feat: add CraftTable MCP OAuth CLI
This commit is contained in:
+264
@@ -0,0 +1,264 @@
|
||||
import { spawn } from "node:child_process";
|
||||
import { constants } from "node:fs";
|
||||
import { copyFile, mkdir, readFile, rename, writeFile } from "node:fs/promises";
|
||||
import os from "node:os";
|
||||
import path from "node:path";
|
||||
import { createInterface } from "node:readline/promises";
|
||||
import { applyEdits, modify, parse } from "jsonc-parser";
|
||||
import type { ClientOptions } from "./config.js";
|
||||
import { errorMessage } from "./config.js";
|
||||
|
||||
export const SERVER_NAME = "crafttable";
|
||||
export type AgentName = "codex" | "claude" | "opencode";
|
||||
export type AgentTarget = AgentName | "all";
|
||||
|
||||
export type CommandResult = { code: number; stdout: string; stderr: string };
|
||||
export interface CommandRunner {
|
||||
run(command: string, args: string[]): Promise<CommandResult>;
|
||||
}
|
||||
|
||||
export type ConfigureInput = {
|
||||
target: AgentTarget;
|
||||
options: ClientOptions;
|
||||
cliEntry: string;
|
||||
nodePath?: string;
|
||||
dryRun?: boolean;
|
||||
force?: boolean;
|
||||
env?: NodeJS.ProcessEnv;
|
||||
runner?: CommandRunner;
|
||||
confirm?: (message: string) => Promise<boolean>;
|
||||
opencodePath?: string;
|
||||
};
|
||||
|
||||
export type ConfigureResult = {
|
||||
agent: AgentName;
|
||||
action: "added" | "replaced" | "removed" | "unchanged" | "absent" | "would-add" | "would-replace" | "would-remove";
|
||||
};
|
||||
|
||||
export async function configureAgents(input: ConfigureInput): Promise<ConfigureResult[]> {
|
||||
const agents = expandTarget(input.target);
|
||||
const command = launchCommand(input.options, input.cliEntry, input.nodePath ?? process.execPath);
|
||||
const runner = input.runner ?? new SpawnCommandRunner();
|
||||
const results: ConfigureResult[] = [];
|
||||
for (const agent of agents) {
|
||||
if (agent === "opencode") {
|
||||
results.push(await configureOpenCode(input, command));
|
||||
} else {
|
||||
results.push(await configureCliAgent(agent, command, input, runner));
|
||||
}
|
||||
}
|
||||
return results;
|
||||
}
|
||||
|
||||
export async function unconfigureAgents(input: ConfigureInput): Promise<ConfigureResult[]> {
|
||||
const agents = expandTarget(input.target);
|
||||
const runner = input.runner ?? new SpawnCommandRunner();
|
||||
const results: ConfigureResult[] = [];
|
||||
for (const agent of agents) {
|
||||
if (agent === "opencode") {
|
||||
results.push(await unconfigureOpenCode(input));
|
||||
continue;
|
||||
}
|
||||
const executable = agent === "codex" ? "codex" : "claude";
|
||||
const existing = await probeCliAgent(agent, runner);
|
||||
if (!existing.exists) {
|
||||
results.push({ agent, action: "absent" });
|
||||
continue;
|
||||
}
|
||||
if (input.dryRun) {
|
||||
results.push({ agent, action: "would-remove" });
|
||||
continue;
|
||||
}
|
||||
const args = agent === "codex"
|
||||
? ["mcp", "remove", SERVER_NAME]
|
||||
: ["mcp", "remove", "--scope", "user", SERVER_NAME];
|
||||
await requireSuccess(runner.run(executable, args), `${agent} MCP removal`);
|
||||
results.push({ agent, action: "removed" });
|
||||
}
|
||||
return results;
|
||||
}
|
||||
|
||||
export function launchCommand(options: ClientOptions, cliEntry: string, nodePath: string): string[] {
|
||||
return [
|
||||
path.resolve(nodePath),
|
||||
path.resolve(cliEntry),
|
||||
"serve",
|
||||
"--url", options.url.toString(),
|
||||
"--client-id", options.clientId,
|
||||
"--callback-port", String(options.callbackPort),
|
||||
];
|
||||
}
|
||||
|
||||
async function configureCliAgent(
|
||||
agent: "codex" | "claude",
|
||||
command: string[],
|
||||
input: ConfigureInput,
|
||||
runner: CommandRunner,
|
||||
): Promise<ConfigureResult> {
|
||||
const existing = await probeCliAgent(agent, runner);
|
||||
if (existing.exists && outputMatchesCommand(existing.output, command)) return { agent, action: "unchanged" };
|
||||
if (existing.exists && !input.force && !input.dryRun) {
|
||||
const confirm = input.confirm ?? terminalConfirm;
|
||||
if (!process.stdin.isTTY && !input.confirm) throw new Error(`${agent} already has a different ${SERVER_NAME} MCP entry; use --force to replace it`);
|
||||
if (!await confirm(`${agent} already has a different ${SERVER_NAME} MCP entry. Replace it?`)) {
|
||||
throw new Error(`${agent} MCP configuration was not changed`);
|
||||
}
|
||||
}
|
||||
const action = existing.exists ? "replaced" : "added";
|
||||
if (input.dryRun) return { agent, action: existing.exists ? "would-replace" : "would-add" };
|
||||
const executable = agent === "codex" ? "codex" : "claude";
|
||||
if (existing.exists) {
|
||||
const removeArgs = agent === "codex"
|
||||
? ["mcp", "remove", SERVER_NAME]
|
||||
: ["mcp", "remove", "--scope", "user", SERVER_NAME];
|
||||
await requireSuccess(runner.run(executable, removeArgs), `${agent} MCP replacement cleanup`);
|
||||
}
|
||||
const addArgs = agent === "codex"
|
||||
? ["mcp", "add", SERVER_NAME, "--", ...command]
|
||||
: ["mcp", "add", "--scope", "user", SERVER_NAME, "--", ...command];
|
||||
await requireSuccess(runner.run(executable, addArgs), `${agent} MCP registration`);
|
||||
return { agent, action };
|
||||
}
|
||||
|
||||
async function probeCliAgent(agent: "codex" | "claude", runner: CommandRunner): Promise<{ exists: boolean; output: string }> {
|
||||
const executable = agent === "codex" ? "codex" : "claude";
|
||||
const args = agent === "codex"
|
||||
? ["mcp", "get", SERVER_NAME, "--json"]
|
||||
: ["mcp", "get", SERVER_NAME];
|
||||
const result = await runner.run(executable, args);
|
||||
if (result.code === 0) return { exists: true, output: result.stdout };
|
||||
const combined = `${result.stdout}\n${result.stderr}`;
|
||||
if (/not found|does not exist|no mcp server|not configured|unknown server/i.test(combined)) return { exists: false, output: combined };
|
||||
throw new Error(`Could not inspect ${agent} MCP configuration: ${safeCommandError(result)}`);
|
||||
}
|
||||
|
||||
function outputMatchesCommand(output: string, command: string[]): boolean {
|
||||
try {
|
||||
const document = JSON.parse(output) as unknown;
|
||||
if (findCommand(document, command)) return true;
|
||||
} catch {
|
||||
// Claude currently returns a human-readable record.
