@stage-labs/metro 0.1.0-beta.2 → 0.1.0-beta.21

package/runtime/node_modules/@metro-labs/mcp/src/daemon/oauth-discovery.ts

@@ -0,0 +1,120 @@
+import { ConnectorVerifyError, parseConnectorUrl } from './connector-verify.js';
+
+const DISCOVERY_TIMEOUT_MS = 10_000;
+
+export interface OAuthServer {
+  issuer: string;
+  authorizationEndpoint: string;
+  tokenEndpoint: string;
+  registrationEndpoint: string | null;
+  supportsS256: boolean;
+}
+
+function refused(message: string): ConnectorVerifyError {
+  return new ConnectorVerifyError(message, 400);
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+const str = (value: unknown): string =>
+  typeof value === 'string' ? value : '';
+
+async function getJson(url: URL): Promise<Record<string, unknown> | null> {
+  let res: Response;
+  try {
+    res = await fetch(url, {
+      redirect: 'manual',
+      signal: AbortSignal.timeout(DISCOVERY_TIMEOUT_MS),
+      headers: { accept: 'application/json' },
+    });
+  } catch {
+    return null;
+  }
+  if (!res.ok) {
+    await res.body?.cancel().catch(() => undefined);
+    return null;
+  }
+  const body: unknown = await res.json().catch(() => null);
+  return isRecord(body) ? body : null;
+}
+
+function wellKnown(base: URL, suffix: string): URL {
+  const url = new URL(base.toString());
+  url.pathname = `/.well-known/${suffix}`;
+  url.search = '';
+  url.hash = '';
+  return url;
+}
+
+export function resourceMetadataUrls(resource: URL): URL[] {
+  const path = resource.pathname.replace(/\/$/, '');
+  const urls = [wellKnown(resource, 'oauth-protected-resource')];
+  if (path !== '')
+    urls.unshift(
+      new URL(`/.well-known/oauth-protected-resource${path}`, resource.origin),
+    );
+  return urls;
+}
+
+export async function advertisesOAuth(resource: URL): Promise<boolean> {
+  for (const candidate of resourceMetadataUrls(resource)) {
+    const body = await getJson(candidate);
+    const servers: unknown = body?.authorization_servers;
+    const first: unknown = Array.isArray(servers) ? servers[0] : undefined;
+    if (typeof first === 'string' && first !== '') return true;
+  }
+  return false;
+}
+
+async function authServerFor(resource: URL): Promise<URL> {
+  for (const candidate of resourceMetadataUrls(resource)) {
+    const body = await getJson(candidate);
+    const servers: unknown = body?.authorization_servers;
+    const first: unknown = Array.isArray(servers) ? servers[0] : undefined;
+    if (typeof first === 'string' && first !== '')
+      return parseConnectorUrl(first);
+  }
+  return parseConnectorUrl(resource.origin);
+}
+
+function toServer(body: Record<string, unknown>, issuer: URL): OAuthServer {
+  const authorizationEndpoint = str(body.authorization_endpoint);
+  const tokenEndpoint = str(body.token_endpoint);
+  if (authorizationEndpoint === '' || tokenEndpoint === '')
+    throw refused(
+      `${issuer.hostname} advertises OAuth but not where to sign in.`,
+    );
+  const methods = body.code_challenge_methods_supported;
+  const registration = str(body.registration_endpoint);
+  return {
+    issuer: str(body.issuer) === '' ? issuer.origin : str(body.issuer),
+    authorizationEndpoint,
+    tokenEndpoint,
+    registrationEndpoint: registration === '' ? null : registration,
+    supportsS256: Array.isArray(methods) ? methods.includes('S256') : false,
+  };
+}
+
+export function authServerMetadataUrls(issuer: URL): URL[] {
+  const path = issuer.pathname.replace(/\/$/, '');
+  const suffixes = ['oauth-authorization-server', 'openid-configuration'];
