dguiducci/Skald-Circle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(mcp): OAuth per-user connectors (§15) — providers, PKCE copy-paste flow, env credential delivery

Browse Source 
- oauth_providers registry table (per-provider client creds) + db/oauth_providers.rs
- mcp/oauth.rs: authorization-code + PKCE S256, RAM-only TTL'd flow store, copy-paste consent
- mcp/install.rs + verify.rs: connector file install + manifest verification
- activate persists a pending row (needs_oauth); /mcp/oauth/start + /complete exchange code for refresh token
- credential delivery via env var on docker exec (google_authorized_user JSON), never on disk
- mcp_catalog/mcp_user_servers: additive OAuth columns (ensure_column), catalog_name/oauth_provider/deliver_json bare TEXT snapshots
- frontend: connector-detail.js (OAuth login panel), shared/connector-common.js, connectors.js admin Sign-in providers modal
- API: /mcp/providers (admin OAuth creds), /mcp/oauth/start|complete
- .gitignore: add /homes/ (instance data), /connectors/, /reset.sh; drop stale /secrets/
This commit is contained in:
dguiducci
2026-07-17 21:47:51 +01:00
parent bcd8f7b5c0
commit e6c4e202a4
28 changed files with 3349 additions and 553 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/frontend/api/marketplace.rs
+274 -33
View File
@@ -129,6 +129,14 @@ struct AuthSpec {
#[serde(default, rename = "type")] kind: Option<String>,
#[serde(default)] delivery: Option<String>,
#[serde(default)] scopes: Vec<String>,
/// oauth: the identity provider slug (`google`) — resolved to client creds +
/// endpoints from the `oauth_providers` registry table (§15). Never carries
/// URLs or secrets: those stay out of the public feed by design.
#[serde(default)] provider: Option<String>,
/// oauth: how the obtained credential is delivered to the server process
/// (`{as,format,env,path}`). Parsed with skald-core's own type so the stored
/// snapshot and the runtime injector agree on the shape.
#[serde(default)] deliver: Option<skald_core::mcp::DeliverSpec>,
}
#[derive(Debug, Clone, Default, Deserialize)]
@@ -150,6 +158,27 @@ struct McpConfigManifest {
#[serde(default)] transport: Option<String>,
}
/// One env/secret field the activation UI must collect (the feed's `env[]` entry).
/// Richer than the old `Vec<String>` of bare key names — drives a real form.
#[derive(Debug, Clone, Default, Serialize, Deserialize)]
struct EnvEntry {
name: String,
label: String,
description: String,
#[serde(default)] required: bool,
#[serde(default)] secret: bool,
#[serde(default)] default: Option<String>,
#[serde(default)] example: Option<String>,
}
/// The verify-before-save step. `command` is a shell snippet run with the
/// collected env/secret injected; `timeout_secs` defaults to 15.
#[derive(Debug, Clone, Default, Deserialize)]
struct VerifySpec {
command: String,
#[serde(default)] timeout_secs: Option<u64>,
}
#[derive(Debug, Clone, Default, Deserialize)]
struct Manifest {
#[serde(default)] name: Option<String>,
@@ -167,12 +196,19 @@ struct Manifest {
#[serde(default)] files: Vec<FileEntry>,
#[serde(default)] scope: Option<String>,
#[serde(default)] auth: Option<AuthSpec>,
/// The full env/secret schema for the activation form (objects, not key names).
#[serde(default)] env: Vec<EnvEntry>,
/// Optional verify-before-save command.
#[serde(default)] verify: Option<VerifySpec>,
}
#[derive(Debug, Clone)]
struct Hydrated {
entry: IndexEntry,
manifest: Manifest,
/// The manifest exactly as served, so [`install`] can record it verbatim
/// without a second fetch. `None` when the manifest could not be read.
manifest_raw: Option<String>,
}
// ── feed vocabulary → Skald vocabulary ────────────────────────────────────────
@@ -373,12 +409,17 @@ async fn fetch_feed() -> Result<Vec<Hydrated>, ApiError> {
set.spawn(async move {
let url = format!("{}/{}/connector.json", base, folder_of(&entry));
// A manifest that fails to load degrades that one card to whatever the
// index said; it never fails the whole listing.
let manifest = match HTTP.get(&url).send().await {
Ok(r) => r.json::<Manifest>().await.unwrap_or_default(),
Err(_) => Manifest::default(),
// index said; it never fails the whole listing. The raw text is kept
// alongside the parsed form so `install` can record what was served
// even if some field of it did not parse.
let (manifest, manifest_raw) = match HTTP.get(&url).send().await {
Ok(r) => match r.text().await {
Ok(t) => (serde_json::from_str::<Manifest>(&t).unwrap_or_default(), Some(t)),
Err(_) => (Manifest::default(), None),
},
Err(_) => (Manifest::default(), None),
};
Hydrated { entry, manifest }
Hydrated { entry, manifest, manifest_raw }
});
}
@@ -548,10 +589,10 @@ pub struct InstallBody {
}
/// Imports a feed entry into `mcp_catalog` — the act that moves a connector from
/// "someone else vetted this" to "this household's admin accepted it". For an
/// `mcp_local` entry it first downloads and hash-verifies the scripts into
/// `./scripts/<id>/`, which is code landing on the box and therefore needs
/// `mcp.register_local_script` (§14) on top of `mcp.manage_catalog`.
/// "someone else vetted this" to "this household's admin accepted it". It downloads
/// and hash-verifies the connector's folder into `./connectors/<id>/`; for an
/// `mcp_local` entry that folder holds code which will run on this box, and
/// therefore needs `mcp.register_local_script` (§14) on top of `mcp.manage_catalog`.
///
/// Installing does **not** activate: a global entry still needs the admin to
/// enable it with a key, a per-user one still needs each user to activate it.
@@ -579,9 +620,25 @@ pub async fn install(
}
// Download + verify before touching the catalog, so a failed digest leaves no
// trace of a half-installed connector.
let (script_path, verified) = if source == "local_script" {
let files = download_verified(&h.entry, &h.manifest).await?;
// trace of a half-installed connector. A `local_script` always downloads its
// files; a `remote` connector downloads them only if it declares a `verify`
// step that references a script (otherwise there is nothing to fetch).
let verify_command = h.manifest.verify.as_ref().map(|v| v.command.clone());
let verify_timeout = h.manifest.verify.as_ref().and_then(|v| v.timeout_secs);
let all_files = files_of(&h.entry, &h.manifest);
let verify_script_rel = verify_command
.as_deref()
.and_then(|c| verify_script_of(c, &all_files));
let verify_script_path = verify_script_rel
.as_ref()
.map(|f| format!("{}/{}", body.id, f));
// Every source downloads its folder now — a remote connector has an icon and a
// manifest to record even when it has no code to run here.
