@thuyphuocthinh/mcp-auth-proxy 0.0.0-stage → 1.0.1

package/dist/tests/proxy.test.js

@@ -0,0 +1,153 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert';
+import { Readable, Writable } from 'node:stream';
+import { extractJsonRpcFromSse, forwardJsonRpc, startProxy } from '../src/proxy.js';
+describe('Stdio to HTTP Proxy Bridge', () => {
+    it('extractJsonRpcFromSse should parse multi-event SSE streams with comments and blank lines', () => {
+        const rawStream = `
+: keepalive comment
+event: message
+data: {"jsonrpc":"2.0","id":1,"result":{"tools":[{"name":"test"}]}}
+
+: another comment
+event: message
+data: {"jsonrpc":"2.0","method":"notifications/initialized"}
+
+data: {"jsonrpc":"2.0","id":2,"result":{"status":"ok"}}
+    `.trim();
+        const results = extractJsonRpcFromSse(rawStream);
+        assert.strictEqual(results.length, 3);
+        assert.strictEqual(JSON.parse(results[0]).id, 1);
+        assert.strictEqual(JSON.parse(results[1]).method, 'notifications/initialized');
+        assert.strictEqual(JSON.parse(results[2]).id, 2);
+    });
+    it('extractJsonRpcFromSse should support raw non-SSE JSON responses', () => {
+        const plainJson = '{"jsonrpc":"2.0","id":100,"result":{"active":true}}';
+        const results = extractJsonRpcFromSse(plainJson);
+        assert.strictEqual(results.length, 1);
+        assert.strictEqual(results[0], plainJson);
+    });
+    it('extractJsonRpcFromSse should return empty array for empty or whitespace content', () => {
+        assert.deepStrictEqual(extractJsonRpcFromSse(''), []);
+        assert.deepStrictEqual(extractJsonRpcFromSse('   \n\n  '), []);
+    });
+    it('forwardJsonRpc should inject Bearer token, Accept headers, and forward JSON payload', async () => {
+        let capturedHeaders;
+        let capturedBody;
+        let capturedMethod;
+        const mockFetch = async (_input, init) => {
+            capturedHeaders = init?.headers;
+            capturedBody = init?.body;
+            capturedMethod = init?.method;
+            return new Response('event: message\ndata: {"jsonrpc":"2.0","id":55,"result":{"version":"1.0"}}\n\n', { status: 200, headers: { 'Content-Type': 'text/event-stream' } });
+        };
+        const requestLine = '{"jsonrpc":"2.0","id":55,"method":"initialize"}';
+        const results = await forwardJsonRpc({
+            line: requestLine,
+            remoteUrl: 'https://mcp.example.com',
+            headers: { Authorization: 'Bearer test_token', 'X-Custom-App': 'Antigravity' },
+            fetchFn: mockFetch
+        });
+        assert.strictEqual(results.length, 1);
+        assert.strictEqual(JSON.parse(results[0]).id, 55);
+        assert.strictEqual(capturedMethod, 'POST');
+        assert.strictEqual(capturedBody, requestLine);
+        const headersRecord = capturedHeaders;
+        assert.strictEqual(headersRecord['Authorization'], 'Bearer test_token');
+        assert.strictEqual(headersRecord['X-Custom-App'], 'Antigravity');
+        assert.strictEqual(headersRecord['Accept'], 'application/json, text/event-stream');
+        assert.strictEqual(headersRecord['Content-Type'], 'application/json');
+    });
+    it('forwardJsonRpc should wrap remote HTTP error status into standard JSON-RPC 2.0 error', async () => {
+        const mockFetch = async () => {
+            return new Response('Unauthorized access token', { status: 401 });
+        };
+        const requestLine = '{"jsonrpc":"2.0","id":999,"method":"tools/call"}';
+        const results = await forwardJsonRpc({
+            line: requestLine,
+            remoteUrl: 'https://mcp.example.com',
+            headers: {},
+            fetchFn: mockFetch
+        });
+        assert.strictEqual(results.length, 1);
+        const parsed = JSON.parse(results[0]);
+        assert.strictEqual(parsed.id, 999, 'Must preserve client request id in error response');
+        assert.strictEqual(parsed.error.code, -32603);
+        assert.ok(parsed.error.message.includes('HTTP 401'));
+        assert.ok(parsed.error.message.includes('Unauthorized access token'));
+    });
