@cyberismo/backend 1.2.0 → 1.3.0

package/src/domain/mcp/index.ts

@@ -1,23 +1,15 @@
-/**
-  Cyberismo
-  Copyright © Cyberismo Ltd and contributors 2025
-  This program is free software: you can redistribute it and/or modify it under
-  the terms of the GNU Affero General Public License version 3 as published by
-  the Free Software Foundation.
-  This program is distributed in the hope that it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
-  FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
-  details. You should have received a copy of the GNU Affero General Public
-  License along with this program. If not, see <https://www.gnu.org/licenses/>.
-*/
+// SPDX-FileCopyrightText: Cyberismo Ltd and contributors
+// SPDX-License-Identifier: AGPL-3.0-only
 
 import { Hono } from 'hono';
 import { randomUUID } from 'node:crypto';
 import { WebStandardStreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js';
-import { createMcpServer, type ProjectProvider } from '@cyberismo/mcp';
+import { createMcpServer, type McpUser } from '@cyberismo/mcp';
+import type { ProjectDirectory } from '@cyberismo/data-handler';
+import type { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types.js';
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { requireRole } from '../../middleware/auth.js';
-import { UserRole, type AppVars } from '../../types.js';
+import { UserRole, type AppVars, type UserInfo } from '../../types.js';
 
 const MAX_SESSIONS = 100;
 const MAX_SESSIONS_PER_USER = 5;
@@ -73,11 +65,22 @@ const cleanupInterval = setInterval(() => {
 }, CLEANUP_INTERVAL_MS);
 cleanupInterval.unref();
 
+// The request's user, in the form the MCP server builds its handle from.
+function authInfoOf(user: UserInfo): AuthInfo {
+  const mcpUser: McpUser = {
+    id: user.id,
+    name: user.name,
+    email: user.email,
+    kind: user.role === UserRole.Connector ? 'connector' : 'user',
+  };
+  return { token: '', clientId: user.id, scopes: [], extra: { user: mcpUser } };
+}
+
 /**
- * Create an MCP HTTP router that serves all projects via the given provider.
+ * Create an MCP HTTP router that serves all projects of the given directory.
  */
 export function createMcpRouter(
-  provider: ProjectProvider,
+  directory: ProjectDirectory,
 ): Hono<{ Variables: AppVars }> {
   const router = new Hono<{ Variables: AppVars }>();
 
@@ -86,21 +89,26 @@ export function createMcpRouter(
    * Supports POST (messages) and DELETE (session cleanup).
    */
   router.all('/', requireRole(UserRole.Editor), async (c) => {
+    const user = c.get('user')!;
     const sessionId = c.req.header('mcp-session-id');
+    // Another user's session is answered as if it did not exist.
+    const found = sessionId ? sessions.get(sessionId) : undefined;
+    const session = found?.userId === user.id ? found : undefined;
 
     // Handle DELETE before routing to existing session so it always runs cleanup
     if (c.req.method === 'DELETE') {
-      if (sessionId) {
-        await destroySession(sessionId);
+      if (session) {
+        await destroySession(sessionId!);
       }
       return c.json({ message: 'Session closed' });
     }
 
     // Handle existing session
-    if (sessionId && sessions.has(sessionId)) {
-      const session = sessions.get(sessionId)!;
+    if (session) {
       session.lastActivity = Date.now();
-      const response = await session.transport.handleRequest(c.req.raw);
+      const response = await session.transport.handleRequest(c.req.raw, {
+        authInfo: authInfoOf(user),
+      });
       return response;
     }
 
@@ -122,7 +130,6 @@ export function createMcpRouter(
       return c.json({ error: 'Too many active sessions' }, 503);
     }
 
-    const user = c.get('user')!;
     const userSessionCount = [...sessions.values()].filter(
       (s) => s.userId === user.id,
     ).length;
@@ -153,10 +160,12 @@ export function createMcpRouter(
       }
     };
 
