@kya-os/mcp-i-core 1.3.9 → 1.3.10

package/src/services/tool-protection.service.ts

@@ -87,55 +87,56 @@ import type {
 import type { ToolProtectionCache } from "../cache/tool-protection-cache.js";
 import { InMemoryToolProtectionCache } from "../cache/tool-protection-cache.js";
 
+/**
+ * Tool protection data structure in API responses
+ */
+interface ToolProtectionData {
+  requiresDelegation?: boolean;
+  requires_delegation?: boolean;
+  requiredScopes?: string[];
+  required_scopes?: string[];
+  scopes?: string[];
+  riskLevel?: string;
+  risk_level?: string;
+  oauthProvider?: string;
+  oauth_provider?: string;
+  authorization?: {
+    type: string;
+    provider?: string;
+    issuer?: string;
+    credentialType?: string;
+  };
+}
+
 /**
  * Response from AgentShield API bouncer endpoints
  *
  * Supports multiple endpoint formats:
- * 1. Merged config endpoint (/projects/{projectId}/config): { data: { config: { toolProtection: { tools: {...} } } } }
- * 2. Old endpoint (/config?agent_did=...): { data: { tools: [{ name: string, ... }] } }
- * 3. Legacy format: { data: { tools: { [toolName]: {...} } } }
- * 4. Legacy toolProtections format: { data: { toolProtections: {...} } } (deprecated)
+ * 1. Merged config (/projects/{projectId}/config): { data: { config: { toolProtection: { tools: {...} } } } }
+ * 2. Legacy tool-protections endpoint: { data: { toolProtections: { [toolName]: {...} } } }
+ * 3. Old config endpoint (/config?agent_did=...): { data: { tools: [{ name: string, ... }] } }
+ * 4. Legacy format: { data: { tools: { [toolName]: {...} } } }
  */
 interface BouncerConfigApiResponse {
   success: boolean;
   data: {
     agent_did?: string;
-    // Merged config format: config object with embedded toolProtection.tools
+    
+    // NEW: Merged config format (v1.6.0+) - preferred format
+    // The entire config is returned with tools embedded at config.toolProtection.tools
     config?: {
       toolProtection?: {
         source?: string;
-        tools?: Record<
-          string,
-          {
-            requiresDelegation?: boolean;
-            requires_delegation?: boolean;
-            requiredScopes?: string[];
-            required_scopes?: string[];
-            scopes?: string[];
-            riskLevel?: string;
-            risk_level?: string;
-            oauthProvider?: string;
-            oauth_provider?: string;
-          }
-        >;
+        tools?: Record<string, ToolProtectionData>;
       };
+      // Other config fields we don't need to parse
+      [key: string]: unknown;
     };
-    // Legacy toolProtections format (deprecated, kept for backward compatibility)
-    toolProtections?: Record<
-      string,
-      {
-        requiresDelegation?: boolean;
-        requires_delegation?: boolean;
-        requiredScopes?: string[];
-        required_scopes?: string[];
-        scopes?: string[];
-        riskLevel?: string;
-        risk_level?: string;
-        oauthProvider?: string; // Phase 2: Tool-specific OAuth provider
-        oauth_provider?: string; // Phase 2: snake_case variant
-      }
-    >;
-    // Old endpoint format: tools array or object
+    
+    // DEPRECATED: Top-level toolProtections (backward compatibility during transition)
+    toolProtections?: Record<string, ToolProtectionData>;
+    
+    // Legacy endpoint formats
     tools?:
       | Array<{
           name: string;
@@ -143,20 +144,10 @@ interface BouncerConfigApiResponse {
           requires_delegation?: boolean;
           scopes?: string[];
           required_scopes?: string[];
-          oauthProvider?: string; // Phase 2: Tool-specific OAuth provider
-          oauth_provider?: string; // Phase 2: snake_case variant
+          oauthProvider?: string;
+          oauth_provider?: string;
         }>
-      | Record<
-          string,
-          {
-            requiresDelegation?: boolean;
-            requires_delegation?: boolean;
-            scopes?: string[];
-            required_scopes?: string[];
-            oauthProvider?: string; // Phase 2: Tool-specific OAuth provider
-            oauth_provider?: string; // Phase 2: snake_case variant
-          }
-        >;
+      | Record<string, ToolProtectionData>;
     reputation_threshold?: number;
     denied_agents?: string[];
   };
@@ -727,7 +718,10 @@ export class ToolProtectionService {
 
