@luquimbo/bi-superpowers 1.0.0

package/bin/lib/licensing/storage.test.js

@@ -0,0 +1,55 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const AdmZip = require('adm-zip');
+const storage = require('./storage');
+
+function makeTempDir() {
+  return fs.mkdtempSync(path.join(os.tmpdir(), 'bi-superpowers-'));
+}
+
+test('extractZip extracts safe entries', async () => {
+  const dir = makeTempDir();
+  const zipPath = path.join(dir, 'safe.zip');
+  const zip = new AdmZip();
+  zip.addFile('foo.txt', Buffer.from('ok'));
+  zip.writeZip(zipPath);
+
+  const dest = path.join(dir, 'out');
+  await storage.extractZip(zipPath, dest);
+
+  const content = fs.readFileSync(path.join(dest, 'foo.txt'), 'utf8');
+  assert.equal(content, 'ok');
+});
+
+test('rejects path traversal entries', () => {
+  const destRoot = path.resolve(makeTempDir());
+  assert.equal(storage._isUnsafeZipEntry('../evil.txt', destRoot), true);
+  assert.equal(storage._isUnsafeZipEntry('..\\\\evil.txt', destRoot), true);
+});
+
+test('rejects absolute path entries', () => {
+  const destRoot = path.resolve(makeTempDir());
+  assert.equal(storage._isUnsafeZipEntry('/abs.txt', destRoot), true);
+  assert.equal(storage._isUnsafeZipEntry('C:\\\\abs.txt', destRoot), true);
+});
+
+test('downloadFile rejects non-https URLs', async () => {
+  const dir = makeTempDir();
+  const dest = path.join(dir, 'file.zip');
+
+  await assert.rejects(
+    () => storage.downloadFile('http://example.com/file.zip', dest),
+    /HTTPS required/
+  );
+});
+
+test('_resolveRedirectUrl resolves relative redirects', () => {
+  const resolved = storage._resolveRedirectUrl(
+    'https://example.com/path/file.zip',
+    '/downloads/content.zip'
+  );
+  assert.equal(resolved, 'https://example.com/downloads/content.zip');
+});

