@neverinfamous/mysql-mcp 2.1.0

package/src/adapters/mysql/types.ts

@@ -0,0 +1,298 @@
+/**
+ * MySQL Adapter - Zod Schemas
+ * 
+ * Input validation schemas for all MySQL tools.
+ */
+
+import { z } from 'zod';
+
+// =============================================================================
+// Core Tools Schemas
+// =============================================================================
+
+export const ReadQuerySchema = z.object({
+    query: z.string().describe('SQL SELECT query to execute'),
+    params: z.array(z.unknown()).optional().describe('Query parameters for prepared statement'),
+    transactionId: z.string().optional().describe('Optional transaction ID for executing within a transaction')
+});
+
+
+export const WriteQuerySchema = z.object({
+    query: z.string().describe('SQL INSERT/UPDATE/DELETE query'),
+    params: z.array(z.unknown()).optional().describe('Query parameters for prepared statement'),
+    transactionId: z.string().optional().describe('Optional transaction ID for executing within a transaction')
+});
+
+
+export const ListTablesSchema = z.object({
+    database: z.string().optional().describe('Database name (defaults to connected database)')
+});
+
+export const DescribeTableSchema = z.object({
+    table: z.string().describe('Table name to describe')
+});
+
+export const CreateTableSchema = z.object({
+    name: z.string().describe('Table name'),
+    columns: z.array(z.object({
+        name: z.string().describe('Column name'),
+        type: z.string().describe('MySQL data type (e.g., INT, VARCHAR(255), JSON)'),
+        nullable: z.boolean().optional().default(true).describe('Allow NULL values'),
+        primaryKey: z.boolean().optional().describe('Is primary key'),
+        autoIncrement: z.boolean().optional().describe('Auto-increment column'),
+        default: z.unknown().optional().describe('Default value'),
+        unique: z.boolean().optional().describe('Unique constraint'),
+        comment: z.string().optional().describe('Column comment')
+    })).describe('Column definitions'),
+    engine: z.enum(['InnoDB', 'MyISAM', 'MEMORY', 'CSV', 'ARCHIVE']).optional().default('InnoDB').describe('Storage engine'),
+    charset: z.string().optional().default('utf8mb4').describe('Character set'),
+    collate: z.string().optional().default('utf8mb4_unicode_ci').describe('Collation'),
+    comment: z.string().optional().describe('Table comment'),
+    ifNotExists: z.boolean().optional().default(false).describe('Add IF NOT EXISTS clause')
+});
+
+export const DropTableSchema = z.object({
+    table: z.string().describe('Table name to drop'),
+    ifExists: z.boolean().optional().default(true).describe('Add IF EXISTS clause')
+});
+
+export const CreateIndexSchema = z.object({
+    name: z.string().describe('Index name'),
+    table: z.string().describe('Table name'),
+    columns: z.array(z.string()).describe('Column names to index'),
+    unique: z.boolean().optional().default(false).describe('Create unique index'),
+    type: z.enum(['BTREE', 'HASH', 'FULLTEXT', 'SPATIAL']).optional().describe('Index type'),
+    ifNotExists: z.boolean().optional().default(false).describe('Add IF NOT EXISTS clause')
+});
+
+export const GetIndexesSchema = z.object({
+    table: z.string().describe('Table name')
+});
+
+// =============================================================================
+// Transaction Schemas
+// =============================================================================
+
+export const TransactionBeginSchema = z.object({
+    isolationLevel: z.enum([
+        'READ UNCOMMITTED',
+        'READ COMMITTED',
+        'REPEATABLE READ',
+        'SERIALIZABLE'
+    ]).optional().describe('Transaction isolation level')
+});
+
+export const TransactionIdSchema = z.object({
+    transactionId: z.string().describe('Transaction ID from begin operation')
+});
+
+export const TransactionSavepointSchema = z.object({
+    transactionId: z.string().describe('Transaction ID'),
+    savepoint: z.string().describe('Savepoint name')
+});
+
+export const TransactionExecuteSchema = z.object({
+    statements: z.array(z.string()).describe('SQL statements to execute atomically'),
+    isolationLevel: z.enum([
+        'READ UNCOMMITTED',
+        'READ COMMITTED',
