@launchdarkly/mcp-server 0.7.0 → 0.7.2

package/src/sdk/metrics.ts

@@ -0,0 +1,134 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import { metricsCreate } from "../funcs/metricsCreate.js";
+import { metricsGet } from "../funcs/metricsGet.js";
+import { metricsList } from "../funcs/metricsList.js";
+import { metricsPatch } from "../funcs/metricsPatch.js";
+import { ClientSDK, RequestOptions } from "../lib/sdks.js";
+import * as components from "../models/components/index.js";
+import * as operations from "../models/operations/index.js";
+import { unwrapAsync } from "../types/fp.js";
+
+export class Metrics extends ClientSDK {
+  /**
+   * List metrics
+   *
+   * @remarks
+   * Get a list of all metrics for the specified project.
+   *
+   * ### Filtering metrics
+   *
+   * The `filter` parameter supports the following operators: `contains`, `equals`, `anyOf`.
+   *
+   * #### Supported fields and operators
+   *
+   * You can only filter certain fields in metrics when using the `filter` parameter. Additionally, you can only filter some fields with certain operators.
+   *
+   * When you search for metrics, the `filter` parameter supports the following fields and operators:
+   *
+   * |<div style="width:120px">Field</div> |Description |Supported operators |
+   * |---|---|---|
+   * | `dataSourceKeys` | The data source that provides events for this metric (for example, "launchdarkly-hosted"). | `anyOf`, `notEquals` |
+   * | `eventKeys` | The metric event key. | `anyOf` |
+   * | `eventKind` | The metric event kind. One of `custom`, `pageview`, `click`. | `equals` |
+   * | `hasConnections` | Whether the metric has connections to experiments or guarded rollouts. One of `true`, `false`. | `equals` |
+   * | `isNumeric` | Whether the metric is numeric. One of `true`, `false`. | `equals` |
+   * | `maintainerIds` | A comma-separated list of metric maintainer IDs. | `anyOf` |
+   * | `maintainerTeamKey` | The metric maintainer team key. | `equals` |
+   * | `metricUsedIn` | Filter by where the metric is used. One of `experiments`, `guarded_rollouts`, `any`, `none`. | `equals` |
+   * | `query` | A "fuzzy" search across metric key and name. Supply a string or list of strings to the operator. | `equals` |
+   * | `tags` | The metric tags. | `contains` |
+   * | `unitAggregationType` | The metric's unit aggregation type. One of `sum`, `average`. | `equals` |
+   * | `versionIds` | The metric version number. | `anyOf` |
+   * | `view` | The view used to restrict access to the metric. | `equals` |
+   *
+   * For example, the filter `?filter=tags contains ["tag1", "tag2", "tag3"]` matches metrics that have all three tags.
+   *
+   * The documented values for `filter` query parameters are prior to URL encoding. For example, the `[` in `?filter=tags contains ["tag1", "tag2", "tag3"]` must be encoded to `%5B`.
+   *
+   * ### Expanding the metric list response
+   *
+   * LaunchDarkly supports expanding the "List metrics" response. By default, the expandable field is **not** included in the response.
+   *
+   * To expand the response, append the `expand` query parameter and add the following supported field:
+   *
+   * - `experimentCount` includes the number of experiments from the specific project that use the metric
+   *
+   * For example, `expand=experimentCount` includes the `experimentCount` field for each metric in the response.
+   */
+  async list(
+    request: operations.GetMetricsRequest,
+    options?: RequestOptions,
+  ): Promise<components.MetricCollectionRep> {
+    return unwrapAsync(metricsList(
+      this,
+      request,
+      options,
+    ));
+  }
+
+  /**
+   * Create metric
+   *
+   * @remarks
+   * Create a new metric in the specified project. The expected `POST` body differs depending on the specified `kind` property.
+   */
+  async create(
+    request: operations.PostMetricRequest,
+    options?: RequestOptions,
+  ): Promise<components.MetricRep> {
+    return unwrapAsync(metricsCreate(
+      this,
+      request,
+      options,
+    ));
+  }
+
+  /**
+   * Get metric
+   *
+   * @remarks
+   * Get information for a single metric from the specific project.
+   *
+   * ### Expanding the metric response
+   * LaunchDarkly supports four fields for expanding the "Get metric" response. By default, these fields are **not** included in the response.
+   *
+   * To expand the response, append the `expand` query parameter and add a comma-separated list with any of the following fields:
+   *
+   * - `experiments` includes all experiments from the specific project that use the metric
+   * - `experimentCount` includes the number of experiments from the specific project that use the metric
+   * - `metricGroups` includes all metric groups from the specific project that use the metric
+   * - `metricGroupCount` includes the number of metric groups from the specific project that use the metric
+   *
+   * For example, `expand=experiments` includes the `experiments` field in the response.
+   */
+  async get(
+    request: operations.GetMetricRequest,
+    options?: RequestOptions,
+  ): Promise<components.MetricRep> {
+    return unwrapAsync(metricsGet(
+      this,
+      request,
+      options,
+    ));
+  }
+
+  /**
+   * Update metric
+   *
+   * @remarks
+   * Patch a metric by key. Updating a metric uses a [JSON patch](https://datatracker.ietf.org/doc/html/rfc6902) representation of the desired changes. To learn more, read [Updates](https://launchdarkly.com/docs/api#updates).
+   */
+  async patch(
+    request: operations.PatchMetricRequest,
+    options?: RequestOptions,
+  ): Promise<components.MetricRep> {
+    return unwrapAsync(metricsPatch(
+      this,
+      request,
+      options,
+    ));
+  }
+}

