@sargonpiraev/hh-mcp-server 1.15.0 → 1.17.0

package/build/main.js

@@ -4,9 +4,11 @@ import cors from 'cors';
 import crypto from 'crypto';
 import { z } from 'zod';
 import { mcpServer, envSchema as baseEnvSchema } from './server.js';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { isInitializeRequest } from '@modelcontextprotocol/sdk/types.js';
 const envSchema = baseEnvSchema.extend({
     PORT: z.string().optional().default('3000'),
-    HOST: z.string().optional().default('127.0.0.1'),
+    HOST: z.string().optional().default('localhost'),
     HH_CLIENT_ID: z.string(),
     HH_CLIENT_SECRET: z.string(),
     HH_USER_AGENT: z.string(),
@@ -15,8 +17,12 @@ const envSchema = baseEnvSchema.extend({
 const env = envSchema.parse(process.env);
 const app = express();
 const sessions = new Map();
-// Enable CORS for all routes
-app.use(cors());
+const transports = {};
+// Enable CORS for all routes and expose MCP session header
+app.use(cors({
+    origin: '*', // Allow all origins
+    exposedHeaders: ['Mcp-Session-Id'],
+}));
 app.use(express.json({ limit: '10mb' }));
 const logger = {
     log: (...message) => {
@@ -43,19 +49,19 @@ app.get('/.well-known/oauth-protected-resource', (req, res) => {
 });
 // OAuth 2.0 Authorization Server Metadata endpoint - HeadHunter doesn't provide this, so we create it
 app.get('/.well-known/oauth-authorization-server', (req, res) => {
+    const baseUrl = `http://${env.HOST}:${env.PORT}`;
     res.json({
-        issuer: 'https://api.hh.ru',
-        authorization_endpoint: 'https://hh.ru/oauth/authorize',
-        token_endpoint: 'https://api.hh.ru/token',
-        registration_endpoint: `${req.protocol}://${req.get('host')}/oauth/register`,
-        jwks_uri: `${req.protocol}://${req.get('host')}/.well-known/jwks.json`,
+        issuer: baseUrl, // This MCP server IS the authorization server now
+        authorization_endpoint: `${baseUrl}/oauth/authorize`, // Our facade endpoint
+        token_endpoint: `${baseUrl}/oauth/token`, // Our facade endpoint
+        registration_endpoint: `${baseUrl}/oauth/register`,
+        jwks_uri: `${baseUrl}/.well-known/jwks.json`,
         response_types_supported: ['code'],
         grant_types_supported: ['authorization_code', 'refresh_token'],
         token_endpoint_auth_methods_supported: ['client_secret_post', 'client_secret_basic'],
         code_challenge_methods_supported: ['S256'],
         scopes_supported: [],
-        // Note: This endpoint simulates DCR for Inspector compatibility
-        // Real HeadHunter OAuth happens via pre-registered clients at dev.hh.ru
+        // This is now a real OAuth Authorization Server, not just metadata
     });
 });
 // JWKS endpoint - HeadHunter doesn't provide this, return empty keys for now
@@ -91,16 +97,16 @@ app.post('/oauth/register', (req, res) => {
         // Return pre-configured OAuth client credentials
         // This simulates DCR but actually uses static credentials
         const client_id = env.HH_CLIENT_ID;
-        logger.log(`DCR simulation: Returning HeadHunter client credentials for "${client_name}"`);
-        // Return successful registration response with HeadHunter client_id
+        logger.log(`DCR facade: Accepting any redirect_uri for "${client_name}"`);
+        // Return successful registration response - now we accept ANY redirect_uri
         res.json({
             client_id,
             client_name,
             grant_types,
             response_types,
-            redirect_uris, // Use the redirect_uris from the request
+            redirect_uris, // Accept client's redirect_uris as-is (facade supports any URI)
             scope,
-            token_endpoint_auth_method: 'client_secret_basic', // HeadHunter uses client_secret
+            token_endpoint_auth_method: 'client_secret_basic',
             client_id_issued_at: Math.floor(Date.now() / 1000),
         });
     }
@@ -120,16 +126,142 @@ app.get('/.well-known/oauth-client-config', (req, res) => {
             error_description: 'OAuth client ID not configured. Set HH_CLIENT_ID environment variable.',
         });
     }
+    const baseUrl = `http://${env.HOST}:${env.PORT}`;
     res.json({
         client_id: env.HH_CLIENT_ID,
-        authorization_endpoint: 'https://hh.ru/oauth/authorize',
-        token_endpoint: 'https://api.hh.ru/token',
+        authorization_endpoint: `${baseUrl}/oauth/authorize`, // Our facade endpoint
+        token_endpoint: `${baseUrl}/oauth/token`, // Our facade endpoint
         scope: '', // OAuth server doesn't use explicit scopes
         response_type: 'code',
         redirect_uri: env.HH_REDIRECT_URI || 'http://localhost:6274/oauth/callback/debug', // Configurable redirect URI
         code_challenge_method: 'S256', // PKCE for security
     });
 });
+// Facade OAuth Authorization endpoint - accepts any redirect_uri and delegates to HeadHunter
+app.get('/oauth/authorize', (req, res) => {
+    const { client_id, redirect_uri, state, code_challenge, code_challenge_method = 'S256' } = req.query;
+    // Validate required parameters
+    if (!client_id || !redirect_uri) {
+        return res.status(400).json({
+            error: 'invalid_request',
+            error_description: 'client_id and redirect_uri are required',