let installed =
download_verified(&h.entry, &h.manifest, h.manifest_raw.as_deref(), &source).await?;
let script_path = if source == "local_script" {
let entry_file = cfg
.args
.first()
@@ -590,9 +647,9 @@ pub async fn install(
"manifest has no mcp_config.args[0] naming the script to run",
))?;
let entry_file = safe_rel_path(&entry_file)?.to_string();
(Some(format!("{}/{}", body.id, entry_file)), files)
Some(format!("{}/{}", body.id, entry_file))
} else {
(None, 0)
None
};
let args_json = if source == "local_script" {
@@ -605,9 +662,23 @@ pub async fn install(
serde_json::to_string(&cfg.args).ok()
};
// `requires` is the feed's coarse precondition list; the activation UI needs
// the concrete env keys, which only the manifest's mcp_config knows.
let config_schema: Vec<String> = cfg.env.keys().cloned().collect();
// The full env/secret schema for the activation form. The manifest's top-level
// `env[]` (array of objects with label/description/required/secret/…) is the
// source of truth; if a feed only ships the old `mcp_config.env` placeholder
// map, fall back to bare key names so the form still renders.
let config_schema_json = if !h.manifest.env.is_empty() {
serde_json::to_string(&h.manifest.env).ok()
} else if !cfg.env.is_empty() {
let names: Vec<String> = cfg.env.keys().cloned().collect();
serde_json::to_string(&names).ok()
} else {
None
};
let _ = verify_timeout; // surfaced to the runtime via the verify module's default
let folder = folder_of(&h.entry);
let icon_small_path = installed_icon(h.entry.icon_small.as_deref(), &folder, &installed);
let icon_large_path = installed_icon(h.entry.icon_large.as_deref(), &folder, &installed);
let id = mcp_catalog::upsert(
skald.db(),
@@ -621,9 +692,23 @@ pub async fn install(
env_json: if cfg.env.is_empty() { None } else { serde_json::to_string(&cfg.env).ok() },
url: cfg.url.as_deref(),
script_path: script_path.as_deref(),
config_schema_json: if config_schema.is_empty() { None } else { serde_json::to_string(&config_schema).ok() },
config_schema_json,
auth_kind: &norm_auth_kind(&h.entry, &h.manifest),
// OAuth wiring (§15): provider slug, the scopes shown at consent, and the
// credential delivery spec — all snapshotted so an activation is
// reproducible even if the feed later changes.
oauth_provider: h.manifest.auth.as_ref().and_then(|a| a.provider.as_deref()),
oauth_scopes_json: h.manifest.auth.as_ref()
.filter(|a| !a.scopes.is_empty())
.and_then(|a| serde_json::to_string(&a.scopes).ok()),
deliver_json: h.manifest.auth.as_ref()
.and_then(|a| a.deliver.as_ref())
.and_then(|d| serde_json::to_string(d).ok()),
role_filter: None,
verify_command: verify_command.as_deref(),
verify_script_path: verify_script_path.as_deref(),
icon_small_path: icon_small_path.as_deref(),
icon_large_path: icon_large_path.as_deref(),
friendly_name: h.entry.name.as_deref().or(h.manifest.name.as_deref()),
// The LLM-facing blurb — this is the column `render_mcp_list` puts in
// the prompt for `activate_tools()`, so the feed's
@@ -641,17 +726,50 @@ pub async fn install(
"name": h.entry.id,
"scope": scope,
"source": source,
"files_verified": verified,
"files_verified": installed.verified,
})))
}
/// Downloads every file the manifest declares into `./scripts/<id>/`, refusing any
/// If a verify `command` references one of the connector's shipped files (by
/// basename match against `files[]`), return that file's relative path — the
/// caller stores `<id>/<file>` so the runtime resolves `./connectors/<id>/<file>`.
/// Returns `None` for inline commands (`curl …`) with no script file.
fn verify_script_of(command: &str, files: &[FileEntry]) -> Option<String> {
for f in files {
let basename = f.path.rsplit_once('/').map(|(_, b)| b).unwrap_or(&f.path);
if !basename.is_empty() && command.contains(basename) {
return Some(f.path.clone());
}
}
None
}
/// What [`download_verified`] put on disk.
struct Installed {
/// How many files were downloaded and matched their declared digest.
verified: usize,
/// The relative paths actually written, so the caller can record a manifest
/// claim (an icon, say) only once the file backing it exists.
files: std::collections::HashSet<String>,
}
/// Downloads a connector's whole folder into `./connectors/<id>/`, refusing any file
/// whose SHA-256 does not match. All-or-nothing: files are verified in memory and
/// only written once every digest checks out, so a tampered feed never leaves a
/// partial connector on disk. Returns how many files were verified.
async fn download_verified(entry: &IndexEntry, manifest: &Manifest) -> Result<usize, ApiError> {
/// partial connector on disk.
///
/// Runs for **every** source, not just `local_script`. Fetching an icon is not the
/// §14 risk axis — that axis is about code the box will *execute*, and it stays
/// gated on `mcp.register_local_script` in [`install`]. What lands here for a remote
/// connector is inert: an icon and the manifest.
async fn download_verified(
entry: &IndexEntry,
manifest: &Manifest,
raw: Option<&str>,
source: &str,
) -> Result<Installed, ApiError> {
let files = files_of(entry, manifest);
if files.is_empty() {
if files.is_empty() && source == "local_script" {
return Err(ApiError::bad_request(
"the feed declares no `files` with digests for this connector — \
refusing to install unverifiable code (§14)",
@@ -660,15 +778,16 @@ async fn download_verified(entry: &IndexEntry, manifest: &Manifest) -> Result<us
let base = base_url();
let folder = folder_of(entry);
let index_digests = !entry.files.is_empty();
let mut staged: Vec<(String, Vec<u8>)> = Vec::new();
for f in files {
let rel = safe_rel_path(&f.path)?;
// Defensive: a document can never carry its own digest (writing the hash
// changes the file), so a self-entry is unverifiable by construction. The
// feed now keeps digests in the index, where this cannot arise.
if rel == "connector.json" {
// A document can never carry its own digest (writing the hash into the file
// changes the file), so a *manifest*-declared self-entry is unverifiable by
// construction. From the index it is verifiable, and gets no exception.
if rel == skald_core::mcp::MANIFEST_FILE && !index_digests {
continue;
}
@@ -703,19 +822,19 @@ async fn download_verified(entry: &IndexEntry, manifest: &Manifest) -> Result<us
staged.push((rel.to_string(), bytes.to_vec()));
}
if staged.is_empty() {
if staged.is_empty() && source == "local_script" {
return Err(ApiError::bad_request(
"manifest declares no installable file besides connector.json",
));
}
let wd = std::env::current_dir()
.map_err(|e| ApiError::bad_request(format!("cannot resolve working directory: {e}")))?;
let dest = wd.join("scripts").join(&entry.id);
let dest = skald_core::mcp::connector_dir(&entry.id)
.map_err(|e| ApiError::bad_request(format!("cannot resolve the connectors dir: {e}")))?;
std::fs::create_dir_all(&dest)
.map_err(|e| ApiError::bad_request(format!("cannot create {}: {e}", dest.display())))?;
let count = staged.len();
let verified = staged.len();
let mut written: std::collections::HashSet<String> = std::collections::HashSet::new();
for (rel, bytes) in staged {
let path = dest.join(&rel);
if let Some(parent) = path.parent() {
@@ -724,8 +843,36 @@ async fn download_verified(entry: &IndexEntry, manifest: &Manifest) -> Result<us
}
std::fs::write(&path, &bytes)
.map_err(|e| ApiError::bad_request(format!("cannot write `{rel}`: {e}")))?;
written.insert(rel);
}
Ok(count)
// The manifest, recorded verbatim. The feed does not digest it (it lists only
// the folder's other files), and it does not need to be: nothing ever reads this
// file back — `mcp_catalog` drives every connect. Its one job is to say what was
// served on the day the admin accepted it, and for that job a tampered copy is
// still the truth of what we accepted. See the module header on what digests do
// and do not buy.
