ms365-mcp-server 1.0.0

package/dist/utils/ms365-auth-enhanced.js

@@ -0,0 +1,639 @@
+import { ConfidentialClientApplication, PublicClientApplication } from '@azure/msal-node';
+import { Client } from '@microsoft/microsoft-graph-client';
+import * as fs from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+import open from 'open';
+import { createServer } from 'http';
+import { URL } from 'url';
+import { logger } from './api.js';
+import { credentialStore } from './credential-store.js';
+// Scopes required for Microsoft 365 operations
+const SCOPES = [
+    'https://graph.microsoft.com/Mail.ReadWrite',
+    'https://graph.microsoft.com/Mail.Send',
+    'https://graph.microsoft.com/MailboxSettings.Read',
+    'https://graph.microsoft.com/Contacts.Read',
+    'https://graph.microsoft.com/User.Read',
+    'offline_access'
+];
+// Built-in application for easier setup (similar to Softeria's approach)
+const BUILTIN_CLIENT_ID = "14d82eec-204b-4c2f-b7e8-296a70dab67e"; // Microsoft Graph Command Line Tools
+const DEFAULT_TENANT_ID = "common";
+// Configuration directory and file paths
+const CONFIG_DIR = path.join(os.homedir(), '.ms365-mcp');
+const CREDENTIALS_FILE = path.join(CONFIG_DIR, 'credentials.json');
+/**
+ * Enhanced Microsoft 365 authentication manager with device code flow support
+ */
+export class EnhancedMS365Auth {
+    constructor(authMethod = 'auto') {
+        this.msalClient = null;
+        this.credentials = null;
+        this.preferredAuthMethod = 'auto';
+        this.pendingAuth = null;
+        this.preferredAuthMethod = authMethod;
+        this.ensureConfigDir();
+    }
+    /**
+     * Ensure configuration directory exists
+     */
+    ensureConfigDir() {
+        if (!fs.existsSync(CONFIG_DIR)) {
+            fs.mkdirSync(CONFIG_DIR, { recursive: true });
+            logger.log('Created MS365 MCP configuration directory');
+        }
+    }
+    /**
+     * Load credentials from environment, file, or use built-in app
+     */
+    async loadCredentials() {
+        try {
+            // Method 1: Environment variables (highest priority)
+            if (process.env.MS365_CLIENT_ID && process.env.MS365_TENANT_ID) {
+                this.credentials = {
+                    clientId: process.env.MS365_CLIENT_ID,
+                    clientSecret: process.env.MS365_CLIENT_SECRET,
+                    tenantId: process.env.MS365_TENANT_ID,
+                    redirectUri: process.env.MS365_REDIRECT_URI || 'http://localhost:44001/oauth2callback',
+                    authType: process.env.MS365_CLIENT_SECRET ? 'redirect' : 'device'
+                };
+                logger.log('Loaded MS365 credentials from environment variables');
+                return true;
+            }
+            // Method 2: Credentials file
+            if (fs.existsSync(CREDENTIALS_FILE)) {
+                const credentialsData = fs.readFileSync(CREDENTIALS_FILE, 'utf8');
+                this.credentials = JSON.parse(credentialsData);
+                logger.log('Loaded MS365 credentials from file');
+                return true;
+            }
+            // Method 3: Built-in application (fallback)
+            this.credentials = {
+                clientId: BUILTIN_CLIENT_ID,
+                tenantId: DEFAULT_TENANT_ID,
+                authType: 'device'
+            };
+            logger.log('Using built-in MS365 application with device code flow');
+            return true;
+        }
+        catch (error) {
+            logger.error('Error loading MS365 credentials:', error);
+            return false;
+        }
+    }
+    /**
+     * Save credentials to file
+     */
+    async saveCredentials(credentials) {
+        try {
+            fs.writeFileSync(CREDENTIALS_FILE, JSON.stringify(credentials, null, 2));
+            logger.log('Saved MS365 credentials to file');
+        }
+        catch (error) {
+            logger.error('Error saving MS365 credentials:', error);
+            throw new Error('Failed to save credentials');
+        }
+    }
+    /**
+     * Initialize MSAL client based on auth type
+     */
+    initializeMsalClient() {
+        if (!this.credentials) {
+            throw new Error('Credentials not loaded');
+        }
+        const isConfidential = this.credentials.clientSecret && this.credentials.authType === 'redirect';
+        if (isConfidential) {
+            // Confidential client for redirect-based auth
+            const config = {
+                auth: {
+                    clientId: this.credentials.clientId,
+                    clientSecret: this.credentials.clientSecret,
+                    authority: `https://login.microsoftonline.com/${this.credentials.tenantId}`
+                },
+                system: {
+                    loggerOptions: {
+                        loggerCallback: (level, message, containsPii) => {
+                            if (!containsPii) {
+                                logger.log(`MSAL: ${message}`);
+                            }
+                        },
+                        piiLoggingEnabled: false,
+                        logLevel: 3
+                    }
+                }
+            };
