@1mcp/agent 0.11.0 → 0.13.0

package/build/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGnD;;GAEG;AACH,iBAAe,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC,CAwBnD;AAED,OAAO,EAAE,WAAW,EAAE,CAAC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAI/D;;GAEG;AACH,iBAAe,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC,CA2BnD;AAED,OAAO,EAAE,WAAW,EAAE,CAAC"}

package/build/server.js

@@ -1,22 +1,25 @@
 import { MCP_SERVER_CAPABILITIES, MCP_SERVER_NAME, MCP_SERVER_VERSION } from './constants.js';
 import logger from './logger/logger.js';
-import { createTransports } from './config/transportConfig.js';
-import { createClients } from './clients/clientManager.js';
-import { ServerManager } from './serverManager.js';
-import { ConfigManager } from './config/configManager.js';
+import { createTransports } from './transport/transportFactory.js';
+import { createClients } from './core/client/clientManager.js';
+import { ServerManager } from './core/server/serverManager.js';
+import { McpConfigManager } from './config/mcpConfigManager.js';
+import configReloadService from './services/configReloadService.js';
 /**
  * Main function to set up the MCP server
  */
 async function setupServer() {
     try {
-        const mcpConfig = ConfigManager.getInstance().getTransportConfig();
+        const mcpConfig = McpConfigManager.getInstance().getTransportConfig();
         // Create transports from configuration
         const transports = createTransports(mcpConfig);
         logger.info(`Created ${Object.keys(transports).length} transports`);
         // Create clients for each transport
         const clients = await createClients(transports);
-        logger.info(`Created ${Object.keys(clients).length} clients`);
+        logger.info(`Created ${clients.size} clients`);
         const serverManager = ServerManager.getOrCreateInstance({ name: MCP_SERVER_NAME, version: MCP_SERVER_VERSION }, { capabilities: MCP_SERVER_CAPABILITIES }, clients, transports);
+        // Initialize config reload service at server startup
+        configReloadService.initialize(transports);
         logger.info('Server setup completed successfully');
         return serverManager;
     }

package/build/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC9F,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE1D;;GAEG;AACH,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC,kBAAkB,EAAE,CAAC;QACnE,uCAAuC;QACvC,MAAM,UAAU,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,aAAa,CAAC,CAAC;QAEpE,oCAAoC;QACpC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,UAAU,CAAC,CAAC;QAE9D,MAAM,aAAa,GAAG,aAAa,CAAC,mBAAmB,CACrD,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,kBAAkB,EAAE,EACtD,EAAE,YAAY,EAAE,uBAAuB,EAAE,EACzC,OAAO,EACP,UAAU,CACX,CAAC;QAEF,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QACnD,OAAO,aAAa,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,4BAA4B,KAAK,EAAE,CAAC,CAAC;QAClD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,OAAO,EAAE,WAAW,EAAE,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC9F,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,mBAAmB,MAAM,mCAAmC,CAAC;AAEpE;;GAEG;AACH,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,gBAAgB,CAAC,WAAW,EAAE,CAAC,kBAAkB,EAAE,CAAC;QACtE,uCAAuC;QACvC,MAAM,UAAU,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,aAAa,CAAC,CAAC;QAEpE,oCAAoC;QACpC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,IAAI,UAAU,CAAC,CAAC;QAE/C,MAAM,aAAa,GAAG,aAAa,CAAC,mBAAmB,CACrD,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,kBAAkB,EAAE,EACtD,EAAE,YAAY,EAAE,uBAAuB,EAAE,EACzC,OAAO,EACP,UAAU,CACX,CAAC;QAEF,qDAAqD;QACrD,mBAAmB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAE3C,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QACnD,OAAO,aAAa,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,4BAA4B,KAAK,EAAE,CAAC,CAAC;QAClD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,OAAO,EAAE,WAAW,EAAE,CAAC"}

package/build/services/configReloadService.d.ts

@@ -1,10 +1,10 @@
-import { ServerInfo, EnhancedTransport } from '../types.js';
+import { InboundConnection, EnhancedTransport } from '../core/types/index.js';
 /**
  * Service to handle dynamic configuration reloading
  */
 export declare class ConfigReloadService {
     private static instance;
-    private serverInfo;
+    private serverInstances;
     private currentTransports;
     private isReloading;
     /**
@@ -17,16 +17,26 @@ export declare class ConfigReloadService {
      */
     static getInstance(): ConfigReloadService;
     /**
-     * Initialize the service with the server instance
-     * @param serverInfo The MCP server instance
+     * Initialize the service with initial transports
      * @param initialTransports The initial transports
      */
-    initialize(serverInfo: ServerInfo, initialTransports: Record<string, EnhancedTransport>): void;
+    initialize(initialTransports: Record<string, EnhancedTransport>): void;
     /**
      * Handle configuration changes
      * @param newConfig The new transport configuration
      */
     private handleConfigChange;
+    /**
+     * Update the server info when a client connects
+     * @param sessionId The session ID for this server instance
+     * @param serverInfo The MCP server instance
+     */
+    updateServerInfo(sessionId: string, serverInfo: InboundConnection): void;
+    /**
+     * Remove server info when a client disconnects
+     * @param sessionId The session ID to remove
+     */
+    removeServerInfo(sessionId: string): void;
     /**
      * Stop the service and clean up resources
      */

