promptfoo 0.125.0 → 0.125.1

package/dist/src/util-CCtqagKc.js

@@ -1,286 +0,0 @@
-import "./shared-DS0YmCOx.js";
-import { X as getProcessEnv, o as logger, y as sanitizeObject } from "./logger-CNHLbG5Y.js";
-import "./dataUrl-CzKvvWNO.js";
-import { t as fetchWithProxy } from "./fetch-5HtnNhHg.js";
-import { y as waitForPromiseWithAbort } from "./shared-BnN4RWgk.js";
-import { n as renderVarsInObject } from "./render-DrCSgzhR.js";
-//#region src/providers/mcp/auth.ts
-function splitOAuthScopes(value) {
-	return value.split(/[,\s]+/).filter(Boolean);
-}
-function normalizeRenderedOAuthScopes(scopes) {
-	if (typeof scopes === "string") return splitOAuthScopes(scopes);
-	if (Array.isArray(scopes)) return scopes.flatMap((scope) => typeof scope === "string" ? splitOAuthScopes(scope) : []);
-}
-function normalizeRenderedAuth(auth) {
-	if (!auth || typeof auth !== "object") return auth;
-	const authObject = auth;
-	if (authObject.type !== "oauth" || authObject.scopes === void 0) return auth;
-	return {
-		...authObject,
-		scopes: normalizeRenderedOAuthScopes(authObject.scopes)
-	};
-}
-//#endregion
-//#region src/util/oauth.ts
-/**
-* Buffer time before token expiry to trigger proactive refresh (60 seconds)
-*/
-const TOKEN_REFRESH_BUFFER_MS = 6e4;
-/**
-* Fetch an OAuth token from a token endpoint.
-* Handles both client_credentials and password grant types.
-*
-* @param config - OAuth configuration with rendered/resolved values
-* @returns Token and expiration timestamp
-*/
-async function fetchOAuthToken(config) {
-	const now = Date.now();
-	logger.debug("[OAuth] Fetching new token");
-	const tokenRequestBody = new URLSearchParams();
-	tokenRequestBody.append("grant_type", config.grantType);
-	if (config.clientId) tokenRequestBody.append("client_id", config.clientId);
-	if (config.clientSecret) tokenRequestBody.append("client_secret", config.clientSecret);
-	if (config.grantType === "password") {
-		if (config.username) tokenRequestBody.append("username", config.username);
-		if (config.password) tokenRequestBody.append("password", config.password);
-	}
-	if (config.scopes && config.scopes.length > 0) tokenRequestBody.append("scope", config.scopes.join(" "));
-	const response = await fetchWithProxy(config.tokenUrl, {
-		signal: config.signal,
-		method: "POST",
-		redirect: config.redirect,
-		headers: { "Content-Type": "application/x-www-form-urlencoded" },
-		body: tokenRequestBody.toString()
-	});
-	if (!response.ok) {
-		const errorText = await response.text();
-		throw new Error(`OAuth token request failed with status ${response.status} ${response.statusText}: ${errorText}`);
-	}
-	const tokenData = await response.json();
-	if (!tokenData.access_token) throw new Error("OAuth token response missing access_token");
-	const expiresAt = now + (tokenData.expires_in || 3600) * 1e3;
-	logger.debug("[OAuth] Successfully fetched token");
-	return {
-		accessToken: tokenData.access_token,
-		expiresAt
-	};
-}
-//#endregion
-//#region src/providers/mcp/util.ts
-function sanitizeMcpToolData(value) {
-	return sanitizeObject(value, {
-		context: "MCP tool data",
-		sanitizeUrls: true
-	});
-}
-function normalizeMcpToolContent(content, onUnknownContent) {
-	if (content == null) return "";
-	if (typeof content === "string") return content;
-	if (Array.isArray(content)) return content.map((part) => {
-		if (typeof part === "string") return part;
-		if (part && typeof part === "object") {
-			if ("text" in part && part.text != null) return String(part.text);
-			if ("json" in part) return JSON.stringify(part.json);
-			if ("data" in part) return JSON.stringify(part.data);
-			onUnknownContent?.(part);
-			return JSON.stringify(part);
-		}
-		return String(part);
-	}).join("\n");
-	return JSON.stringify(content);
-}
-function isMcpToolNameFilter(tools) {
-	const isPlainToolName = (tool) => typeof tool === "string" && !tool.startsWith("file://");
-	return isPlainToolName(tools) || Array.isArray(tools) && tools.every((tool) => isPlainToolName(tool));
-}
-/**
-* Returns true when an MCP tool call surfaced a failure: either the SDK call
-* threw (`error` is set) or the tool resolved with a protocol-level
-* `isError: true` result.
