@mcp-weave/nestjs 0.2.0 → 0.3.0

package/dist/index.js

@@ -2,17 +2,17 @@
 
 require('reflect-metadata');
 var core = require('@mcp-weave/core');
+var crypto = require('crypto');
+var http = require('http');
 var index_js = require('@modelcontextprotocol/sdk/server/index.js');
-var stdio_js = require('@modelcontextprotocol/sdk/server/stdio.js');
 var sse_js = require('@modelcontextprotocol/sdk/server/sse.js');
-var http = require('http');
+var stdio_js = require('@modelcontextprotocol/sdk/server/stdio.js');
 
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
-}) : x)(function(x) {
-  if (typeof require !== "undefined") return require.apply(this, arguments);
-  throw Error('Dynamic require of "' + x + '" is not supported');
-});
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var crypto__default = /*#__PURE__*/_interopDefault(crypto);
+
+// src/index.ts
 function McpServer(options) {
   return (target) => {
     const metadata = {
@@ -132,15 +132,162 @@ function getPromptsMetadata(target) {
 function getParamsMetadata(target) {
   return Reflect.getMetadata(core.METADATA_KEYS.PARAMS, target) ?? [];
 }
+
+// src/auth/index.ts
+function normalizeApiKeys(keys) {
+  if (!keys) return [];
+  if (typeof keys === "string") {
+    return [{ key: keys, name: "default" }];
+  }
+  return keys.map((k, index) => {
+    if (typeof k === "string") {
+      return { key: k, name: `key-${index + 1}` };
+    }
+    return k;
+  });
+}
+function extractApiKey(req, headerName = "x-api-key", queryParamName = "api_key") {
+  const headerKey = req.headers[headerName.toLowerCase()];
+  if (headerKey) {
+    return Array.isArray(headerKey) ? headerKey[0] : headerKey;
+  }
+  const authHeader = req.headers["authorization"];
+  if (authHeader && authHeader.startsWith("Bearer ")) {
+    return authHeader.slice(7);
+  }
+  const url = req.url ?? "";
+  const queryIndex = url.indexOf("?");
+  if (queryIndex !== -1) {
+    const searchParams = new URLSearchParams(url.slice(queryIndex + 1));
+    const queryKey = searchParams.get(queryParamName);
+    if (queryKey) return queryKey;
+  }
+  return void 0;
+}
+function validateApiKey(token, apiKeys) {
+  if (!token) {
+    return {
+      success: false,
+      error: "No API key provided"
+    };
+  }
+  const matchedKey = apiKeys.find((k) => k.key === token);
+  if (!matchedKey) {
+    return {
+      success: false,
+      error: "Invalid API key"
+    };
+  }
+  return {
+    success: true,
+    clientId: hashToken(token),
+    clientName: matchedKey.name,
+    scopes: matchedKey.scopes,
+    metadata: matchedKey.metadata
+  };
+}
+function hashToken(token) {
+  if (token.length <= 8) {
+    return "****";
+  }
+  return `${token.slice(0, 4)}...${token.slice(-4)}`;
+}
+function generateRequestId() {
+  return `req_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;
+}
+function createAuthMiddleware(options = {}) {
+  const {
+    enabled = false,
+    apiKeys,
+    headerName = "x-api-key",
+    queryParamName = "api_key",
+    authenticate,
+    onAuthFailure,
+    onAuthSuccess
+  } = options;
+  const normalizedKeys = normalizeApiKeys(apiKeys);
+  return async (req, res) => {
+    const requestId = generateRequestId();
+    const timestamp = /* @__PURE__ */ new Date();
+    if (!enabled) {
+      return {
+        request: req,
+        auth: { success: true, clientId: "anonymous" },
+        requestId,
+        timestamp
+      };
+    }
+    const token = extractApiKey(req, headerName, queryParamName);
+    let result;
+    if (authenticate) {
+      const authResult = await authenticate(token, req);
+      if (typeof authResult === "boolean") {
+        result = {
+          success: authResult,
+          clientId: authResult ? hashToken(token ?? "unknown") : void 0,
+          error: authResult ? void 0 : "Authentication failed"
+        };
+      } else {
+        result = authResult;
+      }
+    } else {
+      result = validateApiKey(token, normalizedKeys);
+    }
+    if (!result.success) {
+      onAuthFailure?.(req, result.error ?? "Unknown error");
+      res.writeHead(401, { "Content-Type": "application/json" });
+      res.end(
+        JSON.stringify({
+          error: "Unauthorized",
+          message: result.error ?? "Authentication required",
+          requestId
+        })
+      );
+      return null;
+    }
+    const authRequest = {
+      request: req,
