@ibm/ibmi-mcp-server 0.1.2 → 0.3.0

package/dist/ibmi-mcp-server/utils/language/types.d.ts

@@ -0,0 +1,138 @@
+import Statement from "./statement.js";
+export declare enum StatementType {
+    Unknown = "Unknown",
+    Create = "Create",
+    Close = "Close",
+    Insert = "Insert",
+    Select = "Select",
+    With = "With",
+    Update = "Update",
+    Delete = "Delete",
+    Declare = "Declare",
+    Begin = "Begin",
+    Drop = "Drop",
+    End = "End",
+    Else = "Else",
+    Elseif = "Elseif",
+    Call = "Call",
+    Alter = "Alter",
+    Fetch = "Fetch",
+    For = "For",
+    Get = "Get",
+    Goto = "Goto",
+    If = "If",
+    Include = "Include",
+    Iterate = "Iterate",
+    Leave = "Leave",
+    Loop = "Loop",
+    Merge = "Merge",
+    Open = "Open",
+    Pipe = "Pipe",
+    Repeat = "Repeat",
+    Resignal = "Resignal",
+    Return = "Return",
+    Signal = "Signal",
+    Set = "Set",
+    While = "While"
+}
+export declare const StatementTypeWord: {
+    CREATE: StatementType;
+    SELECT: StatementType;
+    WITH: StatementType;
+    INSERT: StatementType;
+    UPDATE: StatementType;
+    DELETE: StatementType;
+    DECLARE: StatementType;
+    DROP: StatementType;
+    END: StatementType;
+    ELSE: StatementType;
+    ELSEIF: StatementType;
+    CALL: StatementType;
+    BEGIN: StatementType;
+    ALTER: StatementType;
+    FOR: StatementType;
+    FETCH: StatementType;
+    GET: StatementType;
+    GOTO: StatementType;
+    IF: StatementType;
+    INCLUDE: StatementType;
+    ITERATE: StatementType;
+    LEAVE: StatementType;
+    LOOP: StatementType;
+    MERGE: StatementType;
+    PIPE: StatementType;
+    REPEAT: StatementType;
+    RESIGNAL: StatementType;
+    RETURN: StatementType;
+    SIGNAL: StatementType;
+    SET: StatementType;
+    WHILE: StatementType;
+};
+export declare enum ClauseType {
+    Unknown = "Unknown",
+    From = "From",
+    Into = "Into",
+    Where = "Where",
+    Having = "Having",
+    Group = "Group",
+    Limit = "Limit",
+    Offset = "Offset",
+    Order = "Order"
+}
+export declare const ClauseTypeWord: {
+    FROM: ClauseType;
+    INTO: ClauseType;
+    WHERE: ClauseType;
+    HAVING: ClauseType;
+    GROUP: ClauseType;
+    LIMIT: ClauseType;
+    OFFSET: ClauseType;
+    ORDER: ClauseType;
+};
+export interface CTEReference {
+    name: string;
+    columns: string[];
+    statement: Statement;
+}
+export interface IRange {
+    start: number;
+    end: number;
+}
+export interface Token {
+    value?: string;
+    block?: Token[];
+    type: string;
+    range: IRange;
+}
+export interface QualifiedObject {
+    schema?: string;
+    name?: string;
+    system?: string;
+}
+export interface ObjectRef {
+    tokens: Token[];
+    object: QualifiedObject;
+    alias?: string;
+    isUDTF?: boolean;
+    fromLateral?: boolean;
+    /** only used within create statements */
+    createType?: string;
+}
+export interface StatementGroup {
+    range: IRange;
+    statements: Statement[];
+}
+export interface Definition extends ObjectRef {
+    range: IRange;
+    children: Definition[];
+}
+export interface ParsedEmbeddedStatement {
+    changed: boolean;
+    content: string;
+    parameterCount: number;
+}
+export interface CallableReference {
+    tokens: Token[];
