File size: 5,733 Bytes
4e23b01 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 | import {
createServer,
type IncomingMessage,
type ServerResponse,
} from 'node:http';
import type { AddressInfo } from 'node:net';
export interface McpAuthStatusServer {
readonly authToken: string;
readonly refreshToken: string;
readonly plainUrl: string;
readonly oauthUrl: string;
readonly unavailableUrl: string;
requestCount(pathname: string): number;
close(): Promise<void>;
}
/** The one refresh token the `/token` endpoint honors. */
const REFRESH_TOKEN = 'valid-test-refresh-token';
export async function startMcpAuthStatusServer(): Promise<McpAuthStatusServer> {
const authToken = 'valid-test-access-token';
let baseUrl = '';
const requestCounts = new Map<string, number>();
const server = createServer((request, response) => {
const pathname = new URL(request.url ?? '/', baseUrl).pathname;
requestCounts.set(pathname, (requestCounts.get(pathname) ?? 0) + 1);
void handleRequest(request, response, baseUrl, authToken).catch((error: unknown) => {
if (!response.headersSent) response.writeHead(500);
response.end(String(error));
});
});
await new Promise<void>((resolve, reject) => {
server.once('error', reject);
server.listen(0, '127.0.0.1', resolve);
});
const { port } = server.address() as AddressInfo;
baseUrl = `http://127.0.0.1:${port}`;
return {
authToken,
refreshToken: REFRESH_TOKEN,
plainUrl: `${baseUrl}/plain`,
oauthUrl: `${baseUrl}/oauth`,
unavailableUrl: `${baseUrl}/unavailable`,
requestCount: (pathname) => requestCounts.get(pathname) ?? 0,
close: () =>
new Promise<void>((resolve, reject) => {
server.close((error) => {
if (error === undefined) resolve();
else reject(error);
});
}),
};
}
async function handleRequest(
request: IncomingMessage,
response: ServerResponse,
baseUrl: string,
authToken: string,
): Promise<void> {
const url = new URL(request.url ?? '/', baseUrl);
if (url.pathname === '/unavailable') {
response.writeHead(503).end('Temporarily unavailable');
return;
}
if (url.pathname === '/token' && request.method === 'POST') {
// Token endpoint: a valid refresh grant rotates into a fresh access
// token; anything else is rejected, so probes of stale credentials still
// land on needs-auth.
const rawBody = await readBody(request);
const params = new URLSearchParams(rawBody);
if (
params.get('grant_type') === 'refresh_token' &&
params.get('refresh_token') === REFRESH_TOKEN
) {
sendJson(response, {
access_token: authToken,
token_type: 'Bearer',
expires_in: 3600,
refresh_token: REFRESH_TOKEN,
});
return;
}
response.writeHead(400, { 'content-type': 'application/json' });
response.end(JSON.stringify({ error: 'invalid_grant' }));
return;
}
if (url.pathname === '/.well-known/oauth-protected-resource') {
sendJson(response, {
resource: `${baseUrl}/oauth`,
authorization_servers: [baseUrl],
});
return;
}
if (
url.pathname === '/.well-known/oauth-authorization-server' ||
url.pathname === '/.well-known/openid-configuration'
) {
sendJson(response, {
issuer: baseUrl,
authorization_endpoint: `${baseUrl}/authorize`,
token_endpoint: `${baseUrl}/token`,
registration_endpoint: `${baseUrl}/register`,
response_types_supported: ['code'],
grant_types_supported: ['authorization_code', 'refresh_token'],
code_challenge_methods_supported: ['S256'],
token_endpoint_auth_methods_supported: ['none'],
});
return;
}
if (url.pathname === '/register' && request.method === 'POST') {
const metadata = await readJson(request);
sendJson(response, { client_id: 'test-client', ...metadata }, 201);
return;
}
if (url.pathname === '/oauth' && request.headers.authorization !== `Bearer ${authToken}`) {
response.writeHead(401, {
'content-type': 'application/json',
'www-authenticate': `Bearer resource_metadata="${baseUrl}/.well-known/oauth-protected-resource"`,
});
response.end(JSON.stringify({ error: 'unauthorized' }));
return;
}
if (request.method !== 'POST') {
response.writeHead(405).end('Method not allowed');
return;
}
const message = (await readJson(request)) as {
readonly id?: string | number;
readonly method?: string;
};
if (message.id === undefined) {
response.writeHead(202).end();
return;
}
const result =
message.method === 'initialize'
? {
protocolVersion: '2025-03-26',
capabilities: { tools: {} },
serverInfo: { name: 'auth-status', version: '0.0.1' },
}
: message.method === 'tools/list'
? { tools: [] }
: {};
sendJson(response, { jsonrpc: '2.0', id: message.id, result });
}
async function readBody(request: AsyncIterable<unknown>): Promise<string> {
const chunks: Buffer[] = [];
for await (const chunk of request) {
chunks.push(typeof chunk === 'string' ? Buffer.from(chunk) : Buffer.from(chunk as Uint8Array));
}
return Buffer.concat(chunks).toString('utf8');
}
async function readJson(request: AsyncIterable<unknown>): Promise<Record<string, unknown>> {
const chunks: Buffer[] = [];
for await (const chunk of request) {
chunks.push(typeof chunk === 'string' ? Buffer.from(chunk) : Buffer.from(chunk as Uint8Array));
}
return JSON.parse(Buffer.concat(chunks).toString('utf8')) as Record<string, unknown>;
}
function sendJson(
response: ServerResponse,
body: unknown,
status = 200,
): void {
response.writeHead(status, { 'content-type': 'application/json' });
response.end(JSON.stringify(body));
}
|