@jessejoris/mcp-mysql-via-api 1.0.0

package/dist/permissions/permissionManager.js

@@ -0,0 +1,199 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PermissionManager = exports.TOOL_PERMISSION_MAP = exports.DANGEROUS_SQL_KEYWORDS = exports.ALL_PERMISSIONS = void 0;
+exports.ALL_PERMISSIONS = [
+    "list",
+    "read",
+    "create",
+    "update",
+    "delete",
+    "execute",
+    "ddl",
+    "utility",
+    "transaction",
+];
+exports.DANGEROUS_SQL_KEYWORDS = [
+    "INTO OUTFILE",
+    "INTO DUMPFILE",
+    "LOAD DATA",
+    "LOAD_FILE",
+    "GRANT",
+    "REVOKE",
+    "CREATE USER",
+    "DROP USER",
+    "ALTER USER",
+    "SET PASSWORD",
+];
+exports.TOOL_PERMISSION_MAP = {
+    // Discovery
+    list_databases: "list",
+    list_tables: "list",
+    read_table_schema: "list",
+    get_database_summary: "list",
+    get_schema_erd: "list",
+    get_schema_rag_context: "list",
+    get_all_tables_relationships: "list",
+    search_schema: "list",
+    find_tables_by_keyword: "list",
+    // Read
+    read_records: "read",
+    read_record: "read",
+    count_records: "read",
+    run_select_query: "read",
+    search_data_across_tables: "read",
+    get_column_statistics: "read",
+    // Create
+    create_record: "create",
+    bulk_insert: "create",
+    // Update
+    update_record: "update",
+    bulk_update: "update",
+    // Delete
+    delete_record: "delete",
+    bulk_delete: "delete",
+    // Execute
+    execute_write_query: "execute",
+    // DDL
+    create_table: "ddl",
+    alter_table: "ddl",
+    drop_table: "ddl",
+    execute_ddl: "ddl",
+    // Utility
+    test_connection: "utility",
+    describe_connection: "utility",
+    list_all_tools: "utility",
+    export_table_to_csv: "utility",
+    export_query_to_csv: "utility",
+};
+class PermissionManager {
+    activePermissions;
+    originalConfig;
+    presetName;
+    constructor(permissionsConfig = "all") {
+        this.activePermissions = new Set();
+        this.originalConfig = permissionsConfig;
+        this.parseConfig(permissionsConfig);
+    }
+    parseConfig(configStr) {
+        this.originalConfig = configStr.trim().toLowerCase();
+        this.activePermissions.clear();
+        const normalized = this.originalConfig;
+        if (!normalized || normalized === "all" || normalized === "admin" || normalized === "*") {
+            this.presetName = "admin";
+            exports.ALL_PERMISSIONS.forEach((p) => this.activePermissions.add(p));
+            return;
+        }
+        if (normalized === "only-read" ||
+            normalized === "readonly" ||
+            normalized === "read-only" ||
+            normalized === "only_read" ||
+            normalized === "read_only" ||
+            normalized === "view-only" ||
+            normalized === "view_only") {
+            this.presetName = "only-read";
+            this.activePermissions.add("list");
+            this.activePermissions.add("read");
+            this.activePermissions.add("utility");
+            return;
+        }
+        if (normalized === "read-write" || normalized === "read_write") {
+            this.presetName = "read-write";
+            this.activePermissions.add("list");
+            this.activePermissions.add("read");
+            this.activePermissions.add("create");
+            this.activePermissions.add("update");
+            this.activePermissions.add("utility");
+            return;
+        }
+        // Custom list: comma-separated
+        this.presetName = "custom";
+        const tokens = normalized.split(",").map((s) => s.trim().toLowerCase());
+        tokens.forEach((token) => {
+            if (exports.ALL_PERMISSIONS.includes(token)) {
+                this.activePermissions.add(token);
+            }
+        });
+    }
+    isPermissionAllowed(perm) {
+        return this.activePermissions.has(perm);
+    }
+    isToolAllowed(toolName, queryContext) {
+        const requiredPermission = exports.TOOL_PERMISSION_MAP[toolName];
+        if (!requiredPermission) {
+            return {
+                allowed: false,
+                reason: `Unknown tool '${toolName}'.`,
+            };
+        }
+        // Global check: dangerous SQL keywords (INTO OUTFILE, LOAD DATA, GRANT, etc.)
+        if (queryContext) {
+            const upper = queryContext.toUpperCase();
+            for (const dangerous of exports.DANGEROUS_SQL_KEYWORDS) {
+                if (upper.includes(dangerous)) {
+                    return {
+                        allowed: false,
+                        reason: `Operation contains forbidden dangerous SQL keyword '${dangerous}' for security protection.`,
+                    };
+                }
+            }
+        }
+        // Extra safety: export_query_to_csv must only run read-only queries
+        if (toolName === "export_query_to_csv" && queryContext) {
+            const trimmed = queryContext.trim().toUpperCase();
+            if (!/^(SELECT|SHOW|DESCRIBE|DESC|EXPLAIN)/.test(trimmed)) {
+                return {
+                    allowed: false,
+                    requiredPermission: "read",
+                    reason: `export_query_to_csv requires a read-only query (SELECT, SHOW, DESCRIBE, EXPLAIN).`,
+                };
+            }
+        }
+        // Extra safety: execute_write_query containing DELETE/TRUNCATE requires delete permission
+        if (toolName === "execute_write_query" && queryContext) {
+            const upper = queryContext.toUpperCase();
+            if (upper.includes("DELETE") || upper.includes("TRUNCATE")) {
+                if (!this.activePermissions.has("delete")) {
+                    return {
+                        allowed: false,
+                        requiredPermission: "delete",
+                        reason: `Operation contains DELETE/TRUNCATE statement which requires explicit 'delete' permission.`,
+                    };
+                }
+            }
+            if (upper.includes("DROP TABLE") ||
+                upper.includes("ALTER TABLE") ||
+                upper.includes("CREATE TABLE")) {
+                if (!this.activePermissions.has("ddl")) {
+                    return {
+                        allowed: false,
+                        requiredPermission: "ddl",
+                        reason: `Operation contains DDL statement (CREATE/ALTER/DROP) which requires explicit 'ddl' permission.`,
+                    };
+                }
+            }
+        }
+        if (!this.activePermissions.has(requiredPermission)) {
+            return {
+                allowed: false,
+                requiredPermission,
+                reason: `Permission denied: Tool '${toolName}' requires '${requiredPermission}' permission. Current active permissions: [${Array.from(this.activePermissions).join(", ")}]. Active policy: ${this.presetName || "custom"}.`,
+            };
+        }
+        return { allowed: true, requiredPermission };
+    }
+    getActivePermissions() {
+        return Array.from(this.activePermissions);
+    }
+    getBlockedPermissions() {
+        return exports.ALL_PERMISSIONS.filter((p) => !this.activePermissions.has(p));
+    }
+    getProfileSummary() {
+        return {
+            preset: this.presetName,
+            originalConfig: this.originalConfig,
+            activePermissions: this.getActivePermissions(),
+            blockedPermissions: this.getBlockedPermissions(),
+        };
+    }
+}
+exports.PermissionManager = PermissionManager;

package/dist/server/apiServer.d.ts

@@ -0,0 +1,7 @@
+import { DatabasePoolManager } from "./dbPool.js";
+export interface CreateApiServerOptions {
+    apiKey?: string;
+    poolManager?: DatabasePoolManager;
+    permissions?: string;
+}
+export declare function createApiServer(options?: CreateApiServerOptions): import("express-serve-static-core").Express;