mcp-creatio 0.3.6

package/src/server/oauth/oauth-server.ts

@@ -0,0 +1,185 @@
+import crypto from 'crypto';
+
+import log from '../../log';
+
+import { OAuthClientManager } from './client-manager';
+import { OAuthStorage } from './storage';
+import { OAuthTokenManager } from './token-manager';
+import { OAuthValidators } from './validators';
+
+import type {
+	OAuthAccessToken,
+	OAuthAuthorizationRequest,
+	OAuthAuthorizationServerMetadata,
+	OAuthClient,
+	OAuthError,
+	OAuthTokenRequest,
+} from './types';
+
+export class OAuthServer {
+	private readonly _jwtSecret: string = crypto.randomBytes(32).toString('hex');
+	private readonly _storage = new OAuthStorage();
+	private readonly _tokenManager: OAuthTokenManager;
+	private readonly _accessTokens = new Map<string, OAuthAccessToken>();
+	private _baseUrl: string;
+
+	constructor(baseUrl: string = 'http://localhost:3000') {
+		this._baseUrl = baseUrl;
+		this._tokenManager = new OAuthTokenManager(this._jwtSecret);
+	}
+
+	private _autoRegisterClientIfNeeded(client_id: string, redirect_uri: string): boolean {
+		if (this._storage.hasClient(client_id)) {
+			return false;
+		}
+		const client = OAuthClientManager.autoRegisterClient(client_id, redirect_uri);
+		this._storage.addClient(client);
+		return true;
+	}
+
+	public getAuthorizationServerMetadata(): OAuthAuthorizationServerMetadata {
+		return {
+			issuer: this._baseUrl,
+			authorization_endpoint: `${this._baseUrl}/authorize`,
+			token_endpoint: `${this._baseUrl}/token`,
+			registration_endpoint: `${this._baseUrl}/register`,
+			response_types_supported: ['code'],
+			grant_types_supported: ['authorization_code'],
+			token_endpoint_auth_methods_supported: ['none', 'client_secret_post'],
+			code_challenge_methods_supported: ['S256'],
+			scopes_supported: ['openid'],
+		};
+	}
+
+	public registerClient(redirect_uris: string[]): OAuthClient {
+		const client = OAuthClientManager.createClient(redirect_uris);
+		this._storage.addClient(client);
+		return client;
+	}
+
+	public validateAuthorizationRequest(params: OAuthAuthorizationRequest): OAuthError | null {
+		let client = this._storage.getClient(params.client_id);
+		if (!client) {
+			const wasRegistered = this._autoRegisterClientIfNeeded(
+				params.client_id,
+				params.redirect_uri,
+			);
+			if (wasRegistered) {
+				client = this._storage.getClient(params.client_id);
+			}
+		}
+		return OAuthValidators.validateAuthorizationRequest(params, client);
+	}
+
+	public storeState(state: string, client_id: string): void {
+		this._storage.storeState(state, client_id);
+		log.info('oauth.state.stored', { state, client_id });
+	}
+
+	public validateState(state: string, client_id: string): boolean {
+		log.info('oauth.state.validate_attempt', {
+			state,
+			client_id,
+			storedStates: this._storage.getAllStates(),
+		});
+		const stateData = this._storage.getState(state);
+		if (!stateData) {
+			log.warn('oauth.state.not_found', {
+				state,
+				storedStates: this._storage.getAllStates(),
