poe-code 4.0.21 → 4.0.23

package/packages/toolcraft/dist/http-hosted-oauth.js

@@ -0,0 +1,438 @@
+import { createHash, createHmac, generateKeyPairSync, randomBytes } from "node:crypto";
+import { exportJWK } from "jose";
+import { createAuthorizationInteractionSecurity, createInMemoryAuthorizationServerStore, createOAuthAuthorizationServer, verifyAuthorizationInteractionCsrf } from "mcp-oauth-server";
+export function isHostedOAuthConfiguration(value) {
+    return typeof value === "object" && value !== null && "kind" in value && value.kind === "hosted";
+}
+function normalizePublicUrl(value) {
+    const url = new URL(value);
+    if (url.hash.length > 0 || url.search.length > 0) {
+        throw new Error("hosted OAuth publicUrl must not contain a query or fragment.");
+    }
+    if (url.username.length > 0 || url.password.length > 0) {
+        throw new Error("hosted OAuth publicUrl must not contain credentials.");
+    }
+    if (url.pathname === "/" || url.pathname.endsWith("/")) {
+        throw new Error("hosted OAuth publicUrl must contain a non-root path without a trailing slash.");
+    }
+    return url;
+}
+function configurationErrors(config, production) {
+    const errors = [];
+    const scopes = config.advanced?.scopes ?? ["mcp", "offline_access"];
+    if (!scopes.includes("mcp"))
+        errors.push("scopes containing required mcp scope");
+    if (scopes.some((scope) => scope.length === 0 || scope.trim() !== scope || scope.includes(" "))) {
+        errors.push("valid space-free scope names");
+    }
+    if (production) {
+        if (normalizePublicUrl(config.publicUrl).protocol !== "https:")
+            errors.push("HTTPS publicUrl");
+        if (!config.storage.capabilities.durable)
+            errors.push("durable storage");
+        if (!config.storage.capabilities.encryptedCredentials)
+            errors.push("encrypted credentials");
+        if (!config.storage.capabilities.stableKeys)
+            errors.push("stable signing and subject keys");
+    }
+    return errors;
+}
+export function hostedOAuth(options) {
+    if (options.provider.name.trim().length === 0)
+        throw new Error("provider.name is required.");
+    if (options.advanced?.interaction === undefined &&
+        (options.provider.login === undefined || options.provider.connect === undefined)) {
+        throw new Error("provider.login and provider.connect are required without an advanced interaction.");
+    }
+    if (options.provider.login !== undefined && options.provider.login.fields.length === 0) {
+        throw new Error("provider.login.fields must contain at least one field.");
+    }
+    const fieldNames = (options.provider.login?.fields ?? []).map((field) => typeof field === "string" ? field : field.name);
+    if (new Set(fieldNames).size !== fieldNames.length ||
+        fieldNames.some((name) => name.length === 0 || name === "signal" || name === "csrf" || name === "transaction")) {
+        throw new Error("provider.login.fields must have unique, non-reserved names.");
+    }
+    if (options.advanced?.interaction !== undefined &&
+        (options.advanced.interaction.paths.length === 0 ||
+            new Set(options.advanced.interaction.paths).size !==
+                options.advanced.interaction.paths.length ||
+            options.advanced.interaction.paths.some((path) => !path.startsWith("/") ||
+                [
+                    "/healthz",
+                    "/oauth/connect",
+                    "/authorize",
+                    "/register",
+                    "/token",
+                    "/revoke",
+                    "/.well-known/oauth-authorization-server",
+                    "/.well-known/jwks.json",
+                    normalizePublicUrl(options.publicUrl).pathname
+                ].includes(path)))) {
+        throw new Error("advanced.interaction.paths must contain unique, non-reserved absolute paths.");
+    }
+    normalizePublicUrl(options.publicUrl);
+    return {
+        ...options,
+        kind: "hosted",
+        async prepare({ production = process.env.NODE_ENV === "production" } = {}) {
+            const errors = configurationErrors(this, production);
+            if (errors.length > 0) {
+                throw new Error(`Hosted OAuth configuration requires: ${errors.join(", ")}.`);
+            }
+            const publicUrl = normalizePublicUrl(this.publicUrl);
+            return {
+                publicUrl,