+        'REPEATABLE READ',
+        'SERIALIZABLE'
+    ]).optional().describe('Transaction isolation level')
+});
+
+// =============================================================================
+// JSON Schemas
+// =============================================================================
+
+export const JsonExtractSchema = z.object({
+    table: z.string().describe('Table name'),
+    column: z.string().describe('JSON column name'),
+    path: z.string().describe('JSON path (e.g., $.name or $[0])'),
+    where: z.string().optional().describe('WHERE clause for filtering rows')
+});
+
+export const JsonSetSchema = z.object({
+    table: z.string().describe('Table name'),
+    column: z.string().describe('JSON column name'),
+    path: z.string().describe('JSON path to set'),
+    value: z.unknown().describe('Value to set'),
+    where: z.string().describe('WHERE clause to identify rows')
+});
+
+export const JsonContainsSchema = z.object({
+    table: z.string().describe('Table name'),
+    column: z.string().describe('JSON column name'),
+    value: z.unknown().describe('Value to search for'),
+    path: z.string().optional().describe('Optional JSON path to search within')
+});
+
+export const JsonKeysSchema = z.object({
+    table: z.string().describe('Table name'),
+    column: z.string().describe('JSON column name'),
+    path: z.string().optional().describe('Optional JSON path (defaults to root)')
+});
+
+export const JsonSearchSchema = z.object({
+    table: z.string().describe('Table name'),
+    column: z.string().describe('JSON column name'),
+    searchValue: z.string().describe('String value to search for'),
+    mode: z.enum(['one', 'all']).optional().default('one').describe('Search mode')
+});
+
+export const JsonValidateSchema = z.object({
+    value: z.string().describe('JSON string to validate')
+});
+
+// =============================================================================
+// Text Schemas
+// =============================================================================
+
+export const RegexpMatchSchema = z.object({
+    table: z.string().describe('Table name'),
+    column: z.string().describe('Column name'),
+    pattern: z.string().describe('Regular expression pattern')
+});
+
+export const LikeSearchSchema = z.object({
+    table: z.string().describe('Table name'),
+    column: z.string().describe('Column name'),
+    pattern: z.string().describe('LIKE pattern with % and _ wildcards')
+});
+
+export const SoundexSchema = z.object({
+    table: z.string().describe('Table name'),
+    column: z.string().describe('Column name'),
+    value: z.string().describe('Value to match phonetically')
+});
+
+export const FulltextCreateSchema = z.object({
+    table: z.string().describe('Table name'),
+    columns: z.array(z.string()).describe('Columns to include in index'),
+    indexName: z.string().optional().describe('Optional index name')
+});
+
+export const FulltextSearchSchema = z.object({
+    table: z.string().describe('Table name'),
+    columns: z.array(z.string()).describe('Columns to search'),
+    query: z.string().describe('Search query'),
+    mode: z.enum(['NATURAL', 'BOOLEAN', 'EXPANSION']).optional().default('NATURAL').describe('Search mode')
+});
+
+// =============================================================================
+// Performance Schemas
+// =============================================================================
+
+export const ExplainSchema = z.object({
+    query: z.string().describe('SQL query to explain'),
+    analyze: z.boolean().optional().default(false).describe('Run EXPLAIN ANALYZE (MySQL 8.0+)'),
+    format: z.enum(['TRADITIONAL', 'JSON', 'TREE']).optional().default('JSON').describe('Output format')
+});
+
+export const SlowQuerySchema = z.object({
+    limit: z.number().optional().default(10).describe('Number of slow queries to return'),
+    minTime: z.number().optional().describe('Minimum query time in seconds')
+});
+
+export const IndexUsageSchema = z.object({
+    table: z.string().optional().describe('Filter by table name')
+});
+
+export const TableStatsSchema = z.object({
+    table: z.string().describe('Table name')
+});
+
+// =============================================================================
+// Admin Schemas
