@prostgles/prostgles 2.3.6-dev.1786548258

package/server/src/McpHub/AnthropicMcpHub/McpOAuth/getMcpOAuthMetadata.ts

@@ -0,0 +1,112 @@
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { MCP_CLIENT_INFO } from "../McpTypes";
+
+export const getMcpOAuthMetadata = async (remoteMcpUrl: string) => {
+  const getOAuthMetadataUrl = (route: keyof OAuthRouteDataMap, url: string) => {
+    const { origin, pathname } = new URL(url);
+
+    return (
+      origin +
+      ["/.well-known", route, pathname.slice(1)].filter(Boolean).join("/")
+    );
+  };
+
+  const metadata = await fetchJson<{
+    resource: string;
+    authorization_servers: string[];
+    scopes_supported: string[];
+    bearer_methods_supported?: string[];
+    client_id_metadata_document_supported?: boolean;
+  }>(getOAuthMetadataUrl("oauth-protected-resource", remoteMcpUrl));
+
+  const [firstServerUrl] = metadata.authorization_servers;
+
+  if (!firstServerUrl) {
+    throw new Error(
+      `MCP server "${remoteMcpUrl}" has no authorization endpoint`,
+    );
+  }
+
+  const serverInfo = await fetchJson<{
+    issuer: string;
+    authorization_endpoint: string;
+    registration_endpoint?: string;
+    token_endpoint: string;
+    response_types_supported: string[];
+    grant_types_supported: string[];
+    service_documentation?: string;
+    scopes_supported: string[];
+  }>(
+    getOAuthMetadataUrl(
+      "oauth-authorization-server",
+      firstServerUrl,
+    ).toString(),
+  );
+
+  const modes = {
+    no_auth: await canConnectWithoutAuthentication(remoteMcpUrl),
+    dcr: Boolean(serverInfo.registration_endpoint),
+    bearer_token: Boolean(metadata.bearer_methods_supported?.length),
+    cimd: Boolean(metadata.client_id_metadata_document_supported),
+  };
+
+  const defaultMode =
+    modes.no_auth ? "no_auth"
+    : modes.dcr ? "dcr"
+    : modes.bearer_token ? "bearer_token"
+    : modes.cimd ? "cimd"
+    : undefined;
+
+  return { modes, defaultMode, metadata, serverInfo };
+};
+
+const fetchJson = async <T>(url: string): Promise<T> => {
+  const data = await fetch(url, {
+    method: "GET",
+    headers: {
+      "Content-Type": "application/json",
+      "User-Agent": "Prostgles-MCP-Client/1.0",
+    },
+    signal: AbortSignal.timeout(5000),
+  });
+  if (!data.ok) {
+    throw new Error(
+      `Failed to fetch MCP OAuth metadata from "${url}": ${data.status} ${data.statusText}`,
+    );
+  }
+  return (await data.json()) as T;
+};
+
+type OAuthRouteDataMap = {
+  "oauth-protected-resource": {
+    resource: string;
+    authorization_servers: string[];
+    scopes_supported: string[];
+    resource_name?: string;
+    bearer_methods_supported?: string[];
+  };
+  "oauth-authorization-server": {
+    authorization_endpoint: string;
+    token_endpoint: string;
+    scopes_supported: string[];
+    resource_name?: string;
+  };
+};
+
+const canConnectWithoutAuthentication = async (
+  remoteMcpUrl: string,
+): Promise<boolean> => {
+  const client = new Client(MCP_CLIENT_INFO, { capabilities: {} });
+  const transport = new StreamableHTTPClientTransport(new URL(remoteMcpUrl));
+
+  try {
+    await client.connect(transport);
+    return true;
+  } catch {
+    return false;
+  } finally {
+    await transport.close().catch(() => {});
+    await client.close().catch(() => {});
+  }
+};

package/server/src/McpHub/AnthropicMcpHub/McpOAuth/getRemoteMcpServerParameters.ts

