@coffeerunhobby/mcp-ha-connect 2.2.1 → 2.3.1

package/src/resources/index.ts

@@ -1,213 +0,0 @@
-/**
- * MCP Resources Registry
- * Provides URI-based access to Home Assistant entities
- */
-
-import { ResourceTemplate } from '@modelcontextprotocol/server';
-import type { McpServer, Variables } from '@modelcontextprotocol/server';
-import type { HaClient } from '../haClient/index.js';
-import { logger } from '../utils/logger.js';
-
-/**
- * Register all Home Assistant resources with the MCP server
- */
-export function registerAllResources(server: McpServer, client: HaClient): void {
-  logger.debug('Registering MCP resources');
-
-  // Static resource: List all entities grouped by domain
-  server.registerResource(
-    'All Entities',
-    'hass://entities',
-    {
-      description: 'List all Home Assistant entities grouped by domain',
-      mimeType: 'application/json',
-    },
-    async () => {
-      const entities = await client.getStates();
-
-      // Group by domain
-      const grouped: Record<string, Array<{ entity_id: string; state: string; friendly_name?: string }>> = {};
-      for (const entity of entities) {
-        const domain = entity.entity_id.split('.')[0];
-        if (!grouped[domain]) {
-          grouped[domain] = [];
-        }
-        grouped[domain].push({
-          entity_id: entity.entity_id,
-          state: entity.state,
-          friendly_name: entity.attributes.friendly_name as string | undefined,
-        });
-      }
-
-      return {
-        contents: [
-          {
-            uri: 'hass://entities',
-            mimeType: 'application/json',
-            text: JSON.stringify({
-              total: entities.length,
-              domains: Object.keys(grouped).length,
-              entities: grouped,
-            }, null, 2),
-          },
-        ],
-      };
-    }
-  );
-
-  // Template resource: Get specific entity state
-  server.registerResource(
-    'Entity State',
-    new ResourceTemplate('hass://entities/{entity_id}', { list: undefined }),
-    {
-      description: 'Get the current state of a specific Home Assistant entity',
-      mimeType: 'application/json',
-    },
-    async (uri: URL, variables: Variables) => {
-      const entityId = variables.entity_id as string;
-      const entity = await client.getState(entityId);
-
-      if (!entity) {
-        return {
-          contents: [
-            {
-              uri: uri.href,
-              mimeType: 'application/json',
-              text: JSON.stringify({ error: 'Entity not found', entity_id: entityId, hint: 'Use the searchEntities tool with a keyword to find the correct entity_id' }),
-            },
-          ],
-        };
-      }
-
-      return {
-        contents: [
-          {
-            uri: uri.href,
-            mimeType: 'application/json',
-            text: JSON.stringify({
-              entity_id: entity.entity_id,
-              state: entity.state,
-              friendly_name: entity.attributes.friendly_name,
-              last_changed: entity.last_changed,
-            }, null, 2),
-          },
-        ],
-      };
-    }
-  );
-
-  // Template resource: Get detailed entity info
-  server.registerResource(
-    'Entity Detailed',
-    new ResourceTemplate('hass://entities/{entity_id}/detailed', { list: undefined }),
-    {
-      description: 'Get detailed information about an entity including all attributes',
-      mimeType: 'application/json',
-    },
-    async (uri: URL, variables: Variables) => {
-      const entityId = variables.entity_id as string;
-      const entity = await client.getState(entityId);
-
-      if (!entity) {
-        return {
-          contents: [
-            {
-              uri: uri.href,
-              mimeType: 'application/json',
-              text: JSON.stringify({ error: 'Entity not found', entity_id: entityId, hint: 'Use the searchEntities tool with a keyword to find the correct entity_id' }),
-            },
-          ],
-        };
-      }
-
-      return {
-        contents: [
-          {
-            uri: uri.href,
-            mimeType: 'application/json',
-            text: JSON.stringify({
-              entity_id: entity.entity_id,
-              state: entity.state,
-              attributes: entity.attributes,
-              last_changed: entity.last_changed,
-              last_updated: entity.last_updated,
-              context: entity.context,
-            }, null, 2),
