@everystack/mcp 0.2.0

package/src/tools/project-validate.ts

@@ -0,0 +1,369 @@
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+
+type Severity = 'error' | 'warning' | 'info';
+
+interface ValidationResult {
+  severity: Severity;
+  category: string;
+  message: string;
+  file?: string;
+  fix?: string;
+}
+
+interface ValidationReport {
+  results: ValidationResult[];
+  summary: {
+    errors: number;
+    warnings: number;
+    info: number;
+  };
+}
+
+function readFileSafe(path: string): string | null {
+  if (!existsSync(path)) return null;
+  try {
+    return readFileSync(path, 'utf-8');
+  } catch {
+    return null;
+  }
+}
+
+function readJsonSafe(path: string): unknown | null {
+  const content = readFileSafe(path);
+  if (!content) return null;
+  try {
+    return JSON.parse(content);
+  } catch {
+    return null;
+  }
+}
+
+function checkPackageJson(projectPath: string, results: ValidationResult[]): void {
+  const pkg = readJsonSafe(join(projectPath, 'package.json')) as Record<string, unknown> | null;
+  if (!pkg) {
+    results.push({
+      severity: 'error',
+      category: 'project',
+      message: 'No package.json found',
+      fix: 'Run `npm init` or create package.json manually',
+    });
+    return;
+  }
+
+  const deps = {
+    ...(pkg.dependencies as Record<string, string> || {}),
+    ...(pkg.devDependencies as Record<string, string> || {}),
+  };
+
+  // Check for required peer dependencies
+  if (deps['@everystack/api'] && !deps['drizzle-orm']) {
+    results.push({
+      severity: 'error',
+      category: 'dependencies',
+      message: '@everystack/api requires drizzle-orm as a peer dependency',
+      fix: 'Run `pnpm add drizzle-orm drizzle-kit`',
+    });
+  }
+
+  if (deps['@everystack/server'] && !deps['sst']) {
+    results.push({
+      severity: 'warning',
+      category: 'dependencies',
+      message: '@everystack/server expects sst as a peer dependency for deployment',
+      fix: 'Run `pnpm add -D sst`',
+    });
+  }
+
+  if (deps['@everystack/query'] && !deps['@tanstack/react-query']) {
+    results.push({
+      severity: 'error',
+      category: 'dependencies',
+      message: '@everystack/query requires @tanstack/react-query as a peer dependency',
+      fix: 'Run `pnpm add @tanstack/react-query`',
+    });
+  }
+}
+
+function checkSecurityConfig(projectPath: string, results: ValidationResult[]): void {
+  // Check for exposed secrets in common locations
+  const dangerousFiles = ['.env', '.env.local', '.env.production'];
+  for (const f of dangerousFiles) {
+    const content = readFileSafe(join(projectPath, f));
+    if (content) {
+      if (content.includes('JWT_SECRET') || content.includes('DATABASE_URL')) {
+        results.push({
+          severity: 'warning',
+          category: 'security',
+          message: `${f} contains sensitive values — use SST secrets instead`,
+          file: f,
+          fix: 'Run `pnpm sst secret set JwtSecret "value" --stage dev` and remove from .env',
+        });
+      }
+
+      // Check gitignore
+      const gitignore = readFileSafe(join(projectPath, '.gitignore'));
+      if (gitignore && !gitignore.includes(f)) {
+        results.push({
+          severity: 'error',
+          category: 'security',
+          message: `${f} is not in .gitignore — secrets may be committed`,
+          file: '.gitignore',
+          fix: `Add '${f}' to .gitignore`,
+        });
+      }
+    }
+  }
+
+  // Check for hardcoded secrets in handler files
+  const serverFiles = ['server/api.ts', 'server/handler.ts', 'server/plugins/api.ts'];
+  for (const f of serverFiles) {
+    const content = readFileSafe(join(projectPath, f));
+    if (content) {
+      if (/['"](?:sk_|pk_|secret_)[a-zA-Z0-9]+['"]/.test(content)) {
+        results.push({
+          severity: 'error',
+          category: 'security',
+          message: `Possible hardcoded API key in ${f}`,
+          file: f,