-    const server = createMcpServer(provider);
+    const server = createMcpServer(directory);
     await server.connect(transport);
 
-    const response = await transport.handleRequest(c.req.raw);
+    const response = await transport.handleRequest(c.req.raw, {
+      authInfo: authInfoOf(user),
+    });
     return response;
   });
 

package/src/domain/project/index.ts

@@ -1,15 +1,5 @@
-/**
-  Cyberismo
-  Copyright © Cyberismo Ltd and contributors 2025
-  This program is free software: you can redistribute it and/or modify it under
-  the terms of the GNU Affero General Public License version 3 as published by
-  the Free Software Foundation.
-  This program is distributed in the hope that it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
-  FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
-  details. You should have received a copy of the GNU Affero General Public
-  License along with this program. If not, see <https://www.gnu.org/licenses/>.
-*/
+// SPDX-FileCopyrightText: Cyberismo Ltd and contributors
+// SPDX-License-Identifier: AGPL-3.0-only
 
 import { Hono } from 'hono';
 import { disableSSG } from 'hono/ssg';
@@ -31,9 +21,9 @@ import { requireRole } from '../../middleware/auth.js';
 const router = new Hono();
 
 router.get('/', requireRole(UserRole.Reader), async (c) => {
-  const commands = c.get('commands');
+  const ws = c.get('ws');
 
-  const project = await projectService.getProject(commands);
+  const project = await projectService.getProject(ws);
   return c.json(project);
 });
 
@@ -42,17 +32,21 @@ router.patch(
   requireRole(UserRole.Admin),
   zValidator('json', updateProjectSchema),
   async (c) => {
-    const commands = c.get('commands');
+    const ws = c.get('ws');
     const updates = c.req.valid('json');
 
-    const project = await projectService.updateProject(commands, updates);
+    const project = await projectService.updateProject(
+      ws,
+      c.get('directory'),
+      updates,
+    );
     return c.json(project);
   },
 );
 
 router.post('/modules/update', requireRole(UserRole.Admin), async (c) => {
-  const commands = c.get('commands');
-  await projectService.updateAllModules(commands);
+  const ws = c.get('ws');
+  await projectService.updateAllModules(ws);
   return c.json({ message: 'All modules updated' });
 });
 
@@ -62,10 +56,10 @@ router.post(
   zValidator('param', moduleParamSchema),
   zValidator('json', updateModuleSchema),
   async (c) => {
-    const commands = c.get('commands');
+    const ws = c.get('ws');
     const { module } = c.req.valid('param');
     const { range } = c.req.valid('json');
-    await projectService.updateModule(commands, module, range);
+    await projectService.updateModule(ws, module, range);
     return c.json({ message: 'Module updated' });
   },
 );
@@ -77,9 +71,9 @@ router.get(
   requireRole(UserRole.Admin),
   zValidator('query', moduleVersionsQuerySchema),
   async (c) => {
-    const commands = c.get('commands');
+    const ws = c.get('ws');
     const target = c.req.valid('query');
-    return c.json(await projectService.listModuleVersions(commands, target));
+    return c.json(await projectService.listModuleVersions(ws, target));
   },
 );
 
@@ -88,14 +82,14 @@ router.get(
   disableSSG(),
   requireRole(UserRole.Admin),
   async (c) => {
-    const commands = c.get('commands');
-    return c.json(await projectService.getUpdatePlan(commands));
+    const ws = c.get('ws');
+    return c.json(await projectService.getUpdatePlan(ws));
   },
 );
 
 router.get('/modules/importable', requireRole(UserRole.Reader), async (c) => {
-  const commands = c.get('commands');
-  const modules = await projectService.getImportableModules(commands);
+  const ws = c.get('ws');
+  const modules = await projectService.getImportableModules(ws);
   return c.json(modules);
 });
 
