llng-mcp 0.1.0

package/dist/tools/consents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consents.js","sourceRoot":"","sources":["../../src/tools/consents.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,UAAU,oBAAoB,CAAC,MAAiB,EAAE,QAA2B;IACjF,MAAM,CAAC,IAAI,CACT,mBAAmB,EACnB,2BAA2B,EAC3B;QACE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;KACzF,EACD,KAAK,EAAE,MAAM,EAAE,EAAE;QACf,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACzD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACxD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAChF,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACzF,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,qBAAqB,EACrB,+BAA+B,EAC/B;QACE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;KACzF,EACD,KAAK,EAAE,MAAM,EAAE,EAAE;QACf,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACzD,MAAM,SAAS,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;YACxD,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,MAAM,CAAC,GAAG,CAAC,MAAM,aAAa,EAAE,CAAC;aAC1F,CAAC;QACJ,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACzF,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/instances.d.ts

@@ -0,0 +1,3 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { TransportRegistry } from "../transport/registry.js";
+export declare function registerInstanceTools(server: McpServer, registry: TransportRegistry): void;

package/dist/tools/instances.js

@@ -0,0 +1,14 @@
+export function registerInstanceTools(server, registry) {
+    server.tool("llng_instances", "List available LLNG instances and their transport mode", {}, async () => {
+        const instances = registry.listInstances();
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: JSON.stringify(instances, null, 2),
+                },
+            ],
+        };
+    });
+}
+//# sourceMappingURL=instances.js.map

package/dist/tools/instances.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"instances.js","sourceRoot":"","sources":["../../src/tools/instances.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,qBAAqB,CAAC,MAAiB,EAAE,QAA2B;IAClF,MAAM,CAAC,IAAI,CACT,gBAAgB,EAChB,wDAAwD,EACxD,EAAE,EACF,KAAK,IAAI,EAAE;QACT,MAAM,SAAS,GAAG,QAAQ,CAAC,aAAa,EAAE,CAAC;QAC3C,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;iBACzC;aACF;SACF,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/oidc-rp.d.ts

@@ -0,0 +1,6 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { TransportRegistry } from "../transport/registry.js";
+/**
+ * Register OIDC Relying Party management tools
+ */
+export declare function registerOidcRpTools(server: McpServer, registry: TransportRegistry): void;

package/dist/tools/oidc-rp.js

@@ -0,0 +1,246 @@
+import { z } from "zod";
+const RP_CONFIG_KEYS = [
+    "oidcRPMetaDataOptions",
+    "oidcRPMetaDataExportedVars",
+    "oidcRPMetaDataMacros",
+    "oidcRPMetaDataScopeRules",
+    "oidcRPMetaDataOptionsExtraClaims",
+];
+/**
+ * Register OIDC Relying Party management tools
+ */
+export function registerOidcRpTools(server, registry) {
+    // 0. llng_oidc_issuer_enable - Enable OIDC issuer
+    server.tool("llng_oidc_issuer_enable", "Enable OIDC issuer on the LLNG instance (activates issuerDBOpenIDConnectActivation and generates signing keys)", {
+        force: z.boolean().optional().describe("Force re-enable even if already activated"),
+        instance: z.string().optional().describe("LLNG instance name (uses default if omitted)"),
+    }, async (args) => {
+        try {
+            const transport = registry.getTransport(args.instance, "manager");
+            const config = await transport.configGet([
+                "issuerDBOpenIDConnectActivation",
+                "oidcServicePrivateKeySig",
+            ]);
+            const isActivated = config["issuerDBOpenIDConnectActivation"] === 1 ||
+                config["issuerDBOpenIDConnectActivation"] === "1";
+            const hasKey = typeof config["oidcServicePrivateKeySig"] === "string" &&
+                config["oidcServicePrivateKeySig"].length > 0;
+            if (isActivated && hasKey && !args.force) {
+                return {
+                    content: [{ type: "text", text: "OIDC issuer is already enabled." }],
+                };
+            }
+            await transport.configSet({ issuerDBOpenIDConnectActivation: 1 });
+            await transport.execScript("rotateOidcKeys", []);
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: "OIDC issuer enabled successfully. Signing keys have been generated.",
+                    },
+                ],
+            };
+        }
+        catch (error) {
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: `Error: ${error instanceof Error ? error.message : String(error)}`,
+                    },
+                ],
+                isError: true,
+            };
+        }
