@adrata/adrata-mcp 1.0.0

package/security.js

@@ -0,0 +1,690 @@
+/**
+ * Enterprise-grade security hardening for Adrata MCP Server.
+ *
+ * Provides:
+ *   1. Rate limiting (sliding window, per-tier)
+ *   2. Input validation (Zod-based sanitization)
+ *   3. Audit logging (enterprise tier, every non-read tool + mass-egress reads)
+ *   4. Token encryption at rest (AES-256-GCM)
+ *   5. CORS restrictions (production mode)
+ *   6. Transport security helpers
+ */
+
+import { z } from 'zod';
+import crypto from 'node:crypto';
+import os from 'node:os';
+import { buildToolAnnotations } from './tool-annotations.js';
+
+// ---------------------------------------------------------------------------
+// Configuration
+// ---------------------------------------------------------------------------
+
+const TELEMETRY_ENABLED = process.env.ADRATA_TELEMETRY !== 'off';
+const IS_PRODUCTION = process.env.NODE_ENV === 'production';
+
+// ---------------------------------------------------------------------------
+// 1. Rate Limiting — Sliding Window
+// ---------------------------------------------------------------------------
+
+/**
+ * Sliding window rate limiter using in-memory Map with timestamps.
+ * Per-session for stdio transport, per-IP for HTTP/SSE transport.
+ */
+class SlidingWindowRateLimiter {
+  constructor() {
+    // Map<string, number[]> — key -> array of request timestamps (ms)
+    this.windows = new Map();
+    // Cleanup stale entries every 5 minutes
+    this.cleanupInterval = setInterval(() => this.cleanup(), 5 * 60 * 1000);
+    if (this.cleanupInterval.unref) this.cleanupInterval.unref();
+  }
+
+  /**
+   * Check if a request is allowed under rate limits.
+   * @param {string} key — session ID or IP address
+   * @param {number} maxRequests — max requests in the window
+   * @param {number} windowMs — window size in milliseconds
+   * @returns {{ allowed: boolean, remaining: number, retryAfterMs: number|null }}
+   */
+  check(key, maxRequests, windowMs) {
+    const now = Date.now();
+    const cutoff = now - windowMs;
+
+    let timestamps = this.windows.get(key);
+    if (!timestamps) {
+      timestamps = [];
+      this.windows.set(key, timestamps);
+    }
+
+    // Remove expired timestamps
+    while (timestamps.length > 0 && timestamps[0] <= cutoff) {
+      timestamps.shift();
+    }
+
+    if (timestamps.length >= maxRequests) {
+      const oldestInWindow = timestamps[0];
+      const retryAfterMs = oldestInWindow + windowMs - now;
+      return {
+        allowed: false,
+        remaining: 0,
+        retryAfterMs: Math.max(retryAfterMs, 1000),
+      };
+    }
+
+    timestamps.push(now);
+    return {
+      allowed: true,
+      remaining: maxRequests - timestamps.length,
+      retryAfterMs: null,
+    };
+  }
+
+  cleanup() {
+    const now = Date.now();
+    // Remove entries with no recent activity (older than 1 hour)
+    const oneHourAgo = now - 60 * 60 * 1000;
+    for (const [key, timestamps] of this.windows) {
+      if (timestamps.length === 0 || timestamps[timestamps.length - 1] < oneHourAgo) {
+        this.windows.delete(key);
+      }
+    }
+  }
+
+  destroy() {
+    clearInterval(this.cleanupInterval);
+    this.windows.clear();
+  }
+}
+
+/**
+ * Tier-based rate limit configuration.
+ * Free tier: 1000 req/hour (abuse protection only)
+ * Pro tier: 10000 req/day
+ * Enterprise tier: 100000 req/day
+ */
+const TIER_RATE_LIMITS = {
+  free: { maxRequests: 1000, windowMs: 60 * 60 * 1000 },          // 1000/hour
+  pro: { maxRequests: 10000, windowMs: 24 * 60 * 60 * 1000 },     // 10000/day
+  enterprise: { maxRequests: 100000, windowMs: 24 * 60 * 60 * 1000 }, // 100000/day
+};
+
+const rateLimiter = new SlidingWindowRateLimiter();
+
+/**
+ * Check rate limit for a request.
