@mgsoftwarebv/mg-dashboard-mcp 7.4.19 → 7.4.21

package/dist/index.js

@@ -1316,6 +1316,257 @@ async function proxyJson(ctx, route, body) {
     content: [{ type: "text", text: JSON.stringify(data, null, 2) }]
   };
 }
+
+// src/mailserver-tools.ts
+var MAILSERVER_TOOL_NAME = "mailserver";
+var MAILSERVER_ACTIONS = [
+  "list-domains",
+  "add-domain",
+  "verify-domain",
+  "list-mailboxes",
+  "create-mailbox",
+  "list-keys",
+  "create-key",
+  "send"
+];
+var DEFAULT_MAILSERVER_URL = "https://mailserver.mgsoftware.nl";
+var MAILSERVER_TOOLS = [
+  {
+    name: MAILSERVER_TOOL_NAME,
+    description: "Configure internal MG Mailserver (mailserver.mgsoftware.nl, send domain mgsoftware.email). Do not use the Postgres tables directly. Actions: list-domains, add-domain, verify-domain, list-mailboxes, create-mailbox, list-keys, create-key (plaintext secret once), send. Customer mailboxes stay on mijn.host \u2014 this is internal Cloudflare Email only.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        action: {
+          type: "string",
+          enum: [...MAILSERVER_ACTIONS],
+          description: "Which mailserver operation to run."
+        },
+        domain: {
+          type: "string",
+          description: "action=add-domain: hostname to register (e.g. mgsoftware.email)."
+        },
+        domainId: {
+          type: "string",
+          description: "UUID of a domains row (verify-domain, create-mailbox, create-key)."
+        },
+        email: {
+          type: "string",
+          description: "action=create-mailbox: full address on a registered domain."
+        },
+        password: {
+          type: "string",
+          description: "action=create-mailbox: webmail password (min 8 chars)."
+        },
+        displayName: {
+          type: "string",
+          description: "action=create-mailbox: optional display name."
+        },
+        keyName: {
+          type: "string",
+          description: "action=create-key: label for the frs_ key."
+        },
+        permissions: {
+          type: "array",
+          items: { type: "string" },
+          description: 'action=create-key: default ["send"].'
+        },
+        from: {
+          type: "string",
+          description: "action=send: From (e.g. MG Mailserver <noreply@mgsoftware.email>)."
+        },
+        to: {
+          type: "string",
+          description: "action=send: recipient email (or comma-separated)."
+        },
+        subject: { type: "string", description: "action=send: subject." },
+        text: { type: "string", description: "action=send: plain text body." },
+        html: { type: "string", description: "action=send: HTML body." }
+      },
+      required: ["action"]
+    }
+  }
+];
+function tokenFromDotenv(content) {
+  for (const line of content.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const eq4 = trimmed.indexOf("=");
+    if (eq4 < 1) continue;
+    const key = trimmed.slice(0, eq4).trim();
+    if (key !== "MAILSERVER_MCP_TOKEN") continue;
+    let value = trimmed.slice(eq4 + 1).trim();
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1);
+    }
+    return value;
+  }
+  return "";
+}
+function asString(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+function planMailserverCall(action, args2) {
+  switch (action) {
+    case "list-domains":
+      return { method: "GET", path: "/api/domains" };
+    case "add-domain": {
+      const domain = asString(args2.domain);
+      if (!domain) return { error: "add-domain needs `domain`" };
+      return { method: "POST", path: "/api/domains", body: { domain } };
+    }
+    case "verify-domain": {
+      const domainId = asString(args2.domainId);
+      if (!domainId) return { error: "verify-domain needs `domainId`" };
+      return { method: "POST", path: `/api/domains/${domainId}/verify` };
+    }
+    case "list-mailboxes":
+      return { method: "GET", path: "/api/imap/accounts" };
+    case "create-mailbox": {
+      const email = asString(args2.email);
+      const password = asString(args2.password);
+      const domainId = asString(args2.domainId);
+      if (!email) return { error: "create-mailbox needs `email`" };
+      if (password.length < 8) return { error: "create-mailbox needs `password` (min 8)" };
+      if (!domainId) return { error: "create-mailbox needs `domainId` (or let the handler resolve it)" };
+      return {
+        method: "POST",
+        path: "/api/imap/accounts",
+        body: {
+          email,
+          password,
+          domain_id: domainId,