|
||||
}
|
||||
return command.every((part) => output.includes(part));
|
||||
}
|
||||
|
||||
function findCommand(value: unknown, command: string[]): boolean {
|
||||
if (!value || typeof value !== "object") return false;
|
||||
if (Array.isArray(value)) return value.some((item) => findCommand(item, command));
|
||||
const record = value as Record<string, unknown>;
|
||||
if (typeof record.command === "string" && Array.isArray(record.args)) {
|
||||
const candidate = [record.command, ...record.args.filter((item): item is string => typeof item === "string")];
|
||||
if (candidate.length === command.length && candidate.every((item, index) => item === command[index])) return true;
|
||||
}
|
||||
return Object.values(record).some((item) => findCommand(item, command));
|
||||
}
|
||||
|
||||
async function configureOpenCode(input: ConfigureInput, command: string[]): Promise<ConfigureResult> {
|
||||
const filePath = input.opencodePath ?? defaultOpenCodePath(input.env);
|
||||
const original = await readOptionalFile(filePath) ?? "{}\n";
|
||||
const document = parse(original) as { mcp?: Record<string, unknown> } | undefined;
|
||||
const existing = document?.mcp?.[SERVER_NAME] as { type?: unknown; command?: unknown; enabled?: unknown } | undefined;
|
||||
const desired = { type: "local", command, enabled: true };
|
||||
if (existing && existing.type === desired.type && existing.enabled === true && arraysEqual(existing.command, command)) {
|
||||
return { agent: "opencode", action: "unchanged" };
|
||||
}
|
||||
if (existing && !input.force && !input.dryRun) {
|
||||
const confirm = input.confirm ?? terminalConfirm;
|
||||
if (!process.stdin.isTTY && !input.confirm) throw new Error(`opencode already has a different ${SERVER_NAME} MCP entry; use --force to replace it`);
|
||||
if (!await confirm(`opencode already has a different ${SERVER_NAME} MCP entry. Replace it?`)) {
|
||||
throw new Error("opencode MCP configuration was not changed");
|
||||
}
|
||||
}
|
||||
if (input.dryRun) return { agent: "opencode", action: existing ? "would-replace" : "would-add" };
|
||||
const updated = applyEdits(original, modify(original, ["mcp", SERVER_NAME], desired, {
|
||||
formattingOptions: { insertSpaces: true, tabSize: 2, eol: "\n" },
|
||||
}));
|
||||
await backupAndAtomicWrite(filePath, updated, await readOptionalFile(filePath) !== undefined);
|
||||
return { agent: "opencode", action: existing ? "replaced" : "added" };
|
||||
}
|
||||
|
||||
async function unconfigureOpenCode(input: ConfigureInput): Promise<ConfigureResult> {
|
||||
const filePath = input.opencodePath ?? defaultOpenCodePath(input.env);
|
||||
const original = await readOptionalFile(filePath);
|
||||
if (original === undefined) return { agent: "opencode", action: "absent" };
|
||||
const document = parse(original) as { mcp?: Record<string, unknown> } | undefined;
|
||||
if (!document?.mcp || !(SERVER_NAME in document.mcp)) return { agent: "opencode", action: "absent" };
|
||||
if (input.dryRun) return { agent: "opencode", action: "would-remove" };
|
||||
const updated = applyEdits(original, modify(original, ["mcp", SERVER_NAME], undefined, {
|
||||
formattingOptions: { insertSpaces: true, tabSize: 2, eol: "\n" },
|
||||
}));
|
||||
await backupAndAtomicWrite(filePath, updated, true);
|
||||
return { agent: "opencode", action: "removed" };
|
||||
}
|
||||
|
||||
export function defaultOpenCodePath(env: NodeJS.ProcessEnv = process.env): string {
|
||||
const base = env.XDG_CONFIG_HOME || (process.platform === "win32"
|
||||
? path.join(env.USERPROFILE || os.homedir(), ".config")
|
||||
: path.join(os.homedir(), ".config"));
|
||||
return path.join(base, "opencode", "opencode.json");
|
||||
}
|
||||
|
||||
async function backupAndAtomicWrite(filePath: string, updated: string, existed: boolean): Promise<void> {
|
||||
await mkdir(path.dirname(filePath), { recursive: true });
|
||||
if (existed) {
|
||||
try {
|
||||
await copyFile(filePath, `${filePath}.crafttable-mcp.backup`, constants.COPYFILE_EXCL);
|
||||
} catch (error) {
|
||||
if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error;
|
||||
}
|
||||
}
|
||||
const temporary = `${filePath}.${process.pid}.tmp`;
|
||||
await writeFile(temporary, updated, "utf8");
|
||||
await rename(temporary, filePath);
|
||||
}
|
||||
|
||||
async function readOptionalFile(filePath: string): Promise<string | undefined> {
|
||||
try {
|
||||
return await readFile(filePath, "utf8");
|
||||
} catch (error) {
|
||||
if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined;
|
||||
throw error;
|
||||
}
|
||||
}
|
||||
|
||||
function arraysEqual(value: unknown, expected: string[]): boolean {
|
||||
return Array.isArray(value) && value.length === expected.length && value.every((item, index) => item === expected[index]);
|
||||
}
|
||||
|
||||
function expandTarget(target: AgentTarget): AgentName[] {
|
||||
if (target === "all") return ["codex", "claude", "opencode"];
|
||||
if (["codex", "claude", "opencode"].includes(target)) return [target as AgentName];
|
||||
throw new Error("Agent must be one of: codex, claude, opencode, all");
|
||||
}
|
||||
|
||||
async function terminalConfirm(message: string): Promise<boolean> {
|
||||