+          fix: 'Move secrets to SST secret management',
+        });
+      }
+    }
+  }
+}
+
+function checkHandlerConfig(projectPath: string, results: ValidationResult[]): void {
+  const handlerCandidates = [
+    'server/plugins/api.ts',
+    'server/api.ts',
+    'server/handler.ts',
+  ];
+
+  let handlerSource: string | null = null;
+  let handlerFile: string | null = null;
+
+  for (const f of handlerCandidates) {
+    const content = readFileSafe(join(projectPath, f));
+    if (content && content.includes('createHandler')) {
+      handlerSource = content;
+      handlerFile = f;
+      break;
+    }
+  }
+
+  if (!handlerSource || !handlerFile) return;
+
+  // pgSettings is required for RLS
+  if (!handlerSource.includes('pgSettings')) {
+    results.push({
+      severity: 'warning',
+      category: 'security',
+      message: 'No pgSettings configured — RLS policies will not receive JWT claims',
+      file: handlerFile,
+      fix: 'Add pgSettings to your createHandler() config. Read everystack://security for the pattern.',
+    });
+  }
+
+  // Check for auth configuration
+  if (!handlerSource.includes('verifyToken')) {
+    results.push({
+      severity: 'warning',
+      category: 'security',
+      message: 'No auth.verifyToken configured — all routes are unauthenticated',
+      file: handlerFile,
+      fix: 'Add auth.verifyToken to createHandler() config',
+    });
+  }
+
+  // exposedTables should be set
+  if (!handlerSource.includes('exposedTables')) {
+    results.push({
+      severity: 'warning',
+      category: 'security',
+      message: 'No exposedTables set — all schema tables are accessible via API',
+      file: handlerFile,
+      fix: 'Add exposedTables to restrict which tables are accessible',
+    });
+  }
+
+  // maxEmbedDepth should be set
+  if (!handlerSource.includes('maxEmbedDepth')) {
+    results.push({
+      severity: 'info',
+      category: 'security',
+      message: 'maxEmbedDepth not set — using default (3). Set explicitly to prevent deep query DoS.',
+      file: handlerFile,
+    });
+  }
+
+  // rowOwnership for user-scoped tables
+  if (!handlerSource.includes('rowOwnership')) {
+    results.push({
+      severity: 'info',
+      category: 'security',
+      message: 'No rowOwnership configured — consider it for user-scoped mutation control',
+      file: handlerFile,
+      fix: 'Add rowOwnership for tables where users should only modify their own rows',
+    });
+  }
+}
+
+function checkSchemaConventions(projectPath: string, results: ValidationResult[]): void {
+  const schemaPath = join(projectPath, 'db', 'schema.ts');
+  const source = readFileSafe(schemaPath);
+  if (!source) return;
+
+  // Check for UUID primary keys (recommended)
+  const serialPkRegex = /serial\(['"]id['"]\)\.primaryKey/;
+  if (serialPkRegex.test(source)) {
+    results.push({
+      severity: 'info',
+      category: 'conventions',
+      message: 'Using serial IDs — UUID primary keys are recommended for distributed systems',
+      file: 'db/schema.ts',
+    });
+  }
+
+  // Check for timestamps
+  const tableNames = [...source.matchAll(/export\s+const\s+(\w+)\s*=\s*pgTable/g)].map((m) => m[1]);
+  for (const name of tableNames) {
+    // Find the table definition block
+    const tableRegex = new RegExp(`export\\s+const\\s+${name}\\s*=\\s*pgTable\\([^,]+,\\s*\\{([^}]+)\\}`);
+    const match = source.match(tableRegex);
+    if (match) {
+      const block = match[1];
+      if (!block.includes('created_at') && !block.includes('createdAt')) {
+        results.push({
+          severity: 'info',
+          category: 'conventions',
+          message: `Table '${name}' has no createdAt timestamp`,
+          file: 'db/schema.ts',
+        });
+      }
+    }
+  }
+}
+
+function checkMigrations(projectPath: string, results: ValidationResult[]): void {
+  const migrationsDir = join(projectPath, 'db', 'migrations');
+  const serverDrizzle = join(projectPath, 'server', 'drizzle');