+  const urls = suffixes.map((suffix) => wellKnown(issuer, suffix));
+  if (path === '') return urls;
+  const aware = suffixes.map(
+    (suffix) => new URL(`/.well-known/${suffix}${path}`, issuer.origin),
+  );
+  return [...aware, new URL(`${path}/.well-known/openid-configuration`, issuer.origin), ...urls];
+}
+
+export async function discoverOAuth(resource: URL): Promise<OAuthServer> {
+  const issuer = await authServerFor(resource);
+  for (const candidate of authServerMetadataUrls(issuer)) {
+    const body = await getJson(candidate);
+    if (body !== null) return toServer(body, issuer);
+  }
+  throw refused(
+    `${resource.hostname} needs authorization, but publishes no OAuth metadata Metro can use.`,
+  );
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/oauth-pending.ts

@@ -0,0 +1,65 @@
+import { randomBytes } from 'node:crypto';
+import type { OAuthClient } from './oauth-client.js';
+import type { OAuthServer } from './oauth-discovery.js';
+
+const TTL_MS = 10 * 60_000;
+const SWEEP_MS = 60_000;
+const MAX_PENDING = 100;
+
+export interface PendingAuth {
+  email: string;
+  name: string;
+  url: string;
+  resource: string;
+  returnTo: string;
+  verifier: string;
+  server: OAuthServer;
+  client: OAuthClient;
+  connectorId: string;
+}
+
+interface Entry extends PendingAuth {
+  expiresAt: number;
+}
+
+const pending = new Map<string, Entry>();
+let sweeper: ReturnType<typeof setInterval> | null = null;
+
+function sweep(now = Date.now()): void {
+  for (const [state, entry] of pending)
+    if (entry.expiresAt <= now) pending.delete(state);
+}
+
+function ensureSweeper(): void {
+  if (sweeper !== null) return;
+  sweeper = setInterval(sweep, SWEEP_MS);
+  sweeper.unref?.();
+}
+
+export function startPending(entry: PendingAuth, now = Date.now()): string {
+  sweep(now);
+  while (pending.size >= MAX_PENDING) {
+    const oldest = pending.keys().next();
+    if (oldest.done) break;
+    pending.delete(oldest.value);
+  }
+  const state = randomBytes(32).toString('base64url');
+  pending.set(state, { ...entry, expiresAt: now + TTL_MS });
+  ensureSweeper();
+  return state;
+}
+
+export function takePending(
+  state: string,
+  now = Date.now(),
+): PendingAuth | undefined {
+  const entry = pending.get(state);
+  if (entry === undefined) return undefined;
+  pending.delete(state);
+  return entry.expiresAt > now ? entry : undefined;
+}
+
+export function pendingCount(): number {
+  sweep();
+  return pending.size;
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/pair-codes.ts

@@ -0,0 +1,58 @@
+import { randomBytes } from 'node:crypto';
+
+const TTL_MS = 10 * 60_000;
+const SWEEP_MS = 60_000;
+const MAX_CODES = 100;
+
+export interface CodeStore<T> {
+  pattern: RegExp;
+  mint(entry: T, now?: number): { code: string; expiresAt: number };
+  take(code: string, now?: number): T | undefined;
+  count(): number;
+}
+
+export function makeCodeStore<T extends object>(prefix: string): CodeStore<T> {
+  const codes = new Map<string, T & { expiresAt: number }>();
+  let sweeper: ReturnType<typeof setInterval> | null = null;
+
+  const sweep = (now = Date.now()): void => {
+    for (const [code, entry] of codes)
+      if (entry.expiresAt <= now) codes.delete(code);
+  };
+
+  const ensureSweeper = (): void => {
+    if (sweeper !== null) return;
+    sweeper = setInterval(sweep, SWEEP_MS);
+    sweeper.unref?.();
+  };
+
+  return {
+    pattern: new RegExp(`^${prefix}_[A-Za-z0-9_-]{16}$`),
+    mint(entry, now = Date.now()) {