+          display_name: asString(args2.displayName) || void 0
+        }
+      };
+    }
+    case "list-keys":
+      return { method: "GET", path: "/api/api-keys" };
+    case "create-key": {
+      const domainId = asString(args2.domainId);
+      const keyName = asString(args2.keyName);
+      if (!domainId) return { error: "create-key needs `domainId`" };
+      if (!keyName) return { error: "create-key needs `keyName`" };
+      const permissions = Array.isArray(args2.permissions) ? args2.permissions.filter((p) => typeof p === "string") : ["send"];
+      return {
+        method: "POST",
+        path: "/api/api-keys",
+        body: { domainId, keyName, permissions }
+      };
+    }
+    case "send": {
+      const from = asString(args2.from);
+      const toRaw = asString(args2.to);
+      const subject = asString(args2.subject);
+      if (!from || !toRaw || !subject) {
+        return { error: "send needs `from`, `to`, and `subject`" };
+      }
+      const to = toRaw.includes(",") ? toRaw.split(",").map((s) => s.trim()).filter(Boolean) : toRaw;
+      return {
+        method: "POST",
+        path: "/api/emails",
+        body: {
+          from,
+          to,
+          subject,
+          text: asString(args2.text) || void 0,
+          html: asString(args2.html) || void 0
+        }
+      };
+    }
+    default:
+      return {
+        error: `Unknown action "${action}". Use: ${MAILSERVER_ACTIONS.join(", ")}`
+      };
+  }
+}
+function domainListFromPayload(payload) {
+  if (!payload || typeof payload !== "object") return [];
+  const data = payload.data;
+  const list = data?.domains;
+  if (!Array.isArray(list)) return [];
+  return list.filter(
+    (d) => Boolean(d) && typeof d === "object" && typeof d.id === "string" && typeof d.domain === "string"
+  );
+}
+async function mailserverFetch(deps, plan) {
+  const fetchFn = deps.fetchFn ?? fetch;
+  const url = `${deps.baseUrl.replace(/\/$/, "")}${plan.path}`;
+  const res = await fetchFn(url, {
+    method: plan.method,
+    headers: {
+      authorization: `Bearer ${deps.token}`,
+      ...plan.body ? { "content-type": "application/json" } : {}
+    },
+    body: plan.body ? JSON.stringify(plan.body) : void 0
+  });
+  const text21 = await res.text();
+  let json = text21;
+  try {
+    json = text21 ? JSON.parse(text21) : null;
+  } catch {
+    json = { error: text21.slice(0, 500) };
+  }
+  return { status: res.status, json };
+}
+async function handleMailserverTool(args2, deps) {
+  const action = asString(args2.action);
+  if (!deps.token) {
+    return {
+      content: [
+        {
+          type: "text",
+          text: "MAILSERVER_MCP_TOKEN is not set (env or MG Mailserver env-store web/production)."
+        }
+      ]
+    };
+  }
+  if (action === "create-mailbox" && !asString(args2.domainId)) {
+    const email = asString(args2.email);
+    const host = email.split("@")[1]?.toLowerCase();
+    if (!host) {
+      return {
+        content: [{ type: "text", text: "create-mailbox needs a full `email` (user@domain)." }]
+      };
+    }
+    const listed = await mailserverFetch(deps, { method: "GET", path: "/api/domains" });
+    const match = domainListFromPayload(listed.json).find(
+      (d) => d.domain.toLowerCase() === host
+    );
+    if (!match) {
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify(
+              {
+                error: `No registered domain for ${host}. add-domain first.`,
+                status: listed.status,
+                domains: listed.json
+              },
+              null,
+              2
+            )
+          }
+        ]
+      };
+    }
+    args2 = { ...args2, domainId: match.id };
+  }
+  const plan = planMailserverCall(action, args2);
+  if ("error" in plan) {
+    return { content: [{ type: "text", text: plan.error }] };
+  }
+  const result = await mailserverFetch(deps, plan);
+  return {
+    content: [
+      {
+        type: "text",
+        text: JSON.stringify({ status: result.status, body: result.json }, null, 2)
+      }
+    ]
+  };
+}
 var ALGORITHM = "aes-256-gcm";
 var IV_LENGTH = 16;
 var AUTH_TAG_LENGTH = 16;
@@ -9029,6 +9280,11 @@ function normalizeAllowedTools(value) {
   const tools = value.filter((t) => typeof t === "string").map((t) => t.trim()).filter(Boolean);
   return tools.length > 0 ? tools : null;
 }
+function isMcpToolAllowed(name, allowed, denied) {
+  if (denied?.includes(name)) return false;
+  if (allowed && allowed.length > 0) return allowed.includes(name);
+  return true;
+}
 var authContext = null;
 var currentClientIp;
