(req: import("http").IncomingMessage, res: import("http").ServerResponse)
| 40 | } |
| 41 | |
| 42 | function handleRequest(req: import("http").IncomingMessage, res: import("http").ServerResponse) { |
| 43 | const url = new URL(req.url || "/", `http://localhost:${currentPort}`) |
| 44 | |
| 45 | if (url.pathname !== currentPath) { |
| 46 | res.writeHead(404) |
| 47 | res.end("Not found") |
| 48 | return |
| 49 | } |
| 50 | |
| 51 | const code = url.searchParams.get("code") |
| 52 | const state = url.searchParams.get("state") |
| 53 | const error = url.searchParams.get("error") |
| 54 | const errorDescription = url.searchParams.get("error_description") |
| 55 | |
| 56 | // Enforce state parameter presence |
| 57 | if (!state) { |
| 58 | const errorMsg = "Missing required state parameter - potential CSRF attack" |
| 59 | res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" }) |
| 60 | res.end(OauthCallbackPage.error(errorMsg, { provider: "MCP" })) |
| 61 | return |
| 62 | } |
| 63 | |
| 64 | if (error) { |
| 65 | const errorMsg = errorDescription || error |
| 66 | if (pendingAuths.has(state)) { |
| 67 | const pending = pendingAuths.get(state)! |
| 68 | clearTimeout(pending.timeout) |
| 69 | pendingAuths.delete(state) |
| 70 | cleanupStateIndex(state) |
| 71 | pending.reject(new Error(errorMsg)) |
| 72 | } |
| 73 | res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" }) |
| 74 | res.end(OauthCallbackPage.error(errorMsg, { provider: "MCP" })) |
| 75 | stopIfIdle() |
| 76 | return |
| 77 | } |
| 78 | |
| 79 | if (!code) { |
| 80 | res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" }) |
| 81 | res.end(OauthCallbackPage.error("No authorization code provided", { provider: "MCP" })) |
| 82 | return |
| 83 | } |
| 84 | |
| 85 | // Validate state parameter |
| 86 | if (!pendingAuths.has(state)) { |
| 87 | const errorMsg = "Invalid or expired state parameter - potential CSRF attack" |
| 88 | res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" }) |
| 89 | res.end(OauthCallbackPage.error(errorMsg, { provider: "MCP" })) |
| 90 | return |
| 91 | } |
| 92 | |
| 93 | const pending = pendingAuths.get(state)! |
| 94 | |
| 95 | clearTimeout(pending.timeout) |
| 96 | pendingAuths.delete(state) |
| 97 | cleanupStateIndex(state) |
| 98 | pending.resolve(code) |
| 99 |
nothing calls this directly
no test coverage detected