+      auth: result,
+      requestId,
+      timestamp
+    };
+    onAuthSuccess?.(req, result);
+    return authRequest;
+  };
+}
+function sendUnauthorized(res, message = "Unauthorized", requestId) {
+  res.writeHead(401, { "Content-Type": "application/json" });
+  res.end(
+    JSON.stringify({
+      error: "Unauthorized",
+      message,
+      requestId
+    })
+  );
+}
+function generateApiKey(prefix = "mcp") {
+  const chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+  let key = "";
+  for (let i = 0; i < 32; i++) {
+    key += chars.charAt(Math.floor(Math.random() * chars.length));
+  }
+  return `${prefix}_${key}`;
+}
+
+// src/runtime/server.ts
 var McpRuntimeServer = class {
   server;
   instance;
   metadata;
-  constructor(target, _options = {}) {
+  authOptions;
+  authMiddleware;
+  constructor(target, options = {}) {
     this.metadata = core.extractMetadata(target);
     if (!this.metadata.server) {
       throw new Error(`Class ${target.name} is not decorated with @McpServer`);
     }
+    this.authOptions = options.auth ?? {};
+    this.authMiddleware = createAuthMiddleware(this.authOptions);
     this.server = new index_js.Server(
       {
         name: this.metadata.server.name,
@@ -347,22 +494,29 @@ var McpRuntimeServer = class {
     const httpServer = http.createServer(async (req, res) => {
       res.setHeader("Access-Control-Allow-Origin", "*");
       res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
-      res.setHeader("Access-Control-Allow-Headers", "Content-Type");
+      res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization, X-Api-Key");
       if (req.method === "OPTIONS") {
         res.writeHead(200);
         res.end();
         return;
       }
+      const authResult = await this.authMiddleware(req, res);
+      if (!authResult) return;
       const url = new URL(req.url ?? "/", `http://localhost:${port}`);
+      if (this.authOptions.enabled) {
+        console.error(
+          `[${authResult.requestId}] ${authResult.auth.clientName ?? authResult.auth.clientId} - ${req.method} ${url.pathname}`
+        );
+      }
       if (url.pathname === endpoint && req.method === "GET") {
         const transport = new sse_js.SSEServerTransport(endpoint, res);
         await this.server.connect(transport);
         return;
       }
       if (url.pathname === `${endpoint}/message` && req.method === "POST") {
-        let body = "";
+        let _body = "";
         req.on("data", (chunk) => {
-          body += chunk.toString();
+          _body += chunk.toString();
         });
         req.on("end", () => {
           res.writeHead(200, { "Content-Type": "application/json" });
@@ -406,10 +560,13 @@ var McpRuntimeServer = class {
   async startWebSocket(options = {}) {
     const port = options.port ?? 8080;
     const endpoint = options.endpoint ?? "/ws";
-    const httpServer = http.createServer((req, res) => {
+    const httpServer = http.createServer(async (req, res) => {
       res.setHeader("Access-Control-Allow-Origin", "*");
       res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
-      res.setHeader("Access-Control-Allow-Headers", "Content-Type, Upgrade, Connection");
+      res.setHeader(
+        "Access-Control-Allow-Headers",
+        "Content-Type, Upgrade, Connection, Authorization, X-Api-Key"
+      );
       if (req.method === "OPTIONS") {
         res.writeHead(200);
         res.end();
@@ -422,12 +579,15 @@ var McpRuntimeServer = class {
             status: "ok",
             server: this.metadata.server?.name,
             version: this.metadata.server?.version,
-            transport: "websocket"
+            transport: "websocket",
+            authEnabled: this.authOptions.enabled ?? false
           })
         );
         return;
       }
-      if (req.url === "/") {
+      const authResult = await this.authMiddleware(req, res);
+      if (!authResult) return;
+      if (req.url === "/" || req.url?.startsWith("/?")) {
         res.writeHead(200, { "Content-Type": "application/json" });
         res.end(
           JSON.stringify({
@@ -436,29 +596,53 @@ var McpRuntimeServer = class {
             websocket: `ws://localhost:${port}${endpoint}`,
             tools: this.metadata.tools.length,
             resources: this.metadata.resources.length,
-            prompts: this.metadata.prompts.length
+            prompts: this.metadata.prompts.length,
