@remit/mcp-server 0.0.0-stage → 0.1.1

package/dist/app-entry.d.ts

@@ -0,0 +1,10 @@
+export { createMcpApp, type McpAppConfig } from "./app.js";
+export { AUTH_BASE_PATH, CONNECTED_APPS_API_PATH, CONNECTED_APPS_PATH, CONSENT_PATH, createBetterAuthTokenVerifier, createMcpAuth, DEVICE_APPROVE_PATH, DEVICE_CODE_PATH, DEVICE_DENY_PATH, DEVICE_PATH, JWKS_PATH, LOGIN_PATH, MCP_PATH, type McpAuth, type McpAuthConfig, type McpAuthRoutes, type McpAuthServer, type McpBrowserAuth, type McpBrowserRoutes, type McpIdentity, type McpSessionState, type McpSignInResult, type McpSubject, mcpResource, OAUTH2_PATH_PREFIX, REVOKE_CLIENT_API_PATH, SIGN_IN_PATH, type SignIn, } from "./auth/authorization-server.js";
+export { describeScopes, MCP_READ_SCOPE, MCP_RULES_SCOPE, MCP_SCOPES, OFFLINE_ACCESS_SCOPE, } from "./auth/scopes.js";
+export type { TokenVerification, TokenVerifier, } from "./auth/token-verifier.js";
+export { claudeMcpAddCommand, type DeviceLoginIo, type DeviceLoginResult, deviceLogin, } from "./cli/device-login.js";
+export { type FilterToolDeps, type FolderToolDeps, type McpDeps, type McpDepsExtras, mcpDepsOf, } from "./deps.js";
+export { STYLESHEET_PATH } from "./pages/assets.js";
+export { errorPage, pageError, renderPage } from "./pages/render.js";
+export { type ConnectedAppGrant, connectedAppsView, consentView, deviceView, loginView, } from "./pages/views.js";
+export { createMcpHandler, type McpPrincipal, type McpRequestHandler, } from "./server.js";

package/dist/app-entry.js

@@ -0,0 +1,9 @@
+export { createMcpApp } from "./app.js";
+export { AUTH_BASE_PATH, CONNECTED_APPS_API_PATH, CONNECTED_APPS_PATH, CONSENT_PATH, createBetterAuthTokenVerifier, createMcpAuth, DEVICE_APPROVE_PATH, DEVICE_CODE_PATH, DEVICE_DENY_PATH, DEVICE_PATH, JWKS_PATH, LOGIN_PATH, MCP_PATH, mcpResource, OAUTH2_PATH_PREFIX, REVOKE_CLIENT_API_PATH, SIGN_IN_PATH, } from "./auth/authorization-server.js";
+export { describeScopes, MCP_READ_SCOPE, MCP_RULES_SCOPE, MCP_SCOPES, OFFLINE_ACCESS_SCOPE, } from "./auth/scopes.js";
+export { claudeMcpAddCommand, deviceLogin, } from "./cli/device-login.js";
+export { mcpDepsOf, } from "./deps.js";
+export { STYLESHEET_PATH } from "./pages/assets.js";
+export { errorPage, pageError, renderPage } from "./pages/render.js";
+export { connectedAppsView, consentView, deviceView, loginView, } from "./pages/views.js";
+export { createMcpHandler, } from "./server.js";

package/dist/app.d.ts

@@ -0,0 +1,11 @@
+import { type McpAuthRoutes } from "./auth/authorization-server.js";
+import type { TokenVerifier } from "./auth/token-verifier.js";
+import type { McpDeps } from "./deps.js";
+import { type McpRequestHandler } from "./server.js";
+export interface McpAppConfig {
+    origin: string;
+    authRoutes: McpAuthRoutes;
+    verifier: TokenVerifier;
+    deps: McpDeps;
+}
+export declare const createMcpApp: ({ origin, authRoutes, verifier, deps, }: McpAppConfig) => McpRequestHandler;

