@payloadcms/plugin-mcp 4.0.0-internal.9496957 → 4.0.0-internal.970009e

package/src/endpoint/oauthLoginToken.ts

@@ -0,0 +1,210 @@
+import type { PayloadRequest, SanitizedCollectionConfig } from 'payload'
+
+import { randomUUID } from 'crypto'
+import { APIError, getFieldsToSign, jwtSign } from 'payload'
+import { removeExpiredSessions } from 'payload/shared'
+
+import type { MCPOAuthTokens } from '../types.js'
+
+/** How long a refresh token stays valid without being used, in milliseconds: 30 days. */
+const refreshTokenExpiration = 30 * 24 * 60 * 60 * 1000
+
+/**
+ * How long a used refresh token is still accepted, in milliseconds. MCP clients that send
+ * requests in parallel can refresh twice at once with the same refresh token.
+ */
+const refreshTokenReuseInterval = 30 * 1000
+
+type User = NonNullable<PayloadRequest['user']>
+
+type Session = NonNullable<User['sessions']>[number]
+
+/** The default refresh token. The OAuth server seals it, so clients can't read or change it. */
+type LoginRefreshToken = {
+  collection: string
+  /** The session's `expiresAt` when this refresh token was issued. Every refresh moves it. */
+  expiresAt: number
+  sid: string
+  userID: number | string
+}
+
+/**
+ * The default `issueToken`: a Payload login token, which Payload's JWT strategy accepts. When the
+ * collection uses sessions, the token gets its own login session, and the client gets a refresh
+ * token for it.
+ */
+export const issueLoginToken = async ({
+  req,
+}: {
+  req: PayloadRequest
+}): Promise<MCPOAuthTokens> => {
+  const collection = req.payload.collections[req.user!.collection]!.config
+
+  if (collection.auth.disableLocalStrategy) {
+    throw new APIError(
+      `MCP clients can't get Payload login tokens for the "${collection.slug}" collection because its local strategy is disabled. Pass oauth.issueToken to the MCP plugin.`,
+    )
+  }
+
+  const user = (await findUser({ id: req.user!.id, collection, req }))!
+
+  if (!collection.auth.useSessions) {
+    return await signLoginToken({ collection, req, user })
+  }
+
+  const session = await saveSession({ collection, req, sid: randomUUID(), user })
+
+  return await signLoginToken({ collection, req, session, user })
+}
+
+/**
+ * The default `refreshToken`. Every refresh moves the session's expiry, so a refresh token with an
+ * older expiry was already used. Outside of parallel refreshes, that means someone copied it, and
+ * the session is signed out, which also revokes the client's access token.
+ */
+export const refreshLoginToken = async ({
+  refreshToken,
+  req,
+}: {
+  refreshToken: string
+  req: PayloadRequest
+}): Promise<MCPOAuthTokens | null> => {
+  const { collection: slug, expiresAt, sid, userID } = JSON.parse(refreshToken) as LoginRefreshToken
+  const collection = req.payload.collections[slug]?.config
+  const user = collection && (await findUser({ id: userID, collection, req }))
+  const session = removeExpiredSessions(user?.sessions ?? []).find(({ id }) => id === sid)
+
+  // Signed out, expired, or the user was deleted
+  if (!collection || !user || !session) {
+    return null
+  }
+
+  const sessionExpiresAt = new Date(session.expiresAt).getTime()
+
+  if (sessionExpiresAt === expiresAt) {
+    return await signLoginToken({
+      collection,
+      req,
+      session: await saveSession({ collection, req, sid, user }),
+      user,
+    })
+  }
+
+  // The client refreshed twice at once, so give the second request the current tokens
+  const refreshedAt = sessionExpiresAt - refreshTokenExpiration
+
+  if (Date.now() - refreshedAt < refreshTokenReuseInterval) {
+    return await signLoginToken({ collection, req, session, user })
+  }
+
+  // Someone copied the refresh token
+  await saveSessions({
+    collection,
+    req,
+    sessions: user.sessions!.filter(({ id }) => id !== sid),
+    user,
+  })
+
+  return null
+}
+