+    });
+    // 1. llng_oidc_rp_list - List OIDC Relying Parties
+    server.tool("llng_oidc_rp_list", "List configured OIDC Relying Parties with their clientID and displayName", {
+        instance: z.string().optional().describe("LLNG instance name (uses default if omitted)"),
+    }, async (args) => {
+        try {
+            const transport = registry.getTransport(args.instance, "manager");
+            const data = await transport.configGet(["oidcRPMetaDataOptions"]);
+            const options = data["oidcRPMetaDataOptions"];
+            if (!options || typeof options !== "object") {
+                return {
+                    content: [{ type: "text", text: JSON.stringify([], null, 2) }],
+                };
+            }
+            const list = Object.entries(options).map(([confKey, opts]) => ({
+                confKey,
+                clientID: opts?.oidcRPMetaDataOptionsClientID || "",
+                displayName: opts?.oidcRPMetaDataOptionsDisplayName || "",
+            }));
+            return {
+                content: [{ type: "text", text: JSON.stringify(list, null, 2) }],
+            };
+        }
+        catch (error) {
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: `Error: ${error instanceof Error ? error.message : String(error)}`,
+                    },
+                ],
+                isError: true,
+            };
+        }
+    });
+    // 2. llng_oidc_rp_get - Get details of an OIDC RP
+    server.tool("llng_oidc_rp_get", "Get full details of an OIDC Relying Party by confKey", {
+        confKey: z.string().describe("The RP configuration key (internal identifier)"),
+        instance: z.string().optional().describe("LLNG instance name (uses default if omitted)"),
+    }, async (args) => {
+        try {
+            const transport = registry.getTransport(args.instance, "manager");
+            const data = await transport.configGet([...RP_CONFIG_KEYS]);
+            const result = {};
+            for (const key of RP_CONFIG_KEYS) {
+                const container = data[key];
+                if (container && typeof container === "object" && args.confKey in container) {
+                    result[key] = container[args.confKey];
+                }
+            }
+            return {
+                content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+            };
+        }
+        catch (error) {
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: `Error: ${error instanceof Error ? error.message : String(error)}`,
+                    },
+                ],
+                isError: true,
+            };
+        }
+    });
+    // 3. llng_oidc_rp_add - Add a new OIDC RP
+    server.tool("llng_oidc_rp_add", "Add a new OIDC Relying Party", {
+        confKey: z.string().describe("Internal identifier for the RP"),
+        clientId: z.string().describe("OAuth2 client ID"),
+        redirectUris: z.string().describe("Redirect URIs (space or newline separated)"),
+        clientSecret: z.string().optional().describe("OAuth2 client secret"),
+        displayName: z.string().optional().describe("Display name for the RP"),
+        exportedVars: z
+            .record(z.string(), z.string())
+            .optional()
+            .describe('Claim-to-attribute mappings (default: {"name":"cn","preferred_username":"uid","email":"mail"})'),
+        extraClaims: z.record(z.string(), z.string()).optional().describe("Extra claims mappings"),
+        options: z
+            .record(z.string(), z.union([z.string(), z.number(), z.boolean()]))
+            .optional()
+            .describe("Additional raw OIDC RP options"),
+        instance: z.string().optional().describe("LLNG instance name (uses default if omitted)"),
+    }, async (args) => {
+        try {
+            const transport = registry.getTransport(args.instance, "manager");
+            // Check OIDC issuer prerequisites
+            const issuerConfig = await transport.configGet([
+                "issuerDBOpenIDConnectActivation",
+                "oidcServicePrivateKeySig",
+            ]);
+            const isActivated = issuerConfig["issuerDBOpenIDConnectActivation"] === 1 ||
+                issuerConfig["issuerDBOpenIDConnectActivation"] === "1";
+            const hasKey = typeof issuerConfig["oidcServicePrivateKeySig"] === "string" &&
+                issuerConfig["oidcServicePrivateKeySig"].length > 0;
+            if (!isActivated || !hasKey) {
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: "Error: OIDC issuer is not enabled or signing keys are missing. Use llng_oidc_issuer_enable first.",
+                        },
+                    ],
+                    isError: true,
+                };
+            }
+            const rpOptions = {
+                oidcRPMetaDataOptionsClientID: args.clientId,