+    parentRef: ObjectRef;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/ibmi-mcp-server/utils/language/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/ibmi-mcp-server/utils/language/types.ts"],"names":[],"mappings":"AAGA,OAAO,SAAS,MAAM,gBAAgB,CAAC;AAEvC,oBAAY,aAAa;IACvB,OAAO,YAAY;IACnB,MAAM,WAAW;IACjB,KAAK,UAAU;IACf,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,OAAO,YAAY;IACnB,KAAK,UAAU;IACf,IAAI,SAAS;IACb,GAAG,QAAQ;IACX,IAAI,SAAS;IACb,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,KAAK,UAAU;IACf,KAAK,UAAU;IACf,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,IAAI,SAAS;IACb,EAAE,OAAO;IACT,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,KAAK,UAAU;IACf,IAAI,SAAS;IACb,KAAK,UAAU;IACf,IAAI,SAAS;IACb,IAAI,SAAS;IACb,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,GAAG,QAAQ;IACX,KAAK,UAAU;CAChB;AAED,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgC7B,CAAC;AAEF,oBAAY,UAAU;IACpB,OAAO,YAAY;IACnB,IAAI,SAAS;IACb,IAAI,SAAS;IACb,KAAK,UAAU;IACf,MAAM,WAAW;IACjB,KAAK,UAAU;IACf,KAAK,UAAU;IACf,MAAM,WAAW;IACjB,KAAK,UAAU;CAChB;AAED,eAAO,MAAM,cAAc;;;;;;;;;CAS1B,CAAC;AAEF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,SAAS,CAAC;CACtB;AAED,MAAM,WAAW,MAAM;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,KAAK;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,MAAM,EAAE,eAAe,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB,yCAAyC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,SAAS,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,UAAW,SAAQ,SAAS;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,UAAU,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,SAAS,EAAE,SAAS,CAAC;CACtB"}

package/dist/ibmi-mcp-server/utils/language/types.js

@@ -0,0 +1,93 @@
+export var StatementType;
+(function (StatementType) {
+    StatementType["Unknown"] = "Unknown";
+    StatementType["Create"] = "Create";
+    StatementType["Close"] = "Close";
+    StatementType["Insert"] = "Insert";
+    StatementType["Select"] = "Select";
+    StatementType["With"] = "With";
+    StatementType["Update"] = "Update";
+    StatementType["Delete"] = "Delete";
+    StatementType["Declare"] = "Declare";
+    StatementType["Begin"] = "Begin";
+    StatementType["Drop"] = "Drop";
+    StatementType["End"] = "End";
+    StatementType["Else"] = "Else";
+    StatementType["Elseif"] = "Elseif";
+    StatementType["Call"] = "Call";
+    StatementType["Alter"] = "Alter";
+    StatementType["Fetch"] = "Fetch";
+    StatementType["For"] = "For";
+    StatementType["Get"] = "Get";
+    StatementType["Goto"] = "Goto";
+    StatementType["If"] = "If";
+    StatementType["Include"] = "Include";
+    StatementType["Iterate"] = "Iterate";
+    StatementType["Leave"] = "Leave";
+    StatementType["Loop"] = "Loop";
+    StatementType["Merge"] = "Merge";
+    StatementType["Open"] = "Open";
+    StatementType["Pipe"] = "Pipe";
+    StatementType["Repeat"] = "Repeat";
+    StatementType["Resignal"] = "Resignal";
+    StatementType["Return"] = "Return";
+    StatementType["Signal"] = "Signal";
+    StatementType["Set"] = "Set";
+    StatementType["While"] = "While";
+})(StatementType || (StatementType = {}));
+export const StatementTypeWord = {
+    CREATE: StatementType.Create,
+    SELECT: StatementType.Select,
+    WITH: StatementType.With,
+    INSERT: StatementType.Insert,
+    UPDATE: StatementType.Update,
+    DELETE: StatementType.Delete,
+    DECLARE: StatementType.Declare,
+    DROP: StatementType.Drop,
+    END: StatementType.End,
+    ELSE: StatementType.Else,
+    ELSEIF: StatementType.Elseif,
+    CALL: StatementType.Call,
+    BEGIN: StatementType.Begin,
+    ALTER: StatementType.Alter,