+// =============================================================================
+
+export const OptimizeTableSchema = z.object({
+    tables: z.array(z.string()).describe('Table names to optimize')
+});
+
+export const AnalyzeTableSchema = z.object({
+    tables: z.array(z.string()).describe('Table names to analyze')
+});
+
+export const CheckTableSchema = z.object({
+    tables: z.array(z.string()).describe('Table names to check'),
+    option: z.enum(['QUICK', 'FAST', 'MEDIUM', 'EXTENDED', 'CHANGED']).optional().describe('Check option')
+});
+
+export const FlushTablesSchema = z.object({
+    tables: z.array(z.string()).optional().describe('Specific tables to flush (empty for all)')
+});
+
+export const KillQuerySchema = z.object({
+    processId: z.number().describe('Process ID to kill'),
+    connection: z.boolean().optional().default(false).describe('Kill connection instead of query')
+});
+
+export const ShowProcesslistSchema = z.object({
+    full: z.boolean().optional().default(false).describe('Show full query text')
+});
+
+export const ShowStatusSchema = z.object({
+    like: z.string().optional().describe('Filter variables by LIKE pattern'),
+    global: z.boolean().optional().default(true).describe('Show global status')
+});
+
+export const ShowVariablesSchema = z.object({
+    like: z.string().optional().describe('Filter variables by LIKE pattern'),
+    global: z.boolean().optional().default(true).describe('Show global variables')
+});
+
+// =============================================================================
+// Backup Schemas
+// =============================================================================
+
+export const ExportTableSchema = z.object({
+    table: z.string().describe('Table name'),
+    format: z.enum(['SQL', 'CSV']).optional().default('SQL').describe('Export format'),
+    where: z.string().optional().describe('WHERE clause to filter rows')
+});
+
+export const ImportDataSchema = z.object({
+    table: z.string().describe('Table name'),
+    data: z.array(z.record(z.string(), z.unknown())).describe('Array of row objects to insert')
+});
+
+// =============================================================================
+// Replication Schemas
+// =============================================================================
+
+export const BinlogEventsSchema = z.object({
+    logFile: z.string().optional().describe('Binlog file name'),
+    position: z.number().optional().describe('Starting position'),
+    limit: z.number().optional().default(100).describe('Maximum events to return')
+});
+
+// =============================================================================
+// Partitioning Schemas
+// =============================================================================
+
+export const PartitionInfoSchema = z.object({
+    table: z.string().describe('Table name')
+});
+
+export const AddPartitionSchema = z.object({
+    table: z.string().describe('Table name'),
+    partitionName: z.string().describe('New partition name'),
+    partitionType: z.enum(['RANGE', 'LIST', 'HASH', 'KEY']).describe('Partition type'),
+    value: z.string().describe('Partition boundary value only - e.g., "2024" for RANGE, "1,2,3" for LIST, "4" for HASH/KEY partitions count. Do NOT include "LESS THAN" or "VALUES IN" keywords.')
+});
+
+export const DropPartitionSchema = z.object({
+    table: z.string().describe('Table name'),
+    partitionName: z.string().describe('Partition name to drop')
+});
+
+export const ReorganizePartitionSchema = z.object({
+    table: z.string().describe('Table name'),
+    fromPartitions: z.array(z.string()).describe('Source partition names'),
+    partitionType: z.enum(['RANGE', 'LIST']).describe('Partition type (RANGE or LIST). HASH/KEY partitions cannot be reorganized.'),
+    toPartitions: z.array(z.object({
+        name: z.string().describe('New partition name'),
+        value: z.string().describe('Partition boundary value only - e.g., "2024" for RANGE, "1,2,3" for LIST. Do NOT include "LESS THAN" or "VALUES IN" keywords.')
+    })).describe('New partition definitions')
+});

package/src/auth/AuthorizationServerDiscovery.ts

@@ -0,0 +1,133 @@
+/**
+ * mysql-mcp - Authorization Server Discovery
+ * 
+ * RFC 8414 Authorization Server Metadata discovery.
