@taazkareem/clickup-mcp-server 0.8.5 → 0.9.1

package/build/middleware/auth.js

@@ -0,0 +1,211 @@
+/**
+ * SPDX-FileCopyrightText: © 2025 Talib Kareem <taazkareem@icloud.com>
+ * SPDX-License-Identifier: MIT
+ *
+ * Simple Authentication Middleware
+ *
+ * Handles authentication for both OAuth2 and API key methods:
+ * - Request authentication validation
+ * - Session management (simplified)
+ * - Backward compatibility with API keys
+ * - Pass-through to ClickUp API (no custom user management)
+ */
+import { Logger } from '../logger.js';
+import config from '../config.js';
+/**
+ * Simple authentication middleware class
+ */
+export class AuthMiddleware {
+    constructor(sessionService) {
+        this.logger = new Logger('AuthMiddleware');
+        this.sessionService = sessionService;
+    }
+    /**
+     * Main authentication middleware (simplified)
+     * @param options Middleware options
+     * @returns Express middleware function
+     */
+    authenticate(options = {}) {
+        return async (req, res, next) => {
+            try {
+                const { required = true, allowApiKey = true } = options;
+                this.logger.debug('Authenticating request', {
+                    path: req.path,
+                    method: req.method,
+                    required,
+                    allowApiKey
+                });
+                // Try OAuth2 authentication first
+                const oauth2Result = await this.tryOAuth2Authentication(req);
+                if (oauth2Result.success) {
+                    req.userSession = oauth2Result.session;
+                    req.authMethod = 'oauth2';
+                    req.clickupApiKey = oauth2Result.session?.accessToken;
+                    req.clickupTeamId = config.clickupTeamId;
+                    req.clickupUserId = oauth2Result.session?.clickupUserId;
+                    this.logger.info('OAuth2 authentication successful', {
+                        clickupUserId: req.clickupUserId,
+                        sessionId: req.userSession?.id
+                    });
+                    return next();
+                }
+                // Fall back to API key authentication if allowed
+                if (allowApiKey) {
+                    const apiKeyResult = await this.tryApiKeyAuthentication(req);
+                    if (apiKeyResult.success) {
+                        req.authMethod = 'api_key';
+                        req.clickupApiKey = apiKeyResult.apiKey;
+                        req.clickupTeamId = apiKeyResult.teamId;
+                        this.logger.info('API key authentication successful');
+                        return next();
+                    }
+                }
+                // If authentication is required but failed
+                if (required) {
+                    this.logger.warn('Authentication required but failed', {
+                        path: req.path,
+                        oauth2Error: oauth2Result.error,
+                        apiKeyAllowed: allowApiKey
+                    });
+                    return res.status(401).json({
+                        error: 'Authentication required',
+                        message: 'Please provide valid OAuth2 session or API key',
+                        code: 'AUTHENTICATION_REQUIRED'
+                    });
+                }
+                // Authentication not required, continue without user context
+                this.logger.debug('Authentication not required, continuing without user context');
+                next();
+            }
+            catch (error) {
+                this.logger.error('Authentication middleware error', {
+                    error: error.message,
+                    path: req.path
+                });
+                res.status(500).json({
+                    error: 'Authentication error',
+                    message: 'Internal authentication error',
+                    code: 'AUTHENTICATION_ERROR'
+                });
+            }
+        };
+    }
+    /**
+     * Try OAuth2 authentication using session (simplified)
