integrate-sdk 0.3.14 → 0.4.2

package/dist/index.js

@@ -203,6 +203,13 @@ class OAuthHandler {
     return data;
   }
   async handleCallback(request) {
+    const providerConfig = this.config.providers[request.provider];
+    if (!providerConfig) {
+      throw new Error(`Provider ${request.provider} not configured. Add OAuth credentials to your API route configuration.`);
+    }
+    if (!providerConfig.clientId || !providerConfig.clientSecret) {
+      throw new Error(`Missing OAuth credentials for ${request.provider}. Check your environment variables.`);
+    }
     const url = new URL("/oauth/callback", this.serverUrl);
     const response = await fetch(url.toString(), {
       method: "POST",
@@ -213,7 +220,9 @@ class OAuthHandler {
         provider: request.provider,
         code: request.code,
         code_verifier: request.codeVerifier,
-        state: request.state
+        state: request.state,
+        client_id: providerConfig.clientId,
+        client_secret: providerConfig.clientSecret
       })
     });
     if (!response.ok) {
@@ -223,20 +232,19 @@ class OAuthHandler {
     const data = await response.json();
     return data;
   }
-  async handleStatus(provider, sessionToken) {
+  async handleStatus(provider, accessToken) {
     const url = new URL("/oauth/status", this.serverUrl);
     url.searchParams.set("provider", provider);
     const response = await fetch(url.toString(), {
       method: "GET",
       headers: {
-        "X-Session-Token": sessionToken
+        Authorization: `Bearer ${accessToken}`
       }
     });
     if (!response.ok) {
       if (response.status === 401) {
         return {
-          authorized: false,
-          provider
+          authorized: false
         };
       }
       const error = await response.text();
@@ -245,16 +253,16 @@ class OAuthHandler {
     const data = await response.json();
     return data;
   }
-  async handleDisconnect(request, sessionToken) {
-    if (!sessionToken) {
-      throw new Error("No session token provided. Cannot disconnect provider.");
+  async handleDisconnect(request, accessToken) {
+    if (!accessToken) {
+      throw new Error("No access token provided. Cannot disconnect provider.");
     }
     const url = new URL("/oauth/disconnect", this.serverUrl);
     const response = await fetch(url.toString(), {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
-        "X-Session-Token": sessionToken
+        Authorization: `Bearer ${accessToken}`
       },
       body: JSON.stringify({
         provider: request.provider
@@ -301,14 +309,15 @@ function createNextOAuthHandler(config) {
     async status(req) {
       try {
         const provider = req.nextUrl.searchParams.get("provider");
-        const sessionToken = req.headers.get("x-session-token");
+        const authHeader = req.headers.get("authorization");
         if (!provider) {
           return Response.json({ error: "Missing provider query parameter" }, { status: 400 });
         }
-        if (!sessionToken) {
-          return Response.json({ error: "Missing X-Session-Token header" }, { status: 400 });
+        if (!authHeader || !authHeader.startsWith("Bearer ")) {
+          return Response.json({ error: "Missing or invalid Authorization header" }, { status: 400 });
         }
-        const result = await handler.handleStatus(provider, sessionToken);
+        const accessToken = authHeader.substring(7);
+        const result = await handler.handleStatus(provider, accessToken);
         return Response.json(result);
       } catch (error) {
         console.error("[OAuth Status] Error:", error);
@@ -317,16 +326,17 @@ function createNextOAuthHandler(config) {
     },
     async disconnect(req) {
       try {
-        const sessionToken = req.headers.get("x-session-token");
-        if (!sessionToken) {
-          return Response.json({ error: "Missing X-Session-Token header" }, { status: 400 });
+        const authHeader = req.headers.get("authorization");
+        if (!authHeader || !authHeader.startsWith("Bearer ")) {
+          return Response.json({ error: "Missing or invalid Authorization header" }, { status: 400 });
         }
+        const accessToken = authHeader.substring(7);
         const body = await req.json();
         const { provider } = body;
         if (!provider) {
           return Response.json({ error: "Missing provider in request body" }, { status: 400 });
         }
-        const result = await handler.handleDisconnect({ provider }, sessionToken);
+        const result = await handler.handleDisconnect({ provider }, accessToken);
