${escapeHtml(error)}
` : '';
+
+ const clientLogoHtml = cimd?.logo_uri
+ ? `${clientLogoHtml}
`
+ : '';
+
+ res.type('html').send(`
+
+
+
+
+ ${clientNameHtml} wants to access your account
Redirecting to ${escapeHtml(cimd.redirect_hostname)}
+
+
+`);
+}
+
async function main() {
const httpServer = http.createServer(app);
let typeDefs = gql(
@@ -55,11 +239,257 @@ async function main() {
});
await server.start();
- // Public key endpoint
app.get('/.well-known/jwks.json', (req, res) => {
res.json(JSON.parse(jwks));
})
+ // OAuth 2.0 Authorization Server Metadata (RFC 8414)
+ app.get('/.well-known/oauth-authorization-server', (req, res) => {
+ const issuer = getIssuer(req);
+ res.json({
+ issuer,
+ jwks_uri: `${issuer}/.well-known/jwks.json`,
+ response_types_supported: ['code'],
+ grant_types_supported: ['authorization_code'],
+ code_challenge_methods_supported: ['S256'],
+ token_endpoint: `${issuer}/token`,
+ authorization_endpoint: `${issuer}/authorize`,
+ registration_endpoint: `${issuer}/register`,
+ scopes_supported: ['user:read:email', 'inventory:read', 'order:read', 'cart:write'],
+ client_id_metadata_document_supported: true,
+ });
+ })
+
+ // RFC 7591 Dynamic Client Registration
+ app.post('/register', express.json(), (req, res) => {
+ const client_id = `client_${crypto.randomUUID()}`;
+ const client_secret = crypto.randomUUID();
+ const redirect_uris = req.body.redirect_uris || [];
+
+ registeredClients.set(client_id, { client_id, client_secret, redirect_uris });
+
+ res.status(201).json({
+ client_id,
+ client_secret,
+ redirect_uris,
+ client_id_issued_at: Math.floor(Date.now() / 1000),
+ client_secret_expires_at: 0,
+ });
+ });
+
+ // OAuth Authorization Endpoint — renders a login form
+ // Supports both CIMD (URL-based client_id) and dynamically registered clients
+ app.get('/authorize', async (req, res) => {
+ const { client_id, redirect_uri, state, scope, code_challenge, code_challenge_method } = req.query;
+ const params: OAuthParams = {
+ client_id: client_id as string,
+ redirect_uri: redirect_uri as string,
+ state: state as string,
+ scope: scope as string,
+ code_challenge: code_challenge as string,
+ code_challenge_method: code_challenge_method as string,
+ };
+
+ if (isUrlClientId(client_id as string)) {
+ try {
+ const cimd = await fetchClientMetadata(client_id as string);
+ if (!validateRedirectUri(redirect_uri as string, cimd.redirect_uris)) {
+ res.status(400).json({ error: 'invalid_request', error_description: 'redirect_uri not registered in client metadata document' });
+ return;
+ }
+ renderLoginPage(res, params, undefined, {
+ client_name: cimd.client_name,
+ client_uri: cimd.client_uri,
+ logo_uri: cimd.logo_uri,
+ redirect_hostname: getRedirectHostname(redirect_uri as string),
+ });
+ } catch (err) {
+ console.error('[OAuth /authorize] CIMD fetch failed:', err);
+ res.status(400).json({ error: 'invalid_client', error_description: String(err) });
+ }
+ return;
+ }
+
+ const registeredClient = registeredClients.get(client_id as string);
+ if (!registeredClient) {
+ res.status(400).json({ error: 'invalid_client', error_description: 'Unknown client_id. Register via /register or use a CIMD URL.' });
+ return;
+ }
+ if (!validateRedirectUri(redirect_uri as string, registeredClient.redirect_uris)) {
+ res.status(400).json({ error: 'invalid_request', error_description: 'redirect_uri not registered for this client' });
+ return;
+ }
+
+ renderLoginPage(res, params);
+ });
+
+ // OAuth Authorization Endpoint — processes the login form submission
+ app.post('/authorize', express.urlencoded({ extended: true }), async (req, res) => {
+ const { username, password, client_id, redirect_uri, state, scope, code_challenge, code_challenge_method } = req.body;
+ const oauthParams: OAuthParams = { client_id, redirect_uri, state, scope, code_challenge, code_challenge_method };
+
+ if (isUrlClientId(client_id)) {
+ try {
+ const cimd = await fetchClientMetadata(client_id);
+ if (!validateRedirectUri(redirect_uri, cimd.redirect_uris)) {
+ renderLoginPage(res, oauthParams, 'redirect_uri not registered in client metadata document');
+ return;
+ }
+ } catch (err) {
+ console.error('[OAuth /authorize POST] CIMD validation failed:', err);
+ res.status(400).json({ error: 'invalid_client', error_description: String(err) });
+ return;
+ }
+ } else {
+ const registeredClient = registeredClients.get(client_id);
+ if (!registeredClient) {
+ res.status(400).json({ error: 'invalid_client', error_description: 'Unknown client_id. Register via /register or use a CIMD URL.' });
+ return;
+ }
+ if (!validateRedirectUri(redirect_uri, registeredClient.redirect_uris)) {
+ renderLoginPage(res, oauthParams, 'redirect_uri not registered for this client');
+ return;
+ }
+ }
+
+ if (!username || !password) {
+ renderLoginPage(res, oauthParams, 'Username and password are required.');
+ return;
+ }
+
+ const user = users.find((u) => u.username === username);
+ if (!user) {
+ renderLoginPage(res, oauthParams, 'Invalid username or password.');
+ return;
+ }
+
+ const userScopes = user.scopes || [];
+ const requestedScopes = scope ? (scope as string).split(' ').filter(Boolean) : [];
+ const grantedScopes = requestedScopes.length > 0
+ ? requestedScopes.filter(s => userScopes.includes(s))
+ : userScopes;
+ if (requestedScopes.length > 0 && grantedScopes.length === 0) {
+ renderLoginPage(res, oauthParams, `Your account does not have any of the requested scopes: ${requestedScopes.join(', ')}`);
+ return;
+ }
+ const grantedScope = grantedScopes.join(' ') || 'user:read:email';
+
+ if (!code_challenge || code_challenge_method !== 'S256') {
+ renderLoginPage(res, oauthParams, 'PKCE with S256 is required.');
+ return;
+ }
+
+ const code = crypto.randomUUID();
+ console.log('[OAuth /authorize] login success for', username, '- created code:', code);
+ authorizationCodes.set(code, {
+ client_id,
+ redirect_uri,
+ scope: grantedScope,
+ user_id: user.id,
+ username: user.username,
+ code_challenge,
+ code_challenge_method,
+ expires_at: Date.now() + 5 * 60 * 1000,
+ });
+
+ const redirectUrl = new URL(redirect_uri as string);
+ redirectUrl.searchParams.set('code', code);
+ if (state) redirectUrl.searchParams.set('state', state as string);
+
+ res.redirect(302, redirectUrl.toString());
+ });
+
+ // OAuth Token Endpoint
+ // CIMD clients are public clients (no client_secret required).
+ // Dynamically registered clients also don't enforce client_secret here (demo).
+ app.post('/token', express.urlencoded({ extended: true }), express.json(), async (req, res): Promise
+
+
+ ${clientInfoHtml}
+ ${errorHtml}
+
+ Apollo Reference Architecture
+Sign in to authorize MCP access
+ ${params.scope ? `${escapeHtml(params.scope)}` : ''} +Test users: user1, user2, user3, inventoryManager
+