+     * @private
+     */
+    async tryOAuth2Authentication(req) {
+        try {
+            // Check for session ID in various places
+            let sessionId;
+            // 1. Authorization header (Bearer token)
+            const authHeader = req.headers.authorization;
+            if (authHeader && authHeader.startsWith('Bearer ')) {
+                sessionId = authHeader.substring(7);
+            }
+            // 2. Session cookie
+            if (!sessionId && req.cookies?.sessionId) {
+                sessionId = req.cookies.sessionId;
+            }
+            // 3. Query parameter (for testing)
+            if (!sessionId && req.query.sessionId) {
+                sessionId = req.query.sessionId;
+            }
+            if (!sessionId) {
+                return {
+                    success: false,
+                    error: 'No session ID provided'
+                };
+            }
+            // Get session from session service
+            const sessionResult = await this.sessionService.getSession(sessionId);
+            if (!sessionResult.success || !sessionResult.data) {
+                return {
+                    success: false,
+                    error: 'Invalid or expired session'
+                };
+            }
+            const session = sessionResult.data;
+            // No need to get user info - ClickUp API will handle permissions
+            return {
+                success: true,
+                session
+            };
+        }
+        catch (error) {
+            this.logger.error('OAuth2 authentication error', { error: error.message });
+            return {
+                success: false,
+                error: error.message
+            };
+        }
+    }
+    /**
+     * Try API key authentication (backward compatibility)
+     * @private
+     */
+    async tryApiKeyAuthentication(req) {
+        try {
+            // Check for API key in various places
+            let apiKey;
+            let teamId;
+            // 1. Authorization header
+            const authHeader = req.headers.authorization;
+            if (authHeader && !authHeader.startsWith('Bearer ')) {
+                apiKey = authHeader;
+            }
+            // 2. Custom headers
+            if (!apiKey && req.headers['x-clickup-api-key']) {
+                apiKey = req.headers['x-clickup-api-key'];
+            }
+            // 3. Environment variables (fallback)
+            if (!apiKey) {
+                apiKey = config.clickupApiKey;
+                teamId = config.clickupTeamId;
+            }
+            // 4. Team ID from headers
+            if (!teamId && req.headers['x-clickup-team-id']) {
+                teamId = req.headers['x-clickup-team-id'];
+            }
+            if (!apiKey || !teamId) {
+                return {
+                    success: false,
+                    error: 'API key or team ID not provided'
+                };
+            }
+            // Basic validation (you might want to add actual API validation here)
+            if (!apiKey.startsWith('pk_')) {
+                return {
+                    success: false,
+                    error: 'Invalid API key format'
+                };
+            }
+            return {
+                success: true,
+                apiKey,
+                teamId
+            };
+        }
+        catch (error) {
+            this.logger.error('API key authentication error', { error: error.message });
+            return {
+                success: false,
+                error: error.message
+            };
+        }
+    }
+    /**
+     * Optional authentication middleware (doesn't require authentication)
+     * @returns Express middleware function
+     */
+    optional() {
+        return this.authenticate({ required: false });
+    }
+    /**
+     * OAuth2 only authentication (no API key fallback)
+     * @returns Express middleware function
+     */
+    oauth2Only() {
+        return this.authenticate({ allowApiKey: false });
+    }
+}

