@vidofy/mcp 0.1.0

package/dist/oauth/token.js

@@ -0,0 +1,165 @@
+/**
+ * `POST /mcp-app/token` — the authorization code becomes an access token.
+ *
+ * This is the only place a credential leaves the server, so everything it checks
+ * is a precondition for handing one over:
+ *
+ *   1. the code exists and has not been used   (GETDEL — one code, one token)
+ *   2. the client asking is the client the code was issued to
+ *   3. the redirect_uri matches the one bound to the code
+ *   4. PKCE: SHA256(code_verifier) equals the challenge recorded at /authorize
+ *
+ * PKCE IS THE WHOLE PROTECTION HERE
+ * ---------------------------------
+ * The code travels through the user's browser — in a URL, through history, past
+ * whatever extensions are installed. Anyone who captures it could exchange it,
+ * and the client authenticates with `none` (a public client has no secret to
+ * prove itself with). What stops the exchange is that the thief does not have
+ * the verifier: it never left the client. So this check is not defence in depth,
+ * it is the door.
+ *
+ * WHY THERE IS NO TOKEN GENERATION IN THIS FILE
+ * ---------------------------------------------
+ * The `vmt_` token was minted by the site when the user approved, and rides in
+ * the code record. The site owns the credential format, the hash, the scope and
+ * the expiry; a second implementation here would be a second definition of one
+ * credential.
+ */
+import { createHash, timingSafeEqual } from 'node:crypto';
+import { consumeCode } from './store.js';
+/** Read a urlencoded body, capped — a token request is a few hundred bytes. */
+async function readForm(req) {
+    const MAX = 8 * 1024;
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        const b = chunk;
+        size += b.length;
+        if (size > MAX)
+            throw new Error('body too large');
+        chunks.push(b);
+    }
+    return new URLSearchParams(Buffer.concat(chunks).toString('utf8'));
+}
+function fail(res, status, error, description) {
+    /* RFC 6749 §5.2: the token endpoint's errors are JSON with no-store, and the
+       status matters — a client distinguishes "your code is bad" (400) from
+       "come back later". */
+    res.writeHead(status, {
+        'content-type': 'application/json; charset=utf-8',
+        'cache-control': 'no-store',
+        pragma: 'no-cache',
+    });
+    res.end(JSON.stringify({ error, error_description: description }));
+}
+/** Constant-time compare of two base64url strings, safe on length mismatch. */
+function sameSecret(a, b) {
+    const ab = Buffer.from(a, 'utf8');
+    const bb = Buffer.from(b, 'utf8');
+    /* timingSafeEqual throws when the lengths differ, and returning early on
+       that is fine: the length of a PKCE challenge is not the secret. */
+    if (ab.length !== bb.length)
+        return false;
+    return timingSafeEqual(ab, bb);
+}
+export async function handleToken(req, res) {
+    if (req.method !== 'POST') {
+        fail(res, 405, 'invalid_request', 'The token endpoint accepts POST.');
+        return;
+    }
+    let form;
+    try {
+        form = await readForm(req);
+    }
+    catch {
+        fail(res, 400, 'invalid_request', 'Request body could not be read.');
+        return;
+    }
+    const get = (k) => (form.get(k) ?? '').trim();
+    if (get('grant_type') !== 'authorization_code') {
+        /* The RFC's own code for this, and the reason we advertise only
+           authorization_code: there is no refresh token to grant. */
+        fail(res, 400, 'unsupported_grant_type', 'Only grant_type=authorization_code is supported.');
+        return;
+    }
+    const code = get('code');
+    const verifier = get('code_verifier');
+    const clientId = get('client_id');
+    const redirectUri = get('redirect_uri');
+    if (code === '' || verifier === '') {
+        fail(res, 400, 'invalid_request', 'code and code_verifier are required.');
+        return;
+    }
+    /* Consumed before anything is validated, deliberately.
+     *
+     * A code that fails any check below is burned either way — OAuth 2.1 says a
+     * code must not be reusable, and a failed attempt is the clearest sign it
+     * may have been stolen. Validating first and deleting after would leave a
+     * stolen code alive for as many guesses as the attacker wants. */
+    const issued = await consumeCode(code);
+    if (issued === null) {
+        fail(res, 400, 'invalid_grant', 'The authorization code is invalid or expired.');
+        return;
+    }
+    /* The client must be the one the code belongs to, and the redirect_uri must be
+     * the one the code was bound to. Since these are public clients with no
+     * secret, client_id is all there is to compare.