@@ -0,0 +1,82 @@
+import type { DBSSchema } from "@common/publishUtils";
+import type { DBS } from "@src/index";
+import type { McpServerParameters } from "../McpTypes";
+import { createMcpOAuthProvider } from "./createMcpOAuthProvider";
+import { saveServerInfo } from "./saveServerInfo";
+
+export const getRemoteMcpServerParameters = ({
+  dbs,
+  server,
+  mcp_server_config,
+  onLog,
+}: {
+  dbs: DBS;
+  server: DBSSchema["mcp_servers"];
+  mcp_server_config: DBSSchema["mcp_server_configs"];
+  onLog: McpServerParameters["onLog"];
+}) => {
+  const { oauth, config } = mcp_server_config;
+  if (!oauth) {
+    throw new Error(
+      `MCP server "${server.name}" has command "streamable-http" but no OAuth config in mcp_server_configs.`,
+    );
+  }
+
+  if (config.type !== "OAuth") {
+    throw new Error(
+      `MCP server "${server.name}" has command "streamable-http" but mcp_server_configs has config type "${config.type}", expected "OAuth".`,
+    );
+  }
+
+  if (oauth.phase === "awaiting_authorization" || oauth.phase === "error") {
+    // do not enable
+    return;
+  }
+
+  const withBearerToken = (
+    existingHeaders: Record<string, string> | undefined | null,
+  ) => {
+    if (config.auth.mode !== "bearer") {
+      return existingHeaders ?? undefined;
+    }
+    return {
+      ...existingHeaders,
+      Authorization: `Bearer ${config.auth.bearerToken}`,
+    };
+  };
+
+  return {
+    type: "remote",
+    isInitializing: oauth.phase === "initializing_dcr",
+    server_name: server.name,
+    url: server.url!, // TODO: change the parameters to typed jsonb,
+    OAuth: createMcpOAuthProvider({
+      dbs,
+      serverConfig: mcp_server_config,
+    }),
+    headers: withBearerToken(server.headers),
+    RemoteServerEvents: {
+      onConnected: async (args) => {
+        await saveServerInfo({ ...config, dbs, server }, args);
+        if (
+          config.auth.mode === "bearer" &&
+          oauth.phase === "initializing_bearer_token"
+        ) {
+          await dbs.mcp_server_configs.update(
+            {
+              server_name: server.name,
+              config,
+            },
+            {
+              oauth: {
+                phase: "connected_bearer",
+                bearerToken: config.auth.bearerToken,
+              },
+            },
+          );
+        }
+      },
+    },
+    onLog,
+  } satisfies McpServerParameters;
+};

