@cyberismo/backend 1.1.2 → 1.3.0

package/src/domain/linkTypes/schema.ts

@@ -1,15 +1,5 @@
-/**
-  Cyberismo
-  Copyright © Cyberismo Ltd and contributors 2025
-  This program is free software: you can redistribute it and/or modify it under
-  the terms of the GNU Affero General Public License version 3 as published by
-  the Free Software Foundation.
-  This program is distributed in the hope that it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
-  FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
-  details. You should have received a copy of the GNU Affero General Public
-  License along with this program. If not, see <https://www.gnu.org/licenses/>.
-*/
+// SPDX-FileCopyrightText: Cyberismo Ltd and contributors
+// SPDX-License-Identifier: AGPL-3.0-only
 
 import { z } from 'zod';
 import { identifierSchema } from '../../common/validationSchemas.js';

package/src/domain/linkTypes/service.ts

@@ -1,34 +1,21 @@
-/**
-  Cyberismo
-  Copyright © Cyberismo Ltd and contributors 2025
-  This program is free software: you can redistribute it and/or modify it under
-  the terms of the GNU Affero General Public License version 3 as published by
-  the Free Software Foundation.
-  This program is distributed in the hope that it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
-  FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
-  details. You should have received a copy of the GNU Affero General Public
-  License along with this program. If not, see <https://www.gnu.org/licenses/>.
-*/
+// SPDX-FileCopyrightText: Cyberismo Ltd and contributors
+// SPDX-License-Identifier: AGPL-3.0-only
 
-import type { CommandManager } from '@cyberismo/data-handler';
+import type { Workspace } from '@cyberismo/data-handler';
 
-export async function getLinkTypes(commands: CommandManager) {
-  const response = await commands.showCmd.showResources('linkTypes');
+export async function getLinkTypes(ws: Workspace) {
+  const response = await ws.resources.list('linkTypes');
   if (!response) {
     throw new Error('No link types found');
   }
 
   const linkTypes = await Promise.all(
-    response.map((linkType: string) => commands.showCmd.showResource(linkType)),
+    response.map((linkType: string) => ws.resources.show(linkType)),
   );
 
   return linkTypes;
 }
 
-export async function createLinkType(
-  commands: CommandManager,
-  linkTypeName: string,
-) {
-  await commands.createCmd.createLinkType(linkTypeName);
+export async function createLinkType(ws: Workspace, linkTypeName: string) {
+  await ws.resources.create(linkTypeName, 'linkTypes', {});
 }

package/src/domain/logicPrograms/index.ts

@@ -1,15 +1,6 @@
-/**
-  Cyberismo
-  Copyright © Cyberismo Ltd and contributors 2025
-  This program is free software: you can redistribute it and/or modify it under
-  the terms of the GNU Affero General Public License version 3 as published by
-  the Free Software Foundation.
-  This program is distributed in the hope that it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
-  FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
-  details. You should have received a copy of the GNU Affero General Public
-  License along with this program. If not, see <https://www.gnu.org/licenses/>.
-*/
+// SPDX-FileCopyrightText: Cyberismo Ltd and contributors
+// SPDX-License-Identifier: AGPL-3.0-only
+
 import { Hono } from 'hono';
 
 import { zValidator } from '../../middleware/zvalidator.js';
@@ -25,12 +16,9 @@ router.get(
   requireRole(UserRole.Reader),
   zValidator('param', resourceParamsWithCard),
   async (c) => {
-    const commands = c.get('commands');
+    const ws = c.get('ws');
     const params = c.req.valid('param');
-    const logicProgram = await logicProgramService.getLogicProgram(
-      commands,
-      params,
-    );
+    const logicProgram = await logicProgramService.getLogicProgram(ws, params);
     return c.json({ logicProgram });
   },
 );

package/src/domain/logicPrograms/service.ts

@@ -1,25 +1,16 @@
-/**
-  Cyberismo
-  Copyright © Cyberismo Ltd and contributors 2025
-  This program is free software: you can redistribute it and/or modify it under
-  the terms of the GNU Affero General Public License version 3 as published by
-  the Free Software Foundation.
-  This program is distributed in the hope that it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
-  FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
-  details. You should have received a copy of the GNU Affero General Public
-  License along with this program. If not, see <https://www.gnu.org/licenses/>.
-*/
-import type { CommandManager } from '@cyberismo/data-handler';
+// SPDX-FileCopyrightText: Cyberismo Ltd and contributors
+// SPDX-License-Identifier: AGPL-3.0-only
+
+import type { Workspace } from '@cyberismo/data-handler';
 import type { ResourceParamsWithCard } from '../../common/validationSchemas.js';
 
