@rekog/mcp-nest 1.7.0-alpha.0 → 1.7.0-alpha.2

package/src/authz/stores/memory-store.service.spec.ts

@@ -0,0 +1,240 @@
+import { Test, TestingModule } from '@nestjs/testing';
+import { MemoryStore } from './memory-store.service';
+import { OAuthClient } from './oauth-store.interface';
+
+describe('MemoryStore', () => {
+  let service: MemoryStore;
+
+  beforeEach(async () => {
+    const module: TestingModule = await Test.createTestingModule({
+      providers: [MemoryStore],
+    }).compile();
+
+    service = module.get<MemoryStore>(MemoryStore);
+  });
+
+  it('should be defined', () => {
+    expect(service).toBeDefined();
+  });
+
+  describe('generateClientId', () => {
+    it('should generate consistent client IDs for identical objects', () => {
+      const client1: Partial<OAuthClient> = {
+        client_name: 'MCP Inspector',
+        client_uri: 'https://github.com/modelcontextprotocol/inspector',
+        redirect_uris: ['http://localhost:6274/oauth/callback'],
+        token_endpoint_auth_method: 'none',
+        grant_types: ['authorization_code', 'refresh_token'],
+        response_types: ['code'],
+      };
+
+      const client2: Partial<OAuthClient> = {
+        client_name: 'MCP Inspector',
+        client_uri: 'https://github.com/modelcontextprotocol/inspector',
+        redirect_uris: ['http://localhost:6274/oauth/callback'],
+        token_endpoint_auth_method: 'none',
+        grant_types: ['authorization_code', 'refresh_token'],
+        response_types: ['code'],
+      };
+
+      const id1 = service.generateClientId(client1 as OAuthClient);
+      const id2 = service.generateClientId(client2 as OAuthClient);
+
+      expect(id1).toBe(id2);
+    });
+
+    it('should generate consistent client IDs regardless of property order', () => {
+      // First object with properties in one order
+      const clientJson1 = `{
+        "client_name": "MCP Inspector",
+        "client_uri": "https://github.com/modelcontextprotocol/inspector",
+        "redirect_uris": ["http://localhost:6274/oauth/callback"],
+        "token_endpoint_auth_method": "none",
+        "grant_types": ["authorization_code", "refresh_token"],
+        "response_types": ["code"]
+      }`;
+
+      // Second object with properties in different order
+      const clientJson2 = `{
+        "response_types": ["code"],
+        "grant_types": ["authorization_code", "refresh_token"],
+        "token_endpoint_auth_method": "none",
+        "redirect_uris": ["http://localhost:6274/oauth/callback"],
+        "client_uri": "https://github.com/modelcontextprotocol/inspector",
+        "client_name": "MCP Inspector"
+      }`;
+
+      const client1 = JSON.parse(clientJson1) as OAuthClient;
+      const client2 = JSON.parse(clientJson2) as OAuthClient;
+
+      const id1 = service.generateClientId(client1);
+      const id2 = service.generateClientId(client2);
+
+      expect(id1).toBe(id2);
+    });
+
+    it('should generate consistent client IDs regardless of array order', () => {
+      // First object with arrays in one order
+      const clientJson1 = `{
+        "client_name": "MCP Inspector",
+        "client_uri": "https://github.com/modelcontextprotocol/inspector",
+        "redirect_uris": [
+          "http://localhost:6274/oauth/callback",
+          "http://localhost:8080/callback",
+          "http://127.0.0.1:3000/auth"
+        ],
+        "token_endpoint_auth_method": "none",
+        "grant_types": [
+          "authorization_code",
+          "refresh_token",
+          "client_credentials"
+        ],
+        "response_types": ["code", "token"]
+      }`;
+
+      // Second object with arrays in different order
+      const clientJson2 = `{
+        "client_name": "MCP Inspector",
+        "client_uri": "https://github.com/modelcontextprotocol/inspector",
+        "redirect_uris": [
+          "http://127.0.0.1:3000/auth",
+          "http://localhost:6274/oauth/callback",
+          "http://localhost:8080/callback"
+        ],
+        "token_endpoint_auth_method": "none",