         return Response.json(result);
       } catch (error) {
         console.error("[OAuth Disconnect] Error:", error);
@@ -824,7 +834,7 @@ function sendCallbackToOpener(params) {
 // src/oauth/manager.ts
 class OAuthManager {
   pendingAuths = new Map;
-  sessionToken;
+  providerTokens = new Map;
   windowManager;
   flowConfig;
   oauthApiBase;
@@ -890,11 +900,19 @@ class OAuthManager {
     }
     try {
       const response = await this.exchangeCodeForToken(pendingAuth.provider, code, pendingAuth.codeVerifier, state);
-      this.sessionToken = response.sessionToken;
-      this.saveSessionToken(response.sessionToken);
+      const tokenData = {
+        accessToken: response.accessToken,
+        refreshToken: response.refreshToken,
+        tokenType: response.tokenType,
+        expiresIn: response.expiresIn,
+        expiresAt: response.expiresAt,
+        scopes: response.scopes
+      };
+      this.providerTokens.set(pendingAuth.provider, tokenData);
+      this.saveProviderToken(pendingAuth.provider, tokenData);
       this.pendingAuths.delete(state);
       this.removePendingAuthFromStorage(state);
-      return response.sessionToken;
+      return { ...tokenData, provider: pendingAuth.provider };
     } catch (error) {
       this.pendingAuths.delete(state);
       this.removePendingAuthFromStorage(state);
@@ -902,7 +920,8 @@ class OAuthManager {
     }
   }
   async checkAuthStatus(provider) {
-    if (!this.sessionToken) {
+    const tokenData = this.providerTokens.get(provider);
+    if (!tokenData) {
       return {
         authorized: false,
         provider
@@ -913,7 +932,7 @@ class OAuthManager {
       const response = await fetch(url, {
         method: "GET",
         headers: {
-          "X-Session-Token": this.sessionToken
+          Authorization: `Bearer ${tokenData.accessToken}`
         }
       });
       if (!response.ok) {
@@ -923,7 +942,7 @@ class OAuthManager {
         };
       }
       const status = await response.json();
-      return status;
+      return { ...status, provider };
     } catch (error) {
       console.error("Failed to check auth status:", error);
       return {
@@ -933,8 +952,9 @@ class OAuthManager {
     }
   }
   async disconnectProvider(provider) {
-    if (!this.sessionToken) {
-      throw new Error("No session token available. Cannot disconnect provider.");
+    const tokenData = this.providerTokens.get(provider);
+    if (!tokenData) {
+      throw new Error(`No access token available for provider "${provider}". Cannot disconnect provider.`);
     }
     try {
       const url = `${this.oauthApiBase}/disconnect`;
@@ -942,7 +962,7 @@ class OAuthManager {
         method: "POST",
         headers: {
           "Content-Type": "application/json",
-          "X-Session-Token": this.sessionToken
+          Authorization: `Bearer ${tokenData.accessToken}`
         },
         body: JSON.stringify({ provider })
       });
@@ -950,25 +970,43 @@ class OAuthManager {
         const errorText = await response.text();
         throw new Error(`Failed to disconnect provider: ${errorText}`);
       }
+      this.providerTokens.delete(provider);
+      this.clearProviderToken(provider);
     } catch (error) {
       console.error("Failed to disconnect provider:", error);
       throw error;
     }
   }
-  getSessionToken() {
-    return this.sessionToken;
+  getProviderToken(provider) {
+    return this.providerTokens.get(provider);
   }
-  setSessionToken(token) {
-    this.sessionToken = token;
-    this.saveSessionToken(token);
+  getAllProviderTokens() {
+    return new Map(this.providerTokens);
   }
-  clearSessionToken() {
-    this.sessionToken = undefined;
-    if (typeof window !== "undefined" && window.sessionStorage) {
+  setProviderToken(provider, tokenData) {
+    this.providerTokens.set(provider, tokenData);
+    this.saveProviderToken(provider, tokenData);
+  }
+  clearProviderToken(provider) {
+    this.providerTokens.delete(provider);
+    if (typeof window !== "undefined" && window.localStorage) {
       try {
-        window.sessionStorage.removeItem("integrate_session_token");
+        window.localStorage.removeItem(`integrate_token_${provider}`);
       } catch (error) {
-        console.error("Failed to clear session token from sessionStorage:", error);
+        console.error(`Failed to clear token for ${provider} from localStorage:`, error);
+      }
+    }
+  }
+  clearAllProviderTokens() {
+    const providers = Array.from(this.providerTokens.keys());
+    this.providerTokens.clear();
+    if (typeof window !== "undefined" && window.localStorage) {
