@hexabot-ai/api 3.2.2-alpha.13 → 3.2.2-alpha.15

package/src/mcp/tools/cms-mcp.tools.ts

@@ -0,0 +1,239 @@
+/*
+ * Hexabot — Fair Core License (FCL-1.0-ALv2)
+ * Copyright (c) 2026 Hexastack.
+ * Full terms: see LICENSE.md.
+ */
+
+import { Action } from '@hexabot-ai/types';
+import { Injectable, NotFoundException } from '@nestjs/common';
+import { Tool, ToolGuards } from '@rekog/mcp-nest';
+import { z } from 'zod';
+
+import { ContentTypeOrmEntity } from '@/cms/entities/content-type.entity';
+import { ContentOrmEntity } from '@/cms/entities/content.entity';
+import { ContentTypeService } from '@/cms/services/content-type.service';
+import { ContentService } from '@/cms/services/content.service';
+
+import { McpPermission } from '../decorators/mcp-permission.decorator';
+import { McpPermissionGuard } from '../guards/mcp-permission.guard';
+
+import { HexabotMcpToolBase } from './hexabot-mcp-tool.base';
+import {
+  jsonObjectSchema,
+  PaginationArgs,
+  paginationSchema,
+  uuidSchema,
+} from './hexabot-mcp.schemas';
+
+@Injectable()
+export class HexabotCmsMcpTools extends HexabotMcpToolBase {
+  constructor(
+    private readonly contentTypeService: ContentTypeService,
+    private readonly contentService: ContentService,
+  ) {
+    super();
+  }
+
+  @McpPermission('contenttype', Action.READ)
+  @ToolGuards([McpPermissionGuard])
+  @Tool({
+    name: 'hexabot_content_type_search',
+    description: 'Search CMS content types.',
+    parameters: z.object({
+      query: z.string().optional(),
+      ...paginationSchema,
+    }),
+  })
+  async searchContentTypes(args: { query?: string } & PaginationArgs) {
+    const where = args.query ? { name: this.contains(args.query) } : {};
+
+    return await this.listWithCount(
+      this.contentTypeService,
+      this.findOptions<ContentTypeOrmEntity>(args, where),
+    );
+  }
+
+  @McpPermission('contenttype', Action.READ)
+  @ToolGuards([McpPermissionGuard])
+  @Tool({
+    name: 'hexabot_content_type_get',
+    description: 'Read one CMS content type.',
+    parameters: z.object({
+      id: uuidSchema,
+    }),
+  })
+  async getContentType(args: { id: string }) {
+    const contentType = await this.contentTypeService.findOne(args.id);
+    if (!contentType) {
+      throw new NotFoundException(`Content type ${args.id} not found`);
+    }
+
+    return contentType;
+  }
+
+  @McpPermission('contenttype', Action.CREATE)
+  @ToolGuards([McpPermissionGuard])
+  @Tool({
+    name: 'hexabot_content_type_create',
+    description: 'Create a CMS content type.',
+    parameters: z.object({
+      name: z.string().min(1),
+      schema: jsonObjectSchema,
+    }),
+  })
+  async createContentType(args: {
+    name: string;
+    schema: Record<string, unknown>;
+  }) {
+    return await this.contentTypeService.create(args as any);
+  }
+
+  @McpPermission('contenttype', Action.UPDATE)
+  @ToolGuards([McpPermissionGuard])
+  @Tool({
+    name: 'hexabot_content_type_update',
+    description: 'Update a CMS content type.',
+    parameters: z.object({
+      id: uuidSchema,
+      name: z.string().min(1).optional(),
+      schema: jsonObjectSchema.optional(),
+    }),
+  })
+  async updateContentType(args: { id: string } & Record<string, unknown>) {
+    const { id, ...updates } = args;
+
+    return await this.contentTypeService.updateOne(id, updates as any);
+  }
+
+  @McpPermission('content', Action.READ)
+  @ToolGuards([McpPermissionGuard])
+  @Tool({
+    name: 'hexabot_content_search',
+    description: 'Search CMS content records.',
+    parameters: z.object({
+      query: z.string().optional(),
+      contentTypeId: uuidSchema.optional(),
+      status: z.boolean().optional(),
+      ...paginationSchema,
+    }),
+  })
+  async searchContent(
+    args: {
+      query?: string;
+      contentTypeId?: string;
+      status?: boolean;
+    } & PaginationArgs,
+  ) {
+    if (args.query) {
+      return {
+        items: await this.contentService.textSearch(args.query, {
+          status: args.status,
+          contentTypeId: args.contentTypeId,
+          limit: args.limit,
+        }),
+        limit: args.limit,
+        skip: 0,
+      };
+    }
+
+    const where = {
+      ...(args.contentTypeId
+        ? { contentType: { id: args.contentTypeId } }
+        : {}),
+      ...(args.status !== undefined ? { status: args.status } : {}),
+    } as any;
+
+    return await this.listWithCount(
+      this.contentService,
+      this.findOptions<ContentOrmEntity>(args, where),
+    );
+  }
+
+  @McpPermission('content', Action.READ)
+  @ToolGuards([McpPermissionGuard])
+  @Tool({
+    name: 'hexabot_content_get',
+    description: 'Read one CMS content record.',
+    parameters: z.object({
+      id: uuidSchema,
+    }),
+  })
+  async getContent(args: { id: string }) {
+    const content = await this.contentService.findOneAndPopulate(args.id);
+    if (!content) {
+      throw new NotFoundException(`Content ${args.id} not found`);
+    }
+
+    return content;
+  }
+
+  @McpPermission('content', Action.CREATE)
+  @ToolGuards([McpPermissionGuard])
+  @Tool({
+    name: 'hexabot_content_create',
+    description: 'Create a CMS content record.',
+    parameters: z.object({
+      contentType: uuidSchema,
+      title: z.string().min(1),
+      status: z.boolean().optional(),
+      properties: jsonObjectSchema.optional(),
+    }),
+  })
+  async createContent(args: {
+    contentType: string;
+    title: string;
+    status?: boolean;
+    properties?: Record<string, unknown>;
+  }) {
+    return await this.contentService.create(args as any);
+  }
+
+  @McpPermission('content', Action.UPDATE)
+  @ToolGuards([McpPermissionGuard])
+  @Tool({
+    name: 'hexabot_content_update',
+    description: 'Update a CMS content record.',
+    parameters: z.object({
+      id: uuidSchema,
+      contentType: uuidSchema.optional(),
+      title: z.string().min(1).optional(),
+      status: z.boolean().optional(),
+      properties: jsonObjectSchema.optional(),
+    }),
+  })
+  async updateContent(args: { id: string } & Record<string, unknown>) {
+    const { id, ...updates } = args;
+
+    return await this.contentService.updateOne(id, updates as any);
+  }
+
+  @McpPermission('content', Action.READ)
+  @ToolGuards([McpPermissionGuard])
+  @Tool({
+    name: 'hexabot_rag_content_search',
+    description: 'Search indexed CMS content through Hexabot RAG retrieval.',
+    parameters: z.object({
+      query: z.string().min(1),
+      mode: z.enum(['embedding', 'lexical']).optional(),
+      limit: z.number().int().min(1).max(50).default(10),
+      contentTypeId: uuidSchema.optional(),
+      includeInactive: z.boolean().optional(),
+    }),
+  })
+  async searchRagContent(args: {
+    query: string;
+    mode?: 'embedding' | 'lexical';
+    limit: number;
+    contentTypeId?: string;
+    includeInactive?: boolean;
+  }) {
+    return {
+      items: await this.contentService.retrieve(args.query, {
+        mode: args.mode,
+        limit: args.limit,
+        contentTypeId: args.contentTypeId,
+        includeInactive: args.includeInactive,
+      }),
+    };
+  }
+}