package/server/src/McpHub/AnthropicMcpHub/McpOAuth/saveServerInfo.ts

@@ -0,0 +1,76 @@
+import type { DBSSchema } from "@common/publishUtils";
+import type { DBS } from "@src/index";
+import type { RemoteMcpServerParameters } from "../McpTypes";
+import { isEqual } from "prostgles-types";
+
+export const saveServerInfo = async (
+  {
+    savePngIcon,
+    dbs,
+    server,
+  }: { savePngIcon: boolean; dbs: DBS; server: DBSSchema["mcp_servers"] },
+  {
+    serverVersion,
+    capabilities,
+  }: Parameters<
+    NonNullable<
+      Required<RemoteMcpServerParameters>["RemoteServerEvents"]["onConnected"]
+    >
+  >[0],
+) => {
+  const firstIcon = serverVersion?.icons?.find(
+    (icon) => icon.mimeType === "image/png",
+  );
+  const maxSize = 1024 * 1024; // 1MB
+  const icon_bytes =
+    savePngIcon && firstIcon?.src ?
+      await fetch(firstIcon.src)
+        .then((res) => {
+          /** Test type and size */
+          if (res.headers.get("Content-Type") !== "image/png") {
+            throw new Error(
+              `Expected icon to be of type "image/png" but got "${res.headers.get(
+                "Content-Type",
+              )}"`,
+            );
+          }
+          const contentLength = res.headers.get("Content-Length");
+          if (contentLength && parseInt(contentLength) > maxSize) {
+            throw new Error(
+              `Expected icon to be less than 1MB but got ${contentLength} bytes`,
+            );
+          }
+          return res.arrayBuffer();
+        })
+        .catch((cause) =>
+          Promise.reject(new Error("Failed to fetch icon", { cause })),
+        )
+    : null;
+
+  if (icon_bytes && icon_bytes.byteLength > maxSize) {
+    throw new Error(
+      `Expected icon to be less than 1MB but got ${icon_bytes.byteLength} bytes`,
+    );
+  }
+
+  const newData = {
+    info: serverVersion?.description ?? serverVersion?.title ?? null,
+    capabilities,
+    server_version: serverVersion,
+    icon_bytes,
+  };
+
+  if (
+    isEqual(server.capabilities, capabilities ?? null) &&
+    isEqual(server.server_version, serverVersion ?? null)
+  ) {
+    return;
+  }
+
+  await dbs.mcp_servers.update(
+    {
+      name: server.name,
+    },
+    newData,
+  );
+};

package/server/src/McpHub/AnthropicMcpHub/McpOAuth/updateRemoteMcpAuthorizationCode.ts

@@ -0,0 +1,100 @@
+import type { DBS } from "@src/index";
+import { getJSONBObjectSchemaValidationError } from "prostgles-types";
+import { enqueuedRequestIds } from "./authenticateMcpServer";
+import { tout } from "@src/utils/tout";
+
+export const updateRemoteMcpAuthorizationCode = async (
+  dbs: DBS,
+  data: unknown,
+) => {
+  const validation = getJSONBObjectSchemaValidationError(
+    {
+      server_name: "string",
+      scopes: "string",
+      code: "string",
+      request_id: "string",
+    },
+    data,
+    "params for updateRemoteMcpAuthorizationCode",
+    undefined,
+    { allowExtraProperties: true },
+  );
+
+  if (validation.error !== undefined) {
+    return { success: false, message: validation.error } as const;
+  }
+  const { scopes: scopesStr, code, server_name, request_id } = validation.data;
+
+  const matchingRequest = enqueuedRequestIds.has(request_id);
+  if (!matchingRequest) {
+    return {
+      success: false,
+      message: `No matching MCP Auth request found for request_id "${request_id}". This may indicate a replay attack or that the request has expired.`,
+    } as const;
+  }
+
+  return await dbs
+    .tx(async (t) => {
+      const existingConfig = await t.mcp_server_configs.findOne({
+        server_name,
+        oauth_request_id: request_id,
+      });
+      if (!existingConfig) {
+        throw new Error(
+          `MCP server config with scope "${scopesStr}" not found.`,
+        );
+      }
+      const { oauth } = existingConfig;
+      if (!oauth) {
+        throw new Error(
+          `MCP server config with scope "${scopesStr}" has no OAuth config.`,
+        );
+      }
+      if (oauth.phase !== "awaiting_authorization") {
+        throw new Error(
+          `MCP server config with scope "${scopesStr}" is not in the correct phase for updating the authorization code. Current phase: ${oauth.phase}`,
+        );
+      }
+      await t.mcp_server_configs.update(
+        { id: existingConfig.id },
+        {
+          oauth: {
+            phase: "exchanging_code",
+            redirectUri: oauth.redirectUri,
+            scopes: oauth.scopes,
+            clientInformation: oauth.clientInformation,
+            discoveryState: oauth.discoveryState,
+            pendingAuthorizationCode: code,
+            codeVerifier: oauth.codeVerifier,
+          },
+        },
+      );
+      enqueuedRequestIds.delete(request_id);
+      await tout(1_000);
+      await t.mcp_servers.update(
+        {
+          name: existingConfig.server_name,
+        },
+        {
+          enabled: true,
+        },
+      );
+      return existingConfig;
+    })
+    .then(async (data) => {
+      const { id: mcp_server_config_id, server_name } = await data;
+      return {
+        success: true,
+        server_name,
+        mcp_server_config_id,
+        code,
+      } as const;
+    })
+    .catch((err) => {
+      console.error("Error updating remote MCP authorization code:", err);
+      return {
+        success: false,
+        message: "Error updating remote MCP authorization code",
+      } as const;
+    });
+};