@@ -104,9 +98,9 @@ router.post(
   requireRole(UserRole.Admin),
   zValidator('json', importModuleSchema),
   async (c) => {
-    const commands = c.get('commands');
+    const ws = c.get('ws');
     const { source, range } = c.req.valid('json');
-    await projectService.importModule(commands, source, range);
+    await projectService.importModule(ws, source, range);
     return c.json({ message: 'Module imported successfully' });
   },
 );
@@ -116,16 +110,16 @@ router.delete(
   requireRole(UserRole.Admin),
   zValidator('param', moduleParamSchema),
   async (c) => {
-    const commands = c.get('commands');
+    const ws = c.get('ws');
     const { module } = c.req.valid('param');
-    await projectService.deleteModule(commands, module);
+    await projectService.deleteModule(ws, module);
     return c.json({ message: 'Module removed' });
   },
 );
 
 router.get('/hubs', requireRole(UserRole.Reader), async (c) => {
-  const commands = c.get('commands');
-  const hubs = await projectService.getHubs(commands);
+  const ws = c.get('ws');
+  const hubs = await projectService.getHubs(ws);
   return c.json(hubs);
 });
 
@@ -134,9 +128,9 @@ router.post(
   requireRole(UserRole.Admin),
   zValidator('json', addHubSchema),
   async (c) => {
-    const commands = c.get('commands');
+    const ws = c.get('ws');
     const { location } = c.req.valid('json');
-    const unreachable = await projectService.addHub(commands, location);
+    const unreachable = await projectService.addHub(ws, location);
     return c.json({ message: 'Hub added', unreachable });
   },
 );
@@ -146,16 +140,16 @@ router.delete(
   requireRole(UserRole.Admin),
   zValidator('query', removeHubSchema),
   async (c) => {
-    const commands = c.get('commands');
+    const ws = c.get('ws');
     const { location } = c.req.valid('query');
-    await projectService.removeHub(commands, location);
+    await projectService.removeHub(ws, location);
     return c.json({ message: 'Hub removed' });
   },
 );
 
 router.post('/hubs/fetch', requireRole(UserRole.Admin), async (c) => {
-  const commands = c.get('commands');
-  const unreachable = await projectService.fetchHubs(commands);
+  const ws = c.get('ws');
+  const unreachable = await projectService.fetchHubs(ws);
   return c.json({ message: 'Hubs fetched', unreachable });
 });
 
@@ -167,9 +161,9 @@ router.post(
   requireRole(UserRole.Admin),
   zValidator('json', cleanSchema),
   async (c) => {
-    const commands = c.get('commands');
+    const ws = c.get('ws');
     const { dryRun } = c.req.valid('json');
-    const result = await projectService.cleanProject(commands, dryRun);
+    const result = await projectService.cleanProject(ws, dryRun);
     return c.json(result);
   },
 );

package/src/domain/project/schema.ts

@@ -1,15 +1,5 @@
-/**
-  Cyberismo
-  Copyright © Cyberismo Ltd and contributors 2025
-  This program is free software: you can redistribute it and/or modify it under
-  the terms of the GNU Affero General Public License version 3 as published by
-  the Free Software Foundation.
-  This program is distributed in the hope that it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
-  FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
-  details. You should have received a copy of the GNU Affero General Public
-  License along with this program. If not, see <https://www.gnu.org/licenses/>.
-*/
+// SPDX-FileCopyrightText: Cyberismo Ltd and contributors
+// SPDX-License-Identifier: AGPL-3.0-only
 
 import { z } from 'zod';
 

package/src/domain/project/service.ts

@@ -1,26 +1,14 @@
-/**
-  Cyberismo
-  Copyright © Cyberismo Ltd and contributors 2025
-  This program is free software: you can redistribute it and/or modify it under
-  the terms of the GNU Affero General Public License version 3 as published by
-  the Free Software Foundation.
-  This program is distributed in the hope that it will be useful, but WITHOUT
-  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
-  FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
-  details. You should have received a copy of the GNU Affero General Public
-  License along with this program. If not, see <https://www.gnu.org/licenses/>.
-*/
+// SPDX-FileCopyrightText: Cyberismo Ltd and contributors
+// SPDX-License-Identifier: AGPL-3.0-only
 
