snow-flow 2.0.2 → 2.0.3

package/src/utils/snow-oauth.ts

@@ -1,797 +0,0 @@
-#!/usr/bin/env node
-/**
- * ServiceNow OAuth Authentication Utility with Dynamic Port
- * Handles OAuth2 flow for ServiceNow integration
- */
-
-import { promises as fs } from 'fs';
-import { join } from 'path';
-import os from 'os';
-import { createServer } from 'http';
-import { URL } from 'url';
-import axios from 'axios';
-import https from 'https';
-import net from 'net';
-import crypto from 'crypto';
-import { snowFlowConfig } from '../config/snow-flow-config.js';
-import { unifiedAuthStore } from './unified-auth-store.js';
-import { OAuthTemplates } from './oauth-html-templates.js';
-
-export interface ServiceNowAuthResult {
-  success: boolean;
-  accessToken?: string;
-  refreshToken?: string;
-  expiresIn?: number;
-  error?: string;
-}
-
-export interface ServiceNowCredentials {
-  instance: string;
-  clientId: string;
-  clientSecret: string;
-  accessToken?: string;
-  refreshToken?: string;
-  expiresAt?: string;
-}
-
-interface OAuthCredentials {
-  instance: string;
-  clientId: string;
-  clientSecret: string;
-  redirectUri: string;
-}
-
-export class ServiceNowOAuth {
-  private credentials?: OAuthCredentials;
-  private tokenPath: string;
-  private stateParameter?: string;
-  private codeVerifier?: string;
-  private codeChallenge?: string;
-  
-  // 🔒 SEC-002 FIX: Add rate limiting to prevent authentication bypass attacks
-  private lastTokenRequest: number = 0;
-  private tokenRequestCount: number = 0;
-  private readonly TOKEN_REQUEST_WINDOW_MS = 60000; // 1 minute window
-  private readonly MAX_TOKEN_REQUESTS_PER_WINDOW = 10; // Max 10 token requests per minute
-
-  constructor() {
-    // Store tokens in user's home directory
-    const configDir = process.env.SNOW_FLOW_HOME || join(os.homedir(), '.snow-flow');
-    this.tokenPath = join(configDir, 'auth.json');
-  }
-
-  /**
-   * 🔒 SEC-002 FIX: Check rate limiting for token requests to prevent brute force attacks
-   */
-  private checkTokenRequestRateLimit(): boolean {
-    const now = Date.now();
-    
-    // Reset counter if window has passed
-    if (now - this.lastTokenRequest > this.TOKEN_REQUEST_WINDOW_MS) {
-      this.tokenRequestCount = 0;
-      this.lastTokenRequest = now;
-    }
-    
-    // Check if within rate limit
-    if (this.tokenRequestCount >= this.MAX_TOKEN_REQUESTS_PER_WINDOW) {
-      console.warn('🔒 Rate limit exceeded: Too many token requests. Please wait before retrying.');
-      return false;
-    }
-    
-    this.tokenRequestCount++;
-    return true;
-  }
-
-  /**
-   * Generate a random state parameter for CSRF protection
-   */
-  private generateState(): string {
-    return Math.random().toString(36).substring(2, 15) + 
-           Math.random().toString(36).substring(2, 15);
-  }
-
-  /**
-   * Generate PKCE code verifier and challenge
-   */
-  private generatePKCE() {
-    // Generate code verifier (43-128 characters)
-    this.codeVerifier = crypto.randomBytes(32).toString('base64url');
-    
-    // Generate code challenge (SHA256 hash of verifier)
-    const hash = crypto.createHash('sha256');
-    hash.update(this.codeVerifier);
-    this.codeChallenge = hash.digest('base64url');
-  }
-
-  /**
-   * Check if a specific port is available
-   */
-  private async checkPortAvailable(port: number): Promise<boolean> {
-    return new Promise((resolve) => {
-      const server = net.createServer();
-      
-      server.on('error', () => {
-        resolve(false);
-      });
-      
-      server.listen(port, () => {
-        server.close(() => {
-          resolve(true);
-        });
-      });
-    });
-  }
-
-
-  /**
-   * Initialize OAuth flow - opens browser and handles callback
-   */
-  /**
-   * 🔧 CRIT-002 FIX: Normalize instance URL to prevent trailing slash 400 errors
-   */
-  private normalizeInstanceUrl(instance: string): string {
-    // Remove any trailing slashes that cause 400 errors
-    let normalized = instance.replace(/\/+$/, '');
-    
-    // Add https:// if missing
-    if (!normalized.startsWith('http://') && !normalized.startsWith('https://')) {
-      normalized = `https://${normalized}`;
-    }
-    
-    // Ensure .service-now.com suffix if it's just the instance name
-    if (!normalized.includes('.service-now.com') && !normalized.includes('localhost') && !normalized.includes('127.0.0.1')) {
-      const instanceName = normalized.replace('https://', '').replace('http://', '');