   /**
    * Fetch tool protection config from AgentShield API
-   * Uses projectId endpoint if available (preferred, project-scoped), otherwise falls back to agent_did query param
+   * 
+   * Uses the merged /config endpoint which returns tool protections embedded
+   * at config.toolProtection.tools. Falls back to legacy formats for backward
+   * compatibility.
    *
    * @param agentDid DID of the agent to fetch config for
    * @param options Optional fetch options
@@ -737,17 +731,17 @@ export class ToolProtectionService {
     agentDid: string,
     options?: { bypassCDNCache?: boolean }
   ): Promise<BouncerConfigApiResponse> {
-    // Prefer project-scoped merged config endpoint: /api/v1/bouncer/projects/{projectId}/config
-    // Falls back to old endpoint: /api/v1/bouncer/config?agent_did={did} for backward compatibility
+    // Use the merged /config endpoint which includes embedded tool protections
+    // This endpoint returns config.toolProtection.tools with all tool rules
     let url: string;
-    let useMergedConfigEndpoint = false;
+    let useMergedEndpoint = false;
 
     if (this.config.projectId) {
-      // ✅ MERGED CONFIG ENDPOINT: Project-scoped, returns config with embedded toolProtection.tools
+      // ✅ MERGED CONFIG ENDPOINT: Returns config with embedded toolProtection.tools
       url = `${this.config.apiUrl}/api/v1/bouncer/projects/${encodeURIComponent(this.config.projectId)}/config`;
-      useMergedConfigEndpoint = true;
+      useMergedEndpoint = true;
     } else {
-      // ⚠️ OLD ENDPOINT: Agent-scoped, returns tools array (backward compatibility)
+      // ⚠️ LEGACY ENDPOINT: Agent-scoped, returns tools array (backward compatibility)
       url = `${this.config.apiUrl}/api/v1/bouncer/config?agent_did=${encodeURIComponent(agentDid)}`;
     }
 
@@ -774,9 +768,9 @@ export class ToolProtectionService {
 
     if (this.config.debug) {
       console.log("[ToolProtectionService] Fetching from API:", url, {
-        method: useMergedConfigEndpoint
+        method: useMergedEndpoint
           ? "projects/{projectId}/config (merged)"
-          : "config?agent_did (old)",
+          : "config?agent_did (legacy)",
         projectId: this.config.projectId || "none",
         apiKeyPresent: !!this.config.apiKey,
         apiKeyLength,
@@ -798,19 +792,19 @@ export class ToolProtectionService {
       );
     }
 
-    // Build headers - merged config endpoint uses X-API-Key (preferred), old endpoint uses Authorization Bearer
+    // Build headers - merged endpoint uses X-API-Key, legacy uses Authorization Bearer
     const headers: Record<string, string> = {
       "Content-Type": "application/json",
     };
 
-    if (useMergedConfigEndpoint) {
-      // ✅ Merged config endpoint headers (X-API-Key preferred by AgentShield V1 API)
+    if (useMergedEndpoint) {
+      // ✅ Merged config endpoint headers
       headers["X-API-Key"] = this.config.apiKey;
       if (this.config.projectId) {
         headers["X-Project-Id"] = this.config.projectId;
       }
     } else {
-      // ⚠️ Old endpoint headers (backward compatibility)
+      // ⚠️ Legacy endpoint headers (backward compatibility)
       headers["Authorization"] = `Bearer ${this.config.apiKey}`;
     }
 
@@ -848,6 +842,19 @@ export class ToolProtectionService {
       throw new Error("API returned success: false");
     }
 
+    // Transform merged config format to normalized format
+    // If response contains config.toolProtection.tools, extract them to data.toolProtections
+    if (useMergedEndpoint && data.data.config?.toolProtection?.tools) {
+      // Extract embedded tools to the standard toolProtections field
+      data.data.toolProtections = data.data.config.toolProtection.tools;
+      if (this.config.debug) {
+        console.log("[ToolProtectionService] Extracted tools from merged config", {
+          toolCount: Object.keys(data.data.toolProtections).length,
+          tools: Object.keys(data.data.toolProtections),
+        });
+      }
+    }
+
     return data;
   }