+ * @param {string} sessionKey — session ID (stdio) or IP (HTTP)
+ * @param {string} tier — 'free', 'pro', or 'enterprise'
+ * @returns {{ allowed: boolean, remaining: number, retryAfterMs: number|null }}
+ */
+export function checkRateLimit(sessionKey, tier) {
+  const config = TIER_RATE_LIMITS[tier] || TIER_RATE_LIMITS.free;
+  return rateLimiter.check(sessionKey, config.maxRequests, config.windowMs);
+}
+
+/**
+ * Build a 429 rate-limit response for MCP.
+ */
+export function rateLimitResponse(retryAfterMs) {
+  const retryAfterSec = Math.ceil(retryAfterMs / 1000);
+  return {
+    content: [{
+      type: 'text',
+      text: JSON.stringify({
+        error: 'rate_limit_exceeded',
+        message: `Rate limit exceeded. Please retry after ${retryAfterSec} seconds.`,
+        retryAfterSeconds: retryAfterSec,
+      }, null, 2),
+    }],
+    isError: true,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// 2. Input Validation
+// ---------------------------------------------------------------------------
+
+/**
+ * Common validation schemas for tool parameters.
+ * These wrap and tighten the existing Zod schemas.
+ */
+export const validators = {
+  /** Sanitize a string — strip control characters, limit length. */
+  sanitizeString(value, maxLength = 1000) {
+    if (typeof value !== 'string') return value;
+    // Strip control characters except newline/tab
+    // eslint-disable-next-line no-control-regex
+    const cleaned = value.replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, '');
+    return cleaned.slice(0, maxLength);
+  },
+
+  /** Validate that a string doesn't contain obvious injection patterns. */
+  isSafe(value) {
+    if (typeof value !== 'string') return true;
+    // Check for common injection patterns.
+    // The event-handler check requires HTML tag or attribute-breakout context
+    // (`<tag ... onX=` or a quote directly before `onX=`). A bare /on\w+\s*=/
+    // rejected legitimate business strings like "phone=555" or "one=1".
+    const dangerous = [
+      /<script\b/i,
+      /javascript:/i,
+      /<[^>]*\bon\w+\s*=/i,   // <img onerror=, <div onclick = ...
+      /["']\s*on\w+\s*=/i,    // " onmouseover= (attribute breakout)
+      /data:\s*text\/html/i,
+    ];
+    return !dangerous.some(pattern => pattern.test(value));
+  },
+
+  /** Validate an ID string (UUIDs, prefixed IDs like c-1, p-123). */
+  isValidId(value) {
+    if (typeof value !== 'string') return false;
+    // Allow UUIDs, prefixed IDs (c-1, p-123), and alphanumeric strings
+    return /^[a-zA-Z0-9_-]{1,128}$/.test(value);
+  },
+
+  /** Validate an email address format. */
+  isValidEmail(value) {
+    if (typeof value !== 'string') return false;
+    return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value) && value.length <= 320;
+  },
+
+  /** Validate a URL format. */
+  isValidUrl(value) {
+    if (typeof value !== 'string') return false;
+    try {
+      const url = new URL(value);
+      return ['http:', 'https:'].includes(url.protocol);
+    } catch {
+      return false;
+    }
+  },
+};
+
+/**
+ * Validate and sanitize all arguments for a tool call.
+ * Rejects obviously malicious input, sanitizes strings.
