@cyberismo/backend 0.0.24 → 0.0.26

package/src/domain/mcp/index.ts

@@ -14,19 +14,21 @@
 import { Hono } from 'hono';
 import { randomUUID } from 'node:crypto';
 import { WebStandardStreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js';
-import { createMcpServer } from '@cyberismo/mcp/server';
-import type { CommandManager } from '@cyberismo/data-handler';
+import { createMcpServer, type ProjectProvider } from '@cyberismo/mcp';
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { requireRole } from '../../middleware/auth.js';
+import { UserRole, type AppVars } from '../../types.js';
 
 const MAX_SESSIONS = 100;
+const MAX_SESSIONS_PER_USER = 5;
 const SESSION_TIMEOUT_MS = 30 * 60 * 1000; // 30 minutes
 const CLEANUP_INTERVAL_MS = 5 * 60 * 1000; // 5 minutes
 
 interface McpSession {
   transport: WebStandardStreamableHTTPServerTransport;
   server: McpServer;
-  commands: CommandManager;
   lastActivity: number;
+  userId: string;
 }
 
 const sessions = new Map<string, McpSession>();
@@ -71,89 +73,92 @@ const cleanupInterval = setInterval(() => {
 }, CLEANUP_INTERVAL_MS);
 cleanupInterval.unref();
 
-const router = new Hono();
-
 /**
- * MCP HTTP endpoint handler.
- * Supports GET (SSE streaming), POST (messages), and DELETE (session cleanup).
+ * Create an MCP HTTP router that serves all projects via the given provider.
  */
-router.all('/', async (c) => {
-  const commands = c.get('commands');
-  const sessionId = c.req.header('mcp-session-id');
-
-  // Handle DELETE before routing to existing session so it always runs cleanup
-  if (c.req.method === 'DELETE') {
-    if (sessionId) {
-      await destroySession(sessionId);
+export function createMcpRouter(
+  provider: ProjectProvider,
+): Hono<{ Variables: AppVars }> {
+  const router = new Hono<{ Variables: AppVars }>();
+
+  /**
+   * MCP HTTP endpoint handler.
+   * Supports POST (messages) and DELETE (session cleanup).
+   */
+  router.all('/', requireRole(UserRole.Editor), async (c) => {
+    const sessionId = c.req.header('mcp-session-id');
+
+    // Handle DELETE before routing to existing session so it always runs cleanup
+    if (c.req.method === 'DELETE') {
+      if (sessionId) {
+        await destroySession(sessionId);
+      }
+      return c.json({ message: 'Session closed' });
     }
-    return c.json({ message: 'Session closed' });
-  }
-
-  // Handle existing session
-  if (sessionId && sessions.has(sessionId)) {
-    const session = sessions.get(sessionId)!;
-    session.lastActivity = Date.now();
-    const response = await session.transport.handleRequest(c.req.raw);
-    return response;
-  }
-
-  // Only allow POST to create new sessions (initialize)
-  if (c.req.method !== 'POST') {
-    return c.json(
-      { error: 'Method not allowed. Use POST to initialize a session.' },
-      405,
-    );
-  }
-
-  // Reject new sessions when at capacity
-  if (sessions.size >= MAX_SESSIONS) {
-    return c.json({ error: 'Too many active sessions' }, 503);
-  }
-
-  // Create new session for initialization
-  const transport = new WebStandardStreamableHTTPServerTransport({
-    sessionIdGenerator: () => randomUUID(),
-    onsessioninitialized: (newSessionId: string) => {
-      sessions.set(newSessionId, {
-        transport,
-        server,
-        commands,
-        lastActivity: Date.now(),
-      });
-    },
-    onsessionclosed: (closedSessionId: string) => {
-      void destroySession(closedSessionId, true);
-    },
-  });
 
-  transport.onclose = () => {
-    const sid = transport.sessionId;
-    if (sid) {
-      void destroySession(sid, true);
+    // Handle existing session
+    if (sessionId && sessions.has(sessionId)) {
+      const session = sessions.get(sessionId)!;
+      session.lastActivity = Date.now();
+      const response = await session.transport.handleRequest(c.req.raw);
+      return response;
     }
-  };
 
