adoptai-mcp 1.0.0

package/dist/integrations/salesforce/auth.js

@@ -0,0 +1,311 @@
+import './env.js';
+import { randomBytes, createHash } from 'node:crypto';
+import { createServer } from 'node:http';
+import { spawn } from 'node:child_process';
+import axios from 'axios';
+import { saveCredentials, getCredentials, isTokenExpired } from '../../core/auth-manager.js';
+
+const APP_ID = 'salesforce';
+
+function requireEnv(name) {
+  const v = process.env[name]?.trim();
+  if (!v) {
+    throw new Error(
+      `${name} is not set. Add it to your environment or integrations/salesforce/.env before running setup.`
+    );
+  }
+  return v;
+}
+
+function loginBaseUrl() {
+  return (process.env.SALESFORCE_LOGIN_URL || 'https://login.salesforce.com').replace(/\/$/, '');
+}
+
+function pkcePair() {
+  const codeVerifier = randomBytes(32).toString('base64url');
+  const codeChallenge = createHash('sha256').update(codeVerifier).digest('base64url');
+  return { codeVerifier, codeChallenge };
+}
+
+function openBrowser(url) {
+  if (process.platform === 'darwin') {
+    spawn('open', [url], { detached: true, stdio: 'ignore' }).unref();
+  } else if (process.platform === 'win32') {
+    spawn('cmd', ['/c', 'start', '""', url], { detached: true, stdio: 'ignore' }).unref();
+  } else {
+    spawn('xdg-open', [url], { detached: true, stdio: 'ignore' }).unref();
+  }
+}
+
+function userIdFromIdentityUrl(idUrl) {
+  if (!idUrl || typeof idUrl !== 'string') return null;
+  const parts = idUrl.replace(/\/$/, '').split('/');
+  return parts[parts.length - 1] || null;
+}
+
+async function exchangeCodeForTokens({ code, codeVerifier, redirectUri, clientId, clientSecret }) {
+  const body = new URLSearchParams({
+    grant_type: 'authorization_code',
+    client_id: clientId,
+    client_secret: clientSecret,
+    redirect_uri: redirectUri,
+    code,
+  });
+  if (codeVerifier) {
+    body.set('code_verifier', codeVerifier);
+  }
+
+  const tokenUrl = `${loginBaseUrl()}/services/oauth2/token`;
+  const res = await axios.post(tokenUrl, body.toString(), {
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json' },
+    timeout: 60000,
+    validateStatus: () => true,
+  });
+
+  if (res.status < 200 || res.status >= 300) {
+    const hint = typeof res.data === 'object' ? JSON.stringify(res.data) : String(res.data);
+    throw new Error(`Salesforce token exchange failed (${res.status}): ${hint}`);
+  }
+
+  const d = res.data;
+  const accessToken = d.access_token;
+  const refreshToken = d.refresh_token;
+  const instanceUrl = d.instance_url?.replace(/\/$/, '');
+  if (!accessToken || !instanceUrl) {
+    throw new Error('Token response missing access_token or instance_url');
+  }
+
+  const expiresIn = Number(d.expires_in);
+  const expiresAt =
+    Number.isFinite(expiresIn) && expiresIn > 0
+      ? new Date(Date.now() + expiresIn * 1000).toISOString()
+      : null;
+
+  return {
+    accessToken,
+    refreshToken: refreshToken || null,
+    instanceUrl,
+    userId: userIdFromIdentityUrl(d.id),
+    expiresAt,
+  };
+}
+
+async function refreshAccessToken(refreshToken, clientId, clientSecret) {
+  const body = new URLSearchParams({
+    grant_type: 'refresh_token',
+    client_id: clientId,
+    client_secret: clientSecret,
+    refresh_token: refreshToken,
+  });
+
+  const tokenUrl = `${loginBaseUrl()}/services/oauth2/token`;
+  const res = await axios.post(tokenUrl, body.toString(), {
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json' },
+    timeout: 60000,
+    validateStatus: () => true,
+  });
+
+  if (res.status < 200 || res.status >= 300) {
+    const hint = typeof res.data === 'object' ? JSON.stringify(res.data) : String(res.data);
+    throw new Error(`Salesforce token refresh failed (${res.status}): ${hint}`);
+  }
+
+  const d = res.data;
+  const accessToken = d.access_token;
+  const instanceUrl = d.instance_url?.replace(/\/$/, '');
+  if (!accessToken) throw new Error('Refresh response missing access_token');
+
+  const expiresIn = Number(d.expires_in);
+  const expiresAt =
+    Number.isFinite(expiresIn) && expiresIn > 0
+      ? new Date(Date.now() + expiresIn * 1000).toISOString()
+      : null;
+
+  return { accessToken, instanceUrl, expiresAt };
+}
+
+export async function runAuth() {
+  const clientId = requireEnv('SALESFORCE_CLIENT_ID');
+  const clientSecret = requireEnv('SALESFORCE_CLIENT_SECRET');
+
+  const { codeVerifier, codeChallenge } = pkcePair();
+  const state = randomBytes(16).toString('hex');
+
+  const fixedRedirect = process.env.SALESFORCE_REDIRECT_URI?.trim();
+  let redirectUri;
+  let callbackPathname = '/callback';
+  let listenPort;
+
+  if (fixedRedirect) {
+    const ru = new URL(fixedRedirect);
+    if (!['127.0.0.1', 'localhost'].includes(ru.hostname)) {
+      throw new Error('SALESFORCE_REDIRECT_URI must use host 127.0.0.1 or localhost');
+    }
+    listenPort = Number(ru.port);
+    if (!Number.isFinite(listenPort) || listenPort <= 0) {
+      throw new Error(