+// The full document, like the one a password login starts its session on
+const findUser = ({
+  id,
+  collection,
+  req,
+}: {
+  collection: SanitizedCollectionConfig
+  id: number | string
+  req: PayloadRequest
+}): Promise<null | User> =>
+  req.payload.db.findOne<User>({ collection: collection.slug, req, where: { id: { equals: id } } })
+
+/** Adds or extends the session `sid`, so it expires `refreshTokenExpiration` from now. */
+const saveSession = async ({
+  collection,
+  req,
+  sid,
+  user,
+}: {
+  collection: SanitizedCollectionConfig
+  req: PayloadRequest
+  sid: string
+  user: User
+}): Promise<Session> => {
+  const now = new Date()
+  const session: Session = {
+    id: sid,
+    createdAt: user.sessions?.find(({ id }) => id === sid)?.createdAt ?? now,
+    expiresAt: new Date(now.getTime() + refreshTokenExpiration),
+  }
+
+  await saveSessions({
+    collection,
+    req,
+    sessions: [
+      ...removeExpiredSessions(user.sessions ?? []).filter(({ id }) => id !== sid),
+      session,
+    ],
+    user,
+  })
+
+  return session
+}
+
+const saveSessions = async ({
+  collection,
+  req,
+  sessions,
+  user,
+}: {
+  collection: SanitizedCollectionConfig
+  req: PayloadRequest
+  sessions: Session[]
+  user: User
+}): Promise<void> => {
+  await req.payload.db.updateOne({
+    id: user.id,
+    collection: collection.slug,
+    // Prevent updatedAt from being updated when only changing sessions
+    data: { ...user, sessions, updatedAt: null },
+    req,
+    returning: false,
+  })
+}
+
+const signLoginToken = async ({
+  collection,
+  req,
+  session,
+  user,
+}: {
+  collection: SanitizedCollectionConfig
+  req: PayloadRequest
+  session?: Session
+  user: User
+}): Promise<MCPOAuthTokens> => {
+  const { token } = await jwtSign({
+    fieldsToSign: getFieldsToSign({
+      collectionConfig: collection,
+      email: user.email!,
+      sid: session?.id,
+      user,
+    }),
+    secret: req.payload.secret,
+    tokenExpiration: collection.auth.tokenExpiration,
+  })
+
+  return {
+    accessToken: token,
+    expiresIn: collection.auth.tokenExpiration,
+    refreshToken:
+      session &&
+      JSON.stringify({
+        collection: collection.slug,
+        expiresAt: new Date(session.expiresAt).getTime(),
+        sid: session.id,
+        userID: user.id,
+      } satisfies LoginRefreshToken),
+  }
+}

package/src/endpoint/oauthServer.ts

@@ -0,0 +1,428 @@
+import type {
+  OAuthClientInformationFull,
+  OAuthTokens,
+  OpenIdProviderDiscoveryMetadata,
+} from '@modelcontextprotocol/server'
+import type { Endpoint, PayloadHandler, PayloadRequest } from 'payload'
+
+import { OAuthErrorCode } from '@modelcontextprotocol/server'
+import { createHash } from 'crypto'
+import { formatAdminURL } from 'payload/shared'
+
+import type { MCPBuiltinOAuthConfig, MCPOAuthTokens } from '../types.js'
+
+import { getPluginConfig } from '../utils/getPluginConfig.js'
+import { getMCPURL } from './oauth.js'
+import { issueLoginToken, refreshLoginToken } from './oauthLoginToken.js'
+
+type Client = { name: string; redirectURIs: string[] }
+
+type Consent = {
+  clientID: string
+  codeChallenge: string
+  collection: string
+  redirectURI: string
+  state: null | string
+  userID: number | string
+}
+
+type Code = {
+  clientID: string
+  codeChallenge: string
+  redirectURI: string
+  tokens: MCPOAuthTokens
+}
+
+type RefreshToken = {
+  clientID: string
+  refreshToken: string
+}
+
+/**
+ * Turns Payload into the OAuth authorization server for MCP clients when `oauth.type` is
+ * `'builtin'`. Clients register, the user allows them after logging in to the admin panel, and
+ * the client receives the tokens `issueToken` creates.
+ *
+ * Clients, consent forms, authorization codes, and refresh tokens are encrypted and handed to the
+ * client instead of being stored. Only the default tokens write to the database, to the user's
+ * login sessions.
