@esankhan3/code-search-mcp 1.0.6 → 1.1.1

package/dist/middleware/auth.js

@@ -1,22 +1,5 @@
-import { createHmac, timingSafeEqual } from "node:crypto";
-const rateBuckets = /* @__PURE__ */ new Map();
-function checkRateLimit(identity, maxPerMinute) {
-  const now = Date.now();
-  const bucket = rateBuckets.get(identity);
-  if (!bucket || now > bucket.resetAt) {
-    rateBuckets.set(identity, { count: 1, resetAt: now + 6e4 });
-    return true;
-  }
-  if (bucket.count >= maxPerMinute) return false;
-  bucket.count++;
-  return true;
-}
-setInterval(() => {
-  const now = Date.now();
-  for (const [key, bucket] of rateBuckets) {
-    if (now > bucket.resetAt) rateBuckets.delete(key);
-  }
-}, 3e5).unref();
+import { createHash, createHmac, timingSafeEqual } from "node:crypto";
+import { localRateLimiter } from "./rate-limit.js";
 function verifyJwt(token, secret, issuer) {
   try {
     const parts = token.split(".");
@@ -31,7 +14,9 @@ function verifyJwt(token, secret, issuer) {
       return null;
     }
     const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString());
-    if (payload.exp && payload.exp < Math.floor(Date.now() / 1e3)) return null;
+    const now = Math.floor(Date.now() / 1e3);
+    if (typeof payload.exp !== "number" || payload.exp <= now) return null;
+    if (payload.nbf !== void 0 && (typeof payload.nbf !== "number" || payload.nbf > now)) return null;
     if (issuer && payload.iss !== issuer) return null;
     return { sub: payload.sub ?? "unknown", scope: payload.scope };
   } catch {
@@ -44,64 +29,47 @@ function safeCompare(a, b) {
   if (bufA.length !== bufB.length) return false;
   return timingSafeEqual(bufA, bufB);
 }
-function createAuthMiddleware(config) {
-  return function authenticate(req, res) {
+function apiKeySubject(key) {
+  return `key:${createHash("sha256").update(key).digest("hex").slice(0, 16)}`;
+}
+function createAuthMiddleware(config, opts = {}) {
+  if (config.authMode === "jwt" && !config.authJwtSecret) {
+    throw new Error('Auth mode "jwt" needs a signing secret: set CODE_SEARCH_AUTH_JWT_SECRET (or auth.jwt_secret in config).');
+  }
+  const rateLimiter = opts.rateLimiter ?? localRateLimiter;
+  const reject = (res, status, error, headers = {}) => {
+    res.writeHead(status, { "Content-Type": "application/json", ...headers });
+    res.end(JSON.stringify({ error }));
+    return null;
+  };
+  return async function authenticate(req, res) {
     if (config.authMode === "none") {
       return { mode: "anonymous", subject: "anonymous", scopes: ["*"] };
     }
     const authHeader = req.headers.authorization;
-    if (!authHeader?.startsWith("Bearer ")) {
-      res.writeHead(401, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ error: "Missing Authorization header" }));
-      return null;
-    }
+    if (!authHeader?.startsWith("Bearer ")) return reject(res, 401, "Missing Authorization header");
     const token = authHeader.slice(7);
+    let identity;
     if (config.authMode === "api-key") {
       const matched = config.authApiKeys.some((key) => safeCompare(token, key));
-      if (!matched) {
-        res.writeHead(401, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ error: "Invalid API key" }));
-        return null;
-      }
-      const identity = {
-        mode: "api-key",
-        subject: `key:${token.slice(0, 8)}...`,
-        scopes: ["*"]
-      };
-      if (!checkRateLimit(identity.subject, config.rateLimitPerMinute)) {
-        res.writeHead(429, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ error: "Rate limit exceeded" }));
-        return null;
-      }
-      return identity;
-    }
-    if (config.authMode === "jwt") {
-      if (!config.authJwtSecret) {
-        res.writeHead(500, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ error: "JWT secret not configured" }));
-        return null;
-      }
+      if (!matched) return reject(res, 401, "Invalid API key");
+      identity = { mode: "api-key", subject: apiKeySubject(token), scopes: ["*"] };
+    } else if (config.authMode === "jwt") {
       const claims = verifyJwt(token, config.authJwtSecret, config.authJwtIssuer);
-      if (!claims) {
-        res.writeHead(401, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ error: "Invalid or expired JWT" }));
-        return null;
-      }
-      const identity = {
+      if (!claims) return reject(res, 401, "Invalid or expired JWT");
+      identity = {
         mode: "jwt",
         subject: claims.sub,
-        scopes: claims.scope ? claims.scope.split(" ") : ["*"]
+        scopes: claims.scope ? claims.scope.split(" ").filter(Boolean) : []
       };
-      if (!checkRateLimit(identity.subject, config.rateLimitPerMinute)) {
-        res.writeHead(429, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ error: "Rate limit exceeded" }));
-        return null;
-      }
-      return identity;
+    } else {
+      return reject(res, 500, `Unknown auth mode: ${config.authMode}`);
     }
-    res.writeHead(500, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: `Unknown auth mode: ${config.authMode}` }));
-    return null;
+    const decision = await rateLimiter(`auth:${identity.subject}`, config.rateLimitPerMinute);
+    if (!decision.ok) {
+      return reject(res, 429, "Rate limit exceeded", { "Retry-After": String(decision.retryAfterSec) });
+    }
+    return identity;
   };
 }
 export {