-      normalized = `https://${instanceName}.service-now.com`;
-    }
-    
-    return normalized;
-  }
-
-  async authenticate(instance: string, clientId: string, clientSecret: string): Promise<ServiceNowAuthResult> {
-    try {
-      // 🔧 CRIT-002 FIX: Apply URL normalization
-      const normalizedInstance = this.normalizeInstanceUrl(instance);
-      // Validate client secret format
-      const secretValidation = this.validateClientSecret(clientSecret);
-      if (!secretValidation.valid) {
-        console.error('❌ Invalid OAuth Client Secret:', secretValidation.reason);
-        console.error('💡 To get a valid OAuth secret:');
-        console.error('   1. Log into ServiceNow as admin');
-        console.error('   2. Navigate to: System OAuth > Application Registry');
-        console.error('   3. Create a new OAuth application');
-        console.error('   4. Copy the generated Client Secret (long random string)');
-        return {
-          success: false,
-          error: secretValidation.reason
-        };
-      }
-      
-      // Get OAuth redirect configuration from environment or use defaults
-      const oauthConfig = snowFlowConfig.servicenow.oauth;
-      const port = oauthConfig.redirectPort;
-      const host = oauthConfig.redirectHost;
-      const path = oauthConfig.redirectPath;
-      const redirectUri = `http://${host}:${port}${path}`;
-      
-      // Check if port is available
-      const isPortAvailable = await this.checkPortAvailable(port);
-      if (!isPortAvailable) {
-        console.error(`❌ Port ${port} is already in use!`);
-        console.error(`💡 Please close any application using port ${port} and try again.`);
-        return {
-          success: false,
-          error: `Port ${port} is already in use. Please free up the port and try again.`
-        };
-      }
-      
-      // Store credentials temporarily with normalized instance
-      this.credentials = {
-        instance: normalizedInstance.replace('https://', '').replace('http://', ''),
-        clientId,
-        clientSecret,
-        redirectUri
-      };
-
-      console.log('🚀 Starting ServiceNow OAuth flow...');
-      console.log(`📋 Instance: ${normalizedInstance}`);
-      console.log(`🔐 Client ID: ${clientId}`);
-      console.log(`🔗 Redirect URI: ${redirectUri}`);
-
-      // Generate state parameter for CSRF protection
-      this.stateParameter = this.generateState();
-
-      // Generate PKCE parameters
-      this.generatePKCE();
-
-      // Generate authorization URL
-      const authUrl = this.generateAuthUrl(this.credentials.instance, clientId, redirectUri);
-      
-      console.log('\n🌐 Authorization URL generated:');
-      console.log(`${authUrl}\n`);
-      
-      // Start local server to handle callback
-      const authResult = await this.startCallbackServer(redirectUri, port);
-      
-      if (authResult.success && authResult.accessToken) {
-        // Save tokens with normalized instance
-        await this.saveTokens({
-          accessToken: authResult.accessToken,
-          refreshToken: authResult.refreshToken || '',
-          expiresIn: authResult.expiresIn || 3600,
-          instance: this.credentials.instance,
-          clientId,
-          clientSecret
-        });
-        
-        console.log('\n✅ Authentication successful!');
-        console.log('🔐 Tokens saved securely');
-      }
-      
-      return authResult;
-    } catch (error) {
-      const errorMessage = error instanceof Error ? error.message : String(error);
-      console.error('❌ Authentication failed:', errorMessage);
-      return {
-        success: false,
-        error: errorMessage
-      };
-    }
-  }
-
-  /**
-   * Generate ServiceNow OAuth authorization URL
-   */
-  private generateAuthUrl(instance: string, clientId: string, redirectUri: string): string {
-    const baseUrl = `https://${instance}/oauth_auth.do`;
-    const params = new URLSearchParams({
-      response_type: 'code',
-      client_id: clientId,
-      redirect_uri: redirectUri,
-      scope: 'useraccount write admin',
-      state: this.stateParameter || '',
-      code_challenge: this.codeChallenge || '',
-      code_challenge_method: 'S256'
-    });
-    
-    return `${baseUrl}?${params.toString()}`;
-  }
-
-  /**
-   * Start local HTTP server to handle OAuth callback
-   */
-  private async startCallbackServer(redirectUri: string, port: number): Promise<ServiceNowAuthResult> {
-    return new Promise((resolve) => {