if !written.contains(skald_core::mcp::MANIFEST_FILE) {
if let Some(raw) = raw {
std::fs::write(dest.join(skald_core::mcp::MANIFEST_FILE), raw).map_err(|e| {
ApiError::bad_request(format!("cannot record connector.json: {e}"))
})?;
}
}
Ok(Installed { verified, files: written })
}
/// The icon path to record in the catalog: the manifest's feed-root-relative claim
/// (`gmail/icon_sm.svg`) reduced to a path inside the connector's own folder
/// (`icon_sm.svg`), and only if that file actually got installed.
///
/// The two vocabularies differ — the index names icons from the feed root but names
/// `files[]` from the folder — so this is where they are reconciled.
fn installed_icon(claim: Option<&str>, folder: &str, installed: &Installed) -> Option<String> {
let claim = claim?.trim_start_matches('/');
let rel = claim.strip_prefix(&format!("{folder}/")).unwrap_or(claim);
installed.files.contains(rel).then(|| rel.to_string())
}
#[cfg(test)]
@@ -837,6 +984,35 @@ mod tests {
assert_eq!(files_of(&entry(r#"{"id":"x"}"#), &m)[0].path, "b.py");
}
/// The index names icons from the feed root (`gmail/icon_sm.svg`) but names
/// `files[]` from the connector's folder (`icon_sm.svg`). Recording the wrong one
/// would 404 every icon, so this is where the two vocabularies must meet.
#[test]
fn icon_paths_are_reduced_to_the_connector_folder() {
let installed = Installed {
verified: 2,
files: ["icon_sm.svg", "server.py"].iter().map(|s| s.to_string()).collect(),
};
assert_eq!(
installed_icon(Some("gmail/icon_sm.svg"), "gmail", &installed),
Some("icon_sm.svg".to_string())
);
// A leading slash is still feed-root-relative.
assert_eq!(
installed_icon(Some("/gmail/icon_sm.svg"), "gmail", &installed),
Some("icon_sm.svg".to_string())
);
// Already folder-relative: left alone.
assert_eq!(
installed_icon(Some("icon_sm.svg"), "gmail", &installed),
Some("icon_sm.svg".to_string())
);
// Claimed but never installed → recorded as absent, so the endpoint says
// "no icon" instead of pointing the browser at a file that is not there.
assert_eq!(installed_icon(Some("gmail/icon_lg.svg"), "gmail", &installed), None);
assert_eq!(installed_icon(None, "gmail", &installed), None);
}
#[test]
fn sha256_matches_a_known_vector() {
assert_eq!(
@@ -845,6 +1021,71 @@ mod tests {
);
}
/// Installs every connector the live feed offers into a throwaway directory and
/// checks what actually lands: the digests hold, the manifest is recorded, and the
/// icon path stored in the catalog names a file that exists.
///
/// That last one is the whole point of the icon column — a path that does not
/// resolve would 404 silently in the browser and look like "this connector has no
/// icon", which is exactly the failure a unit test with a hand-written feed cannot
/// see. `#[ignore]`d (network + it moves the process cwd, so it must run alone):
/// `cargo test --bin skald -- --ignored live_feed_installs`.
#[tokio::test]
#[ignore]
async fn live_feed_installs_folder_with_icon_and_manifest() {
let _ = rustls::crypto::ring::default_provider().install_default();
let tmp = std::env::temp_dir().join(format!("skald-install-test-{}", std::process::id()));
std::fs::create_dir_all(&tmp).unwrap();
std::env::set_current_dir(&tmp).unwrap();
let feed = match fetch_feed().await {
Ok(f) => f,
Err(e) => panic!("feed unreachable: {}", e.message),
};
assert!(!feed.is_empty(), "feed returned no connectors");
for h in &feed {
let source = norm_source(&h.entry, &h.manifest);
let installed =
download_verified(&h.entry, &h.manifest, h.manifest_raw.as_deref(), &source)
.await
.unwrap_or_else(|e| panic!("`{}` failed to install: {}", h.entry.id, e.message));
let dir = skald_core::mcp::connector_dir(&h.entry.id).unwrap();
let folder = folder_of(&h.entry);
// Every source installs now — a remote connector included, which is what
// gives Tavily an icon at all.
assert!(dir.is_dir(), "`{}` installed no folder", h.entry.id);
// The manifest is recorded even though the feed does not digest it.
assert!(
dir.join(skald_core::mcp::MANIFEST_FILE).is_file(),
"`{}` recorded no connector.json",
h.entry.id
);
// The icon path the catalog would store must name a real file.
for (size, claim) in [("sm", &h.entry.icon_small), ("lg", &h.entry.icon_large)] {
let Some(rel) = installed_icon(claim.as_deref(), &folder, &installed) else {
panic!("`{}` declares a {size} icon the installer did not keep", h.entry.id);
};
assert!(
dir.join(&rel).is_file(),
"`{}` {size} icon `{rel}` is not on disk",
h.entry.id
);
// An icon must never be shipped into a user's container.
assert!(skald_core::mcp::install::is_host_asset(&rel), "`{rel}` should be a host asset");
}
println!("{:<8} {} files verified, icon + manifest on disk", h.entry.id, installed.verified);
}
std::fs::remove_dir_all(&tmp).ok();
}
/// Hits the real feed. `#[ignore]`d so the suite stays offline-clean; run with
/// `cargo test --bin skald -- --ignored live_feed`.
#[tokio::test]
src/frontend/api/mcp.rs
+647 -62
View File
@@ -17,7 +17,7 @@ use axum::Json;
use serde::Deserialize;
use serde_json::{json, Value};
use skald_core::db::{mcp_catalog, mcp_global_access, mcp_global_servers, mcp_user_servers, role_capabilities};
use skald_core::db::{mcp_catalog, mcp_global_access, mcp_global_servers, mcp_user_servers, oauth_providers, role_capabilities};
use skald_core::skald::Skald;
use super::guard::AuthUser;
@@ -40,31 +40,217 @@ fn to_json_opt<T: serde::Serialize>(v: &Option<T>) -> Option<String> {
v.as_ref().and_then(|x| serde_json::to_string(x).ok())
}
/// Copies a vetted catalog script from `./scripts/<script_path>` into the user's
/// bind-mounted home under `.skald/mcp/<name>/`, and returns the path it will have
/// INSIDE the container (`/root/.skald/mcp/...`). The home is the only durable
/// zone (§6), so the script survives a container recreate. Single files only for
/// now — directory-tree scripts (e.g. whatsapp_mcp/) are a follow-up.
fn copy_script_into_home(user_id: &str, name: &str, script_path: &str) -> Result<String, ApiError> {
let wd = std::env::current_dir()
.map_err(|e| ApiError::bad_request(format!("cannot resolve working directory: {e}")))?;
let src = wd.join("scripts").join(script_path);
if !src.is_file() {
/// Installs the connector folder that `script_path` (`<connector>/<file>`) belongs
/// to into the caller's container home, and returns the path the entry file will
/// have INSIDE the container.
