web-comments 1.0.0 → 1.0.2

package/dist/connectors/mcp.js

@@ -1,8 +1,11 @@
 import {
   CommentsError
-} from "../chunks/chunk-RRSB326L.js";
+} from "../chunks/chunk-HN5V6BS6.js";
 import "../chunks/chunk-WSFCRVEQ.js";
 
+// src/connectors/mcp/icon.ts
+var icon = "data:image/svg+xml;base64,PHN2ZyB2aWV3Qm94PSIxLjIxIDAgMjEuNTggMjQiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+PHBhdGggZD0iTTEzLjg1IDBhNC4xNiA0LjE2IDAgMCAwLTIuOTUgMS4yMTdMMS40NTYgMTAuNjZhLjgzNS44MzUgMCAwIDAgMCAxLjE4LjgzNS44MzUgMCAwIDAgMS4xOCAwbDkuNDQyLTkuNDQyYTIuNDkgMi40OSAwIDAgMSAzLjU0MSAwIDIuNDkgMi40OSAwIDAgMSAwIDMuNTQxTDguNTkgMTIuOTdsLS4xLjFhLjgzNS44MzUgMCAwIDAgMCAxLjE4LjgzNS44MzUgMCAwIDAgMS4xOCAwbC4xLS4wOTggNy4wMy03LjAzNGEyLjQ5IDIuNDkgMCAwIDEgMy41NDIgMGwuMDQ5LjA1YTIuNDkgMi40OSAwIDAgMSAwIDMuNTRsLTguNTQgOC41NGExLjk2IDEuOTYgMCAwIDAgMCAyLjc1NWwxLjc1MyAxLjc1M2EuODM1LjgzNSAwIDAgMCAxLjE4IDAgLjgzNS44MzUgMCAwIDAgMC0xLjE4bC0xLjc1My0xLjc1M2EuMjY2LjI2NiAwIDAgMSAwLS4zOTRsOC41NC04LjU0YTQuMTg1IDQuMTg1IDAgMCAwIDAtNS45bC0uMDUtLjA1YTQuMTYgNC4xNiAwIDAgMC0yLjk1LTEuMjE4Yy0uMiAwLS40MDEuMDItLjYuMDQ4YTQuMTcgNC4xNyAwIDAgMC0xLjE3LTMuNTUyQTQuMTYgNC4xNiAwIDAgMCAxMy44NSAwbTAgMy4zMzNhLjg0Ljg0IDAgMCAwLS41OS4yNDVMNi4yNzUgMTAuNTZhNC4xODYgNC4xODYgMCAwIDAgMCA1LjkwMiA0LjE4NiA0LjE4NiAwIDAgMCA1LjkwMiAwTDE5LjE2IDkuNDhhLjgzNS44MzUgMCAwIDAgMC0xLjE4LjgzNS44MzUgMCAwIDAtMS4xOCAwbC02Ljk4NSA2Ljk4NGEyLjQ5IDIuNDkgMCAwIDEtMy41NCAwIDIuNDkgMi40OSAwIDAgMSAwLTMuNTRsNi45ODMtNi45ODVhLjgzNS44MzUgMCAwIDAgMC0xLjE4Ljg0Ljg0IDAgMCAwLS41OS0uMjQ1Ii8+PC9zdmc+";
+
 // src/connectors/mcp/pages.ts
 function escapeHtml(value) {
   return value.replace(
@@ -151,10 +154,35 @@ async function readJson(storage, key) {
 async function grantOf(storage, token2) {
   if (!token2.startsWith(TOKEN_PREFIX.access)) return null;
   const record = await readJson(storage, `token:${await sha256(token2)}`);
-  if (record?.kind !== "access") return null;
+  if (record?.kind !== "access" || !await live(storage, record.grantId)) return null;
   const { kind: _, ...grant } = record;
   return grant;
 }
+async function live(storage, grantId) {
+  return await storage.get(`grant:${grantId}`) !== null;
+}
+async function grantIds(storage, identityId) {
+  return await readJson(storage, `grants:${identityId}`) ?? [];
+}
+async function addGrant(storage, identityId, grantId, record) {
+  await storage.set(`grant:${grantId}`, JSON.stringify(record));
+  const ids = await grantIds(storage, identityId);
+  await storage.set(`grants:${identityId}`, JSON.stringify([...ids, grantId]));
+}
+async function grantsOf(storage, identityId) {
+  const found = [];
+  for (const grantId of await grantIds(storage, identityId)) {
+    const record = await readJson(storage, `grant:${grantId}`);
+    if (record) found.push({ grantId, ...record });
+  }
+  return found.reverse();
+}
+async function revokeGrant(storage, identityId, grantId) {
+  const ids = await grantIds(storage, identityId);
+  if (!ids.includes(grantId)) return;
+  await storage.delete(`grant:${grantId}`);
+  await storage.set(`grants:${identityId}`, JSON.stringify(ids.filter((id) => id !== grantId)));
+}
 function looksLikeOurToken(token2) {
   return token2.startsWith(TOKEN_PREFIX.access) || token2.startsWith(TOKEN_PREFIX.refresh);
 }
@@ -302,9 +330,16 @@ var PAGE_HEADERS = {
   "cache-control": "no-store",
   "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; img-src https: data:; frame-ancestors 'none'; base-uri 'none'",
   "x-frame-options": "DENY",
-  "referrer-policy": "no-referrer",
+  // Not no-referrer: under it, browsers send the consent form's Origin as "null".
+  "referrer-policy": "same-origin",
   "x-content-type-options": "nosniff"
 };
+function fromThisOrigin(request) {
+  const site = request.headers.get("sec-fetch-site");
+  if (site) return site === "same-origin";
+  const origin = request.headers.get("origin");
+  return origin === null || origin === new URL(request.url).origin;
+}
 function page(html, status = 200) {
   return new Response(html, { status, headers: PAGE_HEADERS });
 }
@@ -350,6 +385,17 @@ async function authorize(request, context, options) {
   if (resource !== at.resource) return fail("invalid_target", `the resource is ${at.resource}`);
   const who = await context.identify(request);
   if (!who) {
+    const someone = await context.signedIn(request);
+    if (someone) {
+      return page(
+        messagePage(
+          options.name,
+          "Not allowed",
+          `${someone.email ?? someone.name} may not use comments on ${url.host}.`
+        ),
+        403
+      );
+    }
     const login = context.loginUrl(request);
     if (login) return Response.redirect(new URL(login, request.url).href, 302);
     return page(
@@ -387,9 +433,7 @@ async function authorize(request, context, options) {
 }
 async function decide(request, context, options) {
   const at = endpoints(context.url);
-  const ownOrigin = new URL(request.url).origin;
-  const origin = request.headers.get("origin");
-  if (origin !== null && origin !== ownOrigin || request.headers.get("sec-fetch-site") === "cross-site") {
+  if (!fromThisOrigin(request)) {
     return page(
       messagePage(options.name, "Not allowed", "This approval didn't come from this site."),
       403
@@ -431,7 +475,14 @@ async function decide(request, context, options) {
     );
   }
   const code = randomToken();
+  const grantId = randomToken(12);
+  await addGrant(context.storage, who.id, grantId, {
+    clientId: consent.clientId,
+    clientName: clientName(client),
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
   const grant = {
+    grantId,
     identity: who,
     clientId: consent.clientId,
     clientName: clientName(client),
@@ -491,7 +542,7 @@ async function token(request, context, options) {
     const refresh = params.get("refresh_token") ?? "";
     const key = `token:${await sha256(refresh)}`;
     const record = refresh.startsWith(TOKEN_PREFIX.refresh) ? await readJson(storage, key) : null;
-    if (record?.kind !== "refresh" || record.clientId !== clientId || record.site !== context.site) {
+    if (record?.kind !== "refresh" || record.clientId !== clientId || record.site !== context.site || !await live(storage, record.grantId)) {
       return oauthError("invalid_grant", "the refresh token is unknown, used or expired");
     }
     await storage.delete(key);
@@ -540,7 +591,7 @@ async function handleOAuth(request, path, context, options) {
 }
 
