@mgsoftwarebv/mg-dashboard-mcp 7.4.24 → 7.4.26

package/dist/index.js

@@ -724,10 +724,10 @@ var TRIGGER_TOOL_MODULE_MAP = {
   "trigger-env": "settings"
 };
 async function discoverInstance(projectSlug, conn, proxy, sshExec2) {
-  const sql35 = `SELECT re.\\"apiKey\\" || '~~' || p.\\"externalRef\\" FROM \\"RuntimeEnvironment\\" re JOIN \\"Project\\" p ON re.\\"projectId\\" = p.id WHERE p.slug='${projectSlug}' AND re.slug='prod' LIMIT 1`;
+  const sql37 = `SELECT re.\\"apiKey\\" || '~~' || p.\\"externalRef\\" FROM \\"RuntimeEnvironment\\" re JOIN \\"Project\\" p ON re.\\"projectId\\" = p.id WHERE p.slug='${projectSlug}' AND re.slug='prod' LIMIT 1`;
   const cmd = [
     `PORT=$(docker port "${WA_CONTAINER}" 3000/tcp 2>/dev/null | head -1 | sed 's/.*://')`,
-    `ROW=$(docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql35}" 2>/dev/null | tr -d '[:space:]')`,
+    `ROW=$(docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql37}" 2>/dev/null | tr -d '[:space:]')`,
     'echo "$PORT|$ROW"'
   ].join(" && ");
   const result = await sshExec2(conn, cmd, proxy);
@@ -749,8 +749,8 @@ async function discoverInstance(projectSlug, conn, proxy, sshExec2) {
   return { port, apiKey: apiKey2, projectRef: projectRef || "" };
 }
 async function fetchRunLogs(runId, conn, proxy, sshExec2) {
-  const sql35 = `SELECT level, message, \\"isError\\", \\"createdAt\\" FROM \\"TaskEvent\\" WHERE \\"runId\\" = '${runId}' AND level IN ('INFO','WARN','ERROR','DEBUG','LOG','TRACE') ORDER BY \\"startTime\\" ASC LIMIT 200`;
-  const cmd = `docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql35}" 2>/dev/null`;
+  const sql37 = `SELECT level, message, \\"isError\\", \\"createdAt\\" FROM \\"TaskEvent\\" WHERE \\"runId\\" = '${runId}' AND level IN ('INFO','WARN','ERROR','DEBUG','LOG','TRACE') ORDER BY \\"startTime\\" ASC LIMIT 200`;
+  const cmd = `docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql37}" 2>/dev/null`;
   const result = await sshExec2(conn, cmd, proxy);
   const output = result.stdout.trim();
   if (!output) return "";
@@ -832,8 +832,8 @@ async function handleTriggerTool(name, args2, deps) {
   switch (name) {
     // -----------------------------------------------------------------
     case "trigger-list": {
-      const sql35 = 'SELECT slug, name FROM \\"Project\\" ORDER BY name';
-      const cmd = `docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql35}" 2>/dev/null`;
+      const sql37 = 'SELECT slug, name FROM \\"Project\\" ORDER BY name';
+      const cmd = `docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql37}" 2>/dev/null`;
       const result = await sshExec2(conn, cmd, proxy);
       const output = result.stdout.trim();
       if (!output) {
@@ -1317,6 +1317,56 @@ async function proxyJson(ctx, route, body) {
   };
 }
 
+// src/git-credential-tools.ts
+var GIT_CREDENTIAL_TOOL_NAME = "git-credential";
+var GIT_CREDENTIAL_TOOLS = [
+  {
+    name: GIT_CREDENTIAL_TOOL_NAME,
+    description: "Issue a 15-minute mggit access token for git.mgsoftware.nl (username=token, Basic password). Bound to owner/name + write bit. Intended for git credential helpers and agents that need to clone/fetch/push. Not a git runner \u2014 do not use this to execute git commands. Requires module git_hosting.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        repo: {
+          type: "string",
+          description: "Repository as owner/name (e.g. MGSoftwareBV/mg-dashboard)."
+        },
+        write: {
+          type: "boolean",
+          description: "Request push rights (default true). Fetch-only: false."