package/build/routes/auth.js

@@ -0,0 +1,306 @@
+/**
+ * SPDX-FileCopyrightText: © 2025 Talib Kareem <taazkareem@icloud.com>
+ * SPDX-License-Identifier: MIT
+ *
+ * Simple OAuth2 Authentication Routes
+ *
+ * Handles OAuth2 authentication endpoints:
+ * - Authorization redirect
+ * - OAuth2 callback handling
+ * - Token refresh
+ * - Logout and session management
+ * - No complex user management (ClickUp handles this)
+ */
+import { Router } from 'express';
+import { Logger } from '../logger.js';
+import { OAuth2Service } from '../services/auth/oauth2.js';
+import { AuthMiddleware } from '../middleware/auth.js';
+/**
+ * Simple OAuth2 authentication routes
+ */
+export class AuthRoutes {
+    constructor(oauth2Config, sessionService) {
+        this.stateStore = new Map();
+        this.router = Router();
+        this.logger = new Logger('AuthRoutes');
+        this.oauth2Service = new OAuth2Service(oauth2Config);
+        this.sessionService = sessionService;
+        this.authMiddleware = new AuthMiddleware(sessionService);
+        this.setupRoutes();
+        // Clean up expired states every 10 minutes
+        setInterval(() => this.cleanupExpiredStates(), 10 * 60 * 1000);
+    }
+    /**
+     * Get the router instance
+     */
+    getRouter() {
+        return this.router;
+    }
+    /**
+     * Setup authentication routes (simplified)
+     * @private
+     */
+    setupRoutes() {
+        // OAuth2 authorization redirect
+        this.router.get('/login', this.handleLogin.bind(this));
+        // OAuth2 callback
+        this.router.get('/callback', this.handleCallback.bind(this));
+        // Token refresh
+        this.router.post('/refresh', this.handleRefresh.bind(this));
+        // Logout (simplified)
+        this.router.post('/logout', this.handleLogout.bind(this));
+        // Health check
+        this.router.get('/health', this.handleHealth.bind(this));
+        this.logger.info('Simple authentication routes initialized');
+    }
+    /**
+     * Handle OAuth2 login redirect (simplified)
+     */
+    handleLogin(req, res) {
+        try {
+            this.logger.info('Handling OAuth2 login request', {
+                ip: req.ip,
+                userAgent: req.get('User-Agent')
+            });
+            // Generate state parameter for CSRF protection
+            const state = this.generateState();
+            // Store state in memory for validation
+            this.stateStore.set(state, { timestamp: Date.now() });
+            // Generate authorization URL
+            const authUrl = this.oauth2Service.generateAuthorizationUrl(state);
+            this.logger.info('Redirecting to OAuth2 authorization', {
+                state,
+                redirectUrl: authUrl
+            });
+            res.redirect(authUrl);
+        }
+        catch (error) {
+            this.logger.error('Login handler error', { error: error.message });
+            res.status(500).json({
+                error: 'Login error',
+                message: 'Failed to initiate OAuth2 login',
+                code: 'LOGIN_ERROR'
+            });
+        }
+    }
+    /**
+     * Handle OAuth2 callback (simplified)
+     */
+    async handleCallback(req, res) {
+        try {
+            const { code, state, error } = req.query;
+            this.logger.info('Handling OAuth2 callback', {
+                hasCode: !!code,
+                hasState: !!state,
+                hasError: !!error
+            });
+            // Check for OAuth2 error
+            if (error) {
+                this.logger.error('OAuth2 callback error', { error });
+                res.status(400).json({
+                    error: 'OAuth2 error',
+                    message: error,
+                    code: 'OAUTH2_ERROR'
+                });
+                return;
+            }
+            // Validate required parameters
+            if (!code || typeof code !== 'string') {
+                res.status(400).json({
+                    error: 'Missing authorization code',
+                    message: 'Authorization code is required',
+                    code: 'MISSING_CODE'
+                });
+                return;
+            }
+            // Validate state parameter (CSRF protection)
+            if (!state || typeof state !== 'string' || !this.stateStore.has(state)) {
+                this.logger.warn('Invalid OAuth2 state parameter', {
+                    receivedState: state,
+                    hasState: this.stateStore.has(state)
+                });
+                res.status(400).json({
+                    error: 'Invalid state parameter',
+                    message: 'CSRF validation failed',
+                    code: 'INVALID_STATE'
+                });
+                return;
+            }
+            // Remove used state
+            this.stateStore.delete(state);
+            // Exchange code for tokens
+            const authResult = await this.oauth2Service.exchangeCodeForToken(code);
+            if (!authResult.success || !authResult.tokens || !authResult.user) {
+                this.logger.error('Token exchange failed', { error: authResult.error });
+                res.status(400).json({
+                    error: 'Token exchange failed',
+                    message: authResult.error?.message || 'Failed to exchange authorization code',
+                    code: 'TOKEN_EXCHANGE_FAILED'
+                });
+                return;
+            }
+            // Create session directly (no user management needed)
+            const sessionResult = await this.sessionService.createSession({
+                clickupUserId: authResult.user.id.toString(),
+                tokens: authResult.tokens
+            });
+            if (!sessionResult.success || !sessionResult.data) {