+                issuer: new URL(publicUrl.origin),
+                scopes: this.advanced?.scopes ?? ["mcp", "offline_access"]
+            };
+        }
+    };
+}
+export class HostedOAuthLoginError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "HostedOAuthLoginError";
+    }
+}
+function escapeHtml(value) {
+    return value
+        .replaceAll("&", "&")
+        .replaceAll("<", "&lt;")
+        .replaceAll(">", "&gt;")
+        .replaceAll('"', "&quot;")
+        .replaceAll("'", "&#39;");
+}
+function loginField(field) {
+    if (typeof field !== "string")
+        return field;
+    return {
+        name: field,
+        label: field === "apiKey" ? "API key" : `${field[0]?.toUpperCase() ?? ""}${field.slice(1)}`,
+        type: field === "password" || field === "apiKey" ? "password" : field === "email" ? "email" : "text"
+    };
+}
+function renderLogin(providerName, fields, transaction, csrfToken, error) {
+    const controls = fields
+        .map((field) => {
+        const name = escapeHtml(field.name);
+        return `<label>${escapeHtml(field.label ?? field.name)}<input name="${name}" type="${field.type ?? "text"}" required autocomplete="${field.type === "password" ? "current-password" : "off"}"></label>`;
+    })
+        .join("");
+    return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Connect ${escapeHtml(providerName)}</title><style>body{font:16px system-ui;max-width:28rem;margin:10vh auto;padding:1rem;color:#171717}form{display:grid;gap:1rem}label{display:grid;gap:.35rem}input,button{font:inherit;padding:.7rem}button{cursor:pointer}${error === undefined ? "" : ".error{color:#b42318}"}</style></head><body><h1>Connect ${escapeHtml(providerName)}</h1>${error === undefined ? "" : `<p class="error">${escapeHtml(error)}</p>`}<form method="post" action="/oauth/connect"><input type="hidden" name="transaction" value="${escapeHtml(transaction.id)}"><input type="hidden" name="csrf" value="${escapeHtml(csrfToken)}">${controls}<button type="submit">Connect</button></form></body></html>`;
+}
+function loginContentSecurityPolicy(transaction) {
+    const callbackOrigin = new URL(transaction.redirectUri).origin;
+    return `default-src 'none'; style-src 'unsafe-inline'; form-action 'self' ${callbackOrigin}; base-uri 'none'; frame-ancestors 'none'`;
+}
+function interactionCookieName(transactionId) {
+    const suffix = createHash("sha256").update(transactionId).digest("base64url").slice(0, 22);
+    return `__Host-mcp_oauth_csrf_${suffix}`;
+}
+function writeWebResponse(response, webResponse) {
+    webResponse.headers.forEach((value, name) => response.setHeader(name, value));
+    response.statusCode = webResponse.status;
+    return webResponse.arrayBuffer().then((body) => {
+        response.end(Buffer.from(body));
+    });
+}
+async function readBody(request, maxBytes = 65_536) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of request) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        size += buffer.length;
+        if (size > maxBytes)
+            throw new Error("Request body is too large.");
+        chunks.push(buffer);
+    }
+    return Buffer.concat(chunks);
+}
+function toWebRequest(request, issuer, body) {
+    const headers = new Headers();
+    for (const [name, value] of Object.entries(request.headers)) {
+        if (value !== undefined)
+            headers.set(name, Array.isArray(value) ? value.join(", ") : value);
+    }
+    return new Request(new URL(request.url ?? "/", issuer), {
+        method: request.method,
+        headers,
+        ...(body !== undefined && body.length > 0 ? { body: body.toString("utf8") } : {})
+    });
+}
+function credentialsFor(storage, subject) {
+    return {
+        async read() {
+            const credential = await storage.credentials.get(subject);
+            if (credential === undefined)
+                throw new Error("Provider credential is missing; reconnect required.");
+            return credential;
+        },
+        update: (update) => storage.credentials.update(subject, update),
+        delete: () => storage.credentials.delete(subject)
+    };
+}
+/** @internal */
+export async function prepareHostedOAuthRuntime(config) {
+    const prepared = await config.prepare();
+    const fields = (config.provider.login?.fields ?? []).map(loginField);
+    const customInteraction = config.advanced?.interaction;
+    const displayName = config.advanced?.branding?.title ?? config.provider.name;