const readline = createInterface({ input: process.stdin, output: process.stderr });
|
||||
try {
|
||||
return /^y(es)?$/i.test((await readline.question(`${message} [y/N] `)).trim());
|
||||
} finally {
|
||||
readline.close();
|
||||
}
|
||||
}
|
||||
|
||||
async function requireSuccess(resultPromise: Promise<CommandResult>, operation: string): Promise<void> {
|
||||
const result = await resultPromise;
|
||||
if (result.code !== 0) throw new Error(`${operation} failed: ${safeCommandError(result)}`);
|
||||
}
|
||||
|
||||
function safeCommandError(result: CommandResult): string {
|
||||
return (result.stderr || result.stdout || `exit code ${result.code}`).trim();
|
||||
}
|
||||
|
||||
export class SpawnCommandRunner implements CommandRunner {
|
||||
run(command: string, args: string[]): Promise<CommandResult> {
|
||||
return new Promise((resolve, reject) => {
|
||||
const child = spawn(command, args, { shell: false, windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
|
||||
let stdout = "";
|
||||
let stderr = "";
|
||||
child.stdout.setEncoding("utf8").on("data", (chunk) => { stdout += String(chunk); });
|
||||
child.stderr.setEncoding("utf8").on("data", (chunk) => { stderr += String(chunk); });
|
||||
child.once("error", (error) => reject(new Error(`Could not run ${command}: ${errorMessage(error)}`)));
|
||||
child.once("close", (code) => resolve({ code: code ?? 1, stdout, stderr }));
|
||||
});
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,60 @@
|
||||
import { Server } from "@modelcontextprotocol/sdk/server/index.js";
|
||||
import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
|
||||
import {
|
||||
CallToolRequestSchema,
|
||||
ListResourcesRequestSchema,
|
||||
ListResourceTemplatesRequestSchema,
|
||||
ListToolsRequestSchema,
|
||||
ReadResourceRequestSchema,
|
||||
} from "@modelcontextprotocol/sdk/types.js";
|
||||
import type { ClientOptions } from "./config.js";
|
||||
import { DiscoveryStore } from "./config.js";
|
||||
import type { TokenStore } from "./credentials.js";
|
||||
import { connectRemote } from "./remote.js";
|
||||
|
||||
export async function serveBridge(
|
||||
options: ClientOptions,
|
||||
tokenStore: TokenStore,
|
||||
discoveryStore: DiscoveryStore,
|
||||
serviceToken = process.env.CRAFTTABLE_MCP_TOKEN?.trim(),
|
||||
): Promise<void> {
|
||||
const upstream = await connectRemote(options, tokenStore, discoveryStore, serviceToken);
|
||||
if (upstream.authentication === "service-token") {
|
||||
process.stderr.write("CraftTable MCP: using the legacy service-account token path.\n");
|
||||
}
|
||||
const server = createProxyServer(upstream.client);
|
||||
const transport = new StdioServerTransport();
|
||||
const close = async (): Promise<void> => {
|
||||
await server.close().catch(() => undefined);
|
||||
await upstream.close().catch(() => undefined);
|
||||
};
|
||||
process.once("SIGINT", () => void close());
|
||||
process.once("SIGTERM", () => void close());
|
||||
try {
|
||||
await server.connect(transport);
|
||||
} catch (error) {
|
||||
await close();
|
||||
throw error;
|
||||
}
|
||||
}
|
||||
|
||||
export function createProxyServer(upstream: {
|
||||
listTools: (params?: { cursor?: string }) => Promise<unknown>;
|
||||
callTool: (params: { name: string; arguments?: Record<string, unknown> }) => Promise<unknown>;
|
||||
listResources: (params?: { cursor?: string }) => Promise<unknown>;
|
||||
listResourceTemplates: (params?: { cursor?: string }) => Promise<unknown>;
|
||||
readResource: (params: { uri: string }) => Promise<unknown>;
|
||||
}): Server {
|
||||
const server = new Server({ name: "crafttable-mcp-stdio-bridge", version: "0.1.0" }, {
|
||||
capabilities: {
|
||||
tools: {},
|
||||
resources: {},
|
||||
},
|
||||
});
|
||||
server.setRequestHandler(ListToolsRequestSchema, (request) => upstream.listTools(request.params) as never);
|
||||
server.setRequestHandler(CallToolRequestSchema, (request) => upstream.callTool(request.params) as never);
|
||||
server.setRequestHandler(ListResourcesRequestSchema, (request) => upstream.listResources(request.params) as never);
|
||||
server.setRequestHandler(ListResourceTemplatesRequestSchema, (request) => upstream.listResourceTemplates(request.params) as never);
|
||||
server.setRequestHandler(ReadResourceRequestSchema, (request) => upstream.readResource(request.params) as never);
|
||||
return server;
|
||||
}
|
||||
@@ -0,0 +1,84 @@
|
||||
import { createServer, type Server } from "node:http";
|
||||
import type { AddressInfo } from "node:net";
|
||||
|
||||
export type OAuthCallback = { code: string };
|
||||
|
||||
export class OAuthCallbackServer {
|
||||
private server?: Server;
|
||||
private resolveResult?: (value: OAuthCallback) => void;
|
||||
private rejectResult?: (reason: Error) => void;
|
||||
private readonly result = new Promise<OAuthCallback>((resolve, reject) => {
|
||||
this.resolveResult = resolve;
|
||||
this.rejectResult = reject;
|
||||
});
|
||||
|
||||
constructor(
|
||||
private readonly port: number,
|
||||
private readonly validateState: (state: string | null) => boolean,
|
||||
) {
|
||||
// A very fast browser callback can arrive before loginRemote starts awaiting it.
|
||||
// Keep rejection handled while preserving the original promise for wait().