+ */
+export const oauthServerEndpoints: Endpoint[] = [
+  {
+    disableAuth: true,
+    handler: (req) => withIssuer(req, (issuer) => metadataResponse(issuer)),
+    method: 'get',
+    // OpenID discovery is the only metadata location MCP clients check below the issuer's path,
+    // which lets this work under /api without a route at the site root
+    path: '/mcp/oauth/.well-known/openid-configuration',
+  },
+  {
+    disableAuth: true,
+    handler: (req) => withIssuer(req, () => Response.json({ keys: [] })),
+    method: 'get',
+    path: '/mcp/oauth/jwks',
+  },
+  {
+    disableAuth: true,
+    handler: (req) => withIssuer(req, () => register(req)),
+    method: 'post',
+    path: '/mcp/oauth/register',
+  },
+  {
+    handler: (req) => withIssuer(req, () => authorize(req)),
+    method: 'get',
+    path: '/mcp/oauth/authorize',
+  },
+  {
+    handler: (req) => withIssuer(req, () => approve(req)),
+    method: 'post',
+    path: '/mcp/oauth/authorize',
+  },
+  {
+    disableAuth: true,
+    handler: (req) => withIssuer(req, () => token(req)),
+    method: 'post',
+    path: '/mcp/oauth/token',
+  },
+]
+
+/** The authorization server URL, or `undefined` when Payload isn't the authorization server. */
+const getIssuer = (req: PayloadRequest): string | undefined =>
+  getPluginConfig({ config: req.payload.config }).oauth?.type === 'builtin'
+    ? `${getMCPURL({ config: req.payload.config, url: req.url! })}/oauth`
+    : undefined
+
+const withIssuer = (
+  req: PayloadRequest,
+  handler: (issuer: string) => Promise<Response> | Response,
+): Promise<Response> | Response => {
+  const issuer = getIssuer(req)
+  return issuer ? handler(issuer) : new Response(null, { status: 404 })
+}
+
+const metadataResponse = (issuer: string): Response =>
+  Response.json(
+    {
+      authorization_endpoint: `${issuer}/authorize`,
+      code_challenge_methods_supported: ['S256'],
+      grant_types_supported: ['authorization_code', 'refresh_token'],
+      // Required by OpenID discovery. No ID tokens are issued.
+      id_token_signing_alg_values_supported: ['RS256'],
+      issuer,
+      jwks_uri: `${issuer}/jwks`,
+      registration_endpoint: `${issuer}/register`,
+      response_types_supported: ['code'],
+      subject_types_supported: ['public'],
+      token_endpoint: `${issuer}/token`,
+      token_endpoint_auth_methods_supported: ['none'],
+    } satisfies OpenIdProviderDiscoveryMetadata,
+    { headers: { 'Access-Control-Allow-Origin': '*' } },
+  )
+
+const register: PayloadHandler = async (req) => {
+  const { client_name, redirect_uris } = await req.json!().catch(() => ({}))
+
+  if (
+    !Array.isArray(redirect_uris) ||
+    !redirect_uris.length ||
+    !redirect_uris.every(
+      (uri) => typeof uri === 'string' && URL.canParse(uri) && !uri.includes('#'),
+    )
+  ) {
+    return Response.json({ error: OAuthErrorCode.InvalidRedirectUri }, { status: 400 })
+  }
+
+  const client: Client = {
+    name: typeof client_name === 'string' ? client_name : 'An MCP client',
+    redirectURIs: redirect_uris,
+  }
+
+  return Response.json(
+    {
+      client_id: seal({ type: 'client', data: client, req }),
+      client_name: client.name,
+      grant_types: ['authorization_code', 'refresh_token'],
+      redirect_uris: client.redirectURIs,
+      response_types: ['code'],
+      token_endpoint_auth_method: 'none',
+    } satisfies OAuthClientInformationFull,
+    { status: 201 },
+  )
+}
+
+const authorize: PayloadHandler = (req) => {
+  const url = new URL(req.url!)