package/server/src/McpHub/AnthropicMcpHub/McpTypes.ts

@@ -0,0 +1,189 @@
+import type {
+  OAuthClientProvider,
+  OAuthDiscoveryState,
+} from "@modelcontextprotocol/sdk/client/auth";
+import type { StdioServerParameters } from "@modelcontextprotocol/sdk/client/stdio";
+import type {
+  OAuthClientInformationMixed,
+  OAuthTokens,
+} from "@modelcontextprotocol/sdk/shared/auth";
+import {
+  ServerCapabilitiesSchema,
+  type ImplementationSchema,
+  type ListPromptsResultSchema,
+  type ListToolsResult,
+} from "@modelcontextprotocol/sdk/types";
+import { getElectronConfig } from "@src/electronConfig";
+import { z } from "zod";
+const StdioConfigSchema = z.object({
+  transport: z.literal("stdio").optional(),
+  command: z.string(),
+  args: z.array(z.string()).optional(),
+  env: z.record(z.string(), z.string()).optional(),
+  cwd: z.string().optional(),
+  disabled: z.boolean().optional(),
+});
+
+const OAuthStatePersistFnSchema = z.custom<
+  NonNullable<StreamableHTTPOAuthConfig["onPersistState"]>
+>((value) => typeof value === "function");
+
+const OAuthRedirectFnSchema = z.custom<
+  NonNullable<StreamableHTTPOAuthConfig["onAuthRedirect"]>
+>((value) => typeof value === "function");
+
+const OAuthClientProviderSchema = z.custom<OAuthClientProvider>(
+  (value) => typeof value === "object" && value !== null,
+);
+
+const StreamableHTTPOAuthStateSchema = z.object({
+  clientInformation: z.custom<OAuthClientInformationMixed>().optional(),
+  tokens: z.custom<OAuthTokens>().optional(),
+  codeVerifier: z.string().optional(),
+  discoveryState: z.custom<OAuthDiscoveryState>().optional(),
+  pendingAuthorizationCode: z.string().optional(),
+});
+
+const StreamableHTTPOAuthConfigSchema: z.ZodType<StreamableHTTPOAuthConfig> =
+  z.object({
+    enabled: z.boolean().optional(),
+    redirectUri: z.string().url(),
+    clientId: z.string().optional(),
+    clientSecret: z.string().optional(),
+    scopes: z.array(z.string()).optional(),
+    state: StreamableHTTPOAuthStateSchema.optional(),
+    onPersistState: OAuthStatePersistFnSchema.optional(),
+    onAuthRedirect: OAuthRedirectFnSchema.optional(),
+    authProvider: OAuthClientProviderSchema.optional(),
+  });
+
+const StreamableHTTPConfigSchema = z.object({
+  transport: z.literal("streamable-http"),
+  url: z.string().url(),
+  headers: z.record(z.string(), z.string()).optional(),
+  requestInit: z.unknown().optional(),
+  disabled: z.boolean().optional(),
+  oauth: StreamableHTTPOAuthConfigSchema.optional(),
+});
+
+export const ConfigSchema = z.union([
+  StdioConfigSchema,
+  StreamableHTTPConfigSchema,
+]);
+
+export type StreamableHTTPConfig = z.infer<typeof StreamableHTTPConfigSchema>;
+
+export type McpMode = "full" | "server-use-only" | "off";
+
+export type StreamableHTTPOAuthState = z.infer<
+  typeof StreamableHTTPOAuthStateSchema
+>;
+
+export type StreamableHTTPOAuthConfig = {