+    const interaction = {
+        async start({ request, transaction }) {
+            await config.storage.interactions.set(transaction);
+            if (customInteraction !== undefined) {
+                return customInteraction.start({ request, transaction });
+            }
+            const security = createAuthorizationInteractionSecurity({
+                cookieName: interactionCookieName(transaction.id)
+            });
+            return new Response(renderLogin(displayName, fields, transaction, security.csrfToken), {
+                status: 200,
+                headers: {
+                    "content-type": "text/html; charset=utf-8",
+                    "content-security-policy": loginContentSecurityPolicy(transaction),
+                    "cache-control": "no-store",
+                    "referrer-policy": "no-referrer",
+                    "x-content-type-options": "nosniff",
+                    "set-cookie": security.setCookie
+                }
+            });
+        }
+    };
+    await config.storage.cleanup?.();
+    const authorizationServer = createOAuthAuthorizationServer({
+        issuer: prepared.issuer.href,
+        resources: [prepared.publicUrl.href],
+        scopesSupported: prepared.scopes,
+        defaultScopes: prepared.scopes,
+        signingKey: await config.storage.signingKey(),
+        additionalPublicJwks: config.advanced?.additionalPublicJwks,
+        store: config.storage.authorizationServer,
+        interaction,
+        accessTokenTtlSeconds: config.advanced?.accessTokenTtlSeconds,
+        authorizationCodeTtlSeconds: config.advanced?.authorizationCodeTtlSeconds,
+        authorizationTransactionTtlSeconds: config.advanced?.authorizationTransactionTtlSeconds,
+        refreshTokenTtlSeconds: config.advanced?.refreshTokenTtlSeconds
+    });
+    const requestHandler = async (request, response) => {
+        const url = new URL(request.url ?? "/", prepared.issuer);
+        if (request.method === "GET" && url.pathname === "/healthz") {
+            response.writeHead(200, { "content-type": "application/json", "cache-control": "no-store" });
+            response.end('{"ok":true}');
+            return true;
+        }
+        if (customInteraction?.paths.includes(url.pathname) === true) {
+            const body = request.method === "GET" || request.method === "HEAD" ? undefined : await readBody(request);
+            const handled = await customInteraction.handle({
+                request: toWebRequest(request, prepared.issuer, body),
+                async complete({ transactionId, accountId, credential }) {
+                    const subject = await config.storage.resolveSubject(config.provider.name, accountId);
+                    const completed = await authorizationServer.completeAuthorization({
+                        transactionId,
+                        subject
+                    });
+                    await config.storage.credentials.set(subject, credential);
+                    await config.storage.interactions.delete(transactionId);
+                    return new Response(null, {
+                        status: 303,
+                        headers: {
+                            location: completed.redirectUrl.href,
+                            "cache-control": "no-store",
+                            "content-security-policy": "default-src 'none'",
+                            "referrer-policy": "no-referrer"
+                        }
+                    });
+                }
+            });
+            await writeWebResponse(response, handled);
+            return true;
+        }
+        if (request.method === "POST" && url.pathname === "/oauth/connect") {
+            const body = new URLSearchParams((await readBody(request)).toString("utf8"));
+            const transactionId = body.get("transaction") ?? "";
+            const transaction = await config.storage.interactions.get(transactionId);
+            const csrf = body.get("csrf") ?? "";
+            if (transaction === undefined ||
+                !verifyAuthorizationInteractionCsrf({
+                    cookieHeader: request.headers.cookie ?? null,
+                    submittedToken: csrf,
+                    cookieName: interactionCookieName(transactionId)
+                }) ||
+                transaction.expiresAt <= Date.now()) {
+                response.writeHead(400, {
