Connect Superserve

${htmlEscape(clientName)} is requesting access to this Superserve MCP proxy.

\n \n The API key is submitted in the POST body, never in the URL. It is kept only long enough to redeem this one-time authorization code, then the OAuth client uses it as its Bearer token.\n

\n\n`;\n\n return new Response(html, {\n status: 200,\n headers: {\n \"content-type\": \"text/html; charset=utf-8\",\n \"cache-control\": \"no-store\",\n \"content-security-policy\": \"default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; base-uri 'none'\",\n \"referrer-policy\": \"no-referrer\",\n },\n });\n}\n\nasync function handleAuthorize(req: Request, origin: string) {\n const params = req.method === \"GET\" ? new URL(req.url).searchParams : await readForm(req);\n\n let valid;\n try {\n valid = await validateAuthorizeParams(params, origin);\n } catch (error) {\n return oauthError(\"invalid_request\", error instanceof Error ? error.message : \"Invalid authorization request\");\n }\n\n if (req.method === \"GET\") return authorizationPage(params, valid.clientName);\n if (req.method !== \"POST\") return new Response(\"Method Not Allowed\", { status: 405 });\n\n const superserveApiKey = params.get(\"superserve_api_key\")?.trim() ?? \"\";\n if (!superserveApiKey) return oauthError(\"invalid_request\", \"Superserve API key is required\");\n\n await ensureSchema();\n const now = Date.now();\n await sqlite.execute({ sql: `DELETE FROM oauth_codes WHERE expires_at <= ?`, args: [now] });\n\n const code = randomToken(32);\n const codeHash = await sha256(code);\n await sqlite.execute({\n sql: `INSERT INTO oauth_codes\n (code_hash, client_id, redirect_uri, code_challenge, scope, resource, superserve_api_key, expires_at)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,\n args: [\n codeHash,\n valid.clientId,\n valid.redirectUri,\n valid.codeChallenge,\n params.get(\"scope\") || OAUTH_SCOPE,\n valid.resource || protectedResource(origin),\n superserveApiKey,\n now + AUTH_CODE_TTL_MS,\n ],\n });\n\n const redirect = new URL(valid.redirectUri);\n redirect.searchParams.set(\"code\", code);\n const state = params.get(\"state\");\n if (state !== null) redirect.searchParams.set(\"state\", state);\n // RFC 9207 issuer identification. This MUST be present because our\n // authorization-server metadata advertises\n // authorization_response_iss_parameter_supported=true.\n redirect.searchParams.set(\"iss\", origin);\n\n // Some OAuth hosts (including embedded connector flows) do not reliably\n // follow a bare server-side 302 from an authorization form POST. Return a\n // tiny transition page that explicitly navigates this OAuth window to the\n // registered callback. `location.replace` also removes the authorize POST\n // page from browser history, so the provider page does not remain behind.\n const callbackUrl = redirect.toString();\n const callbackJs = JSON.stringify(callbackUrl).replace(/\n\n\n\n\n\nReturning to ChatGPT…\n\n\n\n

