mcp-creatio 0.4.0 → 0.4.1

package/src/server/oauth/client-manager.ts

@@ -1,47 +0,0 @@
-import crypto from 'crypto';
-
-import log from '../../log';
-
-import type { OAuthClient } from './types';
-
-export class OAuthClientManager {
-	public static autoRegisterClient(client_id: string, redirect_uri: string): OAuthClient {
-		let clientName = 'Unknown MCP Client';
-		const redirectUris = [redirect_uri];
-		if (client_id.includes('claude')) {
-			clientName = 'Claude Desktop';
-		} else if (client_id.includes('vscode')) {
-			clientName = 'VS Code';
-		} else if (client_id.includes('cursor')) {
-			clientName = 'Cursor';
-		}
-		const client: OAuthClient = {
-			client_id,
-			redirect_uris: redirectUris,
-			grant_types: ['authorization_code', 'refresh_token'],
-			response_types: ['code'],
-			token_endpoint_auth_method: 'none',
-			created_at: Date.now(),
-		};
-		log.info('oauth.client.auto_registered', {
-			client_id,
-			client_name: clientName,
-			redirect_uris: redirectUris,
-		});
-		return client;
-	}
-
-	public static createClient(redirect_uris: string[]): OAuthClient {
-		const client_id = crypto.randomUUID();
-		const client: OAuthClient = {
-			client_id,
-			redirect_uris,
-			grant_types: ['authorization_code', 'refresh_token'],
-			response_types: ['code'],
-			token_endpoint_auth_method: 'none',
-			created_at: Date.now(),
-		};
-		log.info('oauth.client.registered', { client_id, redirect_uris });
-		return client;
-	}
-}

package/src/server/oauth/index.ts

@@ -1,6 +0,0 @@
-export * from './client-manager';
-export * from './oauth-server';
-export * from './storage';
-export * from './token-manager';
-export * from './types';
-export * from './validators';