+            this.msalClient = new ConfidentialClientApplication(config);
+        }
+        else {
+            // Public client for device code flow
+            const config = {
+                auth: {
+                    clientId: this.credentials.clientId,
+                    authority: `https://login.microsoftonline.com/${this.credentials.tenantId}`
+                },
+                system: {
+                    loggerOptions: {
+                        loggerCallback: (level, message, containsPii) => {
+                            if (!containsPii) {
+                                logger.log(`MSAL: ${message}`);
+                            }
+                        },
+                        piiLoggingEnabled: false,
+                        logLevel: 3
+                    }
+                }
+            };
+            this.msalClient = new PublicClientApplication(config);
+        }
+        return this.msalClient;
+    }
+    /**
+     * Device code flow authentication
+     */
+    async authenticateWithDeviceCode() {
+        if (!await this.loadCredentials()) {
+            throw new Error('MS365 credentials not configured');
+        }
+        const msalClient = this.initializeMsalClient();
+        const deviceCodeRequest = {
+            scopes: SCOPES,
+            deviceCodeCallback: (response) => {
+                // Display the device code to the user on stderr to avoid JSON-RPC conflicts
+                console.error('\n🔐 Microsoft 365 Authentication Required');
+                console.error('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
+                console.error(`📱 Please visit: ${response.verificationUri}`);
+                console.error(`🔑 Enter this code: ${response.userCode}`);
+                console.error('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
+                console.error('⏳ Waiting for authentication...\n');
+                logger.log(`Device code authentication: ${response.verificationUri} - ${response.userCode}`);
+            }
+        };
+        try {
+            const tokenResponse = await msalClient.acquireTokenByDeviceCode(deviceCodeRequest);
+            if (!tokenResponse) {
+                throw new Error('Failed to acquire token via device code');
+            }
+            await this.saveToken(tokenResponse, 'device');
+            logger.log('MS365 device code authentication successful');
+            console.error('✅ Authentication successful!\n');
+            return tokenResponse;
+        }
+        catch (error) {
+            logger.error('Device code authentication failed:', error);
+            throw error;
+        }
+    }
+    /**
+     * Redirect-based authentication (original method)
+     */
+    async authenticateWithRedirect() {
+        if (!await this.loadCredentials()) {
+            throw new Error('MS365 credentials not configured');
+        }
+        if (!this.credentials?.clientSecret) {
+            throw new Error('Client secret required for redirect authentication');
+        }
+        const msalClient = this.initializeMsalClient();
+        try {
+            const authUrl = await msalClient.getAuthCodeUrl({
+                scopes: SCOPES,
+                redirectUri: this.credentials.redirectUri,
+                prompt: 'consent'
+            });
+            logger.log('Opening browser for authentication...');
+            const [authCode] = await Promise.all([
+                this.startCallbackServer(),
+                open(authUrl)
+            ]);
+            const tokenResponse = await msalClient.acquireTokenByCode({
+                code: authCode,
+                scopes: SCOPES,
+                redirectUri: this.credentials.redirectUri
+            });
+            if (!tokenResponse) {
+                throw new Error('Failed to acquire token');
+            }
+            await this.saveToken(tokenResponse, 'redirect');
+            logger.log('MS365 redirect authentication successful');
+            return tokenResponse;
+        }
+        catch (error) {
+            logger.error('Redirect authentication failed:', error);
+            throw error;
+        }
+    }
+    /**
+     * Smart authentication that chooses the best method
+     */
+    async authenticate() {
+        if (!await this.loadCredentials()) {
+            throw new Error('MS365 credentials not configured');
+        }
+        const authType = this.determineAuthType();
+        if (authType === 'device') {
+            return await this.authenticateWithDeviceCode();
+        }
+        else {
+            return await this.authenticateWithRedirect();
+        }
+    }
+    /**
+     * Determine the best authentication type
+     */
+    determineAuthType() {
+        if (this.preferredAuthMethod === 'device') {
+            return 'device';
+        }
+        if (this.preferredAuthMethod === 'redirect') {
+            if (!this.credentials?.clientSecret) {
+                logger.log('No client secret available, falling back to device code flow');
+                return 'device';
+            }
+            return 'redirect';
+        }
+        // Auto mode: prefer device code for simplicity, redirect if client secret is available