+                this.logger.error('Session creation failed', { error: sessionResult.error });
+                res.status(500).json({
+                    error: 'Session creation error',
+                    message: 'Failed to create user session',
+                    code: 'SESSION_CREATION_ERROR'
+                });
+                return;
+            }
+            const session = sessionResult.data;
+            // Set session cookie
+            res.cookie('sessionId', session.id, {
+                httpOnly: true,
+                secure: process.env.NODE_ENV === 'production',
+                maxAge: 24 * 60 * 60 * 1000, // 24 hours
+                sameSite: 'lax'
+            });
+            this.logger.info('OAuth2 authentication successful', {
+                clickupUserId: authResult.user.id,
+                sessionId: session.id
+            });
+            // Redirect to success page or return JSON
+            if (req.query.format === 'json') {
+                res.json({
+                    success: true,
+                    message: 'Authentication successful',
+                    user: {
+                        id: authResult.user.id,
+                        username: authResult.user.username,
+                        email: authResult.user.email
+                    },
+                    sessionId: session.id
+                });
+            }
+            else {
+                // Redirect to dashboard or configured success URL
+                const redirectUrl = process.env.OAUTH2_SUCCESS_REDIRECT || '/dashboard';
+                res.redirect(redirectUrl);
+            }
+        }
+        catch (error) {
+            this.logger.error('Callback handler error', { error: error.message });
+            res.status(500).json({
+                error: 'Callback error',
+                message: 'Failed to process OAuth2 callback',
+                code: 'CALLBACK_ERROR'
+            });
+        }
+    }
+    /**
+     * Handle token refresh (simplified)
+     */
+    async handleRefresh(req, res) {
+        try {
+            const { refreshToken, sessionId } = req.body;
+            if (!refreshToken || !sessionId) {
+                res.status(400).json({
+                    error: 'Missing parameters',
+                    message: 'Refresh token and session ID are required',
+                    code: 'MISSING_PARAMETERS'
+                });
+                return;
+            }
+            // Refresh token
+            const refreshResult = await this.oauth2Service.refreshToken(refreshToken);
+            if (!refreshResult.success || !refreshResult.tokens) {
+                res.status(400).json({
+                    error: 'Token refresh failed',
+                    message: refreshResult.error?.message || 'Failed to refresh token',
+                    code: 'TOKEN_REFRESH_FAILED'
+                });
+                return;
+            }
+            // Update session with new tokens
+            const updateResult = await this.sessionService.updateSessionTokens(sessionId, refreshResult.tokens);
+            if (!updateResult.success) {
+                res.status(500).json({
+                    error: 'Session update failed',
+                    message: 'Failed to update session with new tokens',
+                    code: 'SESSION_UPDATE_FAILED'
+                });
+                return;
+            }
+            res.json({
+                success: true,
+                message: 'Token refreshed successfully',
+                tokens: refreshResult.tokens
+            });
+        }
+        catch (error) {
+            this.logger.error('Refresh handler error', { error: error.message });
+            res.status(500).json({
+                error: 'Refresh error',
+                message: 'Failed to refresh token',
+                code: 'REFRESH_ERROR'
+            });
+        }
+    }
+    /**
+     * Handle logout (simplified)
+     */
+    async handleLogout(req, res) {
+        try {
+            // Get session ID from cookie or header
+            const sessionId = req.cookies?.sessionId ||
+                (req.headers.authorization?.startsWith('Bearer ') ?
+                    req.headers.authorization.substring(7) : null);
+            if (sessionId) {
+                await this.sessionService.deleteSession(sessionId);
+            }
+            // Clear session cookie
+            res.clearCookie('sessionId');
+            res.json({
+                success: true,
+                message: 'Logged out successfully'
+            });
+        }
+        catch (error) {
+            this.logger.error('Logout handler error', { error: error.message });
+            res.status(500).json({
+                error: 'Logout error',
+                message: 'Failed to logout',
+                code: 'LOGOUT_ERROR'
+            });
+        }
+    }
+    /**
+     * Handle health check
+     */
+    handleHealth(req, res) {
+        res.json({
+            status: 'healthy',
+            service: 'oauth2-auth',
+            timestamp: new Date().toISOString()
+        });
+    }
+    /**
+     * Generate random state parameter
+     * @private
+     */
+    generateState() {
+        return Math.random().toString(36).substring(2, 15) + Math.random().toString(36).substring(2, 15);
+    }
+    /**
+     * Clean up expired states
+     * @private
+     */
+    cleanupExpiredStates() {
+        const now = Date.now();
+        const maxAge = 10 * 60 * 1000; // 10 minutes
+        for (const [state, data] of this.stateStore.entries()) {
+            if (now - data.timestamp > maxAge) {
+                this.stateStore.delete(state);
+            }
+        }
+        this.logger.debug('Cleaned up expired OAuth2 states', {
+            remainingStates: this.stateStore.size
+        });
+    }
+}