-      const server = createServer(async (req, res) => {
-        try {
-          const url = new URL(req.url!, `http://${snowFlowConfig.servicenow.oauth.redirectHost}:${port}`);
-          
-          if (url.pathname === '/callback') {
-            const code = url.searchParams.get('code');
-            const error = url.searchParams.get('error');
-            const state = url.searchParams.get('state');
-            
-            // Validate state parameter
-            if (state !== this.stateParameter) {
-              res.writeHead(400, { 'Content-Type': 'text/html' });
-              res.end(OAuthTemplates.securityError);
-              
-              server.close();
-              resolve({
-                success: false,
-                error: 'Invalid state parameter'
-              });
-              return;
-            }
-            
-            if (error) {
-              res.writeHead(400, { 'Content-Type': 'text/html' });
-              res.end(OAuthTemplates.error(error));
-              
-              server.close();
-              resolve({
-                success: false,
-                error: `OAuth error: ${error}`
-              });
-              return;
-            }
-            
-            if (!code) {
-              res.writeHead(400, { 'Content-Type': 'text/html' });
-              res.end(OAuthTemplates.missingCode);
-              
-              server.close();
-              resolve({
-                success: false,
-                error: 'No authorization code received'
-              });
-              return;
-            }
-            
-            // Exchange code for tokens
-            console.log('🔄 Exchanging authorization code for tokens...');
-            const tokenResult = await this.exchangeCodeForTokens(code);
-            
-            if (tokenResult.success) {
-              res.writeHead(200, { 'Content-Type': 'text/html' });
-              res.end(OAuthTemplates.success);
-              
-              server.close();
-              resolve(tokenResult);
-            } else {
-              res.writeHead(500, { 'Content-Type': 'text/html' });
-              res.end(OAuthTemplates.tokenExchangeFailed(tokenResult.error || 'Unknown error'));
-              
-              server.close();
-              resolve(tokenResult);
-            }
-          } else {
-            res.writeHead(404, { 'Content-Type': 'text/plain' });
-            res.end('Not Found');
-          }
-        } catch (error) {
-          console.error('Callback server error:', error);
-          res.writeHead(500, { 'Content-Type': 'text/plain' });
-          res.end('Internal Server Error');
-          
-          server.close();
-          resolve({
-            success: false,
-            error: error instanceof Error ? error.message : String(error)
-          });
-        }
-      });
-      
-      server.listen(port, () => {
-        console.log(`🌐 OAuth callback server started on http://${snowFlowConfig.servicenow.oauth.redirectHost}:${port}`);
-        console.log('🚀 Please open the authorization URL in your browser...');
-        console.log('⏳ Waiting for OAuth callback...');
-        
-        // Auto-open browser if possible
-        try {
-          const { spawn } = require('child_process');
-          const authUrl = this.generateAuthUrl(
-            this.credentials!.instance,
-            this.credentials!.clientId,
-            redirectUri
-          );
-          
-          // Try to open browser on macOS
-          if (process.platform === 'darwin') {
-            spawn('open', [authUrl]);
-          } else if (process.platform === 'win32') {
-            spawn('cmd', ['/c', 'start', authUrl]);
-          } else if (process.platform === 'linux') {
-            spawn('xdg-open', [authUrl]);
-          } else {
-            console.log('Unknown OS:', process.platform);
-          }
-        } catch (err) {
-          console.log('⚠️  Could not auto-open browser. Please open the URL manually.');
-        }
-      });
-    });
-  }
-
-  /**
-   * Exchange authorization code for tokens
-   */
-  private async exchangeCodeForTokens(code: string): Promise<ServiceNowAuthResult> {
-    try {
-      // 🔒 SEC-002 FIX: Apply rate limiting to prevent authentication bypass attacks
-      if (!this.checkTokenRequestRateLimit()) {
-        return {
-          success: false,
-          error: 'Rate limit exceeded. Too many token requests. Please wait 1 minute before retrying.'