+    FOR: StatementType.For,
+    FETCH: StatementType.Fetch,
+    GET: StatementType.Get,
+    GOTO: StatementType.Goto,
+    IF: StatementType.If,
+    INCLUDE: StatementType.Include,
+    ITERATE: StatementType.Iterate,
+    LEAVE: StatementType.Leave,
+    LOOP: StatementType.Loop,
+    MERGE: StatementType.Merge,
+    PIPE: StatementType.Pipe,
+    REPEAT: StatementType.Repeat,
+    RESIGNAL: StatementType.Resignal,
+    RETURN: StatementType.Return,
+    SIGNAL: StatementType.Signal,
+    SET: StatementType.Set,
+    WHILE: StatementType.While,
+};
+export var ClauseType;
+(function (ClauseType) {
+    ClauseType["Unknown"] = "Unknown";
+    ClauseType["From"] = "From";
+    ClauseType["Into"] = "Into";
+    ClauseType["Where"] = "Where";
+    ClauseType["Having"] = "Having";
+    ClauseType["Group"] = "Group";
+    ClauseType["Limit"] = "Limit";
+    ClauseType["Offset"] = "Offset";
+    ClauseType["Order"] = "Order";
+})(ClauseType || (ClauseType = {}));
+export const ClauseTypeWord = {
+    FROM: ClauseType.From,
+    INTO: ClauseType.Into,
+    WHERE: ClauseType.Where,
+    HAVING: ClauseType.Having,
+    GROUP: ClauseType.Group,
+    LIMIT: ClauseType.Limit,
+    OFFSET: ClauseType.Offset,
+    ORDER: ClauseType.Order,
+};
+//# sourceMappingURL=types.js.map

package/dist/ibmi-mcp-server/utils/language/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/ibmi-mcp-server/utils/language/types.ts"],"names":[],"mappings":"AAKA,MAAM,CAAN,IAAY,aAmCX;AAnCD,WAAY,aAAa;IACvB,oCAAmB,CAAA;IACnB,kCAAiB,CAAA;IACjB,gCAAe,CAAA;IACf,kCAAiB,CAAA;IACjB,kCAAiB,CAAA;IACjB,8BAAa,CAAA;IACb,kCAAiB,CAAA;IACjB,kCAAiB,CAAA;IACjB,oCAAmB,CAAA;IACnB,gCAAe,CAAA;IACf,8BAAa,CAAA;IACb,4BAAW,CAAA;IACX,8BAAa,CAAA;IACb,kCAAiB,CAAA;IACjB,8BAAa,CAAA;IACb,gCAAe,CAAA;IACf,gCAAe,CAAA;IACf,4BAAW,CAAA;IACX,4BAAW,CAAA;IACX,8BAAa,CAAA;IACb,0BAAS,CAAA;IACT,oCAAmB,CAAA;IACnB,oCAAmB,CAAA;IACnB,gCAAe,CAAA;IACf,8BAAa,CAAA;IACb,gCAAe,CAAA;IACf,8BAAa,CAAA;IACb,8BAAa,CAAA;IACb,kCAAiB,CAAA;IACjB,sCAAqB,CAAA;IACrB,kCAAiB,CAAA;IACjB,kCAAiB,CAAA;IACjB,4BAAW,CAAA;IACX,gCAAe,CAAA;AACjB,CAAC,EAnCW,aAAa,KAAb,aAAa,QAmCxB;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,MAAM,EAAE,aAAa,CAAC,MAAM;IAC5B,MAAM,EAAE,aAAa,CAAC,MAAM;IAC5B,IAAI,EAAE,aAAa,CAAC,IAAI;IACxB,MAAM,EAAE,aAAa,CAAC,MAAM;IAC5B,MAAM,EAAE,aAAa,CAAC,MAAM;IAC5B,MAAM,EAAE,aAAa,CAAC,MAAM;IAC5B,OAAO,EAAE,aAAa,CAAC,OAAO;IAC9B,IAAI,EAAE,aAAa,CAAC,IAAI;IACxB,GAAG,EAAE,aAAa,CAAC,GAAG;IACtB,IAAI,EAAE,aAAa,CAAC,IAAI;IACxB,MAAM,EAAE,aAAa,CAAC,MAAM;IAC5B,IAAI,EAAE,aAAa,CAAC,IAAI;IACxB,KAAK,EAAE,aAAa,CAAC,KAAK;IAC1B,KAAK,EAAE,aAAa,CAAC,KAAK;IAC1B,GAAG,EAAE,aAAa,CAAC,GAAG;IACtB,KAAK,EAAE,aAAa,CAAC,KAAK;IAC1B,GAAG,EAAE,aAAa,CAAC,GAAG;IACtB,IAAI,EAAE,aAAa,CAAC,IAAI;IACxB,EAAE,EAAE,aAAa,CAAC,EAAE;IACpB,OAAO,EAAE,aAAa,CAAC,OAAO;IAC9B,OAAO,EAAE,aAAa,CAAC,OAAO;IAC9B,KAAK,EAAE,aAAa,CAAC,KAAK;IAC1B,IAAI,EAAE,aAAa,CAAC,IAAI;IACxB,KAAK,EAAE,aAAa,CAAC,KAAK;IAC1B,IAAI,EAAE,aAAa,CAAC,IAAI;IACxB,MAAM,EAAE,aAAa,CAAC,MAAM;IAC5B,QAAQ,EAAE,aAAa,CAAC,QAAQ;IAChC,MAAM,EAAE,aAAa,CAAC,MAAM;IAC5B,MAAM,EAAE,aAAa,CAAC,MAAM;IAC5B,GAAG,EAAE,aAAa,CAAC,GAAG;IACtB,KAAK,EAAE,aAAa,CAAC,KAAK;CAC3B,CAAC;AAEF,MAAM,CAAN,IAAY,UAUX;AAVD,WAAY,UAAU;IACpB,iCAAmB,CAAA;IACnB,2BAAa,CAAA;IACb,2BAAa,CAAA;IACb,6BAAe,CAAA;IACf,+BAAiB,CAAA;IACjB,6BAAe,CAAA;IACf,6BAAe,CAAA;IACf,+BAAiB,CAAA;IACjB,6BAAe,CAAA;AACjB,CAAC,EAVW,UAAU,KAAV,UAAU,QAUrB;AAED,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,IAAI,EAAE,UAAU,CAAC,IAAI;IACrB,IAAI,EAAE,UAAU,CAAC,IAAI;IACrB,KAAK,EAAE,UAAU,CAAC,KAAK;IACvB,MAAM,EAAE,UAAU,CAAC,MAAM;IACzB,KAAK,EAAE,UAAU,CAAC,KAAK;IACvB,KAAK,EAAE,UAAU,CAAC,KAAK;IACvB,MAAM,EAAE,UAAU,CAAC,MAAM;IACzB,KAAK,EAAE,UAAU,CAAC,KAAK;CACxB,CAAC"}