|
||||
void this.result.catch(() => undefined);
|
||||
}
|
||||
|
||||
async listen(): Promise<void> {
|
||||
if (this.server) throw new Error("OAuth callback server is already running");
|
||||
this.server = createServer((request, response) => {
|
||||
const url = new URL(request.url ?? "/", `http://127.0.0.1:${this.port}`);
|
||||
if (request.method !== "GET" || url.pathname !== "/oauth/callback") {
|
||||
response.writeHead(404, { "content-type": "text/plain; charset=utf-8" }).end("Not found");
|
||||
return;
|
||||
}
|
||||
const oauthError = url.searchParams.get("error");
|
||||
if (oauthError) {
|
||||
response.writeHead(400, { "content-type": "text/plain; charset=utf-8" }).end("OAuth login failed. Return to the terminal.");
|
||||
this.rejectResult?.(new Error(`OAuth authorization failed: ${oauthError}`));
|
||||
return;
|
||||
}
|
||||
if (!this.validateState(url.searchParams.get("state"))) {
|
||||
response.writeHead(400, { "content-type": "text/plain; charset=utf-8" }).end("OAuth state did not match. Return to the terminal.");
|
||||
this.rejectResult?.(new Error("OAuth callback state did not match"));
|
||||
return;
|
||||
}
|
||||
const code = url.searchParams.get("code");
|
||||
if (!code) {
|
||||
response.writeHead(400, { "content-type": "text/plain; charset=utf-8" }).end("OAuth authorization code is missing.");
|
||||
this.rejectResult?.(new Error("OAuth callback did not include an authorization code"));
|
||||
return;
|
||||
}
|
||||
response.writeHead(200, { "content-type": "text/html; charset=utf-8" }).end("<!doctype html><title>CraftTable MCP</title><p>Login complete. You can close this window.</p>");
|
||||
this.resolveResult?.({ code });
|
||||
});
|
||||
await new Promise<void>((resolve, reject) => {
|
||||
const onError = (error: Error) => reject(new Error(`Could not listen on OAuth callback port ${this.port}: ${error.message}`));
|
||||
this.server!.once("error", onError);
|
||||
this.server!.listen(this.port, "127.0.0.1", () => {
|
||||
this.server!.off("error", onError);
|
||||
resolve();
|
||||
});
|
||||
});
|
||||
const address = this.server.address() as AddressInfo | null;
|
||||
if (!address || address.port !== this.port) throw new Error(`OAuth callback server did not bind port ${this.port}`);
|
||||
}
|
||||
|
||||
async wait(timeoutMs = 10 * 60 * 1000): Promise<OAuthCallback> {
|
||||
let timeout: NodeJS.Timeout | undefined;
|
||||
try {
|
||||
return await Promise.race([
|
||||
this.result,
|
||||
new Promise<never>((_resolve, reject) => {
|
||||
timeout = setTimeout(() => reject(new Error("OAuth callback timed out")), timeoutMs);
|
||||
}),
|
||||
]);
|
||||
} finally {
|
||||
if (timeout) clearTimeout(timeout);
|
||||
}
|
||||
}
|
||||
|
||||
async close(): Promise<void> {
|
||||
if (!this.server) return;
|
||||
const server = this.server;
|
||||
this.server = undefined;
|
||||
await new Promise<void>((resolve, reject) => server.close((error) => error ? reject(error) : resolve()));
|
||||
}
|
||||
}
|
||||
+140
@@ -0,0 +1,140 @@
|
||||
#!/usr/bin/env node
|
||||
|
||||
import { fileURLToPath } from "node:url";
|
||||
import { Command } from "commander";
|
||||
import { configureAgents, type AgentTarget, unconfigureAgents } from "./agents.js";
|
||||
import { serveBridge } from "./bridge.js";
|
||||
import { type ClientOptions, credentialAccount, DiscoveryStore, resolveClientOptions } from "./config.js";
|
||||
import { KeyringTokenStore } from "./credentials.js";
|
||||
import { connectRemote, loginRemote, logoutRemote } from "./remote.js";
|
||||
|
||||
type ConnectionFlags = { url?: string; clientId?: string; callbackPort?: string };
|
||||
|
||||
const program = new Command()
|
||||
.name("crafttable-mcp")
|
||||
.description("OAuth client and stdio bridge for CraftTable MCP")
|
||||
.version("0.1.0");
|
||||
|
||||
withConnection(program.command("login").description("Log in through the system browser"))
|
||||
.option("--no-browser", "print the authorization URL instead of opening it")
|
||||
.option("--timeout <milliseconds>", "OAuth callback timeout", "600000")
|
||||
.action(async (flags: ConnectionFlags & { browser: boolean; timeout: string }) => {
|
||||
const options = connectionOptions(flags);
|
||||
const timeoutMs = positiveInteger(flags.timeout, "OAuth callback timeout");
|
||||
const result = await loginRemote(options, new KeyringTokenStore(), new DiscoveryStore(), { browser: flags.browser, timeoutMs });
|
||||
printJson({ loggedIn: true, alreadyAuthenticated: result.alreadyAuthenticated, server: options.url.toString(), tools: result.toolCount });
|
||||
});
|
||||
|
||||
withConnection(program.command("status").description("Check saved login state and remote MCP connectivity"))
|
||||
.action(async (flags: ConnectionFlags) => {
|
||||
const options = connectionOptions(flags);
|
||||
const tokens = await new KeyringTokenStore().get(credentialAccount(options));
|
||||
const connection = await connectRemote(options, new KeyringTokenStore(), new DiscoveryStore());
|
||||
try {
|
||||
const tools = await connection.client.listTools();
|
||||
printJson({
|
||||
loggedIn: Boolean(tokens),
|
||||
authentication: connection.authentication,
|
||||
connected: true,
|
||||
server: options.url.toString(),
|
||||
tools: tools.tools.length,
|
||||
});
|
||||
} finally {
|
||||
await connection.close();
|
||||
}
|
||||
});
|
||||
|
||||
withConnection(program.command("logout").description("Revoke OAuth tokens and remove the local credential"))
|
||||
.option("--local-only", "remove local credentials without contacting the authorization server")
|
||||
.action(async (flags: ConnectionFlags & { localOnly?: boolean }) => {
|
||||
const options = connectionOptions(flags);
|
||||
const result = await logoutRemote(options, new KeyringTokenStore(), new DiscoveryStore(), Boolean(flags.localOnly));
|
||||
printJson({ loggedIn: false, credentialRemoved: result.hadCredential, revoked: result.revoked, localOnly: Boolean(flags.localOnly) });
|
||||
});
|
||||
|
||||