+     *
+     * ⚠ BOTH CHECKS USED TO BE OPTIONAL, and the comments that stood here stated
+     * the requirement while the code declined to enforce it: they read
+     * `clientId !== '' && clientId !== issued.clientId`, so a token request that
+     * simply OMITTED client_id and redirect_uri skipped both. RFC 6749 §4.1.3
+     * makes client_id REQUIRED for a public client precisely so a code cannot be
+     * redeemed by whoever holds it.
+     *
+     * That permissive branch served no case anyone could name — the measured
+     * clients (claude.ai and ChatGPT) both send client_id, and the project's rule
+     * is that a lenient branch must prove the case it exists for or fail closed.
+     * It now fails closed. */
+    if (clientId === '') {
+        fail(res, 400, 'invalid_request', 'client_id is required.');
+        return;
+    }
+    if (clientId !== issued.clientId) {
+        fail(res, 400, 'invalid_grant', 'The code was not issued to this client.');
+        return;
+    }
+    if (redirectUri === '') {
+        fail(res, 400, 'invalid_request', 'redirect_uri is required.');
+        return;
+    }
+    if (redirectUri !== issued.redirectUri) {
+        fail(res, 400, 'invalid_grant', 'redirect_uri does not match the authorization request.');
+        return;
+    }
+    /* PKCE S256: BASE64URL(SHA256(ASCII(verifier))) must equal the challenge. */
+    const computed = createHash('sha256').update(verifier, 'ascii').digest('base64url');
+    if (!sameSecret(computed, issued.codeChallenge)) {
+        fail(res, 400, 'invalid_grant', 'code_verifier does not match the challenge.');
+        return;
+    }
+    /* ── Everything checked. Hand over the token. ────────────────────────────
+     *
+     * No `refresh_token`, by decision and with the spec's blessing: "MCP Clients
+     * MUST NOT assume refresh tokens will be issued; the AS retains discretion".
+     * The access token is long-lived instead, and `expires_in` says so honestly
+     * rather than implying forever.
+     *
+     * One year, matching the expiry the site stamped on the row. The two are
+     * written in two places and that is a drift risk worth naming: if the
+     * site's '+1 year' changes, this number must change with it. */
+    const ONE_YEAR_SECONDS = 365 * 24 * 60 * 60;
+    res.writeHead(200, {
+        'content-type': 'application/json; charset=utf-8',
+        // Required by RFC 6749 §5.1 — a cached token response is a leaked token.
+        'cache-control': 'no-store',
+        pragma: 'no-cache',
+    });
+    res.end(JSON.stringify({
+        access_token: issued.rawToken,
+        token_type: 'Bearer',
+        expires_in: ONE_YEAR_SECONDS,
+        scope: issued.scope,
+    }));
+}
+//# sourceMappingURL=token.js.map

package/dist/schema.d.ts

@@ -0,0 +1,147 @@
+/**
+ * Turn one model's admin-authored `m_options` into a JSON Schema an agent can
+ * fill in, plus the wire names needed to actually submit it.
+ *
+ * This is the widest surface in the package. A human wrote the options for every
+ * model in the catalogue, so the rule here is: describe only what the data
+ * actually contains, and stay silent rather than invent. A property this file
+ * omits costs the agent a feature; a property it invents costs the user a
+ * rejected generation they already waited for.
+ *
+ * SHAPES, MEASURED ACROSS THE WHOLE ACTIVE CATALOGUE — not read off the docs:
+ *   m_aspect_ratio        ARRAY   all     (often empty)
+ *   m_resolution_quality  ARRAY   all     (often empty)
+ *   m_duration            OBJECT  some    KEYS are the durations; each value is
+ *                                         the list of resolutions that duration
+ *                                         allows ({"5": [], "10": []} = any)
+ *   m_output_number       INTEGER all
+ *   m_dynamic_fields      ARRAY   all     a long tail of field names
+ *   m_multi_upload        OBJECT  all     8 key sets, TWO families (see below)
+ *   m_negative_prompt / m_seed / m_generate_audio /
+ *   m_camera_fixed / m_enhance_prompt        all BOOLEAN
+ *
+ * DYNAMIC FIELD TYPES IN USE — only five, though the docs list nine:
+ *   radio_group · select · toggle · slider · file_upload_image
+ * Unknown types degrade to a string rather than throwing: a model added
+ * tomorrow must not break the whole catalogue.