 export async function getLogicProgram(
-  commands: CommandManager,
+  ws: Workspace,
   resource: ResourceParamsWithCard,
 ) {
   if (resource.type === 'cards') {
-    return commands.showCmd.showCardLogicProgram(resource.identifier);
+    return ws.cards.logicProgram(resource.identifier);
   } else {
-    return commands.showCmd.showLogicProgram(resource);
+    return ws.queries.logicProgram(resource);
   }
 }

package/src/domain/mcp/index.ts

@@ -1,23 +1,15 @@
-/**
-  Cyberismo
-  Copyright © Cyberismo Ltd and contributors 2025
-  This program is free software: you can redistribute it and/or modify it under
-  the terms of the GNU Affero General Public License version 3 as published by
-  the Free Software Foundation.
-  This program is distributed in the hope that it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
-  FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
-  details. You should have received a copy of the GNU Affero General Public
-  License along with this program. If not, see <https://www.gnu.org/licenses/>.
-*/
+// SPDX-FileCopyrightText: Cyberismo Ltd and contributors
+// SPDX-License-Identifier: AGPL-3.0-only
 
 import { Hono } from 'hono';
 import { randomUUID } from 'node:crypto';
 import { WebStandardStreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js';
-import { createMcpServer, type ProjectProvider } from '@cyberismo/mcp';
+import { createMcpServer, type McpUser } from '@cyberismo/mcp';
+import type { ProjectDirectory } from '@cyberismo/data-handler';
+import type { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types.js';
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { requireRole } from '../../middleware/auth.js';
-import { UserRole, type AppVars } from '../../types.js';
+import { UserRole, type AppVars, type UserInfo } from '../../types.js';
 
 const MAX_SESSIONS = 100;
 const MAX_SESSIONS_PER_USER = 5;
@@ -73,11 +65,22 @@ const cleanupInterval = setInterval(() => {
 }, CLEANUP_INTERVAL_MS);
 cleanupInterval.unref();
 
+// The request's user, in the form the MCP server builds its handle from.
+function authInfoOf(user: UserInfo): AuthInfo {
+  const mcpUser: McpUser = {
+    id: user.id,
+    name: user.name,
+    email: user.email,
+    kind: user.role === UserRole.Connector ? 'connector' : 'user',
+  };
+  return { token: '', clientId: user.id, scopes: [], extra: { user: mcpUser } };
+}
+
 /**
- * Create an MCP HTTP router that serves all projects via the given provider.
+ * Create an MCP HTTP router that serves all projects of the given directory.
  */
 export function createMcpRouter(
-  provider: ProjectProvider,
+  directory: ProjectDirectory,
 ): Hono<{ Variables: AppVars }> {
   const router = new Hono<{ Variables: AppVars }>();
 
@@ -86,21 +89,26 @@ export function createMcpRouter(
    * Supports POST (messages) and DELETE (session cleanup).
    */
   router.all('/', requireRole(UserRole.Editor), async (c) => {
+    const user = c.get('user')!;
     const sessionId = c.req.header('mcp-session-id');
+    // Another user's session is answered as if it did not exist.
+    const found = sessionId ? sessions.get(sessionId) : undefined;
+    const session = found?.userId === user.id ? found : undefined;
 
     // Handle DELETE before routing to existing session so it always runs cleanup
     if (c.req.method === 'DELETE') {
-      if (sessionId) {
-        await destroySession(sessionId);
+      if (session) {
+        await destroySession(sessionId!);
       }
       return c.json({ message: 'Session closed' });
     }
 
     // Handle existing session
-    if (sessionId && sessions.has(sessionId)) {
-      const session = sessions.get(sessionId)!;
+    if (session) {
       session.lastActivity = Date.now();
-      const response = await session.transport.handleRequest(c.req.raw);
+      const response = await session.transport.handleRequest(c.req.raw, {
+        authInfo: authInfoOf(user),
+      });
       return response;
     }
 
@@ -122,7 +130,6 @@ export function createMcpRouter(
       return c.json({ error: 'Too many active sessions' }, 503);
     }
 
-    const user = c.get('user')!;
     const userSessionCount = [...sessions.values()].filter(
       (s) => s.userId === user.id,
     ).length;
@@ -153,10 +160,12 @@ export function createMcpRouter(
       }
     };
 
-    const server = createMcpServer(provider);
+    const server = createMcpServer(directory);
     await server.connect(transport);
 