+			});
+			return false;
+		}
+		if (stateData.expires_at < Date.now()) {
+			this._storage.deleteState(state);
+			log.warn('oauth.state.expired', { state });
+			return false;
+		}
+		if (stateData.client_id !== client_id) {
+			log.warn('oauth.state.client_mismatch', {
+				state,
+				expected: stateData.client_id,
+				actual: client_id,
+			});
+			return false;
+		}
+		this._storage.deleteState(state);
+		log.info('oauth.state.validated_successfully', { state, client_id });
+		return true;
+	}
+
+	public generateAuthorizationCode(
+		client_id: string,
+		redirect_uri: string,
+		code_challenge: string,
+		code_challenge_method: string,
+		userKey: string,
+	): string {
+		const code = crypto.randomBytes(32).toString('base64url');
+		this._storage.storeAuthorizationCode(
+			code,
+			client_id,
+			redirect_uri,
+			code_challenge,
+			code_challenge_method,
+			userKey,
+		);
+		log.info('oauth.authorization_code.generated', { client_id, userKey });
+		return code;
+	}
+
+	public async exchangeCodeForToken(
+		params: OAuthTokenRequest,
+	): Promise<OAuthAccessToken | OAuthError> {
+		log.info('oauth.token.exchange_start', {
+			grant_type: params.grant_type,
+			code: params.code ? '***' + params.code.slice(-4) : 'missing',
+			client_id: params.client_id,
+			redirect_uri: params.redirect_uri,
+			has_code_verifier: !!params.code_verifier,
+			stored_codes: this._storage.getAllStoredCodes().map((k) => '***' + k.slice(-4)),
+		});
+		const validationError = OAuthValidators.validateTokenRequest(params);
+		if (validationError) {
+			return validationError;
+		}
+		const authCode = this._storage.getAuthorizationCode(params.code!);
+		if (!authCode) {
+			log.error('oauth.token.code_not_found', {
+				code: '***' + params.code!.slice(-4),
+				stored_codes: this._storage.getAllStoredCodes().map((k) => '***' + k.slice(-4)),
+			});
+			return { error: 'invalid_grant', error_description: 'Invalid authorization code' };
+		}
+		const codeValidationError = this._tokenManager.validateAuthCodeData(authCode, params);
+		if (codeValidationError) {
+			if (
+				codeValidationError.error === 'invalid_grant' &&
+				codeValidationError.error_description === 'Authorization code expired'
+			) {
+				this._storage.deleteAuthorizationCode(params.code!);
+			}
+			return codeValidationError;
+		}
+		const tokenResponse = this._tokenManager.createTokenResponse(
+			authCode.userKey,
+			params.client_id,
+		);
+		this._accessTokens.set(tokenResponse.access_token, tokenResponse);
+		this._storage.deleteAuthorizationCode(params.code!);
+		log.info('oauth.token.issued', { client_id: params.client_id, userKey: authCode.userKey });
+		return tokenResponse;
+	}
+
+	public validateAccessToken(token: string): string | null {
+		return this._tokenManager.validateAccessToken(token);
+	}
+
+	public getClient(client_id: string): OAuthClient | undefined {
+		return this._storage.getClient(client_id);
+	}
+
+	public cleanup(): void {
+		this._storage.cleanup();
+	}
+}

