pi-soly 1.9.3 → 1.11.0

package/mcp/mcp-auth-flow.upstream-test.ts

@@ -0,0 +1,259 @@
+/**
+ * Tests for mcp-auth-flow.ts - OAuth flow using MCP SDK
+ */
+
+import { describe, it, before, after } from "node:test"
+import assert from "node:assert"
+import { existsSync, rmSync, mkdirSync } from "fs"
+import { join } from "path"
+import { tmpdir } from "os"
+import { randomBytes } from "crypto"
+
+// Set up isolated temp directory for tests
+const TEST_DIR = join(tmpdir(), `mcp-oauth-test-${randomBytes(4).toString('hex')}`)
+process.env.MCP_OAUTH_DIR = TEST_DIR
+
+import {
+  authenticate,
+  startAuth,
+  completeAuth,
+  getAuthStatus,
+  removeAuth,
+  supportsOAuth,
+  extractOAuthConfig,
+  initializeOAuth,
+  shutdownOAuth,
+  type AuthStatus,
+} from "./mcp-auth-flow.ts"
+import { isCallbackServerRunning } from "./mcp-callback-server.ts"
+import { updateTokens, clearAllCredentials } from "./mcp-auth.ts"
+import type { ServerEntry } from "./types.ts"
+
+describe("mcp-auth-flow", () => {
+  before(() => {
+    // Ensure clean state
+    try {
+      if (existsSync(TEST_DIR)) {
+        rmSync(TEST_DIR, { recursive: true, force: true })
+      }
+      mkdirSync(TEST_DIR, { recursive: true })
+    } catch {
+      // Ignore cleanup errors
+    }
+  })
+
+  after(async () => {
+    // Shutdown OAuth and clean up
+    await shutdownOAuth()
+    try {
+      if (existsSync(TEST_DIR)) {
+        rmSync(TEST_DIR, { recursive: true, force: true })
+      }
+    } catch {
+      // Ignore cleanup errors
+    }
+  })
+
+  describe("supportsOAuth", () => {
+    it("should return true for OAuth HTTP server", () => {
+      const definition: ServerEntry = {
+        url: "https://api.example.com/mcp",
+      }
+      assert.strictEqual(supportsOAuth(definition), true)
+    })
+
+    it("should return false for bearer auth", () => {
+      const definition: ServerEntry = {
+        url: "https://api.example.com/mcp",
+        auth: "bearer",
+      }
+      assert.strictEqual(supportsOAuth(definition), false)
+    })
+
+    it("should return false for stdio server", () => {
+      const definition: ServerEntry = {
+        command: "npx",
+        args: ["-y", "@example/mcp-server"],
+      }
+      assert.strictEqual(supportsOAuth(definition), false)
+    })
+
+    it("should return false when no URL", () => {
+      const definition: ServerEntry = {}
+      assert.strictEqual(supportsOAuth(definition), false)
+    })
+  })
+
+  describe("getAuthStatus", () => {
+    it("should return 'not_authenticated' when no tokens", async () => {
+      const status = await getAuthStatus("status-test-none")
+      assert.strictEqual(status, "not_authenticated")
+    })
+
+    it("should return 'authenticated' when tokens exist and not expired", async () => {
+      await updateTokens("status-test-ok", {
+        accessToken: "token",
+        expiresAt: Date.now() / 1000 + 3600, // 1 hour from now
+      })
+
+      const status = await getAuthStatus("status-test-ok")
+      assert.strictEqual(status, "authenticated")
+    })
+
+    it("should return 'expired' when tokens are expired", async () => {
+      await updateTokens("status-test-expired", {
+        accessToken: "token",
+        expiresAt: Date.now() / 1000 - 3600, // 1 hour ago
+      })
+
+      const status = await getAuthStatus("status-test-expired")
+      assert.strictEqual(status, "expired")
+    })
+  })
+
+  describe("removeAuth", () => {
+    it("should remove all credentials", async () => {
+      await updateTokens("remove-test", { accessToken: "token" })
+
+      await removeAuth("remove-test")
+
+      const status = await getAuthStatus("remove-test")
+      assert.strictEqual(status, "not_authenticated")
+    })
+  })
+
+  describe("initializeOAuth / shutdownOAuth", () => {
+    it("should not start callback server on initialize", async () => {
+      await shutdownOAuth()
+      await initializeOAuth()
+      assert.strictEqual(isCallbackServerRunning(), false)
+    })
+
+    it("should stop callback server on shutdown", async () => {
+      await initializeOAuth()
+      await shutdownOAuth()
+      assert.strictEqual(isCallbackServerRunning(), false)
+    })
+  })
+
+  describe("authenticate / completeAuth", () => {
+    it("should throw if no server URL provided", async () => {
+      await assert.rejects(