package/src/server/oauth/oauth-server.ts

@@ -1,185 +0,0 @@
-import crypto from 'crypto';
-
-import log from '../../log';
-
-import { OAuthClientManager } from './client-manager';
-import { OAuthStorage } from './storage';
-import { OAuthTokenManager } from './token-manager';
-import { OAuthValidators } from './validators';
-
-import type {
-	OAuthAccessToken,
-	OAuthAuthorizationRequest,
-	OAuthAuthorizationServerMetadata,
-	OAuthClient,
-	OAuthError,
-	OAuthTokenRequest,
-} from './types';
-
-export class OAuthServer {
-	private readonly _jwtSecret: string = crypto.randomBytes(32).toString('hex');
-	private readonly _storage = new OAuthStorage();
-	private readonly _tokenManager: OAuthTokenManager;
-	private readonly _accessTokens = new Map<string, OAuthAccessToken>();
-	private _baseUrl: string;
-
-	constructor(baseUrl: string = 'http://localhost:3000') {
-		this._baseUrl = baseUrl;
-		this._tokenManager = new OAuthTokenManager(this._jwtSecret);
-	}
-
-	private _autoRegisterClientIfNeeded(client_id: string, redirect_uri: string): boolean {
-		if (this._storage.hasClient(client_id)) {
-			return false;
-		}
-		const client = OAuthClientManager.autoRegisterClient(client_id, redirect_uri);
-		this._storage.addClient(client);
-		return true;
-	}
-
-	public getAuthorizationServerMetadata(): OAuthAuthorizationServerMetadata {
-		return {
-			issuer: this._baseUrl,
-			authorization_endpoint: `${this._baseUrl}/authorize`,
-			token_endpoint: `${this._baseUrl}/token`,
-			registration_endpoint: `${this._baseUrl}/register`,
-			response_types_supported: ['code'],
-			grant_types_supported: ['authorization_code'],
-			token_endpoint_auth_methods_supported: ['none', 'client_secret_post'],
-			code_challenge_methods_supported: ['S256'],
-			scopes_supported: ['openid'],
-		};
-	}
-
-	public registerClient(redirect_uris: string[]): OAuthClient {
-		const client = OAuthClientManager.createClient(redirect_uris);
-		this._storage.addClient(client);
-		return client;
-	}
-
-	public validateAuthorizationRequest(params: OAuthAuthorizationRequest): OAuthError | null {
-		let client = this._storage.getClient(params.client_id);
-		if (!client) {
-			const wasRegistered = this._autoRegisterClientIfNeeded(
-				params.client_id,
-				params.redirect_uri,
-			);
-			if (wasRegistered) {
-				client = this._storage.getClient(params.client_id);
-			}
-		}
-		return OAuthValidators.validateAuthorizationRequest(params, client);
-	}
-
-	public storeState(state: string, client_id: string): void {
-		this._storage.storeState(state, client_id);
-		log.info('oauth.state.stored', { state, client_id });
-	}
-
-	public validateState(state: string, client_id: string): boolean {
-		log.info('oauth.state.validate_attempt', {
-			state,
-			client_id,
-			storedStates: this._storage.getAllStates(),
-		});
-		const stateData = this._storage.getState(state);
-		if (!stateData) {
-			log.warn('oauth.state.not_found', {
-				state,
-				storedStates: this._storage.getAllStates(),
-			});
-			return false;
-		}
-		if (stateData.expires_at < Date.now()) {
-			this._storage.deleteState(state);
-			log.warn('oauth.state.expired', { state });
-			return false;
-		}
-		if (stateData.client_id !== client_id) {
-			log.warn('oauth.state.client_mismatch', {
-				state,
-				expected: stateData.client_id,
-				actual: client_id,
-			});
-			return false;
-		}
-		this._storage.deleteState(state);
-		log.info('oauth.state.validated_successfully', { state, client_id });
-		return true;
-	}
-
-	public generateAuthorizationCode(
-		client_id: string,
-		redirect_uri: string,
-		code_challenge: string,
-		code_challenge_method: string,
-		userKey: string,
-	): string {
-		const code = crypto.randomBytes(32).toString('base64url');
-		this._storage.storeAuthorizationCode(
-			code,
-			client_id,
-			redirect_uri,
-			code_challenge,
-			code_challenge_method,
-			userKey,
-		);
-		log.info('oauth.authorization_code.generated', { client_id, userKey });
-		return code;
-	}
-
-	public async exchangeCodeForToken(
-		params: OAuthTokenRequest,
-	): Promise<OAuthAccessToken | OAuthError> {
-		log.info('oauth.token.exchange_start', {
-			grant_type: params.grant_type,
-			code: params.code ? '***' + params.code.slice(-4) : 'missing',
-			client_id: params.client_id,
-			redirect_uri: params.redirect_uri,
-			has_code_verifier: !!params.code_verifier,
-			stored_codes: this._storage.getAllStoredCodes().map((k) => '***' + k.slice(-4)),
-		});
-		const validationError = OAuthValidators.validateTokenRequest(params);
-		if (validationError) {
-			return validationError;
-		}
-		const authCode = this._storage.getAuthorizationCode(params.code!);
-		if (!authCode) {
-			log.error('oauth.token.code_not_found', {
-				code: '***' + params.code!.slice(-4),
-				stored_codes: this._storage.getAllStoredCodes().map((k) => '***' + k.slice(-4)),
-			});
-			return { error: 'invalid_grant', error_description: 'Invalid authorization code' };
-		}
-		const codeValidationError = this._tokenManager.validateAuthCodeData(authCode, params);
-		if (codeValidationError) {
-			if (
-				codeValidationError.error === 'invalid_grant' &&
-				codeValidationError.error_description === 'Authorization code expired'
-			) {
-				this._storage.deleteAuthorizationCode(params.code!);
-			}
-			return codeValidationError;
-		}
-		const tokenResponse = this._tokenManager.createTokenResponse(
-			authCode.userKey,
-			params.client_id,
-		);
-		this._accessTokens.set(tokenResponse.access_token, tokenResponse);
-		this._storage.deleteAuthorizationCode(params.code!);
-		log.info('oauth.token.issued', { client_id: params.client_id, userKey: authCode.userKey });
-		return tokenResponse;
-	}
-
-	public validateAccessToken(token: string): string | null {
-		return this._tokenManager.validateAccessToken(token);
-	}
-
-	public getClient(client_id: string): OAuthClient | undefined {
-		return this._storage.getClient(client_id);
-	}
-
-	public cleanup(): void {
-		this._storage.cleanup();
-	}
-}