package/dist/middleware/rate-limit.js

@@ -0,0 +1,37 @@
+class SlidingWindow {
+  constructor(windowMs = 6e4, now = Date.now) {
+    this.windowMs = windowMs;
+    this.now = now;
+  }
+  hits = /* @__PURE__ */ new Map();
+  hit(key, limit) {
+    if (limit <= 0) return { ok: true, retryAfterSec: 0 };
+    const t = this.now();
+    const recent = (this.hits.get(key) ?? []).filter((at) => at > t - this.windowMs);
+    if (recent.length >= limit) {
+      this.hits.set(key, recent);
+      return { ok: false, retryAfterSec: Math.max(1, Math.ceil((recent[0] + this.windowMs - t) / 1e3)) };
+    }
+    recent.push(t);
+    this.hits.set(key, recent);
+    return { ok: true, retryAfterSec: 0 };
+  }
+  /** Forget keys with no hit inside the window. */
+  prune() {
+    const cutoff = this.now() - this.windowMs;
+    for (const [key, at] of this.hits) {
+      if (at[at.length - 1] <= cutoff) this.hits.delete(key);
+    }
+  }
+}
+const processWindow = new SlidingWindow();
+setInterval(() => processWindow.prune(), 3e5).unref();
+const localRateLimiter = async (key, limit) => processWindow.hit(key, limit);
+function localRateHit(key, limit) {
+  return processWindow.hit(key, limit);
+}
+export {
+  SlidingWindow,
+  localRateHit,
+  localRateLimiter
+};

package/dist/observability/logger.js

@@ -46,8 +46,7 @@ class Logger {
       const entry = { level, msg, ts: (/* @__PURE__ */ new Date()).toISOString(), ...fields };
       this.opts.write(JSON.stringify(entry));
     } else {
-      const comp = fields?.component ? `[${fields.component}]` : "";
-      this.opts.write(`${level.toUpperCase()} ${comp} ${msg}`);
+      this.opts.write(fields?.component ? `[${fields.component}] ${msg}` : msg);
     }
   }
 }
@@ -59,8 +58,17 @@ function getLogger() {
 function configureLogger(opts) {
   _default = new Logger(opts);
 }
+function getComponentLogger(component) {
+  return {
+    debug: (msg, fields) => getLogger().debug(msg, { component, ...fields }),
+    info: (msg, fields) => getLogger().info(msg, { component, ...fields }),
+    warn: (msg, fields) => getLogger().warn(msg, { component, ...fields }),
+    error: (msg, fields) => getLogger().error(msg, { component, ...fields })
+  };
+}
 export {
   Logger,
   configureLogger,
+  getComponentLogger,
   getLogger
 };