+            client: authResult.auth.clientName,
+            requestId: authResult.requestId
           })
         );
         return;
       }
       res.writeHead(426, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ error: "Upgrade Required", message: `Connect via WebSocket at ${endpoint}` }));
+      res.end(
+        JSON.stringify({
+          error: "Upgrade Required",
+          message: `Connect via WebSocket at ${endpoint}`
+        })
+      );
     });
-    httpServer.on("upgrade", (req, socket, _head) => {
+    httpServer.on("upgrade", async (req, socket, _head) => {
       const url = new URL(req.url ?? "/", `http://localhost:${port}`);
       if (url.pathname !== endpoint) {
         socket.write("HTTP/1.1 404 Not Found\r\n\r\n");
         socket.destroy();
         return;
       }
+      if (this.authOptions.enabled) {
+        const apiKeys = normalizeApiKeys(this.authOptions.apiKeys);
+        const token = extractApiKey(
+          req,
+          this.authOptions.headerName,
+          this.authOptions.queryParamName
+        );
+        const authResult = validateApiKey(token, apiKeys);
+        if (!authResult.success) {
+          socket.write("HTTP/1.1 401 Unauthorized\r\n\r\n");
+          socket.destroy();
+          this.authOptions.onAuthFailure?.(req, authResult.error ?? "Auth failed");
+          return;
+        }
+        console.error(
+          `[WebSocket] Client connected: ${authResult.clientName ?? authResult.clientId}`
+        );
+      }
       const key = req.headers["sec-websocket-key"];
       if (!key) {
         socket.write("HTTP/1.1 400 Bad Request\r\n\r\n");
         socket.destroy();
         return;
       }
-      const crypto = __require("crypto");
-      const acceptKey = crypto.createHash("sha1").update(key + "258EAFA5-E914-47DA-95CA-C5AB0DC85B11").digest("base64");
+      const acceptKey = crypto__default.default.createHash("sha1").update(key + "258EAFA5-E914-47DA-95CA-C5AB0DC85B11").digest("base64");
       socket.write(
         `HTTP/1.1 101 Switching Protocols\r
 Upgrade: websocket\r
@@ -468,7 +652,7 @@ Sec-WebSocket-Accept: ${acceptKey}\r
 `
       );
       const sessions = /* @__PURE__ */ new Map();
-      const sessionId = crypto.randomUUID();
+      const sessionId = crypto__default.default.randomUUID();
       const encodeFrame = (data) => {
         const payload = Buffer.from(data, "utf8");
         const length = payload.length;
@@ -532,11 +716,13 @@ Sec-WebSocket-Accept: ${acceptKey}\r
         }
       };
       sessions.set(sessionId, { send });
-      send(JSON.stringify({
-        jsonrpc: "2.0",
-        method: "connection/established",
-        params: { sessionId, server: this.metadata.server?.name }
-      }));
+      send(
+        JSON.stringify({
+          jsonrpc: "2.0",
+          method: "connection/established",
+          params: { sessionId, server: this.metadata.server?.name }
+        })
+      );
       let messageBuffer = Buffer.alloc(0);
       socket.on("data", async (chunk) => {
         messageBuffer = Buffer.concat([messageBuffer, chunk]);
@@ -567,11 +753,13 @@ Sec-WebSocket-Accept: ${acceptKey}\r
                 send(JSON.stringify(response));
               }
             } catch (error) {
-              send(JSON.stringify({
-                jsonrpc: "2.0",
-                error: { code: -32700, message: "Parse error" },
-                id: null
-              }));
+              send(
+                JSON.stringify({
+                  jsonrpc: "2.0",
+                  error: { code: -32700, message: "Parse error" },
+                  id: null
+                })
+              );
             }
           }
         }
@@ -602,7 +790,11 @@ Sec-WebSocket-Accept: ${acceptKey}\r
     }
     const req = message;
     if (req.jsonrpc !== "2.0" || !req.method) {
-      return { jsonrpc: "2.0", error: { code: -32600, message: "Invalid Request" }, id: req.id ?? null };
+      return {
+        jsonrpc: "2.0",
+        error: { code: -32600, message: "Invalid Request" },
+        id: req.id ?? null
+      };
     }
     try {
       let result;
@@ -630,21 +822,28 @@ Sec-WebSocket-Accept: ${acceptKey}\r
             }))
           };
           break;
-        case "tools/call":
+        case "tools/call": {
           const toolParams = req.params;
           const tool = this.metadata.tools.find((t) => t.name === toolParams.name);