package/src/server/oauth/storage.ts

@@ -1,106 +0,0 @@
-import log from '../../log';
-
-import type { OAuthClient } from './types';
-
-export interface AuthorizationCodeData {
-	client_id: string;
-	redirect_uri: string;
-	code_challenge: string;
-	code_challenge_method: string;
-	userKey: string;
-	expires_at: number;
-}
-
-export interface StateData {
-	client_id: string;
-	expires_at: number;
-}
-
-export class OAuthStorage {
-	private readonly _clients = new Map<string, OAuthClient>();
-	private readonly _authorizationCodes = new Map<string, AuthorizationCodeData>();
-	private readonly _authorizationStates = new Map<string, StateData>();
-
-	public addClient(client: OAuthClient): void {
-		this._clients.set(client.client_id, client);
-	}
-
-	public getClient(client_id: string): OAuthClient | undefined {
-		return this._clients.get(client_id);
-	}
-
-	public hasClient(client_id: string): boolean {
-		return this._clients.has(client_id);
-	}
-
-	public storeAuthorizationCode(
-		code: string,
-		client_id: string,
-		redirect_uri: string,
-		code_challenge: string,
-		code_challenge_method: string,
-		userKey: string,
-		expiresInMs: number = 10 * 60 * 1000,
-	): void {
-		const expires_at = Date.now() + expiresInMs;
-		this._authorizationCodes.set(code, {
-			client_id,
-			redirect_uri,
-			code_challenge,
-			code_challenge_method,
-			userKey,
-			expires_at,
-		});
-	}
-
-	public getAuthorizationCode(code: string): AuthorizationCodeData | undefined {
-		return this._authorizationCodes.get(code);
-	}
-
-	public deleteAuthorizationCode(code: string): void {
-		this._authorizationCodes.delete(code);
-	}
-
-	public storeState(
-		state: string,
-		client_id: string,
-		expiresInMs: number = 30 * 60 * 1000,
-	): void {
-		const expires_at = Date.now() + expiresInMs;
-		this._authorizationStates.set(state, { client_id, expires_at });
-	}
-
-	public getState(state: string): StateData | undefined {
-		return this._authorizationStates.get(state);
-	}
-
-	public deleteState(state: string): void {
-		this._authorizationStates.delete(state);
-	}
-
-	public getAllStates(): string[] {
-		return Array.from(this._authorizationStates.keys());
-	}
-
-	public getAllStoredCodes(): string[] {
-		return Array.from(this._authorizationCodes.keys());
-	}
-
-	public cleanup(): void {
-		const now = Date.now();
-		for (const [code, data] of this._authorizationCodes.entries()) {
-			if (now > data.expires_at) {
-				this._authorizationCodes.delete(code);
-			}
-		}
-		for (const [state, data] of this._authorizationStates.entries()) {
-			if (now > data.expires_at) {
-				this._authorizationStates.delete(state);
-			}
-		}
-		log.info('oauth.storage.cleanup.completed', {
-			remaining_codes: this._authorizationCodes.size,
-			remaining_states: this._authorizationStates.size,
-		});
-	}
-}

package/src/server/oauth/token-manager.ts

@@ -1,80 +0,0 @@
-import crypto from 'crypto';
-
-import jwt from 'jsonwebtoken';
-
-import log from '../../log';
-
-import type { AuthorizationCodeData } from './storage';
-import type { OAuthAccessToken, OAuthError, OAuthTokenRequest } from './types';
-
-export class OAuthTokenManager {
-	private readonly _jwtSecret: string;
-
-	constructor(jwtSecret: string) {
-		this._jwtSecret = jwtSecret;
-	}
-
-	public generateAccessToken(userKey: string, client_id: string): string {
-		return jwt.sign({ userKey, client_id }, this._jwtSecret, { expiresIn: '1h' });
-	}
-
-	public generateRefreshToken(): string {
-		return crypto.randomBytes(32).toString('base64url');
-	}
-
-	public validateAccessToken(token: string): string | null {
-		try {
-			const decoded = jwt.verify(token, this._jwtSecret) as any;
-			return decoded.userKey || null;
-		} catch (error) {
-			log.warn('oauth.token.invalid', { error: String(error) });
-			return null;
-		}
-	}
-
-	public createTokenResponse(
-		userKey: string,
-		client_id: string,
-		refresh_token_required: boolean = true,
-	): OAuthAccessToken {
-		const access_token = this.generateAccessToken(userKey, client_id);
-		const expires_in = 3600;
-		const tokenResponse: OAuthAccessToken = {
-			access_token,
-			token_type: 'Bearer',
-			expires_in,
-			userKey,
-		};
-		if (refresh_token_required) {
-			tokenResponse.refresh_token = this.generateRefreshToken();
-		}
-		return tokenResponse;
-	}
-
-	public verifyPKCE(code_verifier: string, code_challenge: string): boolean {
-		const hash = crypto.createHash('sha256').update(code_verifier).digest('base64url');
-		return hash === code_challenge;
-	}
-
-	public validateAuthCodeData(
-		authCode: AuthorizationCodeData,
-		params: OAuthTokenRequest,
-	): OAuthError | null {
-		if (Date.now() > authCode.expires_at) {
-			return { error: 'invalid_grant', error_description: 'Authorization code expired' };
-		}
-		if (authCode.client_id !== params.client_id) {
-			return { error: 'invalid_grant', error_description: 'Client mismatch' };
-		}
-		if (authCode.redirect_uri !== params.redirect_uri) {
-			return { error: 'invalid_grant', error_description: 'Redirect URI mismatch' };
-		}
-		if (!params.code_verifier) {
-			return { error: 'invalid_request', error_description: 'Missing code_verifier' };
-		}
-		if (!this.verifyPKCE(params.code_verifier, authCode.code_challenge)) {
-			return { error: 'invalid_grant', error_description: 'PKCE verification failed' };
-		}
-		return null;
-	}
-}

