// Authentication module for z-image.ai // Stores and manages the Better Auth session cookie import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs"; import { homedir } from "node:os"; import { join } from "node:path"; import { createServer } from "node:http"; import { exec } from "node:child_process"; const CONFIG_DIR = join(homedir(), ".config", "zimage-mcp"); const AUTH_FILE = join(CONFIG_DIR, "auth.json"); interface AuthConfig { sessionToken: string; updatedAt: string; } function ensureConfigDir(): void { if (!existsSync(CONFIG_DIR)) { mkdirSync(CONFIG_DIR, { recursive: true }); } } export function getSessionToken(): string | null { try { if (!existsSync(AUTH_FILE)) return null; const config: AuthConfig = JSON.parse(readFileSync(AUTH_FILE, "utf-8")); return config.sessionToken || null; } catch { return null; } } export function saveSessionToken(token: string): void { ensureConfigDir(); const config: AuthConfig = { sessionToken: token, updatedAt: new Date().toISOString(), }; writeFileSync(AUTH_FILE, JSON.stringify(config, null, 2), "utf-8"); } // Extract session token from a raw cookie string function extractToken(cookieStr: string): string | null { // Try better-auth.session_token first const match = cookieStr.match(/better-auth\.session_token=([^;\s]+)/); if (match) return match[1]; // If the string looks like a bare token (no = sign), use it directly if (!cookieStr.includes("=") && cookieStr.length > 20) return cookieStr.trim(); return null; } // Open URL in the user's default browser function openBrowser(url: string): void { const cmd = process.platform === "darwin" ? `open "${url}"` : process.platform === "win32" ? `start "${url}"` : `xdg-open "${url}"`; exec(cmd, () => {}); } /** * Streamlined interactive auth flow: * 1. Starts a tiny local HTTP server * 2. Opens z-image.ai — user logs in with Google * 3. User clicks a bookmarklet or pastes a one-liner in console * 4. Local server captures the cookie and saves it * * Called via: zimage-mcp auth */ export async function interactiveAuth(): Promise { return new Promise((resolve, reject) => { const port = 39271; const html = ` Z-Image MCP Auth

🔐 Z-Image MCP Authentication

Step 1 — Open z-image.ai and log in with Google

Step 2 — After logging in, click this button to grab your session automatically:

If the button doesn't work, open the browser console on z-image.ai (F12 → Console) and paste:

fetch('http://localhost:${port}/capture',{method:'POST',headers:{'Content-Type':'text/plain'},body:document.cookie})

✅ Done! — Session captured and saved.
You can close this tab. The MCP server is ready to use.

`; const server = createServer((req, res) => { // CORS headers for cross-origin POST from z-image.ai console res.setHeader("Access-Control-Allow-Origin", "*"); res.setHeader("Access-Control-Allow-Methods", "POST, OPTIONS"); res.setHeader("Access-Control-Allow-Headers", "Content-Type"); if (req.method === "OPTIONS") { res.writeHead(204); res.end(); return; } if (req.url === "/capture" && req.method === "POST") { let body = ""; req.on("data", (chunk: Buffer) => (body += chunk.toString())); req.on("end", () => { const token = extractToken(body); if (token) { saveSessionToken(token); res.writeHead(200, { "Content-Type": "text/plain" }); res.end("OK — session saved"); // Give time for response to send, then resolve setTimeout(() => { server.close(); resolve(token); }, 500); } else { res.writeHead(400, { "Content-Type": "text/plain" }); res.end("Could not extract session token from cookie string"); } }); return; } // Serve auth page res.writeHead(200, { "Content-Type": "text/html" }); res.end(html); }); server.listen(port, () => { const url = `http://localhost:${port}`; console.error(`\n🔐 Z-Image MCP Authentication`); console.error(`━━━━━━━━━━━━━━━━━━━━━━━━━━━━━`); console.error(`Opening auth page: ${url}\n`); console.error(`Steps:`); console.error(` 1. Log in to z-image.ai with Google`); console.error(` 2. Open z-image.ai console (F12 → Console)`); console.error(` 3. Run: document.cookie`); console.error(` 4. Copy the result and paste it in the auth page\n`); openBrowser(url); }); server.on("error", (err: Error) => { reject(new Error(`Auth server failed: ${err.message}`)); }); // Timeout after 5 minutes setTimeout(() => { server.close(); reject(new Error("Auth timeout — no cookie received in 5 minutes")); }, 5 * 60 * 1000); }); } /** * Direct token auth — for CLI: zimage-mcp auth --token * Or for setting from environment variable ZIMAGE_SESSION_TOKEN */ export function directAuth(token: string): void { const extracted = extractToken(token) || token.trim(); saveSessionToken(extracted); } /** * Get the session token from config or environment, with validation */ export function requireAuth(): string { // Environment variable takes precedence const envToken = process.env.ZIMAGE_SESSION_TOKEN; if (envToken) return envToken; const token = getSessionToken(); if (!token) { throw new Error( "Not authenticated. Run: zimage-mcp auth\n" + "Or set ZIMAGE_SESSION_TOKEN environment variable." ); } return token; }