+  const params = url.searchParams
+  const clientID = params.get('client_id')
+  const client = unseal<Client>({ type: 'client', req, value: clientID })
+  const redirectURI = params.get('redirect_uri')
+
+  // Never redirect to an address the client didn't register
+  if (!client || !redirectURI || !client.redirectURIs.includes(redirectURI)) {
+    return page({
+      content: '<p>Start the sign-in again from your MCP client.</p>',
+      status: 400,
+      title: 'This sign-in link is invalid',
+    })
+  }
+
+  const state = params.get('state')
+  const codeChallenge = params.get('code_challenge')
+
+  if (
+    params.get('response_type') !== 'code' ||
+    params.get('code_challenge_method') !== 'S256' ||
+    !codeChallenge
+  ) {
+    return redirect({ params: { error: OAuthErrorCode.InvalidRequest, state }, redirectURI })
+  }
+
+  if (!req.user) {
+    const loginURL = formatAdminURL({ adminRoute: req.payload.config.routes.admin, path: '/login' })
+
+    return new Response(null, {
+      headers: {
+        Location: `${loginURL}?redirect=${encodeURIComponent(url.pathname + url.search)}`,
+      },
+      status: 302,
+    })
+  }
+
+  const consent: Consent = {
+    clientID: clientID!,
+    codeChallenge,
+    collection: req.user.collection,
+    redirectURI,
+    state,
+    userID: req.user.id,
+  }
+
+  return page({
+    content: `<p>It will be able to use this app's MCP tools as ${escapeHTML(String(req.user.email ?? req.user.id))}, and you will return to ${escapeHTML(new URL(redirectURI).host || redirectURI)}.</p>
+<form method="post">
+<input name="consent" type="hidden" value="${seal({ type: 'consent', data: consent, expiresIn: 20 * 60 * 60, req })}">
+<button name="decision" type="submit" value="allow">Allow</button>
+<button name="decision" type="submit" value="deny">Deny</button>
+</form>`,
+    status: 200,
+    title: `Allow ${client.name} to use your account?`,
+  })
+}
+
+const approve: PayloadHandler = async (req) => {
+  const form = new URLSearchParams(await req.text!())
+  const consent = unseal<Consent>({ type: 'consent', req, value: form.get('consent') })
+
+  // The form is only valid for the user it was shown to
+  if (!consent || req.user?.id !== consent.userID || req.user.collection !== consent.collection) {
+    return page({
+      content: '<p>Start the sign-in again from your MCP client.</p>',
+      status: 400,
+      title: 'This sign-in request expired',
+    })
+  }
+
+  const { clientID, codeChallenge, redirectURI, state } = consent
+
+  if (form.get('decision') !== 'allow') {
+    return redirect({ params: { error: OAuthErrorCode.AccessDenied, state }, redirectURI })
+  }
+
+  const code: Code = {
+    clientID,
+    codeChallenge,
+    redirectURI,
+    tokens: await getTokenHooks(req).issueToken({ req }),
+  }
+
+  return redirect({
+    params: { code: seal({ type: 'code', data: code, expiresIn: 60, req }), state },
+    redirectURI,
+  })
+}
+
+const token: PayloadHandler = async (req) => {
+  const form = new URLSearchParams(await req.text!())
+  const clientID = form.get('client_id')
+  const tokens =
+    clientID &&
+    (form.get('grant_type') === 'refresh_token'
+      ? await refresh({ clientID, form, req })
+      : redeemCode({ clientID, form, req }))
+
+  if (!clientID || !tokens) {
+    return Response.json({ error: OAuthErrorCode.InvalidGrant }, { status: 400 })
+  }
+
+  return Response.json(
+    {
+      access_token: tokens.accessToken,
+      expires_in: tokens.expiresIn,
+      refresh_token:
+        tokens.refreshToken &&
+        seal({
+          type: 'refresh',
+          data: { clientID, refreshToken: tokens.refreshToken } satisfies RefreshToken,
+          req,
+        }),
+      token_type: 'Bearer',
+    } satisfies OAuthTokens,
+    { headers: { 'Cache-Control': 'no-store' } },
+  )
+}
+
+const redeemCode = ({
+  clientID,
+  form,
+  req,
+}: {
+  clientID: string
+  form: URLSearchParams
+  req: PayloadRequest
+}): MCPOAuthTokens | undefined => {