Returning to ChatGPT…

Continue

\n\n\n`;\n\n return new Response(html, {\n status: 200,\n headers: {\n \"content-type\": \"text/html; charset=utf-8\",\n \"cache-control\": \"no-store\",\n \"content-security-policy\": \"default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline'; base-uri 'none'\",\n \"referrer-policy\": \"no-referrer\",\n },\n });\n}\n\nasync function handleToken(req: Request, origin: string) {\n if (req.method !== \"POST\") return new Response(\"Method Not Allowed\", { status: 405 });\n const params = await readForm(req);\n if (params.get(\"grant_type\") !== \"authorization_code\") {\n return oauthError(\"unsupported_grant_type\", \"Only authorization_code is supported\");\n }\n\n const code = params.get(\"code\") ?? \"\";\n const clientId = params.get(\"client_id\") ?? \"\";\n const redirectUri = params.get(\"redirect_uri\") ?? \"\";\n const codeVerifier = params.get(\"code_verifier\") ?? \"\";\n if (!code || !clientId || !redirectUri || !codeVerifier) {\n return oauthError(\"invalid_request\", \"code, client_id, redirect_uri, and code_verifier are required\");\n }\n\n try {\n await authenticateTokenClient(params, origin);\n } catch (error) {\n return oauthError(\"invalid_client\", error instanceof Error ? error.message : \"Client authentication failed\", 401);\n }\n\n await ensureSchema();\n const codeHash = await sha256(code);\n const result = await sqlite.execute({\n sql: `SELECT client_id, redirect_uri, code_challenge, scope, resource, superserve_api_key, expires_at\n FROM oauth_codes WHERE code_hash = ?`,\n args: [codeHash],\n });\n if (!result.rows.length) return oauthError(\"invalid_grant\", \"Unknown or already-used authorization code\");\n\n const row = result.rows[0] as Record;\n if (Number(row.expires_at) <= Date.now()) {\n await sqlite.execute({ sql: `DELETE FROM oauth_codes WHERE code_hash = ?`, args: [codeHash] });\n return oauthError(\"invalid_grant\", \"Authorization code expired\");\n }\n if (String(row.client_id) !== clientId || String(row.redirect_uri) !== redirectUri) {\n return oauthError(\"invalid_grant\", \"Authorization code does not match this client or redirect_uri\");\n }\n const expectedChallenge = await sha256(codeVerifier);\n if (expectedChallenge !== String(row.code_challenge)) {\n return oauthError(\"invalid_grant\", \"PKCE verification failed\");\n }\n\n const deleted = await sqlite.execute({ sql: `DELETE FROM oauth_codes WHERE code_hash = ?`, args: [codeHash] });\n if (!deleted.rowsAffected) return oauthError(\"invalid_grant\", \"Authorization code was already redeemed\");\n\n return json({\n access_token: String(row.superserve_api_key),\n token_type: \"Bearer\",\n scope: String(row.scope || OAUTH_SCOPE),\n resource: String(row.resource || protectedResource(origin)),\n });\n}\n\nasync function handleRegister(req: Request) {\n if (req.method !== \"POST\") return new Response(\"Method Not Allowed\", { status: 405 });\n let body: Record;\n try {\n body = await req.json() as Record;\n } catch {\n return oauthError(\"invalid_client_metadata\", \"Expected JSON client metadata\");\n }\n\n const redirectUris = Array.isArray(body.redirect_uris)\n ? body.redirect_uris.filter((v): v is string => typeof v === \"string\")\n : [];\n if (!redirectUris.length) return oauthError(\"invalid_redirect_uri\", \"At least one redirect_uri is required\");\n for (const value of redirectUris) {\n try {\n new URL(value);\n } catch {\n return oauthError(\"invalid_redirect_uri\", `Invalid redirect_uri: ${value}`);\n }\n }\n if (body.token_endpoint_auth_method && body.token_endpoint_auth_method !== \"none\") {\n return oauthError(\"invalid_client_metadata\", \"Only public clients with token_endpoint_auth_method=none are supported\");\n }\n\n await ensureSchema();\n const clientId = `mcp_${randomToken(24)}`;\n const createdAt = Math.floor(Date.now() / 1000);\n const clientName = typeof body.client_name === \"string\" ? body.client_name : \"MCP client\";\n const applicationType = typeof body.application_type === \"string\" ? body.application_type : \"native\";\n await sqlite.execute({\n sql: `INSERT INTO oauth_clients (client_id, redirect_uris, client_name, application_type, created_at)\n VALUES (?, ?, ?, ?, ?)