package/dist/ibmi-mcp-server/utils/security/ibmiSqlParser.d.ts

@@ -0,0 +1,48 @@
+/**
+ * @fileoverview IBM i-aware SQL Parser using vscode-db2i's SQL language module
+ * Handles IBM i-specific SQL syntax that standard parsers don't support
+ *
+ * @module src/ibmi-mcp-server/utils/security/ibmiSqlParser
+ */
+import { RequestContext } from "../../../utils/internal/requestContext.js";
+import { StatementType } from "../../utils/language/types.js";
+/**
+ * Parse result from IBM i SQL parser
+ */
+export interface IbmiParseResult {
+    success: boolean;
+    isReadOnly: boolean;
+    statementTypes: string[];
+    violations: string[];
+    error?: string;
+}
+export declare const readOnlyTypes: StatementType[];
+/**
+ * IBM i-aware SQL parser using vscode-db2i's Document class
+ */
+export declare class IbmiSqlParser {
+    /**
+     * Parse and validate SQL query for IBM i
+     *
+     * @param query - SQL query to parse
+     * @param context - Request context for logging
+     * @returns Parse result with read-only validation
+     */
+    static parseQuery(query: string, context: RequestContext): IbmiParseResult;
+    /**
+     * Detect write operations by analyzing statement types
+     *
+     * @param document - Parsed SQL document
+     * @returns Array of violation messages
+     */
+    private static detectWriteOperations;
+    /**
+     * Determine if a statement type is a write operation
+     *
+     * @param type - Statement type enum value
+     * @returns True if the statement modifies data
+     */
+    private static isWriteOperation;
+}
+export { StatementType } from "../../utils/language/types.js";
+//# sourceMappingURL=ibmiSqlParser.d.ts.map

package/dist/ibmi-mcp-server/utils/security/ibmiSqlParser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ibmiSqlParser.d.ts","sourceRoot":"","sources":["../../../../src/ibmi-mcp-server/utils/security/ibmiSqlParser.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEpE,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAE1E;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,aAAa,iBAA6C,CAAC;AAExE;;GAEG;AACH,qBAAa,aAAa;IACxB;;;;;;OAMG;IACH,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,eAAe;IAuD1E;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,qBAAqB;IAiBpC;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,gBAAgB;CAMhC;AAGD,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC"}

package/dist/ibmi-mcp-server/utils/security/ibmiSqlParser.js

@@ -0,0 +1,93 @@
+/**
+ * @fileoverview IBM i-aware SQL Parser using vscode-db2i's SQL language module
+ * Handles IBM i-specific SQL syntax that standard parsers don't support
+ *
+ * @module src/ibmi-mcp-server/utils/security/ibmiSqlParser
+ */
+import { logger } from "../../../utils/internal/logger.js";
+import Document from "../../utils/language/document.js";
+import { StatementType } from "../../utils/language/types.js";
+export const readOnlyTypes = [StatementType.Select, StatementType.With];
+/**
+ * IBM i-aware SQL parser using vscode-db2i's Document class
+ */
+export class IbmiSqlParser {
+    /**
+     * Parse and validate SQL query for IBM i
+     *
+     * @param query - SQL query to parse
+     * @param context - Request context for logging
