openmausbot 0.1.91 → 0.1.93

package/dist-server/server/mcp-oauth-discovery.js

@@ -0,0 +1,133 @@
+// Find where a URL MCP server wants its users to sign in. MCP servers that
+// require OAuth answer 401 and point at their protected-resource metadata
+// (RFC 9728), which names an authorization server whose own metadata
+// (RFC 8414, or OpenID discovery) lists the endpoints a client needs.
+// Nothing here follows a redirect or accepts a plain-http endpoint off
+// this machine: a token endpoint is where a sign-in code is spent.
+const FETCH_TIMEOUT_MS = 5_000;
+const MAX_METADATA_BYTES = 65_536;
+const LOOPBACK_HOSTS = new Set(["127.0.0.1", "localhost", "[::1]"]);
+/** https anywhere; http only to this machine (local test servers). */
+export function isAllowedAuthUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return false;
+    }
+    if (url.username || url.password)
+        return false;
+    if (url.protocol === "https:")
+        return true;
+    return url.protocol === "http:" && LOOPBACK_HOSTS.has(url.hostname);
+}
+/** The `resource_metadata` parameter of a `WWW-Authenticate: Bearer …` challenge. */
+export function resourceMetadataUrl(wwwAuthenticate) {
+    if (!wwwAuthenticate)
+        return null;
+    const match = /resource_metadata\s*=\s*(?:"([^"]*)"|([^\s,]+))/i.exec(wwwAuthenticate);
+    const value = match?.[1] ?? match?.[2];
+    return value || null;
+}
+async function getJson(url, options) {
+    if (!isAllowedAuthUrl(url))
+        return null;
+    const timeout = AbortSignal.timeout(FETCH_TIMEOUT_MS);
+    const signal = options.signal ? AbortSignal.any([options.signal, timeout]) : timeout;
+    try {
+        const response = await (options.fetch ?? fetch)(url, { headers: { accept: "application/json" }, redirect: "error", signal });
+        if (!response.ok) {
+            void response.body?.cancel().catch(() => { });
+            return null;
+        }
+        const text = await response.text();
+        if (text.length > MAX_METADATA_BYTES)
+            return null;
+        const parsed = JSON.parse(text);
+        return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+function stringList(value) {
+    return Array.isArray(value) && value.every((entry) => typeof entry === "string") ? value : undefined;
+}
+async function protectedResource(mcpUrl, hint, options) {
+    const path = mcpUrl.pathname === "/" ? "" : mcpUrl.pathname;
+    const candidates = [
+        ...(hint ? [hint] : []),
+        `${mcpUrl.origin}/.well-known/oauth-protected-resource${path}`,
+        `${mcpUrl.origin}/.well-known/oauth-protected-resource`,
+    ];
+    for (const candidate of new Set(candidates)) {
+        const document = await getJson(candidate, options);
+        if (document)
+            return document;
+    }
+    return null;
+}
+async function authorizationServer(issuer, options) {
+    const base = issuer.replace(/\/+$/, "");
+    const url = new URL(base);
+    const suffix = url.pathname === "/" ? "" : url.pathname;
+    const candidates = [
+        `${url.origin}/.well-known/oauth-authorization-server${suffix}`,
+        `${url.origin}/.well-known/openid-configuration${suffix}`,
+        ...(suffix ? [`${base}/.well-known/openid-configuration`] : []),
+    ];
+    for (const candidate of candidates) {
+        const document = await getJson(candidate, options);
+        if (document)
+            return document;
+    }
+    return null;
+}
+/** The sign-in endpoints for an MCP server, or null when it does not
+ * describe a usable OAuth sign-in (no metadata, no PKCE S256, or an
+ * endpoint that is not https). */
+export async function discoverMcpAuth(mcpUrl, wwwAuthenticate, options = {}) {
+    let target;
+    try {
+        target = new URL(mcpUrl);
+    }
+    catch {
+        return null;
+    }
+    const resource = await protectedResource(target, resourceMetadataUrl(wwwAuthenticate), options);
+    const servers = stringList(resource?.authorization_servers);
+    const issuer = servers?.[0] ?? target.origin;
+    if (!isAllowedAuthUrl(issuer))
+        return null;
+    const metadata = await authorizationServer(issuer, options);
+    if (!metadata)
+        return null;
+    const authorizationEndpoint = metadata.authorization_endpoint;
+    const tokenEndpoint = metadata.token_endpoint;
+    if (typeof authorizationEndpoint !== "string" || !isAllowedAuthUrl(authorizationEndpoint))
+        return null;
+    if (typeof tokenEndpoint !== "string" || !isAllowedAuthUrl(tokenEndpoint))
+        return null;
+    if (!stringList(metadata.code_challenge_methods_supported)?.includes("S256"))
+        return null;
+    // RFC 8414 §3.3: the metadata must be for the issuer it was fetched for.
+    if (typeof metadata.issuer === "string" && metadata.issuer.replace(/\/+$/, "") !== issuer.replace(/\/+$/, ""))
+        return null;
+    const optionalEndpoint = (value) => typeof value === "string" && isAllowedAuthUrl(value) ? value : undefined;
+    const registrationEndpoint = optionalEndpoint(metadata.registration_endpoint);
+    const revocationEndpoint = optionalEndpoint(metadata.revocation_endpoint);
+    const scopes = stringList(resource?.scopes_supported);
+    const tokenEndpointAuthMethods = stringList(metadata.token_endpoint_auth_methods_supported);
+    target.hash = "";
+    return {
+        issuer,
+        authorizationEndpoint,
+        tokenEndpoint,
+        ...(registrationEndpoint ? { registrationEndpoint } : {}),
+        ...(revocationEndpoint ? { revocationEndpoint } : {}),
+        ...(scopes?.length ? { scopes } : {}),
+        ...(tokenEndpointAuthMethods?.length ? { tokenEndpointAuthMethods } : {}),
+        resource: target.toString(),
+    };
+}