+import { type ProjectDirectory, type Workspace } from '@cyberismo/data-handler';
 import {
   type CleanResult,
-  type CommandManager,
   type HubFetchFailure,
   type ModuleSettingFromHub,
   type ProjectModuleInfo,
   type UpdatePlan,
-} from '@cyberismo/data-handler';
-
-export type { CleanResult } from '@cyberismo/data-handler';
+} from '@cyberismo/model';
 
 // Never carries the module's source location.
 export interface ProjectModule extends ProjectModuleInfo {
@@ -59,11 +47,11 @@ export interface HubInfo {
 }
 
 async function toModuleInfo(
-  commands: CommandManager,
+  ws: Workspace,
   row: ProjectModuleInfo,
 ): Promise<ProjectModule> {
   try {
-    const data = await commands.modulesCmd.show(row.name);
+    const data = await ws.modules.show(row.name);
     return {
       ...row,
       name: data.name || row.name,
@@ -74,17 +62,15 @@ async function toModuleInfo(
   }
 }
 
-export async function getProject(
-  commands: CommandManager,
-): Promise<ProjectInfo> {
-  return commands.consistent(async () => {
-    const project = await commands.showCmd.showProject();
-    const modules = await commands.modulesCmd.inventory();
+export async function getProject(ws: Workspace): Promise<ProjectInfo> {
+  return ws.consistent(async () => {
+    const project = await ws.settings.info();
+    const modules = await ws.modules.inventory();
     const moduleDetails = await Promise.all(
-      modules.map((row) => toModuleInfo(commands, row)),
+      modules.map((row) => toModuleInfo(ws, row)),
     );
 
-    const gitRemoteUrl = (await commands.showCmd.showGitRemoteUrl()) ?? null;
+    const gitRemoteUrl = (await ws.settings.gitRemoteUrl()) ?? null;
 
     return {
       name: project.name,
@@ -98,71 +84,75 @@ export async function getProject(
 }
 
 export async function updateProject(
-  commands: CommandManager,
+  ws: Workspace,
+  directory: ProjectDirectory,
   updates: ProjectUpdatePayload,
 ): Promise<ProjectInfo> {
   const { name, cardKeyPrefix, description, category, gitRemoteUrl } = updates;
 
-  await commands.atomic(async () => {
+  await ws.atomic(async () => {
     if (cardKeyPrefix) {
-      await commands.renameCmd.rename(cardKeyPrefix);
+      await directory.rename(
+        ws.settings.prefix,
+        cardKeyPrefix,
+        ws.actor,
+        ws.identity,
+      );
     }
     if (name) {
-      await commands.project.configuration.setProjectName(name);
+      await ws.settings.setName(name);
     }
     if (description !== undefined) {
-      await commands.project.configuration.setDescription(description);
+      await ws.settings.setDescription(description);
     }
     if (category !== undefined) {
-      await commands.project.configuration.setCategory(category);
+      await ws.settings.setCategory(category);
     }
   }, 'Update project settings');
 
   if (gitRemoteUrl !== undefined) {
-    await commands.editCmd.setGitRemoteUrl(gitRemoteUrl);
+    await ws.settings.setGitRemoteUrl(gitRemoteUrl);
   }
 
-  return getProject(commands);
+  return getProject(ws);
 }
 
 export async function updateModule(
-  commands: CommandManager,
+  ws: Workspace,
   module: string,
   range?: string,
 ) {
-  await commands.modulesCmd.update(range ? { module, range } : { module });
+  await ws.modules.update(range ? { module, range } : { module });
 }
 
-export async function updateAllModules(commands: CommandManager) {
-  await commands.modulesCmd.update({});
+export async function updateAllModules(ws: Workspace) {
+  await ws.modules.update({});
 }
 