           if (!tool) {
-            return { jsonrpc: "2.0", error: { code: -32602, message: `Unknown tool: ${toolParams.name}` }, id: req.id };
+            return {
+              jsonrpc: "2.0",
+              error: { code: -32602, message: `Unknown tool: ${toolParams.name}` },
+              id: req.id
+            };
           }
           const method = Reflect.get(this.instance, tool.propertyKey);
           const toolResult = await method.apply(this.instance, [toolParams.arguments ?? {}]);
           result = {
-            content: [{
-              type: "text",
-              text: typeof toolResult === "string" ? toolResult : JSON.stringify(toolResult)
-            }]
+            content: [
+              {
+                type: "text",
+                text: typeof toolResult === "string" ? toolResult : JSON.stringify(toolResult)
+              }
+            ]
           };
           break;
+        }
         case "resources/list":
           result = {
             resources: this.metadata.resources.map((r) => ({
@@ -655,7 +854,7 @@ Sec-WebSocket-Accept: ${acceptKey}\r
             }))
           };
           break;
-        case "resources/read":
+        case "resources/read": {
           const resParams = req.params;
           for (const resource of this.metadata.resources) {
             const uriParams = this.extractUriParams(resource.uri, resParams.uri);
@@ -667,9 +866,14 @@ Sec-WebSocket-Accept: ${acceptKey}\r
             }
           }
           if (!result) {
-            return { jsonrpc: "2.0", error: { code: -32602, message: `Resource not found: ${resParams.uri}` }, id: req.id };
+            return {
+              jsonrpc: "2.0",
+              error: { code: -32602, message: `Resource not found: ${resParams.uri}` },
+              id: req.id
+            };
           }
           break;
+        }
         case "prompts/list":
           result = {
             prompts: this.metadata.prompts.map((p) => ({
@@ -679,18 +883,30 @@ Sec-WebSocket-Accept: ${acceptKey}\r
             }))
           };
           break;
-        case "prompts/get":
+        case "prompts/get": {
           const promptParams = req.params;
           const prompt = this.metadata.prompts.find((p) => p.name === promptParams.name);
           if (!prompt) {
-            return { jsonrpc: "2.0", error: { code: -32602, message: `Unknown prompt: ${promptParams.name}` }, id: req.id };
+            return {
+              jsonrpc: "2.0",
+              error: { code: -32602, message: `Unknown prompt: ${promptParams.name}` },
+              id: req.id
+            };
           }
           const promptMethod = Reflect.get(this.instance, prompt.propertyKey);
-          const promptArgs = this.resolvePromptArgs(prompt.propertyKey, promptParams.arguments ?? {});
+          const promptArgs = this.resolvePromptArgs(
+            prompt.propertyKey,
+            promptParams.arguments ?? {}
+          );
           result = await promptMethod.apply(this.instance, promptArgs);
           break;
+        }
         default:
-          return { jsonrpc: "2.0", error: { code: -32601, message: `Method not found: ${req.method}` }, id: req.id };
+          return {
+            jsonrpc: "2.0",
+            error: { code: -32601, message: `Method not found: ${req.method}` },
+            id: req.id
+          };
       }
       return { jsonrpc: "2.0", result, id: req.id };
     } catch (error) {
@@ -734,13 +950,21 @@ exports.McpRuntimeServer = McpRuntimeServer;
 exports.McpServer = McpServer;
 exports.McpTool = McpTool;
 exports.VERSION = VERSION;
+exports.createAuthMiddleware = createAuthMiddleware;
 exports.createMcpServer = createMcpServer;
+exports.extractApiKey = extractApiKey;
+exports.generateApiKey = generateApiKey;
+exports.generateRequestId = generateRequestId;
 exports.getMcpServers = getMcpServers;
 exports.getParamsMetadata = getParamsMetadata;
 exports.getPromptsMetadata = getPromptsMetadata;
 exports.getResourcesMetadata = getResourcesMetadata;
 exports.getServerMetadata = getServerMetadata;
 exports.getToolsMetadata = getToolsMetadata;
+exports.hashToken = hashToken;
 exports.isMcpServer = isMcpServer;
+exports.normalizeApiKeys = normalizeApiKeys;
+exports.sendUnauthorized = sendUnauthorized;
+exports.validateApiKey = validateApiKey;
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map