palaryn 0.1.0 → 0.3.2

package/src/mcp/oauth-stores.ts

@@ -0,0 +1,202 @@
+/**
+ * In-memory OAuth stores for MCP OAuth 2.0 flow.
+ *
+ * Stores OAuth clients (dynamic registration), access tokens, refresh tokens,
+ * and authorization codes. All stores use TTL-based auto-cleanup.
+ */
+import { randomUUID, randomBytes } from 'crypto';
+import { OAuthRegisteredClientsStore } from '@modelcontextprotocol/sdk/server/auth/clients.js';
+import { OAuthClientInformationFull } from '@modelcontextprotocol/sdk/shared/auth.js';
+
+// ---------------------------------------------------------------------------
+// OAuth Client Store
+// ---------------------------------------------------------------------------
+
+export class OAuthClientsStore implements OAuthRegisteredClientsStore {
+  private clients = new Map<string, OAuthClientInformationFull>();
+
+  getClient(clientId: string): OAuthClientInformationFull | undefined {
+    return this.clients.get(clientId);
+  }
+
+  registerClient(
+    client: Omit<OAuthClientInformationFull, 'client_id' | 'client_id_issued_at'>,
+  ): OAuthClientInformationFull {
+    const clientId = `pn_client_${randomUUID().replace(/-/g, '').slice(0, 16)}`;
+    const clientSecret = randomBytes(32).toString('hex');
+    const full: OAuthClientInformationFull = {
+      ...client,
+      client_id: clientId,
+      client_secret: clientSecret,
+      client_id_issued_at: Math.floor(Date.now() / 1000),
+    };
+    this.clients.set(clientId, full);
+    return full;
+  }
+
+  /** Serialize for persistence */
+  entries(): [string, OAuthClientInformationFull][] {
+    return Array.from(this.clients.entries());
+  }
+
+  /** Load from persisted data */
+  load(entries: [string, OAuthClientInformationFull][]): void {
+    for (const [id, client] of entries) {
+      this.clients.set(id, client);
+    }
+  }
+
+  clear(): void {
+    this.clients.clear();
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Authorization Code Store
+// ---------------------------------------------------------------------------
+
+export interface StoredAuthCode {
+  code: string;
+  clientId: string;
+  codeChallenge: string;
+  redirectUri: string;
+  scopes: string[];
+  userId: string;
+  workspaceId: string;
+  state?: string;
+  expiresAt: number; // Unix ms
+}
+
+export class AuthCodeStore {
+  private codes = new Map<string, StoredAuthCode>();
+  private cleanupTimer: ReturnType<typeof setInterval>;
+
+  constructor(private ttlMs: number = 10 * 60 * 1000) {
+    this.cleanupTimer = setInterval(() => this.cleanup(), 60_000);
+    this.cleanupTimer.unref();
+  }
+
+  save(entry: StoredAuthCode): void {
+    this.codes.set(entry.code, entry);
+  }
+
+  get(code: string): StoredAuthCode | undefined {
+    const entry = this.codes.get(code);
+    if (!entry) return undefined;
+    if (Date.now() > entry.expiresAt) {
+      this.codes.delete(code);
+      return undefined;
+    }
+    return entry;
+  }
+
+  consume(code: string): StoredAuthCode | undefined {
+    const entry = this.get(code);
+    if (entry) {
+      this.codes.delete(code);
+    }
+    return entry;
+  }
+
+  private cleanup(): void {
+    const now = Date.now();
+    for (const [code, entry] of this.codes) {
+      if (now > entry.expiresAt) {
+        this.codes.delete(code);
+      }
+    }
+  }
+
+  destroy(): void {
+    clearInterval(this.cleanupTimer);
+    this.codes.clear();
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Token Store (access + refresh)
+// ---------------------------------------------------------------------------
+
+export interface StoredToken {
+  token: string;
+  clientId: string;
+  userId: string;
+  workspaceId: string;
+  scopes: string[];
+  expiresAt: number; // Unix seconds
+  createdAt: number; // Unix seconds
+}
+
+export class OAuthTokenStore {
+  private accessTokens = new Map<string, StoredToken>();
+  private refreshTokens = new Map<string, StoredToken>();
+  private cleanupTimer: ReturnType<typeof setInterval>;
+
+  constructor(
+    private accessTtlSec: number = 3600,
+    private refreshTtlSec: number = 30 * 24 * 3600,
+  ) {
+    this.cleanupTimer = setInterval(() => this.cleanup(), 5 * 60_000);
+    this.cleanupTimer.unref();
+  }
+
+  saveAccessToken(entry: StoredToken): void {
+    this.accessTokens.set(entry.token, entry);
+  }
+
+  getAccessToken(token: string): StoredToken | undefined {
+    const entry = this.accessTokens.get(token);
+    if (!entry) return undefined;
+    if (Date.now() / 1000 > entry.expiresAt) {
+      this.accessTokens.delete(token);
+      return undefined;
+    }
+    return entry;
+  }
+
+  revokeAccessToken(token: string): void {
+    this.accessTokens.delete(token);
+  }
+
+  saveRefreshToken(entry: StoredToken): void {
+    this.refreshTokens.set(entry.token, entry);
+  }
+
+  getRefreshToken(token: string): StoredToken | undefined {
+    const entry = this.refreshTokens.get(token);
+    if (!entry) return undefined;
+    if (Date.now() / 1000 > entry.expiresAt) {
+      this.refreshTokens.delete(token);
+      return undefined;
+    }
+    return entry;
+  }
+
+  revokeRefreshToken(token: string): void {
+    this.refreshTokens.delete(token);
+  }
+
+  get accessTtlSeconds(): number {
+    return this.accessTtlSec;
+  }
+
+  get refreshTtlSeconds(): number {
+    return this.refreshTtlSec;
+  }
+
+  private cleanup(): void {
+    const nowSec = Date.now() / 1000;
+    for (const [t, entry] of this.accessTokens) {
+      if (nowSec > entry.expiresAt) this.accessTokens.delete(t);
+    }
+    for (const [t, entry] of this.refreshTokens) {
+      if (nowSec > entry.expiresAt) this.refreshTokens.delete(t);
+    }
+  }
+
+  destroy(): void {
+    clearInterval(this.cleanupTimer);
+    this.accessTokens.clear();
+    this.refreshTokens.clear();
+  }
+}