package/src/server/oauth/storage.ts

@@ -0,0 +1,106 @@
+import log from '../../log';
+
+import type { OAuthClient } from './types';
+
+export interface AuthorizationCodeData {
+	client_id: string;
+	redirect_uri: string;
+	code_challenge: string;
+	code_challenge_method: string;
+	userKey: string;
+	expires_at: number;
+}
+
+export interface StateData {
+	client_id: string;
+	expires_at: number;
+}
+
+export class OAuthStorage {
+	private readonly _clients = new Map<string, OAuthClient>();
+	private readonly _authorizationCodes = new Map<string, AuthorizationCodeData>();
+	private readonly _authorizationStates = new Map<string, StateData>();
+
+	public addClient(client: OAuthClient): void {
+		this._clients.set(client.client_id, client);
+	}
+
+	public getClient(client_id: string): OAuthClient | undefined {
+		return this._clients.get(client_id);
+	}
+
+	public hasClient(client_id: string): boolean {
+		return this._clients.has(client_id);
+	}
+
+	public storeAuthorizationCode(
+		code: string,
+		client_id: string,
+		redirect_uri: string,
+		code_challenge: string,
+		code_challenge_method: string,
+		userKey: string,
+		expiresInMs: number = 10 * 60 * 1000,
+	): void {
+		const expires_at = Date.now() + expiresInMs;
+		this._authorizationCodes.set(code, {
+			client_id,
+			redirect_uri,
+			code_challenge,
+			code_challenge_method,
+			userKey,
+			expires_at,
+		});
+	}
+
+	public getAuthorizationCode(code: string): AuthorizationCodeData | undefined {
+		return this._authorizationCodes.get(code);
+	}
+
+	public deleteAuthorizationCode(code: string): void {
+		this._authorizationCodes.delete(code);
+	}
+
+	public storeState(
+		state: string,
+		client_id: string,
+		expiresInMs: number = 30 * 60 * 1000,
+	): void {
+		const expires_at = Date.now() + expiresInMs;
+		this._authorizationStates.set(state, { client_id, expires_at });
+	}
+
+	public getState(state: string): StateData | undefined {
+		return this._authorizationStates.get(state);
+	}
+
+	public deleteState(state: string): void {
+		this._authorizationStates.delete(state);
+	}
+
+	public getAllStates(): string[] {
+		return Array.from(this._authorizationStates.keys());
+	}
+
+	public getAllStoredCodes(): string[] {
+		return Array.from(this._authorizationCodes.keys());
+	}
+
+	public cleanup(): void {
+		const now = Date.now();
+		for (const [code, data] of this._authorizationCodes.entries()) {
+			if (now > data.expires_at) {
+				this._authorizationCodes.delete(code);
+			}
+		}
+		for (const [state, data] of this._authorizationStates.entries()) {
+			if (now > data.expires_at) {
+				this._authorizationStates.delete(state);
+			}
+		}
+		log.info('oauth.storage.cleanup.completed', {
+			remaining_codes: this._authorizationCodes.size,
+			remaining_states: this._authorizationStates.size,
+		});
+	}
+}

package/src/server/oauth/token-manager.ts

@@ -0,0 +1,80 @@
+import crypto from 'crypto';
+
+import jwt from 'jsonwebtoken';
+
+import log from '../../log';
+
+import type { AuthorizationCodeData } from './storage';
+import type { OAuthAccessToken, OAuthError, OAuthTokenRequest } from './types';
+
+export class OAuthTokenManager {
+	private readonly _jwtSecret: string;
+
+	constructor(jwtSecret: string) {
+		this._jwtSecret = jwtSecret;
+	}
+
+	public generateAccessToken(userKey: string, client_id: string): string {
+		return jwt.sign({ userKey, client_id }, this._jwtSecret, { expiresIn: '1h' });
+	}
+
+	public generateRefreshToken(): string {
+		return crypto.randomBytes(32).toString('base64url');
+	}
+
+	public validateAccessToken(token: string): string | null {
+		try {
+			const decoded = jwt.verify(token, this._jwtSecret) as any;
+			return decoded.userKey || null;
+		} catch (error) {
+			log.warn('oauth.token.invalid', { error: String(error) });
+			return null;
+		}
+	}
+
+	public createTokenResponse(
+		userKey: string,
+		client_id: string,
+		refresh_token_required: boolean = true,
+	): OAuthAccessToken {
+		const access_token = this.generateAccessToken(userKey, client_id);
+		const expires_in = 3600;
+		const tokenResponse: OAuthAccessToken = {
+			access_token,
+			token_type: 'Bearer',
+			expires_in,
+			userKey,
+		};
+		if (refresh_token_required) {
+			tokenResponse.refresh_token = this.generateRefreshToken();
+		}
+		return tokenResponse;
+	}
+
+	public verifyPKCE(code_verifier: string, code_challenge: string): boolean {
+		const hash = crypto.createHash('sha256').update(code_verifier).digest('base64url');
+		return hash === code_challenge;
+	}
+
+	public validateAuthCodeData(
+		authCode: AuthorizationCodeData,
+		params: OAuthTokenRequest,
+	): OAuthError | null {
+		if (Date.now() > authCode.expires_at) {
+			return { error: 'invalid_grant', error_description: 'Authorization code expired' };
+		}
+		if (authCode.client_id !== params.client_id) {
+			return { error: 'invalid_grant', error_description: 'Client mismatch' };
+		}
+		if (authCode.redirect_uri !== params.redirect_uri) {
+			return { error: 'invalid_grant', error_description: 'Redirect URI mismatch' };
+		}
+		if (!params.code_verifier) {
+			return { error: 'invalid_request', error_description: 'Missing code_verifier' };
+		}
+		if (!this.verifyPKCE(params.code_verifier, authCode.code_challenge)) {
+			return { error: 'invalid_grant', error_description: 'PKCE verification failed' };
+		}
+		return null;
+	}
+}