withConnection(program.command("tools").description("List remote MCP tools"))
|
||||
.action(async (flags: ConnectionFlags) => withClient(connectionOptions(flags), async (client) => printJson(await client.listTools())));
|
||||
|
||||
withConnection(program.command("resources").description("List remote MCP resources and resource templates"))
|
||||
.action(async (flags: ConnectionFlags) => withClient(connectionOptions(flags), async (client) => printJson({
|
||||
resources: (await client.listResources()).resources,
|
||||
resourceTemplates: (await client.listResourceTemplates()).resourceTemplates,
|
||||
})));
|
||||
|
||||
withConnection(program.command("read <uri>").description("Read an MCP resource"))
|
||||
.action(async (uri: string, flags: ConnectionFlags) => withClient(connectionOptions(flags), async (client) => printJson(await client.readResource({ uri }))));
|
||||
|
||||
withConnection(program.command("call <tool> [json]").description("Call an MCP tool"))
|
||||
.action(async (tool: string, json: string | undefined, flags: ConnectionFlags) => withClient(connectionOptions(flags), async (client) => {
|
||||
printJson(await client.callTool({ name: tool, arguments: parseObject(json ?? "{}") }));
|
||||
}));
|
||||
|
||||
withConnection(program.command("serve").description("Run the local stdio bridge"))
|
||||
.action(async (flags: ConnectionFlags) => {
|
||||
await serveBridge(connectionOptions(flags), new KeyringTokenStore(), new DiscoveryStore());
|
||||
});
|
||||
|
||||
for (const operation of ["configure", "unconfigure"] as const) {
|
||||
withConnection(program.command(`${operation} <agent>`).description(`${operation === "configure" ? "Add" : "Remove"} the stdio bridge in Codex, Claude Code, or OpenCode`))
|
||||
.option("--dry-run", "show the planned changes without writing")
|
||||
.option("--force", "replace a conflicting entry without prompting")
|
||||
.action(async (agent: AgentTarget, flags: ConnectionFlags & { dryRun?: boolean; force?: boolean }) => {
|
||||
const cliEntry = fileURLToPath(import.meta.url);
|
||||
if (!cliEntry.endsWith(".js")) throw new Error("Agent configuration requires the built CLI; run `npm --prefix apps/mcp-client run build` first");
|
||||
const input = {
|
||||
target: agent,
|
||||
options: connectionOptions(flags),
|
||||
cliEntry,
|
||||
dryRun: Boolean(flags.dryRun),
|
||||
force: Boolean(flags.force),
|
||||
};
|
||||
const result = operation === "configure" ? await configureAgents(input) : await unconfigureAgents(input);
|
||||
printJson({ result });
|
||||
});
|
||||
}
|
||||
|
||||
function withConnection(command: Command): Command {
|
||||
return command
|
||||
.option("--url <url>", "MCP Streamable HTTP URL")
|
||||
.option("--client-id <id>", "pre-registered OAuth public client ID")
|
||||
.option("--callback-port <port>", "fixed localhost OAuth callback port");
|
||||
}
|
||||
|
||||
function connectionOptions(flags: ConnectionFlags): ClientOptions {
|
||||
return resolveClientOptions(flags);
|
||||
}
|
||||
|
||||
async function withClient(options: ClientOptions, action: (client: Awaited<ReturnType<typeof connectRemote>>["client"]) => Promise<void>): Promise<void> {
|
||||
const connection = await connectRemote(options, new KeyringTokenStore(), new DiscoveryStore());
|
||||
try {
|
||||
await action(connection.client);
|
||||
} finally {
|
||||
await connection.close();
|
||||
}
|
||||
}
|
||||
|
||||
function parseObject(raw: string): Record<string, unknown> {
|
||||
let value: unknown;
|
||||
try {
|
||||
value = JSON.parse(raw);
|
||||
} catch {
|
||||
throw new Error("Tool arguments must be a JSON object");
|
||||
}
|
||||
if (!value || Array.isArray(value) || typeof value !== "object") throw new Error("Tool arguments must be a JSON object");
|
||||
return value as Record<string, unknown>;
|
||||
}
|
||||
|
||||
function positiveInteger(value: string, name: string): number {
|
||||
const parsed = Number(value);
|
||||
if (!Number.isInteger(parsed) || parsed <= 0) throw new Error(`${name} must be a positive integer`);
|
||||
return parsed;
|
||||
}
|
||||
|
||||
function printJson(value: unknown): void {
|
||||
process.stdout.write(`${JSON.stringify(value, null, 2)}\n`);
|
||||
}
|
||||
|
||||
program.parseAsync().catch((error: unknown) => {
|
||||
process.stderr.write(`CraftTable MCP failed: ${error instanceof Error ? error.message : String(error)}\n`);
|
||||
process.exitCode = 1;
|
||||
});
|
||||
+112
@@ -0,0 +1,112 @@
|
||||
import { createHash } from "node:crypto";
|
||||
import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
|
||||
import os from "node:os";
|
||||
import path from "node:path";
|
||||
import type { OAuthDiscoveryState } from "@modelcontextprotocol/sdk/client/auth.js";
|
||||
|
||||
export const DEFAULT_MCP_URL = "https://crafttable.crash.work/mcp";
|
||||
export const DEFAULT_CLIENT_ID = "crafttable-mcp-cli";
|
||||
export const DEFAULT_CALLBACK_PORT = 48321;
|
||||
export const OAUTH_SCOPES = "openid profile email offline_access";
|
||||
|
||||
export type ClientOptions = {
|
||||
url: URL;
|
||||
clientId: string;
|
||||
callbackPort: number;
|
||||
};
|
||||
|
||||
export function resolveClientOptions(input: {
|
||||
url?: string;
|
||||
clientId?: string;
|
||||
callbackPort?: string | number;
|
||||
env?: NodeJS.ProcessEnv;
|
||||
} = {}): ClientOptions {
|
||||
const env = input.env ?? process.env;
|
||||
const url = validateMcpUrl(input.url ?? env.CRAFTTABLE_MCP_URL ?? DEFAULT_MCP_URL);
|
||||
const clientId = (input.clientId ?? env.CRAFTTABLE_MCP_OAUTH_CLIENT_ID ?? DEFAULT_CLIENT_ID).trim();
|
||||
if (!clientId) throw new Error("OAuth client ID must not be empty");
|
||||
const callbackPort = Number(input.callbackPort ?? env.CRAFTTABLE_MCP_OAUTH_CALLBACK_PORT ?? DEFAULT_CALLBACK_PORT);
|
||||
if (!Number.isInteger(callbackPort) || callbackPort < 1 || callbackPort > 65535) {
|
||||
throw new Error("OAuth callback port must be an integer between 1 and 65535");
|
||||
}
|
||||
return { url, clientId, callbackPort };