package/src/sdk/sdk.ts

@@ -7,7 +7,9 @@ import { AiConfigs } from "./aiconfigs.js";
 import { AuditLog } from "./auditlog.js";
 import { CodeReferences } from "./codereferences.js";
 import { Environments } from "./environments.js";
+import { Experiments } from "./experiments.js";
 import { FeatureFlags } from "./featureflags.js";
+import { Metrics } from "./metrics.js";
 
 export class LaunchDarkly extends ClientSDK {
   private _auditLog?: AuditLog;
@@ -25,11 +27,21 @@ export class LaunchDarkly extends ClientSDK {
     return (this._featureFlags ??= new FeatureFlags(this._options));
   }
 
+  private _metrics?: Metrics;
+  get metrics(): Metrics {
+    return (this._metrics ??= new Metrics(this._options));
+  }
+
   private _environments?: Environments;
   get environments(): Environments {
     return (this._environments ??= new Environments(this._options));
   }
 
+  private _experiments?: Experiments;
+  get experiments(): Experiments {
+    return (this._experiments ??= new Experiments(this._options));
+  }
+
   private _aiConfigs?: AiConfigs;
   get aiConfigs(): AiConfigs {
     return (this._aiConfigs ??= new AiConfigs(this._options));

package/test/tls-blocklist.test.mjs

@@ -0,0 +1,314 @@
+import assert from "node:assert/strict";
+import { execFile, execFileSync, spawnSync } from "node:child_process";
+import { X509Certificate } from "node:crypto";
+import fs from "node:fs";
+import https from "node:https";
+import os from "node:os";
+import path from "node:path";
+import process from "node:process";
+import tls from "node:tls";
+import { after, before, describe, test } from "node:test";
+import { fileURLToPath } from "node:url";
+import {
+  BLOCKED_CERT_ERROR_CODE,
+  BLOCKED_SPKI_SHA256,
+  checkServerIdentity,
+  isNodeVersionPatched,
+  spkiSha256,
+  unpatchedRuntimeWarning,
+} from "../dist/esm/mcp-server/cli/start/tls-blocklist.js";
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const blocklistModule = path.join(
+  here,
+  "../dist/esm/mcp-server/cli/start/tls-blocklist.js",
+);
+// From https://emudhra.we-have-a-problem.com/impacted-intermediates.json
+const impacted = JSON.parse(
+  fs.readFileSync(
+    path.join(here, "fixtures/emudhra-impacted-intermediates.json"),
+    "utf8",
+  ),
+);
+// app.launchdarkly.com leaf + GlobalSign Atlas intermediate, captured 2026-10-21.
+const ldChainPems = fs
+  .readFileSync(
+    path.join(here, "fixtures/app-launchdarkly-com-chain.pem"),
+    "utf8",
+  )
+  .match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g);
+
+/** Builds a tls.PeerCertificate-shaped chain (leaf first) from PEMs. */
+function peerChain(pems) {
+  const certs = pems.map((pem) => {
+    const x = new X509Certificate(pem);
+    const name = (dn) =>
+      Object.fromEntries(
+        dn.split("\n").map((l) => l.split(/=(.*)/s).slice(0, 2)),
+      );
+    return {
+      raw: x.raw,
+      fingerprint256: x.fingerprint256,
+      subject: name(x.subject),
+      issuer: name(x.issuer),
+      subjectaltname: x.subjectAltName,
+    };
+  });
+  certs.forEach((c, i) => {
+    c.issuerCertificate = certs[i + 1] ?? c;
+  });
+  return certs[0];
+}
+
+const globalSignR3 = tls.rootCertificates.find((pem) =>
+  new X509Certificate(pem).subject.includes("OU=GlobalSign Root CA - R3"),
+);
+
+test("the fixture covers 16 certificates over the 8 blocked keys", () => {
+  assert.equal(impacted.length, 16);
+  assert.deepEqual(
+    new Set(impacted.map((c) => c.spki_sha256.toLowerCase())),
+    BLOCKED_SPKI_SHA256,
+  );
+});
+
+describe("checkServerIdentity", () => {
+  for (const cert of impacted) {
+    const label = `${cert.name} (issued by ${cert.issued_by})`;
+
+    test(`blocks ${label} as a chain element`, () => {
+      assert.equal(
+        spkiSha256(new X509Certificate(cert.pem).raw),
