#!/usr/bin/env python3
"""
OAuth Configuration Diagnostic Tool
This script checks the OAuth configuration and identifies any issues.
"""
import json
import os
import sys
from pathlib import Path
# Add project root to path
project_root = Path(__file__).parent.parent
sys.path.insert(0, str(project_root))
def main():
print("🔍 OAuth Configuration Diagnostic")
print("=" * 50)
try:
# Check if we can import the settings
print("📋 Loading configuration...")
from config.settings import settings
print("✅ Settings loaded successfully")
# Check OAuth configuration
print("\n🔐 Checking OAuth Configuration:")
print(f" Google Client Secrets File: {settings.google_client_secrets_file}")
print(
f" Google Client ID: {'SET' if settings.google_client_id else 'NOT SET'}"
)
print(
f" Google Client Secret: {'SET' if settings.google_client_secret else 'NOT SET'}"
)
print(f" OAuth Redirect URI: {settings.oauth_redirect_uri}")
print(f" Dynamic OAuth Redirect URI: {settings.dynamic_oauth_redirect_uri}")
print(f" Base URL: {settings.base_url}")
print(f" Protocol: {settings.protocol}")
# Check if OAuth is configured
is_configured = settings.is_oauth_configured()
print(f"\n🎯 OAuth Configured: {'✅ YES' if is_configured else '❌ NO'}")
if is_configured:
try:
# Try to get OAuth client config
oauth_config = settings.get_oauth_client_config()
print("✅ OAuth client configuration retrieved")
print(f" Client ID: {oauth_config['client_id'][:20]}...")
print(
f" Client Secret: {'SET' if oauth_config['client_secret'] else 'NOT SET'}"
)
print(f" Auth URI: {oauth_config.get('auth_uri', 'NOT SET')}")
print(f" Token URI: {oauth_config.get('token_uri', 'NOT SET')}")
print(
f" Redirect URIs: {len(oauth_config.get('redirect_uris', []))} configured"
)
except Exception as e:
print(f"❌ Error getting OAuth config: {e}")
else:
print("⚠️ OAuth is not configured. You need to either:")
print(" 1. Set GOOGLE_CLIENT_SECRETS_FILE environment variable, OR")
print(
" 2. Set GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET environment variables"
)
# Check environment variables
print("\n🌍 Environment Variables:")
env_vars = [
"GOOGLE_CLIENT_SECRETS_FILE",
"GOOGLE_CLIENT_ID",
"GOOGLE_CLIENT_SECRET",
"OAUTH_REDIRECT_URI",
"BASE_URL",
"SERVER_PORT",
"ENABLE_HTTPS",
"USE_GOOGLE_OAUTH",
"ENABLE_JWT_AUTH",
]
for var in env_vars:
value = os.getenv(var)
if value:
# Mask sensitive values
if "SECRET" in var or "CLIENT_ID" in var:
display_value = (
f"{'SET' if value else 'NOT SET'} ({'*' * min(len(value), 20)})"
)
else:
display_value = value
print(f" {var}: {display_value}")
else:
print(f" {var}: NOT SET")
# Check credentials directory
print(f"\n📂 Credentials Directory: {settings.credentials_dir}")
creds_path = Path(settings.credentials_dir)
if creds_path.exists():
print("✅ Credentials directory exists")
# List credential files (without exposing content)
cred_files = list(creds_path.glob("*"))
print(f" Files found: {len(cred_files)}")
for file in cred_files:
print(f" - {file.name}")
else:
print("❌ Credentials directory does not exist")
print(f" Will be created at: {creds_path.absolute()}")
# Check Google OAuth client secrets file if specified
if settings.google_client_secrets_file:
secrets_path = Path(settings.google_client_secrets_file)
print(f"\n📄 Google OAuth Secrets File: {secrets_path}")
if secrets_path.exists():
print("✅ OAuth secrets file exists")
try:
with open(secrets_path, "r") as f:
secrets_data = json.load(f)
if "web" in secrets_data:
web_config = secrets_data["web"]
print("✅ 'web' configuration found")
print(
f" Client ID: {web_config.get('client_id', 'NOT SET')[:20]}..."