+        async () => await authenticate("no-url-test", ""),
+        /Invalid URL/
+      )
+    })
+
+    it("should reject malformed OAuth redirectUri values", async () => {
+      await assert.rejects(
+        async () => await startAuth("bad-redirect", "https://api.example.com/mcp", {
+          url: "https://api.example.com/mcp",
+          auth: "oauth",
+          oauth: { redirectUri: "not a url" },
+        }),
+        /Invalid OAuth redirectUri/
+      )
+    })
+
+    it("should reject non-local OAuth redirectUri values", async () => {
+      await assert.rejects(
+        async () => await startAuth("remote-redirect", "https://api.example.com/mcp", {
+          url: "https://api.example.com/mcp",
+          auth: "oauth",
+          oauth: { redirectUri: "https://example.com:3118/callback" },
+        }),
+        /localhost or loopback/
+      )
+    })
+
+    it("should reject OAuth redirectUri values without an explicit port", async () => {
+      await assert.rejects(
+        async () => await startAuth("no-port-redirect", "https://api.example.com/mcp", {
+          url: "https://api.example.com/mcp",
+          auth: "oauth",
+          oauth: { redirectUri: "http://localhost/callback" },
+        }),
+        /explicit numeric port/
+      )
+    })
+
+    it("should reject blank OAuth redirectUri values", async () => {
+      await assert.rejects(
+        async () => await startAuth("blank-redirect", "https://api.example.com/mcp", {
+          url: "https://api.example.com/mcp",
+          auth: "oauth",
+          oauth: { redirectUri: "  " },
+        }),
+        /redirectUri must not be empty/
+      )
+    })
+
+    it("should reject non-string OAuth redirectUri values", async () => {
+      await assert.rejects(
+        async () => await startAuth("typed-redirect", "https://api.example.com/mcp", {
+          url: "https://api.example.com/mcp",
+          auth: "oauth",
+          oauth: { redirectUri: 3118 as unknown as string },
+        }),
+        /redirectUri must be a string/
+      )
+    })
+
+    it("should reject OAuth redirectUri values with fragments", async () => {
+      await assert.rejects(
+        async () => await startAuth("fragment-redirect", "https://api.example.com/mcp", {
+          url: "https://api.example.com/mcp",
+          auth: "oauth",
+          oauth: { redirectUri: "http://localhost:3118/callback#fragment" },
+        }),
+        /redirectUri must not include a fragment/
+      )
+    })
+
+    it("should reject OAuth redirectUri values with username or password", async () => {
+      await assert.rejects(
+        async () => await startAuth("credential-redirect", "https://api.example.com/mcp", {
+          url: "https://api.example.com/mcp",
+          auth: "oauth",
+          oauth: { redirectUri: "http://user:pass@localhost:3118/callback" },
+        }),
+        /redirectUri must not include username or password/
+      )
+    })
+
+    it("should reject non-string OAuth clientName and clientUri values", () => {
+      assert.throws(
+        () => extractOAuthConfig({
+          url: "https://api.example.com/mcp",
+          auth: "oauth",
+          oauth: { clientName: 123 as unknown as string },
+        }),
+        /clientName must be a string/
+      )
+      assert.throws(
+        () => extractOAuthConfig({
+          url: "https://api.example.com/mcp",
+          auth: "oauth",
+          oauth: { clientUri: 123 as unknown as string },
+        }),
+        /clientUri must be a string/
+      )
+    })
+
+    it("should trim OAuth redirectUri and client metadata values", () => {
+      const config = extractOAuthConfig({
+        url: "https://api.example.com/mcp",
+        auth: "oauth",
+        oauth: {
+          redirectUri: "  http://localhost:3118/callback  ",
+          clientName: "  Custom MCP  ",
+          clientUri: "  https://example.com/custom  ",
+        },
+      })
+
+      assert.strictEqual(config.redirectUri, "http://localhost:3118/callback")
+      assert.strictEqual(config.clientName, "Custom MCP")
+      assert.strictEqual(config.clientUri, "https://example.com/custom")
+    })
+  })
+})

package/mcp/mcp-auth.ts

@@ -0,0 +1,302 @@
+/**
+ * MCP Auth Storage Module
+ * 
+ * Handles secure storage of OAuth credentials, tokens, client information,
+ * and PKCE state for MCP servers.
