Feat/setup mcp auth by akulistus · Pull Request #681 · codex-team/hawk.api.nodejs

akulistus · 2026-09-16T00:43:38Z

You can use modified frontend version to test mcp and authorization flow

neSpecc · 2026-09-16T05:59:08Z

+    `${process.env.API_URL}/.well-known/oauth-protected-resource/integration/mcp`
+});
+
+export const useMCPAuth = (app: express.Application) => {


use named functions instead of anonymous. It's better for debugging.

Suggested change

export const useMCPAuth = (app: express.Application) => {

export function useMCPAuth(app: express.Application) {

neSpecc · 2026-09-16T06:01:16Z

+
+export const useMCPAuth = (app: express.Application) => {
+  /**
+   * Dynamic client registration


Please, provide a little more descriptive docs.

neSpecc · 2026-09-16T06:02:11Z

+  verifier: tokenVerifier,
+  resourceMetadataUrl:


neSpecc · 2026-09-16T06:02:35Z

+  });
+
+  /**
+   * Protected resource metadata


same here. Explain why this method is needed and what is does.

neSpecc · 2026-09-16T06:04:26Z

+  );
+
+  /**
+   * Frontend callback


improve docs

neSpecc · 2026-09-16T06:08:01Z

+  expiresAt: number;
+};
+
+const authCodes = new Map<string, AuthCodeData>();


this maps will be shared across all users, is it ok? Also, add docs please

Implemented redis store for multi-instance deployment and improved in-memory store for single-instance deployment

Yes. It's fine, because the storage maps user's unique auth code to authRequest data. The user should not be able to access any other authRequset data except for it's own

neSpecc · 2026-09-16T06:10:22Z

+  });
+
+  /**
+   * MCP client callback


neSpecc · 2026-09-16T06:10:46Z

+  return payload as TokenData;
+};
+
+const createTokenResponse = (userId: string, clientId: string) => ({


neSpecc · 2026-09-16T06:11:50Z

+const createTokenResponse = (userId: string, clientId: string) => ({
+  access_token: jwt.sign(
+    { userId, clientId, tokenUse: "access" },
+    process.env.JWT_SECRET_ACCESS_TOKEN as Secret,
+    { expiresIn: accessTokenLifetimeSeconds }
+  ),
+  refresh_token: jwt.sign(
+    { userId, clientId, tokenUse: "refresh" },
+    process.env.JWT_SECRET_ACCESS_TOKEN as Secret,
+    { expiresIn: "30d" }
+  ),
+  token_type: "Bearer",
+  expires_in: accessTokenLifetimeSeconds,
+  scope: "mcp:tools mcp:resources"
+});


can we reuse generateTokensPair method here?

Copilot

🟡 Changes recommended

Token isolation, redirect validation, CORS, and distributed authorization-code storage must be addressed before approval.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds OAuth authorization and bearer-token protection to the MCP integration.

Changes:

Adds OAuth discovery, registration, consent, token, PKCE, and refresh flows.
Protects MCP routes and adds an authenticated user-ID tool.
Adds the MCP Express dependency.

File summaries

File	Description
`src/integrations/mcp/auth.ts`	Implements MCP OAuth flow.
`src/integrations/mcp/index.ts`	Applies authentication middleware.
`src/integrations/mcp/mcp.ts`	Adds an authenticated test tool.
`package.json`	Adds MCP Express dependency.
`yarn.lock`	Locks the new dependency.

Review details

Files reviewed: 4/5 changed files
Comments generated: 9
Review effort level: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+  refresh_token: jwt.sign(
+    { userId, clientId, tokenUse: "refresh" },
+    process.env.JWT_SECRET_ACCESS_TOKEN as Secret,


+    authCodes.set(code, {
+      userId: user.userId,
+      clientId: client_id,
+      redirectUri: redirect_uri,
+      codeChallenge: code_challenge,


+  expiresAt: number;
+};
+
+const authCodes = new Map<string, AuthCodeData>();


+    { expiresIn: "30d" }
+  ),
+  token_type: "Bearer",
+  expires_in: accessTokenLifetimeSeconds,


+  /**
+   * Frontend callback
+   */
+  app.post("/concent/integration/mcp", (req, res) => {