+ */
+/** Minimal JSON Schema draft-07 subset — everything this file emits. */
+export interface JsonSchemaProperty {
+    type: 'string' | 'number' | 'integer' | 'boolean';
+    description?: string;
+    enum?: Array<string | number>;
+    default?: string | number | boolean;
+    minimum?: number;
+    maximum?: number;
+    multipleOf?: number;
+}
+export interface FileInput {
+    /** The name the agent uses. */
+    name: string;
+    /** The multipart field the server reads. */
+    wire: string;
+    required: boolean;
+    accepts: string[];
+    maxSizeMb: number | null;
+    maxDurationSec: number | null;
+    description: string;
+    /**
+     * Whether this slot accepts `{"from_generation": "<id>"}` instead of a path.
+     *
+     * Not a property of the slot but of the SERVER: reuse travels in
+     * regen_source_map, and the submit path keeps a whitelist of field names it
+     * will honour — m_image, m_video,
+     * m_audio, m_first_frame, m_last_frame, m_multi_file_N, and any dynamic
+     * file field by its own name. A name outside it is dropped in silence, so
+     * the job runs with no input and 422s on a slot the agent believes it
+     * filled. The per-type multi slots (m_multi_<type>_file_N) are the ones
+     * that fall outside, and get_model now says so instead of leaving it to be
+     * discovered by spending credits.
+     */
+    supportsReuse: boolean;
+}
+export interface ModelSchema {
+    model_key: string;
+    /**
+     * The scene identifier for an effect model, '' for everything else.
+     *
+     * A large share of the catalogue are effect models, and this is what tells
+     * the price handler and the worker WHICH effect. Sent on the wire, never
+     * shown as an agent-facing input: it is a property of the model the agent
+     * already chose, not a decision it makes.
+     */
+    effect_key: string;
+    slug: string;
+    name: string;
+    /**
+     * Absolute URL of the provider's logo, or '' when the row has none.
+     *
+     * Served from the site's own origin, not the CDN — the server prefixes the
+     * stored relative path with its own origin before returning it. Every
+     * active model carries one (measured), so a card can label a generation
+     * with the mark of whoever made it instead of a coloured placeholder.
+     */
+    icon: string;
+    /** Short code (t2v) — what the agent sees and what list_models accepts. */
+    mode: string;
+    /** Long key (text-to-video) — what m_mode means on the wire. Not for display. */
+    mode_wire: string;
+    media_type: string;
+    /**
+     * FLOOR, not price: the cheapest this model can cost across every option
+     * combination — the "from X credits" badge the website shows on its model
+     * picker. It is the model row's `m_coins`, which the server computes by
+     * pricing the whole option grid and taking the minimum.
+     *
+     * The real price of a specific request is routinely a MULTIPLE of it — a
+     * high resolution on the same model can cost several times the floor.
+     * Named `_from` because the bare word
+     * `credits` reads as "the price", and an agent that reports it as one
+     * quotes the user a number they will not be charged.
+     *
+     * Only estimate_cost answers what a given input costs.
+     */
+    credits_from: number | null;
+    estimated_seconds: number | null;
+    inputSchema: {
+        type: 'object';
+        properties: Record<string, JsonSchemaProperty>;
+        required: string[];
+        additionalProperties: false;
+    };
+    /** clean name → the m_* form field the server actually reads. */
+    wire: Record<string, string>;
+    files: FileInput[];
+    /**
+     * This model is billed by the DURATION OF THE MEDIA THE USER UPLOADS, not
+     * by the settings alone.
+     *
+     * It matters because estimate_cost never sends the file — the pricing
+     * endpoint receives no upload and would discard one — so for these models
+     * the quote covers the settings and the real charge is higher. Saying so
+     * is the difference between a price and a number.
+     *
+     * Read from m_pricing_mode, which the server DERIVES for this purpose: the
+     * model-info endpoint runs the same pricing resolver the
+     * submit path uses for its ffprobe gate, and normalises the answer into
+     * m_pricing_mode='per_second' whether it came from m_pricing_rules or the
+     * legacy m_options gate. So one field covers both, and it cannot drift
+     * from what is actually charged.
+     *
+     * Measured over the whole active catalogue: the field a client sees agrees
+     * with the resolver everywhere. A minority are upload-billed, and some of
+     * those are invisible in the raw m_options — reading the raw option blob
+     * instead of the served field would have been silently wrong for them.
+     */
+    billedByUploadDuration: boolean;
+    /** Things the agent must know that a schema cannot express. */
+    notes: string[];
+}
+/**
+ * @param payload The whole `/info/model-info/{slug}` body. The B2C door wraps
+ *   the model under `.model` with m_-prefixed keys; the B2B door returns the
+ *   options flat and unprefixed. Both are accepted, and which one arrived is
+ *   decided by the PAYLOAD, never by the configured mode — a status lookup can
+ *   legitimately return the other shape.
+ */
+export declare function buildModelSchema(payload: unknown): ModelSchema;