@stage-labs/metro 0.1.0-beta.302 → 0.1.0-beta.304

package/runtime/node_modules/@metro-labs/daemon/src/connectors/oauth-routes.ts

@@ -1,178 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import { errMsg, log } from '@metro-labs/core/log';
-import { bodyField, readJsonBody, sendJson, stringOf } from '@metro-labs/http/api-http';
-import {
-  beginOAuth,
-  completeOAuth,
-  prepareOAuth,
-  takePending,
-  type PendingAuth,
-} from './oauth.js';
-import { connectorClient, connectorName } from '@metro-labs/http/connector-input';
-import { parseConnectorUrl } from '@metro-labs/http/connector-url';
-import type { OAuthAuth } from '@metro-labs/http/connector-mcp';
-import type { Connector, PendingConnectorInput } from './store.js';
-import { agentsDir } from '../agents/files.js';
-import { withLocalMigrationOperation } from './migration-guard.js';
-import { migrationRecord } from './migration-state.js';
-import { ApiError } from '@metro-labs/http/api-error';
-
-export function hostOf(url: string): string {
-  try {
-    return new URL(url).hostname;
-  } catch {
-    return '';
-  }
-}
-
-export interface OAuthRouteDeps {
-  migrationDir?: string;
-  createPendingConnector: (input: PendingConnectorInput) => Promise<Connector>;
-  reconnectConnector: (id: string, auth: OAuthAuth) => Promise<Connector>;
-  getConnector: (id: string) => Promise<Connector>;
-}
-
-export async function startOAuth(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: OAuthRouteDeps,
-  body: unknown,
-  payload: (row: Connector) => Record<string, unknown>,
-): Promise<void> {
-  const name = connectorName(bodyField(body, 'name'));
-  await withLocalMigrationOperation('', deps.migrationDir ?? agentsDir(), async (operation) => {
-    const url = parseConnectorUrl(bodyField(body, 'url'));
-    const returnTo = stringOf(bodyField(body, 'returnTo'));
-    const clientId = bodyField(body, 'clientId');
-    const clientSecret = bodyField(body, 'clientSecret');
-    const prepared = await prepareOAuth({
-      url,
-      client: connectorClient(clientId, clientSecret),
-      returnTo,
-    }, operation.fetch);
-    const row = await deps.createPendingConnector({
-      name,
-      url: bodyField(body, 'url'),
-      clientId,
-      clientSecret,
-    });
-    operation.check();
-    const authorize = beginOAuth(prepared, {
-      name: row.name,
-      url,
-      returnTo,
-      connectorId: row.id,
-      migrationId: migrationRecord(row.id, deps.migrationDir)?.id ?? null,
-    });
-    log.info(
-      { id: row.id, host: url.hostname },
-      'connector-api: stored unconnected, sending the user to sign in',
-    );
-    sendJson(req, res, 201, { ...payload(row), authorizeUrl: authorize });
-  }, true);
-}
-
-export async function handleConnect(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: OAuthRouteDeps,
-  id: string,
-): Promise<void> {
-  await withLocalMigrationOperation(id, deps.migrationDir ?? agentsDir(), async (operation) => {
-    const row = await deps.getConnector(id);
-    const url = parseConnectorUrl(row.url);
-    const body = await readJsonBody(req);
-    const returnTo = stringOf(bodyField(body, 'returnTo'));
-    const prepared = await prepareOAuth({ url, client: row.client, returnTo }, operation.fetch);
-    operation.check();
-    const authorize = beginOAuth(prepared, {
-      name: row.name,
-      url,
-      returnTo,
-      connectorId: row.id,
-      migrationId: migrationRecord(row.id, deps.migrationDir)?.id ?? null,
-    });
-    log.info(
-      { id: row.id, host: url.hostname },
-      'connector-api: sending the user back to sign in',
-    );
-    sendJson(req, res, 202, { status: 'oauth', authorizeUrl: authorize });
-  }, true);
-}
-
-function landing(entry: PendingAuth, id?: string): string {
-  const target = id ?? entry.connectorId;
-  return target === undefined ? '#/connectors' : `#/connector/${target}`;
-}
-
-function backTo(entry: PendingAuth, error?: string, id?: string): string {
-  const suffix =