+        cert.spki_sha256.toLowerCase(),
+      );
+      // A leaf whose issuer name is benign, so only the key hash can catch it.
+      const chain = peerChain([ldChainPems[0], cert.pem, globalSignR3]);
+      chain.issuer = { CN: "Some Other CA" };
+      const err = checkServerIdentity("app.launchdarkly.com", chain);
+      assert.ok(err instanceof Error);
+      assert.equal(err.code, BLOCKED_CERT_ERROR_CODE);
+      assert.match(err.message, /blocked public key/);
+    });
+
+    test(`blocks a leaf issued by ${label} when only the leaf is visible`, () => {
+      // Bun's fetch passes only the leaf to checkServerIdentity.
+      const leaf = peerChain([ldChainPems[0]]);
+      const cn = new X509Certificate(cert.pem).subject.match(/CN=(.*)/)[1];
+      leaf.issuer = { C: "NL", O: "eMudhra BV", CN: cn };
+      delete leaf.issuerCertificate;
+      const err = checkServerIdentity("app.launchdarkly.com", leaf);
+      assert.equal(err?.code, BLOCKED_CERT_ERROR_CODE);
+      assert.match(err.message, /issued by/);
+    });
+  }
+
+  test("blocks issuer names regardless of case and spacing", () => {
+    const leaf = peerChain([ldChainPems[0]]);
+    leaf.issuer = { CN: "  em  dv tls CA - g3B " };
+    delete leaf.issuerCertificate;
+    assert.equal(
+      checkServerIdentity("app.launchdarkly.com", leaf)?.code,
+      BLOCKED_CERT_ERROR_CODE,
+    );
+  });
+
+  test("allows the real app.launchdarkly.com chain", () => {
+    assert.ok(globalSignR3, "GlobalSign Root CA - R3 is in the bundled roots");
+    const chain = peerChain([...ldChainPems, globalSignR3]);
+    assert.equal(checkServerIdentity("app.launchdarkly.com", chain), undefined);
+  });
+
+  test("still enforces the hostname", () => {
+    const chain = peerChain([...ldChainPems, globalSignR3]);
+    const err = checkServerIdentity("evil.example.com", chain);
+    assert.equal(err?.code, "ERR_TLS_CERT_ALTNAME_INVALID");
+  });
+});
+
+describe("unpatchedRuntimeWarning", () => {
+  const cases = [
+    ["22.23.3", false],
+    ["22.23.4", true],
+    ["24.2.0", false],
+    ["24.22.0", false],
+    ["24.22.1", true],
+    ["24.23.0", true],
+    ["20.19.5", false],
+    ["23.11.1", false],
+    ["25.9.0", false],
+    ["26.12.0", false],
+    ["26.12.1", true],
+    ["27.0.0", true],
+  ];
+  for (const [version, patched] of cases) {
+    test(`Node.js ${version} is ${patched ? "patched" : "unpatched"}`, () => {
+      assert.equal(isNodeVersionPatched(version), patched);
+      assert.equal(
+        unpatchedRuntimeWarning({ node: version }) === undefined,
+        patched,
+      );
+    });
+  }
+
+  test("always warns on Bun until a fixed release is recorded", () => {
+    assert.match(
+      unpatchedRuntimeWarning({ node: "24.3.0", bun: "1.4.3" }),
+      /Bun 1\.4\.3/,
+    );
+  });
+});
+
+// End to end: a real TLS handshake through a chain whose intermediate carries
+// a blocked eMudhra name (with our own key, since nobody has the real ones).
+const haveOpenSSL = spawnSync("openssl", ["version"]).status === 0;
+describe(
+  "installTlsBlocklist with global fetch",
+  { skip: !haveOpenSSL && "openssl not available" },
+  () => {
+    let dir;
+    const servers = [];
+    const urls = {};
+
+    function openssl(...args) {
+      execFileSync("openssl", args, { cwd: dir, stdio: "ignore" });
+    }
+
+    function issue(name, subject, issuer, ext) {
+      openssl(
+        "req",
+        "-new",
+        "-newkey",
+        "ec",
+        "-pkeyopt",
+        "ec_paramgen_curve:P-256",
+        "-nodes",
+        "-keyout",
+        `${name}.key`,
+        "-out",
+        `${name}.csr`,
+        "-subj",
+        subject,
+      );
+      fs.writeFileSync(path.join(dir, `${name}.ext`), ext);
+      openssl(