+        if (this.credentials?.clientSecret && this.credentials?.redirectUri) {
+            return 'redirect';
+        }
+        return 'device';
+    }
+    /**
+     * Save token using secure credential store
+     */
+    async saveToken(token, authType) {
+        try {
+            const tokenData = {
+                accessToken: token.accessToken,
+                refreshToken: '',
+                expiresOn: token.expiresOn?.getTime() || 0,
+                account: token.account,
+                authType: authType
+            };
+            const accountKey = token.account?.username || 'default-user';
+            await credentialStore.setCredentials(accountKey, tokenData);
+            logger.log('Saved MS365 access token securely');
+        }
+        catch (error) {
+            logger.error('Error saving token:', error);
+        }
+    }
+    /**
+     * Load stored token using secure credential store
+     */
+    async loadStoredToken(accountKey = 'default-user') {
+        try {
+            return await credentialStore.getCredentials(accountKey);
+        }
+        catch (error) {
+            logger.error('Error loading stored token:', error);
+            return null;
+        }
+    }
+    /**
+     * Start local server for OAuth2 callback (redirect auth)
+     */
+    startCallbackServer() {
+        return new Promise((resolve, reject) => {
+            const server = createServer((req, res) => {
+                if (req.url?.startsWith('/oauth2callback')) {
+                    const url = new URL(req.url, 'http://localhost:44001');
+                    const code = url.searchParams.get('code');
+                    const error = url.searchParams.get('error');
+                    if (error) {
+                        res.end(`<html><body><h1>Authentication Error</h1><p>${error}</p></body></html>`);
+                        server.close();
+                        reject(new Error(`OAuth2 error: ${error}`));
+                        return;
+                    }
+                    if (code) {
+                        res.end(`<html><body><h1>Authentication Successful!</h1><p>You can close this window and return to the terminal.</p></body></html>`);
+                        server.close();
+                        resolve(code);
+                        return;
+                    }
+                    res.end('<html><body><h1>Invalid Request</h1></body></html>');
+                }
+                else {
+                    res.end('<html><body><h1>MS365 MCP Server OAuth2</h1><p>Waiting for authentication...</p></body></html>');
+                }
+            });
+            server.listen(44001, () => {
+                logger.log('OAuth2 callback server started on port 44001');
+            });
+            server.on('error', (err) => {
+                reject(err);
+            });
+        });
+    }
+    /**
+     * Get authenticated Microsoft Graph client
+     */
+    async getGraphClient(accountKey) {
+        // If no specific account key provided, use the first available account
+        if (!accountKey) {
+            const accounts = await this.listAuthenticatedAccounts();
+            if (accounts.length === 0) {
+                throw new Error('No authenticated accounts found. Please authenticate first.');
+            }
+            accountKey = accounts[0];
+        }
+        const storedToken = await this.loadStoredToken(accountKey);
+        if (!storedToken) {
+            throw new Error('No stored token found. Please authenticate first.');
+        }
+        // Check if token is expired
+        if (storedToken.expiresOn < Date.now()) {
+            await this.refreshToken(accountKey);
+        }
+        const client = Client.init({
+            authProvider: (done) => {
+                done(null, storedToken.accessToken);
+            }
+        });
+        return client;
+    }
+    /**
+     * Refresh access token
+     */
+    async refreshToken(accountKey = 'default-user') {
+        const storedToken = await this.loadStoredToken(accountKey);
+        if (!storedToken?.account) {
+            throw new Error('No account information available. Please re-authenticate.');
+        }
+        if (!await this.loadCredentials()) {
+            throw new Error('MS365 credentials not configured');
+        }
+        const msalClient = this.initializeMsalClient();
+        try {
+            const tokenResponse = await msalClient.acquireTokenSilent({
+                scopes: SCOPES,
+                account: storedToken.account
+            });
+            if (!tokenResponse) {
+                throw new Error('Failed to refresh token');
+            }
+            await this.saveToken(tokenResponse, storedToken.authType);
+            logger.log('MS365 token refreshed successfully');
+        }
+        catch (error) {
+            logger.error('Token refresh failed:', error);
+            throw error;
+        }
+    }
+    /**
+     * Check if user is authenticated
+     */
+    async isAuthenticated(accountKey) {
+        // If no specific account key provided, check all available accounts
+        if (!accountKey) {