package/dist/app.js

@@ -0,0 +1,261 @@
+import { extractBearerToken } from "@remit/auth-service/verifier";
+import { z } from "zod";
+import { CONNECTED_APPS_PATH, CONSENT_PATH, DEVICE_PATH, LOGIN_PATH, MCP_PATH, mcpResource, } from "./auth/authorization-server.js";
+import { MCP_SCOPES } from "./auth/scopes.js";
+import { errorPage, pageError } from "./pages/render.js";
+import { connectedAppsView, consentView, deviceView, loginView, } from "./pages/views.js";
+import { createMcpHandler } from "./server.js";
+const PROTECTED_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource";
+const RETURN_PATHS = new Set([
+    DEVICE_PATH,
+    CONNECTED_APPS_PATH,
+]);
+const connectedAppsSchema = z.object({
+    apps: z.array(z.object({
+        clientId: z.string(),
+        clientName: z.string(),
+        scopes: z.array(z.string()),
+        connectedAt: z.coerce.date(),
+    })),
+});
+const redirectSchema = z.object({ url: z.string() });
+const failureSchema = z.object({
+    message: z.string().optional(),
+    error_description: z.string().optional(),
+});
+const failureOf = async (response) => {
+    const failure = failureSchema.parse(await response.json());
+    return (failure.error_description ??
+        failure.message ??
+        `The request failed with status ${response.status}.`);
+};
+const formString = (form, name) => {
+    const value = form.get(name);
+    return typeof value === "string" ? value : "";
+};
+const redirectWithCookies = (location, from) => {
+    const headers = new Headers({ location, "cache-control": "no-store" });
+    for (const cookie of from.headers.getSetCookie()) {
+        headers.append("set-cookie", cookie);
+    }
+    return new Response(null, { status: 302, headers });
+};
+export const createMcpApp = ({ origin, authRoutes, verifier, deps, }) => {
+    const resource = mcpResource(origin);
+    const resourceMetadataPath = `${PROTECTED_RESOURCE_METADATA_PATH}${MCP_PATH}`;
+    const challenge = (error) => new Response(JSON.stringify({ error: error ?? "unauthorized", resource }), {
+        status: 401,
+        headers: {
+            "content-type": "application/json",
+            "www-authenticate": [
+                "Bearer",
+                ` resource_metadata="${origin}${resourceMetadataPath}",`,
+                ` scope="${MCP_SCOPES.join(" ")}"`,
+                error ? `, error="${error}"` : "",
+            ].join(""),
+        },
+    });
+    const continueFrom = async (response) => {
+        if (!response.ok) {
+            return errorPage("Connecting failed", await failureOf(response), "Go back to your MCP client and connect remit again.", response.status);
+        }
+        const { url } = redirectSchema.parse(await response.json());
+        return redirectWithCookies(url, response);
+    };
+    const disabledPage = () => errorPage("Access refused", "This account is disabled.", "Ask the person who runs this remit server to restore your account.", 403);
+    const toLogin = (returnTo) => {
+        if (authRoutes.browser.kind === "host") {
+            return errorPage("Not signed in", "This server could not tell who you are.", "Sign in to remit, then open this page again.", 401);
+        }
+        return new Response(null, {
+            status: 302,
+            headers: {
+                location: `${LOGIN_PATH}?${new URLSearchParams({ return_to: returnTo })}`,
+                "cache-control": "no-store",
+            },
+        });
+    };
+    const returnToOf = (raw) => {
+        if (!raw.startsWith("/") || raw.startsWith("//"))
+            return CONNECTED_APPS_PATH;
+        const url = new URL(raw, origin);
+        if (url.origin !== origin || !RETURN_PATHS.has(url.pathname)) {
+            return CONNECTED_APPS_PATH;
+        }
+        return `${url.pathname}${url.search}`;
+    };
+    const login = async (request, signIn) => {
+        if (request.method === "GET") {
+            const url = new URL(request.url);
+            if (url.search === "" || url.searchParams.has("return_to")) {
+                return loginView({
+                    return_to: returnToOf(url.searchParams.get("return_to") ?? ""),
+                });
+            }
+            return loginView({ oauth_query: url.search.slice(1) });
+        }
+        const form = await request.formData();
+        const oauthQuery = formString(form, "oauth_query");
+        const returnTo = returnToOf(formString(form, "return_to"));
+        const hiddenFields = oauthQuery
+            ? { oauth_query: oauthQuery }
+            : { return_to: returnTo };
+        const email = formString(form, "email");
+        const response = await signIn(request.headers, {
+            email,
+            password: formString(form, "password"),
+            oauth_query: oauthQuery,
+        });
+        if (response.status === 401) {
+            return loginView(hiddenFields, 401, email, pageError("Wrong email or password.", "Check both and try again. It is the password you sign in to remit with."));
+        }
+        if (response.status === 429) {
+            return loginView(hiddenFields, 429, email, pageError("Too many sign-in attempts.", "Wait a minute, then try again."));
+        }
+        if (!oauthQuery && response.ok) {
+            await response.body?.cancel();
+            return redirectWithCookies(returnTo, response);
+        }
+        return continueFrom(response);
+    };
+    const consent = async (request) => {
+        if (request.method === "GET") {
+            const url = new URL(request.url);
+            const clientId = url.searchParams.get("client_id") ?? "";
+            const scopes = (url.searchParams.get("scope") ?? "")
+                .split(" ")
+                .filter((scope) => scope.length > 0);
+            if ((await authRoutes.sessionOf(request.headers)) === "disabled") {
+                return disabledPage();
+            }
