Setup auth-server to handle callbacks for sandbox-container and workers-bindings

Maximo-Guk · Maximo-Guk · commit 4c1dc2133450 · 2025-04-16T14:10:52.000-05:00
diff --git a/apps/auth-server/wrangler.jsonc b/apps/auth-server/wrangler.jsonc
@@ -20,12 +20,12 @@
 		"staging": {
 			"name": "mcp-cloudflare-auth-server-staging",
 			"account_id": "8995c0f49cdcf57eb54d2c1e52b7d2f3",
-			"routes": ["staging.mcp.cloudflare.com/oauth/callback"],
+			"routes": ["staging.mcp.cloudflare.com/oauth/callback"]
 		},
 		"production": {
 			"name": "mcp-cloudflare-auth-server-production",
 			"account_id": "8995c0f49cdcf57eb54d2c1e52b7d2f3",
-			"routes": ["mcp.cloudflare.com/oauth/callback"],
+			"routes": ["mcp.cloudflare.com/oauth/callback"]
 		}
 	}
 }
diff --git a/apps/sandbox-container/container/index.ts b/apps/sandbox-container/container/index.ts
@@ -7,8 +7,8 @@ import { Hono } from 'hono'
 import { streamText } from 'hono/streaming'
 import mime from 'mime'
 
-import { ExecParams, FilesWrite } from '../shared/schema.ts'
-import { get_file_name_from_path } from './fileUtils.ts'
+import { ExecParams, FilesWrite } from '../shared/schema'
+import { get_file_name_from_path } from './fileUtils'
 
 import type { FileList } from '../shared/schema.ts'
 
diff --git a/apps/sandbox-container/package.json b/apps/sandbox-container/package.json
@@ -20,6 +20,7 @@
 		"@hono/node-server": "^1.13.8",
 		"@hono/zod-validator": "^0.4.3",
 		"@modelcontextprotocol/sdk": "^1.7.0",
+		"@repo/mcp-common": "workspace:*",
 		"@types/node": "^22.13.10",
 		"agents": "^0.0.42",
 		"cron-schedule": "^5.0.4",
@@ -30,10 +31,10 @@
 		"partyserver": "^0.0.65",
 		"tsx": "^4.19.3",
 		"workers-mcp": "0.1.0-3",
-		"zod": "^3.24.2",
-		"@repo/mcp-common": "workspace:*"
+		"zod": "^3.24.2"
 	},
 	"devDependencies": {
+		"@cloudflare/vitest-pool-workers": "0.8.14",
 		"concurrently": "^9.1.2",
 		"wrangler": "^4.9.1"
 	}
diff --git a/apps/sandbox-container/server/index.ts b/apps/sandbox-container/server/index.ts
@@ -2,9 +2,10 @@ import OAuthProvider from '@cloudflare/workers-oauth-provider'
 import { env } from 'cloudflare:workers'
 
 import {
-	CloudflareAuthHandler,
+	createAuthHandlers,
 	handleTokenExchangeCallback,
 } from '@repo/mcp-common/src/cloudflare-oauth-handler'
+import { getEnvironment } from '@repo/mcp-common/src/config'
 