+ */
+
+import type { AuthServerDiscoveryConfig, AuthorizationServerMetadata } from './types.js';
+import { AuthServerDiscoveryError } from './errors.js';
+import { logger } from '../utils/logger.js';
+
+/**
+ * Authorization Server Discovery (RFC 8414)
+ */
+export class AuthorizationServerDiscovery {
+    private readonly config: AuthServerDiscoveryConfig;
+    private metadataCache: AuthorizationServerMetadata | null = null;
+    private cacheTime = 0;
+
+    constructor(config: AuthServerDiscoveryConfig) {
+        this.config = {
+            ...config,
+            cacheTtl: config.cacheTtl ?? 3600,
+            timeout: config.timeout ?? 5000
+        };
+    }
+
+    /**
+     * Discover authorization server metadata
+     */
+    async discover(): Promise<AuthorizationServerMetadata> {
+        const now = Date.now();
+        const cacheTtlMs = (this.config.cacheTtl ?? 3600) * 1000;
+
+        // Check cache
+        if (this.metadataCache && (now - this.cacheTime) < cacheTtlMs) {
+            return this.metadataCache;
+        }
+
+        try {
+            // RFC 8414: well-known endpoint
+            const wellKnownUrl = new URL('/.well-known/oauth-authorization-server', this.config.authServerUrl);
+
+            const controller = new AbortController();
+            const timeoutId = setTimeout(() => controller.abort(), this.config.timeout);
+
+            const response = await fetch(wellKnownUrl.toString(), {
+                method: 'GET',
+                headers: { 'Accept': 'application/json' },
+                signal: controller.signal
+            });
+
+            clearTimeout(timeoutId);
+
+            if (!response.ok) {
+                throw new Error(`HTTP ${response.status}: ${response.statusText}`);
+            }
+
+            const metadata = await response.json() as AuthorizationServerMetadata;
+
+            // Validate required fields
+            if (!metadata.issuer || !metadata.token_endpoint) {
+                throw new Error('Invalid metadata: missing required fields');
+            }
+
+            // Cache the metadata
+            this.metadataCache = metadata;
+            this.cacheTime = now;
+
+            logger.debug('Auth server metadata discovered', { issuer: metadata.issuer });
+
+            return metadata;
+
+        } catch (error) {
+            logger.error('Auth server discovery failed', {
+                url: this.config.authServerUrl,
+                error: String(error)
+            });
+            throw new AuthServerDiscoveryError(
+                `Failed to discover auth server at ${this.config.authServerUrl}: ${String(error)}`
+            );
+        }
+    }
+
+    /**
+     * Get JWKS URI from discovered metadata
+     */
+    async getJwksUri(): Promise<string> {
+        const metadata = await this.discover();
+        if (!metadata.jwks_uri) {
+            throw new AuthServerDiscoveryError('Auth server metadata does not include jwks_uri');
+        }
+        return metadata.jwks_uri;
+    }
+
+    /**
+     * Get token endpoint from discovered metadata
+     */
+    async getTokenEndpoint(): Promise<string> {
+        const metadata = await this.discover();
+        return metadata.token_endpoint;
+    }
+
+    /**
+     * Get registration endpoint (if available)
+     */
+    async getRegistrationEndpoint(): Promise<string | undefined> {
+        const metadata = await this.discover();
+        return metadata.registration_endpoint;
+    }
+
+    /**
+     * Check if auth server supports a specific grant type
+     */
+    async supportsGrantType(grantType: string): Promise<boolean> {
+        const metadata = await this.discover();
+        return metadata.grant_types_supported?.includes(grantType) ?? false;
+    }
+
+    /**
+     * Invalidate cache
+     */
+    invalidateCache(): void {
+        this.metadataCache = null;
+        this.cacheTime = 0;
+    }
+}
+
+/**
+ * Create an authorization server discovery instance
+ */
+export function createAuthServerDiscovery(config: AuthServerDiscoveryConfig): AuthorizationServerDiscovery {
+    return new AuthorizationServerDiscovery(config);
+}

package/src/auth/OAuthResourceServer.ts

@@ -0,0 +1,87 @@
+/**
+ * mysql-mcp - OAuth Resource Server
+ * 
+ * RFC 9728 Protected Resource Metadata implementation.