-        };
-      }
-      
-      const tokenUrl = `https://${this.credentials!.instance}/oauth_token.do`;
-      
-      const response = await axios.post(tokenUrl, new URLSearchParams({
-        grant_type: 'authorization_code',
-        code,
-        client_id: this.credentials!.clientId,
-        client_secret: this.credentials!.clientSecret,
-        redirect_uri: this.credentials!.redirectUri,
-        code_verifier: this.codeVerifier || ''
-      }), {
-        headers: {
-          'Content-Type': 'application/x-www-form-urlencoded'
-        },
-        timeout: 15000,  // 🔒 SEC-002 FIX: 15 second timeout to prevent hanging requests
-        // Allow self-signed certificates for dev instances
-        httpsAgent: new https.Agent({
-          rejectUnauthorized: false
-        })
-      });
-      
-      const data = response.data;
-      
-      if (data.access_token) {
-        return {
-          success: true,
-          accessToken: data.access_token,
-          refreshToken: data.refresh_token,
-          expiresIn: data.expires_in
-        };
-      } else {
-        return {
-          success: false,
-          error: 'No access token received'
-        };
-      }
-    } catch (error) {
-      const errorMessage = error instanceof Error ? error.message : String(error);
-      console.error('Token exchange error:', errorMessage);
-      if (axios.isAxiosError(error) && error.response) {
-        console.error('Response data:', error.response.data);
-      }
-      return {
-        success: false,
-        error: errorMessage
-      };
-    }
-  }
-
-  /**
-   * Save tokens to file
-   */
-  private async saveTokens(tokenData: any): Promise<void> {
-    try {
-      const expiresAt = new Date();
-      expiresAt.setSeconds(expiresAt.getSeconds() + tokenData.expiresIn);
-      
-      const authData = {
-        ...tokenData,
-        expiresAt: expiresAt.toISOString()
-      };
-      
-      // Use unified auth store
-      await unifiedAuthStore.saveTokens(authData);
-      
-      // Bridge to MCP servers immediately
-      await unifiedAuthStore.bridgeToMCP();
-    } catch (error) {
-      console.error('Failed to save tokens:', error);
-      throw error;
-    }
-  }
-
-  /**
-   * Load tokens from file
-   */
-  async loadTokens(): Promise<any> {
-    try {
-      return await unifiedAuthStore.getTokens();
-    } catch (error) {
-      return null;
-    }
-  }
-
-  /**
-   * Check if authenticated
-   */
-  async isAuthenticated(): Promise<boolean> {
-    try {
-      const tokens = await this.loadTokens();
-      if (!tokens) return false;
-      
-      // Check if token is expired
-      const expiresAt = new Date(tokens.expiresAt);
-      const now = new Date();
-      
-      return now < expiresAt;
-    } catch (error) {
-      return false;
-    }
-  }
-
-  /**
-   * Get access token (refresh if needed)
-   */
-  async getAccessToken(): Promise<string | null> {
-    try {
-      const tokens = await this.loadTokens();
-      if (!tokens) return null;
-      
-      // Check if token is expired
-      const expiresAt = new Date(tokens.expiresAt);
-      const now = new Date();
-      
-      if (now >= expiresAt && tokens.refreshToken) {
-        // Token expired, try to refresh
-        console.log('🔄 Token expired, refreshing...');
-        const refreshResult = await this.refreshAccessToken(tokens);
-        
-        if (refreshResult.success && refreshResult.accessToken) {
-          // Update saved tokens
-          await this.saveTokens({
-            ...tokens,
-            accessToken: refreshResult.accessToken,
-            expiresIn: refreshResult.expiresIn || 3600
-          });
-          
-          return refreshResult.accessToken;
-        } else {
-          console.error('❌ Token refresh failed:', refreshResult.error);
-          return null;
-        }
-      }
-      
-      return tokens.accessToken;
-    } catch (error) {
-      console.error('Failed to get access token:', error);
-      return null;
-    }
-  }
-
-  /**
-   * Refresh access token
-   */
-  public async refreshAccessToken(tokens?: any): Promise<ServiceNowAuthResult> {
-    try {
-      // 🔒 SEC-002 FIX: Apply rate limiting to prevent authentication bypass attacks
-      if (!this.checkTokenRequestRateLimit()) {
-        return {
-          success: false,
-          error: 'Rate limit exceeded. Too many token requests. Please wait 1 minute before retrying.'