+      for (const provider of providers) {
+        try {
+          window.localStorage.removeItem(`integrate_token_${provider}`);
+        } catch (error) {
+          console.error(`Failed to clear token for ${provider} from localStorage:`, error);
+        }
       }
     }
   }
@@ -990,12 +1028,35 @@ class OAuthManager {
       }
     }
   }
-  saveSessionToken(token) {
-    if (typeof window !== "undefined" && window.sessionStorage) {
+  saveProviderToken(provider, tokenData) {
+    if (typeof window !== "undefined" && window.localStorage) {
+      try {
+        const key = `integrate_token_${provider}`;
+        window.localStorage.setItem(key, JSON.stringify(tokenData));
+      } catch (error) {
+        console.error(`Failed to save token for ${provider} to localStorage:`, error);
+      }
+    }
+  }
+  loadProviderToken(provider) {
+    if (typeof window !== "undefined" && window.localStorage) {
       try {
-        window.sessionStorage.setItem("integrate_session_token", token);
+        const key = `integrate_token_${provider}`;
+        const stored = window.localStorage.getItem(key);
+        if (stored) {
+          return JSON.parse(stored);
+        }
       } catch (error) {
-        console.error("Failed to save session token to sessionStorage:", error);
+        console.error(`Failed to load token for ${provider} from localStorage:`, error);
+      }
+    }
+    return;
+  }
+  loadAllProviderTokens(providers) {
+    for (const provider of providers) {
+      const tokenData = this.loadProviderToken(provider);
+      if (tokenData) {
+        this.providerTokens.set(provider, tokenData);
       }
     }
   }
@@ -1183,23 +1244,15 @@ class MCPClient {
     this.maxReauthRetries = config.maxReauthRetries ?? 1;
     this.connectionMode = config.connectionMode ?? "lazy";
     this.oauthManager = new OAuthManager(config.oauthApiBase || "/api/integrate/oauth", config.oauthFlow);
-    let sessionToken = config.sessionToken;
-    if (!sessionToken) {
-      const storedToken = this.loadSessionToken();
-      if (storedToken) {
-        sessionToken = storedToken;
-      }
-    }
-    if (sessionToken) {
-      this.oauthManager.setSessionToken(sessionToken);
-      this.transport.setHeader("X-Session-Token", sessionToken);
-    }
+    const providers = this.plugins.filter((p) => p.oauth).map((p) => p.oauth.provider);
+    this.oauthManager.loadAllProviderTokens(providers);
     for (const plugin of this.plugins) {
       for (const toolName of plugin.tools) {
         this.enabledToolNames.add(toolName);
       }
       if (plugin.oauth) {
-        this.authState.set(plugin.oauth.provider, { authenticated: true });
+        const hasToken = this.oauthManager.getProviderToken(plugin.oauth.provider) !== undefined;
+        this.authState.set(plugin.oauth.provider, { authenticated: hasToken });
       }
     }
     this.github = this.createPluginProxy("github");
@@ -1340,30 +1393,36 @@ class MCPClient {
     if (!this.availableTools.has(name)) {
       throw new Error(`Tool "${name}" is not available on the server. Available tools: ${Array.from(this.availableTools.keys()).join(", ")}`);
     }
+    const provider = this.getProviderForTool(name);
+    if (provider) {
+      const tokenData = this.oauthManager.getProviderToken(provider);
+      if (tokenData) {
+        this.transport.setHeader("Authorization", `Bearer ${tokenData.accessToken}`);
+      }
+    }
     const params = {
       name,
       arguments: args
     };
     try {
       const response = await this.transport.sendRequest("tools/call" /* TOOLS_CALL */, params);
-      const provider = this.getProviderForTool(name);
       if (provider) {
         this.authState.set(provider, { authenticated: true });
       }
       return response;
     } catch (error) {
-      const provider = this.getProviderForTool(name);
-      const parsedError = parseServerError(error, { toolName: name, provider });
+      const provider2 = this.getProviderForTool(name);
+      const parsedError = parseServerError(error, { toolName: name, provider: provider2 });
       if (isAuthError(parsedError) && retryCount < this.maxReauthRetries) {
-        if (provider) {
-          this.authState.set(provider, {
+        if (provider2) {
+          this.authState.set(provider2, {
             authenticated: false,
             lastError: parsedError
           });
         }
-        if (this.onReauthRequired && provider) {
+        if (this.onReauthRequired && provider2) {
           const reauthSuccess = await this.onReauthRequired({