-    error === undefined
-      ? ''
-      : `?connector_error=${encodeURIComponent(error)}`;
-  return `${entry.returnTo}${suffix}${landing(entry, id)}`;
-}
-
-function redirect(res: ServerResponse, location: string): void {
-  res.writeHead(302, { location, 'cache-control': 'no-store' }).end();
-}
-
-async function saveOAuth(
-  deps: OAuthRouteDeps,
-  entry: PendingAuth,
-  auth: OAuthAuth,
-): Promise<Connector> {
-  return deps.reconnectConnector(entry.connectorId, auth);
-}
-
-function checkGeneration(entry: PendingAuth, dir: string | undefined): void {
-  if ((entry.migrationId ?? null) !== (migrationRecord(entry.connectorId, dir)?.id ?? null)) throw new ApiError('This sign-in predates the connector migration. Start a fresh sign-in.', 409);
-}
-
-async function settleCallback(
-  res: ServerResponse,
-  deps: OAuthRouteDeps,
-  entry: PendingAuth,
-  code: string,
-): Promise<void> {
-  try {
-    const saved = await withLocalMigrationOperation(entry.connectorId, deps.migrationDir ?? agentsDir(), async (operation) => {
-      checkGeneration(entry, deps.migrationDir);
-      const auth = await completeOAuth(entry, code, operation.fetch);
-      operation.check();
-      checkGeneration(entry, deps.migrationDir);
-      return saveOAuth(deps, entry, auth);
-    }, true);
-    log.info(
-      { id: saved.id, name: saved.name, host: hostOf(saved.url) },
-      'connector-api: oauth sign-in completed',
-    );
-    redirect(res, backTo(entry, undefined, saved.id));
-  } catch (err) {
-    log.warn({ err: errMsg(err) }, 'connector-api: oauth sign-in failed');
-    redirect(res, backTo(entry, errMsg(err)));
-  }
-}
-
-export function handleCallback(
-  req: IncomingMessage,
-  res: ServerResponse,
-  deps: OAuthRouteDeps,
-): void {
-  const query = new URLSearchParams((req.url ?? '').split('?')[1] ?? '');
-  const entry = takePending(query.get('state') ?? '');
-  if (entry === undefined) {
-    sendJson(req, res, 400, { error: 'that sign-in has expired — start it again' });
-    return;
-  }
-  const denied = query.get('error');
-  const code = query.get('code') ?? '';
-  if (denied !== null || code === '') {
-    redirect(res, backTo(entry, denied ?? 'no authorization code came back'));
-    return;
-  }
-  settleCallback(res, deps, entry, code).catch((err: unknown) => {
-    log.warn({ err: errMsg(err) }, 'connector-api: oauth callback failed');
-    if (!res.headersSent) redirect(res, backTo(entry, 'sign-in failed'));
-  });
-}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/oauth.ts

@@ -1,171 +0,0 @@
-import { publicBaseOrDefault } from '../files/attach-serve.js';
-import { refused } from '@metro-labs/http/connector-url';
-import type { OAuthAuth, OAuthTokens } from '@metro-labs/http/connector-mcp';
-import { validateReturnTo } from '@metro-labs/http/return-to';
-import {
-  authorizeUrl,
-  exchangeCode,
-  newVerifier,
-  refreshTokens,
-  registerClient,
-  type OAuthClient,
-} from '@metro-labs/http/connector-oauth';
-import { discoverOAuth, type OAuthServer } from '@metro-labs/http/connector-discovery';
-import { ticketStore } from '@metro-labs/core/tickets';
-import type { FetchLike } from '@metro-labs/core/stations/oauth';
-
-export interface PendingAuth {
-  name: string;
-  url: string;
-  resource: string;
-  returnTo: string;
-  verifier: string;
-  server: OAuthServer;
-  client: OAuthClient;
-  connectorId: string;
-  migrationId?: string | null;
-}
-
-const pending = ticketStore<PendingAuth>(10 * 60_000, 100);
-
-export const startPending = (entry: PendingAuth, now = Date.now()): string => pending.mint(entry, now).ticket;
-
-export const takePending = (state: string, now = Date.now()): PendingAuth | undefined => pending.take(state, now);
-
-export const pendingCount = (): number => pending.size();
-
-const REFRESH_SKEW_MS = 300_000;
-
-const CALLBACK_PATH = '/api/connectors/callback';
-
-const callbackUri = (): string =>
-  `${publicBaseOrDefault()}${CALLBACK_PATH}`;
-