package/bin/lib/licensing/validator.js

@@ -0,0 +1,213 @@
+/**
+ * License Validator Module
+ * ========================
+ *
+ * Handles license validation against the Acadevor API server.
+ *
+ * @module lib/licensing/validator
+ */
+
+const https = require('https');
+const http = require('http');
+
+const storage = require('./storage');
+
+/** Base URL for license validation and content download API */
+const API_BASE_URL = process.env.BIAS_API_URL || 'https://acadevor.com';
+
+/**
+ * Make HTTP(S) request with JSON body
+ *
+ * Generic HTTP client that:
+ * - Automatically selects http/https based on URL protocol
+ * - Handles JSON serialization/deserialization
+ * - Returns both status code and parsed data
+ *
+ * @param {string} url - Full URL to request
+ * @param {Object} options - Node.js http/https request options
+ * @param {string} [options.method='GET'] - HTTP method
+ * @param {Object} [options.headers] - Request headers
+ * @param {Object} [data] - Request body (will be JSON.stringify'd)
+ * @returns {Promise<{status: number, data: Object|string}>} Response object
+ * @throws {Error} On network errors
+ */
+function makeRequest(url, options, data) {
+  return new Promise((resolve, reject) => {
+    const urlObj = new URL(url);
+    const protocol = urlObj.protocol === 'https:' ? https : http;
+
+    const req = protocol.request(url, options, (res) => {
+      let body = '';
+      res.on('data', (chunk) => (body += chunk));
+      res.on('end', () => {
+        try {
+          resolve({
+            status: res.statusCode,
+            data: body ? JSON.parse(body) : null,
+          });
+        } catch (e) {
+          resolve({
+            status: res.statusCode,
+            data: body,
+          });
+        }
+      });
+    });
+
+    req.on('error', reject);
+
+    if (data) {
+      req.write(JSON.stringify(data));
+    }
+
+    req.end();
+  });
+}
+
+/**
+ * Validate license with the Acadevor API server
+ *
+ * Makes a POST request to /api/licenses/validate to check if a license key
+ * is valid and active. Returns license metadata and download URL if valid.
+ *
+ * @param {string} licenseKey - The license key to validate
+ * @returns {Promise<Object>} Validation result
+ * @returns {boolean} .valid - Whether the license is valid
+ * @returns {string} [.email] - User's email if valid
+ * @returns {string} [.name] - User's name if valid
+ * @returns {string} [.downloadUrl] - URL to download premium content
+ * @returns {string} [.error] - Error message if invalid
+ */
+async function validateLicense(licenseKey) {
+  // Skip validation in dev mode (requires secret env var)
+  if (process.env.BIAS_DEV_MODE === 'true') {
+    return { valid: true, email: 'developer@local' };
+  }
+
+  try {
+    const response = await makeRequest(
+      `${API_BASE_URL}/api/licenses/validate`,
+      {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+      },
+      { license: licenseKey }
+    );
+
+    return response.data;
+  } catch (error) {
+    console.error('Validation error:', error.message);
+    return { valid: false, error: 'Connection failed' };
+  }
+}
+
+/**
+ * Check if license is valid before running premium commands
+ *
+ * This function acts as a gatekeeper for commands that require premium content.
+ * It performs the following checks:
+ * 1. Verifies a local license file exists
+ * 2. Re-validates the license against the API server
+ * 3. Downloads content if not already installed
+ *
+ * Called by kickoff, recharge, and other premium commands.
+ *
+ * @param {string} version - Current package version for content versioning
+ * @returns {Promise<Object>} Validation result from API
+ * @throws {Error} Exits process if license is invalid or content download fails
+ */
+async function requireLicense(version) {
+  const license = storage.loadLicense();
+
+  if (!license) {
+    console.log(`
+═══════════════════════════════════════════════════════════════
+  LICENSE REQUIRED
+═══════════════════════════════════════════════════════════════
+
+  BI Agent Superpowers requires a valid license to use.
+
+  To activate your license, run:
+
+    super unlock
+
+  Get your license at: https://acadevor.com/bi-superpowers
+
+═══════════════════════════════════════════════════════════════
+`);
+    process.exit(1);
+  }
+
+  // Re-validate license with server
+  console.log('Verifying license...');
+  const result = await validateLicense(license.license);
+
+  if (!result.valid) {
+    console.log(`\n✗ License no longer valid: ${result.error}`);
+    storage.clearLicense();
+    console.log('\nPlease run "bi-superpowers unlock" with a valid license key.');
+    process.exit(1);
+  }
+
+  console.log(`✓ License valid (${license.email})`);
+
+  const contentInstalled = storage.isContentInstalled();
+
+  // Check if content is installed, download if needed
+  if (!contentInstalled) {
+    console.log('\nPremium content not found. Downloading...');
+    if (result.downloadUrl) {
+      const downloaded = await storage.downloadPremiumContent(result.downloadUrl);
+      if (!downloaded) {
+        console.log('\n✗ Content download failed. Please check your internet connection.');
+        console.log('You can retry with "bi-superpowers unlock"');
+        process.exit(1);
+      }
+      // Persist the content version once we successfully downloaded the content.
+      storage.saveLicense({ ...license, contentVersion: version });
+    } else {
+      console.log('\n✗ No download URL provided. Please re-activate your license.');
+      console.log('Run "bi-superpowers unlock" to download content.');
+      process.exit(1);
+    }
+  } else if (license.contentVersion !== version) {
+    // Best-effort refresh: do not block if the user already has content installed.
+    const previousVersion = license.contentVersion || 'unknown';
+    console.log(
+      `\nPremium content may be outdated (${previousVersion} → ${version}). Refreshing...`
+    );
+
+    if (result.downloadUrl) {
+      const refreshed = await storage.downloadPremiumContent(result.downloadUrl);
+      if (refreshed) {
+        storage.saveLicense({ ...license, contentVersion: version });
+        console.log('✓ Premium content refreshed');
+      } else {
+        console.log('⚠ Premium content refresh failed. Continuing with existing content.');
+      }
+    } else {
+      console.log(
+        '⚠ No download URL provided to refresh premium content. Continuing with existing content.'
+      );
+    }
+  }
+
+  console.log('');
+  return result;
+}
+
+/**
+ * Get the API base URL
+ * @returns {string} API base URL
+ */
+function getApiBaseUrl() {
+  return API_BASE_URL;
+}
+
+module.exports = {
+  makeRequest,
+  validateLicense,
+  requireLicense,
+  getApiBaseUrl,
+  API_BASE_URL,
+};