///
/// The whole folder travels, not just the entry file — which is what finally gets a
/// connector's `requirements.txt` and its multi-file trees to where the server
/// actually runs. The home is the only durable zone (§6), so it survives a
/// container recreate.
fn install_connector_for_user(
user_id: &str,
name: &str,
script_path: &str,
) -> Result<String, ApiError> {
let (folder, entry_file) = skald_core::mcp::split_script_path(script_path)
.map_err(|e| ApiError::bad_request(e.to_string()))?;
let dir = skald_core::mcp::install_into_home(user_id, name, folder)
.map_err(|e| ApiError::bad_request(format!("failed to install connector files: {e}")))?
.ok_or_else(|| ApiError::bad_request(format!(
"connector `{folder}` has no installed files under ./{}/ — \
reinstall it from the marketplace",
skald_core::mcp::CONNECTORS_DIR,
)))?;
Ok(dir.join(entry_file).to_string_lossy().into_owned())
}
// ── verify-before-save helpers ───────────────────────────────────────────────
/// One entry of the catalog's `config_schema_json` (the marketplace `env[]`).
/// Drives both the activation form (frontend) and the env/secret split (here).
#[derive(Debug, serde::Deserialize)]
struct EnvSchemaEntry {
name: String,
#[serde(default)] secret: bool,
#[allow(dead_code)]
#[serde(default)] required: bool,
}
/// Parses the catalog's `config_schema_json` into schema entries. Tolerates the
/// legacy `["KEY1","KEY2"]` shape (treated as non-secret) and the new object
/// array; anything unparseable yields an empty schema.
fn parse_env_schema(config_schema_json: &Option<String>) -> Vec<EnvSchemaEntry> {
let raw = match config_schema_json.as_deref() {
Some(s) => s,
None => return Vec::new(),
};
// Object-array form (the new manifest `env[]`).
if let Ok(v) = serde_json::from_str::<Vec<EnvSchemaEntry>>(raw) {
return v;
}
// Legacy bare-name form.
serde_json::from_str::<Vec<String>>(raw)
.unwrap_or_default()
.into_iter()
.map(|name| EnvSchemaEntry { name, secret: false, required: false })
.collect()
}
/// Splits the form values into non-secret (`env`) and secret (`secret`) maps,
/// the two channels [`run_verify`] substitutes into `{ENV:…}` / `{SECRET:…}`.
///
/// When `auth_kind == "api_key"`, the supplied `api_key` is also injected under
/// every secret-name declared by the schema — the canonical case being Tavily,
/// whose schema names the key `tavilyApiKey` and whose URL carries the matching
/// `{SECRET:tavilyApiKey}` token.
fn split_form_values(
form: Option<&HashMap<String, String>>,
api_key: Option<&str>,
schema: &[EnvSchemaEntry],
auth_kind: &str,
) -> (HashMap<String, String>, HashMap<String, String>) {
let secret_names: std::collections::HashSet<&str> =
schema.iter().filter(|e| e.secret).map(|e| e.name.as_str()).collect();
let mut env = HashMap::new();
let mut secret = HashMap::new();
if let Some(form) = form {
for (k, v) in form {
if secret_names.contains(k.as_str()) {
secret.insert(k.clone(), v.clone());
} else {
env.insert(k.clone(), v.clone());
}
}
}
// An api_key connector maps the key into every declared secret name that the
// form did not already fill (the UI's api_key box is the same value).
if auth_kind == "api_key" {
if let Some(key) = api_key {
for name in secret_names {
secret.entry(name.to_string()).or_insert_with(|| key.to_string());
}
}
}
(env, secret)
}
/// Installs the connector folder holding a catalog entry's verify script into the
/// user's home, returning the in-container directory to run it from. `None` if the
/// entry declares no verify script.
///
/// This runs on the Test button too, before any activation exists — which is why it
/// installs rather than assuming the folder is already there.
fn prepare_user_verify_workdir(
user_id: &str,
name: &str,
entry: &mcp_catalog::McpCatalogRow,
) -> Result<Option<std::path::PathBuf>, ApiError> {
let verify_path = match &entry.verify_script_path {
Some(p) => p,
None => return Ok(None),
};
let (folder, _) = skald_core::mcp::split_script_path(verify_path)
.map_err(|e| ApiError::bad_request(e.to_string()))?;
let dir = skald_core::mcp::install_into_home(user_id, name, folder)
.map_err(|e| ApiError::bad_request(format!("failed to install connector files: {e}")))?
.ok_or_else(|| ApiError::bad_request(format!(
"connector `{folder}` has no installed files — reinstall it from the marketplace"
)))?;
Ok(Some(dir))
}
/// The host working dir for a global connector's verify script — the
/// `./connectors/<catalog_name>/` directory the marketplace installer populated.
fn global_verify_workdir(catalog_name: &str) -> Result<std::path::PathBuf, ApiError> {
let dir = skald_core::mcp::connector_dir(catalog_name)
.map_err(|e| ApiError::bad_request(format!("cannot resolve the connectors dir: {e}")))?;
if !dir.is_dir() {
return Err(ApiError::bad_request(format!(
"catalog script `scripts/{script_path}` not found or not a file \
(directory-tree scripts are not supported yet)"
"connector directory `{}/{catalog_name}` not found — reinstall the connector",
skald_core::mcp::CONNECTORS_DIR,
)));
}
let basename = src.file_name()
.ok_or_else(|| ApiError::bad_request("invalid script_path"))?
.to_string_lossy().to_string();
let dest_dir = wd.join(skald_core::container::HOMES_DIR)
.join(user_id).join(".skald").join("mcp").join(name);
std::fs::create_dir_all(&dest_dir)
.map_err(|e| ApiError::bad_request(format!("failed to create script dir: {e}")))?;
std::fs::copy(&src, dest_dir.join(&basename))
.map_err(|e| ApiError::bad_request(format!("failed to copy script: {e}")))?;
Ok(format!("/root/.skald/mcp/{name}/{basename}"))
Ok(dir)
}
/// Default timeout for a connector-declared verify step. (The manifest can also
/// carry `verify.timeout_secs`; wiring that through is a follow-up.)
const VERIFY_TIMEOUT_SECS: u64 = 20;
// ── connector icons ───────────────────────────────────────────────────────────
#[derive(Deserialize)]
pub struct IconQuery {
/// `sm` (default) | `lg`.
#[serde(default)]
pub size: Option<String>,
}
/// `GET /api/mcp/catalog/{name}/icon?size=sm|lg` — the icon of an **installed**
/// connector, served off `./connectors/<name>/`.