package/build/services/configReloadService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"configReloadService.d.ts","sourceRoot":"","sources":["../../src/services/configReloadService.ts"],"names":[],"mappings":"AAEA,OAAO,EAAmB,UAAU,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAM7E;;GAEG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAsB;IAC7C,OAAO,CAAC,UAAU,CAA2B;IAC7C,OAAO,CAAC,iBAAiB,CAAyC;IAClE,OAAO,CAAC,WAAW,CAAS;IAE5B;;OAEG;IACH,OAAO;IAEP;;;OAGG;WACW,WAAW,IAAI,mBAAmB;IAOhD;;;;OAIG;IACI,UAAU,CAAC,UAAU,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAAG,IAAI;IAqBrG;;;OAGG;YACW,kBAAkB;IA8ChC;;OAEG;IACI,IAAI,IAAI,IAAI;CAMpB;;AAED,wBAAiD"}
+{"version":3,"file":"configReloadService.d.ts","sourceRoot":"","sources":["../../src/services/configReloadService.ts"],"names":[],"mappings":"AAEA,OAAO,EAAmB,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAM/F;;GAEG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAsB;IAC7C,OAAO,CAAC,eAAe,CAA6C;IACpE,OAAO,CAAC,iBAAiB,CAAyC;IAClE,OAAO,CAAC,WAAW,CAAS;IAE5B;;OAEG;IACH,OAAO;IAEP;;;OAGG;WACW,WAAW,IAAI,mBAAmB;IAOhD;;;OAGG;IACI,UAAU,CAAC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAAG,IAAI;IAoB7E;;;OAGG;YACW,kBAAkB;IAgDhC;;;;OAIG;IACI,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,iBAAiB,GAAG,IAAI;IAK/E;;;OAGG;IACI,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAKhD;;OAEG;IACI,IAAI,IAAI,IAAI;CAMpB;;AAED,wBAAiD"}

package/build/services/configReloadService.js

@@ -1,15 +1,15 @@
 import logger from '../logger/logger.js';
-import { ConfigChangeEvent, ConfigManager } from '../config/configManager.js';
-import { createClients } from '../clients/clientManager.js';
+import { ConfigChangeEvent, McpConfigManager } from '../config/mcpConfigManager.js';
+import { createClients } from '../core/client/clientManager.js';
 import { setupCapabilities } from '../capabilities/capabilityManager.js';
-import { createTransports } from '../config/transportConfig.js';
-import { ServerManager } from '../serverManager.js';
+import { createTransports } from '../transport/transportFactory.js';
+import { ServerManager } from '../core/server/serverManager.js';
 /**
  * Service to handle dynamic configuration reloading
  */
 export class ConfigReloadService {
     static instance;
-    serverInfo = null;
+    serverInstances = new Map();
     currentTransports = {};
     isReloading = false;
     /**
@@ -27,14 +27,12 @@ export class ConfigReloadService {
         return ConfigReloadService.instance;
     }
     /**
-     * Initialize the service with the server instance
-     * @param serverInfo The MCP server instance
+     * Initialize the service with initial transports
      * @param initialTransports The initial transports
      */
-    initialize(serverInfo, initialTransports) {
-        this.serverInfo = serverInfo;
+    initialize(initialTransports) {
         this.currentTransports = initialTransports;
-        const configManager = ConfigManager.getInstance();
+        const configManager = McpConfigManager.getInstance();
         // Remove any existing listeners to prevent duplicates
         configManager.removeAllListeners(ConfigChangeEvent.TRANSPORT_CONFIG_CHANGED);
         // Increase max listeners limit to prevent warnings
@@ -50,7 +48,7 @@ export class ConfigReloadService {
      * @param newConfig The new transport configuration
      */
     async handleConfigChange(newConfig) {
-        if (!this.serverInfo || this.isReloading) {
+        if (this.isReloading) {
             return;
         }
         this.isReloading = true;
@@ -75,8 +73,10 @@ export class ConfigReloadService {
             // Update ServerManager with new clients and transports
             const serverManager = ServerManager.current;
             serverManager.updateClientsAndTransports(newClients, newTransports);
-            // Register new capabilities with the server
-            await setupCapabilities(newClients, this.serverInfo);
+            // Register new capabilities with the server if serverInfo is available
+            for (const serverInfo of this.serverInstances.values()) {
+                await setupCapabilities(newClients, serverInfo);
+            }
             // Update current transports
             this.currentTransports = newTransports;
             logger.info('Configuration reload completed successfully');
@@ -88,11 +88,28 @@ export class ConfigReloadService {
             this.isReloading = false;
         }
     }
+    /**
+     * Update the server info when a client connects
+     * @param sessionId The session ID for this server instance
+     * @param serverInfo The MCP server instance
+     */
+    updateServerInfo(sessionId, serverInfo) {
+        this.serverInstances.set(sessionId, serverInfo);
+        logger.debug(`Updated server info for session ${sessionId} in config reload service`);
+    }
+    /**
+     * Remove server info when a client disconnects
+     * @param sessionId The session ID to remove
+     */
+    removeServerInfo(sessionId) {
+        this.serverInstances.delete(sessionId);
+        logger.debug(`Removed server info for session ${sessionId} from config reload service`);
+    }
     /**
      * Stop the service and clean up resources
      */
     stop() {
-        const configManager = ConfigManager.getInstance();
+        const configManager = McpConfigManager.getInstance();
         configManager.stopWatching();
         configManager.removeAllListeners(ConfigChangeEvent.TRANSPORT_CONFIG_CHANGED);
         logger.info('Config reload service stopped');