+        }
+      },
+      required: ["repo"]
+    }
+  }
+];
+async function handleGitCredentialTool(args2, ctx) {
+  const repo = typeof args2.repo === "string" ? args2.repo.trim() : "";
+  if (!repo) {
+    return { content: [{ type: "text", text: "Error: repo is required (owner/name)" }] };
+  }
+  const write = args2.write !== false;
+  const res = await fetch(`${ctx.dashboardBaseUrl.replace(/\/$/, "")}/api/git/credential`, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      authorization: `Bearer ${ctx.apiKey}`
+    },
+    body: JSON.stringify({ repo, write })
+  });
+  const text23 = await res.text().catch(() => "");
+  if (!res.ok) {
+    return {
+      content: [
+        {
+          type: "text",
+          text: `Error: git-credential failed (${res.status}). ${text23.slice(0, 300)}`
+        }
+      ]
+    };
+  }
+  return { content: [{ type: "text", text: text23 || "{}" }] };
+}
+
 // src/mailserver-tools.ts
 var MAILSERVER_TOOL_NAME = "mailserver";
 var MAILSERVER_ACTIONS = [
@@ -6291,6 +6341,52 @@ pgTable("two_factor", {
   secret: text("secret").notNull(),
   backupCodes: text("backup_codes")
 });
+var oauthApplications = pgTable("oauth_application", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  clientId: text("client_id").notNull().unique(),
+  clientSecret: text("client_secret"),
+  name: text("name").notNull(),
+  icon: text("icon"),
+  metadata: text("metadata"),
+  redirectUrls: text("redirect_urls").notNull(),
+  type: text("type").notNull(),
+  disabled: boolean("disabled").notNull().default(false),
+  userId: uuid("user_id").references(() => users.id, { onDelete: "cascade" }),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+});
+pgTable("oauth_access_token", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  accessToken: text("access_token").notNull().unique(),
+  refreshToken: text("refresh_token").unique(),
+  accessTokenExpiresAt: timestamp("access_token_expires_at", {
+    withTimezone: true
+  }).notNull(),
+  refreshTokenExpiresAt: timestamp("refresh_token_expires_at", {
+    withTimezone: true
+  }),
+  clientId: text("client_id").notNull().references(() => oauthApplications.clientId, { onDelete: "cascade" }),
+  userId: uuid("user_id").references(() => users.id, { onDelete: "cascade" }),
+  scopes: text("scopes").notNull().default(""),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+});
+pgTable("oauth_consent", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  clientId: text("client_id").notNull().references(() => oauthApplications.clientId, { onDelete: "cascade" }),
+  userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  scopes: text("scopes").notNull().default(""),
+  consentGiven: boolean("consent_given").notNull().default(false),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+});
+pgTable("jwks", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  publicKey: text("public_key").notNull(),
+  privateKey: text("private_key").notNull(),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  expiresAt: timestamp("expires_at", { withTimezone: true })
+});
 var WIKI_EMBEDDING_DIMENSIONS = 1536;
 var vector = customType({
   dataType(config) {
@@ -7331,6 +7427,62 @@ pgTable(
     index("git_access_log_op_status_idx").on(table.op, table.status)
   ]
 );
+pgTable(
+  "git_credential_grant",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    tokenHash: text("token_hash").notNull(),
+    userId: uuid("user_id").notNull(),
+    apiKeyId: uuid("api_key_id"),
+    helperDeviceId: uuid("helper_device_id"),
+    repo: text("repo").notNull(),
+    write: boolean("write").notNull().default(true),
+    principal: text("principal").notNull(),
+    expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+    issuedIp: text("issued_ip").notNull().default(""),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("git_credential_grant_token_hash_uidx").on(table.tokenHash),