+     * @returns Parse result with read-only validation
+     */
+    static parseQuery(query, context) {
+        try {
+            // Parse query using vscode-db2i's Document class
+            const document = new Document(query);
+            // Extract statement types from parsed statements
+            const statementTypes = document.statements.map((stmt) => StatementType[stmt.type] || "Unknown");
+            // Check for write operations by analyzing statement types
+            const violations = this.detectWriteOperations(document);
+            // Determine if query is read-only
+            const isReadOnly = violations.length === 0;
+            logger.debug({
+                ...context,
+                statementTypes,
+                isReadOnly,
+                violationCount: violations.length,
+                statementCount: document.statements.length,
+            }, "IBM i SQL parsed successfully with vscode-db2i parser");
+            return {
+                success: true,
+                isReadOnly,
+                statementTypes,
+                violations,
+            };
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            logger.debug({
+                ...context,
+                error: errorMessage,
+            }, "vscode-db2i parsing failed - will fall back to other validators");
+            return {
+                success: false,
+                isReadOnly: false,
+                statementTypes: [],
+                violations: ["Parse error"],
+                error: errorMessage,
+            };
+        }
+    }
+    /**
+     * Detect write operations by analyzing statement types
+     *
+     * @param document - Parsed SQL document
+     * @returns Array of violation messages
+     */
+    static detectWriteOperations(document) {
+        const violations = [];
+        for (const statement of document.statements) {
+            const stmtType = statement.type;
+            // Check if statement type is a write operation
+            if (this.isWriteOperation(stmtType)) {
+                violations.push(`Write operation detected: ${StatementType[stmtType] || "Unknown"}`);
+            }
+        }
+        return violations;
+    }
+    /**
+     * Determine if a statement type is a write operation
+     *
+     * @param type - Statement type enum value
+     * @returns True if the statement modifies data
+     */
+    static isWriteOperation(type) {
+        // Only SELECT and WITH (CTE) are read-only
+        // All other statement types (including CALL) are write operations
+        // TODO: Consider refining this logic if certain CALL statements are allowed
+        return !readOnlyTypes.includes(type);
+    }
+}
+// Re-export StatementType for convenience
+export { StatementType } from "../../utils/language/types.js";
+//# sourceMappingURL=ibmiSqlParser.js.map

package/dist/ibmi-mcp-server/utils/security/ibmiSqlParser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ibmiSqlParser.js","sourceRoot":"","sources":["../../../../src/ibmi-mcp-server/utils/security/ibmiSqlParser.