package/src/mcp/tools/credential-mcp.tools.ts

@@ -0,0 +1,81 @@
+/*
+ * Hexabot — Fair Core License (FCL-1.0-ALv2)
+ * Copyright (c) 2026 Hexastack.
+ * Full terms: see LICENSE.md.
+ */
+
+import { Action } from '@hexabot-ai/types';
+import { Injectable, NotFoundException } from '@nestjs/common';
+import { Tool, ToolGuards } from '@rekog/mcp-nest';
+import { z } from 'zod';
+
+import { CredentialService } from '@/user/services/credential.service';
+
+import { McpPermission } from '../decorators/mcp-permission.decorator';
+import { McpPermissionGuard } from '../guards/mcp-permission.guard';
+
+import { HexabotMcpToolBase } from './hexabot-mcp-tool.base';
+import {
+  PaginationArgs,
+  paginationSchema,
+  uuidSchema,
+} from './hexabot-mcp.schemas';
+import { sanitizeCredential } from './hexabot-mcp.utils';
+
+@Injectable()
+export class HexabotCredentialMcpTools extends HexabotMcpToolBase {
+  constructor(private readonly credentialService: CredentialService) {
+    super();
+  }
+
+  @McpPermission('credential', Action.READ)
+  @ToolGuards([McpPermissionGuard])
+  @Tool({
+    name: 'hexabot_credential_search',
+    description:
+      'Search credentials by metadata only. Secret credential values are never returned.',
+    parameters: z.object({
+      query: z.string().optional(),
+      ownerId: uuidSchema.optional(),
+      ...paginationSchema,
+    }),
+  })
+  async searchCredentials(
+    args: { query?: string; ownerId?: string } & PaginationArgs,
+  ) {
+    const where = {
+      ...(args.ownerId ? { owner: { id: args.ownerId } } : {}),
+      ...(args.query ? { name: this.contains(args.query) } : {}),
+    } as any;
+    const result = await this.listWithCount(
+      this.credentialService,
+      this.findOptions(args, where),
+    );
+
+    return {
+      ...result,
+      items: result.items.map((credential) =>
+        sanitizeCredential(credential as Record<string, unknown>),
+      ),
+    };
+  }
+
+  @McpPermission('credential', Action.READ)
+  @ToolGuards([McpPermissionGuard])
+  @Tool({
+    name: 'hexabot_credential_get',
+    description:
+      'Read credential metadata. Secret credential values are never returned.',
+    parameters: z.object({
+      id: uuidSchema,
+    }),
+  })
+  async getCredential(args: { id: string }) {
+    const credential = await this.credentialService.findOneAndPopulate(args.id);
+    if (!credential) {
+      throw new NotFoundException(`Credential ${args.id} not found`);
+    }
+
+    return sanitizeCredential(credential as Record<string, unknown>);
+  }
+}