+                oidcRPMetaDataOptionsRedirectUris: args.redirectUris,
+                oidcRPMetaDataOptionsIDTokenSignAlg: "RS256",
+                oidcRPMetaDataOptionsAccessTokenClaims: 1,
+                ...(args.options || {}),
+            };
+            if (args.clientSecret) {
+                rpOptions.oidcRPMetaDataOptionsClientSecret = args.clientSecret;
+            }
+            if (args.displayName) {
+                rpOptions.oidcRPMetaDataOptionsDisplayName = args.displayName;
+            }
+            const exportedVars = args.exportedVars || {
+                name: "cn",
+                preferred_username: "uid",
+                email: "mail",
+            };
+            const mergeData = {
+                oidcRPMetaDataOptions: {
+                    [args.confKey]: rpOptions,
+                },
+                oidcRPMetaDataExportedVars: {
+                    [args.confKey]: exportedVars,
+                },
+            };
+            if (args.extraClaims) {
+                mergeData.oidcRPMetaDataOptionsExtraClaims = {
+                    [args.confKey]: args.extraClaims,
+                };
+            }
+            await transport.configMerge(JSON.stringify(mergeData));
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: `OIDC RP '${args.confKey}' added successfully with clientId '${args.clientId}'.`,
+                    },
+                ],
+            };
+        }
+        catch (error) {
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: `Error: ${error instanceof Error ? error.message : String(error)}`,
+                    },
+                ],
+                isError: true,
+            };
+        }
+    });
+    // 4. llng_oidc_rp_delete - Delete an OIDC RP
+    server.tool("llng_oidc_rp_delete", "Delete an OIDC Relying Party by confKey", {
+        confKey: z.string().describe("The RP configuration key to delete"),
+        instance: z.string().optional().describe("LLNG instance name (uses default if omitted)"),
+    }, async (args) => {
+        try {
+            const transport = registry.getTransport(args.instance, "manager");
+            for (const key of RP_CONFIG_KEYS) {
+                await transport.configDelKey(key, args.confKey);
+            }
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: `OIDC RP '${args.confKey}' deleted successfully.`,
+                    },
+                ],
+            };
+        }
+        catch (error) {
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: `Error: ${error instanceof Error ? error.message : String(error)}`,
+                    },
+                ],
+                isError: true,
+            };
+        }
+    });
+}
+//# sourceMappingURL=oidc-rp.js.map

package/dist/tools/oidc-rp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-rp.js","sourceRoot":"","sources":["../../src/tools/oidc-rp.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,cAAc,GAAG;IACrB,uBAAuB;IACvB,4BAA4B;IAC5B,sBAAsB;IACtB,0BAA0B;IAC1B,kCAAkC;CAC1B,CAAC;AAEX;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAiB,EAAE,QAA2B;IAChF,kDAAkD;IAClD,MAAM,CAAC,IAAI,CACT,yBAAyB,EACzB,gHAAgH,EAChH;QACE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;QACnF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;KACzF,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACb,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAClE,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC;gBACvC,iCAAiC;gBACjC,0BAA0B;aAC3B,CAAC,CAAC;YAEH,MAAM,WAAW,GACf,MAAM,CAAC,iCAAiC,CAAC,KAAK,CAAC;gBAC/C,MAAM,CAAC,iCAAiC,CAAC,KAAK,GAAG,CAAC;YACpD,MAAM,MAAM,GACV,OAAO,MAAM,CAAC,0BAA0B,CAAC,KAAK,QAAQ;gBACtD,MAAM,CAAC,0BAA0B,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YAEhD,IAAI,WAAW,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACzC,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC;iBACrE,CAAC;YACJ,CAAC;YAED,MAAM,SAAS,CAAC,SAAS,CAAC,EAAE,+BAA+B,EAAE,CAAC,EAAE,CAAC,CAAC;YAClE,MAAM,SAAS,CAAC,UAAU,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;YAEjD,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,qEAAqE;qBAC5E;iBACF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,UAAU,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;qBACzE;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CACF,CAAC;IAEF,mDAAmD;IACnD,MAAM,CAAC,IAAI,CACT,mBAAmB,EACnB,0EAA0E,EAC1E;QACE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;KACzF,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACb,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAClE,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,IAAI,CAAC,uBAAuB,CAAC,CAAC;YAE9C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC5C,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;iBAC/D,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAgB,EAAE,EAAE,CAAC,CAAC;gBAC5E,OAAO;gBACP,QAAQ,EAAE,IAAI,EAAE,6BAA6B,IAAI,EAAE;gBACnD,WAAW,EAAE,IAAI,EAAE,gCAAgC,IAAI,EAAE;aAC1D,CAAC,CAAC,CAAC;YAEJ,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;aACjE,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,UAAU,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;qBACzE;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CACF,CAAC;IAEF,kDAAkD;IAClD,MAAM,CAAC,IAAI,CACT,kBAAkB,EAClB,sDAAsD,EACtD;QACE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gDAAgD,CAAC;QAC9E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;KACzF,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACb,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAClE,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC;YAE5D,MAAM,MAAM,GAAwB,EAAE,CAAC;YACvC,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;gBACjC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC5B,IAAI,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC;oBAC5E,MAAM,CAAC,GAAG,CAAC,GAAI,SAAqC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACrE,CAAC;YACH,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;aACnE,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,UAAU,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;qBACzE;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CACF,CAAC;IAEF,0CAA0C;IAC1C,MAAM,CAAC,IAAI,CACT,kBAAkB,EAClB,8BAA8B,EAC9B;QACE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;QAC9D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QACjD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;QAC/E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QACpE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC;QACtE,YAAY,EAAE,CAAC;aACZ,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;aAC9B,QAAQ,EAAE;aACV,QAAQ,CACP,gGAAgG,CACjG;QACH,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;QAC1F,OAAO,EAAE,CAAC;aACP,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;aAClE,QAAQ,EAAE;aACV,QAAQ,CAAC,gCAAgC,CAAC;QAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;KACzF,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACb,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAElE,kCAAkC;YAClC,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC;gBAC7C,iCAAiC;gBACjC,0BAA0B;aAC3B,CAAC,CAAC;YACH,MAAM,WAAW,GACf,YAAY,CAAC,iCAAiC,CAAC,KAAK,CAAC;gBACrD,YAAY,CAAC,iCAAiC,CAAC,KAAK,GAAG,CAAC;YAC1D,MAAM,MAAM,GACV,OAAO,YAAY,CAAC,0BAA0B,CAAC,KAAK,QAAQ;gBAC5D,YAAY,CAAC,0BAA0B,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YAEtD,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC5B,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,mGAAmG;yBAC1G;qBACF;oBACD,OAAO,EAAE,IAAI;iBACd,CAAC;YACJ,CAAC;YAED,MAAM,SAAS,GAA8C;gBAC3D,6BAA6B,EAAE,IAAI,CAAC,QAAQ;gBAC5C,iCAAiC,EAAE,IAAI,CAAC,YAAY;gBACpD,mCAAmC,EAAE,OAAO;gBAC5C,sCAAsC,EAAE,CAAC;gBACzC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;aACxB,CAAC;YAEF,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACtB,SAAS,CAAC,iCAAiC,GAAG,IAAI,CAAC,YAAY,CAAC;YAClE,CAAC;YACD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,SAAS,CAAC,gCAAgC,GAAG,IAAI,CAAC,WAAW,CAAC;YAChE,CAAC;YAED,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI;gBACxC,IAAI,EAAE,IAAI;gBACV,kBAAkB,EAAE,KAAK;gBACzB,KAAK,EAAE,MAAM;aACd,CAAC;YAEF,MAAM,SAAS,GAAwB;gBACrC,qBAAqB,EAAE;oBACrB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS;iBAC1B;gBACD,0BAA0B,EAAE;oBAC1B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,YAAY;iBAC7B;aACF,CAAC;YAEF,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,SAAS,CAAC,gCAAgC,GAAG;oBAC3C,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,WAAW;iBACjC,CAAC;YACJ,CAAC;YAED,MAAM,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;YAEvD,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,YAAY,IAAI,CAAC,OAAO,uCAAuC,IAAI,CAAC,QAAQ,IAAI;qBACvF;iBACF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,UAAU,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;qBACzE;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CACF,CAAC;IAEF,6CAA6C;IAC7C,MAAM,CAAC,IAAI,CACT,qBAAqB,EACrB,yCAAyC,EACzC;QACE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;QAClE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;KACzF,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACb,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAElE,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;gBACjC,MAAM,SAAS,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAClD,CAAC;YAED,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,YAAY,IAAI,CAAC,OAAO,yBAAyB;qBACxD;iBACF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,UAAU,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;qBACzE;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/oidc.d.ts

@@ -0,0 +1,3 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { TransportRegistry } from "../transport/registry.js";
+export declare function registerOidcTools(server: McpServer, registry: TransportRegistry): void;