+    it('forwardJsonRpc should wrap network connection failures into standard JSON-RPC error', async () => {
+        const mockFailingFetch = async () => {
+            throw new Error('ECONNREFUSED connect 127.0.0.1:9999');
+        };
+        const requestLine = '{"jsonrpc":"2.0","id":"req_abc","method":"ping"}';
+        const results = await forwardJsonRpc({
+            line: requestLine,
+            remoteUrl: 'https://mcp.example.com',
+            headers: {},
+            fetchFn: mockFailingFetch
+        });
+        assert.strictEqual(results.length, 1);
+        const parsed = JSON.parse(results[0]);
+        assert.strictEqual(parsed.id, 'req_abc');
+        assert.strictEqual(parsed.error.code, -32603);
+        assert.ok(parsed.error.message.includes('ECONNREFUSED'));
+    });
+    it('startProxy should continuously pipe stdin requests to stdout responses', async () => {
+        const inputLines = [
+            '',
+            '   ',
+            '{"jsonrpc":"2.0","id":1,"method":"ping"}',
+            '{"jsonrpc":"2.0","id":2,"method":"tools/list"}'
+        ];
+        const inputStream = Readable.from(inputLines.join('\n') + '\n');
+        const outputChunks = [];
+        const outputStream = new Writable({
+            write(chunk, _encoding, callback) {
+                outputChunks.push(chunk.toString());
+                callback();
+            }
+        });
+        const mockFetch = async (_input, init) => {
+            const parsed = JSON.parse(init?.body);
+            return new Response(`event: message\ndata: {"jsonrpc":"2.0","id":${parsed.id},"result":{"pong":true}}\n\n`, { status: 200 });
+        };
+        await startProxy({
+            remoteUrl: 'https://mcp.example.com',
+            getToken: async () => 'active_session_token',
+            input: inputStream,
+            output: outputStream,
+            fetchFn: mockFetch
+        });
+        const output = outputChunks.join('');
+        assert.ok(output.includes('{"jsonrpc":"2.0","id":1,"result":{"pong":true}}'));
+        assert.ok(output.includes('{"jsonrpc":"2.0","id":2,"result":{"pong":true}}'));
+        assert.ok(output.endsWith('\n'), 'Each response line must terminate with newline');
+    });
+    it('startProxy should handle unexpected token retrieval error and emit JSON-RPC error', async () => {
+        const inputStream = Readable.from('{"jsonrpc":"2.0","id":88,"method":"tools/call"}\n');
+        const outputChunks = [];
+        const errorLogs = [];
+        const outputStream = new Writable({
+            write(chunk, _encoding, callback) {
+                outputChunks.push(chunk.toString());
+                callback();
+            }
+        });
+        await startProxy({
+            remoteUrl: 'https://mcp.example.com',
+            getToken: async () => {
+                throw new Error('OAuth consent rejected by user');
+            },
+            input: inputStream,
+            output: outputStream,
+            logError: (msg) => errorLogs.push(msg)
+        });
+        const output = outputChunks.join('');
+        const parsed = JSON.parse(output.trim());
+        assert.strictEqual(parsed.id, 88);
+        assert.strictEqual(parsed.error.code, -32603);
+        assert.ok(parsed.error.message.includes('OAuth consent rejected by user'));
+        assert.ok(errorLogs.some((l) => l.includes('OAuth consent rejected')));
+    });
+});

package/dist/tests/smoke.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/smoke.test.js

@@ -0,0 +1,8 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert';
+import { VERSION } from '../src/index.js';
+describe('Boilerplate Smoke Test', () => {
+    it('should export correct version', () => {
+        assert.strictEqual(VERSION, '1.0.1');
+    });
+});

package/dist/tests/store/token-store.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/store/token-store.test.js

@@ -0,0 +1,218 @@
+import { describe, it, beforeEach, afterEach } from 'node:test';
+import assert from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { TokenStore } from '../../src/store/token-store.js';
+describe('TokenStore & Silent Refresh Logic', () => {