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAEpD,OAAO,QAAQ,MAAM,8CAA8C,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAa1E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC;AAExE;;GAEG;AACH,MAAM,OAAO,aAAa;IACxB;;;;;;OAMG;IACH,MAAM,CAAC,UAAU,CAAC,KAAa,EAAE,OAAuB;QACtD,IAAI,CAAC;YACH,iDAAiD;YACjD,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC;YAErC,iDAAiD;YACjD,MAAM,cAAc,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAC5C,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAChD,CAAC;YAEF,0DAA0D;YAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;YAExD,kCAAkC;YAClC,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC;YAE3C,MAAM,CAAC,KAAK,CACV;gBACE,GAAG,OAAO;gBACV,cAAc;gBACd,UAAU;gBACV,cAAc,EAAE,UAAU,CAAC,MAAM;gBACjC,cAAc,EAAE,QAAQ,CAAC,UAAU,CAAC,MAAM;aAC3C,EACD,uDAAuD,CACxD,CAAC;YAEF,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,UAAU;gBACV,cAAc;gBACd,UAAU;aACX,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,GAChB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAEzD,MAAM,CAAC,KAAK,CACV;gBACE,GAAG,OAAO;gBACV,KAAK,EAAE,YAAY;aACpB,EACD,iEAAiE,CAClE,CAAC;YAEF,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,UAAU,EAAE,KAAK;gBACjB,cAAc,EAAE,EAAE;gBAClB,UAAU,EAAE,CAAC,aAAa,CAAC;gBAC3B,KAAK,EAAE,YAAY;aACpB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,qBAAqB,CAAC,QAAkB;QACrD,MAAM,UAAU,GAAa,EAAE,CAAC;QAEhC,KAAK,MAAM,SAAS,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC5C,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC;YAEhC,+CAA+C;YAC/C,IAAI,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACpC,UAAU,CAAC,IAAI,CACb,6BAA6B,aAAa,CAAC,QAAQ,CAAC,IAAI,SAAS,EAAE,CACpE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,gBAAgB,CAAC,IAAmB;QACjD,2CAA2C;QAC3C,kEAAkE;QAClE,4EAA4E;QAC5E,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;CACF;AAED,0CAA0C;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC"}

package/dist/ibmi-mcp-server/utils/security/sqlSecurityValidator.d.ts

@@ -1,6 +1,6 @@
 /**
  * @fileoverview SQL Security Validator for validating SQL queries against security policies
- * Provides both AST-based and regex-based validation with comprehensive security checks
+ * Uses vscode-db2i tokenizer for precise validation and regex patterns as fallback
  *
  * @module src/utils/security/sqlSecurityValidator
  */
@@ -15,25 +15,49 @@ export interface SecurityValidationResult {
     /** List of security violations found */
     violations: string[];
     /** Validation method used */
-    validationMethod: "ast" | "regex" | "combined";
+    validationMethod: "regex" | "combined";
 }
 /**
  * Dangerous SQL operations that should be blocked in read-only mode
  */
-export declare const DANGEROUS_OPERATIONS: readonly ["INSERT", "UPDATE", "DELETE", "REPLACE", "MERGE", "TRUNCATE", "DROP", "CREATE", "ALTER", "RENAME", "CALL", "EXEC", "EXECUTE", "SET", "DECLARE", "GRANT", "REVOKE", "DENY", "LOAD", "IMPORT", "EXPORT", "BULK", "SHUTDOWN", "RESTART", "KILL", "STOP", "START", "BACKUP", "RESTORE", "DUMP", "LOCK", "UNLOCK", "COMMIT", "ROLLBACK", "SAVEPOINT", "QCMDEXC", "SQL_EXECUTE_IMMEDIATE"];
-/**
- * Dangerous SQL functions that should be monitored/blocked
- */
-export declare const DANGEROUS_FUNCTIONS: readonly ["SYSTEM", "QCMDEXC", "SQL_EXECUTE_IMMEDIATE", "SQLCMD", "LOAD_EXTENSION", "EXEC", "EXECUTE_IMMEDIATE", "EVAL", "CONCAT", "CHAR", "VARCHAR"];
+export declare const DANGEROUS_OPERATIONS: readonly ["INSERT", "UPDATE", "DELETE", "MERGE", "TRUNCATE", "DROP", "CREATE", "ALTER", "RENAME", "CALL", "EXEC", "EXECUTE", "SET", "DECLARE", "GRANT", "REVOKE", "DENY", "LOAD", "IMPORT", "EXPORT", "BULK", "SHUTDOWN", "RESTART", "KILL", "STOP", "START", "BACKUP", "RESTORE", "DUMP", "LOCK", "UNLOCK", "COMMIT", "ROLLBACK", "SAVEPOINT", "QCMDEXC", "SQL_EXECUTE_IMMEDIATE"];
 /**
  * Dangerous SQL patterns that should be detected
  */