-  const server = createMcpServer(commands);
-  await server.connect(transport);
+    // Reject requests with an unknown session ID (e.g. after server restart)
+    if (sessionId) {
+      return c.json({ error: 'Unknown session ID' }, 404);
+    }
 
-  const response = await transport.handleRequest(c.req.raw);
-  return response;
-});
+    // Only allow POST to create new sessions (initialize)
+    if (c.req.method !== 'POST') {
+      return c.json(
+        { error: 'Method not allowed. Use POST to initialize a session.' },
+        405,
+      );
+    }
 
-/**
- * SSE endpoint for server-to-client messages
- */
-router.get('/sse', async (c) => {
-  const sessionId = c.req.header('mcp-session-id');
+    // Reject new sessions when at capacity
+    if (sessions.size >= MAX_SESSIONS) {
+      return c.json({ error: 'Too many active sessions' }, 503);
+    }
 
-  if (!sessionId || !sessions.has(sessionId)) {
-    return c.json({ error: 'Invalid or missing session ID' }, 400);
-  }
+    const user = c.get('user')!;
+    const userSessionCount = [...sessions.values()].filter(
+      (s) => s.userId === user.id,
+    ).length;
+    if (userSessionCount >= MAX_SESSIONS_PER_USER) {
+      return c.json({ error: 'Too many active sessions for this user' }, 503);
+    }
 
-  const session = sessions.get(sessionId)!;
-  session.lastActivity = Date.now();
-  const response = await session.transport.handleRequest(c.req.raw);
-  return response;
-});
+    // Create new session for initialization
+    const transport = new WebStandardStreamableHTTPServerTransport({
+      sessionIdGenerator: () => randomUUID(),
+      onsessioninitialized: (newSessionId: string) => {
+        sessions.set(newSessionId, {
+          transport,
+          server,
+          lastActivity: Date.now(),
+          userId: user.id,
+        });
+      },
+      onsessionclosed: (closedSessionId: string) => {
+        void destroySession(closedSessionId, true);
+      },
+    });
+
+    transport.onclose = () => {
+      const sid = transport.sessionId;
+      if (sid) {
+        void destroySession(sid, true);
+      }
+    };
+
+    const server = createMcpServer(provider);
+    await server.connect(transport);
+
+    const response = await transport.handleRequest(c.req.raw);
+    return response;
+  });
 
-export default router;
+  return router;
+}

package/src/domain/projects/index.ts

@@ -0,0 +1,39 @@
+/**
+  Cyberismo
+  Copyright © Cyberismo Ltd and contributors 2026
+  This program is free software: you can redistribute it and/or modify it under
+  the terms of the GNU Affero General Public License version 3 as published by
+  the Free Software Foundation.
+  This program is distributed in the hope that it will be useful, but WITHOUT
+  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+  FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
+  details. You should have received a copy of the GNU Affero General Public
+  License along with this program. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import { Hono } from 'hono';
+import type { ProjectRegistry } from '../../project-registry.js';
+import { requireRole } from '../../middleware/auth.js';
+import { UserRole } from '../../types.js';
+
+export function createProjectsRouter(registry: ProjectRegistry) {
+  const router = new Hono();
+
+  /**
+   * @swagger
+   * /api/projects:
+   *   get:
+   *     summary: List available projects
+   *     description: Returns a list of all available projects
+   *     responses:
+   *       200:
+   *         description: List of projects
+   *       401:
+   *         description: Unauthorized
+   */
+  router.get('/', requireRole(UserRole.Reader), (c) => {
+    return c.json(registry.list());
+  });
+
+  return router;
+}

package/src/domain/resources/service.ts

@@ -372,6 +372,7 @@ async function processTemplates(
             'templates',
             template,
             projectPrefix,
+            [],
           ),
         );
       }
@@ -390,6 +391,7 @@ async function processTemplates(
             'templates',
             template,
             projectPrefix,
+            [],
           ),
         );
       }

package/src/export.ts

@@ -18,6 +18,7 @@ import fs, { readFile } from 'node:fs/promises';
 import type { CommandManager } from '@cyberismo/data-handler';
 import { createApp } from './app.js';
 import { MockAuthProvider } from './auth/mock.js';
+import type { ProjectRegistry } from './project-registry.js';
 import { cp, writeFile } from 'node:fs/promises';
 import { staticFrontendDirRelative } from './utils.js';
 import type { QueryResult } from '@cyberismo/data-handler/types/queries';
@@ -28,7 +29,11 @@ import {
   findRelevantAttachments,
 } from './domain/cards/service.js';
 