+        "x509",
+        "-req",
+        "-in",
+        `${name}.csr`,
+        "-CA",
+        `${issuer}.pem`,
+        "-CAkey",
+        `${issuer}.key`,
+        "-CAcreateserial",
+        "-days",
+        "2",
+        "-out",
+        `${name}.pem`,
+        "-extfile",
+        `${name}.ext`,
+      );
+    }
+
+    async function serve(label, intermediate) {
+      const read = (f) => fs.readFileSync(path.join(dir, f));
+      const server = https.createServer(
+        {
+          key: read(`${label}-leaf.key`),
+          cert: Buffer.concat([
+            read(`${label}-leaf.pem`),
+            read(`${intermediate}.pem`),
+          ]),
+        },
+        (_req, res) => res.end("ok"),
+      );
+      await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+      servers.push(server);
+      urls[label] = `https://localhost:${server.address().port}/`;
+    }
+
+    before(async () => {
+      dir = fs.mkdtempSync(path.join(os.tmpdir(), "tls-blocklist-"));
+      openssl(
+        "req",
+        "-x509",
+        "-newkey",
+        "ec",
+        "-pkeyopt",
+        "ec_paramgen_curve:P-256",
+        "-nodes",
+        "-keyout",
+        "root.key",
+        "-out",
+        "root.pem",
+        "-days",
+        "2",
+        "-subj",
+        "/CN=Test Root",
+        "-addext",
+        "basicConstraints=critical,CA:TRUE",
+        "-addext",
+        "keyUsage=critical,keyCertSign,cRLSign",
+      );
+      const caExt =
+        "basicConstraints=critical,CA:TRUE,pathlen:0\nkeyUsage=critical,keyCertSign,cRLSign\n";
+      const leafExt =
+        "basicConstraints=critical,CA:FALSE\nsubjectAltName=DNS:localhost\nextendedKeyUsage=serverAuth\n";
+      issue(
+        "emudhra-int",
+        "/C=NL/O=eMudhra BV/CN=EM DV TLS CA - G3B",
+        "root",
+        caExt,
+      );
+      issue("benign-int", "/CN=Test Intermediate", "root", caExt);
+      issue("emudhra-leaf", "/CN=localhost", "emudhra-int", leafExt);
+      issue("benign-leaf", "/CN=localhost", "benign-int", leafExt);
+      await serve("emudhra", "emudhra-int");
+      await serve("benign", "benign-int");
+    });
+
+    after(() => {
+      servers.forEach((s) => s.close());
+      fs.rmSync(dir, { recursive: true, force: true });
+    });
+
+    // Each case runs in a child process so the global patch and the extra CA
+    // stay out of this test process.
+    function fetchInChild(url, install) {
+      const script = `
+      const { installTlsBlocklist } = await import(${JSON.stringify(blocklistModule)});
+      if (${install}) installTlsBlocklist();
+      try { const r = await fetch(${JSON.stringify(url)}); console.log("OK " + r.status); }
+      catch (e) { console.log("FAIL " + (e.cause?.code ?? e.code ?? e.message)); }`;
+      // Async, so this process can keep serving the handshake.
+      return new Promise((resolve, reject) => {
+        execFile(
+          process.execPath,
+          ["--input-type=module", "-e", script],
+          {
+            env: {
+              ...process.env,
+              NODE_EXTRA_CA_CERTS: path.join(dir, "root.pem"),
+            },
+          },
+          (err, stdout) => (err ? reject(err) : resolve(stdout.trim())),
+        );
+      });
+    }
+
+    test("rejects a chain through a blocked eMudhra intermediate", async () => {
+      assert.equal(
+        await fetchInChild(urls.emudhra, false),
+        "OK 200",
+        "control: the chain is otherwise valid",
+      );
+      assert.equal(
+        await fetchInChild(urls.emudhra, true),
+        `FAIL ${BLOCKED_CERT_ERROR_CODE}`,
+      );
+    });
+
+    test("allows a chain through any other intermediate", async () => {
+      assert.equal(await fetchInChild(urls.benign, true), "OK 200");
+    });
+  },
+);