@wukongcrm/mcp-server 0.1.4 → 0.2.0

package/dist/oauth-state.d.ts

@@ -0,0 +1,94 @@
+import type { OAuthRegisteredClientsStore } from "@modelcontextprotocol/sdk/server/auth/clients.js";
+import type { OAuthClientInformationFull } from "@modelcontextprotocol/sdk/shared/auth.js";
+export type RegisterableClient = Omit<OAuthClientInformationFull, "client_id" | "client_id_issued_at"> & {
+    client_id?: string;
+    client_id_issued_at?: number;
+};
+export interface OAuthStateStore extends OAuthRegisteredClientsStore {
+    readonly kind: "file" | "redis";
+    initialize(): Promise<void>;
+    close(): Promise<void>;
+    revoke(jti: string, expiresAt: number): Promise<void>;
+    isRevoked(jti: string): Promise<boolean>;
+    setPendingAuthorization(requestId: string, value: string, expiresAt: number): Promise<void>;
+    getPendingAuthorization(requestId: string): Promise<string | undefined>;
+    deletePendingAuthorization(requestId: string): Promise<void>;
+    setAuthorizationCode(code: string, value: string, expiresAt: number): Promise<void>;
+    getAuthorizationCode(code: string): Promise<string | undefined>;
+    consumeAuthorizationCode(code: string): Promise<string | undefined>;
+}
+export declare class FileOAuthState implements OAuthStateStore {
+    readonly kind: "file";
+    private readonly filePath;
+    private readonly clients;
+    private readonly revoked;
+    private readonly pendingAuthorizations;
+    private readonly authorizationCodes;
+    private readonly ready;
+    private persistQueue;
+    constructor(dataDirectory: string);
+    initialize(): Promise<void>;
+    close(): Promise<void>;
+    getClient(clientId: string): Promise<OAuthClientInformationFull | undefined>;
+    registerClient(client: RegisterableClient): Promise<OAuthClientInformationFull>;
+    revoke(jti: string, expiresAt: number): Promise<void>;
+    isRevoked(jti: string): Promise<boolean>;
+    setPendingAuthorization(requestId: string, value: string, expiresAt: number): Promise<void>;
+    getPendingAuthorization(requestId: string): Promise<string | undefined>;
+    deletePendingAuthorization(requestId: string): Promise<void>;
+    setAuthorizationCode(code: string, value: string, expiresAt: number): Promise<void>;
+    getAuthorizationCode(code: string): Promise<string | undefined>;
+    consumeAuthorizationCode(code: string): Promise<string | undefined>;
+    private setExpiringValue;
+    private getExpiringValue;
+    private deleteExpiringValue;
+    private load;
+    private loadExpiringValues;
+    private removeExpiredState;
+    private persist;
+}
+interface RedisSetOptions {
+    EX?: number;
+    PX?: number;
+}
+export interface RedisOAuthClient {
+    readonly isOpen?: boolean;
+    connect(): Promise<unknown>;
+    quit(): Promise<unknown>;
+    on(event: string, listener: (error: Error) => void): unknown;
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string, options?: RedisSetOptions): Promise<unknown>;
+    del(key: string): Promise<number>;
+    sendCommand(args: string[]): Promise<unknown>;
+}
+export interface RedisOAuthStateOptions {
+    url: string;
+    keyPrefix?: string;
+    connectTimeoutMs?: number;
+    client?: RedisOAuthClient;
+}
+export declare class RedisOAuthState implements OAuthStateStore {
+    readonly kind: "redis";
+    private readonly client;
+    private readonly keyPrefix;
+    private connectPromise?;
+    constructor(options: RedisOAuthStateOptions);
+    initialize(): Promise<void>;
+    close(): Promise<void>;
+    getClient(clientId: string): Promise<OAuthClientInformationFull | undefined>;
+    registerClient(client: RegisterableClient): Promise<OAuthClientInformationFull>;
+    revoke(jti: string, expiresAt: number): Promise<void>;
+    isRevoked(jti: string): Promise<boolean>;
+    setPendingAuthorization(requestId: string, value: string, expiresAt: number): Promise<void>;
+    getPendingAuthorization(requestId: string): Promise<string | undefined>;
+    deletePendingAuthorization(requestId: string): Promise<void>;
+    setAuthorizationCode(code: string, value: string, expiresAt: number): Promise<void>;
+    getAuthorizationCode(code: string): Promise<string | undefined>;
+    consumeAuthorizationCode(code: string): Promise<string | undefined>;
+    private setExpiringValue;
+    private get;
+    private set;
+    private delete;
+    private key;
+}
+export {};

package/dist/oauth-state.js

@@ -0,0 +1,310 @@
+import { createHash, randomUUID } from "node:crypto";
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { createClient } from "redis";
+export class FileOAuthState {
+    kind = "file";
+    filePath;
+    clients = new Map();
+    revoked = new Map();
+    pendingAuthorizations = new Map();
+    authorizationCodes = new Map();
+    ready;