+  enabled?: boolean;
+  redirectUri: string;
+  clientId?: string;
+  clientSecret?: string;
+  scopes?: string[];
+  state?: StreamableHTTPOAuthState;
+  onPersistState?: (state: StreamableHTTPOAuthState) => void | Promise<void>;
+  onAuthRedirect?: (authorizationUrl: string) => void | Promise<void>;
+  authProvider?: OAuthClientProvider;
+};
+
+export type McpServer = {
+  name: string;
+  config: RemoteMcpServerParameters | StdioServerParameters;
+  status: "connected" | "connecting" | "disconnected";
+  error?: string;
+  tools?: McpTool[];
+  resources?: McpResource[];
+  resourceTemplates?: McpResourceTemplate[];
+  prompts?: Awaited<ReturnType<typeof ListPromptsResultSchema.parse>>;
+};
+
+export type McpTool = ListToolsResult["tools"][number];
+
+export type McpResource = {
+  uri: string;
+  name: string;
+  mimeType?: string;
+  description?: string;
+};
+
+export type McpResourceTemplate = {
+  uriTemplate: string;
+  name: string;
+  description?: string;
+  mimeType?: string;
+};
+
+export type McpResourceResponse = {
+  _meta?: Record<string, any>;
+  contents: Array<{
+    uri: string;
+    mimeType?: string;
+    text?: string;
+    blob?: string;
+  }>;
+};
+
+export type McpServerEvents = {
+  onLog: (
+    item:
+      | { type: "stderr"; data: string }
+      | {
+          type: "error";
+          errorType?:
+            | "oauth-authorization-url"
+            | "oauth-dcr-not-supported"
+            | "disconnected";
+          data: unknown;
+        },
+    fullLog: string,
+  ) => void | Promise<void>;
+  onTransportClose: () => void;
+};
+
+export type RemoteMcpServerParameters = {
+  url: string;
+  headers: Record<string, string> | undefined;
+  /**
+   * If true will remove requestInit to try DCR
+   */
+  isInitializing: boolean;
+  requestInit?: RequestInit;
+  OAuth:
+    | undefined
+    | {
+        pendingAuthorizationCode: undefined | string;
+        onCodeUsed: () => Promise<void>;
+        authProvider: OAuthClientProvider;
+        onAuthError: (
+          errorType: "dcr_not_supported" | "unknown",
+          error: string,
+        ) => void;
+      };
+  RemoteServerEvents?: {
+    onConnected?: (info: {
+      serverVersion?: z.infer<typeof ImplementationSchema>;
+      capabilities?: z.infer<typeof ServerCapabilitiesSchema>;
+    }) => Promise<void> | void;
+  };
+};
+
+export type McpServerParametersWithEvents =
+  | ({ type: "stdio" } & StdioServerParameters &
+      Omit<McpServerEvents, "onTransportClose">)
+  | ({ type: "remote" } & RemoteMcpServerParameters &
+      Omit<McpServerEvents, "onTransportClose">);
+
+export type McpServerParameters = McpServerParametersWithEvents & {
+  server_name: string;
+};
+export type ServersConfig = Map<string, McpServerParameters>;
+
+export const MCP_CLIENT_INFO = {
+  name: "Prostgles" + (getElectronConfig()?.isElectron ? " Desktop" : " UI"),
+  version: "1.0.0",
+};