+    const tempDir = path.join(os.tmpdir(), `mcp-token-store-test-${Date.now()}-${Math.random()}`);
+    const storeFilePath = path.join(tempDir, 'tokens.json');
+    let store;
+    beforeEach(() => {
+        fs.mkdirSync(tempDir, { recursive: true });
+        store = new TokenStore(storeFilePath);
+    });
+    afterEach(() => {
+        fs.rmSync(tempDir, { recursive: true, force: true });
+    });
+    it('should persist and retrieve tokens across different resources independently', () => {
+        store.saveToken('https://mcp.alpha.com', {
+            accessToken: 'token_alpha',
+            refreshToken: 'refresh_alpha',
+            expiresAt: Date.now() + 3600_000,
+            tokenType: 'Bearer',
+            scope: 'read'
+        });
+        store.saveToken('https://mcp.beta.com', {
+            accessToken: 'token_beta',
+            expiresAt: Date.now() + 7200_000
+        });
+        const alpha = store.getToken('https://mcp.alpha.com');
+        const beta = store.getToken('https://mcp.beta.com');
+        const gamma = store.getToken('https://mcp.gamma.com');
+        assert.strictEqual(alpha?.accessToken, 'token_alpha');
+        assert.strictEqual(alpha?.refreshToken, 'refresh_alpha');
+        assert.strictEqual(alpha?.scope, 'read');
+        assert.strictEqual(beta?.accessToken, 'token_beta');
+        assert.strictEqual(beta?.refreshToken, undefined);
+        assert.strictEqual(gamma, null);
+    });
+    it('should handle missing or corrupted JSON file gracefully without throwing', () => {
+        const freshStore = new TokenStore(path.join(tempDir, 'does-not-exist.json'));
+        assert.strictEqual(freshStore.getToken('any'), null);
+        const corruptPath = path.join(tempDir, 'corrupt.json');
+        fs.writeFileSync(corruptPath, '{ malformed json: not valid !!');
+        const corruptStore = new TokenStore(corruptPath);
+        assert.strictEqual(corruptStore.getToken('any'), null);
+    });
+    it('should detect tokens expiring within customizable buffer threshold', () => {
+        const now = Date.now();
+        const expiringIn3Min = { accessToken: 'a', expiresAt: now + 180_000 };
+        const expiringIn7Min = { accessToken: 'b', expiresAt: now + 420_000 };
+        // Default 5-minute buffer (300,000ms)
+        assert.strictEqual(store.isExpiringSoon(expiringIn3Min), true);
+        assert.strictEqual(store.isExpiringSoon(expiringIn7Min), false);
+        // Custom 10-minute buffer (600,000ms)
+        assert.strictEqual(store.isExpiringSoon(expiringIn7Min, 600_000), true);
+    });
+    it('refreshToken should exchange refresh_token for a new access_token and update storage', async () => {
+        const resource = 'https://mcp.example.com';
+        const tokenEndpoint = 'https://api.example.com/oauth/token';
+        const clientId = 'client_xyz';
+        store.saveToken(resource, {
+            accessToken: 'stale_token',
+            refreshToken: 'current_refresh_token',
+            expiresAt: Date.now() + 60_000
+        });
+        let requestBody;
+        const mockFetch = async (_input, init) => {
+            requestBody = new URLSearchParams(init?.body);
+            return new Response(JSON.stringify({
+                access_token: 'freshly_refreshed_access_token',
+                refresh_token: 'rotated_refresh_token',
+                expires_in: 3600,
+                token_type: 'Bearer'
+            }), { status: 200, headers: { 'Content-Type': 'application/json' } });
+        };
+        const newAccessToken = await store.refreshToken({
+            resource,
+            tokenEndpoint,
+            clientId,
+            fetchFn: mockFetch,
+            log: () => { }
+        });
+        assert.strictEqual(newAccessToken, 'freshly_refreshed_access_token');
+        assert.strictEqual(requestBody?.get('grant_type'), 'refresh_token');
+        assert.strictEqual(requestBody?.get('refresh_token'), 'current_refresh_token');
+        assert.strictEqual(requestBody?.get('client_id'), clientId);
+        const updated = store.getToken(resource);
+        assert.strictEqual(updated?.accessToken, 'freshly_refreshed_access_token');