package/build/services/configReloadService.js.map

@@ -1 +1 @@
-{"version":3,"file":"configReloadService.js","sourceRoot":"","sources":["../../src/services/configReloadService.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,qBAAqB,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAE9E,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD;;GAEG;AACH,MAAM,OAAO,mBAAmB;IACtB,MAAM,CAAC,QAAQ,CAAsB;IACrC,UAAU,GAAsB,IAAI,CAAC;IACrC,iBAAiB,GAAsC,EAAE,CAAC;IAC1D,WAAW,GAAG,KAAK,CAAC;IAE5B;;OAEG;IACH,gBAAuB,CAAC;IAExB;;;OAGG;IACI,MAAM,CAAC,WAAW;QACvB,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,CAAC;YAClC,mBAAmB,CAAC,QAAQ,GAAG,IAAI,mBAAmB,EAAE,CAAC;QAC3D,CAAC;QACD,OAAO,mBAAmB,CAAC,QAAQ,CAAC;IACtC,CAAC;IAED;;;;OAIG;IACI,UAAU,CAAC,UAAsB,EAAE,iBAAoD;QAC5F,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAE3C,MAAM,aAAa,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC;QAElD,sDAAsD;QACtD,aAAa,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;QAE7E,mDAAmD;QACnD,aAAa,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAElC,uCAAuC;QACvC,aAAa,CAAC,EAAE,CAAC,iBAAiB,CAAC,wBAAwB,EAAE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAEjG,2CAA2C;QAC3C,aAAa,CAAC,aAAa,EAAE,CAAC;QAE9B,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;IACnD,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,kBAAkB,CAAC,SAA0C;QACzE,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACzC,OAAO;QACT,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QAEhD,4CAA4C;QAC5C,MAAM,uBAAuB,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAEvE,IAAI,CAAC;YACH,+BAA+B;YAC/B,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,uBAAuB,EAAE,CAAC;gBACvD,IAAI,CAAC;oBACH,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;oBACxB,MAAM,CAAC,IAAI,CAAC,qBAAqB,GAAG,EAAE,CAAC,CAAC;gBAC1C,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,KAAK,CAAC,2BAA2B,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;YAED,mDAAmD;YACnD,MAAM,aAAa,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;YAElD,wCAAwC;YACxC,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,CAAC;YAEtD,uDAAuD;YACvD,MAAM,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC;YAC5C,aAAa,CAAC,0BAA0B,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YAEpE,4CAA4C;YAC5C,MAAM,iBAAiB,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YAErD,4BAA4B;YAC5B,IAAI,CAAC,iBAAiB,GAAG,aAAa,CAAC;YAEvC,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,mCAAmC,KAAK,EAAE,CAAC,CAAC;QAC3D,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;QAC3B,CAAC;IACH,CAAC;IAED;;OAEG;IACI,IAAI;QACT,MAAM,aAAa,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC;QAClD,aAAa,CAAC,YAAY,EAAE,CAAC;QAC7B,aAAa,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;QAC7E,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC/C,CAAC;CACF;AAED,eAAe,mBAAmB,CAAC,WAAW,EAAE,CAAC"}
+{"version":3,"file":"configReloadService.js","sourceRoot":"","sources":["../../src/services/configReloadService.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,qBAAqB,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEpF,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAEhE;;GAEG;AACH,MAAM,OAAO,mBAAmB;IACtB,MAAM,CAAC,QAAQ,CAAsB;IACrC,eAAe,GAAmC,IAAI,GAAG,EAAE,CAAC;IAC5D,iBAAiB,GAAsC,EAAE,CAAC;IAC1D,WAAW,GAAG,KAAK,CAAC;IAE5B;;OAEG;IACH,gBAAuB,CAAC;IAExB;;;OAGG;IACI,MAAM,CAAC,WAAW;QACvB,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,CAAC;YAClC,mBAAmB,CAAC,QAAQ,GAAG,IAAI,mBAAmB,EAAE,CAAC;QAC3D,CAAC;QACD,OAAO,mBAAmB,CAAC,QAAQ,CAAC;IACtC,CAAC;IAED;;;OAGG;IACI,UAAU,CAAC,iBAAoD;QACpE,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAE3C,MAAM,aAAa,GAAG,gBAAgB,CAAC,WAAW,EAAE,CAAC;QAErD,sDAAsD;QACtD,aAAa,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;QAE7E,mDAAmD;QACnD,aAAa,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAElC,uCAAuC;QACvC,aAAa,CAAC,EAAE,CAAC,iBAAiB,CAAC,wBAAwB,EAAE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAEjG,2CAA2C;QAC3C,aAAa,CAAC,aAAa,EAAE,CAAC;QAE9B,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;IACnD,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,kBAAkB,CAAC,SAA0C;QACzE,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QAEhD,4CAA4C;QAC5C,MAAM,uBAAuB,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAEvE,IAAI,CAAC;YACH,+BAA+B;YAC/B,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,uBAAuB,EAAE,CAAC;gBACvD,IAAI,CAAC;oBACH,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;oBACxB,MAAM,CAAC,IAAI,CAAC,qBAAqB,GAAG,EAAE,CAAC,CAAC;gBAC1C,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,KAAK,CAAC,2BAA2B,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;YAED,mDAAmD;YACnD,MAAM,aAAa,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;YAElD,wCAAwC;YACxC,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,CAAC;YAEtD,uDAAuD;YACvD,MAAM,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC;YAC5C,aAAa,CAAC,0BAA0B,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YAEpE,uEAAuE;YACvE,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,EAAE,CAAC;gBACvD,MAAM,iBAAiB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YAClD,CAAC;YAED,4BAA4B;YAC5B,IAAI,CAAC,iBAAiB,GAAG,aAAa,CAAC;YAEvC,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,mCAAmC,KAAK,EAAE,CAAC,CAAC;QAC3D,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;QAC3B,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,gBAAgB,CAAC,SAAiB,EAAE,UAA6B;QACtE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAChD,MAAM,CAAC,KAAK,CAAC,mCAAmC,SAAS,2BAA2B,CAAC,CAAC;IACxF,CAAC;IAED;;;OAGG;IACI,gBAAgB,CAAC,SAAiB;QACvC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,mCAAmC,SAAS,6BAA6B,CAAC,CAAC;IAC1F,CAAC;IAED;;OAEG;IACI,IAAI;QACT,MAAM,aAAa,GAAG,gBAAgB,CAAC,WAAW,EAAE,CAAC;QACrD,aAAa,CAAC,YAAY,EAAE,CAAC;QAC7B,aAAa,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;QAC7E,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC/C,CAAC;CACF;AAED,eAAe,mBAAmB,CAAC,WAAW,EAAE,CAAC"}