///
/// Authenticated but deliberately **not** capability-gated: seeing the icon of a
/// connector you are allowed to activate is not an administrative act. The
/// marketplace's own icon endpoint cannot do this job — it proxies the live feed
/// behind `manage_catalog`, so a normal user gets a 403, and the image would vanish
/// the moment the feed went down or the entry was pulled upstream. Once installed,
/// the bytes are ours.
pub async fn catalog_icon(
State(skald): State<Arc<Skald>>,
Extension(_auth): Extension<AuthUser>,
Path(name): Path<String>,
axum::extract::Query(q): axum::extract::Query<IconQuery>,
) -> Result<axum::response::Response, ApiError> {
use axum::http::header;
use axum::response::IntoResponse;
let entry = mcp_catalog::get_by_name(skald.db(), &name).await?
.ok_or_else(|| ApiError::not_found(format!("no catalog entry `{name}`")))?;
let large = q.size.as_deref() == Some("lg");
let rel = if large {
entry.icon_large_path.clone().or_else(|| entry.icon_small_path.clone())
} else {
entry.icon_small_path.clone().or_else(|| entry.icon_large_path.clone())
}
.ok_or_else(|| ApiError::not_found("this connector has no installed icon"))?;
// Containment, mirroring `tools::fs::resolve_host_path`: canonicalize and
// prefix-check, fail-closed. `rel` only ever holds a path the installer already
// proved safe, and `name` only ever names a real catalog row — this is the belt
// to those braces, and the reason a bad row cannot turn into an arbitrary read.
let dir = skald_core::mcp::connector_dir(&entry.name)
.map_err(|e| ApiError::bad_request(format!("cannot resolve the connectors dir: {e}")))?;
let base = dir.canonicalize()
.map_err(|_| ApiError::not_found("this connector has no installed files"))?;
let path = base.join(&rel).canonicalize()
.map_err(|_| ApiError::not_found("icon file is missing — reinstall the connector"))?;
if !path.starts_with(&base) {
return Err(ApiError::forbidden("icon path escapes the connector directory"));
}
let bytes = std::fs::read(&path)
.map_err(|e| ApiError::bad_request(format!("cannot read icon: {e}")))?;
let ext = path.extension().and_then(|e| e.to_str()).unwrap_or_default().to_ascii_lowercase();
let ct = skald_core::mcp::content_type_for_ext(&ext);
// An icon is untrusted bytes from a remote feed, and half of them are SVGs —
// a format that can carry script. Served from our own origin, that would be
// stored XSS for anyone who opened the URL directly. `nosniff` pins the type,
// and the CSP neuters any script or fetch the document tries to perform.
Ok((
[
(header::CONTENT_TYPE, ct.to_string()),
(header::X_CONTENT_TYPE_OPTIONS, "nosniff".to_string()),
(header::CONTENT_SECURITY_POLICY, "default-src 'none'; style-src 'unsafe-inline'".to_string()),
(header::CACHE_CONTROL, "private, max-age=3600".to_string()),
],
bytes,
)
.into_response())
}
// ── existing: running-server introspection ────────────────────────────────────
@@ -100,6 +286,8 @@ pub struct CatalogUpsertBody {
#[serde(default = "default_none_auth")]
pub auth_kind: String,
pub role_filter: Option<Vec<String>>,
pub verify_command: Option<String>,
pub verify_script_path: Option<String>,
pub friendly_name: Option<String>,
pub description: Option<String>,
}
@@ -130,7 +318,18 @@ pub async fn catalog_upsert(
script_path: body.script_path.as_deref(),
config_schema_json: to_json_opt(&body.config_schema),
auth_kind: &body.auth_kind,
// OAuth catalog entries come from the vetted feed (marketplace install),
// not the admin's manual form — so these stay unset here.
oauth_provider: None,
oauth_scopes_json: None,
deliver_json: None,
role_filter: to_json_opt(&body.role_filter),
verify_command: body.verify_command.as_deref(),
verify_script_path: body.verify_script_path.as_deref(),
// Not the admin form's to set: the installer owns them, and `upsert`
// COALESCEs these away rather than blanking an installed connector's icons.
icon_small_path: None,
icon_large_path: None,
friendly_name: body.friendly_name.as_deref(),
description: body.description.as_deref(),
}).await?;
@@ -147,6 +346,71 @@ pub async fn catalog_delete(
Ok(Json(json!({ "ok": true })))
}
// ── admin: OAuth providers (§15) ──────────────────────────────────────────────
/// The OAuth identity providers, **without** client secrets (never leaves the
/// process for the browser).
pub async fn providers_list(
State(skald): State<Arc<Skald>>,
Extension(auth): Extension<AuthUser>,
) -> Result<Json<Vec<oauth_providers::OauthProviderView>>, ApiError> {
require_cap(&skald, &auth.user_id, role_capabilities::MANAGE_CATALOG).await?;
let rows = oauth_providers::list(skald.db()).await?;
Ok(Json(rows.into_iter().map(Into::into).collect()))
}
#[derive(Deserialize)]
pub struct ProviderUpsertBody {
pub name: String,
pub display_name: String,
pub auth_url: String,
pub token_url: String,
pub client_id: String,
/// Empty keeps the stored secret — the list view never gave it back, so editing
/// the URLs must not force the admin to re-paste it.
#[serde(default)]
pub client_secret: String,
pub redirect_uri: String,
pub extra_params: Option<String>,
}
pub async fn providers_upsert(
State(skald): State<Arc<Skald>>,
Extension(auth): Extension<AuthUser>,
Json(body): Json<ProviderUpsertBody>,
) -> Result<Json<Value>, ApiError> {
require_cap(&skald, &auth.user_id, role_capabilities::MANAGE_CATALOG).await?;
// `extra_params` must be valid JSON — it is merged into the consent URL, and a
// malformed value would silently drop `access_type`/`prompt` and cost the user a
// refresh token. Reject it here rather than fail quietly at sign-in.
if let Some(extra) = body.extra_params.as_deref().filter(|s| !s.trim().is_empty()) {
serde_json::from_str::<HashMap<String, String>>(extra)
.map_err(|e| ApiError::bad_request(format!("extra_params is not a JSON object of strings: {e}")))?;
}
let extra = body.extra_params.as_deref().filter(|s| !s.trim().is_empty());
oauth_providers::upsert(skald.db(), oauth_providers::UpsertProvider {
name: &body.name,
display_name: &body.display_name,
auth_url: &body.auth_url,
token_url: &body.token_url,
client_id: &body.client_id,
client_secret: &body.client_secret,
redirect_uri: &body.redirect_uri,
extra_params: extra,
}).await?;
Ok(Json(json!({ "ok": true })))
}
pub async fn providers_delete(
State(skald): State<Arc<Skald>>,
Extension(auth): Extension<AuthUser>,
Path(name): Path<String>,
) -> Result<Json<Value>, ApiError> {
require_cap(&skald, &auth.user_id, role_capabilities::MANAGE_CATALOG).await?;
oauth_providers::delete(skald.db(), &name).await?;
Ok(Json(json!({ "ok": true })))
}
// ── admin: globally-active connectors + access ────────────────────────────────
pub async fn global_list(
@@ -181,25 +445,37 @@ pub async fn global_enable(
let name = body.name.clone().unwrap_or_else(|| entry.name.clone());
// Snapshot the concrete config from the catalog; the admin supplies the secret.