+        assert.strictEqual(updated?.refreshToken, 'rotated_refresh_token');
+        assert.ok(updated.expiresAt > Date.now() + 3500_000);
+    });
+    it('refreshToken should return null when refresh_token is missing or revoked', async () => {
+        const resource = 'https://mcp.example.com';
+        store.saveToken(resource, {
+            accessToken: 'token_no_refresh',
+            expiresAt: Date.now() + 60_000
+        });
+        const res1 = await store.refreshToken({
+            resource,
+            tokenEndpoint: 'https://auth.com/token',
+            clientId: 'id',
+            log: () => { }
+        });
+        assert.strictEqual(res1, null, 'Should return null when token has no refresh_token');
+        // Server returns 400 invalid_grant
+        store.saveToken(resource, {
+            accessToken: 'token',
+            refreshToken: 'bad_refresh',
+            expiresAt: Date.now() + 60_000
+        });
+        const mockFetch400 = async () => new Response('invalid_grant', { status: 400 });
+        const res2 = await store.refreshToken({
+            resource,
+            tokenEndpoint: 'https://auth.com/token',
+            clientId: 'id',
+            fetchFn: mockFetch400,
+            log: () => { }
+        });
+        assert.strictEqual(res2, null, 'Should return null when server rejects refresh request');
+    });
+    it('getOrRefreshToken should return valid token without network call if not expiring soon', async () => {
+        const resource = 'https://mcp.example.com';
+        store.saveToken(resource, {
+            accessToken: 'long_lived_token',
+            expiresAt: Date.now() + 1800_000 // 30 mins
+        });
+        let networkHit = false;
+        const mockFetch = async () => {
+            networkHit = true;
+            return new Response('{}');
+        };
+        const token = await store.getOrRefreshToken({
+            resource,
+            tokenEndpoint: 'https://auth.com/token',
+            clientId: 'id',
+            fetchFn: mockFetch,
+            log: () => { }
+        });
+        assert.strictEqual(token, 'long_lived_token');
+        assert.strictEqual(networkHit, false, 'Must not make HTTP request when token is still valid');
+    });
+    it('getOrRefreshToken should fallback to unexpired token if silent refresh fails', async () => {
+        const resource = 'https://mcp.example.com';
+        store.saveToken(resource, {
+            accessToken: 'still_working_for_2_minutes',
+            refreshToken: 'broken_refresh',
+            expiresAt: Date.now() + 120_000 // 2 mins remaining (< 5m buffer, but > 0s)
+        });
+        const mockFailingFetch = async () => new Response('Server Error', { status: 500 });
+        const token = await store.getOrRefreshToken({
+            resource,
+            tokenEndpoint: 'https://auth.com/token',
+            clientId: 'id',
+            fetchFn: mockFailingFetch,
+            log: () => { }
+        });
+        assert.strictEqual(token, 'still_working_for_2_minutes', 'Should fallback to remaining validity');
+    });
+    it('refreshToken should prioritize persisted clientId over options.clientId and preserve it in storage', async () => {
+        const resource = 'https://mcp.bound-client.com';
+        const tokenEndpoint = 'https://api.bound-client.com/oauth/token';
+        store.saveToken(resource, {
+            accessToken: 'old_token',
+            refreshToken: 'bound_refresh_token',
+            expiresAt: Date.now() + 60_000,
+            clientId: 'original_persisted_client_id'
+        });
+        let sentClientId = null;
+        const mockFetch = async (_input, init) => {
+            const params = new URLSearchParams(init?.body);
+            sentClientId = params.get('client_id');
+            return new Response(JSON.stringify({
+                access_token: 'new_token_refreshed',
+                expires_in: 3600
+            }), { status: 200, headers: { 'Content-Type': 'application/json' } });
+        };
+        // Even if options passes a different clientId, stored clientId MUST take precedence!