+
+  const hasDbMigrations = existsSync(migrationsDir);
+  const hasServerDrizzle = existsSync(serverDrizzle);
+
+  if (!hasDbMigrations && !hasServerDrizzle) {
+    const hasSchema = existsSync(join(projectPath, 'db', 'schema.ts'));
+    if (hasSchema) {
+      results.push({
+        severity: 'warning',
+        category: 'database',
+        message: 'Schema exists but no migrations directory found',
+        fix: 'Run `npx drizzle-kit generate` to create migrations',
+      });
+    }
+    return;
+  }
+
+  // Check for RLS in migrations
+  const dir = hasServerDrizzle ? serverDrizzle : migrationsDir;
+  try {
+    const files = readdirSync(dir).filter((f) => f.endsWith('.sql'));
+    let hasRls = false;
+
+    for (const f of files) {
+      const content = readFileSafe(join(dir, f));
+      if (content && content.includes('ENABLE ROW LEVEL SECURITY')) {
+        hasRls = true;
+        break;
+      }
+    }
+
+    if (!hasRls && files.length > 0) {
+      results.push({
+        severity: 'warning',
+        category: 'security',
+        message: 'No RLS policies found in migrations — tables are not protected at database level',
+        fix: 'Add RLS policies via custom SQL migrations. Read everystack://security for templates.',
+      });
+    }
+  } catch {
+    // ignore
+  }
+}
+
+function checkDeploymentReadiness(projectPath: string, results: ValidationResult[]): void {
+  // SST config
+  if (!existsSync(join(projectPath, 'sst.config.ts'))) {
+    results.push({
+      severity: 'info',
+      category: 'deployment',
+      message: 'No sst.config.ts — project is not configured for AWS deployment',
+      fix: 'Create sst.config.ts following everystack://deployment',
+    });
+    return;
+  }
+
+  const sstConfig = readFileSafe(join(projectPath, 'sst.config.ts'));
+  if (sstConfig) {
+    // Check for VPC configuration
+    if (!sstConfig.includes('Vpc') && !sstConfig.includes('vpc')) {
+      results.push({
+        severity: 'info',
+        category: 'deployment',
+        message: 'No VPC configured in sst.config.ts — RDS requires a VPC',
+      });
+    }
+  }
+}
+
+function checkFileConventions(projectPath: string, results: ValidationResult[]): void {
+  // Check for default exports (everystack uses named exports)
+  const srcDirs = ['server', 'db', 'lib'];
+  for (const dir of srcDirs) {
+    const dirPath = join(projectPath, dir);
+    if (!existsSync(dirPath)) continue;
+
+    try {
+      const files = readdirSync(dirPath).filter((f) => f.endsWith('.ts') && !f.endsWith('.test.ts'));
+      for (const f of files) {
+        const content = readFileSafe(join(dirPath, f));
+        if (content && /^export\s+default\s/m.test(content)) {
+          results.push({
+            severity: 'info',
+            category: 'conventions',
+            message: `${dir}/${f} uses default export — everystack convention prefers named exports`,
+            file: `${dir}/${f}`,
+          });
+        }
+      }
+    } catch {
+      // ignore
+    }
+  }
+}
+
+export function validateProject(projectPath: string): ValidationReport {
+  const results: ValidationResult[] = [];
+
+  checkPackageJson(projectPath, results);
+  checkSecurityConfig(projectPath, results);
+  checkHandlerConfig(projectPath, results);
+  checkSchemaConventions(projectPath, results);
+  checkMigrations(projectPath, results);
+  checkDeploymentReadiness(projectPath, results);
+  checkFileConventions(projectPath, results);
+
+  // Sort: errors first, then warnings, then info
+  const order: Record<Severity, number> = { error: 0, warning: 1, info: 2 };
+  results.sort((a, b) => order[a.severity] - order[b.severity]);
+
+  return {
+    results,
+    summary: {
+      errors: results.filter((r) => r.severity === 'error').length,
+      warnings: results.filter((r) => r.severity === 'warning').length,
+      info: results.filter((r) => r.severity === 'info').length,
+    },
+  };
+}