-    const response = await transport.handleRequest(c.req.raw);
+    const response = await transport.handleRequest(c.req.raw, {
+      authInfo: authInfoOf(user),
+    });
     return response;
   });
 

package/src/domain/project/index.ts

@@ -1,24 +1,17 @@
-/**
-  Cyberismo
-  Copyright © Cyberismo Ltd and contributors 2025
-  This program is free software: you can redistribute it and/or modify it under
-  the terms of the GNU Affero General Public License version 3 as published by
-  the Free Software Foundation.
-  This program is distributed in the hope that it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
-  FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
-  details. You should have received a copy of the GNU Affero General Public
-  License along with this program. If not, see <https://www.gnu.org/licenses/>.
-*/
+// SPDX-FileCopyrightText: Cyberismo Ltd and contributors
+// SPDX-License-Identifier: AGPL-3.0-only
 
 import { Hono } from 'hono';
+import { disableSSG } from 'hono/ssg';
 import { zValidator } from '../../middleware/zvalidator.js';
 import {
   addHubSchema,
   cleanSchema,
   importModuleSchema,
   moduleParamSchema,
+  moduleVersionsQuerySchema,
   removeHubSchema,
+  updateModuleSchema,
   updateProjectSchema,
 } from './schema.js';
 import * as projectService from './service.js';
@@ -28,9 +21,9 @@ import { requireRole } from '../../middleware/auth.js';
 const router = new Hono();
 
 router.get('/', requireRole(UserRole.Reader), async (c) => {
-  const commands = c.get('commands');
+  const ws = c.get('ws');
 
-  const project = await projectService.getProject(commands);
+  const project = await projectService.getProject(ws);
   return c.json(project);
 });
 
@@ -39,17 +32,21 @@ router.patch(
   requireRole(UserRole.Admin),
   zValidator('json', updateProjectSchema),
   async (c) => {
-    const commands = c.get('commands');
+    const ws = c.get('ws');
     const updates = c.req.valid('json');
 
-    const project = await projectService.updateProject(commands, updates);
+    const project = await projectService.updateProject(
+      ws,
+      c.get('directory'),
+      updates,
+    );
     return c.json(project);
   },
 );
 
 router.post('/modules/update', requireRole(UserRole.Admin), async (c) => {
-  const commands = c.get('commands');
-  await projectService.updateAllModules(commands);
+  const ws = c.get('ws');
+  await projectService.updateAllModules(ws);
   return c.json({ message: 'All modules updated' });
 });
 
@@ -57,17 +54,42 @@ router.post(
   '/modules/:module/update',
   requireRole(UserRole.Admin),
   zValidator('param', moduleParamSchema),
+  zValidator('json', updateModuleSchema),
   async (c) => {
-    const commands = c.get('commands');
+    const ws = c.get('ws');
     const { module } = c.req.valid('param');
-    await projectService.updateModule(commands, module);
+    const { range } = c.req.valid('json');
+    await projectService.updateModule(ws, module, range);
     return c.json({ message: 'Module updated' });
   },
 );
 
+// These reach the module sources over the network, which an export must not do.
+router.get(
+  '/modules/versions',
+  disableSSG(),
+  requireRole(UserRole.Admin),
+  zValidator('query', moduleVersionsQuerySchema),
+  async (c) => {
+    const ws = c.get('ws');
+    const target = c.req.valid('query');
+    return c.json(await projectService.listModuleVersions(ws, target));
+  },
+);
+
+router.get(
+  '/modules/update-plan',
+  disableSSG(),
+  requireRole(UserRole.Admin),
+  async (c) => {
+    const ws = c.get('ws');
+    return c.json(await projectService.getUpdatePlan(ws));
+  },
+);
+
 router.get('/modules/importable', requireRole(UserRole.Reader), async (c) => {
-  const commands = c.get('commands');
-  const modules = await projectService.getImportableModules(commands);
+  const ws = c.get('ws');
+  const modules = await projectService.getImportableModules(ws);
   return c.json(modules);
 });
 
@@ -76,9 +98,9 @@ router.post(
   requireRole(UserRole.Admin),
   zValidator('json', importModuleSchema),
   async (c) => {
-    const commands = c.get('commands');
-    const { source } = c.req.valid('json');
-    await projectService.importModule(commands, source);
+    const ws = c.get('ws');
+    const { source, range } = c.req.valid('json');
+    await projectService.importModule(ws, source, range);
     return c.json({ message: 'Module imported successfully' });
   },
 );
@@ -88,16 +110,16 @@ router.delete(
   requireRole(UserRole.Admin),
   zValidator('param', moduleParamSchema),
   async (c) => {
-    const commands = c.get('commands');
+    const ws = c.get('ws');
     const { module } = c.req.valid('param');
-    await projectService.deleteModule(commands, module);
+    await projectService.deleteModule(ws, module);
     return c.json({ message: 'Module removed' });
   },
 );
 
 router.get('/hubs', requireRole(UserRole.Reader), async (c) => {
-  const commands = c.get('commands');
-  const hubs = await projectService.getHubs(commands);
+  const ws = c.get('ws');
+  const hubs = await projectService.getHubs(ws);
   return c.json(hubs);
 });
 