`,\n args: [clientId, JSON.stringify(redirectUris), clientName, applicationType, createdAt],\n });\n\n return json({\n client_id: clientId,\n client_id_issued_at: createdAt,\n redirect_uris: redirectUris,\n client_name: clientName,\n application_type: applicationType,\n token_endpoint_auth_method: \"none\",\n grant_types: [\"authorization_code\"],\n response_types: [\"code\"],\n }, { status: 201 });\n}\n\nfunction protectedResourceMetadata(origin: string) {\n return json({\n resource: protectedResource(origin),\n authorization_servers: [origin],\n bearer_methods_supported: [\"header\"],\n scopes_supported: [OAUTH_SCOPE],\n });\n}\n\nfunction authorizationServerMetadata(origin: string) {\n return json({\n issuer: origin,\n authorization_endpoint: `${origin}/authorize`,\n token_endpoint: `${origin}/token`,\n registration_endpoint: `${origin}/register`,\n response_types_supported: [\"code\"],\n grant_types_supported: [\"authorization_code\"],\n token_endpoint_auth_methods_supported: [\"none\", \"private_key_jwt\"],\n token_endpoint_auth_signing_alg_values_supported: [\"RS256\"],\n code_challenge_methods_supported: [\"S256\"],\n scopes_supported: [OAUTH_SCOPE],\n client_id_metadata_document_supported: true,\n });\n}\n\nfunction bearerToken(req: Request) {\n const authorization = req.headers.get(\"authorization\") ?? \"\";\n const match = authorization.match(/^Bearer\\s+(.+)$/i);\n return match?.[1]?.trim() || null;\n}\n\nasync function proxyToSuperserve(req: Request, origin: string) {\n const incoming = new URL(req.url);\n const queryApiKey = incoming.searchParams.get(\"e2b_api_key\")?.trim() || null;\n const apiKey = queryApiKey || bearerToken(req);\n if (!apiKey) return unauthorized(origin);\n\n const target = new URL(incoming.pathname + incoming.search, UPSTREAM);\n target.searchParams.delete(\"e2b_api_key\");\n const headers = new Headers(req.headers);\n for (const name of HOP_BY_HOP) headers.delete(name);\n headers.delete(\"host\");\n headers.set(\"authorization\", `Bearer ${apiKey}`);\n headers.set(\"cache-control\", \"no-store\");\n\n const upstream = await fetch(target, {\n method: req.method,\n headers,\n body: req.method === \"GET\" || req.method === \"HEAD\" ? undefined : req.body,\n redirect: \"manual\",\n });\n\n const responseHeaders = new Headers(upstream.headers);\n for (const name of HOP_BY_HOP) responseHeaders.delete(name);\n responseHeaders.set(\"cache-control\", \"no-store\");\n if (upstream.status === 401) {\n responseHeaders.set(\n \"www-authenticate\",\n `Bearer resource_metadata=\"${origin}/.well-known/oauth-protected-resource\", scope=\"${OAUTH_SCOPE}\"`,\n );\n }\n return new Response(upstream.body, {\n status: upstream.status,\n statusText: upstream.statusText,\n headers: responseHeaders,\n });\n}\n\nexport default async function handler(req: Request): Promise {\n const url = new URL(req.url);\n const origin = url.origin;\n\n if (url.pathname === \"/.well-known/oauth-protected-resource\") return protectedResourceMetadata(origin);\n if (url.pathname === \"/.well-known/oauth-authorization-server\") return authorizationServerMetadata(origin);\n if (url.pathname === \"/authorize\") return handleAuthorize(req, origin);\n if (url.pathname === \"/token\") return handleToken(req, origin);\n if (url.pathname === \"/register\") return handleRegister(req);\n\n return proxyToSuperserve(req, origin);\n}\n","superserve","children",[],[192],["D",1789230170258],[],[18],"2cb5e45e-b4a9-4914-9964-8544ee91c575",".gitignore","e1096144-956e-11f1-9504-1607ee4eb77e",["D",1786443887953],".env\nnode_modules/\n.DS_Store\n",[],[206],["D",1786443887569],["D",1789486866837],{"_11":12,"_145":70},{"_11":12,"_141":-5,"_69":70,"_30":68,"_142":143,"_144":24},{"_41":88,"_13":16,"_35":38,"_133":95,"_134":-5,"_135":-5,"_136":-5,"_137":-5,"_138":-5,"_139":14,"_140":12},"ctx",{"_54":-5,"_165":250,"_251":252,"_253":254,"_255":24,"_256":24,"_257":24,"_258":163,"_259":-5,"_260":-7,"_261":-7,"_262":26,"_263":24,"_264":24,"_265":-5,"_266":24,"_267":24,"_268":24,"_269":-5},"ENV",{"_221":222,"_223":224,"_225":16,"_226":227,"_228":229,"_230":231,"_232":233,"_234":235,"_236":237,"_238":239,"_240":241,"_242":243,"_244":245,"_246":247,"_248":249},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

History · README.md