+        "grant_types": ["client_credentials", "authorization_code", "refresh_token"],
+        "response_types": ["token", "code"]
+      }`;
+
+      const client1 = JSON.parse(clientJson1) as OAuthClient;
+      const client2 = JSON.parse(clientJson2) as OAuthClient;
+
+      const id1 = service.generateClientId(client1);
+      const id2 = service.generateClientId(client2);
+
+      expect(id1).toBe(id2);
+    });
+
+    it('should generate consistent client IDs regardless of both property and array order', () => {
+      // First object with mixed ordering
+      const clientJson1 = `{
+        "grant_types": ["refresh_token", "authorization_code"],
+        "client_name": "MCP Inspector",
+        "response_types": ["code"],
+        "redirect_uris": [
+          "http://localhost:8080/callback",
+          "http://localhost:6274/oauth/callback"
+        ],
+        "token_endpoint_auth_method": "none",
+        "client_uri": "https://github.com/modelcontextprotocol/inspector"
+      }`;
+
+      // Second object with different mixed ordering
+      const clientJson2 = `{
+        "client_uri": "https://github.com/modelcontextprotocol/inspector",
+        "token_endpoint_auth_method": "none",
+        "redirect_uris": [
+          "http://localhost:6274/oauth/callback",
+          "http://localhost:8080/callback"
+        ],
+        "response_types": ["code"],
+        "client_name": "MCP Inspector",
+        "grant_types": ["authorization_code", "refresh_token"]
+      }`;
+
+      const client1 = JSON.parse(clientJson1) as OAuthClient;
+      const client2 = JSON.parse(clientJson2) as OAuthClient;
+
+      const id1 = service.generateClientId(client1);
+      const id2 = service.generateClientId(client2);
+
+      expect(id1).toBe(id2);
+    });
+
+    it('should generate different client IDs for different objects', () => {
+      const client1: Partial<OAuthClient> = {
+        client_name: 'MCP Inspector',
+        client_uri: 'https://github.com/modelcontextprotocol/inspector',
+        redirect_uris: ['http://localhost:6274/oauth/callback'],
+        token_endpoint_auth_method: 'none',
+        grant_types: ['authorization_code', 'refresh_token'],
+        response_types: ['code'],
+      };
+
+      const client2: Partial<OAuthClient> = {
+        client_name: 'Different App', // Changed client name
+        client_uri: 'https://github.com/modelcontextprotocol/inspector',
+        redirect_uris: ['http://localhost:6274/oauth/callback'],
+        token_endpoint_auth_method: 'none',
+        grant_types: ['authorization_code', 'refresh_token'],
+        response_types: ['code'],
+      };
+
+      const id1 = service.generateClientId(client1 as OAuthClient);
+      const id2 = service.generateClientId(client2 as OAuthClient);
+
+      expect(id1).not.toBe(id2);
+    });
+
+    it('should generate different client IDs when array contents differ', () => {
+      const client1: Partial<OAuthClient> = {
+        client_name: 'MCP Inspector',
+        client_uri: 'https://github.com/modelcontextprotocol/inspector',
+        redirect_uris: ['http://localhost:6274/oauth/callback'],
+        token_endpoint_auth_method: 'none',
+        grant_types: ['authorization_code', 'refresh_token'],
+        response_types: ['code'],
+      };
+
+      const client2: Partial<OAuthClient> = {
+        client_name: 'MCP Inspector',
+        client_uri: 'https://github.com/modelcontextprotocol/inspector',
+        redirect_uris: ['http://localhost:6274/oauth/callback'],
+        token_endpoint_auth_method: 'none',
+        grant_types: ['authorization_code'], // Removed 'refresh_token'
+        response_types: ['code'],
+      };
+
+      const id1 = service.generateClientId(client1 as OAuthClient);
+      const id2 = service.generateClientId(client2 as OAuthClient);
+
+      expect(id1).not.toBe(id2);
+    });
+
+    it('should include normalized client name in the generated ID', () => {
+      const client: Partial<OAuthClient> = {
+        client_name: 'MCP Inspector!@#', // Special characters