let id = mcp_global_servers::upsert(skald.db(), mcp_global_servers::UpsertGlobal {
name: &name,
catalog_name: Some(&entry.name),
transport: &entry.transport,
command: entry.command.as_deref(),
args_json: entry.args_json.clone(),
env_json: body.env.as_ref().and_then(|e| serde_json::to_string(e).ok()).or_else(|| entry.env_json.clone()),
url: entry.url.as_deref(),
api_key: body.api_key.as_deref(),
friendly_name: entry.friendly_name.as_deref(),
description: entry.description.as_deref(),
name: &name,
catalog_name: Some(&entry.name),
transport: &entry.transport,
command: entry.command.as_deref(),
args_json: entry.args_json.clone(),
env_json: body.env.as_ref().and_then(|e| serde_json::to_string(e).ok()).or_else(|| entry.env_json.clone()),
url: entry.url.as_deref(),
api_key: body.api_key.as_deref(),
verify_command: entry.verify_command.as_deref(),
verify_script_path: entry.verify_script_path.as_deref(),
friendly_name: entry.friendly_name.as_deref(),
description: entry.description.as_deref(),
}).await?;
// Verify the admin-supplied credentials before starting the server. A failure
// disables the row so it does not run with bad creds; the admin sees the
// message and can fix + re-enable. A connector with no verify step is allowed
// through unchanged.
let verify = run_verify_for_entry(&skald, &auth, &entry, &name, body.env.as_ref(), body.api_key.as_deref()).await?;
if !verify.skipped && !verify.ok {
mcp_global_servers::set_enabled(skald.db(), id, false).await?;
return Ok(Json(json!({ "id": id, "verify": verify, "error": verify.message })));
}
// Start it now in the global runtime (host transport).
let row = mcp_global_servers::get(skald.db(), id).await?
.ok_or_else(|| ApiError::bad_request("global server vanished after upsert"))?;
let spec = skald_core::mcp::global_row_spec(&row);
match skald.mcp().start_server(spec).await {
Ok(tools) => Ok(Json(json!({ "id": id, "tools": tools }))),
Err(e) => Ok(Json(json!({ "id": id, "error": e.to_string() }))),
Ok(tools) => Ok(Json(json!({ "id": id, "tools": tools, "verify": verify }))),
Err(e) => Ok(Json(json!({ "id": id, "error": e.to_string(), "verify": verify }))),
}
}
@@ -216,6 +492,98 @@ pub async fn global_delete(
Ok(Json(json!({ "ok": true })))
}
/// Runs a catalog entry's verify step in the right target — inside the caller's
/// container for a `per_user` local_script, on the host for a `global` remote.
/// Returns [`VerifyReport::skipped`] when the entry declares no verify step, so
/// callers can treat "no test" uniformly.
///
/// `runtime_name` is the in-container directory key (the user's chosen runtime
/// name for an activation, or the catalog name for a standalone Test).
async fn run_verify_for_entry(
skald: &Skald,
auth: &AuthUser,
entry: &mcp_catalog::McpCatalogRow,
runtime_name: &str,
form: Option<&HashMap<String, String>>,
api_key: Option<&str>,
) -> Result<skald_core::mcp::VerifyReport, ApiError> {
use skald_core::mcp::{run_verify, VerifyReport, VerifyTarget};
let verify_command = match entry.verify_command.as_deref() {
Some(c) => c,
None => return Ok(VerifyReport::skipped()),
};
let schema = parse_env_schema(&entry.config_schema_json);
let (env_values, secret_values) = split_form_values(form, api_key, &schema, &entry.auth_kind);
let report = match entry.scope.as_str() {
"per_user" => {
// `require_context` ensures the container exists before we exec into it.
let _ctx = require_context(skald, &auth.user_id).await?;
let workdir = prepare_user_verify_workdir(&auth.user_id, runtime_name, entry)?
.ok_or_else(|| ApiError::bad_request(
"catalog entry declares verify_command but no verify_script_path",
))?;
let container = skald_core::container::container_name(&auth.user_id);
run_verify(
verify_command,
&env_values,
&secret_values,
VerifyTarget::Container { container: &container, workdir: &workdir },
VERIFY_TIMEOUT_SECS,
).await
}
"global" => {
require_cap(skald, &auth.user_id, role_capabilities::MANAGE_CATALOG).await?;
let workdir = global_verify_workdir(&entry.name)?;
run_verify(
verify_command,
&env_values,
&secret_values,
VerifyTarget::Host { workdir: &workdir },
VERIFY_TIMEOUT_SECS,
).await
}
other => return Err(ApiError::bad_request(format!("unknown catalog scope `{other}`"))),
};
Ok(report)
}
// ── user: test a connector without persisting ─────────────────────────────────
#[derive(Deserialize)]
pub struct TestBody {
/// The catalog entry whose credentials to probe.
pub catalog_name: String,
/// The form values the user just typed (env + secret mixed).
pub env: Option<HashMap<String, String>>,
pub api_key: Option<String>,
}
/// `POST /api/mcp/test` — runs a connector's verify step with the supplied
/// credentials and returns the [`VerifyReport`] **without persisting anything**.
/// The frontend Test button calls this before offering Activate.
pub async fn test(
State(skald): State<Arc<Skald>>,
Extension(auth): Extension<AuthUser>,
Json(body): Json<TestBody>,
) -> Result<Json<skald_core::mcp::VerifyReport>, ApiError> {
let entry = mcp_catalog::get_by_name(skald.db(), &body.catalog_name).await?
.ok_or_else(|| ApiError::not_found(format!("no catalog entry `{}`", body.catalog_name)))?;
// Per-role gate, mirroring `activate`: a user may only test connectors
// their role is allowed to activate.
let user = skald_core::db::users::get(skald.db(), &auth.user_id).await?
.ok_or_else(|| ApiError::unauthorized("unknown user"))?;
if !entry.allowed_for_role(&user.role_id) {
return Err(ApiError::forbidden("your role may not use this connector"));
}
let report = run_verify_for_entry(
&skald, &auth, &entry, &entry.name,
body.env.as_ref(), body.api_key.as_deref(),
).await?;
Ok(Json(report))
}
#[derive(Deserialize)]
pub struct GlobalAccessBody {
/// The full set of user ids allowed to use this global connector.
@@ -369,29 +737,79 @@ pub async fn activate(
let name = body.name.clone().unwrap_or_else(|| entry.name.clone());
reject_name_collision(&skald, &ctx.pool, &auth.user_id, &name).await?;
// For a local script, copy it into the container home and point the
// command at the in-container path.