+      sweep(now);
+      while (codes.size >= MAX_CODES) {
+        const oldest = codes.keys().next();
+        if (oldest.done) break;
+        codes.delete(oldest.value);
+      }
+      const code = `${prefix}_${randomBytes(12).toString('base64url')}`;
+      const expiresAt = now + TTL_MS;
+      codes.set(code, { ...entry, expiresAt });
+      ensureSweeper();
+      return { code, expiresAt };
+    },
+    take(code, now = Date.now()) {
+      const entry = codes.get(code);
+      if (entry === undefined) return undefined;
+      codes.delete(code);
+      if (entry.expiresAt <= now) return undefined;
+      const rest: Record<string, unknown> = { ...entry };
+      delete rest.expiresAt;
+      return rest as T;
+    },
+    count() {
+      sweep();
+      return codes.size;
+    },
+  };
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/paths.ts

@@ -0,0 +1,134 @@
+import { execFileSync } from 'node:child_process';
+import {
+  closeSync,
+  existsSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  unlinkSync,
+  writeSync,
+} from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { log } from './log.js';
+
+export const STATE_DIR =
+  process.env.METRO_STATE_DIR ?? join(homedir(), '.cache', 'metro');
+mkdirSync(STATE_DIR, { recursive: true });
+
+export const CONFIG_DIR =
+  process.env.METRO_CONFIG_DIR ??
+  join(process.env.XDG_CONFIG_HOME ?? join(homedir(), '.config'), 'metro');
+export const CONFIG_ENV_FILE = join(CONFIG_DIR, '.env');
+
+export const TRAINS_ENV_FILE = join(homedir(), '.metro', '.env');
+
+export const envSources = (): readonly string[] => [
+  join(process.cwd(), '.env'),
+  TRAINS_ENV_FILE,
+  CONFIG_ENV_FILE,
+];
+
+const LINE_RE = /^\s*([A-Za-z_]\w*)\s*=\s*(.*?)\s*$/;
+const QUOTED_RE = /^(['"])(.*)\1$/;
+
+export function readDotenv(path: string): Record<string, string> {
+  if (!existsSync(path)) return {};
+  const out: Record<string, string> = {};
+  for (const line of readFileSync(path, 'utf8').split('\n')) {
+    const m = LINE_RE.exec(line);
+    if (m?.[1] !== undefined && m[2] !== undefined)
+      out[m[1]] = m[2].replace(QUOTED_RE, '$2');
+  }
+  return out;
+}
+
+export function loadMetroEnv(): void {
+  for (const path of envSources()) {
+    for (const [k, v] of Object.entries(readDotenv(path))) {
+      process.env[k] ??= v;
+    }
+  }
+}
+
+function readLockPid(lockFile: string): number {
+  try {
+    return Number(readFileSync(lockFile, 'utf8').trim());
+  } catch {
+    return NaN;
+  }
+}
+
+function namesMetro(text: string): boolean {
+  return text.includes('server.ts') || text.includes('metro');
+}
+
+function holderIsMetro(pid: number): boolean {
+  try {
+    return namesMetro(readFileSync(`/proc/${pid}/cmdline`, 'utf8'));
+  } catch {
+    return holderCommand(pid);
+  }
+}
+
+function holderCommand(pid: number): boolean {
+  try {
+    return namesMetro(
+      execFileSync('ps', ['-o', 'command=', '-p', String(pid)], {
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'ignore'],
+      }),
+    );
+  } catch {
+    return false;
+  }
+}
+
+export function lockHeldByLiveDaemon(pid: number): boolean {
+  if (!Number.isInteger(pid) || pid <= 0 || pid === process.pid) return false;
+  try {
+    process.kill(pid, 0);
+  } catch {
+    return false;
+  }
+  return holderIsMetro(pid);
+}
+
+function writeOwnLock(lockFile: string): void {
+  const fd = openSync(lockFile, 'wx');
+  writeSync(fd, String(process.pid));
+  closeSync(fd);
+  process.on('exit', () => {
+    try {