 import { ContainerManager } from './containerManager'
 import { ContainerMcpAgent } from './containerMcp'
@@ -32,7 +33,10 @@ export default new OAuthProvider({
 	// @ts-ignore
 	apiHandler: ContainerMcpAgent.mount('/workers/sandbox/sse', { binding: 'CONTAINER_MCP_AGENT' }),
 	// @ts-ignore
-	defaultHandler: CloudflareAuthHandler,
+	defaultHandler: createAuthHandlers({
+		serverPath: 'workers/containers',
+		environment: getEnvironment(env.ENVIRONMENT),
+	}),
 	authorizeEndpoint: '/oauth/authorize',
 	tokenEndpoint: '/token',
 	tokenExchangeCallback: (options) =>
diff --git a/apps/sandbox-container/tsconfig.json b/apps/sandbox-container/tsconfig.json
@@ -1,16 +1,3 @@
 {
-	"compilerOptions": {
-		"target": "ESNext",
-		"lib": ["ESNext", "DOM"],
-		"jsx": "react-jsx",
-		"module": "ESNext",
-		"moduleResolution": "bundler",
-		"types": ["./worker-configuration.d.ts", "@cloudflare/workers-types/2023-07-01"],
-		"noEmit": true,
-		"esModuleInterop": true,
-		"forceConsistentCasingInFileNames": true,
-		"strict": true,
-		"skipLibCheck": true
-	},
-	"include": ["server/**.ts", "shared/**.ts"]
+	"extends": "@repo/typescript-config/workers.json"
 }
diff --git a/apps/sandbox-container/worker-configuration.d.ts b/apps/sandbox-container/worker-configuration.d.ts
@@ -2,11 +2,14 @@
 // Runtime types generated with workerd@1.20250409.0 2025-04-03
 declare namespace Cloudflare {
 	interface Env {
-		OAUTH_KV: KVNamespace
-		CONTAINER_MCP_AGENT: DurableObjectNamespace<import('./server/index').ContainerMcpAgent>
-		CONTAINER_MANAGER: DurableObjectNamespace<import('./server/index').ContainerManager>
-		CLOUDFLARE_CLIENT_ID: string
-		CLOUDFLARE_CLIENT_SECRET: string
+		OAUTH_KV: KVNamespace;
+		// eslint-disable-next-line @typescript-eslint/consistent-type-imports
+		CONTAINER_MCP_AGENT: DurableObjectNamespace<import("./server/index").ContainerMcpAgent>;
+		// eslint-disable-next-line @typescript-eslint/consistent-type-imports
+		CONTAINER_MANAGER: DurableObjectNamespace<import("./server/index").ContainerManager>;
+		CLOUDFLARE_CLIENT_ID: string;
+		CLOUDFLARE_CLIENT_SECRET: string;
+        ENVIRONMENT: string
 	}
 }
 interface Env extends Cloudflare.Env {}
diff --git a/apps/sandbox-container/wrangler.jsonc b/apps/sandbox-container/wrangler.jsonc
@@ -1,6 +1,6 @@
 {
 	"$schema": "node_modules/wrangler/config-schema.json",
-	"name": "sandbox-container",
+	"name": "sandbox-container-dev",
 	"main": "server/index.ts",
 	"compatibility_date": "2025-04-03",
 	"containers": [
@@ -41,5 +41,8 @@
 	],
 	"dev": {
 		"port": 8976
+	},
+	"vars": {
+		"ENVIRONMENT": "development"
 	}
 }
diff --git a/apps/workers-bindings/src/index.ts b/apps/workers-bindings/src/index.ts
@@ -4,9 +4,10 @@ import { McpAgent } from 'agents/mcp'
 import { env } from 'cloudflare:workers'
 
 import {
-	CloudflareAuthHandler,
+	createAuthHandlers,
 	handleTokenExchangeCallback,
 } from '@repo/mcp-common/src/cloudflare-oauth-handler'
+import { getEnvironment } from '@repo/mcp-common/src/config'
 import { registerAccountTools } from '@repo/mcp-common/src/tools/account'
 import { registerKVTools } from '@repo/mcp-common/src/tools/kv_namespace'
 import { registerWorkersTools } from '@repo/mcp-common/src/tools/worker'
@@ -66,11 +67,18 @@ export default new OAuthProvider({
 	// @ts-ignore
 	apiHandler: WorkersBindingsMCP.mount('/workers/bindings/sse'),
 	// @ts-ignore
-	defaultHandler: CloudflareAuthHandler,
+	defaultHandler: createAuthHandlers({
+		serverPath: 'workers/containers',
+		environment: getEnvironment(env.ENVIRONMENT),
+	}),
 	authorizeEndpoint: '/oauth/authorize',
 	tokenEndpoint: '/token',
 	tokenExchangeCallback: (options) =>
-		handleTokenExchangeCallback(options, env.CLOUDFLARE_CLIENT_ID, env.CLOUDFLARE_CLIENT_SECRET),
+		handleTokenExchangeCallback(
+			options,
+			env.CLOUDFLARE_CLIENT_ID,
+			env.CLOUDFLARE_CLIENT_SECRET
+		),
 	// Cloudflare access token TTL
 	accessTokenTTL: 3600,
 	clientRegistrationEndpoint: '/register',
diff --git a/apps/workers-bindings/vitest.config.ts b/apps/workers-bindings/vitest.config.ts
@@ -1,5 +1,7 @@
 import { defineWorkersConfig } from '@cloudflare/vitest-pool-workers/config'
 