-let _cardQueryPromise: Promise<QueryResult<'card'>[]> | null = null;
+export interface ExportSiteOptions extends TreeOptions {
+  defaultProject?: string;
+}
+
+const _cardQueryCache = new Map<string, Promise<QueryResult<'card'>[]>>();
 const OVERHEAD_CALLS = 6; // estimated number of overhead calls during export in addition to card exports
 
 /**
@@ -36,7 +41,7 @@ const OVERHEAD_CALLS = 6; // estimated number of overhead calls during export in
  * Also resets the card query promise.
  */
 export function reset() {
-  _cardQueryPromise = null;
+  _cardQueryCache.clear();
 }
 
 /**
@@ -50,15 +55,14 @@ export async function getCardQueryResult(
   commands: CommandManager,
   cardKey?: string,
 ): Promise<QueryResult<'card'>[]> {
-  if (!_cardQueryPromise) {
-    // fetch all cards
-    _cardQueryPromise = commands.calculateCmd.runQuery(
-      'card',
-      'exportedSite',
-      {},
+  const prefix = commands.project.configuration.cardKeyPrefix;
+  if (!_cardQueryCache.has(prefix)) {
+    _cardQueryCache.set(
+      prefix,
+      commands.calculateCmd.runQuery('card', 'exportedSite', {}),
     );
   }
-  return _cardQueryPromise.then((results) => {
+  return _cardQueryCache.get(prefix)!.then((results) => {
     if (!cardKey) {
       return results;
     }
@@ -73,29 +77,38 @@ export async function getCardQueryResult(
 /**
  * Export the site to a given directory.
  * Note: Do not call this function in parallel.
- * @param commands - CommandManager instance for the project.
+ * @param registry - ProjectRegistry holding all project CommandManagers.
  * @param exportDir - Directory to export to.
  * @param options - Export options.
  * @param options.recursive - Whether to export cards recursively.
  * @param options.cardKey - Key of the card to export. If not provided, all cards will be exported.
- * @param level - Log level for the operation.
+ * @param options.defaultProject - Default project prefix to write into config.json.
  * @param onProgress - Optional progress callback function.
  * @returns An object containing any errors that occurred during export.
  */
 export async function exportSite(
-  commands: CommandManager,
+  registry: ProjectRegistry,
   exportDir?: string,
-  options?: TreeOptions,
+  options?: ExportSiteOptions,
   onProgress?: (current: number, total: number) => void,
 ): Promise<{ errors: string[] }> {
   exportDir = exportDir || 'static';
-  const opts = {
+  const { defaultProject, ...treeOpts } = options ?? {};
+  const opts: TreeOptions = {
     recursive: false,
-    cardKey: undefined,
-    ...options,
+    ...treeOpts,
   };
 
-  const app = createApp(new MockAuthProvider(), commands, opts);
+  if (defaultProject && !registry.has(defaultProject)) {
+    throw new Error(
+      `Default project '${defaultProject}' is not in the registry. Available: ${registry
+        .list()
+        .map((p) => p.prefix)
+        .join(', ')}`,
+    );
+  }
+
+  const app = createApp(new MockAuthProvider(), registry, opts, true);
 
   // copy whole frontend to the same directory
   await cp(staticFrontendDirRelative, exportDir, { recursive: true });
@@ -103,6 +116,9 @@ export async function exportSite(
   const config = await readFile(path.join(exportDir, 'config.json'), 'utf-8');
   const configJson = JSON.parse(config);
   configJson.staticMode = true;
+  if (defaultProject) {
+    configJson.defaultProject = defaultProject;
+  }
   await writeFile(
     path.join(exportDir, 'config.json'),
     JSON.stringify(configJson),
@@ -110,10 +126,13 @@ export async function exportSite(
 
   reset();
 
