373f346e5f
Some checks failed
Run install, format, lint, build, and test on every push / build (push) Has been cancelled
Run install, format, lint, build, and test on every push / publish (push) Has been cancelled
Run install, format, lint, build, and test on every push / publish-github-container-registry (push) Has been cancelled
Closes #1689. Typecheck cli/tui src, add a core/ format+lint gate, and gate core/json + core/client coverage. See PR #1766 for the full review history.
96 lines
3.6 KiB
TypeScript
96 lines
3.6 KiB
TypeScript
/**
|
|
* Default OAuth callback URL for Node runners (TUI / CLI).
|
|
*
|
|
* Web uses the main Hono server (`localhost:6274` by default). Runners spin up
|
|
* a minimal loopback listener; default port 6276 (T9 "MCPO", MCP OAuth) avoids colliding
|
|
* with the web dev server while staying in the Inspector 627x family.
|
|
*
|
|
* Port 6276 is fixed so EMA, CIMD, and static OAuth apps can pre-register
|
|
* `http://127.0.0.1:6276/oauth/callback`. Concurrent TUI OAuth on that port is
|
|
* unsupported; override via `--callback-url` / `MCP_OAUTH_CALLBACK_URL`.
|
|
*/
|
|
|
|
export const RUNNER_OAUTH_CALLBACK_DEFAULT_HOSTNAME = "127.0.0.1";
|
|
/** Default loopback port for TUI/CLI OAuth callback (6276 ≈ T9 "MCPO", MCP OAuth). */
|
|
export const RUNNER_OAUTH_CALLBACK_DEFAULT_PORT = 6276;
|
|
export const RUNNER_OAUTH_CALLBACK_PATH = "/oauth/callback";
|
|
|
|
export const DEFAULT_RUNNER_OAUTH_CALLBACK_URL = `http://${RUNNER_OAUTH_CALLBACK_DEFAULT_HOSTNAME}:${RUNNER_OAUTH_CALLBACK_DEFAULT_PORT}${RUNNER_OAUTH_CALLBACK_PATH}`;
|
|
|
|
export interface RunnerOAuthCallbackConfig {
|
|
hostname: string;
|
|
port: number;
|
|
pathname: string;
|
|
}
|
|
|
|
/**
|
|
* Resolve the callback listener URL for TUI/CLI.
|
|
* Precedence: CLI `--callback-url` → `MCP_OAUTH_CALLBACK_URL` → default 6276.
|
|
* Pass `http://127.0.0.1:0/oauth/callback` for an OS-assigned ephemeral port.
|
|
*/
|
|
export function parseRunnerOAuthCallbackUrl(
|
|
cliCallbackUrl?: string,
|
|
): RunnerOAuthCallbackConfig {
|
|
const raw =
|
|
cliCallbackUrl?.trim() || process.env.MCP_OAUTH_CALLBACK_URL?.trim() || "";
|
|
if (!raw) {
|
|
return {
|
|
hostname: RUNNER_OAUTH_CALLBACK_DEFAULT_HOSTNAME,
|
|
port: RUNNER_OAUTH_CALLBACK_DEFAULT_PORT,
|
|
pathname: RUNNER_OAUTH_CALLBACK_PATH,
|
|
};
|
|
}
|
|
|
|
let url: URL;
|
|
try {
|
|
url = new URL(raw);
|
|
} catch (err) {
|
|
/* v8 ignore next -- new URL() only throws an Error with a message; the String(err) fallback is unreachable */
|
|
const reason = (err as Error)?.message ?? String(err);
|
|
throw new Error(`Invalid OAuth callback URL: ${reason}`);
|
|
}
|
|
if (url.protocol !== "http:") {
|
|
throw new Error("OAuth callback URL must use http scheme");
|
|
}
|
|
const hostname = url.hostname;
|
|
/* v8 ignore start -- a parseable http: URL always has a non-empty hostname; empty-host http URLs throw at new URL() above */
|
|
if (!hostname) {
|
|
throw new Error("OAuth callback URL must include a hostname");
|
|
}
|
|
/* v8 ignore stop */
|
|
/* v8 ignore next -- an http: URL always has a non-empty pathname (min "/"), so the fallback is unreachable */
|
|
const pathname = url.pathname || "/";
|
|
let port: number;
|
|
if (url.port === "") {
|
|
port = 80;
|
|
} else {
|
|
port = Number(url.port);
|
|
/* v8 ignore start -- new URL() already rejects out-of-range/non-numeric ports, so url.port is always a valid 0-65535 numeric string here */
|
|
if (
|
|
!Number.isFinite(port) ||
|
|
!Number.isInteger(port) ||
|
|
port < 0 ||
|
|
port > 65535
|
|
) {
|
|
throw new Error("OAuth callback URL port must be between 0 and 65535");
|
|
}
|
|
/* v8 ignore stop */
|
|
}
|
|
return { hostname, port, pathname };
|
|
}
|
|
|
|
/**
|
|
* Build the redirect_uri string sent to the authorization server.
|
|
* Port 0 yields `…:0/…`; the TUI overwrites `redirectUrlProvider.redirectUrl`
|
|
* with the bound listener URL before OAuth starts, so :0 is never sent to the AS.
|
|
*/
|
|
export function formatRunnerOAuthRedirectUrl(
|
|
config: RunnerOAuthCallbackConfig,
|
|
): string {
|
|
const needsBrackets =
|
|
config.hostname.includes(":") && !config.hostname.startsWith("[");
|
|
const formattedHost = needsBrackets
|
|
? `[${config.hostname}]`
|
|
: config.hostname;
|
|
return `http://${formattedHost}:${config.port}${config.pathname}`;
|
|
}
|