package/bin/lib/licensing/validator.test.js

@@ -0,0 +1,137 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const http = require('http');
+
+const storage = require('./storage');
+
+function startLicenseServer() {
+  const server = http.createServer((req, res) => {
+    if (req.method === 'POST' && req.url === '/api/licenses/validate') {
+      let body = '';
+      req.on('data', (chunk) => (body += chunk));
+      req.on('end', () => {
+        // Minimal happy-path response for requireLicense()
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(
+          JSON.stringify({
+            valid: true,
+            email: 'server@example.com',
+            downloadUrl: 'https://example.com/content.zip',
+          })
+        );
+      });
+      return;
+    }
+
+    res.writeHead(404, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'not found' }));
+  });
+
+  return new Promise((resolve) => {
+    server.listen(0, '127.0.0.1', () => {
+      const address = server.address();
+      resolve({
+        server,
+        baseUrl: `http://127.0.0.1:${address.port}`,
+      });
+    });
+  });
+}
+
+function patch(obj, key, value) {
+  const original = obj[key];
+  obj[key] = value;
+  return () => {
+    obj[key] = original;
+  };
+}
+
+test('requireLicense refreshes premium content on version mismatch (best-effort)', async () => {
+  const { server, baseUrl } = await startLicenseServer();
+  const originalDevMode = process.env.BIAS_DEV_MODE;
+  process.env.BIAS_API_URL = baseUrl;
+  process.env.BIAS_DEV_MODE = 'false';
+  delete require.cache[require.resolve('./validator')];
+  const validator = require('./validator');
+
+  const license = {
+    license: 'LICENSE_KEY',
+    email: 'user@example.com',
+    contentVersion: '1.0.0',
+  };
+
+  let downloadCalls = 0;
+  let savedLicense = null;
+
+  const restores = [
+    patch(storage, 'loadLicense', () => license),
+    patch(storage, 'isContentInstalled', () => true),
+    patch(storage, 'downloadPremiumContent', async () => {
+      downloadCalls += 1;
+      return true;
+    }),
+    patch(storage, 'saveLicense', (data) => {
+      savedLicense = data;
+    }),
+  ];
+
+  try {
+    const result = await validator.requireLicense('2.0.0');
+    assert.equal(result.valid, true);
+    assert.equal(downloadCalls, 1);
+    assert.equal(savedLicense.contentVersion, '2.0.0');
+  } finally {
+    restores.forEach((fn) => fn());
+    server.close();
+    if (originalDevMode === undefined) {
+      delete process.env.BIAS_DEV_MODE;
+    } else {
+      process.env.BIAS_DEV_MODE = originalDevMode;
+    }
+  }
+});
+
+test('requireLicense does not block when refresh fails but content is installed', async () => {
+  const { server, baseUrl } = await startLicenseServer();
+  const originalDevMode = process.env.BIAS_DEV_MODE;
+  process.env.BIAS_API_URL = baseUrl;
+  process.env.BIAS_DEV_MODE = 'false';
+  delete require.cache[require.resolve('./validator')];
+  const validator = require('./validator');
+
+  const license = {
+    license: 'LICENSE_KEY',
+    email: 'user@example.com',
+    contentVersion: '1.0.0',
+  };
+
+  let downloadCalls = 0;
+  let saveCalls = 0;
+
+  const restores = [
+    patch(storage, 'loadLicense', () => license),
+    patch(storage, 'isContentInstalled', () => true),
+    patch(storage, 'downloadPremiumContent', async () => {
+      downloadCalls += 1;
+      return false;
+    }),
+    patch(storage, 'saveLicense', () => {
+      saveCalls += 1;
+    }),
+  ];
+
+  try {
+    const result = await validator.requireLicense('2.0.0');
+    assert.equal(result.valid, true);
+    assert.equal(downloadCalls, 1);
+    assert.equal(saveCalls, 0);
+  } finally {
+    restores.forEach((fn) => fn());
+    server.close();
+    if (originalDevMode === undefined) {
+      delete process.env.BIAS_DEV_MODE;
+    } else {
+      process.env.BIAS_DEV_MODE = originalDevMode;
+    }
+  }
+});