+                    "content-type": "text/plain; charset=utf-8",
+                    "cache-control": "no-store"
+                });
+                response.end("This connection has expired or was already used. Restart the connection.");
+                return true;
+            }
+            const controller = new AbortController();
+            request.once("aborted", () => controller.abort());
+            const values = Object.assign(Object.create(null), {
+                signal: controller.signal
+            });
+            for (const field of fields)
+                values[field.name] = body.get(field.name) ?? "";
+            try {
+                const connect = config.provider.connect;
+                if (connect === undefined)
+                    throw new Error("Provider form connection is not configured.");
+                const connected = await connect(values);
+                if (connected.accountId.trim().length === 0)
+                    throw new Error("Provider returned an empty accountId.");
+                const subject = await config.storage.resolveSubject(config.provider.name, connected.accountId);
+                const completed = await authorizationServer.completeAuthorization({
+                    transactionId,
+                    subject
+                });
+                await config.storage.credentials.set(subject, connected.credential);
+                await config.storage.interactions.delete(transactionId);
+                response.writeHead(303, {
+                    location: completed.redirectUrl.href,
+                    "cache-control": "no-store",
+                    "content-security-policy": "default-src 'none'",
+                    "referrer-policy": "no-referrer"
+                });
+                response.end();
+            }
+            catch (error) {
+                const safeError = error instanceof HostedOAuthLoginError
+                    ? error.message
+                    : "Sign-in failed. Please try again.";
+                response.writeHead(400, {
+                    "content-type": "text/html; charset=utf-8",
+                    "content-security-policy": loginContentSecurityPolicy(transaction),
+                    "cache-control": "no-store",
+                    "referrer-policy": "no-referrer"
+                });
+                response.end(renderLogin(displayName, fields, transaction, csrf, safeError));
+            }
+            return true;
+        }
+        const oauthPaths = new Set([
+            "/.well-known/oauth-authorization-server",
+            "/.well-known/jwks.json",
+            "/authorize",
+            "/register",
+            "/token",
+            "/revoke"
+        ]);
+        if (!oauthPaths.has(url.pathname))
+            return false;
+        const body = request.method === "POST" ? await readBody(request) : undefined;
+        await writeWebResponse(response, await authorizationServer.handle(toWebRequest(request, prepared.issuer, body)));
+        return true;
+    };
+    return {
+        mcpPath: prepared.publicUrl.pathname,
+        oauth: {
+            resource: prepared.publicUrl.href,
+            authorizationServers: [authorizationServer.issuer],
+            requiredScopes: ["mcp"],
+            scopesSupported: [...prepared.scopes],
+            verifier: {
+                async verify(input) {
+                    const verified = await authorizationServer.verifyAccessToken(input.token, prepared.publicUrl.href);
+                    return {
+                        token: input.token,
+                        issuer: authorizationServer.issuer,
+                        audience: [verified.resource],
+                        scopes: [...verified.scopes],
+                        expiresAt: verified.expiresAt,
+                        claims: { sub: verified.subject, client_id: verified.clientId, jti: verified.tokenId },
+                        subject: verified.subject,
+                        clientId: verified.clientId
+                    };
+                }
+            }
+        },
+        requestHandler,
+        async requestServices(identity) {
+            const credentials = credentialsFor(config.storage, identity.subject);
+            await credentials.read();
+            return config.provider.services({ credentials, identity });
+        }
+    };
+}
+export function createInMemoryHostedOAuthStorage(options) {
+    if (options.development !== true) {