+ *
+ * @param {string} toolName — name of the tool being called
+ * @param {object} args — raw arguments from the client
+ * @returns {{ valid: boolean, args: object, error: string|null }}
+ */
+export function validateToolInput(toolName, args) {
+  if (!args || typeof args !== 'object') {
+    return { valid: true, args: args || {}, error: null };
+  }
+
+  const sanitized = {};
+  const errors = [];
+
+  for (const [key, value] of Object.entries(args)) {
+    if (typeof value === 'string') {
+      // Check for injection attempts
+      if (!validators.isSafe(value)) {
+        errors.push(`Parameter "${key}" contains potentially unsafe content`);
+        continue;
+      }
+
+      // Sanitize string values
+      const maxLen = key === 'body' || key === 'message' || key === 'description'
+        ? 10000
+        : key === 'query' || key === 'search'
+          ? 500
+          : 1000;
+      sanitized[key] = validators.sanitizeString(value, maxLen);
+
+      // Validate specific field types
+      if (key === 'id' || key.endsWith('Id')) {
+        if (!validators.isValidId(value)) {
+          errors.push(`Parameter "${key}" is not a valid ID format`);
+          continue;
+        }
+      }
+
+      if (key === 'email' || key === 'personEmail') {
+        if (value && !validators.isValidEmail(value)) {
+          errors.push(`Parameter "${key}" is not a valid email address`);
+          continue;
+        }
+      }
+
+      if (key === 'website' || key === 'linkedinUrl' || key === 'twitterUrl') {
+        if (value && !validators.isValidUrl(value)) {
+          errors.push(`Parameter "${key}" is not a valid URL`);
+          continue;
+        }
+      }
+    } else {
+      sanitized[key] = value;
+    }
+  }
+
+  if (errors.length > 0) {
+    return {
+      valid: false,
+      args: sanitized,
+      error: errors.join('; '),
+    };
+  }
+
+  return { valid: true, args: sanitized, error: null };
+}
+
+/**
+ * Build an input validation error response for MCP.
+ */
+export function validationErrorResponse(error) {
+  return {
+    content: [{
+      type: 'text',
+      text: JSON.stringify({
+        error: 'validation_error',
+        message: `Input validation failed: ${error}`,
+      }, null, 2),
+    }],
+    isError: true,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// 3. Audit Logging
+// ---------------------------------------------------------------------------
+
+/**
+ * In-memory audit log buffer. Entries are flushed to the Rust API
+ * periodically or when the buffer reaches a threshold.
+ */
+class AuditLogger {
+  constructor(apiFn) {
+    this.buffer = [];
+    this.apiFn = apiFn;
+    this.flushThreshold = 50;
+    this.maxBufferedEntries = 1000;
+    this.flushIntervalMs = 30_000;
+    this.flushing = false;
+    this.flushTimer = setInterval(() => this.flush(), this.flushIntervalMs);
+    if (this.flushTimer.unref) this.flushTimer.unref();
+  }
+
+  /**
+   * Log an audit event.
+   * @param {{ tool: string, tier: string, action: string, args: object, userId: string|null, sessionKey: string, timestamp: string }} entry
+   */
+  log(entry) {
+    if (!TELEMETRY_ENABLED) return;
+
+    this.buffer.push({
+      tool: entry.tool,
+      action: entry.action || 'tool_call',
+      tier: entry.tier,
+      userId: entry.userId || null,
+      sessionKey: entry.sessionKey,
+      timestamp: entry.timestamp || new Date().toISOString(),
+      // Redact sensitive fields from args
+      params: redactSensitiveFields(entry.args),
+    });
+
+    if (this.buffer.length >= this.flushThreshold) {
+      this.flush();
+    }
+  }
+
+  /**
+   * Flush buffered entries to the Rust API.
+   * Silently drops entries if the API is unavailable (non-blocking).
+   */
+  async flush() {
+    if (this.buffer.length === 0 || this.flushing) return;
+    this.flushing = true;
+    const entries = this.buffer.splice(0, this.buffer.length);
+
+    if (this.apiFn) {
+      try {
+        await this.apiFn('POST', '/api/v1/mcp/audit', { body: { entries } });
+      } catch {
+        // Retain a bounded retry buffer. Never retain arbitrary arguments: log()
+        // already redacts and truncates them before they enter this buffer.
+        this.buffer = [...entries, ...this.buffer].slice(-this.maxBufferedEntries);
+        console.error(`[audit] Failed to flush ${entries.length} audit entries; retained for retry`);
+      } finally {
+        this.flushing = false;
+      }
+    } else {
+      this.flushing = false;
+    }
+  }
+
+  destroy() {
+    clearInterval(this.flushTimer);
+    this.flush();
+  }
+}
+
+/**
+ * Redact fields that may contain secrets or PII from audit logs.