+        });
+    }
+    // Store original request parameters for later use in callback
+    const stateKey = `auth_${crypto.randomUUID()}`;
+    sessions.set(stateKey, {
+        originalRedirectUri: redirect_uri,
+        originalState: state,
+        clientId: client_id,
+        codeChallenge: code_challenge,
+        codeChallengeMethod: code_challenge_method,
+        createdAt: new Date(),
+    });
+    // Construct HeadHunter authorization URL with our callback
+    const hhAuthUrl = new URL('https://hh.ru/oauth/authorize');
+    hhAuthUrl.searchParams.set('client_id', env.HH_CLIENT_ID || '');
+    hhAuthUrl.searchParams.set('response_type', 'code');
+    hhAuthUrl.searchParams.set('redirect_uri', env.HH_REDIRECT_URI || `http://${env.HOST}:${env.PORT}/oauth/callback/debug`);
+    hhAuthUrl.searchParams.set('state', stateKey); // Use our state key
+    logger.log(`Facade authorize: Redirecting to HeadHunter with state=${stateKey}`);
+    // Redirect user to HeadHunter authorization
+    res.redirect(hhAuthUrl.toString());
+});
+// Facade OAuth Token endpoint - exchanges authorization code for access token
+app.post('/oauth/token', express.urlencoded({ extended: true }), async (req, res) => {
+    const { grant_type, client_id, code, redirect_uri, code_verifier } = req.body;
+    // Validate required parameters
+    if (grant_type !== 'authorization_code' || !client_id || !code || !redirect_uri) {
+        return res.status(400).json({
+            error: 'invalid_request',
+            error_description: 'Invalid token request parameters',
+        });
+    }
+    try {
+        // Use the configured redirect_uri instead of the client's redirect_uri
+        const configuredRedirectUri = env.HH_REDIRECT_URI || `http://${env.HOST}:${env.PORT}/oauth/callback/debug`;
+        // Prepare token request for HeadHunter
+        const tokenParams = new URLSearchParams({
+            grant_type: 'authorization_code',
+            client_id: env.HH_CLIENT_ID || '',
+            client_secret: env.HH_CLIENT_SECRET || '',
+            code: code,
+            redirect_uri: configuredRedirectUri, // Use our configured redirect_uri, not client's
+        });
+        // Add PKCE code_verifier if provided by client
+        if (code_verifier) {
+            tokenParams.set('code_verifier', code_verifier);
+        }
+        logger.log(`Facade token: Exchanging code with HeadHunter, redirect_uri=${configuredRedirectUri}`);
+        // Exchange code with HeadHunter token endpoint
+        const tokenResponse = await fetch('https://api.hh.ru/token', {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+                'User-Agent': 'MCP-Facade-Server/1.0',
+            },
+            body: tokenParams,
+        });
+        if (!tokenResponse.ok) {
+            const errorText = await tokenResponse.text();
+            logger.error(`HeadHunter token exchange failed: ${tokenResponse.status} ${errorText}`);
+            return res.status(400).json({
+                error: 'invalid_grant',
+                error_description: 'Authorization code is invalid or expired',
+            });
+        }
+        const tokenData = (await tokenResponse.json());
+        logger.log(`Facade token: Successfully exchanged code for HeadHunter access token`);
+        // Return the token response from HeadHunter (with our issuer)
+        res.json({
+            ...tokenData,
+            issuer: `http://${env.HOST}:${env.PORT}`, // Override issuer to point to our facade
+        });
+    }
+    catch (error) {
+        logger.error('Token exchange error:', error instanceof Error ? error.message : String(error));
+        res.status(500).json({
+            error: 'server_error',
+            error_description: 'Internal server error during token exchange',
+        });
+    }
+});
+// Enhanced proxy callback endpoint for facade authorization flow
+app.get('/oauth/callback/debug', (req, res) => {
+    const { code, state, error, error_description } = req.query;
+    if (error) {
+        logger.error(`HeadHunter authorization error: ${error} - ${error_description}`);
+        return res.status(400).json({
+            error: error,
+            error_description: error_description,
+        });
+    }
+    if (!code || !state) {
+        return res.status(400).json({
+            error: 'invalid_request',
+            error_description: 'Missing authorization code or state parameter',
+        });
+    }
+    // Retrieve stored authorization request
+    const authSession = sessions.get(state);
+    if (!authSession) {
+        logger.error(`No session found for state: ${state}`);
+        return res.status(400).json({
+            error: 'invalid_state',
+            error_description: 'Invalid or expired authorization request',
+        });
+    }
+    // Clean up session
+    sessions.delete(state);
+    // Redirect back to original client with authorization code
+    const callbackUrl = new URL(authSession.originalRedirectUri);
+    callbackUrl.searchParams.set('code', code);
+    if (authSession.originalState) {
+        callbackUrl.searchParams.set('state', authSession.originalState);
+    }