package/dist/observability/metrics.js

@@ -46,6 +46,10 @@ class Gauge {
   set(value, labels) {
     this.buckets.set(labelKey(labels), { labels, value });
   }
+  /** Drop every series (a collector that owns the gauge starts each scrape empty). */
+  clear() {
+    this.buckets.clear();
+  }
   render() {
     const lines = [];
     lines.push(`# HELP ${this.name} ${this.help}`);
@@ -122,14 +126,11 @@ const registry = new Registry();
 const metrics = {
   queriesTotal: registry.register(new Counter("code_search_queries_total", "Total search queries by mode + repo.")),
   queryDuration: registry.register(new Histogram("code_search_query_duration_seconds", "Query latency by mode.")),
-  indexChunks: registry.register(new Gauge("code_search_index_chunks_total", "Indexed chunks by repo.")),
-  indexAge: registry.register(new Gauge("code_search_index_age_seconds", "Seconds since last index by repo.")),
+  indexChunks: registry.register(new Gauge("code_search_index_chunks_total", "Indexed chunks by project + repo.")),
+  indexAge: registry.register(new Gauge("code_search_index_age_seconds", "Seconds since the last successful index, by project.")),
   vectorIndexUnindexedRows: registry.register(new Gauge("code_search_vector_index_unindexed_rows", "Rows not yet folded into the vector index (brute-force scanned) by project.")),
   vectorIndexGrowthRatio: registry.register(new Gauge("code_search_vector_index_growth_ratio", "Rows written since the vector index was last trained / rows it was trained on, by project (retrains at CODE_SEARCH_VECTOR_RETRAIN_RATIO).")),
-  embeddingCalls: registry.register(new Counter("code_search_embeddings_calls_total", "Embedding API calls by provider.")),
-  llmCalls: registry.register(new Counter("code_search_llm_calls_total", "LLM API calls by phase.")),
-  errors: registry.register(new Counter("code_search_errors_total", "Errors by kind.")),
-  rerankerCacheHits: registry.register(new Counter("code_search_reranker_cache_hits_total", "Rerank cache lookups by outcome."))
+  errors: registry.register(new Counter("code_search_errors_total", "Errors by kind."))
 };
 export {
   Counter,

package/dist/projects/registry.js

@@ -3,6 +3,7 @@ import { join } from "node:path";
 import {
   resolveCodeSearchConfig
 } from "../core/config.js";
+import { localRateHit } from "../middleware/rate-limit.js";
 const DEFAULT_QUOTAS = {
   maxQueriesPerMinute: 100,
   maxEmbeddingCostUsd: 0,
@@ -123,24 +124,21 @@ function projectAccessAllowed(project, identityScopes) {
   }
   return false;
 }
-const projectRateBuckets = /* @__PURE__ */ new Map();
+function projectQuotaKey(project, identity) {
+  return `project:${project.name}|${identity}`;
+}
 function checkProjectQuota(project, identity) {
-  if (project.quotas.maxQueriesPerMinute <= 0) return { ok: true };
-  const key = `${identity}|${project.name}`;
-  const now = Date.now();
-  const bucket = projectRateBuckets.get(key);
-  if (!bucket || now > bucket.resetAt) {
-    projectRateBuckets.set(key, { count: 1, resetAt: now + 6e4 });
-    return { ok: true };
-  }
-  if (bucket.count >= project.quotas.maxQueriesPerMinute) {
-    return { ok: false, reason: `quota exceeded for project="${project.name}": ${project.quotas.maxQueriesPerMinute}/min` };
-  }
-  bucket.count++;
-  return { ok: true };
+  const d = localRateHit(projectQuotaKey(project, identity), project.quotas.maxQueriesPerMinute);
+  if (d.ok) return { ok: true };
+  return {
+    ok: false,
+    reason: `quota exceeded for project="${project.name}": ${project.quotas.maxQueriesPerMinute}/min`,
+    retryAfterSec: d.retryAfterSec
+  };
 }
 export {
   ProjectRegistry,
   checkProjectQuota,
-  projectAccessAllowed
+  projectAccessAllowed,
+  projectQuotaKey
 };

package/dist/resources/resources.js

@@ -18,6 +18,22 @@ function registerResources(ctx) {
     }
   ];
 }
+function registerResourceTemplates() {
+  return [
+    {
+      uriTemplate: "code-search://repo/{name}/profile",
+      name: "Repo Profile",
+      description: "Profile of one repo (see code-search://repos for names)",
+      mimeType: "application/json"
+    },
+    {
+      uriTemplate: "code-search://repo/{name}/graph",
+      name: "Repo Graph",
+      description: "Code graph (nodes + links) of one repo",
+      mimeType: "application/json"
+    }
+  ];
+}
 async function handleResource(uri, ctx) {
   try {
     if (uri === "code-search://repos") {
@@ -78,5 +94,6 @@ async function handleResource(uri, ctx) {
 }
 export {
   handleResource,
+  registerResourceTemplates,
   registerResources
 };