+ */
+function redactSensitiveFields(args) {
+  if (!args || typeof args !== 'object') return args;
+  const redacted = {};
+  // Compared against key.toLowerCase(), so every entry MUST be lowercase.
+  // 'apiKey'/'creditCard' were stored camelCase and could never match — an
+  // apiKey argument landed unredacted in the audit log.
+  const sensitiveKeys = new Set([
+    'password', 'token', 'apikey', 'api_key', 'secret', 'authorization',
+    'cookie', 'session', 'creditcard', 'credit_card', 'ssn',
+  ]);
+
+  for (const [key, value] of Object.entries(args)) {
+    if (sensitiveKeys.has(key.toLowerCase())) {
+      redacted[key] = '[REDACTED]';
+    } else if (typeof value === 'string' && value.length > 200) {
+      redacted[key] = value.slice(0, 200) + '...[truncated]';
+    } else {
+      redacted[key] = value;
+    }
+  }
+  return redacted;
+}
+
+// ---------------------------------------------------------------------------
+// 4. Token Security — AES-256-GCM Encryption at Rest
+// ---------------------------------------------------------------------------
+
+/**
+ * Encrypt a token for local storage using AES-256-GCM.
+ * The encryption key is derived from ADRATA_ENCRYPTION_KEY env var
+ * or a machine-specific fallback.
+ *
+ * @param {string} plaintext — the token to encrypt
+ * @returns {string} — base64-encoded encrypted payload (iv:authTag:ciphertext)
+ */
+export function encryptToken(plaintext) {
+  const key = getEncryptionKey();
+  const iv = crypto.randomBytes(12);
+  const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+
+  let encrypted = cipher.update(plaintext, 'utf8', 'base64');
+  encrypted += cipher.final('base64');
+  const authTag = cipher.getAuthTag();
+
+  // Format: iv:authTag:ciphertext (all base64)
+  return `${iv.toString('base64')}:${authTag.toString('base64')}:${encrypted}`;
+}
+
+/**
+ * Decrypt a token from local storage.
+ *
+ * @param {string} encryptedPayload — output from encryptToken()
+ * @returns {string} — the original plaintext token
+ */
+export function decryptToken(encryptedPayload) {
+  const key = getEncryptionKey();
+  const [ivB64, authTagB64, ciphertext] = encryptedPayload.split(':');
+
+  const iv = Buffer.from(ivB64, 'base64');
+  const authTag = Buffer.from(authTagB64, 'base64');
+  const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
+  decipher.setAuthTag(authTag);
+
+  let decrypted = decipher.update(ciphertext, 'base64', 'utf8');
+  decrypted += decipher.final('utf8');
+  return decrypted;
+}
+
+/**
+ * Derive a 256-bit encryption key.
+ * Uses ADRATA_ENCRYPTION_KEY if set, otherwise derives from hostname + username.
+ */
+function getEncryptionKey() {
+  const source = process.env.ADRATA_ENCRYPTION_KEY
+    || `adrata-mcp-${process.env.USER || 'default'}-${os.hostname()}`;
+  return crypto.createHash('sha256').update(source).digest();
+}
+
+// ---------------------------------------------------------------------------
+// 5. CORS Restrictions
+// ---------------------------------------------------------------------------
+
+/**
+ * Allowed origins for HTTP/SSE transport in production.
+ */
+const ALLOWED_ORIGINS = new Set([
+  'https://app.adrata.com',
+  'https://adrata.com',
+  'https://www.adrata.com',
+  'https://staging.adrata.com',
+]);
+
+/**
+ * Check if an origin is allowed for CORS.
+ * In development mode, all origins are allowed.