package/build/transport/http/middlewares/errorHandler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errorHandler.d.ts","sourceRoot":"","sources":["../../../../src/transport/http/middlewares/errorHandler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAI1D,MAAM,CAAC,OAAO,UAAU,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,QAQhG"}

package/build/{server → transport/http/middlewares}/errorHandler.js

@@ -1,5 +1,5 @@
 import { ErrorCode } from '@modelcontextprotocol/sdk/types.js';
-import logger from '../logger/logger.js';
+import logger from '../../../logger/logger.js';
 export default function errorHandler(err, req, res, _next) {
     logger.error('Express error:', err);
     res.status(500).json({

package/build/transport/http/middlewares/errorHandler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errorHandler.js","sourceRoot":"","sources":["../../../../src/transport/http/middlewares/errorHandler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AAC/D,OAAO,MAAM,MAAM,2BAA2B,CAAC;AAE/C,MAAM,CAAC,OAAO,UAAU,YAAY,CAAC,GAAU,EAAE,GAAY,EAAE,GAAa,EAAE,KAAmB;IAC/F,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;IACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QACnB,KAAK,EAAE;YACL,IAAI,EAAE,SAAS,CAAC,aAAa;YAC7B,OAAO,EAAE,uBAAuB;SACjC;KACF,CAAC,CAAC;AACL,CAAC"}