package/server/src/McpHub/AnthropicMcpHub/connectToMCPServer.ts

@@ -0,0 +1,132 @@
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+import { tout } from "@src/utils/tout";
+import { getSerialisableError } from "prostgles-types";
+import type { McpConnection } from "./McpHub";
+import {
+  MCP_CLIENT_INFO,
+  type McpServerEvents,
+  type McpServerParameters,
+} from "./McpTypes";
+import { connectToRemoteMCPServer } from "./McpOAuth/connectToRemoteMCPServer";
+import { createMcpServerHandlers } from "./createMcpServerHandlers";
+
+export type MCPServerInitInfo = McpServerEvents & {
+  name: string;
+  server_name: string;
+  parameters: McpServerParameters;
+};
+
+export const connectToMCPServer = async ({
+  name,
+  server_name,
+  parameters,
+  onLog,
+  onTransportClose,
+}: MCPServerInitInfo): Promise<
+  | {
+      success: true;
+      connection: McpConnection;
+    }
+  | {
+      success: false;
+      error: unknown;
+      log: string;
+    }
+> => {
+  let log = "";
+  try {
+    // Each MCP server requires its own transport connection and has unique capabilities, configurations, and error handling.
+    // Having separate clients also allows proper scoping of resources/tools and independent server management like reconnection.
+    const client = new Client(MCP_CLIENT_INFO, {
+      capabilities: {},
+    });
+
+    if (parameters.type === "remote") {
+      const connection = await connectToRemoteMCPServer({
+        name,
+        server_name,
+        client,
+        parameters,
+        onLog,
+        onTransportClose,
+        appendToLog: (chunk: string) => {
+          log += chunk;
+        },
+        getFullLog: () => log,
+      });
+      return { success: true, connection };
+    }
+
+    const transport = new StdioClientTransport({
+      command: parameters.command,
+      args: parameters.args,
+      env: {
+        ...parameters.env,
+        ...(process.env.PATH ? { PATH: process.env.PATH } : {}),
+        // ...(process.env.NODE_PATH ? { NODE_PATH: process.env.NODE_PATH } : {}),
+      },
+      cwd: parameters.cwd,
+      stderr: "pipe", // necessary for stderr to be available
+    });
+    // transport.onmessage = (message) => {
+    //   console.log(`MCP Server ${name} message:`, message);
+    // };
+
+    transport.onerror = (error) => {
+      const errMsg = `Transport error: ${error.message}`;
+      log += errMsg;
+      void onLog({ type: "error", data: error }, log);
+      // reject(errMsg);
+    };
+    transport.onclose = () => {
+      onTransportClose();
+      // reject(new Error(`Transport closed`));
+    };
+
+    const connection: McpConnection = {
+      server_name,
+      server: {
+        name,
+        config: parameters,
+        status: "connecting",
+      },
+      client,
+      transport,
+      handlers: createMcpServerHandlers(client),
+      destroy: async () => {
+        try {
+          await transport.close();
+          await client.close();
+        } catch (error) {
+          console.error(`Failed to close transport for ${name}:`, error);
+        }
+      },
+    };
+
+    // transport.stderr is only available after the process has been started. However we can't start it separately from the .connect() call because it also starts the transport. And we can't place this after the connect call since we need to capture the stderr stream before the connection is established, in order to capture errors during the connection process.
+    // As a workaround, we start the transport ourselves, and then monkey-patch the start method to no-op so that .connect() doesn't try to start it again.
+    await transport.start();
+    const stderrStream = transport.stderr;
+    if (stderrStream) {
+      transport.stderr.on("data", (data: Buffer) => {
+        const errorOutput = data.toString();
+        log += errorOutput;
+        void onLog({ type: "stderr", data: errorOutput }, log);
+      });
+    } else {
+      console.error(`No stderr stream for ${name}`);
+    }
+    transport.start = async () => {}; // No-op now, .connect() won't fail
+
+    await client.connect(transport).catch(async (error) => {
+      await tout(1000); // wait for connection to be established
+      return Promise.reject(error);
+    });
+    connection.server.status = "connected";
+    connection.server.error = "";
+    return { success: true, connection };
+  } catch (error) {
+    return { success: false, error: getSerialisableError(error), log };
+  }
+};