 function extractClientIp(req) {
@@ -9057,7 +9313,7 @@ async function validateApiKey(key) {
     return null;
   }
   const apiKeyRows = await db.execute(sql`
-    SELECT id, name, created_by, allowed_server_ids, allowed_tools, is_active, expires_at
+    SELECT id, name, created_by, allowed_server_ids, allowed_tools, denied_tools, is_active, expires_at
     FROM dashboard_mcp_api_key
     WHERE api_key_hash = ${keyHash} AND is_active = true
     LIMIT 1
@@ -9110,6 +9366,7 @@ async function validateApiKey(key) {
     userId: data.created_by,
     allowedServerIds,
     allowedTools: normalizeAllowedTools(data.allowed_tools),
+    deniedTools: normalizeAllowedTools(data.denied_tools),
     permissions,
     roleName
   };
@@ -9304,7 +9561,7 @@ async function validateSshKey(pubkeyPathInput, expectedApiKeyId) {
     return null;
   }
   const apiRows = await db.execute(sql`
-    SELECT id, name, created_by, allowed_server_ids, allowed_tools, is_active, expires_at
+    SELECT id, name, created_by, allowed_server_ids, allowed_tools, denied_tools, is_active, expires_at
     FROM dashboard_mcp_api_key
     WHERE id = ${keyRow.api_key_id} AND is_active = true
     LIMIT 1
@@ -9359,6 +9616,7 @@ async function validateSshKey(pubkeyPathInput, expectedApiKeyId) {
     userId: apiRow.created_by,
     allowedServerIds,
     allowedTools: normalizeAllowedTools(apiRow.allowed_tools),
+    deniedTools: normalizeAllowedTools(apiRow.denied_tools),
     permissions,
     roleName
   };
@@ -9547,6 +9805,23 @@ function decrypt2(payload) {
   decrypted += decipher.final("utf8");
   return decrypted;
 }
+async function readMailserverMcpTokenFromEnvStore() {
+  try {
+    const { stageIds } = await resolveReleaseProfileStageIds("MG Mailserver");
+    const data = await db.execute(sql`
+      SELECT env_data_encrypted
+      FROM env_config
+      WHERE app_name = 'web'
+        AND environment = 'production'
+        AND release_profile_stage_id = ANY(${uuidArrayParam(stageIds)})
+    `);
+    const row = data[0];
+    if (!row) return "";
+    return tokenFromDotenv(decrypt2(row.env_data_encrypted));
+  } catch {
+    return "";
+  }
+}
 function posixQuote(arg) {
   if (arg === "") return "''";
   if (/^[A-Za-z0-9._\/=:@%+\-]+$/.test(arg)) return arg;
@@ -13628,6 +13903,7 @@ var TOOLS = [
       required: ["action"]
     }
   },
+  ...MAILSERVER_TOOLS,
   // ----- Trigger.dev -----
   ...TRIGGER_TOOLS
 ];
@@ -13650,7 +13926,8 @@ async function handleListTools() {
   const allowedTools = authContext.allowedTools;
   const isSuperadmin = authContext.roleName === "superadmin";
   const accessible = TOOLS.filter((tool) => {
-    if (allowedTools && !allowedTools.includes(tool.name)) return false;
+    if (!isMcpToolAllowed(tool.name, allowedTools, authContext.deniedTools))
+      return false;
     if (SUPERADMIN_ONLY_TOOLS.has(tool.name) && !isSuperadmin) return false;
     const requiredModule = TOOL_MODULE_MAP[tool.name];
     if (!requiredModule) return true;
@@ -13664,12 +13941,16 @@ async function handleCallTool(request) {
   }
   const { name, arguments: toolArgs } = request.params;
   const a = toolArgs || {};
-  if (authContext.allowedTools && !authContext.allowedTools.includes(name)) {
+  if (!isMcpToolAllowed(
+    name,
+    authContext.allowedTools,
+    authContext.deniedTools
+  )) {
     return {
       content: [
         {
           type: "text",
-          text: `Access denied: this API key is restricted to a specific tool allowlist and may not call "${name}". Allowed: ${authContext.allowedTools.join(", ")}`
+          text: `Access denied: this API key may not call "${name}".`
         }
       ]
     };
@@ -17383,6 +17664,13 @@ Install: GET https://dashboard.mgsoftware.nl/api/downloads/versions.txt then \u2
           ]
         };
       }
+      case MAILSERVER_TOOL_NAME: {
+        const token = process.env.MAILSERVER_MCP_TOKEN?.trim() || await readMailserverMcpTokenFromEnvStore();
+        return handleMailserverTool(a, {
+          baseUrl: process.env.MAILSERVER_URL?.trim() || DEFAULT_MAILSERVER_URL,
+          token
+        });
+      }
       default:
         if (TRIGGER_TOOL_NAMES.has(name)) {
           return handleTriggerTool(name, a, { sshExec, getServerConnection });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mgsoftwarebv/mg-dashboard-mcp",
-  "version": "7.4.19",
+  "version": "7.4.21",
   "description": "MCP Server for MG Dashboard - SSH, SFTP, Docker, domains, DNS, and environment config tools for Cursor",
   "type": "module",
   "main": "dist/index.js",