package/build/schemas/member.js

@@ -0,0 +1,13 @@
+// src/schemas/member.ts
+import { z } from 'zod';
+export const MemberSchema = z.object({
+    id: z.number(),
+    username: z.string().optional(),
+    email: z.string().optional(),
+    full_name: z.string().optional(),
+    profile_picture: z.string().optional(),
+    role: z.number(),
+    role_name: z.string().optional(),
+    initials: z.string().optional(),
+    last_active: z.string().optional(),
+});

package/build/server.js

@@ -7,6 +7,7 @@
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, ListPromptsRequestSchema, GetPromptRequestSchema, ListResourcesRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
 import config from "./config.js";
+import { isLicenseValid, getLicenseErrorMessage } from "./license.js";
 import { workspaceHierarchyTool, handleGetWorkspaceHierarchy } from "./tools/workspace.js";
 import { createTaskTool, updateTaskTool, moveTaskTool, duplicateTaskTool, getTaskTool, deleteTaskTool, getTaskCommentsTool, createTaskCommentTool, createBulkTasksTool, updateBulkTasksTool, moveBulkTasksTool, deleteBulkTasksTool, attachTaskFileTool, getWorkspaceTasksTool, getTaskTimeEntriesTool, startTimeTrackingTool, stopTimeTrackingTool, addTimeEntryTool, deleteTimeEntryTool, getCurrentTimeEntryTool, handleCreateTask, handleUpdateTask, handleMoveTask, handleDuplicateTask, handleDeleteTask, handleGetTaskComments, handleCreateTaskComment, handleCreateBulkTasks, handleUpdateBulkTasks, handleMoveBulkTasks, handleDeleteBulkTasks, handleGetTask, handleAttachTaskFile, handleGetWorkspaceTasks, handleGetTaskTimeEntries, handleStartTimeTracking, handleStopTimeTracking, handleAddTimeEntry, handleDeleteTimeEntry, handleGetCurrentTimeEntry } from "./tools/task/index.js";
 import { createListTool, handleCreateList, createListInFolderTool, handleCreateListInFolder, getListTool, handleGetList, updateListTool, handleUpdateList, deleteListTool, handleDeleteList } from "./tools/list.js";
@@ -135,6 +136,19 @@ export function configureServer() {
         logger.info(`Received CallTool request for tool: ${name}`, {
             params
         });
+        // Check license validity FIRST - before any tool execution
+        if (!isLicenseValid()) {
+            logger.warn(`Tool execution blocked: Invalid or missing license key`);
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: getLicenseErrorMessage()
+                    }
+                ],
+                isError: true
+            };
+        }
         // Check if the tool is enabled
         if (!isToolEnabled(name)) {
             const reason = config.enabledTools.length > 0

package/build/server.log

@@ -0,0 +1,15 @@
+Logging initialized to /Volumes/Code/Projects/MCP/clickup-mcp-server/build/server.log
+[2025-12-24T23:37:55.704Z] [PID:59029] ERROR: [ClickUp:TaskService] Authorization failed for /list/901309789109/task/86ae4175p
+{
+  "path": "/list/901309789109/task/86ae4175p",
+  "status": 403,
+  "method": "POST",
+  "requestData": {}
+}
+[2025-12-24T23:38:50.385Z] [PID:59029] ERROR: [ClickUp:TaskService] Authorization failed for /list/901309789109/task/86ae4175p
+{
+  "path": "/list/901309789109/task/86ae4175p",
+  "status": 403,
+  "method": "POST",
+  "requestData": {}
+}