-  // estimate total based on the number of cards to export
-  const cards = await findAllCards(commands, opts);
-  const attachments = await findRelevantAttachments(commands, opts);
-  let total = cards.length + attachments.length + OVERHEAD_CALLS;
+  // estimate total based on the number of cards to export across all projects
+  let total = OVERHEAD_CALLS;
+  for (const commands of registry.values()) {
+    const cards = await findAllCards(commands, opts);
+    const attachments = await findRelevantAttachments(commands, opts);
+    total += cards.length + attachments.length;
+  }
 
   // Actual export with progress reporting
   let done = 0;
@@ -130,6 +149,10 @@ export async function exportSite(
           if (url.pathname.startsWith('/mcp')) {
             return false;
           }
+          // Skip OIDC/well-known routes — not relevant for static export
+          if (url.pathname.startsWith('/.well-known')) {
+            return false;
+          }
           return req;
         },
         afterResponseHook: async (response) => {

package/src/index.ts

@@ -16,14 +16,15 @@ import { Hono } from 'hono';
 import { serveStatic } from '@hono/node-server/serve-static';
 import path from 'node:path';
 import { readFile } from 'node:fs/promises';
-import type { CommandManager } from '@cyberismo/data-handler';
 import { findFreePort } from './utils.js';
 import { createApp } from './app.js';
 import type { AuthProvider } from './auth/types.js';
+import type { ProjectRegistry } from './project-registry.js';
 export { MockAuthProvider } from './auth/mock.js';
 export type { MockUserConfig } from './auth/mock.js';
 export type { AuthProvider } from './auth/types.js';
-export { exportSite } from './export.js';
+export { exportSite, type ExportSiteOptions } from './export.js';
+export { ProjectRegistry } from './project-registry.js';
 
 const DEFAULT_PORT = 3000;
 const DEFAULT_MAX_PORT = DEFAULT_PORT + 100;
@@ -56,12 +57,12 @@ export async function previewSite(dir: string, findPort: boolean = true) {
 /**
  * Start the server
  * @param authProvider - Authentication provider
- * @param commands - CommandManager instance for the project
+ * @param registry - ProjectRegistry holding all project CommandManagers
  * @param findPort - If true, find a free port
  */
 export async function startServer(
   authProvider: AuthProvider,
-  commands: CommandManager,
+  registry: ProjectRegistry,
   findPort: boolean = true,
 ) {
   let port = parseInt(process.env.PORT || DEFAULT_PORT.toString(), 10);
@@ -69,7 +70,7 @@ export async function startServer(
   if (findPort) {
     port = await findFreePort(port, DEFAULT_MAX_PORT);
   }
-  const app = createApp(authProvider, commands);
+  const app = createApp(authProvider, registry);
   startApp(app, port);
 }
 

package/src/main.ts

@@ -10,12 +10,14 @@
   details. You should have received a copy of the GNU Affero General Public
   License along with this program. If not, see <https://www.gnu.org/licenses/>.
 */
-import { CommandManager } from '@cyberismo/data-handler';
+import { scanForProjects } from '@cyberismo/data-handler';
 import { startServer } from './index.js';
 import { exportSite } from './export.js';
 import { MockAuthProvider } from './auth/mock.js';
 import { KeycloakAuthProvider } from './auth/keycloak.js';
 import type { AuthProvider } from './auth/types.js';
+import { ProjectRegistry } from './project-registry.js';
+import { parseArgs } from 'node:util';
 import dotenv from 'dotenv';
 
 // Load environment variables from .env file
@@ -55,12 +57,50 @@ function createAuthProvider(): AuthProvider {
   process.exit(1);
 }
 
-const projectPath = process.env.npm_config_project_path || '';
-const commands = await CommandManager.getInstance(projectPath);
+const projectPath = process.env.npm_config_project_path || process.cwd();
+let projects;
+try {
+  projects = await scanForProjects(projectPath);
+} catch (error) {
+  console.error(
+    error instanceof Error
+      ? error.message
+      : `Failed to scan for projects in '${projectPath}'`,
+  );
+  process.exit(1);
+}
+
+const { values: args } = parseArgs({
+  options: {
+    export: { type: 'boolean', default: false },
+    'default-project': { type: 'string' },
+  },
+  strict: false,
+});
 