+  const code = unseal<Code>({ type: 'code', req, value: form.get('code') })
+
+  if (
+    form.get('grant_type') === 'authorization_code' &&
+    code?.clientID === clientID &&
+    code.redirectURI === form.get('redirect_uri') &&
+    // PKCE: only the client that started the sign-in knows the verifier
+    createHash('sha256')
+      .update(form.get('code_verifier') ?? '')
+      .digest('base64url') === code.codeChallenge
+  ) {
+    return code.tokens
+  }
+}
+
+const refresh = async ({
+  clientID,
+  form,
+  req,
+}: {
+  clientID: string
+  form: URLSearchParams
+  req: PayloadRequest
+}): Promise<MCPOAuthTokens | null | undefined> => {
+  const refreshToken = unseal<RefreshToken>({
+    type: 'refresh',
+    req,
+    value: form.get('refresh_token'),
+  })
+
+  // Only the client a refresh token was issued to can use it
+  if (refreshToken?.clientID === clientID) {
+    return await getTokenHooks(req).refreshToken?.({
+      refreshToken: refreshToken.refreshToken,
+      req,
+    })
+  }
+}
+
+/** `issueToken` and `refreshToken`, or the defaults for Payload login tokens. */
+const getTokenHooks = (req: PayloadRequest) => {
+  const oauth = getPluginConfig({ config: req.payload.config }).oauth as MCPBuiltinOAuthConfig
+
+  return oauth.issueToken
+    ? { issueToken: oauth.issueToken, refreshToken: oauth.refreshToken }
+    : { issueToken: issueLoginToken, refreshToken: refreshLoginToken }
+}
+
+/**
+ * Encrypts data for the client to hold, so it doesn't need to be stored. `type` keeps one kind
+ * from being used as another, e.g. a client ID as an authorization code.
+ */
+const seal = ({
+  type,
+  data,
+  expiresIn,
+  req,
+}: {
+  data: object
+  /** Seconds */
+  expiresIn?: number
+  req: PayloadRequest
+  type: string
+}): string =>
+  req.payload.encrypt(
+    JSON.stringify({ ...data, type, exp: expiresIn && Date.now() + expiresIn * 1000 }),
+  )
+
+const unseal = <T>({
+  type,
+  req,
+  value,
+}: {
+  req: PayloadRequest
+  type: string
+  value: null | string
+}): T | undefined => {
+  // Only the v1 format is authenticated. Older formats decrypt anything without an error.
+  if (!value?.startsWith('v1:')) {
+    return undefined
+  }
+
+  try {
+    // Previous secrets can be public, like a default secret from source code, so only client IDs
+    // accept them. Client IDs grant nothing, and this keeps clients registered when the secret changes.
+    const secret = type === 'client' ? undefined : req.payload.config.secret
+    const data = JSON.parse(req.payload.decrypt(value, { secret }))
+    return data.type === type && (!data.exp || data.exp > Date.now()) ? data : undefined
+  } catch {
+    return undefined
+  }
+}
+
+const redirect = ({
+  params,
+  redirectURI,
+}: {
+  params: Record<string, null | string>
+  redirectURI: string
+}): Response => {
+  const location = new URL(redirectURI)
+
+  for (const [key, value] of Object.entries(params)) {
+    if (value) {
+      location.searchParams.set(key, value)
+    }
+  }
+
+  return new Response(null, { headers: { Location: location.href }, status: 302 })
+}
+
+const page = ({
+  content,
+  status,
+  title,
+}: {
+  content: string
+  status: number
+  title: string
+}): Response =>
+  new Response(
+    `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${escapeHTML(title)}</title>
+<style>
+body { font-family: system-ui, sans-serif; margin: 4rem auto; max-width: 32rem; overflow-wrap: anywhere; padding: 0 1rem }
+button { font: inherit; margin-inline-end: 0.5rem; padding: 0.5rem 1rem }
+</style>
+</head>
+<body><h1>${escapeHTML(title)}</h1>${content}</body>
+</html>`,
+    {
+      headers: {
+        // Stop other sites from framing the page to trick users into clicking Allow
+        'Content-Security-Policy': "frame-ancestors 'none'",
+        'Content-Type': 'text/html; charset=utf-8',
+      },
+      status,
+    },
+  )
+
+const escapeHTML = (value: string): string =>
+  value.replace(/[&<>"']/g, (character) => `&#${character.charCodeAt(0)};`)