-            provider,
+            provider: provider2,
             error: parsedError,
             toolName: name
           });
@@ -1414,35 +1473,8 @@ class MCPClient {
   off(event, handler) {
     this.eventEmitter.off(event, handler);
   }
-  saveSessionToken(token) {
-    if (typeof window !== "undefined" && window.sessionStorage) {
-      try {
-        window.sessionStorage.setItem("integrate_session_token", token);
-      } catch (error) {
-        console.error("Failed to save session token to sessionStorage:", error);
-      }
-    }
-  }
-  loadSessionToken() {
-    if (typeof window !== "undefined" && window.sessionStorage) {
-      try {
-        return window.sessionStorage.getItem("integrate_session_token") || undefined;
-      } catch (error) {
-        console.error("Failed to load session token from sessionStorage:", error);
-        return;
-      }
-    }
-    return;
-  }
   clearSessionToken() {
-    if (typeof window !== "undefined" && window.sessionStorage) {
-      try {
-        window.sessionStorage.removeItem("integrate_session_token");
-      } catch (error) {
-        console.error("Failed to clear session token from sessionStorage:", error);
-      }
-    }
-    this.oauthManager.clearSessionToken();
+    this.oauthManager.clearAllProviderTokens();
   }
   async disconnectProvider(provider) {
     const plugin = this.plugins.find((p) => p.oauth?.provider === provider);
@@ -1522,10 +1554,13 @@ class MCPClient {
     this.eventEmitter.emit("auth:started", { provider });
     try {
       await this.oauthManager.initiateFlow(provider, plugin.oauth);
-      const sessionToken = this.oauthManager.getSessionToken();
-      if (sessionToken) {
-        this.saveSessionToken(sessionToken);
-        this.eventEmitter.emit("auth:complete", { provider, sessionToken });
+      const tokenData = this.oauthManager.getProviderToken(provider);
+      if (tokenData) {
+        this.eventEmitter.emit("auth:complete", {
+          provider,
+          accessToken: tokenData.accessToken,
+          expiresAt: tokenData.expiresAt
+        });
       }
       this.authState.set(provider, { authenticated: true });
     } catch (error) {
@@ -1535,18 +1570,13 @@ class MCPClient {
   }
   async handleOAuthCallback(params) {
     try {
-      const sessionToken = await this.oauthManager.handleCallback(params.code, params.state);
-      this.saveSessionToken(sessionToken);
-      this.transport.setHeader("X-Session-Token", sessionToken);
-      for (const plugin of this.plugins) {
-        if (plugin.oauth) {
-          this.authState.set(plugin.oauth.provider, { authenticated: true });
-          this.eventEmitter.emit("auth:complete", {
-            provider: plugin.oauth.provider,
-            sessionToken
-          });
-        }
-      }
+      const result = await this.oauthManager.handleCallback(params.code, params.state);
+      this.authState.set(result.provider, { authenticated: true });
+      this.eventEmitter.emit("auth:complete", {
+        provider: result.provider,
+        accessToken: result.accessToken,
+        expiresAt: result.expiresAt
+      });
     } catch (error) {
       this.eventEmitter.emit("auth:error", {
         provider: "unknown",
@@ -1555,12 +1585,12 @@ class MCPClient {
       throw error;
     }
   }
-  getSessionToken() {
-    return this.oauthManager.getSessionToken();
+  getProviderToken(provider) {
+    return this.oauthManager.getProviderToken(provider);
   }
-  setSessionToken(token) {
-    this.oauthManager.setSessionToken(token);
-    this.transport.setHeader("X-Session-Token", token);
+  setProviderToken(provider, tokenData) {
+    this.oauthManager.setProviderToken(provider, tokenData);
+    this.authState.set(provider, { authenticated: true });
   }
   async reauthenticate(provider) {
     const state = this.authState.get(provider);

package/dist/oauth.js

@@ -65,6 +65,13 @@ class OAuthHandler {
     return data;
   }
   async handleCallback(request) {
+    const providerConfig = this.config.providers[request.provider];
+    if (!providerConfig) {
+      throw new Error(`Provider ${request.provider} not configured. Add OAuth credentials to your API route configuration.`);
+    }
+    if (!providerConfig.clientId || !providerConfig.clientSecret) {
+      throw new Error(`Missing OAuth credentials for ${request.provider}. Check your environment variables.`);
+    }
     const url = new URL("/oauth/callback", this.serverUrl);
     const response = await fetch(url.toString(), {
       method: "POST",
@@ -75,7 +82,9 @@ class OAuthHandler {