+    persistQueue = Promise.resolve();
+    constructor(dataDirectory) {
+        this.filePath = path.join(dataDirectory, "oauth-state.json");
+        this.ready = this.load();
+    }
+    async initialize() {
+        await this.ready;
+    }
+    async close() {
+        await this.ready;
+        await this.persistQueue;
+    }
+    async getClient(clientId) {
+        await this.ready;
+        return this.clients.get(clientId);
+    }
+    async registerClient(client) {
+        await this.ready;
+        const now = Math.floor(Date.now() / 1000);
+        const fullClient = {
+            ...client,
+            client_id: client.client_id ?? randomUUID(),
+            client_id_issued_at: client.client_id_issued_at ?? now
+        };
+        this.clients.set(fullClient.client_id, fullClient);
+        await this.persist();
+        return fullClient;
+    }
+    async revoke(jti, expiresAt) {
+        await this.ready;
+        this.removeExpiredState();
+        if (expiresAt > Math.floor(Date.now() / 1000)) {
+            this.revoked.set(jti, expiresAt);
+        }
+        await this.persist();
+    }
+    async isRevoked(jti) {
+        await this.ready;
+        const changed = this.removeExpiredState();
+        if (changed) {
+            await this.persist();
+        }
+        return this.revoked.has(jti);
+    }
+    async setPendingAuthorization(requestId, value, expiresAt) {
+        await this.setExpiringValue(this.pendingAuthorizations, requestId, value, expiresAt);
+    }
+    async getPendingAuthorization(requestId) {
+        return this.getExpiringValue(this.pendingAuthorizations, requestId);
+    }
+    async deletePendingAuthorization(requestId) {
+        await this.deleteExpiringValue(this.pendingAuthorizations, requestId);
+    }
+    async setAuthorizationCode(code, value, expiresAt) {
+        await this.setExpiringValue(this.authorizationCodes, code, value, expiresAt);
+    }
+    async getAuthorizationCode(code) {
+        return this.getExpiringValue(this.authorizationCodes, code);
+    }
+    async consumeAuthorizationCode(code) {
+        await this.ready;
+        const entry = this.authorizationCodes.get(code);
+        if (!entry) {
+            return undefined;
+        }
+        this.authorizationCodes.delete(code);
+        await this.persist();
+        return entry.expiresAt > Date.now() ? entry.value : undefined;
+    }
+    async setExpiringValue(target, key, value, expiresAt) {
+        await this.ready;
+        if (expiresAt > Date.now()) {
+            target.set(key, { value, expiresAt });
+        }
+        else {
+            target.delete(key);
+        }
+        await this.persist();
+    }
+    async getExpiringValue(target, key) {
+        await this.ready;
+        const entry = target.get(key);
+        if (!entry) {
+            return undefined;
+        }
+        if (entry.expiresAt > Date.now()) {
+            return entry.value;
+        }
+        target.delete(key);
+        await this.persist();
+        return undefined;
+    }
+    async deleteExpiringValue(target, key) {
+        await this.ready;
+        if (target.delete(key)) {
+            await this.persist();
+        }
+    }
+    async load() {
+        try {
+            const parsed = JSON.parse(await readFile(this.filePath, "utf8"));
+            for (const [clientId, client] of Object.entries(parsed.clients ?? {})) {
+                if (isValidClient(client, clientId)) {
+                    this.clients.set(clientId, client);
+                }
+            }
+            for (const [jti, expiresAt] of Object.entries(parsed.revoked ?? {})) {
+                if (Number.isFinite(expiresAt)) {
+                    this.revoked.set(jti, expiresAt);
+                }
+            }
+            this.loadExpiringValues(this.pendingAuthorizations, parsed.pendingAuthorizations);
+            this.loadExpiringValues(this.authorizationCodes, parsed.authorizationCodes);
+            this.removeExpiredState();
+        }
+        catch (error) {
+            if (error.code !== "ENOENT") {
+                throw error;
+            }
+        }
+    }
+    loadExpiringValues(target, values) {
+        for (const [key, entry] of Object.entries(values ?? {})) {
+            if (entry && typeof entry.value === "string" && Number.isFinite(entry.expiresAt)) {
+                target.set(key, entry);
+            }
+        }
+    }
+    removeExpiredState() {
+        let changed = false;
+        const nowSeconds = Math.floor(Date.now() / 1000);
+        for (const [jti, expiresAt] of this.revoked) {
+            if (expiresAt <= nowSeconds) {
+                changed = this.revoked.delete(jti) || changed;
+            }
+        }
+        const nowMilliseconds = Date.now();