-export declare const DANGEROUS_PATTERNS: readonly [RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp];
+export declare const DANGEROUS_PATTERNS: readonly [RegExp, RegExp, RegExp];
 /**
  * SQL Security Validator class for comprehensive SQL security validation
+ * Uses token-based validation with vscode-db2i tokenizer as primary method
  */
 export declare class SqlSecurityValidator {
-    private static parser;
+    private static tokeniser;
+    /**
+     * Truncate query string for error messages and logging
+     * @param query - SQL query to truncate
+     * @param maxLength - Maximum length before truncation (default: 100)
+     * @returns Truncated query with ellipsis if needed
+     * @private
+     */
+    private static truncateQuery;
+    /**
+     * Throw validation error with standardized format
+     * @param message - Error message
+     * @param violations - List of violations
+     * @param context - Additional context for error
+     * @param query - SQL query being validated
+     * @throws McpError with ValidationError code
+     * @private
+     */
+    private static throwValidationError;
+    /**
+     * Validate forbidden keywords using token-based approach
+     * This method uses the vscode-db2i tokenizer to precisely identify SQL keywords
+     * @param query - SQL query to validate
+     * @param forbiddenKeywords - List of forbidden keywords
+     * @returns Security validation result
+     * @private
+     */
+    private static validateForbiddenKeywordsToken;
     /**
      * Validate SQL query against security configuration
      * @param query - SQL query to validate
@@ -50,7 +74,7 @@ export declare class SqlSecurityValidator {
      */
     private static validateQueryLength;
     /**
-     * Validate forbidden keywords using both AST and regex approaches
+     * Validate forbidden keywords using token-based approach with regex fallback
      * @param query - SQL query to validate
      * @param securityConfig - Security configuration
      * @param context - Request context for logging
@@ -58,59 +82,11 @@ export declare class SqlSecurityValidator {
      */
     private static validateForbiddenKeywords;
     /**
-     * Validate read-only restrictions using comprehensive validation
+     * Validate read-only restrictions using IBM i parser with regex fallback
      * @param query - SQL query to validate
      * @param context - Request context for logging
      * @private
      */
     private static validateReadOnlyRestrictions;
-    /**
-     * Validate SQL query using AST parsing
-     * @param query - SQL query to validate
-     * @param context - Request context for logging
-     * @private
-     */
-    private static validateQueryAST;
-    /**
-     * Validate SQL query using regex patterns
-     * @param query - SQL query to validate
-     * @param _context - Request context for logging (unused but kept for consistency)
-     * @private
-     */
-    private static validateQueryRegex;
-    /**
-     * Validate forbidden keywords using AST parsing
-     * @param query - SQL query to validate
-     * @param forbiddenKeywords - List of forbidden keywords
-     * @param context - Request context for logging
-     * @private
-     */
-    private static validateForbiddenKeywordsAST;
-    /**
-     * Validate forbidden keywords using regex patterns
-     * @param query - SQL query to validate
-     * @param forbiddenKeywords - List of forbidden keywords
-     * @private