package/dist/tools/oidc.js

@@ -0,0 +1,343 @@
+import { z } from "zod";
+import { randomBytes, createHash } from "crypto";
+// Cache for OIDC discovery documents, keyed by issuer with TTL
+const discoveryCache = new Map();
+const DISCOVERY_CACHE_TTL_MS = 3600_000; // 1 hour
+async function getDiscoveryMetadata(config) {
+    const cached = discoveryCache.get(config.issuer);
+    if (cached && Date.now() - cached.fetchedAt < DISCOVERY_CACHE_TTL_MS) {
+        return cached.metadata;
+    }
+    const url = `${config.issuer}/.well-known/openid-configuration`;
+    const response = await fetch(url);
+    if (!response.ok) {
+        throw new Error(`Failed to fetch discovery metadata: ${response.status} ${response.statusText}`);
+    }
+    const metadata = await response.json();
+    discoveryCache.set(config.issuer, { metadata, fetchedAt: Date.now() });
+    return metadata;
+}
+function generateCodeVerifier() {
+    return randomBytes(32).toString("base64url");
+}
+function generateCodeChallenge(verifier) {
+    return createHash("sha256").update(verifier).digest("base64url");
+}
+function generateState() {
+    return randomBytes(16).toString("base64url");
+}
+function isUrlSafe(url) {
+    try {
+        const parsed = new URL(url);
+        if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+            return false;
+        }
+        const hostname = parsed.hostname;
+        // Block private/link-local/loopback IPs
+        if (hostname === "localhost" ||
+            hostname.startsWith("127.") ||
+            hostname === "[::1]" ||
+            hostname.startsWith("10.") ||
+            hostname.startsWith("192.168.") ||
+            hostname.startsWith("169.254.") ||
+            hostname.startsWith("0.") ||
+            /^172\.(1[6-9]|2\d|3[01])\./.test(hostname)) {
+            return false;
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function base64UrlDecode(str) {
+    // Convert base64url to base64
+    let base64 = str.replace(/-/g, "+").replace(/_/g, "/");
+    // Add padding if needed
+    base64 += "=".repeat((4 - (base64.length % 4)) % 4);
+    return Buffer.from(base64, "base64").toString("utf-8");
+}
+export function registerOidcTools(server, registry) {
+    server.tool("llng_oidc_metadata", "Fetch OIDC discovery metadata", {
+        instance: z.string().optional().describe("LLNG instance name (uses default if omitted)"),
+    }, async (params) => {
+        try {
+            const config = registry.getOidcConfig(params.instance);
+            if (!config) {
+                return { content: [{ type: "text", text: "Error: OIDC not configured" }], isError: true };
+            }
+            const metadata = await getDiscoveryMetadata(config);
+            return { content: [{ type: "text", text: JSON.stringify(metadata, null, 2) }] };
+        }
+        catch (e) {
+            return {
+                content: [{ type: "text", text: `Error: ${e instanceof Error ? e.message : String(e)}` }],
+                isError: true,
+            };
+        }
+    });
+    server.tool("llng_oidc_authorize", "Get authorization URL with PKCE", {
+        scope: z.string().optional(),
+        instance: z.string().optional().describe("LLNG instance name (uses default if omitted)"),
+    }, async (params) => {
+        try {
+            const config = registry.getOidcConfig(params.instance);
+            if (!config) {
+                return { content: [{ type: "text", text: "Error: OIDC not configured" }], isError: true };
+            }
+            const metadata = await getDiscoveryMetadata(config);
+            const codeVerifier = generateCodeVerifier();
+            const codeChallenge = generateCodeChallenge(codeVerifier);
+            const state = generateState();
+            const scope = params.scope || config.scope;
+            const authUrl = new URL(metadata.authorization_endpoint);
+            authUrl.searchParams.set("response_type", "code");
+            authUrl.searchParams.set("client_id", config.clientId);
+            authUrl.searchParams.set("redirect_uri", config.redirectUri);
+            authUrl.searchParams.set("scope", scope);
+            authUrl.searchParams.set("code_challenge", codeChallenge);
+            authUrl.searchParams.set("code_challenge_method", "S256");
+            authUrl.searchParams.set("state", state);
+            const result = {
+                url: authUrl.toString(),
+                code_verifier: codeVerifier,
+                state: state,
+            };
+            return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+        }
+        catch (e) {
+            return {
+                content: [{ type: "text", text: `Error: ${e instanceof Error ? e.message : String(e)}` }],
+                isError: true,