+import type { Env } from './worker-configuration'
+
 export interface TestEnv extends Env {
 	CLOUDFLARE_MOCK_ACCOUNT_ID: string
 	CLOUDFLARE_MOCK_API_TOKEN: string
diff --git a/apps/workers-bindings/worker-configuration.d.ts b/apps/workers-bindings/worker-configuration.d.ts
@@ -1,11 +1,14 @@
 // Generated by Wrangler by running `wrangler types` (hash: 83b65e4226fcf5092146edc626681982)
+
 // Runtime types generated with workerd@1.20250409.0 2025-03-10 nodejs_compat
 declare namespace Cloudflare {
 	interface Env {
 		OAUTH_KV: KVNamespace;
 		CLOUDFLARE_CLIENT_ID: string;
 		CLOUDFLARE_CLIENT_SECRET: string;
+		// eslint-disable-next-line @typescript-eslint/consistent-type-imports
 		MCP_OBJECT: DurableObjectNamespace<import("./src/index").WorkersBindingsMCP>;
+        ENVIRONMENT: string
 	}
 }
 interface Env extends Cloudflare.Env {}
diff --git a/apps/workers-bindings/wrangler.jsonc b/apps/workers-bindings/wrangler.jsonc
@@ -4,7 +4,7 @@
  */
 {
 	"$schema": "node_modules/wrangler/config-schema.json",
-	"name": "workers-bindings",
+	"name": "workers-bindings-dev",
 	"main": "src/index.ts",
 	"compatibility_date": "2025-03-10",
 	"compatibility_flags": ["nodejs_compat"],
@@ -33,6 +33,9 @@
 	},
 	"dev": {
 		"port": 8976
+	},
+	"vars": {
+		"ENVIRONMENT": "development"
 	}
 	/**
 	 * Smart Placement
diff --git a/apps/workers-observability/src/index.ts b/apps/workers-observability/src/index.ts
@@ -76,7 +76,7 @@ export default new OAuthProvider({
 		serverPath: 'workers/observability',
 		environment: getEnvironment(env.ENVIRONMENT),
 	}),
-	authorizeEndpoint: '/oauth/workers/observability/authorize',
+	authorizeEndpoint: '/workers/observability/oauth/authorize',
 	tokenEndpoint: '/workers/observability/token',
 	tokenExchangeCallback: (options) =>
 		handleTokenExchangeCallback(options, env.CLOUDFLARE_CLIENT_ID, env.CLOUDFLARE_CLIENT_SECRET),
diff --git a/packages/mcp-common/src/cloudflare-oauth-handler.ts b/packages/mcp-common/src/cloudflare-oauth-handler.ts
@@ -8,7 +8,6 @@ import {
 	getAuthToken,
 	refreshAuthToken,
 } from './cloudflare-auth'
-import { MCPEnvironment } from './config'
 import { McpError } from './mcp-error'
 
 import type {
@@ -17,6 +16,7 @@ import type {
 	TokenExchangeCallbackResult,
 } from '@cloudflare/workers-oauth-provider'
 import type { Context } from 'hono'
+import type { MCPEnvironment } from './config'
 
 type AuthContext = {
 	Bindings: {
@@ -258,7 +258,7 @@ export function createAuthHandlers({
 	 * Then it redirects the user to Cloudflare's authorization page with the appropriate
 	 * parameters so the user can authenticate and grant permissions.
 	 */
-	app.get(`/oauth/${serverPath}/authorize`, async (c) => {
+	app.get(`/${serverPath}/oauth/authorize`, async (c) => {
 		return await handleAuthorize(c, { serverPath })
 	})
 
@@ -270,7 +270,7 @@ export function createAuthHandlers({
 	 * user metadata & the auth token as part of the 'props' on the token passed
 	 * down to the client. It ends by redirecting the client back to _its_ callback URL
 	 */
-	app.get(`/oauth/${serverPath}/callback`, zValidator('query', AuthQuery), async (c) => {
+	app.get(`/${serverPath}/oauth/callback`, zValidator('query', AuthQuery), async (c) => {
 		const { state, code } = c.req.valid('query')
 		return await handleCallback(c, { state, code })
 	})
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml

Original file line number	Diff line number	Diff line change
`@@ -20,12 +20,12 @@`
`20`	`20`	`"staging": {`
`21`	`21`	`"name": "mcp-cloudflare-auth-server-staging",`
`22`	`22`	`"account_id": "8995c0f49cdcf57eb54d2c1e52b7d2f3",`
`23`		`- "routes": ["staging.mcp.cloudflare.com/oauth/callback"],`
	`23`	`+ "routes": ["staging.mcp.cloudflare.com/oauth/callback"]`
`24`	`24`	`},`
`25`	`25`	`"production": {`
`26`	`26`	`"name": "mcp-cloudflare-auth-server-production",`
`27`	`27`	`"account_id": "8995c0f49cdcf57eb54d2c1e52b7d2f3",`
`28`		`- "routes": ["mcp.cloudflare.com/oauth/callback"],`
	`28`	`+ "routes": ["mcp.cloudflare.com/oauth/callback"]`
`29`	`29`	`}`
`30`	`30`	`}`
`31`	`31`	`}`
Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"$schema": "node_modules/wrangler/config-schema.json",`
`3`		`- "name": "sandbox-container",`
	`3`	`+ "name": "sandbox-container-dev",`
`4`	`4`	`"main": "server/index.ts",`
`5`	`5`	`"compatibility_date": "2025-04-03",`
`6`	`6`	`"containers": [`
`@@ -41,5 +41,8 @@`
`41`	`41`	`],`
`42`	`42`	`"dev": {`
`43`	`43`	`"port": 8976`
	`44`	`+ },`
	`45`	`+ "vars": {`
	`46`	`+ "ENVIRONMENT": "development"`
`44`	`47`	`}`
`45`	`48`	`}`