YeonGyu-Kim
dcda8769cc
* feat(mcp-oauth): add oauth field to ClaudeCodeMcpServer schema Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * feat(mcp-oauth): add RFC 7591 Dynamic Client Registration * feat(mcp-oauth): add RFC 9728 PRM + RFC 8414 AS discovery * feat(mcp-oauth): add secure token storage with {host}/{resource} key format * feat(mcp-oauth): add dynamic port OAuth callback server * feat(mcp-oauth): add RFC 8707 Resource Indicators * feat(mcp-oauth): implement full-spec McpOAuthProvider * feat(mcp-oauth): add step-up authorization handler * feat(mcp-oauth): integrate authProvider into SkillMcpManager * feat(doctor): add MCP OAuth token status check * feat(cli): add mcp oauth subcommand structure * feat(cli): implement mcp oauth login command * fix(mcp-oauth): address cubic review — security, correctness, and test issues - Remove @ts-nocheck from provider.ts, storage.ts, provider.test.ts - Fix server resource leak on missing code/state (close + reject) - Fix command injection in openBrowser (spawn array args, cross-platform) - Mock McpOAuthProvider in login.test.ts for deterministic CI - Recreate auth provider with merged scopes in step-up flow - Add listAllTokens() for global status listing - Fix logout to accept --server-url for correct token deletion - Support both quoted and unquoted WWW-Authenticate params (RFC 2617) - Save/restore OPENCODE_CONFIG_DIR in storage.test.ts - Fix index.test.ts: vitest → bun:test * fix(mcp-oauth): use explorer instead of cmd /c start on Windows to prevent shell injection * fix(mcp-oauth): address remaining cubic review issues - Add 5-minute timeout to provider callback server to prevent indefinite hangs - Persist client registration from token storage across process restarts - Require --server-url for logout to match token storage key format - Use listTokensByHost for server-specific status lookups - Fix callback-server test to handle promise rejection ordering - Fix provider test port expectations (8912 → 19877) - Fix cli-guide.md duplicate Section 7 numbering - Fix manager test for login-on-missing-tokens behavior * fix(mcp-oauth): address final review issues - P1: Redact token values in status.ts output to prevent credential leakage - P2: Read OAuth error response body before throwing in token exchange - Test: Fix mcp-oauth doctor test to use epoch seconds (not milliseconds) --------- Co-authored-by: justsisyphus <justsisyphus@users.noreply.github.com> Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
125 lines
3.5 KiB
TypeScript
125 lines
3.5 KiB
TypeScript
const DEFAULT_PORT = 19877
|
|
const MAX_PORT_ATTEMPTS = 20
|
|
const TIMEOUT_MS = 5 * 60 * 1000
|
|
|
|
export type OAuthCallbackResult = {
|
|
code: string
|
|
state: string
|
|
}
|
|
|
|
export type CallbackServer = {
|
|
port: number
|
|
waitForCallback: () => Promise<OAuthCallbackResult>
|
|
close: () => void
|
|
}
|
|
|
|
const SUCCESS_HTML = `<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<title>OAuth Authorized</title>
|
|
<style>
|
|
body { font-family: -apple-system, BlinkMacSystemFont, sans-serif; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background: #0a0a0a; color: #fafafa; }
|
|
.container { text-align: center; }
|
|
h1 { font-size: 1.5rem; margin-bottom: 0.5rem; }
|
|
p { color: #888; }
|
|
</style>
|
|
</head>
|
|
<body>
|
|
<div class="container">
|
|
<h1>Authorization successful</h1>
|
|
<p>You can close this window and return to your terminal.</p>
|
|
</div>
|
|
</body>
|
|
</html>`
|
|
|
|
async function isPortAvailable(port: number): Promise<boolean> {
|
|
try {
|
|
const server = Bun.serve({
|
|
port,
|
|
hostname: "127.0.0.1",
|
|
fetch: () => new Response(),
|
|
})
|
|
server.stop(true)
|
|
return true
|
|
} catch {
|
|
return false
|
|
}
|
|
}
|
|
|
|
export async function findAvailablePort(startPort: number = DEFAULT_PORT): Promise<number> {
|
|
for (let attempt = 0; attempt < MAX_PORT_ATTEMPTS; attempt++) {
|
|
const port = startPort + attempt
|
|
if (await isPortAvailable(port)) {
|
|
return port
|
|
}
|
|
}
|
|
throw new Error(`No available port found in range ${startPort}-${startPort + MAX_PORT_ATTEMPTS - 1}`)
|
|
}
|
|
|
|
export async function startCallbackServer(startPort: number = DEFAULT_PORT): Promise<CallbackServer> {
|
|
const port = await findAvailablePort(startPort)
|
|
|
|
let resolveCallback: ((result: OAuthCallbackResult) => void) | null = null
|
|
let rejectCallback: ((error: Error) => void) | null = null
|
|
|
|
const callbackPromise = new Promise<OAuthCallbackResult>((resolve, reject) => {
|
|
resolveCallback = resolve
|
|
rejectCallback = reject
|
|
})
|
|
|
|
const timeoutId = setTimeout(() => {
|
|
rejectCallback?.(new Error("OAuth callback timed out after 5 minutes"))
|
|
server.stop(true)
|
|
}, TIMEOUT_MS)
|
|
|
|
const server = Bun.serve({
|
|
port,
|
|
hostname: "127.0.0.1",
|
|
fetch(request: Request): Response {
|
|
const url = new URL(request.url)
|
|
|
|
if (url.pathname !== "/oauth/callback") {
|
|
return new Response("Not Found", { status: 404 })
|
|
}
|
|
|
|
const oauthError = url.searchParams.get("error")
|
|
if (oauthError) {
|
|
const description = url.searchParams.get("error_description") ?? oauthError
|
|
clearTimeout(timeoutId)
|
|
rejectCallback?.(new Error(`OAuth authorization failed: ${description}`))
|
|
setTimeout(() => server.stop(true), 100)
|
|
return new Response(`Authorization failed: ${description}`, { status: 400 })
|
|
}
|
|
|
|
const code = url.searchParams.get("code")
|
|
const state = url.searchParams.get("state")
|
|
|
|
if (!code || !state) {
|
|
clearTimeout(timeoutId)
|
|
rejectCallback?.(new Error("OAuth callback missing code or state parameter"))
|
|
setTimeout(() => server.stop(true), 100)
|
|
return new Response("Missing code or state parameter", { status: 400 })
|
|
}
|
|
|
|
resolveCallback?.({ code, state })
|
|
clearTimeout(timeoutId)
|
|
|
|
setTimeout(() => server.stop(true), 100)
|
|
|
|
return new Response(SUCCESS_HTML, {
|
|
headers: { "content-type": "text/html; charset=utf-8" },
|
|
})
|
|
},
|
|
})
|
|
|
|
return {
|
|
port,
|
|
waitForCallback: () => callbackPromise,
|
|
close: () => {
|
|
clearTimeout(timeoutId)
|
|
server.stop(true)
|
|
},
|
|
}
|
|
}
|