+            const accounts = await this.listAuthenticatedAccounts();
+            if (accounts.length === 0) {
+                return false;
+            }
+            // Check if any account has valid authentication
+            for (const account of accounts) {
+                if (await this.isAuthenticated(account)) {
+                    return true;
+                }
+            }
+            return false;
+        }
+        const storedToken = await this.loadStoredToken(accountKey);
+        if (!storedToken) {
+            return false;
+        }
+        // If token is expired, try to refresh
+        if (storedToken.expiresOn < Date.now()) {
+            try {
+                await this.refreshToken(accountKey);
+                return true;
+            }
+            catch (error) {
+                logger.error('Token refresh failed during authentication check:', error);
+                return false;
+            }
+        }
+        return true;
+    }
+    /**
+     * Check if credentials are configured
+     */
+    async isConfigured() {
+        return await this.loadCredentials();
+    }
+    /**
+     * Clear stored authentication data
+     */
+    async resetAuth(accountKey) {
+        try {
+            if (accountKey) {
+                // Delete specific account
+                await credentialStore.deleteCredentials(accountKey);
+                logger.log(`Cleared stored authentication tokens for account: ${accountKey}`);
+            }
+            else {
+                // Delete all authenticated accounts
+                const authenticatedAccounts = await this.listAuthenticatedAccounts();
+                if (authenticatedAccounts.length === 0) {
+                    // If no accounts found by listing, try deleting the default-user key as fallback
+                    await credentialStore.deleteCredentials('default-user');
+                    logger.log('Cleared stored authentication tokens (fallback to default-user)');
+                }
+                else {
+                    // Delete all found accounts
+                    for (const account of authenticatedAccounts) {
+                        await credentialStore.deleteCredentials(account);
+                        logger.log(`Cleared stored authentication tokens for account: ${account}`);
+                    }
+                }
+            }
+        }
+        catch (error) {
+            logger.error('Error clearing authentication data:', error);
+        }
+    }
+    /**
+     * Get authentication URL for device code flow
+     */
+    async getDeviceCodeInfo() {
+        if (!await this.loadCredentials()) {
+            throw new Error('MS365 credentials not configured');
+        }
+        const msalClient = this.initializeMsalClient();
+        return new Promise((resolve, reject) => {
+            const deviceCodeRequest = {
+                scopes: SCOPES,
+                deviceCodeCallback: (response) => {
+                    resolve({
+                        verificationUri: response.verificationUri,
+                        userCode: response.userCode,
+                        message: response.message
+                    });
+                }
+            };
+            // This will trigger the callback immediately without completing auth
+            msalClient.acquireTokenByDeviceCode(deviceCodeRequest).catch(reject);
+        });
+    }
+    /**
+     * Start device code authentication and return device code info immediately
+     */
+    async startDeviceCodeAuth() {
+        if (!await this.loadCredentials()) {
+            throw new Error('MS365 credentials not configured');
+        }
+        const msalClient = this.initializeMsalClient();
+        return new Promise((resolve, reject) => {
+            const deviceCodeRequest = {
+                scopes: SCOPES,
+                deviceCodeCallback: (response) => {
+                    const deviceCodeInfo = {
+                        verificationUri: response.verificationUri,
+                        userCode: response.userCode,
+                        message: response.message
+                    };
+                    // Store the pending auth promise
+                    const authPromise = msalClient.acquireTokenByDeviceCode(deviceCodeRequest)
+                        .then(async (tokenResponse) => {
+                        if (!tokenResponse) {
+                            throw new Error('Failed to acquire token via device code');
+                        }
+                        await this.saveToken(tokenResponse, 'device');
+                        logger.log('MS365 device code authentication successful');
+                        this.pendingAuth = null; // Clear pending auth
+                        return tokenResponse;
+                    })
+                        .catch((error) => {
+                        this.pendingAuth = null; // Clear pending auth on error
+                        throw error;
+                    });
+                    this.pendingAuth = { authPromise, deviceCodeInfo };
+                    logger.log(`Device code authentication: ${response.verificationUri} - ${response.userCode}`);
