aauth-signed-http-server.js

#!/usr/bin/env node
/**
 * AAuth Signed HTTP Server (test fixture for mcp-shark AAuth visibility)
 *
 * Streamable HTTP-style MCP endpoint that emits AAuth-shaped response headers:
 *   - Signature           (RFC 9421 sf-binary, PLACEHOLDER ONLY)
 *   - Signature-Input     (RFC 9421 sf-list, PLACEHOLDER ONLY)
 *   - Signature-Key       (key thumbprint preview)
 *   - AAuth-Agent
 *   - AAuth-Mission       (echoed from request, otherwise default)
 *
 * IMPORTANT: This server emits well-formed but cryptographically INVALID
 * signatures. mcp-shark's AAuth feature is observation-only — it does not
 * verify signatures. Do NOT use this server as a real AAuth resource.
 *
 * Default bind: 127.0.0.1:9701 (override with HOST/PORT env vars).
 */

import http from 'node:http';

const HOST = process.env.HOST || '127.0.0.1';
const PORT = Number.parseInt(process.env.PORT || '9701', 10);

const AGENT_ID = 'aauth:dummy-signed@example.dev';
const KEY_ID = 'dummy-mcp-key-1';
const ALG = 'ed25519';
const KEY_THUMBPRINT_B64 = 'AbCdEfGhIjKlMnOpQrStUvWxYz0123456789AAAAAAAA';
const SIGNATURE_B64 =
  'MEUCIQDxPLACEHOLDER0000000000000000000000000000000000000000AAAAAAA';

const SERVER_INFO = {
  name: 'aauth-signed-http-server',
  version: '1.0.0',
  protocolVersion: '2025-06-18',
};

const TOOLS = [
  {
    name: 'lookup_record',
    description: 'Returns a fake customer record by ID (test fixture).',
    inputSchema: {
      type: 'object',
      properties: { id: { type: 'string', description: 'Record id' } },
      required: ['id'],
    },
  },
  {
    name: 'add_note',
    description: 'Appends a note to a fake record (test fixture).',
    inputSchema: {
      type: 'object',
      properties: {
        id: { type: 'string', description: 'Record id' },
        note: { type: 'string', description: 'Note text' },
      },
      required: ['id', 'note'],
    },
  },
  {
    name: 'list_artifacts',
    description: 'Lists fake artifacts for a project (test fixture).',
    inputSchema: {
      type: 'object',
      properties: { project: { type: 'string', description: 'Project key' } },
    },
  },
];

function buildSignatureInput() {
  const created = Math.floor(Date.now() / 1000);
  const covered = '"@method" "@target-uri" "@authority" "host" "content-digest"';
  return `sig1=(${covered});keyid="${KEY_ID}";alg="${ALG}";created=${created}`;
}

function setAauthHeaders(res, mission) {
  res.setHeader('Signature', `sig1=:${SIGNATURE_B64}=:`);
  res.setHeader('Signature-Input', buildSignatureInput());
  res.setHeader('Signature-Key', `sha-256=:${KEY_THUMBPRINT_B64}=:`);
  res.setHeader('AAuth-Agent', AGENT_ID);
  res.setHeader('AAuth-Mission', mission);
}

function jsonRpcResult(id, result) {
  return { jsonrpc: '2.0', id: id ?? null, result };
}

function jsonRpcError(id, code, message) {
  return { jsonrpc: '2.0', id: id ?? null, error: { code, message } };
}

function handleMcpMethod(method, params) {
  switch (method) {
    case 'initialize':
      return {
        protocolVersion: SERVER_INFO.protocolVersion,
        serverInfo: { name: SERVER_INFO.name, version: SERVER_INFO.version },
        capabilities: { tools: {} },
      };
    case 'tools/list':
      return { tools: TOOLS };
    case 'tools/call': {
      const name = params?.name || 'unknown';
      return {
        content: [
          { type: 'text', text: `[${SERVER_INFO.name}] tool=${name} ok` },
        ],
        isError: false,
      };
    }
    case 'ping':
      return {};
    default:
      return null;
  }
}

async function readJsonBody(req) {
  return new Promise((resolve, reject) => {
    const chunks = [];
    req.on('data', (c) => chunks.push(c));
    req.on('end', () => {
      const raw = Buffer.concat(chunks).toString('utf8');
      if (!raw) return resolve(null);
      try {
        resolve(JSON.parse(raw));
      } catch (err) {
        reject(err);
      }
    });
    req.on('error', reject);
  });
}

function defaultMission() {
  const d = new Date().toISOString().slice(0, 10);
  return `m_${d}_signed`;
}

const server = http.createServer(async (req, res) => {
  const incomingMission =
    req.headers['aauth-mission'] || req.headers['AAuth-Mission'.toLowerCase()];
  const mission = incomingMission || defaultMission();

  if (req.method === 'GET' && req.url === '/.well-known/aauth') {
    setAauthHeaders(res, mission);
    res.writeHead(200, { 'Content-Type': 'application/json' });
    res.end(
      JSON.stringify({
        agent: AGENT_ID,
        jwks_uri: `http://${HOST}:${PORT}/jwks.json`,
        mode: 'identity',
      })
    );
    return;
  }

  if (req.method === 'GET' && req.url === '/jwks.json') {
    setAauthHeaders(res, mission);
    res.writeHead(200, { 'Content-Type': 'application/json' });
    res.end(
      JSON.stringify({
        keys: [
          {
            kty: 'OKP',
            crv: 'Ed25519',
            kid: KEY_ID,
            x: KEY_THUMBPRINT_B64,
            alg: ALG,
          },
        ],
      })
    );
    return;
  }

  if (req.url !== '/mcp' && req.url !== '/') {
    res.writeHead(404, { 'Content-Type': 'application/json' });
    res.end(JSON.stringify({ error: 'not_found', path: req.url }));
    return;
  }

  if (req.method !== 'POST') {
    setAauthHeaders(res, mission);
    res.writeHead(200, { 'Content-Type': 'application/json' });
    res.end(JSON.stringify({ ok: true, server: SERVER_INFO.name }));
    return;
  }

  let body;
  try {
    body = await readJsonBody(req);
  } catch (err) {
    res.writeHead(400, { 'Content-Type': 'application/json' });
    res.end(JSON.stringify({ error: 'invalid_json', message: String(err) }));
    return;
  }

  setAauthHeaders(res, mission);
  res.setHeader('Content-Type', 'application/json');

  const id = body?.id ?? null;
  const method = body?.method;
  const params = body?.params;

  if (!body || typeof method !== 'string') {
    res.writeHead(400);
    res.end(JSON.stringify(jsonRpcError(id, -32600, 'Invalid Request')));
    return;
  }

  const result = handleMcpMethod(method, params);
  if (result === null) {
    res.writeHead(404);
    res.end(JSON.stringify(jsonRpcError(id, -32601, `Method not found: ${method}`)));
    return;
  }

  res.writeHead(200);
  res.end(JSON.stringify(jsonRpcResult(id, result)));
});

server.listen(PORT, HOST, () => {
  // biome-ignore lint/suspicious/noConsole: dev server log
  console.log(
    `[aauth-signed-http-server] listening on http://${HOST}:${PORT}/mcp ` +
      `(agent=${AGENT_ID})`
  );
});