-          },
-        ],
-      };
-    }
-  );
-
-  // Template resource: Get entities by domain
-  server.registerResource(
-    'Domain Entities',
-    new ResourceTemplate('hass://entities/domain/{domain}', { list: undefined }),
-    {
-      description: 'Get all entities for a specific domain',
-      mimeType: 'application/json',
-    },
-    async (uri: URL, variables: Variables) => {
-      const domain = variables.domain as string;
-      const entities = await client.getEntitiesByDomain(domain);
-
-      return {
-        contents: [
-          {
-            uri: uri.href,
-            mimeType: 'application/json',
-            text: JSON.stringify({
-              domain,
-              count: entities.length,
-              entities: entities.map(e => ({
-                entity_id: e.entity_id,
-                state: e.state,
-                friendly_name: e.attributes.friendly_name,
-              })),
-            }, null, 2),
-          },
-        ],
-      };
-    }
-  );
-
-  // Template resource: Search entities
-  server.registerResource(
-    'Search Entities',
-    new ResourceTemplate('hass://search/{query}/{limit}', { list: undefined }),
-    {
-      description: 'Search for entities matching a query with result limit',
-      mimeType: 'application/json',
-    },
-    async (uri: URL, variables: Variables) => {
-      const queryStr = decodeURIComponent(variables.query as string);
-      const limitNum = parseInt(variables.limit as string || '50', 10);
-
-      let entities = await client.searchEntities(queryStr);
-      if (limitNum > 0) {
-        entities = entities.slice(0, limitNum);
-      }
-
-      return {
-        contents: [
-          {
-            uri: uri.href,
-            mimeType: 'application/json',
-            text: JSON.stringify({
-              query: queryStr,
-              limit: limitNum,
-              count: entities.length,
-              entities: entities.map(e => ({
-                entity_id: e.entity_id,
-                state: e.state,
-                friendly_name: e.attributes.friendly_name,
-              })),
-            }, null, 2),
-          },
-        ],
-      };
-    }
-  );
-
-  logger.info('MCP resources registered successfully', { resourceCount: 5 });
-}

package/src/server/auth.ts

@@ -1,175 +0,0 @@
-/**
- * Bearer token authentication middleware for HTTP server
- */
-
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import type { AuthInfo } from '@modelcontextprotocol/server';
-import { verifyJwt, type JwtPayload } from '../utils/jwt.js';
-import { defaultRoleWarning, getUserPermissions, Role, type PermissionsConfig } from '../permissions/index.js';
-import { logger } from '../utils/logger.js';
-
-export type AuthMethod = 'none' | 'bearer';
-
-export interface AuthConfig {
-  method: AuthMethod;
-  secret?: string;
-  permissions?: PermissionsConfig;
-  skipPaths?: string[];
-  /** Reject tokens without an exp claim (H3). */
-  requireExp?: boolean;
-  /** Expected JWT issuer, if any (L6). */
-  issuer?: string;
-  /** Expected JWT audience, if any (L6). */
-  audience?: string;
-}
-
-/** Emit the "no exp" advisory at most once per process. */
-let warnedNoExp = false;
-
-export interface AuthResult {
-  authenticated: boolean;
-  payload?: JwtPayload;
-  permissions?: number;
-  error?: string;
-}
-
-/** Extended request with MCP SDK compatible auth info */
-export interface AuthenticatedRequest extends IncomingMessage {
-  auth?: AuthInfo;
-}
-
-/**
- * Validate JWT from Authorization header
- */
-interface ClaimPolicy {
-  requireExp?: boolean;
-  issuer?: string;
-  audience?: string;
-}
-
-function validateJwt(
-  req: IncomingMessage,
-  secret: string,
-  permConfig?: PermissionsConfig,
-  policy: ClaimPolicy = {}
-): AuthResult {
-  const authHeader = req.headers.authorization;
-
-  if (!authHeader) {
-    return { authenticated: false, error: 'Missing Authorization header' };
-  }
-
-  if (!authHeader.startsWith('Bearer ')) {
-    return { authenticated: false, error: 'Expected: Bearer <token>' };
-  }
-
-  const token = authHeader.slice(7);
-  const result = verifyJwt(token, secret, {
-    requireExp: policy.requireExp,
-    issuer: policy.issuer,
-    audience: policy.audience,
-    clockSkewSec: 60,
-  });
-
-  if (!result.valid) {
-    return { authenticated: false, error: result.error };
-  }
-
-  // H3: warn (once) when accepting a token that can never expire.