+      if (readFileSync(lockFile, 'utf8').trim() === String(process.pid))
+        unlinkSync(lockFile);
+    } catch {
+    }
+  });
+}
+
+export function acquireLock(lockFile: string): void {
+  for (let attempt = 0; attempt < 5; attempt++) {
+    try {
+      writeOwnLock(lockFile);
+      return;
+    } catch (err) {
+      if ((err as NodeJS.ErrnoException).code !== 'EEXIST') throw err;
+      const pid = readLockPid(lockFile);
+      if (lockHeldByLiveDaemon(pid)) {
+        log.info(
+          { pid },
+          'a healthy `metro` daemon is already running; exiting (no second dispatcher)',
+        );
+        process.exit(0);
+      }
+      try {
+        unlinkSync(lockFile);
+      } catch {
+      }
+    }
+  }
+  throw new Error(
+    `metro: could not acquire dispatcher lock (${lockFile}) after retries`,
+  );
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/project-api.ts

@@ -0,0 +1,214 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { errMsg, log } from './log.js';
+import {
+  apiFailure,
+  apiSession,
+  bodyField,
+  cors,
+  readJsonBody,
+  sendJson,
+  type ApiSession,
+} from './api-http.js';
+import { parseId } from '../db/ids.js';
+import type { Member, Project } from '../db/projects.js';
+
+const PREFIX = '/api/projects';
+
+export interface ProjectApiDeps {
+  listProjects: (email: string) => Promise<Project[]>;
+  createProject: (email: string, name: unknown) => Promise<Project>;
+  renameProject: (
+    email: string,
+    id: string,
+    name: unknown,
+  ) => Promise<Project>;
+  deleteProject: (
+    email: string,
+    id: string,
+  ) => Promise<{ id: string; name: string }>;
+  listMembers: (email: string, id: string) => Promise<Member[]>;
+  addMember: (
+    email: string,
+    id: string,
+    invited: unknown,
+    role: unknown,
+  ) => Promise<Member[]>;
+  setMemberRole: (
+    email: string,
+    id: string,
+    memberId: string,
+    role: unknown,
+  ) => Promise<Member[]>;
+  removeMember: (
+    email: string,
+    id: string,
+    memberId: string,
+  ) => Promise<Member[]>;
+}
+
+type Routable =
+  | { kind: 'index' }
+  | { kind: 'project'; id: string }
+  | { kind: 'rename'; id: string }
+  | { kind: 'members'; id: string }
+  | { kind: 'member'; id: string; memberId: string };
+
+type Target = Routable | { kind: 'unknown' } | null;
+
+const ALLOWED: Record<Routable['kind'], string[]> = {
+  index: ['GET', 'POST'],
+  project: ['DELETE'],
+  rename: ['POST'],
+  members: ['GET', 'POST'],
+  member: ['POST', 'DELETE'],
+};
+
+function memberTarget(id: string, rest: string[]): Target {
+  if (rest.length === 1) return { kind: 'members', id };
+  if (rest.length > 2) return { kind: 'unknown' };
+  const memberId = parseId(rest[1] ?? '');
+  return memberId === null
+    ? { kind: 'unknown' }
+    : { kind: 'member', id, memberId };
+}
+
+function subTarget(id: string, rest: string[]): Target {
+  if (rest.length === 0) return { kind: 'project', id };
+  const head = rest[0];
+  if (head === 'members') return memberTarget(id, rest);
+  if (rest.length > 1) return { kind: 'unknown' };
+  if (head === 'rename') return { kind: 'rename', id };
+  return { kind: 'unknown' };
+}
+
+function target(path: string): Target {
+  if (path === PREFIX || path === `${PREFIX}/`) return { kind: 'index' };
+  if (!path.startsWith(`${PREFIX}/`)) return null;
+  const segments = path.slice(PREFIX.length + 1).split('/').filter(Boolean);
+  const head = segments[0];
+  if (head === undefined) return { kind: 'index' };