package/build/transport/http/middlewares/scopeAuthMiddleware.d.ts

@@ -0,0 +1,42 @@
+import { Request, Response, NextFunction } from 'express';
+/**
+ * Authentication information structure
+ */
+export interface AuthInfo {
+    token: string;
+    clientId: string;
+    grantedScopes: string[];
+    grantedTags: string[];
+}
+/**
+ * Creates a scope validation middleware that uses the SDK's bearer auth middleware
+ *
+ * This middleware:
+ * 1. Uses SDK's requireBearerAuth to verify tokens (when auth enabled)
+ * 2. Validates that requested tags are covered by granted scopes
+ * 3. Provides authentication context to downstream handlers
+ *
+ * When scope validation is disabled, all tags are allowed.
+ * When scope validation is enabled:
+ * - If auth is also enabled, validates tokens and scopes
+ * - If auth is disabled, allows all tags (useful for development/testing)
+ */
+export declare function createScopeAuthMiddleware(): (_req: Request, res: Response, next: NextFunction) => void;
+/**
+ * Default middleware for backward compatibility
+ *
+ * @deprecated Use createScopeAuthMiddleware() instead
+ */
+export default function scopeAuthMiddleware(req: Request, res: Response, next: NextFunction): void;
+/**
+ * Utility function to get validated tags from response locals
+ *
+ * This should be used by downstream handlers instead of directly accessing res.locals.tags
+ * to ensure they get scope-validated tags.
+ */
+export declare function getValidatedTags(res: Response): string[];
+/**
+ * Utility function to get authentication information from response locals
+ */
+export declare function getAuthInfo(res: Response): AuthInfo | undefined;
+//# sourceMappingURL=scopeAuthMiddleware.d.ts.map

package/build/transport/http/middlewares/scopeAuthMiddleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopeAuthMiddleware.d.ts","sourceRoot":"","sources":["../../../../src/transport/http/middlewares/scopeAuthMiddleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAO1D;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,WAKvB,OAAO,OAAO,QAAQ,QAAQ,YAAY,KAAG,IAAI,CAuFlE;AAED;;;;GAIG;AACH,MAAM,CAAC,OAAO,UAAU,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAGjG;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,QAAQ,GAAG,MAAM,EAAE,CAWxD;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAM/D"}

package/build/transport/http/middlewares/scopeAuthMiddleware.js

@@ -0,0 +1,136 @@
+import { requireBearerAuth } from '@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js';
+import logger from '../../../logger/logger.js';
+import { AgentConfigManager } from '../../../core/server/agentConfig.js';
+import { SDKOAuthServerProvider } from '../../../auth/sdkOAuthServerProvider.js';
+import { hasRequiredScopes, scopesToTags, auditScopeOperation } from '../../../utils/scopeValidation.js';
+/**
+ * Creates a scope validation middleware that uses the SDK's bearer auth middleware
+ *
+ * This middleware:
+ * 1. Uses SDK's requireBearerAuth to verify tokens (when auth enabled)
+ * 2. Validates that requested tags are covered by granted scopes
+ * 3. Provides authentication context to downstream handlers
+ *
+ * When scope validation is disabled, all tags are allowed.
+ * When scope validation is enabled:
+ * - If auth is also enabled, validates tokens and scopes
+ * - If auth is disabled, allows all tags (useful for development/testing)
+ */
+export function createScopeAuthMiddleware() {
+    const serverConfig = AgentConfigManager.getInstance();
+    // If scope validation is disabled, return a pass-through middleware
+    if (!serverConfig.isScopeValidationEnabled()) {
+        return (_req, res, next) => {
+            const requestedTags = res.locals.tags || [];
+            res.locals.validatedTags = requestedTags;
+            next();
+        };
+    }
+    // If scope validation is enabled but auth is disabled, allow all tags
+    if (!serverConfig.isAuthEnabled()) {
+        return (_req, res, next) => {
+            const requestedTags = res.locals.tags || [];
+            res.locals.validatedTags = requestedTags;
+            next();
+        };
+    }
+    const oauthProvider = new SDKOAuthServerProvider();
+    // Create the SDK's bearer auth middleware
+    const bearerAuthMiddleware = requireBearerAuth({
+        verifier: oauthProvider,
+    });
+    // Return a combined middleware that does both auth and scope validation
+    return async (req, res, next) => {
+        try {
+            // First run the SDK's bearer auth middleware
+            await new Promise((resolve, reject) => {
+                bearerAuthMiddleware(req, res, (err) => {
+                    if (err)
+                        reject(err);
+                    else
+                        resolve();
+                });
+            });
+            // If we get here, auth succeeded and req.auth is populated
+            const authInfo = req.auth;
+            const grantedScopes = authInfo.scopes || [];
+            const grantedTags = scopesToTags(grantedScopes);
+            // Get requested tags from previous middleware (tagsExtractor)
+            const requestedTags = res.locals.tags || [];
+            // Validate that all requested tags are covered by granted scopes
+            if (!hasRequiredScopes(grantedScopes, requestedTags)) {
+                auditScopeOperation('insufficient_scopes', {
+                    clientId: authInfo.clientId,
+                    requestedScopes: requestedTags.map((tag) => `tag:${tag}`),
+                    grantedScopes,
+                    success: false,
+                    error: 'Insufficient scopes for requested tags',
+                });
+                res.status(403).json({
+                    error: 'insufficient_scope',
+                    error_description: `Insufficient scopes. Required: ${requestedTags.join(', ')}, Granted: ${grantedTags.join(', ')}`,
+                });
+                return;
+            }
+            // Provide authentication context to downstream handlers via res.locals
+            res.locals.auth = {
+                token: req.headers.authorization?.slice(7) || '', // Remove 'Bearer ' prefix
+                clientId: authInfo.clientId,
+                grantedScopes,
+                grantedTags,
+            };
+            // Provide validated tags to downstream handlers
+            // If no specific tags requested, use all granted tags
+            res.locals.validatedTags = requestedTags.length > 0 ? requestedTags : grantedTags;
+            auditScopeOperation('scope_validation_success', {
+                clientId: authInfo.clientId,
+                requestedScopes: requestedTags.map((tag) => `tag:${tag}`),
+                grantedScopes,
+                success: true,
+            });
+            next();
+        }
+        catch (error) {
+            logger.error('Scope auth middleware error:', error);
+            res.status(500).json({
+                error: 'server_error',
+                error_description: 'Internal server error',
+            });
+        }
+    };
+}
+/**
+ * Default middleware for backward compatibility
+ *
+ * @deprecated Use createScopeAuthMiddleware() instead
+ */
+export default function scopeAuthMiddleware(req, res, next) {
+    const middleware = createScopeAuthMiddleware();
+    middleware(req, res, next);
+}
+/**
+ * Utility function to get validated tags from response locals
+ *
+ * This should be used by downstream handlers instead of directly accessing res.locals.tags
+ * to ensure they get scope-validated tags.
+ */
+export function getValidatedTags(res) {
+    if (!res?.locals?.validatedTags) {
+        return [];
+    }
+    // Ensure it's an array
+    if (!Array.isArray(res.locals.validatedTags)) {
+        return [];
+    }
+    return res.locals.validatedTags;
+}
+/**
+ * Utility function to get authentication information from response locals
+ */
+export function getAuthInfo(res) {
+    if (!res?.locals?.auth) {
+        return undefined;
+    }
+    return res.locals.auth;
+}
+//# sourceMappingURL=scopeAuthMiddleware.js.map

