@mhingston5/conduit 1.0.0

package/src/core/request.controller.ts

@@ -0,0 +1,297 @@
+import { ExecutionContext } from './execution.context.js';
+import { Logger } from 'pino';
+
+import { GatewayService } from '../gateway/gateway.service.js';
+import { metrics } from './metrics.service.js';
+import { ExecutionService } from './execution.service.js';
+
+import { Middleware } from './interfaces/middleware.interface.js';
+
+import { ConduitError, JSONRPCRequest, JSONRPCResponse } from './types.js';
+
+export { ConduitError, JSONRPCRequest, JSONRPCResponse };
+
+export class RequestController {
+    private logger: Logger;
+    private executionService: ExecutionService;
+    private gatewayService: GatewayService;
+
+    private middlewares: Middleware[] = [];
+
+    constructor(
+        logger: Logger,
+        executionService: ExecutionService,
+        gatewayService: GatewayService,
+        middlewares: Middleware[] = []
+    ) {
+        this.logger = logger;
+        this.executionService = executionService;
+        this.gatewayService = gatewayService;
+        this.middlewares = middlewares;
+    }
+
+    use(middleware: Middleware) {
+        this.middlewares.push(middleware);
+    }
+
+
+
+    async handleRequest(request: JSONRPCRequest, context: ExecutionContext): Promise<JSONRPCResponse> {
+        return this.executePipeline(request, context);
+    }
+
+    private async executePipeline(request: JSONRPCRequest, context: ExecutionContext): Promise<JSONRPCResponse> {
+        let index = -1;
+
+        const dispatch = async (i: number): Promise<JSONRPCResponse> => {
+            if (i <= index) throw new Error('next() called multiple times');
+            index = i;
+
+            const middleware = this.middlewares[i];
+            if (middleware) {
+                return middleware.handle(request, context, () => dispatch(i + 1));
+            }
+
+            return this.finalHandler(request, context);
+        };
+
+        return dispatch(0);
+    }
+
+    private async handleValidateTool(request: JSONRPCRequest, context: ExecutionContext): Promise<JSONRPCResponse> {
+        const params = request.params as { toolName: string; args: any };
+        if (!params || !params.toolName || !params.args) {
+            return {
+                jsonrpc: '2.0',
+                id: request.id,
+                error: {
+                    code: -32602,
+                    message: 'Missing toolName or args params',
+                },
+            };
+        }
+
+        try {
+            const result = await this.gatewayService.validateTool(params.toolName, params.args, context);
+            return {
+                jsonrpc: '2.0',
+                id: request.id,
+                result,
+            };
+        } catch (error: any) {
+            return {
+                jsonrpc: '2.0',
+                id: request.id,
+                error: {
+                    code: -32603,
+                    message: error.message || 'Validation failed',
+                },
+            };
+        }
+    }
+
+    private async finalHandler(request: JSONRPCRequest, context: ExecutionContext): Promise<JSONRPCResponse> {
+        const { method, params, id } = request;
+        // Logging and metrics handled by middlewares now
+
+        // Try/catch handled by ErrorMiddleware, but we handle logic errors here if needed
+        // Actually routing logic should just throw and let middleware catch?
+        // Or specific logic.
+
+        switch (method) {
+            case 'mcp.discoverTools':
+                return this.handleDiscoverTools(params, context, id);
+            case 'mcp.listToolPackages':
+                return this.handleListToolPackages(params, context, id);
+            case 'mcp.listToolStubs':
+                return this.handleListToolStubs(params, context, id);
+            case 'mcp.readToolSchema':
+                return this.handleReadToolSchema(params, context, id);
+            case 'mcp.validateTool':
+                return this.handleValidateTool(request, context);
+            case 'mcp.callTool':
+                return this.handleCallTool(params, context, id);
+            case 'mcp.executeTypeScript':
+                return this.handleExecuteTypeScript(params, context, id);
+            case 'mcp.executePython':
+                return this.handleExecutePython(params, context, id);
+            case 'mcp.executeIsolate':
+                return this.handleExecuteIsolate(params, context, id);
+            default:
+                // metrics.recordExecutionEnd is handled by LoggingMiddleware??
+                // Wait, if 404, LoggingMiddleware records execution end?
+                // Yes, handle() in LoggingMiddleware wraps next().
+                return this.errorResponse(id, -32601, `Method not found: ${method}`);
+        }
+    }
+
+    private async handleDiscoverTools(params: any, context: ExecutionContext, id: string | number): Promise<JSONRPCResponse> {
+        const tools = await this.gatewayService.discoverTools(context);
+        return {
+            jsonrpc: '2.0',
+            id,
+            result: {
+                tools,