         provider: request.provider,
         code: request.code,
         code_verifier: request.codeVerifier,
-        state: request.state
+        state: request.state,
+        client_id: providerConfig.clientId,
+        client_secret: providerConfig.clientSecret
       })
     });
     if (!response.ok) {
@@ -85,20 +94,19 @@ class OAuthHandler {
     const data = await response.json();
     return data;
   }
-  async handleStatus(provider, sessionToken) {
+  async handleStatus(provider, accessToken) {
     const url = new URL("/oauth/status", this.serverUrl);
     url.searchParams.set("provider", provider);
     const response = await fetch(url.toString(), {
       method: "GET",
       headers: {
-        "X-Session-Token": sessionToken
+        Authorization: `Bearer ${accessToken}`
       }
     });
     if (!response.ok) {
       if (response.status === 401) {
         return {
-          authorized: false,
-          provider
+          authorized: false
         };
       }
       const error = await response.text();
@@ -107,16 +115,16 @@ class OAuthHandler {
     const data = await response.json();
     return data;
   }
-  async handleDisconnect(request, sessionToken) {
-    if (!sessionToken) {
-      throw new Error("No session token provided. Cannot disconnect provider.");
+  async handleDisconnect(request, accessToken) {
+    if (!accessToken) {
+      throw new Error("No access token provided. Cannot disconnect provider.");
     }
     const url = new URL("/oauth/disconnect", this.serverUrl);
     const response = await fetch(url.toString(), {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
-        "X-Session-Token": sessionToken
+        Authorization: `Bearer ${accessToken}`
       },
       body: JSON.stringify({
         provider: request.provider
@@ -156,14 +164,14 @@ async function POST(req, context) {
     }
     if (action === "disconnect") {
       const body = await parseRequestBody(req);
-      const sessionToken = extractSessionToken(req);
-      if (!sessionToken) {
-        return createErrorResponse("Missing X-Session-Token header", 400);
+      const accessToken = extractAccessToken(req);
+      if (!accessToken) {
+        return createErrorResponse("Missing or invalid Authorization header", 400);
       }
       if (!body.provider) {
         return createErrorResponse("Missing provider in request body", 400);
       }
-      const result = await handler.handleDisconnect({ provider: body.provider }, sessionToken);
+      const result = await handler.handleDisconnect({ provider: body.provider }, accessToken);
       return createSuccessResponse(result);
     }
     return createErrorResponse(`Unknown action: ${action}`, 404);
@@ -183,11 +191,15 @@ async function GET(req, context) {
   }
   try {
     if (action === "status") {
-      const { provider, sessionToken } = parseQueryParams(req);
-      if (!provider || !sessionToken) {
-        return createErrorResponse("Missing provider or session token", 400);
+      const provider = extractProvider(req);
+      const accessToken = extractAccessToken(req);
+      if (!provider) {
+        return createErrorResponse("Missing provider parameter", 400);
       }
-      const result = await handler.handleStatus(provider, sessionToken);
+      if (!accessToken) {
+        return createErrorResponse("Missing or invalid Authorization header", 400);
+      }
+      const result = await handler.handleStatus(provider, accessToken);
       return createSuccessResponse(result);
     }
     return createErrorResponse(`Unknown action: ${action}`, 404);
@@ -202,24 +214,25 @@ async function parseRequestBody(req) {
   }
   throw new Error("Unable to parse request body");
 }
-function extractSessionToken(req) {
+function extractAccessToken(req) {
   if (req.headers?.get) {
-    return req.headers.get("x-session-token") || undefined;
+    const authHeader = req.headers.get("authorization");
+    if (authHeader && authHeader.startsWith("Bearer ")) {
+      return authHeader.substring(7);
+    }
   }
   return;
 }
-function parseQueryParams(req) {
+function extractProvider(req) {
   let url;
   if (req.nextUrl) {
     url = new URL(req.nextUrl);
   } else if (req.url) {
     url = new URL(req.url);
   } else {
-    return {};
+    return;
   }
-  const provider = url.searchParams.get("provider") || undefined;
-  const sessionToken = extractSessionToken(req);
-  return { provider, sessionToken };
+  return url.searchParams.get("provider") || undefined;
 }
 function createSuccessResponse(data) {
   if (typeof globalThis.NextResponse !== "undefined") {