+                    // Return device code info immediately
+                    resolve(deviceCodeInfo);
+                }
+            };
+            // This will never complete, but will call the callback immediately
+            msalClient.acquireTokenByDeviceCode(deviceCodeRequest).catch(() => {
+                // Ignore the error from this call since we're handling it in the stored promise
+            });
+        });
+    }
+    /**
+     * Wait for pending device code authentication to complete
+     */
+    async waitForDeviceCodeAuth() {
+        if (!this.pendingAuth) {
+            throw new Error('No pending device code authentication. Call startDeviceCodeAuth first.');
+        }
+        return await this.pendingAuth.authPromise;
+    }
+    /**
+     * Check if there's a pending device code authentication
+     */
+    hasPendingAuth() {
+        return this.pendingAuth !== null;
+    }
+    /**
+     * Get pending device code info
+     */
+    getPendingDeviceCodeInfo() {
+        return this.pendingAuth?.deviceCodeInfo || null;
+    }
+    /**
+     * Setup credentials interactively
+     */
+    async setupCredentials() {
+        const readline = await import('readline');
+        const rl = readline.createInterface({
+            input: process.stdin,
+            output: process.stdout
+        });
+        const question = (prompt) => {
+            return new Promise((resolve) => {
+                rl.question(prompt, resolve);
+            });
+        };
+        try {
+            console.log('\n🔧 MS365 MCP Server Credential Setup\n');
+            console.log('Choose authentication method:');
+            console.log('1. Device Code Flow (Recommended - no app registration needed)');
+            console.log('2. Custom Azure App (Advanced - requires app registration)\n');
+            const choice = await question('Enter your choice (1 or 2): ');
+            if (choice === '1') {
+                // Use built-in app with device code flow
+                const credentials = {
+                    clientId: BUILTIN_CLIENT_ID,
+                    tenantId: DEFAULT_TENANT_ID,
+                    authType: 'device'
+                };
+                await this.saveCredentials(credentials);
+                console.log('\n✅ Configured for device code authentication!');
+                console.log('Run: ms365-mcp-server to start the server\n');
+            }
+            else if (choice === '2') {
+                console.log('\nCustom Azure App Setup:');
+                console.log('1. Go to https://portal.azure.com');
+                console.log('2. Navigate to Azure Active Directory > App registrations');
+                console.log('3. Click "New registration"');
+                console.log('4. Set redirect URI to: http://localhost:44001/oauth2callback');
+                console.log('5. Grant required API permissions for Microsoft Graph\n');
+                const clientId = await question('Enter your Client ID: ');
+                const clientSecret = await question('Enter your Client Secret (optional for device flow): ');
+                const tenantId = await question('Enter your Tenant ID (or "common" for multi-tenant): ');
+                const authType = clientSecret ? 'redirect' : 'device';
+                const credentials = {
+                    clientId: clientId.trim(),
+                    clientSecret: clientSecret.trim() || undefined,
+                    tenantId: tenantId.trim(),
+                    redirectUri: 'http://localhost:44001/oauth2callback',
+                    authType: authType
+                };
+                await this.saveCredentials(credentials);
+                console.log('\n✅ Credentials saved successfully!');
+                console.log('Run: ms365-mcp-server to start the server\n');
+            }
+            else {
+                console.log('Invalid choice. Setup cancelled.');
+            }
+        }
+        finally {
+            rl.close();
+        }
+    }
+    /**
+     * Get storage method information
+     */
+    getStorageInfo() {
+        return {
+            method: credentialStore.getStorageMethod(),
+            location: credentialStore.isKeychainAvailable() ? 'OS Keychain' : CONFIG_DIR
+        };
+    }
+    /**
+     * List all authenticated accounts
+     */
+    async listAuthenticatedAccounts() {
+        return await credentialStore.listAccounts();
+    }
+    /**
+     * Get authentication URL without opening browser (redirect flow)
+     */
+    async getAuthUrl() {
+        if (!await this.loadCredentials()) {
+            throw new Error('MS365 credentials not configured');
+        }
+        if (!this.credentials?.clientSecret) {
+            throw new Error('Client secret required for redirect authentication. Use device code flow instead.');
+        }
+        const msalClient = this.initializeMsalClient();
+        const authUrl = await msalClient.getAuthCodeUrl({
+            scopes: SCOPES,
+            redirectUri: this.credentials.redirectUri,
+            prompt: 'consent'
+        });
+        return authUrl;
+    }
+}
+export const enhancedMS365Auth = new EnhancedMS365Auth();