+            };
+        }
+    });
+    server.tool("llng_oidc_tokens", "Exchange authorization code for tokens", {
+        code: z.string(),
+        code_verifier: z.string(),
+        instance: z.string().optional().describe("LLNG instance name (uses default if omitted)"),
+    }, async (params) => {
+        try {
+            const config = registry.getOidcConfig(params.instance);
+            if (!config) {
+                return { content: [{ type: "text", text: "Error: OIDC not configured" }], isError: true };
+            }
+            const metadata = await getDiscoveryMetadata(config);
+            const body = new URLSearchParams();
+            body.set("grant_type", "authorization_code");
+            body.set("code", params.code);
+            body.set("redirect_uri", config.redirectUri);
+            body.set("client_id", config.clientId);
+            body.set("code_verifier", params.code_verifier);
+            if (config.clientSecret) {
+                body.set("client_secret", config.clientSecret);
+            }
+            const response = await fetch(metadata.token_endpoint, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/x-www-form-urlencoded",
+                },
+                body: body.toString(),
+            });
+            const result = await response.json();
+            if (!response.ok) {
+                return {
+                    content: [{ type: "text", text: `Error: ${JSON.stringify(result)}` }],
+                    isError: true,
+                };
+            }
+            return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+        }
+        catch (e) {
+            return {
+                content: [{ type: "text", text: `Error: ${e instanceof Error ? e.message : String(e)}` }],
+                isError: true,
+            };
+        }
+    });
+    server.tool("llng_oidc_userinfo", "Get user info from OIDC provider", {
+        access_token: z.string(),
+        instance: z.string().optional().describe("LLNG instance name (uses default if omitted)"),
+    }, async (params) => {
+        try {
+            const config = registry.getOidcConfig(params.instance);
+            if (!config) {
+                return { content: [{ type: "text", text: "Error: OIDC not configured" }], isError: true };
+            }
+            const metadata = await getDiscoveryMetadata(config);
+            const response = await fetch(metadata.userinfo_endpoint, {
+                headers: {
+                    Authorization: `Bearer ${params.access_token}`,
+                },
+            });
+            const result = await response.json();
+            if (!response.ok) {
+                return {
+                    content: [{ type: "text", text: `Error: ${JSON.stringify(result)}` }],
+                    isError: true,
+                };
+            }
+            return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+        }
+        catch (e) {
+            return {
+                content: [{ type: "text", text: `Error: ${e instanceof Error ? e.message : String(e)}` }],
+                isError: true,
+            };
+        }
+    });
+    server.tool("llng_oidc_introspect", "Introspect an access token", {
+        token: z.string(),
+        instance: z.string().optional().describe("LLNG instance name (uses default if omitted)"),
+    }, async (params) => {
+        try {
+            const config = registry.getOidcConfig(params.instance);
+            if (!config) {
+                return { content: [{ type: "text", text: "Error: OIDC not configured" }], isError: true };
+            }
+            const metadata = await getDiscoveryMetadata(config);
+            if (!metadata.introspection_endpoint) {
+                return {
+                    content: [{ type: "text", text: "Error: Introspection endpoint not supported" }],
+                    isError: true,
+                };
+            }
+            const body = new URLSearchParams();
+            body.set("token", params.token);
+            body.set("client_id", config.clientId);
+            if (config.clientSecret) {
+                body.set("client_secret", config.clientSecret);
+            }
+            const response = await fetch(metadata.introspection_endpoint, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/x-www-form-urlencoded",
+                },
+                body: body.toString(),
+            });
+            const result = await response.json();
+            if (!response.ok) {
+                return {
+                    content: [{ type: "text", text: `Error: ${JSON.stringify(result)}` }],
+                    isError: true,
+                };
+            }
+            return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+        }
+        catch (e) {