+        const result = await store.refreshToken({
+            resource,
+            tokenEndpoint,
+            clientId: 'different_new_client_id',
+            fetchFn: mockFetch,
+            log: () => { }
+        });
+        assert.strictEqual(result, 'new_token_refreshed');
+        assert.strictEqual(sentClientId, 'original_persisted_client_id', 'Must use persisted clientId tied to refresh token');
+        const updated = store.getToken(resource);
+        assert.strictEqual(updated?.clientId, 'original_persisted_client_id', 'Must preserve persisted clientId after refresh');
+    });
+    it('getOrRefreshToken should use stored clientId during silent refresh when clientId option is omitted', async () => {
+        const resource = 'https://mcp.silent.com';
+        const tokenEndpoint = 'https://api.silent.com/oauth/token';
+        store.saveToken(resource, {
+            accessToken: 'expiring_token',
+            refreshToken: 'my_refresh_token',
+            expiresAt: Date.now() + 60_000, // < 5m buffer
+            clientId: 'stored_pkce_client_id'
+        });
+        let sentClientId = null;
+        const mockFetch = async (_input, init) => {
+            const params = new URLSearchParams(init?.body);
+            sentClientId = params.get('client_id');
+            return new Response(JSON.stringify({
+                access_token: 'refreshed_access_token',
+                expires_in: 7200
+            }), { status: 200, headers: { 'Content-Type': 'application/json' } });
+        };
+        const token = await store.getOrRefreshToken({
+            resource,
+            tokenEndpoint,
+            fetchFn: mockFetch,
+            log: () => { }
+        });
+        assert.strictEqual(token, 'refreshed_access_token');
+        assert.strictEqual(sentClientId, 'stored_pkce_client_id');
+    });
+});

package/package.json

@@ -1,6 +1,52 @@
 {
   "name": "@thuyphuocthinh/mcp-auth-proxy",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.1",
+  "description": "Zero-config Stdio to Streamable HTTP MCP runtime proxy with automatic OAuth PKCE & silent refresh",
+  "type": "module",
+  "main": "./dist/src/index.js",
+  "bin": {
+    "mcp-auth-proxy": "./bin/cli.js",
+    "mcp-oauth-proxy": "./bin/cli.js"
+  },
+  "files": [
+    "dist",
+    "bin",
+    "README.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/thuyphuocthinh/mcp-auth-proxy.git"
+  },
+  "bugs": {
+    "url": "https://github.com/thuyphuocthinh/mcp-auth-proxy/issues"
+  },
+  "homepage": "https://github.com/thuyphuocthinh/mcp-auth-proxy#readme",
+  "scripts": {
+    "build": "tsc",
+    "start": "node ./bin/cli.js",
+    "test": "node --test dist/**/*.test.js",
+    "prepack": "npm run build"
+  },
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "oauth",
+    "pkce",
+    "proxy",
+    "stdio",
+    "ai-agent",
+    "antigravity",
+    "cursor",
+    "claude"
+  ],
+  "author": "Thuy Phuoc Thinh",
+  "license": "MIT",
+  "devDependencies": {
+    "@types/node": "^22.10.1",
+    "typescript": "^5.7.2"
+  }
+}