+    const user = jwt.verify(
+      loginToken,
+      process.env.JWT_SECRET_ACCESS_TOKEN as Secret
+    ) as UserJWTData;


+    const calculatedChallenge = crypto
+      .createHash("sha256")
+      .update(code_verifier)
+      .digest("base64url");


+    `${process.env.API_URL}/.well-known/oauth-protected-resource/integration/mcp`
+});
+
+export const useMCPAuth = (app: express.Application) => {


+  server.registerTool(
+    "print_userId",
+    {
+      description: "A test tool that pritn userId from auth token"


Reversean · 2026-09-21T21:53:52Z

+  /**
+   * MCP
+   */
+  app.use("/integration/mcp", authMiddleware, router);


Under WHATWG Fetch §3.2.1, browser CORS preflights (OPTIONS) do not carry credentials (Authorization). Because OPTIONS currently cascades into authMiddleware (requireBearerAuth), it responds with 401 Unauthorized per RFC 6750 §3.1, causing browsers to abort cross-origin MCP requests.

Consider either:

intercepting OPTIONS before authMiddleware to respond with 204 to keep changes local to this route

terminating OPTIONS preflights with 204 and adding Authorization to Access-Control-Allow-Headers

For discovery endpoints (/.well-known/oauth-*), RFC 8414 §3 also recommends Access-Control-Allow-Origin: * for external clients.

Reversean · 2026-09-21T21:53:52Z

+      });
+    }
+
+    const auth = authCodes.get(code);


Per RFC 6749 §10.5 and §4.1.2, authorization codes should be single-use. Currently authCodes.delete(code) is only reached after PKCE verification succeeds, so on parameter or PKCE failure the code remains active for 5 minutes.

Consider consuming/invalidating the code upon initial lookup (or ensuring deletion in all error branches) to prevent replay or brute-force verifier probing against an intercepted code.

Reversean · 2026-09-21T21:53:52Z

+      description: "A test tool that pritn userId from auth token"
+    },
+    async (ctx: ServerContext) => {
+      const token = ctx.http?.req?.headers.get("authorization")?.slice(7)!;


Accessing ctx.http?.req?.headers.get("authorization")?.slice(7)! directly and passing it to jwt.decode can throw an unhandled TypeError if the header is missing, malformed, or formatted differently, and reads unverified claims instead of the token already verified by requireBearerAuth.

…dis for multi-instance deploy or in-memory for single instance deploy, add JSDoc

akulistus added this pull request to stack #682 September 16, 2026 00:43

neSpecc reviewed Sep 16, 2026

View reviewed changes

neSpecc requested a balanced review from Copilot September 16, 2026 06:12

Copilot started reviewing on behalf of neSpecc September 16, 2026 06:12

View session

Copilot AI reviewed Sep 16, 2026

View reviewed changes

Reversean requested changes Sep 21, 2026

View reviewed changes

akulistus force-pushed the feat/setup-mcp-auth branch from 4a261e7 to c83154d Compare October 14, 2026 15:40

akulistus force-pushed the feat/setup-mcp-auth branch 2 times, most recently from 6fe3738 to 7401a65 Compare October 22, 2026 20:16

akulistus and others added 4 commits October 24, 2026 00:14

feat(mcp-auth): add initial OAuth 2.1 authorization support

f446cfc

chore(mcp-auth): refresh token

d9d1a0e

feat(MCPAuthRequestStore): implement caching MCPAuthRequests using re…

3f8ef37

…dis for multi-instance deploy or in-memory for single instance deploy, add JSDoc

Bump version up to 1.6.2

08d5031

akulistus force-pushed the feat/setup-mcp-auth branch from 7401a65 to 08d5031 Compare October 23, 2026 21:16

akulistus added 3 commits October 25, 2026 20:02

fix(token-refresh): fix 400 status code error on token refresh

7e70c76

add JSDoc and fix lint

db7d5c0

chore(generateTokenPair): check enforced sso before issuing tokens

a869ee0

	export const useMCPAuth = (app: express.Application) => {
	export function useMCPAuth(app: express.Application) {

Conversation

akulistus commented Sep 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

akulistus commented Sep 16, 2026 •

edited

Loading