+ * 
+ * Token storage location: $MCP_OAUTH_DIR/sha256-<server-hash>/tokens.json when set,
+ * otherwise <Pi agent dir>/mcp-oauth/sha256-<server-hash>/tokens.json
+ */
+
+import { createHash } from 'crypto';
+import { mkdirSync, readFileSync, writeFileSync, existsSync, rmSync } from 'fs';
+import { join } from 'path';
+import { getAgentPath } from './agent-dir.ts';
+
+/** OAuth token storage format */
+export interface StoredTokens {
+  accessToken: string;
+  refreshToken?: string;
+  expiresAt?: number; // Unix timestamp in seconds
+  scope?: string;
+}
+
+/** OAuth client information from dynamic or static registration */
+export interface StoredClientInfo {
+  clientId: string;
+  clientSecret?: string;
+  clientIdIssuedAt?: number;
+  clientSecretExpiresAt?: number;
+  redirectUris?: string[];
+}
+
+/** Complete auth entry for a server */
+export interface AuthEntry {
+  tokens?: StoredTokens;
+  clientInfo?: StoredClientInfo;
+  codeVerifier?: string;
+  oauthState?: string;
+  serverUrl?: string; // Track the URL these credentials are for
+}
+
+// Base directory for auth storage - can be overridden via env var for testing
+function getAuthBaseDir(): string {
+  const override = process.env.MCP_OAUTH_DIR?.trim();
+  return override ? override : getAgentPath('mcp-oauth');
+}
+
+/**
+ * Get the server-specific directory path.
+ */
+function getServerDir(serverName: string): string {
+  if (typeof serverName !== 'string') {
+    throw new Error(`Invalid MCP server name: ${JSON.stringify(serverName)}`);
+  }
+  const storageKey = createHash('sha256').update(serverName, 'utf8').digest('hex');
+  return join(getAuthBaseDir(), `sha256-${storageKey}`);
+}
+
+/**
+ * Get the tokens file path for a server.
+ */
+export function getAuthEntryFilePath(serverName: string): string {
+  return join(getServerDir(serverName), 'tokens.json');
+}
+
+/**
+ * Ensure the server directory exists with secure permissions.
+ */
+function ensureServerDir(serverName: string): void {
+  const dir = getServerDir(serverName);
+  if (!existsSync(dir)) {
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+  }
+}
+
+/**
+ * Read the auth entry for a server from disk.
+ * Returns undefined if file doesn't exist.
+ */
+function readAuthEntry(serverName: string): AuthEntry | undefined {
+  const filePath = getAuthEntryFilePath(serverName);
+  try {
+    if (!existsSync(filePath)) {
+      return undefined;
+    }
+    const data = readFileSync(filePath, 'utf-8');
+    return JSON.parse(data) as AuthEntry;
+  } catch (error) {
+    console.error(`Failed to read auth entry for ${serverName}:`, error);
+    return undefined;
+  }
+}
+
+/**
+ * Write the auth entry for a server to disk with secure permissions.
+ */
+function writeAuthEntry(serverName: string, entry: AuthEntry): void {
+  ensureServerDir(serverName);
+  const filePath = getAuthEntryFilePath(serverName);
+  writeFileSync(filePath, JSON.stringify(entry, null, 2), { mode: 0o600 });
+}
+
+/**
+ * Get auth entry for a server.
+ */
+export function getAuthEntry(serverName: string): AuthEntry | undefined {
+  return readAuthEntry(serverName);
+}
+
+/**
+ * Get auth entry and validate it's for the correct URL.
+ * Returns undefined if URL has changed (credentials are invalid).
+ */
+export function getAuthForUrl(serverName: string, serverUrl: string): AuthEntry | undefined {
+  const entry = getAuthEntry(serverName);
+  if (!entry) return undefined;
+
+  // If no serverUrl is stored, this is from an old version - consider it invalid
+  if (!entry.serverUrl) return undefined;
+
+  // If URL has changed, credentials are invalid
+  if (entry.serverUrl !== serverUrl) return undefined;
+
+  return entry;
+}
+
+/**
+ * Save auth entry for a server.
+ */
+export function saveAuthEntry(serverName: string, entry: AuthEntry, serverUrl?: string): void {
+  // Always update serverUrl if provided
+  if (serverUrl) {
+    entry.serverUrl = serverUrl;
+  }
+  writeAuthEntry(serverName, entry);
+}
+
+/**
+ * Remove auth entry for a server.
+ * Also removes the server directory if empty.
