@auth0/auth0-mcp-server/dist/utils/onboarding.js

Auth0 Model Context Protocol (MCP) Server (Beta) — A secure and extendable implementation of an MCP server that provides AI assistants with controlled access to the Auth0 Management API through natural language. This project is in beta and not intended fo

import * as path from 'path';
import * as os from 'os';
import { resolvePlaceholders } from './quickstart-placeholders.js';
// Directories that must never receive credential files.
const POSIX_DENIED_PREFIXES = [
    '/etc',
    '/var',
    '/usr',
    '/bin',
    '/sbin',
    '/lib',
    '/lib64',
    '/boot',
    '/run',
    '/root',
    '/tmp',
    '/opt',
    '/srv',
];
const WINDOWS_DENIED_PREFIXES = [
    'C:\\Windows',
    'C:\\Program Files',
    'C:\\Program Files (x86)',
    'C:\\ProgramData',
    'C:\\System Volume Information',
];
export function hasProjectMarker(resolvedDir) {
    const homeDir = os.homedir();
    if (resolvedDir === homeDir)
        return false;
    // Block hidden config directories directly inside home (e.g. ~/.ssh, ~/.config)
    if (resolvedDir.startsWith(homeDir + path.sep) && path.basename(resolvedDir).startsWith('.'))
        return false;
    if (process.platform === 'win32') {
        const lower = resolvedDir.toLowerCase();
        return !WINDOWS_DENIED_PREFIXES.some((p) => lower === p.toLowerCase() || lower.startsWith(p.toLowerCase() + path.sep));
    }
    return !POSIX_DENIED_PREFIXES.some((p) => resolvedDir === p || resolvedDir.startsWith(p + path.sep));
}
export const FRAMEWORK_FILENAMES = {
    react: 'react-quickstart-definition.json',
    vue: 'vuejs-quickstart-definition.json',
    angular: 'angular-quickstart-definition.json',
    nextjs: 'nextjs-quickstart-definition.json',
    javascript: 'vanillajs-quickstart-definition.json',
    express: 'express-quickstart-definition.json',
    python: 'python-quickstart-definition.json',
    android: 'android-quickstart-definition.json',
};
export const SUPPORTED_FRAMEWORKS = Object.keys(FRAMEWORK_FILENAMES);
export function isFrameworkSupported(framework) {
    return SUPPORTED_FRAMEWORKS.includes(framework.toLowerCase());
}
export var UrlSource;
(function (UrlSource) {
    UrlSource["Detected"] = "detected";
    UrlSource["FrameworkDefault"] = "framework_default";
})(UrlSource || (UrlSource = {}));
const APP_TYPE_URL_CONFIGS = {
    spa: new Set(['callback_urls', 'logout_urls', 'web_origins']),
    webapp: new Set(['callback_urls', 'logout_urls']),
    native: new Set(['callback_urls', 'logout_urls']),
};
export const resolveDefaultOrigin = (defaultAppOrigin, inputValues = {}, schemeOverride) => {
    const { scheme, domain, port } = defaultAppOrigin;
    // `domain` may be a literal string (web frameworks) or an object referencing an
    // input value by key (e.g. native apps whose origin is the Auth0 tenant domain).
    const resolvedDomain = typeof domain === 'string' ? domain : inputValues[domain.inputKey];
    if (!resolvedDomain) {
        throw new Error(`Cannot resolve defaultAppOrigin.domain from input "${typeof domain === 'string' ? domain : domain.inputKey}"`);
    }
    // A custom URL scheme (e.g. an Android custom-scheme callback) may override the spec's
    // fixed origin scheme.
    const resolvedScheme = schemeOverride ?? scheme;
    const resolvedPort = port !== undefined ? String(port) : '';
    const raw = `${resolvedScheme}://${resolvedDomain}${resolvedPort ? `:${resolvedPort}` : ''}`;
    // For http/https, `new URL().origin` normalizes the value (e.g. strips the default port).
    // Custom schemes are non-special, so `.origin` returns the literal "null" — build the origin
    // string directly (trailing slash stripped) in that case.
    if (resolvedScheme === 'http' || resolvedScheme === 'https') {
        return new URL(raw).origin;
    }
    return raw.replace(/\/+$/, '');
};
export const resolveCallbackUrls = (quickstartSpec, baseUrl, inputValues = {}, schemeOverride) => {
    const resolvedBaseUrl = baseUrl
        ? baseUrl.trim().replace(/\/+$/, '')
        : resolveDefaultOrigin(quickstartSpec.defaultAppOrigin, inputValues, schemeOverride);
    const urlSource = baseUrl ? UrlSource.Detected : UrlSource.FrameworkDefault;
    const urlKeys = APP_TYPE_URL_CONFIGS[quickstartSpec.appType];
    // Paths may carry %PLACEHOLDER% tokens (e.g. /android/%APPLICATION_ID%/callback).
    // Resolve them with the same semantics used for the LLM prompt before concatenation.
    const resolvePath = (pathTemplate) => resolvePlaceholders(pathTemplate, quickstartSpec.placeholders, inputValues, quickstartSpec.environment);
    const callbackUrl = quickstartSpec.callbackPath
        ? `${resolvedBaseUrl}${resolvePath(quickstartSpec.callbackPath)}`
        : resolvedBaseUrl;
    const logoutUrl = quickstartSpec.logoutPath
        ? `${resolvedBaseUrl}${resolvePath(quickstartSpec.logoutPath)}`
        : resolvedBaseUrl;
    return {
        base_url: resolvedBaseUrl,
        ...(urlKeys.has('callback_urls') && { callback_urls: [callbackUrl] }),
        ...(urlKeys.has('logout_urls') && { logout_urls: [logoutUrl] }),
        ...(urlKeys.has('web_origins') && { web_origins: [resolvedBaseUrl] }),
        url_source: urlSource,
    };
};
function isLoopbackUri(url) {
    const hostname = url.hostname.toLowerCase();
    if (hostname === 'localhost')
        return true;
    const clean = hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;
    if (/^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(clean))
        return true;
    if (clean === '::1')
        return true;
    return false;
}
function isCustomUriScheme(url) {
    return url.protocol !== 'http:' && url.protocol !== 'https:';
}
function isRedirectUriVerifiable(url) {
    return !isCustomUriScheme(url) && !isLoopbackUri(url);
}
export function hasNonVerifiableCallbacks(callbackUrls) {
    return callbackUrls.some((urlStr) => {
        try {
            return !isRedirectUriVerifiable(new URL(urlStr));
        }
        catch {
            return false;
        }
    });
}
//# sourceMappingURL=onboarding.js.map