package/build/transport/http/middlewares/scopeAuthMiddleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopeAuthMiddleware.js","sourceRoot":"","sources":["../../../../src/transport/http/middlewares/scopeAuthMiddleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gEAAgE,CAAC;AACnG,OAAO,MAAM,MAAM,2BAA2B,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAYzG;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,yBAAyB;IACvC,MAAM,YAAY,GAAG,kBAAkB,CAAC,WAAW,EAAE,CAAC;IAEtD,oEAAoE;IACpE,IAAI,CAAC,YAAY,CAAC,wBAAwB,EAAE,EAAE,CAAC;QAC7C,OAAO,CAAC,IAAa,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;YAChE,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,aAAa,GAAG,aAAa,CAAC;YACzC,IAAI,EAAE,CAAC;QACT,CAAC,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,EAAE,CAAC;QAClC,OAAO,CAAC,IAAa,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;YAChE,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,aAAa,GAAG,aAAa,CAAC;YACzC,IAAI,EAAE,CAAC;QACT,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,sBAAsB,EAAE,CAAC;IAEnD,0CAA0C;IAC1C,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;QAC7C,QAAQ,EAAE,aAAa;KACxB,CAAC,CAAC;IAEH,wEAAwE;IACxE,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAiB,EAAE;QAC9E,IAAI,CAAC;YACH,6CAA6C;YAC7C,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC1C,oBAAoB,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAS,EAAE,EAAE;oBAC3C,IAAI,GAAG;wBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;wBAChB,OAAO,EAAE,CAAC;gBACjB,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,2DAA2D;YAC3D,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAK,CAAC;YAC3B,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;YAC5C,MAAM,WAAW,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;YAEhD,8DAA8D;YAC9D,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YAE5C,iEAAiE;YACjE,IAAI,CAAC,iBAAiB,CAAC,aAAa,EAAE,aAAa,CAAC,EAAE,CAAC;gBACrD,mBAAmB,CAAC,qBAAqB,EAAE;oBACzC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;oBAC3B,eAAe,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,OAAO,GAAG,EAAE,CAAC;oBACjE,aAAa;oBACb,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,wCAAwC;iBAChD,CAAC,CAAC;gBAEH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,oBAAoB;oBAC3B,iBAAiB,EAAE,kCAAkC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBACpH,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,uEAAuE;YACvE,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG;gBAChB,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,0BAA0B;gBAC5E,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,aAAa;gBACb,WAAW;aACZ,CAAC;YAEF,gDAAgD;YAChD,sDAAsD;YACtD,GAAG,CAAC,MAAM,CAAC,aAAa,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;YAElF,mBAAmB,CAAC,0BAA0B,EAAE;gBAC9C,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,eAAe,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,OAAO,GAAG,EAAE,CAAC;gBACjE,aAAa;gBACb,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YAEH,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;YACpD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,cAAc;gBACrB,iBAAiB,EAAE,uBAAuB;aAC3C,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,OAAO,UAAU,mBAAmB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IACzF,MAAM,UAAU,GAAG,yBAAyB,EAAE,CAAC;IAC/C,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAa;IAC5C,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QAChC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,uBAAuB;IACvB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC;AAClC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,GAAa;IACvC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;AACzB,CAAC"}