+    logger.log(`Facade callback: Redirecting to original client: ${callbackUrl.toString()}`);
+    res.redirect(callbackUrl.toString());
+});
 // Session management middleware
 function getOrCreateSession(req) {
     let sessionId = req.get('Mcp-Session-Id');
@@ -193,24 +325,64 @@ async function requireAuth(req, res, next) {
 // MCP endpoint - POST for JSON-RPC requests
 app.post('/mcp', requireAuth, async (req, res) => {
     try {
-        const sessionId = getOrCreateSession(req);
-        res.set('Mcp-Session-Id', sessionId);
-        res.set('Content-Type', 'application/json');
-        // Handle JSON-RPC request through MCP server
-        const result = await mcpServer.server.request(req.body, z.any());
-        res.json(result);
+        const sessionId = req.get('Mcp-Session-Id');
+        logger.log(sessionId ? `MCP request for session: ${sessionId}` : 'New MCP request');
+        let transport;
+        if (sessionId && transports[sessionId]) {
+            // Reuse existing transport
+            transport = transports[sessionId];
+        }
+        else if (!sessionId && isInitializeRequest(req.body)) {
+            // New initialization request
+            transport = new StreamableHTTPServerTransport({
+                sessionIdGenerator: () => crypto.randomUUID(),
+                enableJsonResponse: true, // Enable JSON response mode for simplicity
+                onsessioninitialized: (sessionId) => {
+                    logger.log(`Session initialized with ID: ${sessionId}`);
+                    transports[sessionId] = transport;
+                },
+            });
+            // Set up cleanup on close
+            transport.onclose = () => {
+                const sid = transport.sessionId;
+                if (sid && transports[sid]) {
+                    logger.log(`Transport closed for session ${sid}`);
+                    delete transports[sid];
+                }
+            };
+            // Connect transport to MCP server BEFORE handling request
+            await mcpServer.connect(transport);
+            await transport.handleRequest(req, res, req.body);
+            return; // Already handled
+        }
+        else {
+            // Invalid request - no session ID or not initialization request
+            res.status(400).json({
+                jsonrpc: '2.0',
+                error: {
+                    code: -32000,
+                    message: 'Bad Request: No valid session ID provided',
+                },
+                id: null,
+            });
+            return;
+        }
+        // Handle the request with existing transport
+        await transport.handleRequest(req, res, req.body);
     }
     catch (error) {
-        console.error('MCP request error:', error);
-        res.status(500).json({
-            jsonrpc: '2.0',
-            error: {
-                code: -32603,
-                message: 'Internal error',
-                data: error instanceof Error ? error.message : String(error),
-            },
-            id: req.body?.id || null,
-        });
+        logger.error('MCP request error:', error instanceof Error ? error.message : String(error));
+        if (!res.headersSent) {
+            res.status(500).json({
+                jsonrpc: '2.0',
+                error: {
+                    code: -32603,
+                    message: 'Internal error',
+                    data: error instanceof Error ? error.message : String(error),
+                },
+                id: req.body?.id || null,
+            });
+        }
     }
 });
 // MCP endpoint - GET for SSE streams
@@ -281,12 +453,36 @@ async function main() {
     }
 }
 // Graceful shutdown
-process.on('SIGINT', () => {
+process.on('SIGINT', async () => {
     logger.log('Shutting down MCP Server...');
+    // Close all active transports
+    for (const sessionId in transports) {
+        try {
+            logger.log(`Closing transport for session ${sessionId}`);
+            await transports[sessionId].close();
+            delete transports[sessionId];
+        }
+        catch (error) {
+            logger.error(`Error closing transport for session ${sessionId}:`, error instanceof Error ? error.message : String(error));
+        }
+    }
+    logger.log('Server shutdown complete');
     process.exit(0);
 });
-process.on('SIGTERM', () => {
+process.on('SIGTERM', async () => {
     logger.log('Shutting down MCP Server...');
+    // Close all active transports
+    for (const sessionId in transports) {
+        try {
+            logger.log(`Closing transport for session ${sessionId}`);
+            await transports[sessionId].close();
+            delete transports[sessionId];
+        }
+        catch (error) {
+            logger.error(`Error closing transport for session ${sessionId}:`, error instanceof Error ? error.message : String(error));
+        }
+    }
+    logger.log('Server shutdown complete');
     process.exit(0);
 });
 main().catch((error) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sargonpiraev/hh-mcp-server",
-  "version": "1.15.0",
+  "version": "1.17.0",
   "description": "HeadHunter API MCP Server provides seamless integration between AI tools and HeadHunter's comprehensive job search platform.",
   "keywords": [
     "mcp",