package/bin/lib/microsoft-mcp.js

@@ -0,0 +1,176 @@
+/**
+ * Official Microsoft MCP Configuration Helpers
+ * ============================================
+ *
+ * Single source of truth for the Claude Code plugin and legacy adapter
+ * configurations that point at the official Microsoft Power BI / Fabric
+ * MCP servers.
+ *
+ * @module lib/microsoft-mcp
+ */
+
+const path = require('path');
+
+const REMOTE_POWERBI_URL = 'https://api.fabric.microsoft.com/v1/mcp/powerbi';
+const FABRIC_MCP_PACKAGE = '@microsoft/fabric-mcp@latest';
+const MODELING_SERVER_NAME = 'powerbi-modeling-mcp';
+const REMOTE_SERVER_NAME = 'powerbi-remote';
+const FABRIC_SERVER_NAME = 'fabric-mcp-server';
+const ABSOLUTE_LAUNCHER_MODE = 'absolute';
+const PLUGIN_ROOT_LAUNCHER_MODE = 'plugin-root';
+
+/**
+ * Resolve the launcher script path used to start the official Modeling MCP.
+ *
+ * @param {Object} options - Path resolution options
+ * @param {string} [options.packageDir] - Installed package directory
+ * @param {string} [options.launcherMode] - `absolute` or `plugin-root`
+ * @returns {string} Launcher path expression
+ */
+function resolveModelingLauncherPath(options = {}) {
+  const { packageDir, launcherMode = ABSOLUTE_LAUNCHER_MODE } = options;
+
+  if (launcherMode === PLUGIN_ROOT_LAUNCHER_MODE) {
+    return '${CLAUDE_PLUGIN_ROOT}/bin/mcp/powerbi-modeling-launcher.js';
+  }
+
+  return path.join(packageDir || process.cwd(), 'bin', 'mcp', 'powerbi-modeling-launcher.js');
+}
+
+/**
+ * Create the canonical flat MCP config used by Claude Code plugins.
+ *
+ * @param {Object} options - Generation options
+ * @param {string} [options.packageDir] - Installed package directory
+ * @param {string} [options.launcherMode] - `absolute` or `plugin-root`
+ * @returns {Object} Flat MCP server object
+ */
+function createPluginMcpConfig(options = {}) {
+  const launcherPath = resolveModelingLauncherPath(options);
+
+  return {
+    [REMOTE_SERVER_NAME]: {
+      type: 'http',
+      url: REMOTE_POWERBI_URL,
+    },
+    [FABRIC_SERVER_NAME]: {
+      type: 'stdio',
+      command: 'npx',
+      args: ['-y', FABRIC_MCP_PACKAGE, 'server', 'start', '--mode', 'all'],
+    },
+    [MODELING_SERVER_NAME]: {
+      type: 'stdio',
+      command: 'node',
+      args: [launcherPath],
+    },
+  };
+}
+
+/**
+ * Convert the canonical flat config to the target client format.
+ *
+ * @param {string} format - Target format identifier
+ * @param {Object} options - Generation options
+ * @returns {Object} Config object in the target format
+ */
+function createMcpConfigForFormat(format, options = {}) {
+  const flatConfig = createPluginMcpConfig(options);
+
+  switch (format) {
+    case 'plugin':
+    case 'cursor':
+      return flatConfig;
+
+    case 'claude':
+    case 'kilo':
+    case 'vscode':
+      return { mcpServers: flatConfig };
+
+    case 'opencode':
+      return {
+        mcp: Object.fromEntries(
+          Object.entries(flatConfig).map(([name, config]) => {
+            if (config.type === 'http') {
+              return [name, config];
+            }
+
+            const quotedArgs = (config.args || []).map((arg) =>
+              /\s/.test(arg) ? JSON.stringify(arg) : arg
+            );
+
+            return [
+              name,
+              {
+                type: 'local',
+                command: [config.command, ...quotedArgs].join(' '),
+              },
+            ];
+          })
+        ),
+      };
+
+    default:
+      return { mcpServers: flatConfig };
+  }
+}
+
+/**
+ * Merge a generated MCP config into an existing config object.
+ *
+ * @param {Object} existingConfig - Existing parsed config
+ * @param {Object} newConfig - Generated MCP config
+ * @param {string} format - Target format identifier
+ * @returns {Object} Merged config
+ */
+function mergeMcpConfig(existingConfig, newConfig, format) {
+  const existing = existingConfig || {};
+
+  switch (format) {
+    case 'plugin':
+    case 'cursor':
+      return {
+        ...existing,
+        ...newConfig,
+      };
+
+    case 'claude':
+    case 'kilo':
+    case 'vscode':
+      return {
+        ...existing,
+        mcpServers: {
+          ...(existing.mcpServers || {}),
+          ...(newConfig.mcpServers || {}),
+        },
+      };
+
+    case 'opencode':
+      return {
+        ...existing,
+        mcp: {
+          ...(existing.mcp || {}),
+          ...(newConfig.mcp || {}),
+        },
+      };
+
+    default:
+      return {
+        ...existing,
+        ...newConfig,
+      };
+  }
+}
+
+module.exports = {
+  ABSOLUTE_LAUNCHER_MODE,
+  PLUGIN_ROOT_LAUNCHER_MODE,
+  REMOTE_POWERBI_URL,
+  FABRIC_MCP_PACKAGE,
+  MODELING_SERVER_NAME,
+  REMOTE_SERVER_NAME,
+  FABRIC_SERVER_NAME,
+  resolveModelingLauncherPath,
+  createPluginMcpConfig,
+  createMcpConfigForFormat,
+  mergeMcpConfig,
+};