-  if (!policy.requireExp && result.payload?.exp === undefined && !warnedNoExp) {
-    warnedNoExp = true;
-    logger.warn('Accepting a JWT without an exp claim; set MCP_AUTH_REQUIRE_EXP=true to enforce token expiry');
-  }
-
-  // Get user permissions from config.
-  // L3: fail closed when no permission map is configured — an authenticated token
-  // with no RBAC mapping gets NONE, never full access. (In the real server path
-  // `permConfig` is always supplied by loadConfig, so this is defense in depth.)
-  const permissions = permConfig
-    ? getUserPermissions(result.payload?.sub, permConfig)
-    : Role.NONE;
-
-  return { authenticated: true, payload: result.payload, permissions };
-}
-
-/**
- * Authentication middleware
- * Returns true if request should proceed, false if blocked
- */
-export function createAuthMiddleware(config: AuthConfig): (req: IncomingMessage, res: ServerResponse) => boolean {
-  const { method, secret, permissions: permConfig, skipPaths = [], requireExp, issuer, audience } = config;
-
-  // Loudly flag a permissive defaultRole: it silently grants every valid token whose
-  // sub is unmapped. Lives here (not in server startup) because this middleware is
-  // what applies defaultRole, so the warning cannot be bypassed.
-  if (method === 'bearer' && permConfig) {
-    const warning = defaultRoleWarning(permConfig);
-    if (warning) {
-      logger.warn(warning);
-    }
-  }
-
-  return (req: IncomingMessage, res: ServerResponse): boolean => {
-    if (method === 'none') {
-      // No auth = full permissions via AuthInfo.extra
-      (req as AuthenticatedRequest).auth = {
-        token: '',
-        clientId: 'anonymous',
-        scopes: [],
-        extra: { permissions: 0xFF },
-      };
-      return true;
-    }
-
-    // Check skip paths
-    const url = req.url ?? '/';
-    const path = url.split('?')[0];
-
-    if (skipPaths.some((p) => path === p || path.startsWith(p + '/'))) {
-      return true;
-    }
-
-    // Bearer auth (JWT)
-    if (method === 'bearer') {
-      if (!secret) {
-        logger.error('Bearer auth enabled but no secret configured');
-        res.statusCode = 500;
-        res.setHeader('Content-Type', 'application/json');
-        res.end(JSON.stringify({ error: 'Server misconfiguration' }));
-        return false;
-      }
-
-      const result = validateJwt(req, secret, permConfig, { requireExp, issuer, audience });
-
-      if (!result.authenticated) {
-        logger.warn('Auth failed', { path, error: result.error, ip: req.socket.remoteAddress });
-        res.statusCode = 401;
-        res.setHeader('Content-Type', 'application/json');
-        res.setHeader('WWW-Authenticate', 'Bearer');
-        res.end(JSON.stringify({ error: 'Unauthorized', message: result.error }));
-        return false;
-      }
-
-      // Attach AuthInfo to request (MCP SDK compatible format)
-      const authReq = req as AuthenticatedRequest;
-      const token = req.headers.authorization?.slice(7) ?? '';
-      authReq.auth = {
-        token,
-        clientId: result.payload?.sub ?? 'unknown',
-        scopes: [],
-        extra: {
-          permissions: result.permissions,
-          payload: result.payload,
-        },
-      };
-
-      logger.debug('Auth OK', { path, sub: result.payload?.sub, permissions: result.permissions });
-      return true;
-    }
-
-    res.statusCode = 500;
-    res.setHeader('Content-Type', 'application/json');
-    res.end(JSON.stringify({ error: 'Unknown auth method' }));
-    return false;
-  };
-}