-const resourceOf = (url: URL): string => url.toString();
-
-export interface PrepareInput {
-  url: URL;
-  client: OAuthClient | null;
-  returnTo: string;
-}
-
-export interface PreparedOAuth {
-  server: OAuthServer;
-  client: OAuthClient;
-  redirectUri: string;
-}
-
-export async function prepareOAuth(input: PrepareInput, send: FetchLike = fetch): Promise<PreparedOAuth> {
-  if (!validateReturnTo(input.returnTo))
-    throw refused('that return address is not one Metro will send you back to');
-  const server = await discoverOAuth(input.url, send);
-  const redirectUri = callbackUri();
-  const client = input.client ?? (await registerClient(server, redirectUri, send));
-  return { server, client, redirectUri };
-}
-
-export interface BeginInput {
-  connectorId: string;
-  migrationId?: string | null;
-  name: string;
-  url: URL;
-  returnTo: string;
-}
-
-export function beginOAuth(prepared: PreparedOAuth, input: BeginInput): string {
-  const { server, client, redirectUri } = prepared;
-  const verifier = newVerifier();
-  const resource = resourceOf(input.url);
-  const state = startPending({
-    name: input.name,
-    url: input.url.toString(),
-    resource,
-    returnTo: input.returnTo,
-    verifier,
-    server,
-    client,
-    connectorId: input.connectorId,
-    migrationId: input.migrationId ?? null,
-  });
-  return authorizeUrl({
-    server,
-    client,
-    redirectUri,
-    state,
-    verifier,
-    resource,
-  });
-}
-
-function authOf(pendingAuth: PendingAuth, tokens: OAuthTokens): OAuthAuth {
-  return {
-    kind: 'oauth',
-    issuer: pendingAuth.server.issuer,
-    tokenEndpoint: pendingAuth.server.tokenEndpoint,
-    resource: pendingAuth.resource,
-    clientId: pendingAuth.client.clientId,
-    ...(pendingAuth.client.clientSecret === undefined
-      ? {}
-      : { clientSecret: pendingAuth.client.clientSecret }),
-    ...(pendingAuth.server.scopes.length === 0
-      ? {}
-      : { scope: pendingAuth.server.scopes.join(' ') }),
-    ...tokens,
-  };
-}
-
-export async function completeOAuth(
-  entry: PendingAuth,
-  code: string,
-  send: FetchLike = fetch,
-): Promise<OAuthAuth> {
-  const tokens = await exchangeCode(entry.server, entry.client, {
-    code,
-    redirectUri: callbackUri(),
-    verifier: entry.verifier,
-    resource: entry.resource,
-  }, send);
-  return authOf(entry, tokens);
-}
-
-export function oauthExpired(auth: OAuthAuth, now = Date.now()): boolean {
-  return auth.expiresAt !== undefined && auth.expiresAt - REFRESH_SKEW_MS <= now;
-}
-
-export async function refreshOAuth(
-  auth: OAuthAuth,
-  resource: string,
-  send: FetchLike = fetch,
-): Promise<OAuthAuth> {
-  if (auth.refreshToken === undefined)
-    throw refused('that connector needs signing in again');
-  const server = {
-    issuer: auth.issuer,
-    authorizationEndpoint: '',
-    tokenEndpoint: auth.tokenEndpoint,
-    registrationEndpoint: null,
-    supportsS256: true,
-    scopes: [],
-  };
-  const client = {
-    clientId: auth.clientId,
-    ...(auth.clientSecret === undefined
-      ? {}
-      : { clientSecret: auth.clientSecret }),
-  };
-  const tokens = await refreshTokens(
-    server,
-    client,
-    auth.refreshToken,
-    auth.resource ?? resource,
-    auth.scope,
-    send,
-  );
-  return {
-    ...auth,
-    ...tokens,
-    ...(tokens.refreshToken === undefined
-      ? { refreshToken: auth.refreshToken }
-      : {}),
-  };
-}

package/runtime/node_modules/@metro-labs/daemon/src/connectors/relay-passive.ts

@@ -1,96 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import { JSONRPCNotificationSchema, ServerNotificationSchema } from '@modelcontextprotocol/sdk/types.js';
-import { isRecord } from '@metro-labs/core/is-record';
-import type { MigrationOperation } from './migration-operations.js';
-
-export const isRelaySse = (contentType: string | null | undefined): boolean => /^text\/event-stream\s*(?:;|$)/i.test(contentType ?? '');
-const MAX_FRAME = 64 * 1024;