-        };
-      }
-      
-      // If no tokens provided, load from file
-      if (!tokens) {
-        tokens = await this.loadTokens();
-        if (!tokens) {
-          return {
-            success: false,
-            error: 'No tokens found to refresh'
-          };
-        }
-      }
-      
-      const tokenUrl = `https://${tokens.instance}/oauth_token.do`;
-      
-      const response = await axios.post(tokenUrl, new URLSearchParams({
-        grant_type: 'refresh_token',
-        refresh_token: tokens.refreshToken,
-        client_id: tokens.clientId,
-        client_secret: tokens.clientSecret
-      }), {
-        headers: {
-          'Content-Type': 'application/x-www-form-urlencoded'
-        },
-        timeout: 15000,  // 🔒 SEC-002 FIX: 15 second timeout to prevent hanging requests
-        // Allow self-signed certificates for dev instances
-        httpsAgent: new https.Agent({
-          rejectUnauthorized: false
-        })
-      });
-      
-      const data = response.data;
-      
-      if (data.access_token) {
-        // Update saved tokens
-        await this.saveTokens({
-          ...tokens,
-          accessToken: data.access_token,
-          expiresIn: data.expires_in || 3600
-        });
-        
-        return {
-          success: true,
-          accessToken: data.access_token,
-          expiresIn: data.expires_in
-        };
-      } else {
-        return {
-          success: false,
-          error: 'No access token received'
-        };
-      }
-    } catch (error) {
-      const errorMessage = error instanceof Error ? error.message : String(error);
-      return {
-        success: false,
-        error: errorMessage
-      };
-    }
-  }
-
-  /**
-   * Logout - clear saved tokens
-   */
-  async logout(): Promise<void> {
-    try {
-      await fs.unlink(this.tokenPath);
-      console.log('✅ Logged out successfully');
-    } catch (error) {
-      console.log('No active session to logout from');
-    }
-  }
-
-  /**
-   * Get stored OAuth tokens for use in other contexts (MCP servers)
-   */
-  async getStoredTokens(): Promise<any> {
-    return await this.loadTokens();
-  }
-
-  /**
-   * Load credentials (including tokens) with .env fallback
-   */
-  async loadCredentials(): Promise<ServiceNowCredentials | null> {
-    try {
-      // First, try to load saved OAuth tokens
-      const tokens = await this.loadTokens();
-      
-      if (tokens && tokens.accessToken) {
-        // Validate client secret when loading
-        if (tokens.clientSecret) {
-          const secretValidation = this.validateClientSecret(tokens.clientSecret);
-          if (!secretValidation.valid) {
-            console.warn('⚠️  OAuth Configuration Issue:', secretValidation.reason);
-            console.warn('💡 Your stored client secret may be incorrect. Re-authenticate with: snow-flow auth login');
-          }
-        }
-        
-        // Check if token is expired
-        const expiresAt = new Date(tokens.expiresAt);
-        const now = new Date();
-        
-        if (now < expiresAt) {
-          console.log('✅ Using saved OAuth tokens');
-          return {
-            instance: tokens.instance,
-            clientId: tokens.clientId,
-            clientSecret: tokens.clientSecret,
-            accessToken: tokens.accessToken,
-            refreshToken: tokens.refreshToken,
-            expiresAt: tokens.expiresAt
-          };
-        } else {
-          console.log('⏰ Saved OAuth token expired, will try refresh...');
-        }
-      }
-      
-      // 🔧 NEW: Fallback to .env file if no valid tokens
-      console.log('🔍 No valid OAuth tokens found, checking .env file...');
-      
-      // Load environment variables with dotenv
-      try {
-        require('dotenv').config();
-      } catch (err) {
-        console.log('📝 dotenv not available, using process.env directly');
-      }
-      
-      const envInstance = process.env.SNOW_INSTANCE;
-      const envClientId = process.env.SNOW_CLIENT_ID;
-      const envClientSecret = process.env.SNOW_CLIENT_SECRET;
-      
-      if (envInstance && envClientId && envClientSecret) {
-        console.log('✅ Found ServiceNow credentials in .env file');
-        console.log(`   - Instance: ${envInstance}`);
-        console.log(`   - Client ID: ${envClientId}`);
-        console.log(`   - Client Secret: ✅ Present`);
-        
-        // Validate client secret
-        const secretValidation = this.validateClientSecret(envClientSecret);
-        if (!secretValidation.valid) {
-          console.error('❌ Invalid OAuth Client Secret in .env file:', secretValidation.reason);