package/bin/lib/microsoft-mcp.test.js

@@ -0,0 +1,106 @@
+/**
+ * Tests for official Microsoft MCP config helpers.
+ */
+
+const { test, describe } = require('node:test');
+const assert = require('node:assert');
+const path = require('node:path');
+
+const {
+  ABSOLUTE_LAUNCHER_MODE,
+  PLUGIN_ROOT_LAUNCHER_MODE,
+  REMOTE_POWERBI_URL,
+  FABRIC_MCP_PACKAGE,
+  createPluginMcpConfig,
+  createMcpConfigForFormat,
+  mergeMcpConfig,
+  resolveModelingLauncherPath,
+} = require('./microsoft-mcp');
+
+describe('resolveModelingLauncherPath', () => {
+  test('uses plugin root placeholder for plugin builds', () => {
+    const launcherPath = resolveModelingLauncherPath({
+      launcherMode: PLUGIN_ROOT_LAUNCHER_MODE,
+    });
+
+    assert.strictEqual(launcherPath, '${CLAUDE_PLUGIN_ROOT}/bin/mcp/powerbi-modeling-launcher.js');
+  });
+
+  test('uses absolute package path for generated project configs', () => {
+    const launcherPath = resolveModelingLauncherPath({
+      packageDir: '/tmp/bi-superpowers',
+      launcherMode: ABSOLUTE_LAUNCHER_MODE,
+    });
+
+    assert.strictEqual(
+      launcherPath,
+      path.join('/tmp/bi-superpowers', 'bin', 'mcp', 'powerbi-modeling-launcher.js')
+    );
+  });
+});
+
+describe('createPluginMcpConfig', () => {
+  test('returns the official Microsoft MCP defaults', () => {
+    const config = createPluginMcpConfig({
+      packageDir: '/tmp/bi-superpowers',
+      launcherMode: ABSOLUTE_LAUNCHER_MODE,
+    });
+
+    assert.deepStrictEqual(config['powerbi-remote'], {
+      type: 'http',
+      url: REMOTE_POWERBI_URL,
+    });
+    assert.deepStrictEqual(config['fabric-mcp-server'], {
+      type: 'stdio',
+      command: 'npx',
+      args: ['-y', FABRIC_MCP_PACKAGE, 'server', 'start', '--mode', 'all'],
+    });
+    assert.strictEqual(config['powerbi-modeling-mcp'].type, 'stdio');
+    assert.strictEqual(config['powerbi-modeling-mcp'].command, 'node');
+    assert.ok(config['powerbi-modeling-mcp'].args[0].endsWith('powerbi-modeling-launcher.js'));
+  });
+});
+
+describe('createMcpConfigForFormat', () => {
+  test('returns flat plugin config for plugin/cursor outputs', () => {
+    const pluginConfig = createMcpConfigForFormat('plugin');
+    const cursorConfig = createMcpConfigForFormat('cursor');
+
+    assert.ok(pluginConfig['powerbi-remote']);
+    assert.ok(cursorConfig['powerbi-remote']);
+    assert.strictEqual(pluginConfig['powerbi-remote'].type, 'http');
+    assert.strictEqual(cursorConfig['powerbi-remote'].type, 'http');
+  });
+
+  test('returns nested mcpServers config for claude-like outputs', () => {
+    const config = createMcpConfigForFormat('claude');
+
+    assert.ok(config.mcpServers);
+    assert.ok(config.mcpServers['powerbi-modeling-mcp']);
+    assert.ok(config.mcpServers['fabric-mcp-server']);
+  });
+});
+
+describe('mergeMcpConfig', () => {
+  test('merges plugin configs without dropping existing entries', () => {
+    const merged = mergeMcpConfig(
+      { existing: { type: 'http', url: 'https://example.com' } },
+      { 'powerbi-remote': { type: 'http', url: REMOTE_POWERBI_URL } },
+      'plugin'
+    );
+
+    assert.ok(merged.existing);
+    assert.ok(merged['powerbi-remote']);
+  });
+
+  test('merges claude configs inside mcpServers', () => {
+    const merged = mergeMcpConfig(
+      { mcpServers: { existing: { type: 'http', url: 'https://example.com' } } },
+      { mcpServers: { 'powerbi-remote': { type: 'http', url: REMOTE_POWERBI_URL } } },
+      'claude'
+    );
+
+    assert.ok(merged.mcpServers.existing);
+    assert.ok(merged.mcpServers['powerbi-remote']);
+  });
+});