+ *
+ * @param {string} origin — the Origin header value
+ * @returns {boolean}
+ */
+export function isOriginAllowed(origin) {
+  if (!IS_PRODUCTION) return true;
+  if (!origin) return false;
+
+  // Allow configured origins
+  if (ALLOWED_ORIGINS.has(origin)) return true;
+
+  // Allow custom origins from env
+  const customOrigins = process.env.ADRATA_ALLOWED_ORIGINS;
+  if (customOrigins) {
+    const extras = customOrigins.split(',').map(s => s.trim());
+    if (extras.includes(origin)) return true;
+  }
+
+  return false;
+}
+
+/**
+ * Get CORS headers for an HTTP response.
+ *
+ * @param {string} origin — the request Origin header
+ * @returns {object} — headers to set on the response
+ */
+export function getCorsHeaders(origin) {
+  const headers = {
+    'X-Content-Type-Options': 'nosniff',
+    'X-Frame-Options': 'DENY',
+    'X-XSS-Protection': '1; mode=block',
+    'Referrer-Policy': 'strict-origin-when-cross-origin',
+  };
+
+  if (IS_PRODUCTION) {
+    headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains';
+  }
+
+  if (origin && isOriginAllowed(origin)) {
+    headers['Access-Control-Allow-Origin'] = origin;
+    headers['Access-Control-Allow-Methods'] = 'GET, POST, OPTIONS';
+    headers['Access-Control-Allow-Headers'] = 'Content-Type, Authorization, X-API-Key';
+    headers['Access-Control-Max-Age'] = '86400';
+  }
+
+  return headers;
+}
+
+// ---------------------------------------------------------------------------
+// 6. Transport Security
+// ---------------------------------------------------------------------------
+
+/**
+ * Check if the SSE transport is using TLS in production.
+ * Returns a warning if HTTP is detected in production mode.
+ *
+ * @param {string} url — the transport URL
+ * @returns {{ secure: boolean, warning: string|null }}
+ */
+export function checkTransportSecurity(url) {
+  if (!IS_PRODUCTION) {
+    return { secure: true, warning: null };
+  }
+
+  if (url && url.startsWith('http://')) {
+    return {
+      secure: false,
+      warning: 'SSE transport requires TLS (HTTPS) in production. HTTP connections are rejected.',
+    };
+  }
+
+  return { secure: true, warning: null };
+}
+
+// ---------------------------------------------------------------------------
+// 7. IP Allowlisting (Enterprise)
+// ---------------------------------------------------------------------------
+
+/**
+ * Check if an IP is in the enterprise allowlist.
+ * If no allowlist is configured, all IPs are allowed.
+ *
+ * @param {string} ip — the client IP
+ * @returns {boolean}
+ */
+export function isIpAllowed(ip) {
+  const allowlist = process.env.ADRATA_IP_ALLOWLIST;
+  if (!allowlist) return true;
+
+  const allowed = allowlist.split(',').map(s => s.trim());
+  return allowed.includes(ip);
+}
+
+// ---------------------------------------------------------------------------
+// 8. Security Middleware — Wraps the tool registry
+// ---------------------------------------------------------------------------
+
+/**
+ * Create the security layer that wraps the MCP server's tool registry.
+ *
+ * @param {object} server — the McpServer instance
+ * @param {object} auth — the auth context from authenticate()
+ * @param {Function} apiFn — the api() helper for making Rust API calls
+ * @returns {{ auditLogger: AuditLogger, rateLimiter: SlidingWindowRateLimiter }}
+ */
+/**
+ * Classify a tool call for the audit log.
+ *
+ * The composite `manage_*` tools carry their real verb in `args.action`, so a
+ * name-prefix guess logs every one of them as "execute" — including deletes.
+ * Read the action when there is one; fall back to the name otherwise.
+ *
+ * @param {string} name
+ * @param {object} args
+ * @returns {'create'|'read'|'update'|'delete'|'execute'}
+ */
+export function auditActionFor(name, args) {
+  const action = args && typeof args.action === 'string' ? args.action.toLowerCase() : null;
+  if (action) {
+    if (action === 'delete' || action.startsWith('remove')) return 'delete';
+    if (action === 'create') return 'create';
+    if (action === 'update') return 'update';
+    if (action === 'get' || action === 'list' || action.startsWith('list_')
+        || action === 'search' || action === 'timeline') return 'read';
+    return 'execute';
+  }
+  if (/^(delete|remove|bulk_delete)/.test(name)) return 'delete';
+  if (name.startsWith('create')) return 'create';
+  if (name.startsWith('update')) return 'update';
+  return 'execute';
+}
+
+/**
+ * Tools that must be audited even though their annotations say read-only.