-*/
-function isMcpErrorResult(result) {
-	return Boolean(result.error || result.isError);
-}
-/**
-* Resolve a human-readable message for a failed MCP tool call. Prefers the
-* thrown-error message, falls back to the tool's own error content, and finally
-* to a generic message for tools that signal `isError` without any detail.
-*/
-function getMcpErrorMessage(result) {
-	return result.error || result.content || "Tool returned an error result";
-}
-/**
-* Render environment variables in server config auth fields.
-* Supports {{VAR_NAME}} syntax for variable substitution.
-*/
-function renderAuthVars(server, vars) {
-	if (!server.auth) return server;
-	const renderVars = vars || getProcessEnv();
-	return {
-		...server,
-		auth: renderVarsInObject(server.auth, renderVars)
-	};
-}
-const oauthTokenCache = /* @__PURE__ */ new Map();
-/**
-* Get the cache key for an OAuth config
-*/
-function getOAuthCacheKey(auth, tokenUrl) {
-	return `${tokenUrl}:${auth.grantType}:${"clientId" in auth ? auth.clientId : ""}:${"username" in auth ? auth.username : ""}:${normalizeRenderedOAuthScopes(auth.scopes)?.join(" ") ?? ""}`;
-}
-const tokenEndpointCache = /* @__PURE__ */ new Map();
-function isValidTokenEndpoint(tokenEndpoint, serverUrl) {
-	try {
-		const parsedUrl = new URL(tokenEndpoint);
-		return (parsedUrl.protocol === "http:" || parsedUrl.protocol === "https:") && parsedUrl.origin === serverUrl.origin && !parsedUrl.username && !parsedUrl.password;
-	} catch {
-		return false;
-	}
-}
-/**
-* Discover the OAuth token endpoint from the server's well-known metadata.
-* Follows RFC 8414 OAuth 2.0 Authorization Server Metadata.
-* Only requires token_endpoint from the response (unlike SDK which requires authorization_endpoint).
-*/
-async function discoverTokenEndpoint(serverUrl, signal) {
-	const cached = tokenEndpointCache.get(serverUrl);
-	if (cached) return cached;
-	const url = new URL(serverUrl);
-	const baseUrl = `${url.protocol}//${url.host}`;
-	const discoveryUrls = [];
-	const pathname = url.pathname.replace(/\/+$/, "");
-	if (pathname) {
-		discoveryUrls.push(`${baseUrl}${pathname}/.well-known/oauth-authorization-server`);
-		discoveryUrls.push(`${baseUrl}/.well-known/oauth-authorization-server${pathname}`);
-	}
-	discoveryUrls.push(`${baseUrl}/.well-known/oauth-authorization-server`);
-	for (const discoveryUrl of discoveryUrls) try {
-		logger.debug(`[MCP Auth] Trying OAuth discovery at ${discoveryUrl}`);
-		const response = await fetchWithProxy(discoveryUrl, {
-			redirect: "error",
-			...signal && { signal }
-		});
-		if (!response.ok) {
-			logger.debug(`[MCP Auth] Discovery failed at ${discoveryUrl}: ${response.status}`);
-			continue;
-		}
-		const metadata = await response.json();
-		if (metadata.token_endpoint && isValidTokenEndpoint(metadata.token_endpoint, url)) {
-			logger.debug(`[MCP Auth] Discovered token endpoint: ${metadata.token_endpoint}`);
-			tokenEndpointCache.set(serverUrl, metadata.token_endpoint);
-			return metadata.token_endpoint;
-		}
-		logger.debug(`[MCP Auth] No valid token_endpoint in metadata from ${discoveryUrl}`);
-	} catch (error) {
-		signal?.throwIfAborted();
-		logger.debug(`[MCP Auth] Error fetching ${discoveryUrl}: ${error}`);
-	}
-	throw new Error(`Failed to discover OAuth token endpoint for ${serverUrl}. Please configure tokenUrl explicitly in the auth config.`);
-}
-const pendingTokenRequests = /* @__PURE__ */ new Map();
-/** Reuse a valid token, discover its endpoint if needed, and replace rejected tokens. */
-async function getOAuthTokenWithExpiry(auth, serverUrl, rejectedToken, signal) {
-	signal?.throwIfAborted();
-	let tokenUrl = auth.tokenUrl;
-	if (!tokenUrl) {
-		if (!serverUrl) throw new Error("Either tokenUrl or serverUrl is required for OAuth token fetching");
-		tokenUrl = await discoverTokenEndpoint(serverUrl, signal);
-	}
-	const cacheKey = getOAuthCacheKey(auth, tokenUrl);