+        throw new Error("In-memory hosted OAuth storage requires explicit development mode.");
+    }
+    const credentials = new Map();
+    const interactions = new Map();
+    const updates = new Map();
+    const subjectSalt = randomBytes(32);
+    let signingKeyPromise;
+    return {
+        authorizationServer: createInMemoryAuthorizationServerStore(),
+        interactions: {
+            async set(transaction) {
+                interactions.set(transaction.id, structuredClone(transaction));
+            },
+            async get(transactionId) {
+                const transaction = interactions.get(transactionId);
+                return transaction === undefined ? undefined : structuredClone(transaction);
+            },
+            async delete(transactionId) {
+                interactions.delete(transactionId);
+            }
+        },
+        capabilities: {
+            durable: false,
+            encryptedCredentials: false,
+            stableKeys: false,
+            shared: false
+        },
+        credentials: {
+            async get(subject) {
+                return credentials.get(subject);
+            },
+            async set(subject, credential) {
+                credentials.set(subject, credential);
+            },
+            async delete(subject) {
+                credentials.delete(subject);
+            },
+            async update(subject, update) {
+                const previous = updates.get(subject) ?? Promise.resolve();
+                const next = previous.then(async () => {
+                    const current = credentials.get(subject);
+                    if (current === undefined)
+                        throw new Error("Provider credential is missing; reconnect required.");
+                    const replacement = await update(current);
+                    credentials.set(subject, replacement);
+                    return replacement;
+                });
+                updates.set(subject, next);
+                try {
+                    return await next;
+                }
+                finally {
+                    if (updates.get(subject) === next)
+                        updates.delete(subject);
+                }
+            }
+        },
+        async signingKey() {
+            signingKeyPromise ??= (async () => {
+                const { privateKey, publicKey } = generateKeyPairSync("ec", {
+                    namedCurve: "prime256v1"
+                });
+                return {
+                    algorithm: "ES256",
+                    keyId: randomBytes(16).toString("base64url"),
+                    privateKey,
+                    publicJwk: await exportJWK(publicKey)
+                };
+            })();
+            return await signingKeyPromise;
+        },
+        async resolveSubject(providerName, accountId) {
+            return createHmac("sha256", subjectSalt)
+                .update(providerName)
+                .update("\0")
+                .update(accountId)
+                .digest("base64url");
+        }
+    };
+}

package/packages/toolcraft/dist/http.d.ts

@@ -1,18 +1,20 @@
 import "./node-require-shim.js";
-import { type HttpListenOptions, type HttpServer, type HttpServerHandle, type HttpToolContext, type HttpTransportOptions } from "../../tiny-http-mcp-server/dist/server.js";
+import { type HttpListenOptions, type HttpServer, type HttpServerHandle, type HttpToolContext, type HttpTransportOptions, type TinyHttpMcpServerOAuthOptions } from "../../tiny-http-mcp-server/dist/server.js";
 import type { Group } from "./index.js";
 import type { OAuthAuthorizationServer } from "../../mcp-oauth-server/dist/index.js";
 import { type RunMCPOptions } from "./mcp.js";
+import { type HostedOAuthConfiguration } from "./http-hosted-oauth.js";
 export type ToolcraftHTTPContext = HttpToolContext;
 export type ToolcraftHTTPServer = HttpServer;
 export type ToolcraftHTTPServerHandle = HttpServerHandle;
-type HTTPTransportControls = Omit<HttpTransportOptions, "name" | "version" | "validateToolArguments">;
+type HTTPTransportControls = Omit<HttpTransportOptions, "name" | "version" | "validateToolArguments" | "oauth" | "requestHandler">;
 type HTTPListenControls = Omit<HttpListenOptions, "port" | "hostname" | "path">;
 export interface RunHTTPMCPOptions<TServices extends object = Record<string, unknown>> extends RunMCPOptions<TServices>, HTTPTransportControls, HTTPListenControls {