|
||||
}
|
||||
|
||||
export function validateMcpUrl(value: string): URL {
|
||||
let url: URL;
|
||||
try {
|
||||
url = new URL(value);
|
||||
} catch {
|
||||
throw new Error("MCP URL must be an absolute URL");
|
||||
}
|
||||
if (url.username || url.password || url.search || url.hash) {
|
||||
throw new Error("MCP URL must not include credentials, query parameters, or a fragment");
|
||||
}
|
||||
const local = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
|
||||
if (url.protocol !== "https:" && !(url.protocol === "http:" && local)) {
|
||||
throw new Error("MCP URL must use HTTPS unless it targets localhost");
|
||||
}
|
||||
url.pathname = url.pathname.replace(/\/+$/, "") || "/";
|
||||
return url;
|
||||
}
|
||||
|
||||
export function credentialAccount(options: Pick<ClientOptions, "url" | "clientId">): string {
|
||||
return createHash("sha256").update(`${options.url.toString()}\0${options.clientId}`).digest("hex");
|
||||
}
|
||||
|
||||
export function platformConfigDir(env: NodeJS.ProcessEnv = process.env, platform = process.platform): string {
|
||||
if (platform === "win32") return path.join(env.APPDATA || path.join(os.homedir(), "AppData", "Roaming"), "GameCraftTable", "mcp-client");
|
||||
if (platform === "darwin") return path.join(os.homedir(), "Library", "Application Support", "GameCraftTable", "mcp-client");
|
||||
return path.join(env.XDG_CONFIG_HOME || path.join(os.homedir(), ".config"), "gamecrafttable", "mcp-client");
|
||||
}
|
||||
|
||||
type DiscoveryFile = {
|
||||
version: 1;
|
||||
entries: Record<string, OAuthDiscoveryState>;
|
||||
};
|
||||
|
||||
export class DiscoveryStore {
|
||||
readonly filePath: string;
|
||||
|
||||
constructor(configDir = platformConfigDir()) {
|
||||
this.filePath = path.join(configDir, "discovery.json");
|
||||
}
|
||||
|
||||
async get(account: string): Promise<OAuthDiscoveryState | undefined> {
|
||||
return (await this.read()).entries[account];
|
||||
}
|
||||
|
||||
async set(account: string, state: OAuthDiscoveryState): Promise<void> {
|
||||
const document = await this.read();
|
||||
document.entries[account] = state;
|
||||
await atomicWriteJson(this.filePath, document);
|
||||
}
|
||||
|
||||
async delete(account: string): Promise<void> {
|
||||
const document = await this.read();
|
||||
if (!(account in document.entries)) return;
|
||||
delete document.entries[account];
|
||||
await atomicWriteJson(this.filePath, document);
|
||||
}
|
||||
|
||||
private async read(): Promise<DiscoveryFile> {
|
||||
try {
|
||||
const value = JSON.parse(await readFile(this.filePath, "utf8")) as Partial<DiscoveryFile>;
|
||||
return { version: 1, entries: value.entries && typeof value.entries === "object" ? value.entries : {} };
|
||||
} catch (error) {
|
||||
if ((error as NodeJS.ErrnoException).code === "ENOENT") return { version: 1, entries: {} };
|
||||
throw new Error(`Could not read OAuth discovery cache: ${errorMessage(error)}`);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
export async function atomicWriteJson(filePath: string, value: unknown): Promise<void> {
|
||||
await mkdir(path.dirname(filePath), { recursive: true });
|
||||
const temporary = `${filePath}.${process.pid}.tmp`;
|
||||
await writeFile(temporary, `${JSON.stringify(value, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
|
||||
await rename(temporary, filePath);
|
||||
}
|
||||
|
||||
export function errorMessage(error: unknown): string {
|
||||
return error instanceof Error ? error.message : String(error);
|
||||
}
|
||||
@@ -0,0 +1,64 @@
|
||||
import type { OAuthTokens } from "@modelcontextprotocol/sdk/shared/auth.js";
|
||||
|
||||
export const KEYRING_SERVICE = "CraftTable MCP";
|
||||
|
||||
export interface TokenStore {
|
||||
get(account: string): Promise<OAuthTokens | undefined>;
|
||||
set(account: string, tokens: OAuthTokens): Promise<void>;
|
||||
delete(account: string): Promise<void>;
|
||||
}
|
||||
|
||||
export class KeyringTokenStore implements TokenStore {
|
||||
async get(account: string): Promise<OAuthTokens | undefined> {
|
||||
let serialized: string | undefined;
|
||||
try {
|
||||
const entry = await keyringEntry(account);
|
||||
serialized = await entry.getPassword();
|
||||
} catch (error) {
|
||||
throw keyringError(error);
|
||||
}
|
||||
if (!serialized) return undefined;
|
||||
try {
|
||||
const value = JSON.parse(serialized) as OAuthTokens;
|
||||
if (!value.access_token || !value.token_type) throw new Error("missing token fields");
|
||||
return value;
|
||||
} catch {
|
||||
throw new Error("The saved CraftTable MCP credential is invalid; run `crafttable-mcp logout --local-only` and log in again");
|
||||
}
|
||||
}
|
||||
|
||||
async set(account: string, tokens: OAuthTokens): Promise<void> {
|
||||
try {
|
||||
const entry = await keyringEntry(account);
|
||||
await entry.setPassword(JSON.stringify(tokens));
|
||||
} catch (error) {
|
||||
throw keyringError(error);
|
||||
}
|
||||
}
|
||||
|
||||
async delete(account: string): Promise<void> {
|
||||
try {
|
||||
const entry = await keyringEntry(account);
|
||||
await entry.deleteCredential();
|
||||
} catch (error) {
|
||||
const message = String((error as Error)?.message ?? error).toLowerCase();
|
||||
if (message.includes("no entry") || message.includes("not found")) return;
|
||||
throw keyringError(error);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
async function keyringEntry(account: string): Promise<import("@napi-rs/keyring").AsyncEntry> {
|
||||
try {
|
||||
const { AsyncEntry } = await import("@napi-rs/keyring");
|
||||
return new AsyncEntry(KEYRING_SERVICE, account);
|
||||
} catch (error) {
|
||||
throw keyringError(error);
|
||||
}
|
||||
}
|
||||
|
||||
function keyringError(error: unknown): Error {
|
||||
if (error instanceof Error && error.message.startsWith("The operating-system credential store is unavailable")) return error;
|
||||
const detail = error instanceof Error ? error.message : String(error);
|
||||