// For a local script, install its folder into the container home and
// point the command at the in-container path.
let (command, args_json, script_rel_path) = if entry.source == "local_script" {
let script = entry.script_path.clone()
.ok_or_else(|| ApiError::bad_request("catalog local_script entry has no script_path"))?;
let container_path = copy_script_into_home(&auth.user_id, &name, &script)?;
let container_path = install_connector_for_user(&auth.user_id, &name, &script)?;
(entry.command.clone(), Some(json!([container_path]).to_string()), Some(container_path))
} else {
(entry.command.clone(), entry.args_json.clone(), None)
};
let env_json = body.env.as_ref()
.and_then(|e| serde_json::to_string(e).ok())
.or_else(|| entry.env_json.clone());
// OAuth connectors do NOT activate directly (§15): the refresh token
// comes from an interactive consent, not from the activation form. We
// persist a PENDING row (files installed, command wired) and hand off to
// `/mcp/oauth/start` → `/complete`, which obtains the token, flips the
// row to `ready`, and starts the server. Nothing runs until then.
if entry.auth_kind == "oauth" {
let provider_name = entry.oauth_provider.as_deref().ok_or_else(|| {
ApiError::bad_request("this OAuth connector names no provider in the catalog")
})?;
// Fail early, clearly, if the admin has not configured the provider —
// better than a dead pending row the user cannot complete.
let provider = skald_core::db::oauth_providers::get(skald.db(), provider_name).await?
.ok_or_else(|| ApiError::bad_request(format!(
"the `{provider_name}` sign-in provider is not set up yet — \
an admin must add its client credentials first"
)))?;
if provider.client_id.is_empty() {
return Err(ApiError::bad_request(format!(
"the `{provider_name}` sign-in provider has no client id configured"
)));
}
let id = mcp_user_servers::insert(&ctx.pool, mcp_user_servers::InsertUserServer {
name: &name,
catalog_name: Some(&entry.name),
source: &entry.source,
transport: &entry.transport,
command: command.as_deref(),
args_json,
env_json,
url: entry.url.as_deref(),
api_key: None, // obtained by the OAuth flow
oauth_provider: Some(provider_name),
deliver_json: entry.deliver_json.clone(),
script_rel_path: script_rel_path.as_deref(),
verify_command: None,
verify_script_rel_path: None,
auth_state: "pending",
}).await?;
return Ok(Json(json!({
"id": id, "auth_state": "pending", "needs_oauth": true,
})));
}
mcp_user_servers::insert(&ctx.pool, mcp_user_servers::InsertUserServer {
name: &name,
catalog_name: Some(&entry.name),
source: &entry.source,
transport: &entry.transport,
command: command.as_deref(),
name: &name,
catalog_name: Some(&entry.name),
source: &entry.source,
transport: &entry.transport,
command: command.as_deref(),
args_json,
env_json: body.env.as_ref().and_then(|e| serde_json::to_string(e).ok()).or_else(|| entry.env_json.clone()),
url: entry.url.as_deref(),
api_key: body.api_key.as_deref(),
script_rel_path: script_rel_path.as_deref(),
auth_state: "ready",
env_json,
url: entry.url.as_deref(),
api_key: body.api_key.as_deref(),
oauth_provider: None,
deliver_json: None,
script_rel_path: script_rel_path.as_deref(),
verify_command: entry.verify_command.as_deref(),
verify_script_rel_path: None, // resolved when verify runs in-container
auth_state: "ready",
}).await?
}
None => {
@@ -403,17 +821,21 @@ pub async fn activate(
.ok_or_else(|| ApiError::bad_request("a self-registered remote needs a `url`"))?;
reject_name_collision(&skald, &ctx.pool, &auth.user_id, &name).await?;
mcp_user_servers::insert(&ctx.pool, mcp_user_servers::InsertUserServer {
name: &name,
catalog_name: None,
source: "remote",
transport: &body.transport,
command: None,
args_json: None,
env_json: body.env.as_ref().and_then(|e| serde_json::to_string(e).ok()),
url: Some(&url),
api_key: body.api_key.as_deref(),
script_rel_path: None,
auth_state: "ready",
name: &name,
catalog_name: None,
source: "remote",
transport: &body.transport,
command: None,
args_json: None,
env_json: body.env.as_ref().and_then(|e| serde_json::to_string(e).ok()),
url: Some(&url),
api_key: body.api_key.as_deref(),
oauth_provider: None,
deliver_json: None,
script_rel_path: None,
verify_command: None,
verify_script_rel_path: None,
auth_state: "ready",
}).await?
}
};
@@ -421,11 +843,44 @@ pub async fn activate(
// Start it now in this user's runtime (container transport for stdio).
let row = mcp_user_servers::get(&ctx.pool, insert).await?
.ok_or_else(|| ApiError::bad_request("user server vanished after insert"))?;
// Verify-before-start for catalog local_script connectors (a self-registered
// remote has no verify step). The activation is persisted either way; a
// failed verify flips auth_state to 'pending' so the user can retry without
// retyping, and the row stays out of `all_startable` until a test passes.
let verify = if row.source == "local_script" && row.verify_command.is_some() {
match &row.catalog_name {
Some(catalog_name) => match mcp_catalog::get_by_name(skald.db(), catalog_name).await? {
Some(entry) => {
let report = run_verify_for_entry(
&skald, &auth, &entry, &row.name,
body.env.as_ref(), body.api_key.as_deref(),
).await?;
if !report.skipped && !report.ok {
mcp_user_servers::set_auth_state(&ctx.pool, insert, "pending").await?;
return Ok(Json(json!({
"id": insert, "verify": report, "auth_state": "pending",
})));
}
report
}
None => skald_core::mcp::VerifyReport::skipped(),
},
None => skald_core::mcp::VerifyReport::skipped(),
}
} else {
skald_core::mcp::VerifyReport::skipped()
};
let container = skald_core::container::container_name(&auth.user_id);
let spec = skald_core::mcp::user_row_spec(&row, &container);
let spec = skald_core::mcp::user_row_spec_resolved(&row, &container, skald.db()).await;
match ctx.user_mcp.start_server(spec).await {
Ok(tools) => Ok(Json(json!({ "id": insert, "tools": tools }))),
Err(e) => Ok(Json(json!({ "id": insert, "error": e.to_string() }))),
Ok(tools) => Ok(Json(json!({
"id": insert, "tools": tools, "verify": verify, "auth_state": "ready",
}))),
Err(e) => Ok(Json(json!({
"id": insert, "error": e.to_string(), "verify": verify,
}))),
}
}
@@ -460,3 +915,133 @@ pub async fn deactivate(
mcp_user_servers::delete(&ctx.pool, id).await?;
Ok(Json(json!({ "ok": true })))
}
// ── user: interactive OAuth login for a per-user connector (§15) ───────────────
//
// A pending consent lives only in RAM, keyed by an opaque `state`: it holds the
// PKCE verifier that a copy-pasteable authorization code is worthless without, plus
// which user + connector row it belongs to. The flow is stateless on disk — an
// abandoned consent is simply pruned, and a restart drops every in-flight flow (the
// user just starts again), mirroring the RAM-only session model.
struct PendingFlow {
user_id: String,
server_id: i64,
verifier: String,
provider_name: String,
created_at: std::time::Instant,
}
/// How long a started-but-uncompleted consent stays valid.