+            },
+        };
+    }
+
+    private async handleListToolPackages(params: any, context: ExecutionContext, id: string | number): Promise<JSONRPCResponse> {
+        const packages = await this.gatewayService.listToolPackages();
+        return {
+            jsonrpc: '2.0',
+            id,
+            result: {
+                packages
+            }
+        };
+    }
+
+    private async handleListToolStubs(params: any, context: ExecutionContext, id: string | number): Promise<JSONRPCResponse> {
+        const { packageId } = params;
+        if (!packageId) {
+            return this.errorResponse(id, -32602, 'Missing packageId parameter');
+        }
+
+        try {
+            const stubs = await this.gatewayService.listToolStubs(packageId, context);
+            return {
+                jsonrpc: '2.0',
+                id,
+                result: {
+                    stubs
+                }
+            };
+        } catch (error: any) {
+            return this.errorResponse(id, -32001, error.message);
+        }
+    }
+
+    private async handleReadToolSchema(params: any, context: ExecutionContext, id: string | number): Promise<JSONRPCResponse> {
+        const { toolId } = params;
+        if (!toolId) {
+            return this.errorResponse(id, -32602, 'Missing toolId parameter');
+        }
+
+        try {
+            const schema = await this.gatewayService.getToolSchema(toolId, context);
+            if (!schema) {
+                return this.errorResponse(id, -32001, `Tool not found: ${toolId}`);
+            }
+            return {
+                jsonrpc: '2.0',
+                id,
+                result: {
+                    schema
+                }
+            };
+        } catch (error: any) {
+            return this.errorResponse(id, -32003, error.message);
+        }
+    }
+
+    private async handleCallTool(params: any, context: ExecutionContext, id: string | number): Promise<JSONRPCResponse> {
+        const { name, arguments: toolArgs } = params;
+        const response = await this.gatewayService.callTool(name, toolArgs, context);
+        return { ...response, id };
+    }
+
+    private async handleExecuteTypeScript(params: any, context: ExecutionContext, id: string | number): Promise<JSONRPCResponse> {
+        const { code, limits, allowedTools } = params;
+
+        if (Array.isArray(allowedTools)) {
+            context.allowedTools = allowedTools;
+        }
+
+        const result = await this.executionService.executeTypeScript(code, limits, context, allowedTools);
+
+        if (result.error) {
+            return this.errorResponse(id, result.error.code, result.error.message);
+        }
+
+        return {
+            jsonrpc: '2.0',
+            id,
+            result: {
+                stdout: result.stdout,
+                stderr: result.stderr,
+                exitCode: result.exitCode,
+            },
+        };
+    }
+
+    private async handleExecutePython(params: any, context: ExecutionContext, id: string | number): Promise<JSONRPCResponse> {
+        const { code, limits, allowedTools } = params;
+
+        if (Array.isArray(allowedTools)) {
+            context.allowedTools = allowedTools;
+        }
+
+        const result = await this.executionService.executePython(code, limits, context, allowedTools);
+
+        if (result.error) {
+            return this.errorResponse(id, result.error.code, result.error.message);
+        }
+
+        return {
+            jsonrpc: '2.0',
+            id,
+            result: {
+                stdout: result.stdout,
+                stderr: result.stderr,
+                exitCode: result.exitCode,
+            },
+        };
+    }
+
+    private async handleExecuteIsolate(params: any, context: ExecutionContext, id: string | number): Promise<JSONRPCResponse> {
+        const { code, limits, allowedTools } = params;
+
+        if (Array.isArray(allowedTools)) {
+            context.allowedTools = allowedTools;
+        }
+
+        const result = await this.executionService.executeIsolate(code, limits, context, allowedTools);
+
+        if (result.error) {
+            return this.errorResponse(id, result.error.code, result.error.message);
+        }
+
+        return {
+            jsonrpc: '2.0',
+            id,
+            result: {
+                stdout: result.stdout,
+                stderr: result.stderr,
+                exitCode: result.exitCode,
+            },
+        };
+    }
+
+    private errorResponse(id: string | number, code: number, message: string): JSONRPCResponse {
+        return {
+            jsonrpc: '2.0',
+            id,
+            error: {
+                code,
+                message,
+            },
+        };
+    }
+
+    async shutdown() {
+        await this.executionService.shutdown();
+    }
+
+    async healthCheck() {
+        const pyodideHealth = await this.executionService.healthCheck();
+        return {
+            status: pyodideHealth.status === 'ok' ? 'ok' : 'error',
+            pyodide: pyodideHealth
+        };
+    }
+
+    async warmup() {
+        await this.executionService.warmup();
+    }
+}