return new Error(`The operating-system credential store is unavailable (${detail}). Enable Windows Credential Manager, macOS Keychain, or a Secret Service provider, then retry; plaintext token storage is not supported.`);
|
||||
}
|
||||
@@ -0,0 +1,84 @@
|
||||
import { randomBytes, timingSafeEqual } from "node:crypto";
|
||||
import type { OAuthClientProvider, OAuthDiscoveryState } from "@modelcontextprotocol/sdk/client/auth.js";
|
||||
import type { OAuthClientInformationMixed, OAuthClientMetadata, OAuthTokens } from "@modelcontextprotocol/sdk/shared/auth.js";
|
||||
import type { ClientOptions } from "./config.js";
|
||||
import { credentialAccount, DiscoveryStore, OAUTH_SCOPES } from "./config.js";
|
||||
import type { TokenStore } from "./credentials.js";
|
||||
|
||||
export class GameCraftOAuthProvider implements OAuthClientProvider {
|
||||
readonly redirectUrl: URL;
|
||||
readonly clientMetadata: OAuthClientMetadata;
|
||||
private readonly account: string;
|
||||
private readonly expectedState: string;
|
||||
private codeVerifierValue?: string;
|
||||
|
||||
constructor(
|
||||
private readonly options: ClientOptions,
|
||||
private readonly tokenStore: TokenStore,
|
||||
private readonly discoveryStore: DiscoveryStore,
|
||||
private readonly onRedirect: (url: URL) => void | Promise<void>,
|
||||
state = randomBytes(32).toString("base64url"),
|
||||
) {
|
||||
this.redirectUrl = new URL(`http://127.0.0.1:${options.callbackPort}/oauth/callback`);
|
||||
this.clientMetadata = {
|
||||
client_name: "CraftTable MCP CLI",
|
||||
redirect_uris: [this.redirectUrl.toString()],
|
||||
grant_types: ["authorization_code", "refresh_token"],
|
||||
response_types: ["code"],
|
||||
token_endpoint_auth_method: "none",
|
||||
scope: OAUTH_SCOPES,
|
||||
};
|
||||
this.account = credentialAccount(options);
|
||||
this.expectedState = state;
|
||||
}
|
||||
|
||||
state(): string {
|
||||
return this.expectedState;
|
||||
}
|
||||
|
||||
validateState(value: string | null): boolean {
|
||||
if (!value) return false;
|
||||
const expected = Buffer.from(this.expectedState);
|
||||
const actual = Buffer.from(value);
|
||||
return expected.length === actual.length && timingSafeEqual(expected, actual);
|
||||
}
|
||||
|
||||
clientInformation(): OAuthClientInformationMixed {
|
||||
return { client_id: this.options.clientId };
|
||||
}
|
||||
|
||||
tokens(): Promise<OAuthTokens | undefined> {
|
||||
return this.tokenStore.get(this.account);
|
||||
}
|
||||
|
||||
saveTokens(tokens: OAuthTokens): Promise<void> {
|
||||
return this.tokenStore.set(this.account, tokens);
|
||||
}
|
||||
|
||||
redirectToAuthorization(url: URL): void | Promise<void> {
|
||||
return this.onRedirect(url);
|
||||
}
|
||||
|
||||
saveCodeVerifier(codeVerifier: string): void {
|
||||
this.codeVerifierValue = codeVerifier;
|
||||
}
|
||||
|
||||
codeVerifier(): string {
|
||||
if (!this.codeVerifierValue) throw new Error("OAuth PKCE verifier is missing or expired");
|
||||
return this.codeVerifierValue;
|
||||
}
|
||||
|
||||
discoveryState(): Promise<OAuthDiscoveryState | undefined> {
|
||||
return this.discoveryStore.get(this.account);
|
||||
}
|
||||
|
||||
saveDiscoveryState(state: OAuthDiscoveryState): Promise<void> {
|
||||
return this.discoveryStore.set(this.account, state);
|
||||
}
|
||||
|
||||
async invalidateCredentials(scope: "all" | "client" | "tokens" | "verifier" | "discovery"): Promise<void> {
|
||||
if (scope === "all" || scope === "tokens") await this.tokenStore.delete(this.account);
|
||||
if (scope === "all" || scope === "discovery") await this.discoveryStore.delete(this.account);
|
||||
if (scope === "all" || scope === "verifier") this.codeVerifierValue = undefined;
|
||||
}
|
||||
}
|
||||
+167
@@ -0,0 +1,167 @@
|
||||
import { Client } from "@modelcontextprotocol/sdk/client/index.js";
|
||||
import { UnauthorizedError } from "@modelcontextprotocol/sdk/client/auth.js";
|
||||
import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
|
||||
import type { OAuthTokens } from "@modelcontextprotocol/sdk/shared/auth.js";
|
||||
import open from "open";
|
||||
import { OAuthCallbackServer } from "./callbackServer.js";
|
||||
import type { ClientOptions } from "./config.js";
|
||||
import { credentialAccount, DiscoveryStore, errorMessage } from "./config.js";
|
||||
import type { TokenStore } from "./credentials.js";
|
||||
import { GameCraftOAuthProvider } from "./oauthProvider.js";
|
||||
|
||||
export type RemoteConnection = {
|
||||
client: Client;
|
||||
transport: StreamableHTTPClientTransport;
|
||||
authentication: "oauth" | "service-token";
|
||||
close: () => Promise<void>;
|
||||
};
|
||||
|
||||
export async function connectRemote(
|
||||
options: ClientOptions,
|
||||
tokenStore: TokenStore,
|
||||
discoveryStore: DiscoveryStore,
|
||||
serviceToken = process.env.CRAFTTABLE_MCP_TOKEN?.trim(),
|
||||
): Promise<RemoteConnection> {
|
||||
const tokens = await tokenStore.get(credentialAccount(options));
|
||||
if (tokens) {
|
||||
const provider = new GameCraftOAuthProvider(options, tokenStore, discoveryStore, () => {
|
||||
throw new Error("OAuth login is required; run `crafttable-mcp login`");
|
||||
});
|
||||
return connectWithTransport(options, new StreamableHTTPClientTransport(options.url, { authProvider: provider }), "oauth");
|
||||
}
|
||||
if (serviceToken) {
|
||||
return connectWithTransport(options, new StreamableHTTPClientTransport(options.url, {
|
||||
requestInit: { headers: { authorization: `Bearer ${serviceToken}` } },
|
||||
}), "service-token");
|
||||
}
|
||||
throw new Error("Not logged in; run `crafttable-mcp login` or set CRAFTTABLE_MCP_TOKEN for the legacy service-account path");
|
||||
}
|
||||
|
||||
export async function loginRemote(
|
||||
options: ClientOptions,
|
||||
tokenStore: TokenStore,
|
||||
discoveryStore: DiscoveryStore,
|
||||
input: { browser: boolean; timeoutMs?: number; writeLine?: (value: string) => void } = { browser: true },
|
||||
): Promise<{ alreadyAuthenticated: boolean; toolCount: number }> {