+        for (const target of [this.pendingAuthorizations, this.authorizationCodes]) {
+            for (const [key, entry] of target) {
+                if (entry.expiresAt <= nowMilliseconds) {
+                    changed = target.delete(key) || changed;
+                }
+            }
+        }
+        return changed;
+    }
+    async persist() {
+        const operation = this.persistQueue.catch(() => undefined).then(async () => {
+            this.removeExpiredState();
+            const directory = path.dirname(this.filePath);
+            await mkdir(directory, { recursive: true });
+            const temporaryPath = `${this.filePath}.${process.pid}.tmp`;
+            const state = {
+                clients: Object.fromEntries(this.clients),
+                revoked: Object.fromEntries(this.revoked),
+                pendingAuthorizations: Object.fromEntries(this.pendingAuthorizations),
+                authorizationCodes: Object.fromEntries(this.authorizationCodes)
+            };
+            await writeFile(temporaryPath, `${JSON.stringify(state, null, 2)}\n`, {
+                encoding: "utf8",
+                mode: 0o600
+            });
+            await rename(temporaryPath, this.filePath);
+        });
+        this.persistQueue = operation;
+        await operation;
+    }
+}
+export class RedisOAuthState {
+    kind = "redis";
+    client;
+    keyPrefix;
+    connectPromise;
+    constructor(options) {
+        const redisUrl = validateRedisUrl(options.url);
+        this.keyPrefix = normalizeKeyPrefix(options.keyPrefix ?? "wukong-mcp:oauth");
+        this.client = options.client ?? createClient({
+            url: redisUrl,
+            socket: {
+                connectTimeout: options.connectTimeoutMs ?? 5_000,
+                reconnectStrategy: (retries) => retries >= 5
+                    ? new Error("Redis OAuth state connection retry limit reached.")
+                    : Math.min(100 * (2 ** retries), 2_000)
+            }
+        });
+        this.client.on("error", (error) => {
+            console.error("Redis OAuth state error:", error.message);
+        });
+    }
+    async initialize() {
+        if (this.client.isOpen) {
+            return;
+        }
+        this.connectPromise ??= this.client.connect().then(() => undefined);
+        await this.connectPromise;
+    }
+    async close() {
+        if (this.client.isOpen) {
+            await this.client.quit();
+        }
+    }
+    async getClient(clientId) {
+        const value = await this.get(this.key("client", clientId));
+        if (!value) {
+            return undefined;
+        }
+        const client = JSON.parse(value);
+        return isValidClient(client, clientId) ? client : undefined;
+    }
+    async registerClient(client) {
+        const now = Math.floor(Date.now() / 1000);
+        const fullClient = {
+            ...client,
+            client_id: client.client_id ?? randomUUID(),
+            client_id_issued_at: client.client_id_issued_at ?? now
+        };
+        await this.set(this.key("client", fullClient.client_id), JSON.stringify(fullClient));
+        return fullClient;
+    }
+    async revoke(jti, expiresAt) {
+        const ttlSeconds = expiresAt - Math.floor(Date.now() / 1000);
+        const key = this.key("revoked", jti);
+        if (ttlSeconds <= 0) {
+            await this.delete(key);
+            return;
+        }
+        await this.set(key, "1", { EX: ttlSeconds });
+    }
+    async isRevoked(jti) {
+        return (await this.get(this.key("revoked", jti))) !== null;
+    }
+    async setPendingAuthorization(requestId, value, expiresAt) {
+        await this.setExpiringValue(this.key("pending", requestId), value, expiresAt);
+    }
+    async getPendingAuthorization(requestId) {
+        return (await this.get(this.key("pending", requestId))) ?? undefined;
+    }
+    async deletePendingAuthorization(requestId) {
+        await this.delete(this.key("pending", requestId));
+    }
+    async setAuthorizationCode(code, value, expiresAt) {
+        await this.setExpiringValue(this.key("code", code), value, expiresAt);
+    }
+    async getAuthorizationCode(code) {
+        return (await this.get(this.key("code", code))) ?? undefined;
+    }
+    async consumeAuthorizationCode(code) {
+        await this.initialize();
+        const value = await this.client.sendCommand(["GETDEL", this.key("code", code)]);
+        return typeof value === "string" ? value : undefined;
+    }
+    async setExpiringValue(key, value, expiresAt) {
+        const ttlMilliseconds = Math.ceil(expiresAt - Date.now());
+        if (ttlMilliseconds <= 0) {
+            await this.delete(key);
+            return;
+        }
+        await this.set(key, value, { PX: ttlMilliseconds });
+    }