package/src/mcp/server.ts

@@ -0,0 +1,55 @@
+#!/usr/bin/env node
+
+/**
+ * Palaryn MCP Server — standalone entry point for Claude Code and other MCP clients.
+ *
+ * Usage:
+ *   node dist/mcp/server.js
+ *   claude mcp add palaryn -- node /path/to/dist/mcp/server.js
+ *
+ * Environment variables:
+ *   PALARYN_MCP_WORKSPACE  — Workspace ID (default: 'ws-claude-code')
+ *   PALARYN_MCP_ACTOR      — Actor ID (default: 'claude-code')
+ *   PALARYN_MCP_PLATFORM   — Platform identifier (default: 'claude_code')
+ *   POLICY_PACK_PATH       — Path to policy pack YAML (default: './policy-packs/default.yaml')
+ *
+ * All logging goes to stderr — stdout is reserved for MCP JSON-RPC messages.
+ */
+
+import { startMCPBridge, MCPBridgeConfig } from './bridge';
+
+const workspace = process.env.PALARYN_MCP_WORKSPACE || 'ws-claude-code';
+const actorId = process.env.PALARYN_MCP_ACTOR || 'claude-code';
+const platform = process.env.PALARYN_MCP_PLATFORM || 'claude_code';
+
+const bridgeConfig: MCPBridgeConfig = {
+  workspace_id: workspace,
+  actor: { type: 'agent', id: actorId, display: actorId },
+  source: { platform },
+};
+
+let shuttingDown = false;
+
+export async function startMCPServer(): Promise<void> {
+  const bridge = await startMCPBridge(undefined, bridgeConfig);
+  process.stderr.write(`Palaryn MCP server started (workspace=${workspace}, actor=${actorId}, platform=${platform})\n`);
+
+  const shutdown = async () => {
+    if (shuttingDown) return;
+    shuttingDown = true;
+    process.stderr.write('Palaryn MCP server shutting down\n');
+    await bridge.close();
+    process.exit(0);
+  };
+
+  process.on('SIGINT', shutdown);
+  process.on('SIGTERM', shutdown);
+}
+
+// Direct execution (node dist/src/mcp/server.js)
+if (require.main === module) {
+  startMCPServer().catch((err) => {
+    process.stderr.write(`Palaryn MCP server fatal error: ${err instanceof Error ? err.message : String(err)}\n`);
+    process.exit(1);
+  });
+}