package/src/core/security.service.ts

@@ -0,0 +1,68 @@
+import { Logger } from 'pino';
+import { NetworkPolicyService } from './network.policy.service.js';
+import { SessionManager, Session } from './session.manager.js';
+import { IUrlValidator } from './interfaces/url.validator.interface.js';
+import crypto from 'node:crypto';
+
+export { Session };
+
+export class SecurityService implements IUrlValidator {
+    private logger: Logger;
+    private ipcToken: string;
+    private networkPolicy: NetworkPolicyService;
+    private sessionManager: SessionManager;
+
+    constructor(logger: Logger, ipcToken: string) {
+        this.logger = logger;
+        this.ipcToken = ipcToken;
+        this.networkPolicy = new NetworkPolicyService(logger);
+        this.sessionManager = new SessionManager(logger);
+    }
+
+    validateCode(code: string): { valid: boolean; message?: string } {
+        // [IMPORTANT] This is a SANITY CHECK only.
+        // We rely on RUNTIME isolation (Deno permissions, Isolate context) for actual security.
+        // Static analysis of code is fundamentally unable to prevent all sandbox escapes.
+        if (!code || code.length > 1024 * 1024) { // 1MB limit for sanity
+            return { valid: false, message: 'Code size exceeds limit or is empty' };
+        }
+        return { valid: true };
+    }
+
+    async validateUrl(url: string): Promise<{ valid: boolean; message?: string; resolvedIp?: string }> {
+        return this.networkPolicy.validateUrl(url);
+    }
+
+    checkRateLimit(key: string): boolean {
+        return this.networkPolicy.checkRateLimit(key);
+    }
+
+    validateIpcToken(token: string): boolean {
+        // Fix Sev1: Use timing-safe comparison for sensitive tokens
+        const expected = Buffer.from(this.ipcToken);
+        const actual = Buffer.from(token);
+
+        if (expected.length === actual.length && crypto.timingSafeEqual(expected, actual)) {
+            return true;
+        }
+
+        return !!this.sessionManager.getSession(token);
+    }
+
+    createSession(allowedTools?: string[]): string {
+        return this.sessionManager.createSession(allowedTools);
+    }
+
+    getSession(token: string): Session | undefined {
+        return this.sessionManager.getSession(token);
+    }
+
+    invalidateSession(token: string): void {
+        this.sessionManager.invalidateSession(token);
+    }
+
+
+    getIpcToken(): string {
+        return this.ipcToken;
+    }
+}

package/src/core/session.manager.ts

@@ -0,0 +1,44 @@
+import { Logger } from 'pino';
+import { v4 as uuidv4 } from 'uuid';
+import { LRUCache } from 'lru-cache';
+
+export interface Session {
+    allowedTools?: string[];
+    createdAt: number;
+}
+
+export class SessionManager {
+    private logger: Logger;
+    private sessions: LRUCache<string, Session>;
+    private readonly SESSION_TTL_MS = 3600000; // 1 hour
+
+    constructor(logger: Logger) {
+        this.logger = logger;
+        this.sessions = new LRUCache({
+            max: 10000,
+            ttl: this.SESSION_TTL_MS,
+        });
+    }
+
+    createSession(allowedTools?: string[]): string {
+        const token = uuidv4();
+        this.sessions.set(token, {
+            allowedTools,
+            createdAt: Date.now()
+        });
+        return token;
+    }
+
+    getSession(token: string): Session | undefined {
+        return this.sessions.get(token);
+    }
+
+    invalidateSession(token: string): void {
+        this.sessions.delete(token);
+    }
+
+    cleanupSessions() {
+        // LRUCache handles this automatically via TTL
+        this.sessions.purgeStale();
+    }
+}

package/src/core/types.ts

@@ -0,0 +1,47 @@
+export enum ConduitError {
+    InternalError = -32603,
+    RequestTimeout = -32008,
+    Forbidden = -32003,
+    OutputLimitExceeded = -32013,
+    MemoryLimitExceeded = -32009,
+    LogLimitExceeded = -32014,
+    ServerBusy = -32000,
+}
+
+export interface JSONRPCRequest {
+    jsonrpc: '2.0';
+    id: string | number;
+    method: string;
+    params?: any;
+    auth?: {
+        bearerToken: string;
+    };
+}
+
+export interface JSONRPCResponse {
+    jsonrpc: '2.0';
+    id: string | number;
+    result?: any;
+    error?: {
+        code: number;
+        message: string;
+        data?: any;
+    };
+}
+
+export interface ToolPackage {
+    id: string; // e.g., "github"
+    description?: string;
+    version?: string;
+}
+
+export interface ToolStub {
+    id: string; // e.g., "github__create_issue"
+    name: string; // e.g., "create_issue"
+    description?: string;
+}
+
+export interface ToolManifest {
+    version: string;
+    tools: ToolStub[];
+}