+    async get(key) {
+        await this.initialize();
+        return this.client.get(key);
+    }
+    async set(key, value, options) {
+        await this.initialize();
+        await this.client.set(key, value, options);
+    }
+    async delete(key) {
+        await this.initialize();
+        await this.client.del(key);
+    }
+    key(type, identifier) {
+        const digest = createHash("sha256").update(identifier, "utf8").digest("base64url");
+        return `${this.keyPrefix}:${type}:${digest}`;
+    }
+}
+function isValidClient(value, expectedClientId) {
+    if (!value || typeof value !== "object") {
+        return false;
+    }
+    const client = value;
+    return client.client_id === expectedClientId && Array.isArray(client.redirect_uris);
+}
+function validateRedisUrl(value) {
+    const normalized = value.trim();
+    const url = new URL(normalized);
+    if (url.protocol !== "redis:" && url.protocol !== "rediss:") {
+        throw new Error("MCP_REDIS_URL 必须使用 redis:// 或 rediss://。");
+    }
+    return normalized;
+}
+function normalizeKeyPrefix(value) {
+    const normalized = value.trim().replace(/:+$/, "");
+    if (!normalized || /\s/.test(normalized)) {
+        throw new Error("MCP_REDIS_PREFIX 不能为空或包含空白字符。");
+    }
+    return normalized;
+}

package/dist/oauth.d.ts

@@ -1,43 +1,28 @@
-import type { OAuthRegisteredClientsStore } from "@modelcontextprotocol/sdk/server/auth/clients.js";
 import type { OAuthServerProvider, AuthorizationParams } from "@modelcontextprotocol/sdk/server/auth/provider.js";
 import type { AuthInfo } from "@modelcontextprotocol/sdk/server/auth/types.js";
 import type { OAuthClientInformationFull, OAuthTokenRevocationRequest, OAuthTokens } from "@modelcontextprotocol/sdk/shared/auth.js";
 import type { Response } from "express";
-type RegisterableClient = Omit<OAuthClientInformationFull, "client_id" | "client_id_issued_at"> & {
-    client_id?: string;
-    client_id_issued_at?: number;
-};
-export declare class FileOAuthState implements OAuthRegisteredClientsStore {
-    private readonly filePath;
-    private readonly clients;
-    private readonly revoked;
-    private readonly ready;
-    private persistQueue;
-    constructor(dataDirectory: string);
-    getClient(clientId: string): Promise<OAuthClientInformationFull | undefined>;
-    registerClient(client: RegisterableClient): Promise<OAuthClientInformationFull>;
-    revoke(jti: string, expiresAt: number): Promise<void>;
-    isRevoked(jti: string): Promise<boolean>;
-    private load;
-    private removeExpiredRevocations;
-    private persist;
-}
+import { type OAuthStateStore } from "./oauth-state.js";
 export interface WukongOAuthProviderOptions {
     resourceUrl: URL;
     crmBaseUrl?: string;
     crmBindingAuthorizeUrl: URL;
     crmBindingExchangeUrl: URL;
+    crmBindingExchangeAllowHttp?: boolean;
     crmBindingCallbackUrl: URL;
     crmBindingClientId: string;
     crmBindingClientSecret: string;
     secret: string;
     dataDirectory: string;
+    redisUrl?: string;
+    redisKeyPrefix?: string;
+    stateStore?: OAuthStateStore;
     fetchImpl?: typeof fetch;
     accessTokenTtlSeconds?: number;
     refreshTokenTtlSeconds?: number;
 }
 export declare class WukongOAuthProvider implements OAuthServerProvider {
-    readonly clientsStore: FileOAuthState;
+    readonly clientsStore: OAuthStateStore;
     private readonly resourceUrl;
     private readonly crmBaseUrl?;
     private readonly fetchImpl?;
@@ -49,9 +34,9 @@ export declare class WukongOAuthProvider implements OAuthServerProvider {
     private readonly encryptionKey;
     private readonly accessTokenTtlSeconds;
     private readonly refreshTokenTtlSeconds;
-    private readonly pendingAuthorizations;
-    private readonly authorizationCodes;
     constructor(options: WukongOAuthProviderOptions);
+    initialize(): Promise<void>;
+    close(): Promise<void>;
     authorize(client: OAuthClientInformationFull, params: AuthorizationParams, res: Response): Promise<void>;
     completeBindingAuthorization(requestId: string, bindingCode: string): Promise<string>;
     private exchangeBindingCode;
@@ -61,11 +46,14 @@ export declare class WukongOAuthProvider implements OAuthServerProvider {
     verifyAccessToken(token: string): Promise<AuthInfo>;
     revokeToken(client: OAuthClientInformationFull, request: OAuthTokenRevocationRequest): Promise<void>;
     private getAuthorizationCode;
+    private consumeAuthorizationCode;
     private issueTokens;
     private decodeAndVerifyToken;
     private encryptToken;
     private decryptToken;
+    private encryptTransientState;
+    private decryptTransientState;
+    private encryptValue;
+    private decryptValue;
     private assertResource;
-    private cleanupTransientState;
 }
-export {};