-if (process.argv.includes('--export')) {
-  await exportSite(commands);
+if (args.export) {
+  if (projects.length === 0) {
+    console.error('No projects found to export.');
+    process.exit(1);
+  }
+  const registry = await ProjectRegistry.fromScannedProjects(projects);
+  await exportSite(registry, undefined, {
+    defaultProject:
+      typeof args['default-project'] === 'string'
+        ? args['default-project']
+        : undefined,
+  });
 } else {
+  if (projects.length === 0) {
+    console.error(
+      `No projects found in "${projectPath}". Cannot start the server without at least one project.`,
+    );
+    process.exit(1);
+  }
+  const autocommit = process.env.CYBERISMO_AUTOCOMMIT === 'true';
+  const registry = await ProjectRegistry.fromScannedProjects(projects, {
+    autocommit,
+  });
   const authProvider = createAuthProvider();
-  await startServer(authProvider, commands);
+  await startServer(authProvider, registry);
 }

package/src/middleware/auth.ts

@@ -42,6 +42,16 @@ export function createAuthMiddleware(
     if (user) {
       c.set('user', user);
     } else {
+      // RFC 9728 §5.1: include resource_metadata in WWW-Authenticate
+      // only for MCP routes, where the metadata document applies.
+      const issuer = process.env.OIDC_ISSUER;
+      if (issuer && c.req.path.startsWith('/mcp')) {
+        const origin = new URL(issuer).origin;
+        const resourceUrl = `${origin}/.well-known/oauth-protected-resource/mcp`;
+        return c.json({ error: 'Unauthorized' }, 401, {
+          'WWW-Authenticate': `Bearer resource_metadata="${resourceUrl}"`,
+        });
+      }
       return c.json({ error: 'Unauthorized' }, 401);
     }
 

package/src/middleware/commandManager.ts

@@ -13,28 +13,66 @@
 import type { Context, MiddlewareHandler } from 'hono';
 import type { CommandManager } from '@cyberismo/data-handler';
 import { getCurrentUser } from './auth.js';
+import type { ProjectRegistry } from '../project-registry.js';
 
 // Extend Hono Context type to include our custom properties
 declare module 'hono' {
   interface ContextVariableMap {
     commands: CommandManager;
     projectPath: string;
+    registry: ProjectRegistry;
   }
 }
 
+/**
+ * Set CommandManager on context and run the next handler as the authenticated user.
+ */
+async function runWithCommands(
+  c: Context,
+  commands: CommandManager,
+  next: () => Promise<void>,
+) {
+  const user = getCurrentUser(c);
+  if (!user) {
+    throw new Error('CommandManager expects a user');
+  }
+  c.set('commands', commands);
+  c.set('projectPath', commands.project.basePath);
+  await commands.runAsAuthor({ name: user.name, email: user.email }, () =>
+    next(),
+  );
+}
+
+// TODO: Remove once MCP is made project-scoped via attachProjectRegistry
 export const attachCommandManager = (
   commands: CommandManager,
+): MiddlewareHandler => {
+  return (c, next) => runWithCommands(c, commands, next);
+};
+
+/**
+ * Middleware that resolves the project from the registry and sets the
+ * CommandManager on context.
+ *
+ * @param registry - Project registry to look up projects.
+ * @param fixedPrefix - When provided, used instead of the `:prefix` route
+ *   param. This is needed in export/SSG mode where routes are mounted at
+ *   concrete paths (e.g. `/api/projects/decision/...`) with no dynamic param.
+ */
+export const attachProjectRegistry = (
+  registry: ProjectRegistry,
+  fixedPrefix?: string,
 ): MiddlewareHandler => {
   return async (c: Context, next) => {
-    c.set('commands', commands);
-    c.set('projectPath', commands.project.basePath);
-    const user = getCurrentUser(c);
-    if (user) {
-      await commands.runAsAuthor({ name: user.name, email: user.email }, () =>
-        next(),
-      );
-    } else {
-      throw new Error('CommandManager expects a user');
+    c.set('registry', registry);
+    const prefix = c.req.param('prefix') ?? fixedPrefix;
+    if (!prefix) {
+      return c.json({ error: 'Project prefix is required' }, 400);
+    }
+    const commands = registry.get(prefix);
+    if (!commands) {
+      return c.json({ error: `Project '${prefix}' not found` }, 404);
     }
+    return runWithCommands(c, commands, next);
   };
 };