// // OAuthCallbackServer.swift // ScrobblerContext // // Created by Tomas Martins on 25/05/25. // import Foundation @preconcurrency import Swifter import Logging /// HTTP server for handling OAuth callbacks final class OAuthCallbackServer: Sendable { private let port: Int private let logger = Logger(label: "com.lastfm.mcp-server.oauth") private let server = HttpServer() private let lastFMService: LastFMService private let expectedStateManager = ExpectedStateManager() private let continuationManager = ContinuationManager() init(port: Int, lastFMService: LastFMService) { self.port = port self.lastFMService = lastFMService setupRoutes() } private func setupRoutes() { // OAuth callback endpoint let callbackHandler: @Sendable (HttpRequest) -> HttpResponse = { [weak self] request in guard let self = self else { return .internalServerError } self.logger.info("Received OAuth callback") // Handle the callback asynchronously Task { [weak self] in guard let self = self else { return } do { let result = try await self.handleCallback(request: request) await self.continuationManager.resume(with: .success(result)) } catch { self.logger.error("Callback processing failed: \(error)") await self.continuationManager.resume(with: .failure(error)) } } // Return immediate success page return .ok(.html(self.generateSuccessPage())) } server["/callback"] = callbackHandler // Health check endpoint server["/health"] = { _ in return .ok(.json([ "status": "ready", "service": "lastfm-oauth-callback", "timestamp": Date().timeIntervalSince1970 ])) } // Handle OAuth errors server["/error"] = { request in let queryParams = self.queryParametersAsDictionary(request.queryParams) let errorMsg = queryParams["error"] ?? "Unknown error" let errorDescription = queryParams["error_description"] ?? "" return .ok(.html(generateErrorPage(error: errorMsg, description: errorDescription))) } // Catch-all for other paths server.notFoundHandler = { request in return .notFound } } func start() async throws { do { try server.start(UInt16(port)) logger.info("OAuth callback server started on http://localhost:\(port)") } catch { logger.error("Failed to start OAuth callback server: \(error)") throw ToolError.networkError("Failed to start callback server on port \(port): \(error.localizedDescription)") } } func stop() async { server.stop() logger.info("OAuth callback server stopped") } func setExpectedState(_ state: String) async { await expectedStateManager.setState(state) } func waitForCallback() async throws -> ToolResult { return try await continuationManager.waitForResult() } private func handleCallback(request: HttpRequest) async throws -> ToolResult { // Convert query parameters to dictionary for easier access let queryParams = queryParametersAsDictionary(request.queryParams) logger.info("Processing OAuth callback with query params: \(queryParams.map { "\($0.key)=\($0.value)" }.joined(separator: "&"))") // Check for error parameter first if let error = queryParams["error"] { let errorDescription = queryParams["error_description"] ?? "No description provided" logger.error("OAuth error received: \(error) - \(errorDescription)") throw ToolError.invalidOAuthCallback("OAuth error: \(error) - \(errorDescription)") } // Extract token and state guard let token = queryParams["token"] else { logger.error("Missing token parameter in OAuth callback") throw ToolError.invalidOAuthCallback("Missing token parameter in callback") } let receivedState = queryParams["state"] // Verify state matches (CSRF protection) - Last.fm doesn't return state parameter let expectedStateValue = await expectedStateManager.getState() logger.info("State validation - Expected: '\(expectedStateValue ?? "nil")', Received: '\(receivedState ?? "nil")'") // NOTE: Last.fm OAuth doesn't return the state parameter, so we skip strict validation // The CSRF risk is minimal since this is a temporary local server with a short-lived token if let receivedState = receivedState, let expectedStateValue = expectedStateValue { // If Last.fm ever starts returning state, validate it if receivedState == expectedStateValue { logger.info("✅ State parameter validation successful") } else { logger.warning("⚠️ State parameter mismatch, but continuing (Last.fm limitation)") } } else if expectedStateValue != nil { logger.info("ℹ️ Last.fm didn't return state parameter (expected behavior)") } else { logger.warning("⚠️ No expected state stored") } logger.info("Received valid OAuth token, exchanging for session key...") do { // Exchange token for session key using Last.fm API let sessionKey = try await lastFMService.exchangeTokenForSession(token: token) // Set the session key in the service try await lastFMService.setSessionKey(sessionKey) // Verify authentication worked by checking status let isAuthenticated = await lastFMService.isAuthenticated() guard isAuthenticated else { throw ToolError.authenticationFailed("Failed to authenticate with received session key") } // Get username for confirmation let username = await lastFMService.getCurrentUsername() logger.info("🎵 Browser OAuth authentication completed successfully for user: \(username ?? "unknown")") let result: [String: (any Sendable)] = [ "authenticated": true, "method": "browser_oauth", "user": username ?? "unknown", "timestamp": Date().timeIntervalSince1970, "message": "Successfully authenticated via browser OAuth flow" ] return ToolResult.success(data: result) } catch let toolError as ToolError { logger.error("Authentication process failed: \(toolError)") throw toolError } catch { logger.error("Unexpected error during authentication: \(error)") throw ToolError.authenticationFailed("Authentication process failed: \(error.localizedDescription)") } } /// Convert Swifter's query parameters (array of tuples) to a dictionary private func queryParametersAsDictionary(_ queryParams: [(String, String)]) -> [String: String] { var dict: [String: String] = [:] for (key, value) in queryParams { dict[key] = value } return dict } private func generateSuccessPage() -> String { return """ ✅ Authentication Successful!
ScrobblerContext
🎵

Last.fm Authentication

You have successfully authenticated with Last.fm.

You can now close this tab and return to your MCP client.

📱 Try AirScrobble - The Scrobbler for what's playing IRL
""" } } // MARK: - Thread-Safe Helper Actors /// Actor to manage expected state safely actor ExpectedStateManager { private var expectedState: String? func setState(_ state: String) { self.expectedState = state } func getState() -> String? { return expectedState } func clearState() { expectedState = nil } } /// Actor to manage continuation safely actor ContinuationManager { private var continuation: CheckedContinuation? func waitForResult() async throws -> ToolResult { return try await withCheckedThrowingContinuation { continuation in self.continuation = continuation } } func resume(with result: Result) { guard let continuation = self.continuation else { return } self.continuation = nil switch result { case .success(let toolResult): continuation.resume(returning: toolResult) case .failure(let error): continuation.resume(throwing: error) } } } // MARK: - Error Page Generator private func generateErrorPage(error: String, description: String) -> String { return """ Authentication Error
❌

Authentication Failed

Error: \(error)
\(description.isEmpty ? "" : "

\(description)

")

Please close this window and try authenticating again.

If the problem persists, check your Last.fm credentials and try again.

""" }