+        client_uri: 'https://github.com/modelcontextprotocol/inspector',
+        redirect_uris: ['http://localhost:6274/oauth/callback'],
+        token_endpoint_auth_method: 'none',
+        grant_types: ['authorization_code', 'refresh_token'],
+        response_types: ['code'],
+      };
+
+      const clientId = service.generateClientId(client as OAuthClient);
+
+      // Should start with normalized name (lowercase, alphanumeric only)
+      expect(clientId).toMatch(/^mcpinspector_[a-f0-9]{16}$/);
+    });
+
+    it('should generate IDs with consistent format', () => {
+      const client: Partial<OAuthClient> = {
+        client_name: 'Test App',
+        client_uri: 'https://example.com',
+        redirect_uris: ['http://localhost:3000/callback'],
+        token_endpoint_auth_method: 'none',
+        grant_types: ['authorization_code'],
+        response_types: ['code'],
+      };
+
+      const clientId = service.generateClientId(client as OAuthClient);
+
+      // Should match pattern: normalizedname_16hexchars
+      expect(clientId).toMatch(/^[a-z0-9]+_[a-f0-9]{16}$/);
+
+      // Should be consistent across multiple calls
+      const clientId2 = service.generateClientId(client as OAuthClient);
+      expect(clientId).toBe(clientId2);
+    });
+  });
+});

package/src/authz/stores/memory-store.service.ts

@@ -0,0 +1,100 @@
+import { Injectable } from '@nestjs/common';
+import { createHash } from 'crypto';
+import { OAuthSession } from '../providers/oauth-provider.interface';
+import {
+  AuthorizationCode,
+  IOAuthStore,
+  OAuthClient,
+} from './oauth-store.interface';
+
+// In-memory storage (in production, use a database)
+@Injectable()
+export class MemoryStore implements IOAuthStore {
+  private clients = new Map<string, OAuthClient>();
+  private authCodes = new Map<string, AuthorizationCode>();
+  private oauthSessions = new Map<string, OAuthSession>();
+
+  async storeClient(client: OAuthClient): Promise<OAuthClient> {
+    this.clients.set(client.client_id, client);
+    return client;
+  }
+
+  async getClient(client_id: string): Promise<OAuthClient | undefined> {
+    return this.clients.get(client_id);
+  }
+
+  async findClient(client_name: string): Promise<OAuthClient | undefined> {
+    for (const client of this.clients.values()) {
+      if (client.client_name === client_name) {
+        return client;
+      }
+    }
+    return undefined;
+  }
+
+  async storeAuthCode(code: AuthorizationCode): Promise<void> {
+    this.authCodes.set(code.code, code);
+  }
+
+  async getAuthCode(code: string): Promise<AuthorizationCode | undefined> {
+    return this.authCodes.get(code);
+  }
+
+  async removeAuthCode(code: string): Promise<void> {
+    this.authCodes.delete(code);
+  }
+
+  // New OAuth session methods for provider-agnostic flow
+  async storeOAuthSession(
+    sessionId: string,
+    session: OAuthSession,
+  ): Promise<void> {
+    this.oauthSessions.set(sessionId, session);
+  }
+
+  async getOAuthSession(sessionId: string): Promise<OAuthSession | undefined> {
+    const session = this.oauthSessions.get(sessionId);
+    if (session && session.expiresAt < Date.now()) {
+      this.oauthSessions.delete(sessionId);
+      return undefined;
+    }
+    return session;
+  }
+
+  async removeOAuthSession(sessionId: string): Promise<void> {
+    this.oauthSessions.delete(sessionId);
+  }
+
+  generateClientId(client: OAuthClient): string {
+    // Create deterministic client ID based on entire client object
+    const normalizedClient = this.normalizeClientObject(client);
+    const clientString = JSON.stringify(normalizedClient);
+    const hash = createHash('sha256').update(clientString).digest('hex');
+
+    // Use first 16 characters of hash with client name prefix for readability
+    const normalizedName = client.client_name
+      .toLowerCase()
+      .replace(/[^a-z0-9]/g, '');
+    return `${normalizedName}_${hash.substring(0, 16)}`;
+  }
+
+  private normalizeClientObject(client: OAuthClient): any {