-	const cached = oauthTokenCache.get(cacheKey);
-	if (cached && cached.accessToken !== rejectedToken && Date.now() < cached.refreshAt) return {
-		accessToken: cached.accessToken,
-		expiresAt: cached.expiresAt
-	};
-	let pending = pendingTokenRequests.get(cacheKey);
-	if (!pending || pending.controller.signal.aborted) {
-		const controller = new AbortController();
-		pending = {
-			controller,
-			promise: fetchOAuthToken({
-				signal: controller.signal,
-				tokenUrl,
-				redirect: auth.tokenUrl ? void 0 : "error",
-				grantType: auth.grantType,
-				clientId: auth.clientId,
-				clientSecret: auth.clientSecret,
-				username: "username" in auth ? auth.username : void 0,
-				password: "password" in auth ? auth.password : void 0,
-				scopes: normalizeRenderedOAuthScopes(auth.scopes)
-			}).then((result) => {
-				controller.signal.throwIfAborted();
-				const remainingMs = Math.max(0, result.expiresAt - Date.now());
-				oauthTokenCache.set(cacheKey, {
-					...result,
-					refreshAt: result.expiresAt - Math.min(TOKEN_REFRESH_BUFFER_MS, remainingMs / 2)
-				});
-				logger.debug("[MCP Auth] Cached OAuth token");
-				return result;
-			}).finally(() => {
-				if (pendingTokenRequests.get(cacheKey)?.controller === controller) pendingTokenRequests.delete(cacheKey);
-			}),
-			waiters: 0
-		};
-		pendingTokenRequests.set(cacheKey, pending);
-	}
-	pending.waiters++;
-	try {
-		return await waitForPromiseWithAbort(pending.promise, signal);
-	} finally {
-		pending.waiters--;
-		if (pending.waiters === 0) pending.controller.abort();
-	}
-}
-/**
-* Get authentication headers for an MCP server configuration.
-* Returns headers for bearer, basic, and api_key (header placement) auth types.
-* For OAuth, fetch a token with getOAuthTokenWithExpiry() first and pass it in.
-* For api_key with query placement, use getAuthQueryParams() instead.
-*/
-function getAuthHeaders(server, oauthToken) {
-	if (!server.auth) return {};
-	switch (server.auth.type) {
-		case "bearer":
-			if (!server.auth.token) return {};
-			return { Authorization: `Bearer ${server.auth.token}` };
-		case "basic": return { Authorization: `Basic ${Buffer.from(`${server.auth.username}:${server.auth.password}`).toString("base64")}` };
-		case "api_key": {
-			const apiKeyAuth = server.auth;
-			const value = apiKeyAuth.value || apiKeyAuth.api_key;
-			if (!value) return {};
-			if ((apiKeyAuth.placement || "header") === "header") return { [apiKeyAuth.keyName || "X-API-Key"]: value };
-			return {};
-		}
-		case "oauth":
-			if (oauthToken) return { Authorization: `Bearer ${oauthToken}` };
-			logger.warn("[MCP Auth] OAuth auth configured but no token provided");
-			return {};
-		default: return {};
-	}
-}
-/**
-* Get authentication query parameters for api_key auth with query placement.
-* Returns an object with key-value pairs to be added to the URL.
-*/
-function getAuthQueryParams(server) {
-	if (!server.auth || server.auth.type !== "api_key") return {};
-	const apiKeyAuth = server.auth;
-	const value = apiKeyAuth.value || apiKeyAuth.api_key;
-	if (!value) return {};
-	if ((apiKeyAuth.placement || "header") !== "query") return {};
-	return { [apiKeyAuth.keyName || "X-API-Key"]: value };
-}
-/**
-* Apply query parameters to a URL
-*/
-function applyQueryParams(url, params) {
-	if (Object.keys(params).length === 0) return url;
-	const urlObj = new URL(url);
-	for (const [key, value] of Object.entries(params)) urlObj.searchParams.append(key, value);
-	return urlObj.toString();
-}
-//#endregion
-export { getOAuthTokenWithExpiry as a, normalizeMcpToolContent as c, TOKEN_REFRESH_BUFFER_MS as d, normalizeRenderedAuth as f, getMcpErrorMessage as i, renderAuthVars as l, getAuthHeaders as n, isMcpErrorResult as o, getAuthQueryParams as r, isMcpToolNameFilter as s, applyQueryParams as t, sanitizeMcpToolData as u };
-
-//# sourceMappingURL=util-CCtqagKc.js.map