@jieunmarslim/server-editable-slides 0.2.1 → 0.2.3

package/index.js

@@ -71,43 +71,125 @@ async function runDoctor() {
 
   // 1. Check Auth
   if (account && token) {
-    console.error(` [1/3] Google Cloud Authentication:`);
+    console.error(` [1/4] Google Cloud Authentication:`);
     console.error(`       ✓ Authenticated: ${account}`);
   } else {
     hasError = true;
-    console.error(` [1/3] Google Cloud Authentication:`);
+    console.error(` [1/4] Google Cloud Authentication:`);
     console.error(`       ✗ FAILED: Not authenticated or token expired.`);
     console.error(`       👉 Please run: gcloud auth login`);
   }
 
-  // 2. Check Project
-  if (project) {
-    console.error(`\n [2/3] GEAP Billing & Quota Project:`);
-    console.error(`       ✓ Target Project ID: ${project}`);
-  } else {
+  // 2. Check Project Configuration & Account Access Permissions
+  let projectAccessOk = false;
+  if (!project) {
     hasError = true;
-    console.error(`\n [2/3] GEAP Billing & Quota Project:`);
-    console.error(`       ✗ FAILED: No GCP project configured for billing.`);
+    console.error(`\n [2/4] GEAP Billing & Quota Project:`);
+    console.error(`       ✗ FAILED: No GCP project configured.`);
     console.error(`       👉 Please run: gcloud config set project YOUR_GCP_PROJECT_ID`);
     console.error(`       👉 Or export:  export EDITABLE_SLIDES_PROJECT=YOUR_GCP_PROJECT_ID`);
+  } else {
+    try {
+      // Actually verify that the logged-in account has access to this project
+      const check = execSync(
+        `gcloud projects describe ${project} --format="value(projectId)"`,
+        { stdio: ['ignore', 'pipe', 'pipe'] },
+      )
+        .toString()
+        .trim();
+      if (check === project) {
+        projectAccessOk = true;
+        console.error(`\n [2/4] Target GCP Project Accessibility:`);
+        console.error(
+          `       ✓ Verified: Account [${account}] has active access to project [${project}].`,
+        );
+      }
+    } catch (err) {
+      hasError = true;
+      const stderr = err.stderr ? err.stderr.toString() : err.message;
+      console.error(`\n [2/4] Target GCP Project Accessibility:`);
+      if (
+        stderr.includes('does not have permission') ||
+        stderr.includes('caller does not have permission')
+      ) {
+        console.error(
+          `       ✗ ACCESS DENIED: Account [${account}] does NOT have permission to access project [${project}].`,
+        );
+        console.error(
+          `       👉 Solution 1: Switch to an account that has access to [${project}]:`,
+        );
+        console.error(`          gcloud config set account <ACCOUNT_WITH_ACCESS>`);
+        console.error(
+          `       👉 Solution 2: Switch to a project that [${account}] can access:`,
+        );
+        console.error(
+          `          gcloud config set project <ACCESSIBLE_PROJECT_ID>`,
+        );
+      } else if (stderr.includes('not found') || stderr.includes('404')) {
+        console.error(
+          `       ✗ NOT FOUND: Project [${project}] does not exist or was deleted.`,
+        );
+        console.error(
+          `       👉 Please run: gcloud config set project <VALID_PROJECT_ID>`,
+        );
+      } else {
+        console.error(
+          `       ✗ FAILED: Unable to verify project access (${stderr.trim()}).`,
+        );
+      }
+    }
+  }
+
+  // 3. Verify One-Time IAM Delegation to EditNBLM Service Account
+  if (projectAccessOk) {
+    try {
+      const bindings = execSync(
+        `gcloud projects get-iam-policy ${project} --flatten="bindings[].members" --filter="bindings.role:roles/aiplatform.user" --format="value(bindings.members)"`,
+        { stdio: ['ignore', 'pipe', 'ignore'] },
+      ).toString();
+      const hasAiPlatform = bindings.includes(
+        'serviceAccount:editnblm-mcp-runtime@editnblm-in-ge-2036.iam.gserviceaccount.com',
+      );
+
+      console.error(`\n [3/4] GEAP Quota & IAM Delegation:`);
+      if (hasAiPlatform) {
+        console.error(
+          `       ✓ GRANTED: Service account has roles/aiplatform.user on [${project}].`,
+        );
+      } else {
+        hasError = true;
+        console.error(
+          `       ✗ MISSING: editnblm-mcp-runtime has NOT been granted roles/aiplatform.user on [${project}].`,
+        );
+        console.error(`       👉 Please run the delegation commands below.`);
+      }
+    } catch {
+      console.error(`\n [3/4] GEAP Quota & IAM Delegation:`);
+      console.error(
+        `       ⚠️  Could not read IAM policy directly. Ensure the delegation commands below were executed.`,
+      );
+    }
+  } else {
+    console.error(`\n [3/4] GEAP Quota & IAM Delegation:`);
+    console.error(`       ⏸️  Skipped until project access is resolved.`);
   }
 