package/src/server/oauth/types.ts

@@ -1,55 +0,0 @@
-export interface OAuthClient {
-	client_id: string;
-	client_secret?: string;
-	redirect_uris: string[];
-	grant_types: string[];
-	response_types?: string[];
-	token_endpoint_auth_method?: string;
-	created_at: number;
-}
-
-export interface OAuthAuthorizationRequest {
-	client_id: string;
-	redirect_uri: string;
-	response_type: string;
-	state?: string;
-	code_challenge: string;
-	code_challenge_method: string;
-	scope?: string;
-}
-
-export interface OAuthTokenRequest {
-	grant_type: string;
-	client_id: string;
-	code?: string;
-	redirect_uri?: string;
-	code_verifier?: string;
-	refresh_token?: string;
-}
-
-export interface OAuthAccessToken {
-	access_token: string;
-	token_type: 'Bearer';
-	expires_in: number;
-	refresh_token?: string;
-	scope?: string;
-	userKey: string;
-}
-
-export interface OAuthError {
-	error: string;
-	error_description?: string;
-	error_uri?: string;
-}
-
-export interface OAuthAuthorizationServerMetadata {
-	issuer: string;
-	authorization_endpoint: string;
-	token_endpoint: string;
-	registration_endpoint: string;
-	response_types_supported: string[];
-	grant_types_supported: string[];
-	token_endpoint_auth_methods_supported: string[];
-	code_challenge_methods_supported: string[];
-	scopes_supported?: string[];
-}

package/src/server/oauth/validators.ts

@@ -1,56 +0,0 @@
-import type {
-	OAuthAuthorizationRequest,
-	OAuthClient,
-	OAuthError,
-	OAuthTokenRequest,
-} from './types';
-export class OAuthValidators {
-	public static validateAuthorizationRequest(
-		params: OAuthAuthorizationRequest,
-		client: OAuthClient | undefined,
-	): OAuthError | null {
-		if (!client) {
-			return { error: 'invalid_client', error_description: 'Client not found' };
-		}
-		if (!client.redirect_uris.includes(params.redirect_uri)) {
-			return { error: 'invalid_request', error_description: 'Invalid redirect_uri' };
-		}
-		if (params.response_type !== 'code') {
-			return { error: 'unsupported_response_type' };
-		}
-		if (!params.code_challenge || params.code_challenge_method !== 'S256') {
-			return { error: 'invalid_request', error_description: 'PKCE required' };
-		}
-		return null;
-	}
-
-	public static validateTokenRequest(params: OAuthTokenRequest): OAuthError | null {
-		if (params.grant_type !== 'authorization_code') {
-			return { error: 'unsupported_grant_type' };
-		}
-		if (!params.code || !params.code_verifier) {
-			return { error: 'invalid_request', error_description: 'Missing code or code_verifier' };
-		}
-		return null;
-	}
-
-	public static validateClientRegistration(redirect_uris: unknown): string | null {
-		if (!redirect_uris || !Array.isArray(redirect_uris)) {
-			return 'redirect_uris is required and must be an array';
-		}
-		if (redirect_uris.length === 0) {
-			return 'redirect_uris must contain at least one URI';
-		}
-		for (const uri of redirect_uris) {
-			if (typeof uri !== 'string') {
-				return 'All redirect_uris must be strings';
-			}
-			try {
-				new URL(uri);
-			} catch {
-				return `Invalid redirect_uri: ${uri}`;
-			}
-		}
-		return null;
-	}
-}

package/src/services/index.ts

@@ -1,2 +0,0 @@
-export * from './session-context';
-export * from './token-refresh-scheduler';