package/src/server/oauth/types.ts

@@ -0,0 +1,55 @@
+export interface OAuthClient {
+	client_id: string;
+	client_secret?: string;
+	redirect_uris: string[];
+	grant_types: string[];
+	response_types?: string[];
+	token_endpoint_auth_method?: string;
+	created_at: number;
+}
+
+export interface OAuthAuthorizationRequest {
+	client_id: string;
+	redirect_uri: string;
+	response_type: string;
+	state?: string;
+	code_challenge: string;
+	code_challenge_method: string;
+	scope?: string;
+}
+
+export interface OAuthTokenRequest {
+	grant_type: string;
+	client_id: string;
+	code?: string;
+	redirect_uri?: string;
+	code_verifier?: string;
+	refresh_token?: string;
+}
+
+export interface OAuthAccessToken {
+	access_token: string;
+	token_type: 'Bearer';
+	expires_in: number;
+	refresh_token?: string;
+	scope?: string;
+	userKey: string;
+}
+
+export interface OAuthError {
+	error: string;
+	error_description?: string;
+	error_uri?: string;
+}
+
+export interface OAuthAuthorizationServerMetadata {
+	issuer: string;
+	authorization_endpoint: string;
+	token_endpoint: string;
+	registration_endpoint: string;
+	response_types_supported: string[];
+	grant_types_supported: string[];
+	token_endpoint_auth_methods_supported: string[];
+	code_challenge_methods_supported: string[];
+	scopes_supported?: string[];
+}

package/src/server/oauth/validators.ts

@@ -0,0 +1,56 @@
+import type {
+	OAuthAuthorizationRequest,
+	OAuthClient,
+	OAuthError,
+	OAuthTokenRequest,
+} from './types';
+export class OAuthValidators {
+	public static validateAuthorizationRequest(
+		params: OAuthAuthorizationRequest,
+		client: OAuthClient | undefined,
+	): OAuthError | null {
+		if (!client) {
+			return { error: 'invalid_client', error_description: 'Client not found' };
+		}
+		if (!client.redirect_uris.includes(params.redirect_uri)) {
+			return { error: 'invalid_request', error_description: 'Invalid redirect_uri' };
+		}
+		if (params.response_type !== 'code') {
+			return { error: 'unsupported_response_type' };
+		}
+		if (!params.code_challenge || params.code_challenge_method !== 'S256') {
+			return { error: 'invalid_request', error_description: 'PKCE required' };
+		}
+		return null;
+	}
+
+	public static validateTokenRequest(params: OAuthTokenRequest): OAuthError | null {
+		if (params.grant_type !== 'authorization_code') {
+			return { error: 'unsupported_grant_type' };
+		}
+		if (!params.code || !params.code_verifier) {
+			return { error: 'invalid_request', error_description: 'Missing code or code_verifier' };
+		}
+		return null;
+	}
+
+	public static validateClientRegistration(redirect_uris: unknown): string | null {
+		if (!redirect_uris || !Array.isArray(redirect_uris)) {
+			return 'redirect_uris is required and must be an array';
+		}
+		if (redirect_uris.length === 0) {
+			return 'redirect_uris must contain at least one URI';
+		}
+		for (const uri of redirect_uris) {
+			if (typeof uri !== 'string') {
+				return 'All redirect_uris must be strings';
+			}
+			try {
+				new URL(uri);
+			} catch {
+				return `Invalid redirect_uri: ${uri}`;
+			}
+		}
+		return null;
+	}
+}

package/src/services/index.ts

@@ -0,0 +1,2 @@
+export * from './session-context';
+export * from './token-refresh-scheduler';