oauth2_auth

Implementation Reference

• src/tools/authentication.ts:97-143 (handler)

  The handler function for the 'oauth2_auth' tool. Validates input parameters based on grant type, constructs OAuth2Config, calls AuthManager.authenticateWithOAuth2, and returns success or error message.

  async ({ client_id, client_secret, token_url, authorization_url, grant_type, username, password, scope, redirect_uri }) => {
    try {
      const authManager = AuthManager.getInstance();
      
      // Validate required parameters for specific grant types
      if (grant_type === 'password' && (!username || !password)) {
        throw new Error("Username and password are required for password grant type");
      }
      
      if (grant_type === 'authorization_code' && !redirect_uri) {
        throw new Error("Redirect URI is required for authorization code grant type");
      }
      
      // Configure OAuth2
      const config: OAuth2Config = {
        clientId: client_id,
        clientSecret: client_secret,
        tokenUrl: token_url,
        authorizationUrl: authorization_url || "",
        grantType: grant_type as any,
        username,
        password,
        scope,
        redirectUri: redirect_uri
      };
      
      const authState = await authManager.authenticateWithOAuth2(config);
      
      return {
        content: [
          {
            type: "text",
            text: `Successfully authenticated with OAuth2\nGrant type: ${grant_type}\nToken type: ${authState.token ? 'Bearer' : 'Unknown'}\n${authState.tokenExpiry ? `Token expires: ${authState.tokenExpiry.toISOString()}` : ''}`,
          },
        ],
      };
    } catch (error) {
      return {
        content: [
          {
            type: "text",
            text: `Error authenticating with OAuth2: ${(error as Error).message}`,
          },
        ],
      };
    }
  }

• src/tools/authentication.ts:86-96 (schema)

  Zod input schema for the 'oauth2_auth' tool defining all required and optional parameters for different OAuth2 grant types.

  {
    client_id: z.string().describe("OAuth2 client ID"),
    client_secret: z.string().optional().describe("OAuth2 client secret"),
    token_url: z.string().url().describe("OAuth2 token endpoint URL"),
    authorization_url: z.string().url().optional().describe("OAuth2 authorization endpoint URL (for authorization code flow)"),
    grant_type: z.enum(['client_credentials', 'password', 'authorization_code', 'refresh_token']).default('client_credentials').describe("OAuth2 grant type"),
    username: z.string().optional().describe("Username (for password grant type)"),
    password: z.string().optional().describe("Password (for password grant type)"),
    scope: z.string().optional().describe("OAuth2 scope"),
    redirect_uri: z.string().optional().describe("Redirect URI (for authorization code flow)"),
  },

• src/tools/authentication.ts:84-144 (registration)

  Registration of the 'oauth2_auth' tool using server.tool(), including schema and handler within the registerAuthenticationTools function.

  server.tool(
    "oauth2_auth",
    {
      client_id: z.string().describe("OAuth2 client ID"),
      client_secret: z.string().optional().describe("OAuth2 client secret"),
      token_url: z.string().url().describe("OAuth2 token endpoint URL"),
      authorization_url: z.string().url().optional().describe("OAuth2 authorization endpoint URL (for authorization code flow)"),
      grant_type: z.enum(['client_credentials', 'password', 'authorization_code', 'refresh_token']).default('client_credentials').describe("OAuth2 grant type"),
      username: z.string().optional().describe("Username (for password grant type)"),
      password: z.string().optional().describe("Password (for password grant type)"),
      scope: z.string().optional().describe("OAuth2 scope"),
      redirect_uri: z.string().optional().describe("Redirect URI (for authorization code flow)"),
    },
    async ({ client_id, client_secret, token_url, authorization_url, grant_type, username, password, scope, redirect_uri }) => {
      try {
        const authManager = AuthManager.getInstance();
        
        // Validate required parameters for specific grant types
        if (grant_type === 'password' && (!username || !password)) {
          throw new Error("Username and password are required for password grant type");
        }
        
        if (grant_type === 'authorization_code' && !redirect_uri) {
          throw new Error("Redirect URI is required for authorization code grant type");
        }
        
        // Configure OAuth2
        const config: OAuth2Config = {
          clientId: client_id,
          clientSecret: client_secret,
          tokenUrl: token_url,
          authorizationUrl: authorization_url || "",
          grantType: grant_type as any,
          username,
          password,
          scope,
          redirectUri: redirect_uri
        };
        
        const authState = await authManager.authenticateWithOAuth2(config);
        
        return {
          content: [
            {
              type: "text",
              text: `Successfully authenticated with OAuth2\nGrant type: ${grant_type}\nToken type: ${authState.token ? 'Bearer' : 'Unknown'}\n${authState.tokenExpiry ? `Token expires: ${authState.tokenExpiry.toISOString()}` : ''}`,
            },
          ],
        };
      } catch (error) {
        return {
          content: [
            {
              type: "text",
              text: `Error authenticating with OAuth2: ${(error as Error).message}`,
            },
          ],
        };
      }
    }
  );

• src/utils/authManager.ts:135-209 (helper)

  Supporting utility in AuthManager class that performs the actual OAuth2 token request via axios.post to the tokenUrl, handles different grant types, parses response, calculates expiry, and updates the authentication state.

  public async authenticateWithOAuth2(config: OAuth2Config): Promise<AuthState> {
    const { 
      clientId, 
      clientSecret, 
      tokenUrl, 
      grantType = 'client_credentials',
      username,
      password,
      scope,
      redirectUri
    } = config;
    
    try {
      let data: Record<string, string> = {
        client_id: clientId,
        grant_type: grantType
      };
      
      // Add optional parameters based on grant type
      if (clientSecret) {
        data.client_secret = clientSecret;
      }
      
      if (scope) {
        data.scope = scope;
      }
      
      if (redirectUri) {
        data.redirect_uri = redirectUri;
      }
      
      // Add credentials for password grant
      if (grantType === 'password' && username && password) {
        data.username = username;
        data.password = password;
      }
      
      // Execute the token request
      const response = await axios.post(tokenUrl, new URLSearchParams(data), {
        headers: {
          'Content-Type': 'application/x-www-form-urlencoded'
        }
      });
      
      const { 
        access_token, 
        refresh_token, 
        expires_in, 
        token_type = 'Bearer'
      } = response.data;
      
      // Calculate token expiry
      let tokenExpiry: Date | undefined;
      if (expires_in) {
        tokenExpiry = new Date();
        tokenExpiry.setSeconds(tokenExpiry.getSeconds() + expires_in);
      }
      
      // Update auth state
      this.authState = {
        type: 'oauth2',
        token: access_token,
        refreshToken: refresh_token,
        tokenExpiry,
        oauthTokens: response.data,
        headers: {
          'Authorization': `${token_type} ${access_token}`
        }
      };
      
      return this.getAuthState();
    } catch (error) {
      throw new Error(`OAuth2 authentication failed: ${(error as Error).message}`);
    }
  }