+ */
+export function removeAuthEntry(serverName: string): void {
+  try {
+    const filePath = getAuthEntryFilePath(serverName);
+    if (existsSync(filePath)) {
+      writeFileSync(filePath, '{}', { mode: 0o600 });
+    }
+    // Try to remove the directory
+    const dir = getServerDir(serverName);
+    if (existsSync(dir)) {
+      try {
+        rmSync(dir, { recursive: true });
+      } catch {
+        // Directory may not be empty, ignore
+      }
+    }
+  } catch (error) {
+    console.error(`Failed to remove auth entry for ${serverName}:`, error);
+  }
+}
+
+/**
+ * Update tokens for a server.
+ */
+export function updateTokens(
+  serverName: string, 
+  tokens: StoredTokens, 
+  serverUrl?: string
+): void {
+  const entry = getAuthEntry(serverName) ?? {};
+  if (serverUrl && entry.serverUrl !== serverUrl) {
+    delete entry.clientInfo;
+    delete entry.codeVerifier;
+    delete entry.oauthState;
+  }
+  entry.tokens = tokens;
+  saveAuthEntry(serverName, entry, serverUrl);
+}
+
+/**
+ * Update client info for a server.
+ */
+export function updateClientInfo(
+  serverName: string, 
+  clientInfo: StoredClientInfo, 
+  serverUrl?: string
+): void {
+  const entry = getAuthEntry(serverName) ?? {};
+  if (serverUrl && entry.serverUrl !== serverUrl) {
+    delete entry.tokens;
+    delete entry.codeVerifier;
+    delete entry.oauthState;
+  }
+  entry.clientInfo = clientInfo;
+  saveAuthEntry(serverName, entry, serverUrl);
+}
+
+/**
+ * Update code verifier for a server.
+ */
+export function updateCodeVerifier(serverName: string, codeVerifier: string, serverUrl?: string): void {
+  const entry = getAuthEntry(serverName) ?? {};
+  if (serverUrl && entry.serverUrl !== serverUrl) {
+    delete entry.tokens;
+    delete entry.clientInfo;
+    delete entry.oauthState;
+  }
+  entry.codeVerifier = codeVerifier;
+  saveAuthEntry(serverName, entry, serverUrl);
+}
+
+/**
+ * Clear code verifier for a server.
+ */
+export function clearCodeVerifier(serverName: string): void {
+  const entry = getAuthEntry(serverName);
+  if (entry) {
+    delete entry.codeVerifier;
+    saveAuthEntry(serverName, entry);
+  }
+}
+
+/**
+ * Update OAuth state for a server.
+ */
+export function updateOAuthState(serverName: string, state: string, serverUrl?: string): void {
+  const entry = getAuthEntry(serverName) ?? {};
+  if (serverUrl && entry.serverUrl !== serverUrl) {
+    delete entry.tokens;
+    delete entry.clientInfo;
+    delete entry.codeVerifier;
+  }
+  entry.oauthState = state;
+  saveAuthEntry(serverName, entry, serverUrl);
+}
+
+/**
+ * Get OAuth state for a server.
+ */
+export function getOAuthState(serverName: string): string | undefined {
+  const entry = getAuthEntry(serverName);
+  return entry?.oauthState;
+}
+
+/**
+ * Clear OAuth state for a server.
+ */
+export function clearOAuthState(serverName: string): void {
+  const entry = getAuthEntry(serverName);
+  if (entry) {
+    delete entry.oauthState;
+    saveAuthEntry(serverName, entry);
+  }
+}
+
+/**
+ * Check if stored tokens are expired.
+ * Returns null if no tokens exist, false if no expiry or not expired, true if expired.
+ */
+export function isTokenExpired(serverName: string): boolean | null {
+  const entry = getAuthEntry(serverName);
+  if (!entry?.tokens) return null;
+  if (!entry.tokens.expiresAt) return false;
+  return entry.tokens.expiresAt < Date.now() / 1000;
+}
+
+/**
+ * Check if a server has stored tokens.
+ */
+export function hasStoredTokens(serverName: string): boolean {
+  const entry = getAuthEntry(serverName);
+  return !!entry?.tokens;
+}
+
+/**
+ * Clear all credentials for a server.
+ */
+export function clearAllCredentials(serverName: string): void {
+  removeAuthEntry(serverName);
+}
+
+/**
+ * Clear only client info for a server.
+ */
+export function clearClientInfo(serverName: string): void {
+  const entry = getAuthEntry(serverName);
+  if (entry) {
+    delete entry.clientInfo;
+    saveAuthEntry(serverName, entry);
+  }
+}
+
+/**
+ * Clear only tokens for a server.
+ */
+export function clearTokens(serverName: string): void {
+  const entry = getAuthEntry(serverName);
+  if (entry) {
+    delete entry.tokens;
+    saveAuthEntry(serverName, entry);
+  }
+}