-const NOTIFICATIONS = new Set(['notifications/tools/list_changed', 'notifications/resources/list_changed', 'notifications/prompts/list_changed', 'notifications/resources/updated', 'notifications/message']);
-
-export class PassiveSseListener {
-  forwarding = false;
-  private pending: Buffer[] = [];
-  private length = 0;
-  private data: string[] = [];
-  private fields = false;
-  private size = 0;
-  private unsafe = false;
-  private skipLf = false;
-  private first = true;
-  private readonly decoder = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true });
-
-  idle(): boolean { return !this.unsafe && this.length === 0 && !this.fields && !this.forwarding; }
-  keepaliveAllowed(): boolean { return this.unsafe || this.idle(); }
-
-  observe(chunk: Uint8Array): void {
-    if (this.unsafe) return;
-    this.scan(chunk);
-    if (this.unsafe) { this.pending = []; this.length = 0; this.data = []; }
-  }
-
-  private append(bytes: Uint8Array): void {
-    this.length += bytes.length;
-    if (this.length + this.size > MAX_FRAME) this.unsafe = true;
-    else if (bytes.length > 0) this.pending.push(Buffer.from(bytes));
-  }
-
-  private scan(bytes: Uint8Array): void {
-    let start = 0;
-    for (let at = 0; at < bytes.length; at += 1) {
-      if (at - start + this.length + this.size > MAX_FRAME) { this.unsafe = true; return; }
-      const byte = bytes[at];
-      if (this.skipLf && byte === 10) { this.skipLf = false; start = at + 1; continue; }
-      this.skipLf = false;
-      if (byte !== 10 && byte !== 13) continue;
-      this.append(bytes.subarray(start, at));
-      try { this.line(this.decoder.decode(Buffer.concat(this.pending, this.length)), this.length); }
-      catch { this.unsafe = true; }
-      this.pending = []; this.length = 0;
-      this.skipLf = byte === 13;
-      start = at + 1;
-      if (this.unsafe) return;
-    }
-    this.append(bytes.subarray(start));
-  }
-
-  private line(raw: string, length: number): void {
-    const line = this.first && raw.charCodeAt(0) === 0xfeff ? raw.slice(1) : raw;
-    this.first = false;
-    if (line === '') {
-      if (this.data.length > 0 && !this.notification()) this.unsafe = true;
-      this.data = []; this.fields = false; this.size = 0;
-      return;
-    }
-    if (line.startsWith(':')) return;
-    this.size += length;
-    if (this.size > MAX_FRAME) { this.unsafe = true; return; }
-    this.fields = true;
-    const colon = line.indexOf(':');
-    const field = colon < 0 ? line : line.slice(0, colon);
-    const value = colon < 0 ? '' : line.slice(colon + 1).replace(/^ /, '');
-    this.field(field, value);
-  }
-
-  private field(field: string, value: string): void {
-    if (field === 'data') this.data.push(value);
-    else if (field === 'event') { if (value !== '' && value !== 'message') this.unsafe = true; }
-    else if (field === 'retry') { if (!/^\d+$/.test(value)) this.unsafe = true; }
-    else this.unsafe = true;
-  }
-
-  private notification(): boolean {
-    const text = this.data.join('\n');
-    if (text === '') return true;
-    const value: unknown = JSON.parse(text);
-    return isRecord(value) && typeof value.method === 'string' && NOTIFICATIONS.has(value.method)
-      && JSONRPCNotificationSchema.safeParse(value).success && ServerNotificationSchema.safeParse(value).success;
-  }
-}
-
-export function passiveRelayListener(req: IncomingMessage, res: ServerResponse, upstream: Response, operation: MigrationOperation, stop: () => void): PassiveSseListener | undefined {
-  if (req.method !== 'GET' || req.headers['last-event-id'] !== undefined || req.headers['transfer-encoding'] !== undefined || Number(req.headers['content-length'] ?? 0) !== 0) return undefined;
-  if (upstream.status !== 200 || upstream.body === null || !isRelaySse(upstream.headers.get('content-type'))) return undefined;
-  const listener = new PassiveSseListener();
-  operation.passiveListener({ idle: () => listener.idle() && res.writableLength === 0 && !res.destroyed, stop });
-  return listener;
-}