@helm-protocol/ttt-mcp 0.1.7 → 0.1.8

package/dist/auth.js

@@ -0,0 +1,257 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var auth_exports = {};
+__export(auth_exports, {
+  AUTH_ERROR_MESSAGE: () => AUTH_ERROR_MESSAGE,
+  verifyHelmApiKey: () => verifyHelmApiKey
+});
+module.exports = __toCommonJS(auth_exports);
+var import_crypto = require("crypto");
+var https = __toESM(require("https"));
+var import_crypto2 = require("crypto");
+const HELM_PUBLIC_KEY_B64 = process.env.HELM_PUBLIC_KEY ?? "PLACEHOLDER_REPLACE_BEFORE_DEPLOY";
+const HELM_AUTH_SERVER_URL = process.env.HELM_AUTH_SERVER_URL;
+if (HELM_AUTH_SERVER_URL !== void 0) {
+  if (!HELM_AUTH_SERVER_URL.startsWith("https://")) {
+    throw new Error(
+      "[ttt-mcp] HELM_AUTH_SERVER_URL must use HTTPS (got: " + HELM_AUTH_SERVER_URL + "). Refusing to start to protect API keys in transit."
+    );
+  }
+}
+const CLIENT_VERSION = "0.2.0";
+const authCache = /* @__PURE__ */ new Map();
+function getCached(apiKey, toolName) {
+  const key = `${apiKey}:${toolName}`;
+  const entry = authCache.get(key);
+  if (!entry) return null;
+  if (Date.now() > entry.expiresAt) {
+    authCache.delete(key);
+    return null;
+  }
+  return entry;
+}
+function setCached(apiKey, toolName, allowed, planTier, cacheTtlMs) {
+  const key = `${apiKey}:${toolName}`;
+  authCache.set(key, {
+    allowed,
+    planTier,
+    expiresAt: Date.now() + cacheTtlMs
+  });
+}
+const CIRCUIT_FAILURE_THRESHOLD = 3;
+const CIRCUIT_OPEN_DURATION_MS = 5 * 60 * 1e3;
+const circuit = {
+  state: "CLOSED",
+  consecutiveFailures: 0,
+  openedAt: 0
+};
+function circuitRecordSuccess() {
+  circuit.consecutiveFailures = 0;
+  circuit.state = "CLOSED";
+}
+function circuitRecordFailure() {
+  circuit.consecutiveFailures += 1;
+  if (circuit.consecutiveFailures >= CIRCUIT_FAILURE_THRESHOLD) {
+    circuit.state = "OPEN";
+    circuit.openedAt = Date.now();
+  }
+}
+function circuitCanAttempt() {
+  if (circuit.state === "CLOSED") return true;
+  if (circuit.state === "OPEN") {
+    if (Date.now() - circuit.openedAt >= CIRCUIT_OPEN_DURATION_MS) {
+      circuit.state = "HALF_OPEN";
+      return true;
+    }
+    return false;
+  }
+  return true;
+}
+function callAuthServer(serverUrl, apiKey, toolName) {
+  return new Promise((resolve, reject) => {
+    const requestId = (0, import_crypto2.randomUUID)();
+    const body = JSON.stringify({
+      api_key: apiKey,
+      tool_name: toolName,
+      request_id: requestId,
+      timestamp_ms: Date.now(),
+      client_version: CLIENT_VERSION
+    });
+    const url = new URL("/v1/auth/verify", serverUrl);
+    const options = {
+      hostname: url.hostname,
+      port: url.port || 443,
+      path: url.pathname,
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "Content-Length": Buffer.byteLength(body),
+        "X-Request-ID": requestId
+      }
+    };
+    const req = https.request(options, (res) => {
+      let data = "";
+      res.on("data", (chunk) => {
+        data += chunk.toString();
+      });
+      res.on("end", () => {
+        try {
+          const parsed = JSON.parse(data);
+          resolve(parsed);
+        } catch {
+          reject(new Error("Auth server returned non-JSON response"));
+        }
+      });
+    });
+    req.setTimeout(3e3, () => {
+      req.destroy(new Error("Auth server request timed out (3000ms)"));
+    });
+    req.on("error", (err) => {
+      reject(err);
+    });
+    req.write(body);
+    req.end();
+  });
+}
+async function serverSideGate(apiKey, toolName) {
+  if (!HELM_AUTH_SERVER_URL) {
+    return null;
+  }
+  const cached = getCached(apiKey, toolName);
+  if (cached !== null) {
+    if (!cached.allowed) {
+      return `Access denied by Helm Auth Server (plan: ${cached.planTier}, cached)`;
+    }
+    return null;
+  }