package/dist-server/server/mcp-oauth-store.js

@@ -0,0 +1,70 @@
+// Sign-in state for URL MCP servers, kept apart from config.json so a
+// pasted or exported config never carries a token. One owner-only file:
+// per server, the URL it was signed in for (a token never follows the
+// entry to another address), the client it signed in as, and its tokens.
+import { mkdirSync, readFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { z } from "zod";
+import { writeFileAtomic } from "./atomic.js";
+const tokensSchema = z.object({
+    access: z.string().min(1),
+    refresh: z.string().min(1).optional(),
+    expiresAt: z.number().optional(),
+    scope: z.string().optional(),
+});
+const recordSchema = z.object({
+    url: z.string(),
+    state: z.enum(["needs-sign-in", "signed-in"]),
+    issuer: z.string().optional(),
+    clientId: z.string().optional(),
+    /** How a pre-registered app with a secret proves itself at the token
+     * endpoint. The secret stays in config.json; it is never kept here. */
+    tokenAuth: z.enum(["client_secret_post", "client_secret_basic"]).optional(),
+    redirectUri: z.string().optional(),
+    tokenEndpoint: z.string().optional(),
+    revocationEndpoint: z.string().optional(),
+    tokens: tokensSchema.optional(),
+});
+const fileSchema = z.object({
+    servers: z.record(z.string(), recordSchema).default({}),
+});
+export class McpOAuthStore {
+    file;
+    constructor(file) {
+        this.file = file;
+    }
+    /** The record for this server, only while it is still for this URL. */
+    get(name, url) {
+        const record = this.read().servers[name];
+        return record && record.url === url ? record : undefined;
+    }
+    put(name, record) {
+        const data = this.read();
+        data.servers[name] = recordSchema.parse(record);
+        this.write(data);
+    }
+    delete(name) {
+        const data = this.read();
+        if (!Object.hasOwn(data.servers, name))
+            return;
+        delete data.servers[name];
+        this.write(data);
+    }
+    // Read through on every call: the file is small, and another process
+    // (the config CLI, a second window's server) may have changed it.
+    read() {
+        try {
+            const parsed = fileSchema.safeParse(JSON.parse(readFileSync(this.file, "utf8")));
+            if (parsed.success)
+                return parsed.data;
+        }
+        catch {
+            // missing or unreadable: empty until the next write
+        }
+        return { servers: {} };
+    }
+    write(data) {
+        mkdirSync(dirname(this.file), { recursive: true });
+        writeFileAtomic(this.file, JSON.stringify(data, null, 2), { mode: 0o600 });
+    }
+}