 // src/connectors/mcp/index.ts
-var VERSION = "1.0.0";
+var VERSION = "1.0.2";
 var PROTOCOL_VERSIONS = ["2025-11-25", "2025-06-18", "2025-03-26", "2024-11-05"];
 function mcp(options = {}) {
   const oauth = {
@@ -566,6 +617,42 @@ function mcp(options = {}) {
       }
       if (path === "/") return serve(request, context, oauth);
       return await handleOAuth(request, path, context, oauth) ?? Response.json({ error: "not_found" }, { status: 404, headers: CORS });
+    },
+    // The toolbar's MCP panel: how to connect an agent, and the ones connected.
+    async panel(who, context) {
+      const url = `${context.origin}${context.basePath}/mcp`;
+      const grants = await grantsOf(context.storage, who.id);
+      return {
+        title: "MCP",
+        icon,
+        blocks: [
+          {
+            type: "text",
+            text: "Let an agent (Claude Code, Cursor, \u2026) read the comments here with their screenshots, reply, and resolve them, as you. You approve it in the browser the first time."
+          },
+          { type: "code", label: "Server URL", value: url },
+          {
+            type: "code",
+            label: "Claude Code",
+            value: `claude mcp add --transport http comments ${url}`
+          },
+          {
+            type: "list",
+            label: "Your agents",
+            empty: "No agent connected yet.",
+            items: grants.map((grant) => ({
+              title: grant.clientName,
+              description: `Connected ${new Date(grant.createdAt).toLocaleDateString("en", { month: "short", day: "numeric", year: "numeric" })}`,
+              button: { label: "Disconnect", action: "revoke", input: { grant: grant.grantId } }
+            }))
+          }
+        ]
+      };
+    },
+    async action(action, who, input, context) {
+      if (action === "revoke" && typeof input.grant === "string") {
+        await revokeGrant(context.storage, who.id, input.grant);
+      }
     }
   };
 }
@@ -619,6 +706,7 @@ async function authenticate(request, context) {
     if (!grant || grant.site !== context.site || grant.resource !== endpoints(context.url).resource) {
       return null;
     }
+    if (!await context.allowed(grant.identity, request)) return null;
     return {
       ...grant.identity,
       name: `${grant.identity.name} (${grant.clientName})`,