-          console.error('💡 Please update SNOW_CLIENT_SECRET in .env with proper OAuth secret from ServiceNow');
-          return null;
-        }
-        
-        console.log('');
-        console.log('🔐 OAuth Setup Required:');
-        console.log('   Your .env has OAuth credentials but no active session.');
-        console.log('   Run: snow-flow auth login');
-        console.log('   This will authenticate and create persistent tokens.');
-        console.log('');
-        
-        // Return credentials without access token - this will trigger auth flow
-        return {
-          instance: envInstance.replace(/\/$/, ''),
-          clientId: envClientId,
-          clientSecret: envClientSecret,
-          // No accessToken - this signals that OAuth login is needed
-        };
-      }
-      
-      // 🔧 Check for old username/password setup in .env
-      const envUsername = process.env.SNOW_USERNAME;
-      const envPassword = process.env.SNOW_PASSWORD;
-      
-      if (envInstance && envUsername && envPassword) {
-        console.warn('⚠️  Found username/password in .env - OAuth is recommended');
-        console.warn('💡 For better security, set up OAuth credentials:');
-        console.warn('   1. In ServiceNow: System OAuth > Application Registry > New');
-        console.warn('   2. Update .env with SNOW_CLIENT_ID and SNOW_CLIENT_SECRET');
-        console.warn('   3. Run: snow-flow auth login');
-        
-        // Don't return username/password - force OAuth setup
-        return null;
-      }
-      
-      // No credentials found anywhere
-      console.error('❌ No ServiceNow credentials found!');
-      console.error('');
-      console.error('🔧 Setup Instructions:');
-      console.error('   1. Create .env file with OAuth credentials:');
-      console.error('      SNOW_INSTANCE=your-instance.service-now.com');
-      console.error('      SNOW_CLIENT_ID=your_oauth_client_id');
-      console.error('      SNOW_CLIENT_SECRET=your_oauth_client_secret');
-      console.error('   2. Run: snow-flow auth login');
-      console.error('');
-      console.error('💡 To get OAuth credentials:');
-      console.error('   • ServiceNow: System OAuth > Application Registry > New OAuth Application');
-      console.error(`   • Redirect URI: http://${snowFlowConfig.servicenow.oauth.redirectHost}:${snowFlowConfig.servicenow.oauth.redirectPort}${snowFlowConfig.servicenow.oauth.redirectPath}`);
-      console.error('   • Scopes: useraccount write admin');
-      console.error('');
-      
-      return null;
-      
-    } catch (error) {
-      console.error('❌ Error loading credentials:', error);
-      return null;
-    }
-  }
-
-  /**
-   * Validate OAuth client secret format
-   * OAuth secrets are typically long random strings (32+ chars) with mixed case and alphanumeric
-   * Common passwords are shorter and may contain dictionary words
-   */
-  validateClientSecret(clientSecret: string): { valid: boolean; reason?: string } {
-    // Check minimum length - OAuth secrets are typically 32+ characters
-    if (clientSecret.length < 20) {
-      return {
-        valid: false,
-        reason: 'OAuth Client Secret too short. Expected 32+ character random string from ServiceNow.'
-      };
-    }
-    
-    // Check for common password patterns
-    const commonPasswordPatterns = [
-      /^password/i,
-      /^admin/i,
-      /^test/i,
-      /^demo/i,
-      /^welcome/i,
-      /123456/,
-      /qwerty/i,
-      /^[a-z]+\d{1,4}$/i,  // Simple word + numbers like "Welkom123"
-      /^[A-Z][a-z]+\d{1,4}$/  // Capitalized word + numbers
-    ];
-    
-    for (const pattern of commonPasswordPatterns) {
-      if (pattern.test(clientSecret)) {
-        return {
-          valid: false,
-          reason: `OAuth Client Secret appears to be a password. ServiceNow OAuth secrets are long random strings (e.g., "a1b2c3d4e5f6..."). Check your Application Registry in ServiceNow.`
-        };
-      }
-    }
-    
-    // Check for sufficient entropy (mix of upper, lower, numbers)
-    const hasUpper = /[A-Z]/.test(clientSecret);
-    const hasLower = /[a-z]/.test(clientSecret);
-    const hasNumber = /[0-9]/.test(clientSecret);
-    const charTypes = [hasUpper, hasLower, hasNumber].filter(Boolean).length;
-    
-    if (charTypes < 2) {
-      return {
-        valid: false,
-        reason: 'OAuth Client Secret lacks complexity. ServiceNow generates secrets with mixed case and numbers.'
-      };
-    }
-    
-    return { valid: true };
-  }
-
-  /**
-   * Get credentials (compatibility method for MCP servers)
-   */
-  async getCredentials(): Promise<ServiceNowCredentials | null> {
-    return await this.loadCredentials();
-  }
-}