+            return {
+                content: [{ type: "text", text: `Error: ${e instanceof Error ? e.message : String(e)}` }],
+                isError: true,
+            };
+        }
+    });
+    server.tool("llng_oidc_refresh", "Refresh an access token", {
+        refresh_token: z.string(),
+        instance: z.string().optional().describe("LLNG instance name (uses default if omitted)"),
+    }, async (params) => {
+        try {
+            const config = registry.getOidcConfig(params.instance);
+            if (!config) {
+                return { content: [{ type: "text", text: "Error: OIDC not configured" }], isError: true };
+            }
+            const metadata = await getDiscoveryMetadata(config);
+            const body = new URLSearchParams();
+            body.set("grant_type", "refresh_token");
+            body.set("refresh_token", params.refresh_token);
+            body.set("client_id", config.clientId);
+            if (config.clientSecret) {
+                body.set("client_secret", config.clientSecret);
+            }
+            const response = await fetch(metadata.token_endpoint, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/x-www-form-urlencoded",
+                },
+                body: body.toString(),
+            });
+            const result = await response.json();
+            if (!response.ok) {
+                return {
+                    content: [{ type: "text", text: `Error: ${JSON.stringify(result)}` }],
+                    isError: true,
+                };
+            }
+            return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+        }
+        catch (e) {
+            return {
+                content: [{ type: "text", text: `Error: ${e instanceof Error ? e.message : String(e)}` }],
+                isError: true,
+            };
+        }
+    });
+    server.tool("llng_oidc_whoami", "Decode ID token to show identity (WARNING: signature is NOT verified, for debugging only)", {
+        id_token: z.string(),
+        instance: z.string().optional().describe("LLNG instance name (uses default if omitted)"),
+    }, async (params) => {
+        try {
+            const config = registry.getOidcConfig(params.instance);
+            if (!config) {
+                return { content: [{ type: "text", text: "Error: OIDC not configured" }], isError: true };
+            }
+            const parts = params.id_token.split(".");
+            if (parts.length !== 3) {
+                return { content: [{ type: "text", text: "Error: Invalid JWT format" }], isError: true };
+            }
+            const payload = JSON.parse(base64UrlDecode(parts[1]));
+            const result = {
+                _warning: "UNVERIFIED - JWT signature was NOT checked. Do not trust these claims for authorization decisions.",
+                ...payload,
+            };
+            return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+        }
+        catch (e) {
+            return {
+                content: [{ type: "text", text: `Error: ${e instanceof Error ? e.message : String(e)}` }],
+                isError: true,
+            };
+        }
+    });
+    server.tool("llng_oidc_check_auth", "Check if a URL requires authentication (only public URLs allowed, private/internal IPs blocked)", {
+        url: z.string().url(),
+        access_token: z.string(),
+        instance: z.string().optional().describe("LLNG instance name (uses default if omitted)"),
+    }, async (params) => {
+        try {
+            const config = registry.getOidcConfig(params.instance);
+            if (!config) {
+                return { content: [{ type: "text", text: "Error: OIDC not configured" }], isError: true };
+            }
+            if (!isUrlSafe(params.url)) {
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: "Error: URL must be a public HTTP(S) URL. Private, loopback, and link-local addresses are blocked.",
+                        },
+                    ],
+                    isError: true,
+                };
+            }
+            const response = await fetch(params.url, {
+                headers: {
+                    Authorization: `Bearer ${params.access_token}`,
+                },
+                redirect: "manual",
+            });
+            const result = {
+                status: response.status,
+                statusText: response.statusText,
+                headers: Object.fromEntries(response.headers.entries()),
+            };
+            return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+        }
+        catch (e) {
+            return {
+                content: [{ type: "text", text: `Error: ${e instanceof Error ? e.message : String(e)}` }],
+                isError: true,
+            };
+        }
+    });
+}
+//# sourceMappingURL=oidc.js.map