     hostname?: string;
     port?: number;
     path?: string;
     requestServices?(context: ToolcraftHTTPContext): Partial<TServices> | Promise<Partial<TServices>>;
+    oauth?: TinyHttpMcpServerOAuthOptions | HostedOAuthConfiguration<unknown, TServices>;
 }
 export interface HTTPMCPAuthorizationOptions {
     authorizationServer: Pick<OAuthAuthorizationServer, "issuer" | "verifyAccessToken">;

package/packages/toolcraft/dist/http.js

@@ -2,6 +2,7 @@ import "./node-require-shim.js";
 import { createHttpServer } from "tiny-http-mcp-server/server";
 import { createMCPServerForTransport } from "./mcp.js";
 import { enableSourceMaps } from "./stack-trim.js";
+import { isHostedOAuthConfiguration, prepareHostedOAuthRuntime } from "./http-hosted-oauth.js";
 function toVerifiedAccessToken(token, issuer, verified) {
     return {
         token,
@@ -62,7 +63,8 @@ function createTransportOptions(options, serverOptions) {
         requestIdGenerator: options.requestIdGenerator,
         observability: options.observability,
         trustedProxy: options.trustedProxy,
-        oauth: options.oauth
+        oauth: options.oauth,
+        requestHandler: options.requestHandler
     };
 }
 function createListenOptions(options) {
@@ -77,20 +79,70 @@ function createListenOptions(options) {
     };
 }
 export async function createHTTPMCPServer(roots, options) {
+    let resolvedOptions = options;
+    let hostedMcpPath;
+    if (isHostedOAuthConfiguration(options.oauth)) {
+        const runtime = await prepareHostedOAuthRuntime(options.oauth);
+        const applicationServices = options.requestServices;
+        hostedMcpPath = runtime.mcpPath;
+        resolvedOptions = {
+            ...options,
+            oauth: runtime.oauth,
+            sessionIdGenerator: undefined,
+            enableJsonResponse: true,
+            requestServices: async (context) => {
+                const auth = context.auth;
+                const subject = auth?.subject;
+                if (auth === undefined || subject === undefined)
+                    throw new Error("Hosted OAuth request is missing a verified subject.");
+                return {
+                    ...(applicationServices === undefined ? {} : await applicationServices(context)),
+                    ...(await runtime.requestServices({
+                        issuer: auth.issuer,
+                        subject,
+                        clientId: auth.clientId,
+                        scopes: auth.scopes,
+                        resource: auth.resource.href
+                    }))
+                };
+            },
+            requestHandler: runtime.requestHandler
+        };
+    }
     let server;
-    await createMCPServerForTransport(roots, options, {
+    await createMCPServerForTransport(roots, resolvedOptions, {
         createServer(serverOptions) {
-            server = createHttpServer(createTransportOptions(options, serverOptions));
+            server = createHttpServer(createTransportOptions(resolvedOptions, serverOptions));
             return server;
         },
         getRequestContext() {
             return server?.getRequestContext();
         },
-        requestServices: options.requestServices
+        requestServices: resolvedOptions.requestServices
     });
     if (server === undefined) {
         throw new Error("Toolcraft HTTP MCP server was not created.");
     }
+    if (hostedMcpPath !== undefined) {
+        const listenHttp = server.listenHttp.bind(server);
+        server.listenHttp = async (listenOptions = {}) => {
+            if (listenOptions.path !== undefined) {
+                const withLeadingSlash = listenOptions.path.startsWith("/")
+                    ? listenOptions.path
+                    : `/${listenOptions.path}`;
+                const requestedPath = withLeadingSlash.length > 1 && withLeadingSlash.endsWith("/")
+                    ? withLeadingSlash.slice(0, -1)
+                    : withLeadingSlash;
+                if (requestedPath !== hostedMcpPath) {
+                    throw new Error(`Hosted OAuth MCP path ${JSON.stringify(requestedPath)} conflicts with publicUrl path ${JSON.stringify(hostedMcpPath)}.`);
+                }
+            }
+            return listenHttp({
+                ...listenOptions,
+                path: hostedMcpPath
+            });
+        };
+    }
     return server;
 }
 export async function runHTTPMCP(roots, options) {