McpServer(
     { name: 'Payload MCP Server', version: '1.0.0', ...serverOptions.serverInfo },
@@ -68,7 +71,7 @@ export const buildMcpServer = ({
 
   /**
    * Runs a collection/global tool call:
-   * - reads `collectionSlug` / `globalSlug` from the input
+   * - reads `slug` from the input
    * - runs access control: errors if `authorizedMCP.items` has no entry for this tool + slug
    * - runs the tool handler and finalizes its response
    */
@@ -82,16 +85,15 @@ export const buildMcpServer = ({
     serverContext: ServerContext
   }): Promise<MCPToolResponse> => {
     const entity = item.type === 'collectionTool' ? 'collection' : 'global'
-    const slugKey = item.type === 'collectionTool' ? 'collectionSlug' : 'globalSlug'
     const toolInput = (input ?? {}) as Record<string, unknown>
-    const slug = toolInput[slugKey] as string | undefined
+    const slug = toolInput.slug as string | undefined
 
     if (!slug) {
       return {
         content: [
           {
             type: 'text',
-            text: `Error: "${item.mcpName}" requires ${slugKey}. Use getConfigInfo to inspect ${entity} slugs.`,
+            text: `Error: "${item.mcpName}" requires slug. Use getConfigInfo to inspect ${entity} slugs.`,
           },
         ],
         isError: true,
@@ -126,8 +128,8 @@ export const buildMcpServer = ({
       serverContext,
     }
     const response = await (match.type === 'collectionTool'
-      ? match.tool.handler({ ...handlerArgs, collectionSlug: slug })
-      : match.tool.handler({ ...handlerArgs, globalSlug: slug }))
+      ? match.tool.handler({ ...handlerArgs, slug })
+      : match.tool.handler({ ...handlerArgs, slug }))
 
     return finalizeToolResponse({
       input: toolInput,
@@ -149,10 +151,7 @@ export const buildMcpServer = ({
           }
           registeredEntityTools.add(item.mcpName)
 
-          const inputSchema = withSlugInput({
-            name: item.type === 'collectionTool' ? 'collectionSlug' : 'globalSlug',
-            input: item.tool.input,
-          })
+          const inputSchema = withSlugInput({ input: item.tool.input })
 
           server.registerTool(
             item.mcpName,
@@ -246,39 +245,50 @@ export const buildMcpServer = ({
   return server
 }
 
-const withSlugInput = ({
-  name,
-  input,
-}: {
-  input?: ToolInputSchema
-  name: 'collectionSlug' | 'globalSlug'
-}): ToolInputSchema => {
-  const description = name === 'collectionSlug' ? 'The collection slug' : 'The global slug'
-  const slugSchema = z.string().describe(description)
+const withSlugInput = ({ input }: { input?: ToolInputSchema }): ToolInputSchema => {
+  const description = 'The target slug.'
+  const slugSchema = z.string().check(z.describe(description))
 
   if (!input) {
-    return z.object({ [name]: slugSchema })
+    return strictObject({ slug: slugSchema })
   }
 
-  if (input instanceof z.ZodObject) {
-    return input.extend({ [name]: slugSchema })
+  if (typeof input === 'object' && input !== null && '~standard' in input) {
+    const schema = input['~standard'].jsonSchema.input({ target: 'draft-2020-12' })
+    const properties = schema.properties as Record<string, unknown> | undefined
+
+    if (properties?.slug) {
+      return input
+    }
+
+    return addSlugToJSONSchema({ description, schema })
   }
 
-  const schema = input as {
+  return addSlugToJSONSchema({ description, schema: input })
+}
+
+const addSlugToJSONSchema = ({
+  description,
+  schema,
+}: {
+  description: string
+  schema: JsonSchemaType
+}): JsonSchemaType => {
+  const objectSchema = schema as {
     properties?: Record<string, JsonSchemaType>
     required?: string[]
   } & JsonSchemaType
 
   return {
-    ...schema,
+    ...objectSchema,
     type: 'object',
     properties: {
-      ...schema.properties,
-      [name]: {
+      ...objectSchema.properties,
+      slug: {
         type: 'string',
         description,
       },
     },
-    required: Array.from(new Set([name, ...(schema.required ?? [])])),
+    required: Array.from(new Set(['slug', ...(objectSchema.required ?? [])])),
   }
 }