const OAUTH_FLOW_TTL: std::time::Duration = std::time::Duration::from_secs(15 * 60);
static OAUTH_FLOWS: std::sync::LazyLock<std::sync::Mutex<HashMap<String, PendingFlow>>> =
std::sync::LazyLock::new(|| std::sync::Mutex::new(HashMap::new()));
/// Stores a pending flow, pruning any that timed out first. The lock is never held
/// across an `.await` — a single synchronous critical section.
fn oauth_flow_insert(state: String, flow: PendingFlow) {
let mut map = OAUTH_FLOWS.lock().unwrap();
map.retain(|_, f| f.created_at.elapsed() < OAUTH_FLOW_TTL);
map.insert(state, flow);
}
/// Removes and returns a pending flow, or `None` if unknown or expired.
fn oauth_flow_take(state: &str) -> Option<PendingFlow> {
let mut map = OAUTH_FLOWS.lock().unwrap();
let flow = map.remove(state)?;
(flow.created_at.elapsed() < OAUTH_FLOW_TTL).then_some(flow)
}
#[derive(Deserialize)]
pub struct OauthStartBody {
/// The pending `mcp_user_servers` row (created by `activate`) to sign in.
pub server_id: i64,
}
/// `POST /api/mcp/oauth/start` — begins the consent for a pending OAuth connector.
/// Returns the URL the user opens and an opaque `state` the caller echoes back to
/// `/complete`. Does not touch the provider or the network beyond building a URL.
pub async fn oauth_start(
State(skald): State<Arc<Skald>>,
Extension(auth): Extension<AuthUser>,
Json(body): Json<OauthStartBody>,
) -> Result<Json<Value>, ApiError> {
let ctx = require_context(&skald, &auth.user_id).await?;
let row = mcp_user_servers::get(&ctx.pool, body.server_id).await?
.ok_or_else(|| ApiError::not_found("no such connector"))?;
let provider_name = row.oauth_provider.as_deref()
.ok_or_else(|| ApiError::bad_request("this connector does not use OAuth"))?;
let provider = skald_core::db::oauth_providers::get(skald.db(), provider_name).await?
.ok_or_else(|| ApiError::bad_request(format!("sign-in provider `{provider_name}` is not configured")))?;
// The scopes to request live on the catalog entry (kept current), linked by the
// row's snapshotted catalog name.
let scopes = match &row.catalog_name {
Some(cn) => mcp_catalog::get_by_name(skald.db(), cn).await?
.map(|e| e.oauth_scopes())
.unwrap_or_default(),
None => Vec::new(),
};
let pkce = skald_core::mcp::oauth::generate_pkce();
let state = skald_core::mcp::oauth::random_state();
let auth_url = skald_core::mcp::oauth::build_consent_url(&provider, &scopes, &state, &pkce.challenge)
.map_err(|e| ApiError::bad_request(e.to_string()))?;
oauth_flow_insert(state.clone(), PendingFlow {
user_id: auth.user_id.clone(),
server_id: row.id,
verifier: pkce.verifier,
provider_name: provider_name.to_string(),
created_at: std::time::Instant::now(),
});
Ok(Json(json!({ "auth_url": auth_url, "state": state })))
}
#[derive(Deserialize)]
pub struct OauthCompleteBody {
/// The `state` returned by `/start`, identifying the pending flow.
pub state: String,
/// The authorization code the user pasted from the provider's page.
pub code: String,
}
/// `POST /api/mcp/oauth/complete` — exchanges the pasted code for a refresh token,
/// stores it, flips the connector to `ready`, and starts it in the user's runtime.
pub async fn oauth_complete(
State(skald): State<Arc<Skald>>,
Extension(auth): Extension<AuthUser>,
Json(body): Json<OauthCompleteBody>,
) -> Result<Json<Value>, ApiError> {
let ctx = require_context(&skald, &auth.user_id).await?;
let flow = oauth_flow_take(&body.state)
.ok_or_else(|| ApiError::bad_request("this sign-in has expired — start it again"))?;
// The flow is bound to the user who started it: a leaked `state` cannot let
// someone finish another person's consent into their own connector.
if flow.user_id != auth.user_id {
return Err(ApiError::forbidden("this sign-in does not belong to you"));
}
let provider = skald_core::db::oauth_providers::get(skald.db(), &flow.provider_name).await?
.ok_or_else(|| ApiError::bad_request("sign-in provider is no longer configured"))?;
let token = skald_core::mcp::oauth::exchange_code(&provider, body.code.trim(), &flow.verifier)
.await
.map_err(|e| ApiError::bad_request(e.to_string()))?;
let refresh = token.refresh_token.ok_or_else(|| ApiError::bad_request(
"the provider returned no refresh token — revoke this app's access in your \
account settings and try the sign-in again",
))?;
mcp_user_servers::set_oauth_token(&ctx.pool, flow.server_id, &refresh).await?;
// Start it now, with the credential resolved into the server's env (§15).
let row = mcp_user_servers::get(&ctx.pool, flow.server_id).await?
.ok_or_else(|| ApiError::bad_request("connector vanished after sign-in"))?;
let container = skald_core::container::container_name(&auth.user_id);
let spec = skald_core::mcp::user_row_spec_resolved(&row, &container, skald.db()).await;
match ctx.user_mcp.start_server(spec).await {
Ok(tools) => Ok(Json(json!({ "id": row.id, "tools": tools, "auth_state": "ready" }))),
Err(e) => Ok(Json(json!({ "id": row.id, "error": e.to_string(), "auth_state": "ready" }))),
}
}
src/frontend/api/mod.rs
+10
View File
@@ -139,14 +139,24 @@ pub fn router() -> Router<Arc<Skald>> {
// admin: catalog + globally-active connectors
.route("/mcp/catalog", get(mcp::catalog_list).post(mcp::catalog_upsert))
.route("/mcp/catalog/{id}", delete(mcp::catalog_delete))
// The icon of an installed connector, off the local `connectors/` folder.
// Any logged-in user, not just a catalog manager — see `catalog_icon`.
.route("/mcp/catalog/{name}/icon", get(mcp::catalog_icon))
.route("/mcp/global", get(mcp::global_list).post(mcp::global_enable))
.route("/mcp/global/{id}", delete(mcp::global_delete))
.route("/mcp/global/{id}/access", get(mcp::global_get_access).put(mcp::global_set_access))
// admin: OAuth providers (client credentials for per-user sign-in, §15)
.route("/mcp/providers", get(mcp::providers_list).post(mcp::providers_upsert))
.route("/mcp/providers/{name}", delete(mcp::providers_delete))
// user: available catalog + per-user activation
.route("/mcp/available", get(mcp::available))
.route("/mcp/activate", post(mcp::activate))
.route("/mcp/test", post(mcp::test))
.route("/mcp/activated", get(mcp::activated_list))
.route("/mcp/activated/{id}", delete(mcp::deactivate))
// user: interactive OAuth login for a pending per-user connector (§15)
.route("/mcp/oauth/start", post(mcp::oauth_start))
.route("/mcp/oauth/complete", post(mcp::oauth_complete))
// Dev / debug
.route("/dev/debug_mode", get(dev::get_debug_mode).post(dev::set_debug_mode).put(dev::set_debug_mode))
.route("/dev/llm-requests", get(dev::list_llm_requests))