+            const clientName = await authRoutes.clientName(request.headers, clientId);
+            if (!clientName) {
+                return errorPage("Connecting failed", "This sign-in request names an app remit does not know.", "Go back to your MCP client and connect remit again.", 400);
+            }
+            return consentView(url.search.slice(1), clientName, scopes);
+        }
+        const form = await request.formData();
+        return continueFrom(await authRoutes.consent(request.headers, {
+            accept: formString(form, "accept") === "true",
+            oauth_query: formString(form, "oauth_query"),
+        }));
+    };
+    const invalidCode = (userCode) => deviceView({
+        kind: "enter",
+        userCode,
+        error: pageError("That code is not valid or has expired.", "Run remit mcp login again and enter the new code."),
+    }, 400);
+    const device = async (request) => {
+        const url = new URL(request.url);
+        const session = await authRoutes.sessionOf(request.headers);
+        if (session === "disabled")
+            return disabledPage();
+        if (session === "absent") {
+            return toLogin(`${url.pathname}${url.search}`);
+        }
+        if (request.method === "GET") {
+            const userCode = (url.searchParams.get("user_code") ?? "").trim();
+            if (!userCode)
+                return deviceView({ kind: "enter", userCode: "" });
+            if (!(await authRoutes.claimDeviceCode(request.headers, userCode))) {
+                return invalidCode(userCode);
+            }
+            return deviceView({ kind: "confirm", userCode });
+        }
+        const form = await request.formData();
+        const userCode = formString(form, "user_code");
+        const approve = formString(form, "action") === "approve";
+        if (!(await authRoutes.claimDeviceCode(request.headers, userCode))) {
+            return invalidCode(userCode);
+        }
+        const response = await authRoutes.decideDeviceCode(request.headers, userCode, approve);
+        if (response.status === 401) {
+            return toLogin(`${DEVICE_PATH}?${new URLSearchParams({ user_code: userCode })}`);
+        }
+        if (!response.ok) {
+            return deviceView({
+                kind: "enter",
+                userCode,
+                error: pageError(await failureOf(response), "Run remit mcp login again and enter the new code."),
+            }, response.status);
+        }
+        await response.body?.cancel();
+        return deviceView({ kind: approve ? "approved" : "denied" });
+    };
+    const listConnectedApps = async (request) => {
+        const response = await authRoutes.connectedApps(request.headers);
+        if (response.status === 401) {
+            await response.body?.cancel();
+            return toLogin(CONNECTED_APPS_PATH);
+        }
+        if (response.status === 403) {
+            await response.body?.cancel();
+            return disabledPage();
+        }
+        if (!response.ok) {
+            throw new Error(`Listing connected apps failed with ${response.status}: ${await response.text()}`);
+        }
+        return connectedAppsSchema.parse(await response.json()).apps;
+    };
+    const connectedApps = async (request) => {
+        if (request.method === "GET") {
+            const apps = await listConnectedApps(request);
+            if (apps instanceof Response)
+                return apps;
+            return connectedAppsView(apps);
+        }
+        const form = await request.formData();
+        const clientId = formString(form, "client_id");
+        const before = await listConnectedApps(request);
+        if (before instanceof Response)
+            return before;
+        const name = before.find((app) => app.clientId === clientId)?.clientName ?? clientId;
+        const response = await authRoutes.revokeClient(request.headers, clientId);
+        if (response.status === 401)
+            return toLogin(CONNECTED_APPS_PATH);
+        if (!response.ok) {
+            return connectedAppsView(before, response.status, undefined, pageError(`Disconnecting ${name} failed: ${await failureOf(response)}`, "Reload the page and try again."));
+        }
+        await response.body?.cancel();
+        const after = await listConnectedApps(request);
+        if (after instanceof Response)
+            return after;
+        return connectedAppsView(after, 200, name);
+    };
+    const serveMcp = async (request) => {
+        const bearer = extractBearerToken(request.headers.get("authorization") ?? undefined);
+        if (!bearer)
+            return challenge();
+        const verification = await verifier.verify(bearer);
+        if (!verification.ok)
+            return challenge("invalid_token");
+        return createMcpHandler(verification.principal, deps)(request);
+    };
+    return async (request) => {
+        const { pathname } = new URL(request.url);
+        if (pathname === "/.well-known/oauth-authorization-server") {
+            return authRoutes.serverMetadata(request);
+        }
+        if (pathname === resourceMetadataPath ||
+            pathname === PROTECTED_RESOURCE_METADATA_PATH) {
+            return Response.json({
+                resource,
+                authorization_servers: [origin],
+                scopes_supported: [...MCP_SCOPES],
+                bearer_methods_supported: ["header"],
+            });
+        }
+        if (pathname === MCP_PATH)
+            return serveMcp(request);
+        if (pathname === LOGIN_PATH && authRoutes.browser.kind === "signIn") {
+            return login(request, authRoutes.browser.signIn);
+        }
+        if (pathname === CONSENT_PATH)
+            return consent(request);
+        if (pathname === DEVICE_PATH)
+            return device(request);
+        if (pathname === CONNECTED_APPS_PATH)
+            return connectedApps(request);
+        return authRoutes.handle(request);
+    };
+};