|
||||
const writeLine = input.writeLine ?? ((value) => process.stderr.write(`${value}\n`));
|
||||
let authorizationUrl: URL | undefined;
|
||||
const provider = new GameCraftOAuthProvider(options, tokenStore, discoveryStore, async (url) => {
|
||||
authorizationUrl = url;
|
||||
if (!input.browser) {
|
||||
writeLine(`Open this URL to log in:\n${url.toString()}`);
|
||||
return;
|
||||
}
|
||||
try {
|
||||
await open(url.toString(), { wait: false });
|
||||
writeLine("Opened the system browser for Game-CraftTable login.");
|
||||
} catch (error) {
|
||||
writeLine(`Could not open the browser (${errorMessage(error)}). Open this URL manually:\n${url.toString()}`);
|
||||
}
|
||||
});
|
||||
const callback = new OAuthCallbackServer(options.callbackPort, (state) => provider.validateState(state));
|
||||
await callback.listen();
|
||||
const firstClient = new Client({ name: "crafttable-mcp-cli", version: "0.1.0" });
|
||||
const firstTransport = new StreamableHTTPClientTransport(options.url, { authProvider: provider });
|
||||
try {
|
||||
try {
|
||||
await firstClient.connect(firstTransport);
|
||||
const tools = await firstClient.listTools();
|
||||
return { alreadyAuthenticated: true, toolCount: tools.tools.length };
|
||||
} catch (error) {
|
||||
if (!(error instanceof UnauthorizedError) && !authorizationUrl) throw error;
|
||||
const { code } = await callback.wait(input.timeoutMs);
|
||||
await firstTransport.finishAuth(code);
|
||||
}
|
||||
} finally {
|
||||
await firstClient.close().catch(() => undefined);
|
||||
await callback.close().catch(() => undefined);
|
||||
}
|
||||
|
||||
const connection = await connectRemote(options, tokenStore, discoveryStore, "");
|
||||
try {
|
||||
const tools = await connection.client.listTools();
|
||||
return { alreadyAuthenticated: false, toolCount: tools.tools.length };
|
||||
} finally {
|
||||
await connection.close();
|
||||
}
|
||||
}
|
||||
|
||||
export async function logoutRemote(
|
||||
options: ClientOptions,
|
||||
tokenStore: TokenStore,
|
||||
discoveryStore: DiscoveryStore,
|
||||
localOnly: boolean,
|
||||
fetchFn: typeof fetch = fetch,
|
||||
): Promise<{ hadCredential: boolean; revoked: boolean }> {
|
||||
const account = credentialAccount(options);
|
||||
const tokens = await tokenStore.get(account);
|
||||
if (tokens && !localOnly) {
|
||||
const endpoint = await discoverRevocationEndpoint(options.url, fetchFn);
|
||||
await revokeTokens(endpoint, options.clientId, tokens, fetchFn);
|
||||
}
|
||||
await tokenStore.delete(account);
|
||||
await discoveryStore.delete(account);
|
||||
return { hadCredential: Boolean(tokens), revoked: Boolean(tokens && !localOnly) };
|
||||
}
|
||||
|
||||
async function connectWithTransport(
|
||||
options: ClientOptions,
|
||||
transport: StreamableHTTPClientTransport,
|
||||
authentication: RemoteConnection["authentication"],
|
||||
): Promise<RemoteConnection> {
|
||||
const client = new Client({ name: "crafttable-mcp-cli", version: "0.1.0" });
|
||||
try {
|
||||
await client.connect(transport);
|
||||
} catch (error) {
|
||||
await client.close().catch(() => undefined);
|
||||
if (error instanceof UnauthorizedError) throw new Error("OAuth login is required; run `crafttable-mcp login`");
|
||||
throw error;
|
||||
}
|
||||
return {
|
||||
client,
|
||||
transport,
|
||||
authentication,
|
||||
close: () => client.close(),
|
||||
};
|
||||
}
|
||||
|
||||
async function discoverRevocationEndpoint(resource: URL, fetchFn: typeof fetch): Promise<URL> {
|
||||
const metadataUrl = new URL(`/.well-known/oauth-protected-resource${resource.pathname === "/" ? "" : resource.pathname}`, resource.origin);
|
||||
const protectedResponse = await fetchFn(metadataUrl, { headers: { accept: "application/json" } });
|
||||
if (!protectedResponse.ok) throw new Error(`OAuth protected-resource discovery returned HTTP ${protectedResponse.status}`);
|
||||
const protectedMetadata = await protectedResponse.json() as { authorization_servers?: unknown };
|
||||
const issuer = Array.isArray(protectedMetadata.authorization_servers)
|
||||
? protectedMetadata.authorization_servers.find((value): value is string => typeof value === "string")
|
||||
: undefined;
|
||||
if (!issuer) throw new Error("OAuth protected-resource metadata has no authorization server");
|
||||
const issuerUrl = new URL(issuer);
|
||||
const candidates = [
|
||||
new URL(`${issuerUrl.toString().replace(/\/$/, "")}/.well-known/openid-configuration`),
|
||||
new URL(`/.well-known/openid-configuration${issuerUrl.pathname === "/" ? "" : issuerUrl.pathname}`, issuerUrl.origin),
|
||||
];
|
||||
for (const candidate of candidates) {
|
||||
const response = await fetchFn(candidate, { headers: { accept: "application/json" } });
|
||||
if (!response.ok) continue;
|
||||
try {
|
||||
const metadata = await response.json() as { revocation_endpoint?: unknown };
|
||||
if (typeof metadata.revocation_endpoint === "string") return new URL(metadata.revocation_endpoint);
|
||||
} catch {
|
||||
// Try the next standards-compatible discovery location.
|
||||
}
|
||||
}
|
||||
throw new Error("OAuth authorization server does not advertise a revocation endpoint");
|
||||
}
|
||||
|
||||
async function revokeTokens(endpoint: URL, clientId: string, tokens: OAuthTokens, fetchFn: typeof fetch): Promise<void> {
|
||||
const candidates = [tokens.refresh_token
|
||||
? { token: tokens.refresh_token, hint: "refresh_token" }
|
||||
: { token: tokens.access_token, hint: "access_token" }];
|
||||
for (const value of candidates) {
|
||||
const response = await fetchFn(endpoint, {
|
||||
method: "POST",
|
||||
headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
|
||||
body: new URLSearchParams({ token: value.token, token_type_hint: value.hint, client_id: clientId }),
|
||||
});
|
||||
if (!response.ok) throw new Error(`OAuth token revocation returned HTTP ${response.status}; local credentials were retained`);
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user