+    index("git_credential_grant_expires_idx").on(table.expiresAt),
+    index("git_credential_grant_user_idx").on(table.userId, table.expiresAt),
+    index("git_credential_grant_helper_device_idx").on(table.helperDeviceId)
+  ]
+);
+pgTable(
+  "git_helper_enroll",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    userId: uuid("user_id").notNull(),
+    codeHash: text("code_hash").notNull(),
+    expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+    usedAt: timestamp("used_at", { withTimezone: true }),
+    issuedIp: text("issued_ip").notNull().default(""),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("git_helper_enroll_code_hash_uidx").on(table.codeHash),
+    index("git_helper_enroll_user_idx").on(table.userId, table.expiresAt)
+  ]
+);
+pgTable(
+  "git_helper_device",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    userId: uuid("user_id").notNull(),
+    tokenHash: text("token_hash").notNull(),
+    expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+    revokedAt: timestamp("revoked_at", { withTimezone: true }),
+    lastUsedAt: timestamp("last_used_at", { withTimezone: true }),
+    issuedIp: text("issued_ip").notNull().default(""),
+    userAgent: text("user_agent").notNull().default(""),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("git_helper_device_token_hash_uidx").on(table.tokenHash),
+    index("git_helper_device_user_idx").on(table.userId, table.expiresAt)
+  ]
+);
 var directoryLinkType = pgEnum("directory_link_type", [
   "dofollow",
   "nofollow",
@@ -8135,6 +8287,22 @@ pgTable(
     )
   ]
 );
+
+// ../platform/dist/utils/permissions.js
+var MODULE_KEYS = [
+  "users",
+  "ssh_servers",
+  "wiki",
+  "ci_cd",
+  "settings",
+  "cursor_remote",
+  "code_battle",
+  "git_hosting"
+];
+({
+  modules: Object.fromEntries(MODULE_KEYS.map((k) => [k, false]))});
+({
+  modules: Object.fromEntries(MODULE_KEYS.map((k) => [k, true]))});
 var SSH_POOL_IDLE_MS = 6e4;
 var sshPool = /* @__PURE__ */ new Map();
 function poolKey(options) {
@@ -10688,7 +10856,7 @@ async function writeAuditLog(entry) {
     );
   }
 }
-var MODULE_KEYS = [
+var MODULE_KEYS2 = [
   "users",
   "ssh_servers",
   "wiki",
@@ -10699,9 +10867,9 @@ var MODULE_KEYS = [
   "code_battle",
   "git_hosting"
 ];
-var FULL_PERMISSIONS = {
+var FULL_PERMISSIONS2 = {
   modules: Object.fromEntries(
-    MODULE_KEYS.map((k) => [k, true])
+    MODULE_KEYS2.map((k) => [k, true])
   ),
   resources: { ssh_servers: ["*"] }
 };
@@ -10709,12 +10877,12 @@ function parsePermissions(raw) {
   if (!raw || typeof raw !== "object") return null;
   return raw;
 }
-function resolvePermissions(roleName, roleDefaults, userOverrides) {
-  if (roleName === "superadmin") return FULL_PERMISSIONS;
+function resolvePermissions2(roleName, roleDefaults, userOverrides) {
+  if (roleName === "superadmin") return FULL_PERMISSIONS2;
   const base = parsePermissions(roleDefaults);
   const overrides = parsePermissions(userOverrides);
   const modules = {};
-  for (const key of MODULE_KEYS) {
+  for (const key of MODULE_KEYS2) {
     const userVal = overrides?.modules?.[key];
     const roleVal = base?.modules?.[key];
     modules[key] = userVal !== void 0 ? userVal : roleVal !== void 0 ? roleVal : false;
@@ -10763,6 +10931,7 @@ var TOOL_MODULE_MAP = {
   "cursor-remote-list": "cursor_remote",
   "cursor-remote-run": "cursor_remote",
   "ai-company": "ssh_servers",
+  "git-credential": "git_hosting",
   // cursor-skill intentionally unmapped — any valid API key may pull shared skills
   ...TRIGGER_TOOL_MODULE_MAP
 };
@@ -10906,7 +11075,7 @@ async function validateApiKey(key) {
   const roleName = userData.role_name || "user";
   const roleDefaults = userData.role_default_permissions ?? {};