package/build/transport/http/middlewares/securityMiddleware.d.ts

@@ -0,0 +1,30 @@
+import { Request, Response, NextFunction } from 'express';
+/**
+ * Security headers middleware to protect against common attacks
+ */
+export declare function securityHeaders(req: Request, res: Response, next: NextFunction): void;
+/**
+ * Rate limiter for sensitive operations (stricter than general OAuth)
+ */
+export declare const sensitiveOperationLimiter: import("express-rate-limit").RateLimitRequestHandler;
+/**
+ * Enhanced input validation middleware
+ */
+export declare function inputValidation(req: Request, res: Response, next: NextFunction): void;
+/**
+ * Session security middleware
+ */
+export declare function sessionSecurity(req: Request, res: Response, next: NextFunction): void;
+/**
+ * Request logging middleware for security audit trail
+ */
+export declare function securityAuditLogger(req: Request, res: Response, next: NextFunction): void;
+/**
+ * Prevent common timing attacks
+ */
+export declare function timingAttackPrevention(req: Request, res: Response, next: NextFunction): void;
+/**
+ * Comprehensive security middleware stack
+ */
+export declare function setupSecurityMiddleware(): (typeof securityHeaders)[];
+//# sourceMappingURL=securityMiddleware.d.ts.map

package/build/transport/http/middlewares/securityMiddleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityMiddleware.d.ts","sourceRoot":"","sources":["../../../../src/transport/http/middlewares/securityMiddleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAI1D;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAyBrF;AAED;;GAEG;AACH,eAAO,MAAM,yBAAyB,sDA2BpC,CAAC;AAEH;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAiErF;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAarF;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CA4CzF;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAwB5F;AAED;;GAEG;AACH,wBAAgB,uBAAuB,+BAEtC"}