-     */
-    private static validateForbiddenKeywordsRegex;
-    /**
-     * Find dangerous functions anywhere in the AST
-     * @param node - AST node to analyze
-     * @private
-     */
-    private static findDangerousFunctionsInAST;
-    /**
-     * Find forbidden keywords anywhere in the AST
-     * @param node - AST node to analyze
-     * @param forbiddenKeywords - List of forbidden keywords
-     * @private
-     */
-    private static findForbiddenKeywordsInAST;
-    /**
-     * Check for UNION with dangerous statements
-     * @param statement - AST statement to check
-     * @private
-     */
-    private static hasUnionWithDangerousStatements;
 }
 //# sourceMappingURL=sqlSecurityValidator.d.ts.map

package/dist/ibmi-mcp-server/utils/security/sqlSecurityValidator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sqlSecurityValidator.d.ts","sourceRoot":"","sources":["../../../../src/ibmi-mcp-server/utils/security/sqlSecurityValidator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAE/D;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,oCAAoC;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,wCAAwC;IACxC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,6BAA6B;IAC7B,gBAAgB,EAAE,KAAK,GAAG,OAAO,GAAG,UAAU,CAAC;CAChD;AAED;;GAEG;AACH,eAAO,MAAM,oBAAoB,gYAgDvB,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,mBAAmB,uJAYtB,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,kBAAkB,2EAcrB,CAAC;AAEX;;GAEG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,MAAM,CAAC,MAAM,CAAgB;IAErC;;;;;;OAMG;IACH,MAAM,CAAC,aAAa,CAClB,KAAK,EAAE,MAAM,EACb,cAAc,EAAE,qBAAqB,EACrC,OAAO,EAAE,cAAc,GACtB,IAAI;IA8BP;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,mBAAmB;IAkBlC;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,yBAAyB;IAgDxC;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,4BAA4B;IAiC3C;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,gBAAgB;IA4E/B;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,kBAAkB;IAoCjC;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,4BAA4B;IAsC3C;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,8BAA8B;IAuB7C;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,2BAA2B;IA+B1C;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,0BAA0B;IAuCzC;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,+BAA+B;CAmB/C"}
+{"version":3,"file":"sqlSecurityValidator.d.ts","sourceRoot":"","sources":["../../../../src/ibmi-mcp-server/utils/security/sqlSecurityValidator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAK/D;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,oCAAoC;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,wCAAwC;IACxC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,6BAA6B;IAC7B,gBAAgB,EAAE,OAAO,GAAG,UAAU,CAAC;CACxC;AAED;;GAEG;AACH,eAAO,MAAM,oBAAoB,qXA+CvB,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,kBAAkB,mCAOrB,CAAC;AAEX;;;GAGG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,MAAM,CAAC,SAAS,CAAsB;IAE9C;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,aAAa;IAM5B;;;;;;;;OAQG;IACH,OAAO,CAAC,MAAM,CAAC,oBAAoB;IAanC;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,8BAA8B;IA6B7C;;;;;;OAMG;IACH,MAAM,CAAC,aAAa,CAClB,KAAK,EAAE,MAAM,EACb,cAAc,EAAE,qBAAqB,EACrC,OAAO,EAAE,cAAc,GACtB,IAAI;IA8BP;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,mBAAmB;IAkBlC;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,yBAAyB;IA+DxC;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,4BAA4B;CA0D5C"}