+  const id = parseId(head);
+  return id === null ? { kind: 'unknown' } : subTarget(id, segments.slice(1));
+}
+
+async function handleIndex(
+  req: IncomingMessage,
+  res: ServerResponse,
+  deps: ProjectApiDeps,
+  session: ApiSession,
+): Promise<void> {
+  if (req.method === 'GET') {
+    sendJson(req, res, 200, { projects: await deps.listProjects(session.email) });
+    return;
+  }
+  const made = await deps.createProject(
+    session.email,
+    bodyField(await readJsonBody(req), 'name'),
+  );
+  log.info({ id: made.id, name: made.name }, 'project-api: created project');
+  sendJson(req, res, 201, made);
+}
+
+async function handleMembers(
+  req: IncomingMessage,
+  res: ServerResponse,
+  deps: ProjectApiDeps,
+  session: ApiSession,
+  id: string,
+): Promise<void> {
+  if (req.method === 'GET') {
+    sendJson(req, res, 200, { members: await deps.listMembers(session.email, id) });
+    return;
+  }
+  const body = await readJsonBody(req);
+  const members = await deps.addMember(
+    session.email,
+    id,
+    bodyField(body, 'email'),
+    bodyField(body, 'role'),
+  );
+  sendJson(req, res, 200, { members });
+}
+
+async function handleMember(
+  req: IncomingMessage,
+  res: ServerResponse,
+  deps: ProjectApiDeps,
+  session: ApiSession,
+  tgt: { id: string; memberId: string },
+): Promise<void> {
+  if (req.method === 'DELETE') {
+    const members = await deps.removeMember(session.email, tgt.id, tgt.memberId);
+    sendJson(req, res, 200, { members });
+    return;
+  }
+  const members = await deps.setMemberRole(
+    session.email,
+    tgt.id,
+    tgt.memberId,
+    bodyField(await readJsonBody(req), 'role'),
+  );
+  sendJson(req, res, 200, { members });
+}
+
+async function route(
+  req: IncomingMessage,
+  res: ServerResponse,
+  deps: ProjectApiDeps,
+  session: ApiSession,
+  tgt: Routable,
+): Promise<void> {
+  try {
+    if (tgt.kind === 'index') await handleIndex(req, res, deps, session);
+    else if (tgt.kind === 'members')
+      await handleMembers(req, res, deps, session, tgt.id);
+    else if (tgt.kind === 'member')
+      await handleMember(req, res, deps, session, tgt);
+    else if (tgt.kind === 'rename')
+      sendJson(
+        req,
+        res,
+        200,
+        await deps.renameProject(
+          session.email,
+          tgt.id,
+          bodyField(await readJsonBody(req), 'name'),
+        ),
+      );
+    else sendJson(req, res, 200, await deps.deleteProject(session.email, tgt.id));
+  } catch (err) {
+    apiFailure(req, res, err, 'project-api');
+  }
+}
+
+export function handleProjectApiRequest(
+  req: IncomingMessage,
+  res: ServerResponse,
+  deps: ProjectApiDeps,
+): boolean {
+  const tgt = target((req.url ?? '').split('?')[0] ?? '');
+  if (tgt === null) return false;
+  if (req.method === 'OPTIONS') {
+    res.writeHead(204, cors(req)).end();
+    return true;
+  }
+  if (tgt.kind === 'unknown') {
+    sendJson(req, res, 404, { error: 'no such project' });
+    return true;
+  }
+  if (!ALLOWED[tgt.kind].includes(req.method ?? '')) {
+    sendJson(req, res, 405, { error: 'method not allowed' });
+    return true;
+  }
+  const session = apiSession(req);
+  if (!session) {
+    sendJson(req, res, 401, { error: 'unauthorized' });
+    return true;
+  }
+  route(req, res, deps, session, tgt).catch((err: unknown) => {
+    log.warn({ err: errMsg(err) }, 'project-api: unhandled error');
+    if (!res.headersSent)
+      sendJson(req, res, 500, { error: 'project api failed' });
+  });
+  return true;
+}