-  // 3. Check Backend Connectivity
+  // 4. Check Backend Connectivity
   try {
     const res = await fetch(`${BASE_URL}/health`);
     if (res.ok) {
-      console.error(`\n [3/3] EditNBLM Cloud Backend:`);
+      console.error(`\n [4/4] EditNBLM Cloud Backend:`);
       console.error(`       ✓ Status: Connected (${BASE_URL})`);
     } else {
-      console.error(`\n [3/3] EditNBLM Cloud Backend:`);
+      console.error(`\n [4/4] EditNBLM Cloud Backend:`);
       console.error(`       ⚠️  Status: HTTP ${res.status}`);
     }
   } catch (err) {
-    console.error(`\n [3/3] EditNBLM Cloud Backend:`);
+    console.error(`\n [4/4] EditNBLM Cloud Backend:`);
     console.error(`       ✗ Status: Unreachable (${err.message})`);
   }
 
-  // 4. One-Time IAM Delegation command helper
+  // 5. One-Time IAM Delegation command helper
   console.error('\n------------------------------------------------------------------------');
   console.error(' 📋 One-Time IAM Delegation Commands for your Project:');
   console.error('------------------------------------------------------------------------');
@@ -121,7 +203,7 @@ async function runDoctor() {
   console.error('========================================================================\n');
 
   if (!hasError) {
-    console.error('🎉 Pre-flight check PASSED! Your environment is ready to use EditNBLM MCP.\n');
+    console.error('🎉 All checks PASSED! Your environment is ready to use EditNBLM MCP.\n');
     process.exit(0);
   } else {
     console.error('⚠️  Setup incomplete. Please fix the items marked with ✗ above.\n');
@@ -189,7 +271,18 @@ async function callRemoteMcp(method, params, apiKey) {
   const data = JSON.parse(jsonStr);
 
   if (data.error) {
-    throw new Error(data.error.message || JSON.stringify(data.error));
+    const msg = data.error.message || JSON.stringify(data.error);
+    if (
+      msg.includes('aiplatform.endpoints.predict') ||
+      (msg.includes('Permission') && msg.includes('denied'))
+    ) {
+      throw new Error(
+        `[EditNBLM IAM Delegation Required] Project (${project}) has not delegated roles/aiplatform.user to the EditNBLM service account.\n` +
+          `Run in terminal:\n` +
+          `gcloud projects add-iam-policy-binding ${project} --member="serviceAccount:editnblm-mcp-runtime@editnblm-in-ge-2036.iam.gserviceaccount.com" --role="roles/aiplatform.user"`,
+      );
+    }
+    throw new Error(msg);
   }
   return data.result;
 }
@@ -251,7 +344,58 @@ async function downloadPptxHelper(downloadUrl, targetPath) {
   return null;
 }
 
+function assertEnvironmentOrExit() {
+  const account = getAccount();
+  const token = getAuthToken();
+  const project = getProject();
+
+  if (!account || !token) {
+    console.error('\n[EditNBLM] ❌ Activation Failed: Google Cloud authentication required.');
+    console.error('[EditNBLM] Please run `gcloud auth login` before activating this MCP server.');
+    console.error('[EditNBLM] Run `npx -y @jieunmarslim/server-editable-slides doctor` to diagnose.\n');
+    process.exit(1);
+  }
+
+  if (!project) {
+    console.error('\n[EditNBLM] ❌ Activation Failed: No GCP Project configured for GEAP billing.');
+    console.error('[EditNBLM] Please run `gcloud config set project <PROJECT_ID>` or export EDITABLE_SLIDES_PROJECT.');
+    console.error('[EditNBLM] Run `npx -y @jieunmarslim/server-editable-slides doctor` to diagnose.\n');
+    process.exit(1);
+  }
+
+  // Verify that account actually has permission to access the project
+  try {
+    const check = execSync(
+      `gcloud projects describe ${project} --format="value(projectId)"`,
+      { stdio: ['ignore', 'pipe', 'pipe'] },
+    )
+      .toString()
+      .trim();
+    if (check !== project) {
+      throw new Error(`Project mismatch`);
+    }
+  } catch (err) {
+    const stderr = err.stderr ? err.stderr.toString() : err.message;
+    console.error(`\n[EditNBLM] ❌ Activation Failed: Account [${account}] does NOT have access to project [${project}].`);
+    if (
+      stderr.includes('does not have permission') ||
+      stderr.includes('caller does not have permission')
+    ) {
+      console.error(`[EditNBLM] 👉 Solution 1: Switch to an account with access: gcloud config set account <ACCOUNT>`);
+      console.error(`[EditNBLM] 👉 Solution 2: Switch to a project that [${account}] can access: gcloud config set project <PROJECT>`);
+    } else if (stderr.includes('not found') || stderr.includes('404')) {
+      console.error(`[EditNBLM] 👉 Project [${project}] does not exist. Run: gcloud config set project <VALID_PROJECT_ID>`);
+    } else {
+      console.error(`[EditNBLM] 👉 Details: ${stderr.trim()}`);
+    }
+    console.error('[EditNBLM] Run `npx -y @jieunmarslim/server-editable-slides doctor` to diagnose.\n');
+    process.exit(1);
+  }
+}
+
 function startMcpServer() {
+  assertEnvironmentOrExit();
+
   const server = new McpServer({
     name: 'editable-slides',
     version: '1.0.0',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jieunmarslim/server-editable-slides",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "Model Context Protocol (MCP) client for Editable Slides Cloud",
   "type": "module",
   "bin": {