-export async function getUpdatePlan(
-  commands: CommandManager,
-): Promise<UpdatePlan> {
-  return commands.modulesCmd.planUpdate({});
+export async function getUpdatePlan(ws: Workspace): Promise<UpdatePlan> {
+  return ws.modules.planUpdate({});
 }
 
 export async function listModuleVersions(
-  commands: CommandManager,
+  ws: Workspace,
   target: { module?: string; source?: string },
 ): Promise<string[]> {
-  return commands.modulesCmd.listVersions(
+  return ws.modules.listVersions(
     target.source !== undefined
       ? { source: target.source }
       : { module: target.module! },
   );
 }
 
-export async function deleteModule(commands: CommandManager, module: string) {
-  await commands.removeCmd.remove('module', module);
+export async function deleteModule(ws: Workspace, module: string) {
+  await ws.modules.remove(module);
 }
 
 // Hub data is only refreshed on demand, so a project that has never fetched
 // would otherwise show an empty catalogue until the user asks for a refresh.
-async function populateHubCache(commands: CommandManager) {
+async function populateHubCache(ws: Workspace) {
   try {
-    await commands.fetchCmd.ensureModuleListExists();
+    await ws.modules.ensureModuleListExists();
   } catch (error) {
     // An unreachable hub must not fail listing the hubs we already know about.
     console.warn('Failed to populate the hub cache', error);
@@ -170,28 +160,25 @@ async function populateHubCache(commands: CommandManager) {
 }
 
 export async function getImportableModules(
-  commands: CommandManager,
+  ws: Workspace,
 ): Promise<ModuleSettingFromHub[]> {
-  await populateHubCache(commands);
-  return commands.showCmd.showImportableModules(false, true);
+  await populateHubCache(ws);
+  return ws.modules.importable(false, true);
 }
 
 export async function importModule(
-  commands: CommandManager,
+  ws: Workspace,
   source: string,
   range?: string,
 ): Promise<void> {
-  await commands.modulesCmd.install(
-    source,
-    range ? { version: range } : undefined,
-  );
+  await ws.modules.install(source, range ? { version: range } : undefined);
 }
 
-export async function getHubs(commands: CommandManager): Promise<HubInfo[]> {
-  await populateHubCache(commands);
-  const hubs = await commands.showCmd.showHubDetails();
+export async function getHubs(ws: Workspace): Promise<HubInfo[]> {
+  await populateHubCache(ws);
+  const hubs = await ws.modules.hubDetails();
   const importedModules = new Set(
-    (await commands.modulesCmd.list()).map((mod) => mod.name),
+    (await ws.modules.list()).map((mod) => mod.name),
   );
   return hubs.map((hub) => ({
     location: hub.location,
@@ -207,28 +194,26 @@ export async function getHubs(commands: CommandManager): Promise<HubInfo[]> {
 }
 
 export async function addHub(
-  commands: CommandManager,
+  ws: Workspace,
   location: string,
 ): Promise<HubFetchFailure[]> {
-  await commands.createCmd.addHubLocation(location);
+  await ws.settings.hubs.add(location);
   // The hub is configured even when it cannot be reached right now; its
   // modules appear once a later refresh succeeds.
-  return commands.fetchCmd.fetchHubs(true);
+  return ws.modules.fetchHubs(true);
 }
 
-export async function removeHub(commands: CommandManager, location: string) {
-  await commands.removeCmd.remove('hub', location);
+export async function removeHub(ws: Workspace, location: string) {
+  await ws.settings.hubs.remove(location);
 }
 
-export async function fetchHubs(
-  commands: CommandManager,
-): Promise<HubFetchFailure[]> {
-  return commands.fetchCmd.fetchHubs(true);
+export async function fetchHubs(ws: Workspace): Promise<HubFetchFailure[]> {
+  return ws.modules.fetchHubs(true);
 }
 
 export async function cleanProject(
-  commands: CommandManager,
+  ws: Workspace,
   dryRun: boolean,
 ): Promise<CleanResult> {
-  return commands.cleanCmd.clean(dryRun);
+  return ws.clean.run(dryRun);
 }