   const userOverrides = userData.permissions ?? null;
-  const permissions = resolvePermissions(roleName, roleDefaults, userOverrides);
+  const permissions = resolvePermissions2(roleName, roleDefaults, userOverrides);
   const allowedServerIds = intersectServerAccess(
     data.allowed_server_ids,
     permissions.resources.ssh_servers
@@ -10917,9 +11086,9 @@ async function validateApiKey(key) {
     WHERE id = ${data.id}
       AND (last_used_at IS NULL OR last_used_at < now() - interval '60 seconds')
   `);
-  const moduleCount = MODULE_KEYS.filter((k) => permissions.modules[k]).length;
+  const moduleCount = MODULE_KEYS2.filter((k) => permissions.modules[k]).length;
   console.error(
-    `Authenticated as user ${data.created_by} (role: ${roleName}, modules: ${moduleCount}/${MODULE_KEYS.length})`
+    `Authenticated as user ${data.created_by} (role: ${roleName}, modules: ${moduleCount}/${MODULE_KEYS2.length})`
   );
   return {
     apiKeyId: data.id,
@@ -11153,7 +11322,7 @@ async function validateSshKey(pubkeyPathInput, expectedApiKeyId) {
   const roleName = userData.role_name || "user";
   const roleDefaults = userData.role_default_permissions ?? {};
   const userOverrides = userData.permissions ?? null;
-  const permissions = resolvePermissions(roleName, roleDefaults, userOverrides);
+  const permissions = resolvePermissions2(roleName, roleDefaults, userOverrides);
   const allowedServerIds = intersectServerAccess(
     apiRow.allowed_server_ids,
     permissions.resources.ssh_servers
@@ -11170,9 +11339,9 @@ async function validateSshKey(pubkeyPathInput, expectedApiKeyId) {
             AND (last_used_at IS NULL OR last_used_at < now() - interval '60 seconds')`
     )
   ]);
-  const moduleCount = MODULE_KEYS.filter((k) => permissions.modules[k]).length;
+  const moduleCount = MODULE_KEYS2.filter((k) => permissions.modules[k]).length;
   console.error(
-    `Authenticated via SSH key "${keyRow.name}" (fp ${fingerprint.slice(0, 24)}...) as user ${apiRow.created_by} (role: ${roleName}, modules: ${moduleCount}/${MODULE_KEYS.length})`
+    `Authenticated via SSH key "${keyRow.name}" (fp ${fingerprint.slice(0, 24)}...) as user ${apiRow.created_by} (role: ${roleName}, modules: ${moduleCount}/${MODULE_KEYS2.length})`
   );
   return {
     apiKeyId: apiRow.id,
@@ -13453,11 +13622,11 @@ CREATE TABLE IF NOT EXISTS _mcp_migrations (
   applied_by  TEXT
 );
 `.trim();
-function normaliseMigrationSql(sql35) {
-  return sql35.replace(/\r\n/g, "\n").trim() + "\n";
+function normaliseMigrationSql(sql37) {
+  return sql37.replace(/\r\n/g, "\n").trim() + "\n";
 }
-function migrationSha256(sql35) {
-  return createHash("sha256").update(sql35.replace(/\r\n/g, "\n"), "utf8").digest("hex");
+function migrationSha256(sql37) {
+  return createHash("sha256").update(sql37.replace(/\r\n/g, "\n"), "utf8").digest("hex");
 }
 function dollarQuoteTag(value) {
   let tag = "_mcp";
@@ -15469,6 +15638,7 @@ var TOOLS = [
     }
   },
   ...MAILSERVER_TOOLS,
+  ...GIT_CREDENTIAL_TOOLS,
   ...HERMES_COMPANY_TOOLS,
   // ----- Trigger.dev -----
   ...TRIGGER_TOOLS
@@ -19237,6 +19407,12 @@ Install: GET https://dashboard.mgsoftware.nl/api/downloads/versions.txt then \u2
           token
         });
       }
+      case GIT_CREDENTIAL_TOOL_NAME: {
+        return handleGitCredentialTool(a, {
+          dashboardBaseUrl,
+          apiKey: apiKey ?? ""
+        });
+      }
       case HERMES_COMPANY_TOOL_NAME: {
         return handleHermesCompanyTool(a, {
           userId: ctx.userId,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mgsoftwarebv/mg-dashboard-mcp",
-  "version": "7.4.24",
+  "version": "7.4.26",
   "description": "MCP Server for MG Dashboard - SSH, SFTP, Docker, domains, DNS, and environment config tools for Cursor",
   "type": "module",
   "main": "dist/index.js",