+        'SALESFORCE_REDIRECT_URI must include an explicit port (e.g. http://127.0.0.1:8765/callback)'
+      );
+    }
+    redirectUri = fixedRedirect;
+    callbackPathname = ru.pathname || '/callback';
+  }
+
+  const server = await new Promise((resolve, reject) => {
+    const s = createServer();
+    s.once('error', reject);
+    s.listen(fixedRedirect ? listenPort : 0, '127.0.0.1', () => resolve(s));
+  });
+
+  if (!fixedRedirect) {
+    listenPort = server.address().port;
+    redirectUri = `http://127.0.0.1:${listenPort}/callback`;
+  }
+
+  const scope =
+    process.env.SALESFORCE_SCOPES?.trim() || 'api refresh_token offline_access openid';
+
+  const authParams = new URLSearchParams({
+    response_type: 'code',
+    client_id: clientId,
+    redirect_uri: redirectUri,
+    scope,
+    state,
+    code_challenge: codeChallenge,
+    code_challenge_method: 'S256',
+  });
+
+  const authorizeFull = `${loginBaseUrl()}/services/oauth2/authorize?${authParams.toString()}`;
+
+  console.log(`
+┌─────────────────────────────────────────────┐
+│  Salesforce Authentication (OAuth2 + PKCE)  │
+│                                             │
+│  Add this callback URL to your Connected App│
+│  OAuth web flow settings:                    │
+│    ${redirectUri}
+│                                             │
+│  Opening browser to authorize…              │
+└─────────────────────────────────────────────┘
+  `);
+
+  const result = new Promise((resolve, reject) => {
+    server.on('request', (req, res) => {
+      try {
+        const u = new URL(req.url || '/', `http://127.0.0.1:${listenPort}`);
+        if (u.pathname !== callbackPathname) {
+          res.writeHead(404);
+          res.end();
+          return;
+        }
+        const code = u.searchParams.get('code');
+        const returned = u.searchParams.get('state');
+        const err = u.searchParams.get('error');
+        if (err) {
+          res.writeHead(400, { 'Content-Type': 'text/plain' });
+          res.end(`Error: ${err}`);
+          server.close();
+          reject(new Error(u.searchParams.get('error_description') || err));
+          return;
+        }
+        if (!code || returned !== state) {
+          res.writeHead(400, { 'Content-Type': 'text/plain' });
+          res.end('Invalid callback');
+          server.close();
+          reject(new Error('Invalid OAuth callback'));
+          return;
+        }
+        res.writeHead(200, { 'Content-Type': 'text/html' });
+        res.end(
+          '<html><body>You can close this window and return to the terminal.</body></html>'
+        );
+        server.close();
+        resolve(code);
+      } catch (e) {
+        reject(e);
+      }
+    });
+  });
+
+  openBrowser(authorizeFull);
+
+  let code;
+  try {
+    code = await result;
+  } catch (e) {
+    server.close();
+    throw e;
+  }
+
+  const tokens = await exchangeCodeForTokens({
+    code,
+    codeVerifier,
+    redirectUri,
+    clientId,
+    clientSecret,
+  });
+
+  saveCredentials(APP_ID, {
+    token: tokens.accessToken,
+    refreshToken: tokens.refreshToken,
+    tokenType: 'bearer',
+    expiresAt: tokens.expiresAt,
+    instanceUrl: tokens.instanceUrl,
+    userId: tokens.userId,
+    savedAt: new Date().toISOString(),
+  });
+
+  console.log('✅ Salesforce tokens saved (instance URL + access token).');
+}
+
+export function getToken() {
+  return getCredentials(APP_ID)?.token || null;
+}
+
+export function getInstanceUrl() {
+  const fromEnv = process.env.SALESFORCE_INSTANCE_URL?.replace(/\/$/, '');
+  if (fromEnv) return fromEnv;
+  return getCredentials(APP_ID)?.instanceUrl || null;
+}
+
+export function getDefaultUserId() {
+  return getCredentials(APP_ID)?.userId || null;
+}
+
+export function buildAuthHeaders() {
+  const token = getToken();
+  if (!token) {
+    throw new Error('Not authenticated. Run: npx adoptai-salesforce-mcp --client cursor');
+  }
+  return { Authorization: `Bearer ${token}` };
+}
+
+export async function ensureAccessToken() {
+  const creds = getCredentials(APP_ID);
+  if (!creds?.token) {
+    throw new Error('Not authenticated. Run: npx adoptai-salesforce-mcp --client cursor');
+  }
+  if (!isTokenExpired(APP_ID)) return;
+
+  const clientId = requireEnv('SALESFORCE_CLIENT_ID');
+  const clientSecret = requireEnv('SALESFORCE_CLIENT_SECRET');
+  if (!creds.refreshToken) {
+    throw new Error('Access token expired and no refresh token. Run setup again.');
+  }
+
+  const next = await refreshAccessToken(creds.refreshToken, clientId, clientSecret);
+  const instanceUrl = next.instanceUrl || creds.instanceUrl;
+
+  saveCredentials(APP_ID, {
+    ...creds,
+    token: next.accessToken,
+    tokenType: 'bearer',
+    expiresAt: next.expiresAt,
+    instanceUrl: instanceUrl || creds.instanceUrl,
+    savedAt: new Date().toISOString(),
+  });
+
+  if (instanceUrl && !process.env.SALESFORCE_INSTANCE_URL) {
+    process.env.SALESFORCE_INSTANCE_URL = instanceUrl;
+  }
+}