)
print(
f" Client Secret: {'SET' if web_config.get('client_secret') else 'NOT SET'}"
)
print(
f" Redirect URIs: {len(web_config.get('redirect_uris', []))} configured"
)
elif "installed" in secrets_data:
installed_config = secrets_data["installed"]
print("✅ 'installed' configuration found")
print(
f" Client ID: {installed_config.get('client_id', 'NOT SET')[:20]}..."
)
print(
f" Client Secret: {'SET' if installed_config.get('client_secret') else 'NOT SET'}"
)
print(
f" Redirect URIs: {len(installed_config.get('redirect_uris', []))} configured"
)
else:
print(
"❌ OAuth secrets file missing 'web' or 'installed' configuration"
)
except json.JSONDecodeError as e:
print(f"❌ OAuth secrets file contains invalid JSON: {e}")
except Exception as e:
print(f"❌ Error reading OAuth secrets file: {e}")
else:
print(
f"❌ OAuth secrets file does not exist at: {secrets_path.absolute()}"
)
# Test OAuth proxy
print("\n🔄 Testing OAuth Proxy:")
try:
from auth.oauth_proxy import oauth_proxy
stats = oauth_proxy.get_stats()
print("✅ OAuth Proxy is working")
print(f" Active proxy clients: {stats['active_proxy_clients']}")
print(f" Oldest client age: {stats.get('oldest_client_age', 'N/A')}")
print(f" Newest client age: {stats.get('newest_client_age', 'N/A')}")
except Exception as e:
print(f"❌ OAuth Proxy error: {e}")
# Test dynamic client registration
print("\n📝 Testing Dynamic Client Registration:")
try:
from auth.dynamic_client_registration import client_registry
print("✅ Dynamic Client Registration is available")
# Test a simple registration (won't work without OAuth config but will show errors)
if is_configured:
test_metadata = {
"client_name": "Test MCP Client",
"redirect_uris": ["http://localhost:3000/auth/callback"],
}
print("🧪 Testing client registration...")
try:
result = client_registry.register_client(test_metadata)
temp_client_id = result.get("client_id")
print(f"✅ Test registration successful: {temp_client_id}")
# Clean up the test client
try:
access_token = result.get("registration_access_token")
if access_token:
client_registry.delete_client(temp_client_id, access_token)
print("✅ Test client cleaned up")
except Exception as cleanup_e:
print(f"⚠️ Cleanup warning: {cleanup_e}")
except Exception as reg_e:
print(f"❌ Test registration failed: {reg_e}")
else:
print("⚠️ Skipping registration test - OAuth not configured")
except Exception as e:
print(f"❌ Dynamic Client Registration error: {e}")
# Summary and recommendations
print("\n" + "=" * 50)
print("📋 SUMMARY AND RECOMMENDATIONS:")
if not is_configured:
print("❌ CRITICAL: OAuth is not configured!")
print(" You need to:")
print(" 1. Create a Google OAuth 2.0 client in Google Cloud Console")
print(" 2. Download the client secrets JSON file")
print(" 3. Set GOOGLE_CLIENT_SECRETS_FILE environment variable")
print(" OR")
print(
" 3. Set GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET environment variables"
)
else:
print("✅ OAuth is configured and should work!")
print(" Your server should be able to handle OAuth flows.")
# Additional checks
if (
not settings.enable_https
and "https" in settings.dynamic_oauth_redirect_uri
):
print("⚠️ WARNING: HTTPS is disabled but redirect URI uses HTTPS")
print(
" Consider setting ENABLE_HTTPS=true or updating OAUTH_REDIRECT_URI"
)
if (
settings.server_host == "localhost"
and settings.dynamic_oauth_redirect_uri
):
print("✅ Local development setup detected")
print(f" Redirect URI: {settings.dynamic_oauth_redirect_uri}")
print("\n🚀 To test the server:")
print(" 1. Run: uv run fastmcp dev")
print(
" 2. Check: http://localhost:8002/.well-known/oauth-protected-resource/mcp"
)
print(" 3. Test registration: POST http://localhost:8002/oauth/register")
except Exception as e:
print(f"❌ CRITICAL ERROR: {e}")
import traceback
traceback.print_exc()
return 1
return 0
if __name__ == "__main__":
sys.exit(main())