+  if (!circuitCanAttempt()) {
+    return "Helm Auth Server is temporarily unreachable. Access denied (fail-closed). Please retry in a few minutes.";
+  }
+  try {
+    const resp = await callAuthServer(HELM_AUTH_SERVER_URL, apiKey, toolName);
+    const ttl = typeof resp.cache_ttl_ms === "number" && resp.cache_ttl_ms > 0 ? resp.cache_ttl_ms : 3e5;
+    setCached(apiKey, toolName, resp.allowed, resp.plan_tier ?? "unknown", ttl);
+    circuitRecordSuccess();
+    if (!resp.allowed) {
+      const reason = resp.reason ? ` Reason: ${resp.reason}` : "";
+      return `Access denied by Helm Auth Server (plan: ${resp.plan_tier}).${reason}`;
+    }
+    return null;
+  } catch {
+    circuitRecordFailure();
+    return "Helm Auth Server is unreachable. Access denied (fail-closed). Please retry later.";
+  }
+}
+async function verifyHelmApiKey(apiKey, opts) {
+  if (!apiKey) {
+    return { valid: false, error: "No API key provided" };
+  }
+  if (!apiKey.startsWith("hk-")) {
+    return { valid: false, error: "Invalid key format" };
+  }
+  if (HELM_PUBLIC_KEY_B64 === "PLACEHOLDER_REPLACE_BEFORE_DEPLOY") {
+    if (process.env.HELM_DEV_MODE === "true") {
+      return { valid: true, tier: 0, orgId: "dev-mode" };
+    }
+    return { valid: false, error: "Server misconfiguration: HELM_PUBLIC_KEY not set" };
+  }
+  const jwt = apiKey.slice(3);
+  const parts = jwt.split(".");
+  if (parts.length !== 3) {
+    return { valid: false, error: "Malformed JWT" };
+  }
+  try {
+    const payload = JSON.parse(
+      Buffer.from(parts[1], "base64url").toString("utf8")
+    );
+    if (typeof payload.exp !== "number" || payload.exp < Math.floor(Date.now() / 1e3)) {
+      return { valid: false, error: "Key expired" };
+    }
+    if (payload.iss !== "helm-protocol") {
+      return { valid: false, error: "Invalid issuer" };
+    }
+    const publicKey = (0, import_crypto.createPublicKey)({
+      key: Buffer.from(HELM_PUBLIC_KEY_B64, "base64"),
+      format: "der",
+      type: "spki"
+    });
+    const sigInput = Buffer.from(`${parts[0]}.${parts[1]}`);
+    const sig = Buffer.from(parts[2], "base64url");
+    const isValid = (0, import_crypto.verify)(null, sigInput, publicKey, sig);
+    if (!isValid) {
+      return { valid: false, error: "Invalid signature" };
+    }
+    if (opts?.redisClient && payload.type === "short" && payload.jti) {
+      const redisKey = `helm:jti:${payload.jti}`;
+      const ttl = Math.max(
+        1,
+        payload.exp - Math.floor(Date.now() / 1e3)
+      );
+      const isNew = await opts.redisClient.set(redisKey, "1", {
+        NX: true,
+        EX: ttl
+      });
+      if (isNew === null) {
+        opts.onReplayDetected?.(payload.jti);
+        return { valid: false, error: "Replay detected" };
+      }
+    }
+    if (opts?.toolName) {
+      const gateError = await serverSideGate(apiKey, opts.toolName);
+      if (gateError !== null) {
+        return { valid: false, error: gateError };
+      }
+    }
+    return {
+      valid: true,
+      tier: typeof payload.tier === "number" ? payload.tier : 0,
+      orgId: payload.sub
+    };
+  } catch {
+    return { valid: false, error: "Verification error" };
+  }
+}
+const AUTH_ERROR_MESSAGE = `This tool requires a Helm Protocol API key.
+
+To get access:
+  1. Contact enterprise@helmprotocol.io
+  2. Add the key to your MCP config:
+     { "env": { "HELM_API_KEY": "hk-..." } }
+
+Optional server-side validation:
+  Set HELM_AUTH_SERVER_URL=https://auth.helm-protocol.com for additional
+  server-side gate (quota enforcement, revocation, plan tier checks).
+  HTTPS is required \u2014 HTTP URLs are rejected at startup.
+
+Free tools available without a key: pot_health, pot_stats`;
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AUTH_ERROR_MESSAGE,
+  verifyHelmApiKey
+});