@@ -106,9 +128,9 @@ router.post(
   requireRole(UserRole.Admin),
   zValidator('json', addHubSchema),
   async (c) => {
-    const commands = c.get('commands');
+    const ws = c.get('ws');
     const { location } = c.req.valid('json');
-    const unreachable = await projectService.addHub(commands, location);
+    const unreachable = await projectService.addHub(ws, location);
     return c.json({ message: 'Hub added', unreachable });
   },
 );
@@ -118,16 +140,16 @@ router.delete(
   requireRole(UserRole.Admin),
   zValidator('query', removeHubSchema),
   async (c) => {
-    const commands = c.get('commands');
+    const ws = c.get('ws');
     const { location } = c.req.valid('query');
-    await projectService.removeHub(commands, location);
+    await projectService.removeHub(ws, location);
     return c.json({ message: 'Hub removed' });
   },
 );
 
 router.post('/hubs/fetch', requireRole(UserRole.Admin), async (c) => {
-  const commands = c.get('commands');
-  const unreachable = await projectService.fetchHubs(commands);
+  const ws = c.get('ws');
+  const unreachable = await projectService.fetchHubs(ws);
   return c.json({ message: 'Hubs fetched', unreachable });
 });
 
@@ -139,9 +161,9 @@ router.post(
   requireRole(UserRole.Admin),
   zValidator('json', cleanSchema),
   async (c) => {
-    const commands = c.get('commands');
+    const ws = c.get('ws');
     const { dryRun } = c.req.valid('json');
-    const result = await projectService.cleanProject(commands, dryRun);
+    const result = await projectService.cleanProject(ws, dryRun);
     return c.json(result);
   },
 );

package/src/domain/project/schema.ts

@@ -1,15 +1,5 @@
-/**
-  Cyberismo
-  Copyright © Cyberismo Ltd and contributors 2025
-  This program is free software: you can redistribute it and/or modify it under
-  the terms of the GNU Affero General Public License version 3 as published by
-  the Free Software Foundation.
-  This program is distributed in the hope that it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
-  FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
-  details. You should have received a copy of the GNU Affero General Public
-  License along with this program. If not, see <https://www.gnu.org/licenses/>.
-*/
+// SPDX-FileCopyrightText: Cyberismo Ltd and contributors
+// SPDX-License-Identifier: AGPL-3.0-only
 
 import { z } from 'zod';
 
@@ -51,11 +41,44 @@ export const cleanSchema = z.object({
   dryRun: z.boolean(),
 });
 
+// Credentials in a source would be stored in cardsConfig.json and echoed in
+// query strings, logs and errors.
+const gitSourceSchema = z
+  .string()
+  .min(1)
+  .refine((s) => s.startsWith('https://') || s.startsWith('git@'), {
+    message: 'Source must be a git URL (https:// or git@)',
+  })
+  .refine(
+    (s) => {
+      if (!s.startsWith('https://')) return true;
+      try {
+        const { username, password } = new URL(s);
+        return username === '' && password === '';
+      } catch {
+        return false;
+      }
+    },
+    { message: 'Source must be a valid URL without credentials' },
+  );
+
+// A blank range is a valid semver range meaning '*', which would unpin.
+const rangeSchema = z.string().trim().min(1);
+
 export const importModuleSchema = z.object({
-  source: z
-    .string()
-    .min(1)
-    .refine((s) => s.startsWith('https://') || s.startsWith('git@'), {
-      message: 'Source must be a git URL (https:// or git@)',
-    }),
+  source: gitSourceSchema,
+  range: rangeSchema.optional(),
 });
+
+export const updateModuleSchema = z.object({
+  range: rangeSchema.optional(),
+});
+
+export const moduleVersionsQuerySchema = z
+  .object({
+    module: z.string().min(1).optional(),
+    source: gitSourceSchema.optional(),
+  })
+  .refine((q) => (q.module === undefined) !== (q.source === undefined), {
+    message: 'Provide exactly one of module or source',
+  });