+ *
+ * Mass-egress reads move whole datasets out of the workspace and belong in the
+ * audit trail; the extensibility inspection tools were audited under the old
+ * hand-kept list and stay audited (their headless-operation policy declares
+ * audit events for them).
+ */
+const AUDIT_ALWAYS = new Set([
+  'export_data', 'bulk_import',
+  'inspect_provider_catalog', 'list_provider_endpoints',
+]);
+
+/**
+ * Whether a tool call must be written to the audit log.
+ *
+ * Derived from the tool's real behaviour annotations (anything that is not
+ * read-only gets audited), NOT from a hand-kept allowlist. The old `crudTools`
+ * set silently excluded the most dangerous tools on the server —
+ * adrata_api_request, export_data, bulk_import, enroll_contacts,
+ * purchase_domain, paper_send_email, every partner write, and the paper
+ * deletes — so none of them left an audit trail.
+ *
+ * @param {string} name
+ * @returns {boolean}
+ */
+export function mustAuditTool(name) {
+  if (AUDIT_ALWAYS.has(name)) return true;
+  return !buildToolAnnotations(name).readOnlyHint;
+}
+
+export function applySecurityLayer(server, authOrProvider, apiFn) {
+  const getAuth = typeof authOrProvider === 'function' ? authOrProvider : () => authOrProvider;
+  const auditLogger = new AuditLogger(apiFn);
+  const localSessionKey = `stdio-${crypto.randomUUID()}`;
+
+  function securityContext() {
+    const auth = getAuth() || { tier: 'free' };
+    // Hosted transport supplies an opaque, process-keyed principal. Never use
+    // bearer tokens or API keys themselves as rate-limit map keys.
+    const sessionKey = auth.securityPrincipal || localSessionKey;
+    return { auth, sessionKey };
+  }
+
+  // Wrap server.tool to add security layers around every handler
+  const _currentTool = server.tool.bind(server);
+  server.tool = function securedTool(name, ...rest) {
+    const handler = rest[rest.length - 1];
+    rest[rest.length - 1] = async function securedHandler(...handlerArgs) {
+      const { auth, sessionKey } = securityContext();
+      // --- Rate limiting ---
+      const rateCheck = checkRateLimit(sessionKey, auth.tier);
+      if (!rateCheck.allowed) {
+        return rateLimitResponse(rateCheck.retryAfterMs);
+      }
+
+      // --- Input validation ---
+      // handlerArgs[0] is the tool arguments object
+      const rawArgs = handlerArgs[0] || {};
+      const validation = validateToolInput(name, rawArgs);
+      if (!validation.valid) {
+        return validationErrorResponse(validation.error);
+      }
+      // Replace args with sanitized version
+      handlerArgs[0] = validation.args;
+
+      // --- Execute the tool ---
+      const result = await handler(...handlerArgs);
+
+      // --- Audit logging (enterprise tier; every non-read tool + mass egress) ---
+      if (auth.tier === 'enterprise' && mustAuditTool(name)) {
+        auditLogger.log({
+          tool: name,
+          action: auditActionFor(name, rawArgs),
+          tier: auth.tier,
+          userId: auth.userId || null,
+          sessionKey,
+          args: rawArgs,
+        });
+      }
+
+      return result;
+    };
+    return _currentTool(name, ...rest);
+  };
+
+  return { auditLogger, rateLimiter };
+}
+
+// ---------------------------------------------------------------------------
+// Exports for testing
+// ---------------------------------------------------------------------------
+
+export {
+  SlidingWindowRateLimiter,
+  AuditLogger,
+  redactSensitiveFields,
+  TIER_RATE_LIMITS,
+};