+    // Create a normalized version of the client object for consistent hashing
+    const normalized: any = {};
+
+    // Sort object keys to ensure consistent ordering
+    const sortedKeys = Object.keys(client).sort();
+
+    for (const key of sortedKeys) {
+      const value = (client as any)[key];
+      if (Array.isArray(value)) {
+        // Sort arrays to ensure consistent ordering
+        normalized[key] = [...value].sort();
+      } else {
+        normalized[key] = value;
+      }
+    }
+
+    return normalized;
+  }
+}

package/src/authz/stores/oauth-store.interface.ts

@@ -0,0 +1,105 @@
+import { OAuthSession } from '../providers/oauth-provider.interface';
+
+export interface OAuthClient {
+  client_id: string;
+  client_name: string;
+  client_description?: string;
+  logo_uri?: string;
+  client_uri?: string;
+  developer_name?: string;
+  developer_email?: string;
+  redirect_uris: string[];
+  grant_types: string[];
+  response_types: string[];
+  token_endpoint_auth_method: string;
+  created_at: Date;
+  updated_at: Date;
+}
+
+export interface AuthorizationCode {
+  code: string;
+  user_id: string;
+  client_id: string;
+  redirect_uri: string;
+  code_challenge: string;
+  code_challenge_method: string;
+  expires_at: number;
+  used_at?: Date;
+  github_access_token: string;
+}
+
+export interface ClientRegistrationDto {
+  client_name: string;
+  client_description?: string;
+  logo_uri?: string;
+  client_uri?: string;
+  developer_name?: string;
+  developer_email?: string;
+  redirect_uris: string[];
+  grant_types?: string[];
+  response_types?: string[];
+  token_endpoint_auth_method?: string;
+}
+
+/**
+ * Interface for OAuth store implementations.
+ *
+ * Implement this interface to create custom storage solutions (e.g., Redis, Database, etc.).
+ * The default implementation is an in-memory store suitable for development.
+ *
+ * @example
+ * ```typescript
+ * class RedisOAuthStore implements IOAuthStore {
+ *   constructor(private redisClient: RedisClient) {}
+ *
+ *   async storeClient(client: OAuthClient): Promise<void> {
+ *     await this.redisClient.set(`client:${client.client_id}`, JSON.stringify(client));
+ *   }
+ *
+ *   async getClient(client_id: string): Promise<OAuthClient | undefined> {
+ *     const data = await this.redisClient.get(`client:${client_id}`);
+ *     return data ? JSON.parse(data) : undefined;
+ *   }
+ *
+ *   async findClient(client_name: string): Promise<OAuthClient | undefined> {
+ *     const data = await this.redisClient.get(`client_name:${client_name}`);
+ *     return data ? JSON.parse(data) : undefined;
+ *   }
+ *
+ *   generateClientId(client: OAuthClient): string {
+ *     // Custom client ID generation logic
+ *     const normalizedName = client.client_name.toLowerCase().replace(/[^a-z0-9]/g, '');
+ *     const timestamp = Date.now().toString(36);
+ *     return `${normalizedName}_${timestamp}`;
+ *   }
+ *
+ *   // ... implement other methods
+ * }
+ *
+ * // Usage in module:
+ * McpOAuthModule.forRoot({
+ *   provider: GoogleOAuthProvider,
+ *   clientId: process.env.GOOGLE_CLIENT_ID!,
+ *   clientSecret: process.env.GOOGLE_CLIENT_SECRET!,
+ *   jwtSecret: process.env.JWT_SECRET!,
+ *   memoryStore: new RedisOAuthStore(redisClient), // Custom implementation
+ * })
+ * ```
+ */
+export interface IOAuthStore {
+  // Client management
+  storeClient(client: OAuthClient): Promise<OAuthClient>;
+  getClient(client_id: string): Promise<OAuthClient | undefined>;
+  findClient(client_name: string): Promise<OAuthClient | undefined>;
+  generateClientId(client: OAuthClient): string;
+
+  // Authorization code management
+  storeAuthCode(code: AuthorizationCode): Promise<void>;
+  getAuthCode(code: string): Promise<AuthorizationCode | undefined>;
+  removeAuthCode(code: string): Promise<void>;
+
+  // OAuth session management
+  storeOAuthSession(sessionId: string, session: OAuthSession): Promise<void>;
+  getOAuthSession(sessionId: string): Promise<OAuthSession | undefined>;
+  removeOAuthSession(sessionId: string): Promise<void>;
+}