package/build/transport/http/middlewares/securityMiddleware.js

@@ -0,0 +1,201 @@
+import rateLimit from 'express-rate-limit';
+import logger from '../../../logger/logger.js';
+/**
+ * Security headers middleware to protect against common attacks
+ */
+export function securityHeaders(req, res, next) {
+    // Prevent clickjacking
+    res.setHeader('X-Frame-Options', 'DENY');
+    // Prevent MIME type sniffing
+    res.setHeader('X-Content-Type-Options', 'nosniff');
+    // Enable XSS protection
+    res.setHeader('X-XSS-Protection', '1; mode=block');
+    // Prevent referrer leakage
+    res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
+    // Content Security Policy for HTML responses (disabled for OAuth/auth paths)
+    if (req.accepts('html') && !req.path.includes('/oauth/') && !req.path.includes('/auth/')) {
+        res.setHeader('Content-Security-Policy', "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; form-action 'self'; frame-ancestors 'none';");
+    }
+    // Remove server information
+    res.removeHeader('X-Powered-By');
+    next();
+}
+/**
+ * Rate limiter for sensitive operations (stricter than general OAuth)
+ */
+export const sensitiveOperationLimiter = rateLimit({
+    windowMs: 15 * 60 * 1000, // 15 minutes
+    max: 10, // 10 attempts per window
+    standardHeaders: true,
+    legacyHeaders: false,
+    message: {
+        error: 'rate_limit_exceeded',
+        error_description: 'Too many sensitive operations. Please try again later.',
+    },
+    skip: (req) => {
+        // Skip rate limiting for health checks or non-sensitive endpoints
+        return req.path === '/health' || req.path === '/';
+    },
+    handler: (req, res) => {
+        logger.warn(`Rate limit exceeded for sensitive operation`, {
+            ip: req.ip,
+            userAgent: req.get('User-Agent'),
+            path: req.path,
+            method: req.method,
+            timestamp: new Date().toISOString(),
+        });
+        res.status(429).json({
+            error: 'rate_limit_exceeded',
+            error_description: 'Too many sensitive operations. Please try again later.',
+        });
+    },
+});
+/**
+ * Enhanced input validation middleware
+ */
+export function inputValidation(req, res, next) {
+    // Check for common injection patterns in headers
+    const suspiciousPatterns = [
+        /\$\(.*\)/, // Command injection
+        /<script[\s\S]*?>/i, // XSS - matches across newlines
+        /javascript:/i, // JavaScript protocol
+        /\.\./, // Path traversal
+        /\0/, // Null byte injection
+        /union.*select/i, // SQL injection
+        /exec\s*\(/i, // Code execution
+    ];
+    const checkForMaliciousContent = (value, location) => {
+        return suspiciousPatterns.some((pattern) => {
+            if (pattern.test(value)) {
+                logger.warn(`Suspicious content detected in ${location}`, {
+                    value: value.substring(0, 100), // Log only first 100 chars
+                    pattern: pattern.toString(),
+                    ip: req.ip,
+                    userAgent: req.get('User-Agent'),
+                    path: req.path,
+                    timestamp: new Date().toISOString(),
+                });
+                return true;
+            }
+            return false;
+        });
+    };
+    // Check headers
+    for (const [key, value] of Object.entries(req.headers)) {
+        if (typeof value === 'string' && checkForMaliciousContent(value, `header:${key}`)) {
+            res.status(400).json({
+                error: 'invalid_request',
+                error_description: 'Request contains suspicious content',
+            });
+            return;
+        }
+    }
+    // Check query parameters
+    for (const [key, value] of Object.entries(req.query)) {
+        if (typeof value === 'string' && checkForMaliciousContent(value, `query:${key}`)) {
+            res.status(400).json({
+                error: 'invalid_request',
+                error_description: 'Request contains suspicious content',
+            });
+            return;
+        }
+    }
+    // Check body for POST requests
+    if (req.body && typeof req.body === 'object') {
+        for (const [key, value] of Object.entries(req.body)) {
+            if (typeof value === 'string' && checkForMaliciousContent(value, `body:${key}`)) {
+                res.status(400).json({
+                    error: 'invalid_request',
+                    error_description: 'Request contains suspicious content',
+                });
+                return;
+            }
+        }
+    }
+    next();
+}
+/**
+ * Session security middleware
+ */
+export function sessionSecurity(req, res, next) {
+    // Add security-related headers for session management
+    res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
+    res.setHeader('Pragma', 'no-cache');
+    res.setHeader('Expires', '0');
+    res.setHeader('Surrogate-Control', 'no-store');
+    // For OAuth endpoints, add additional security
+    if (req.path.includes('/oauth/')) {
+        res.setHeader('X-Robots-Tag', 'noindex, nofollow, nosnippet, noarchive');
+    }
+    next();
+}
+/**
+ * Request logging middleware for security audit trail
+ */
+export function securityAuditLogger(req, res, next) {
+    const startTime = Date.now();
+    // Log high-value security events
+    const isSecurityRelevant = req.path.includes('/oauth/') ||
+        req.path.includes('/auth/') ||
+        req.method === 'POST' ||
+        req.method === 'PUT' ||
+        req.method === 'DELETE';
+    if (isSecurityRelevant) {
+        logger.info('Security-relevant request', {
+            method: req.method,
+            path: req.path,
+            ip: req.ip,
+            userAgent: req.get('User-Agent'),
+            contentType: req.get('Content-Type'),
+            timestamp: new Date().toISOString(),
+            sessionId: req.headers['mcp-session-id'],
+            authorization: req.headers.authorization ? 'Bearer [REDACTED]' : undefined,
+        });
+    }
+    // Capture response details
+    const originalSend = res.send;
+    res.send = function (body) {
+        const duration = Date.now() - startTime;
+        if (isSecurityRelevant) {
+            logger.info('Security-relevant response', {
+                method: req.method,
+                path: req.path,
+                statusCode: res.statusCode,
+                duration,
+                ip: req.ip,
+                timestamp: new Date().toISOString(),
+            });
+        }
+        return originalSend.call(this, body);
+    };
+    next();
+}
+/**
+ * Prevent common timing attacks
+ */
+export function timingAttackPrevention(req, res, next) {
+    const startTime = Date.now();
+    // Add random delay for authentication-related endpoints to prevent timing attacks
+    const isAuthEndpoint = req.path.includes('/oauth/') || req.path.includes('/auth/');
+    if (isAuthEndpoint) {
+        // Add random delay between 10-50ms to make timing attacks harder
+        const randomDelay = Math.floor(Math.random() * 40) + 10;
+        const originalSend = res.send;
+        res.send = function (body) {
+            const elapsed = Date.now() - startTime;
+            const remainingDelay = Math.max(0, randomDelay - elapsed);
+            setTimeout(() => {
+                return originalSend.call(this, body);
+            }, remainingDelay);
+            return this;
+        };
+    }
+    next();
+}
+/**
+ * Comprehensive security middleware stack
+ */
+export function setupSecurityMiddleware() {
+    return [securityHeaders, sessionSecurity, inputValidation, securityAuditLogger, timingAttackPrevention];
+}
+//# sourceMappingURL=securityMiddleware.js.map