package/src/mcp/tools/hexabot-mcp-tool.base.ts

@@ -0,0 +1,74 @@
+/*
+ * Hexabot — Fair Core License (FCL-1.0-ALv2)
+ * Copyright (c) 2026 Hexastack.
+ * Full terms: see LICENSE.md.
+ */
+
+import type { User } from '@hexabot-ai/types';
+import { UnauthorizedException } from '@nestjs/common';
+import { FindManyOptions, Like } from 'typeorm';
+
+import { HexabotMcpRequest } from '../types';
+
+import { PaginationArgs } from './hexabot-mcp.schemas';
+
+export abstract class HexabotMcpToolBase {
+  protected findOptions<Entity>(
+    args: PaginationArgs,
+    where: FindManyOptions<Entity>['where'],
+  ): FindManyOptions<Entity> {
+    return {
+      where,
+      take: args.limit,
+      skip: args.skip,
+      order: { [args.sortBy]: args.sortDirection } as any,
+    };
+  }
+
+  protected async listWithCount<Entity>(
+    service: {
+      findAndPopulate(options?: FindManyOptions<Entity>): Promise<unknown[]>;
+      count(options?: FindManyOptions<Entity>): Promise<number>;
+    },
+    options: FindManyOptions<Entity>,
+  ) {
+    const [items, total] = await Promise.all([
+      service.findAndPopulate(options),
+      service.count({ where: options.where }),
+    ]);
+
+    return {
+      items,
+      total,
+      limit: options.take,
+      skip: options.skip,
+    };
+  }
+
+  protected contains(value: string) {
+    return Like(`%${value}%`);
+  }
+
+  protected resolveRelationId(
+    relation: string | { id?: string | null } | null | undefined,
+  ): string | null {
+    if (typeof relation === 'string') {
+      return relation;
+    }
+
+    return relation?.id ?? null;
+  }
+
+  protected getActor(request?: HexabotMcpRequest): User {
+    const actor = request?.hexabotUser ?? request?.user;
+    if (!actor?.id) {
+      throw new UnauthorizedException('MCP Hexabot user is required');
+    }
+
+    return actor as User;
+  }
+
+  protected getActorId(request?: HexabotMcpRequest): string {
+    return this.getActor(request).id;
+  }
+}

package/src/mcp/tools/hexabot-mcp.schemas.ts

@@ -0,0 +1,55 @@
+/*
+ * Hexabot — Fair Core License (FCL-1.0-ALv2)
+ * Copyright (c) 2026 Hexastack.
+ * Full terms: see LICENSE.md.
+ */
+
+import { z } from 'zod';
+
+import {
+  DirectionType,
+  McpServerTransport,
+  WorkflowType,
+} from '@/workflow/types';
+
+export const uuidSchema = z.string().uuid();
+
+export const jsonObjectSchema = z.record(z.string(), z.unknown());
+
+export const paginationSchema = {
+  limit: z.number().int().min(1).max(100).default(20),
+  skip: z.number().int().min(0).default(0),
+  sortBy: z.string().default('createdAt'),
+  sortDirection: z.enum(['ASC', 'DESC']).default('DESC'),
+};
+
+export const workflowPayloadSchema = {
+  name: z.string().min(1).optional(),
+  description: z.string().optional(),
+  type: z.enum(WorkflowType).optional(),
+  schedule: z.string().nullable().optional(),
+  inputSchema: jsonObjectSchema.optional(),
+  builtin: z.boolean().optional(),
+  x: z.number().optional(),
+  y: z.number().optional(),
+  zoom: z.number().optional(),
+  direction: z.enum(DirectionType).optional(),
+};
+
+export const mcpServerPayloadSchema = {
+  name: z.string().min(1).optional(),
+  enabled: z.boolean().optional(),
+  transport: z.enum(McpServerTransport).optional(),
+  url: z.string().nullable().optional(),
+  command: z.string().nullable().optional(),
+  args: z.array(z.string()).nullable().optional(),
+  cwd: z.string().nullable().optional(),
+  credential: uuidSchema.nullable().optional(),
+};
+
+export type PaginationArgs = {
+  limit: number;
+  skip: number;
+  sortBy: string;
+  sortDirection: 'ASC' | 'DESC';
+};