+ */
+
+import type { ResourceServerConfig, ProtectedResourceMetadata } from './types.js';
+
+/**
+ * OAuth 2.0 Resource Server (RFC 9728)
+ */
+export class OAuthResourceServer {
+    private readonly config: ResourceServerConfig;
+
+    constructor(config: ResourceServerConfig) {
+        this.config = {
+            ...config,
+            bearerMethodsSupported: config.bearerMethodsSupported ?? ['header']
+        };
+    }
+
+    /**
+     * Get protected resource metadata (RFC 9728)
+     */
+    getMetadata(): ProtectedResourceMetadata {
+        return {
+            resource: this.config.resource,
+            authorization_servers: this.config.authorizationServers,
+            scopes_supported: this.config.scopesSupported,
+            bearer_methods_supported: this.config.bearerMethodsSupported,
+            resource_documentation: `${this.config.resource}/docs`,
+            resource_signing_alg_values_supported: ['RS256', 'ES256']
+        };
+    }
+
+    /**
+     * Get the well-known endpoint path for protected resource metadata
+     */
+    getWellKnownPath(): string {
+        return '/.well-known/oauth-protected-resource';
+    }
+
+    /**
+     * Verify that a scope is supported by this resource
+     */
+    isScopeSupported(scope: string): boolean {
+        // Check if in explicit list
+        if (this.config.scopesSupported.includes(scope)) {
+            return true;
+        }
+
+        // Check for database-specific scope patterns
+        if (scope.startsWith('db:') || scope.startsWith('table:')) {
+            return true;
+        }
+
+        return false;
+    }
+
+    /**
+     * Get the resource identifier
+     */
+    getResourceId(): string {
+        return this.config.resource;
+    }
+
+    /**
+     * Get all supported scopes
+     */
+    getSupportedScopes(): string[] {
+        return [...this.config.scopesSupported];
+    }
+
+    /**
+     * Get authorization servers
+     */
+    getAuthorizationServers(): string[] {
+        return [...this.config.authorizationServers];
+    }
+}
+
+/**
+ * Create an OAuth resource server instance
+ */
+export function createOAuthResourceServer(config: ResourceServerConfig): OAuthResourceServer {
+    return new OAuthResourceServer(config);
+}

package/src/auth/TokenValidator.ts

@@ -0,0 +1,143 @@
+/**
+ * mysql-mcp - Token Validator
+ * 
+ * JWT token validation with JWKS support.
+ */
+
+import * as jose from 'jose';
+import type { TokenValidatorConfig, TokenValidationResult, TokenClaims } from './types.js';
+import { JwksFetchError } from './errors.js';
+import { parseScopes } from './scopes.js';
+import { logger } from '../utils/logger.js';
+
+/**
+ * JWT Token Validator with JWKS support
+ */
+export class TokenValidator {
+    private readonly config: TokenValidatorConfig;
+    private jwksCache: jose.JWTVerifyGetKey | null = null;
+    private jwksCacheTime = 0;
+
+    constructor(config: TokenValidatorConfig) {
+        this.config = {
+            ...config,
+            clockTolerance: config.clockTolerance ?? 60,
+            jwksCacheTtl: config.jwksCacheTtl ?? 3600,
+            algorithms: config.algorithms ?? ['RS256', 'RS384', 'RS512', 'ES256', 'ES384', 'ES512']
+        };
+    }
+
+    /**
+     * Validate a JWT token
+     */
+    async validate(token: string): Promise<TokenValidationResult> {
+        try {
+            // Get or refresh JWKS
+            const jwks = this.getJWKS();
+
+            // Verify the token
+            const { payload } = await jose.jwtVerify(token, jwks, {
+                issuer: this.config.issuer,
+                audience: this.config.audience,
+                clockTolerance: this.config.clockTolerance
+            });
+
+            // Extract claims
+            const claims: TokenClaims = {
+                sub: payload.sub ?? '',
+                scopes: parseScopes(payload['scope'] as string | undefined),
+                exp: payload.exp ?? 0,
+                iat: payload.iat ?? 0,
+                iss: payload.iss,
+                aud: payload.aud,
+                nbf: payload.nbf,
+                jti: payload.jti,
+                client_id: payload['client_id'] as string | undefined
+            };
+
+            logger.debug('Token validated successfully', { sub: claims.sub });
+
+            return { valid: true, claims };
+
+        } catch (error) {
+            return this.handleValidationError(error);
+        }
+    }
+
+    /**
+     * Get or refresh JWKS cache
+     */
+    private getJWKS(): jose.JWTVerifyGetKey {
+        const now = Date.now();
+        const cacheTtlMs = (this.config.jwksCacheTtl ?? 3600) * 1000;
+
+        // Check if cache is still valid
+        if (this.jwksCache && (now - this.jwksCacheTime) < cacheTtlMs) {
+            return this.jwksCache;
+        }
+
+        try {
+            // Create new JWKS remote key set
+            this.jwksCache = jose.createRemoteJWKSet(new URL(this.config.jwksUri));
+            this.jwksCacheTime = now;
+
+            logger.debug('JWKS cache refreshed', { uri: this.config.jwksUri });
+
+            return this.jwksCache;
+        } catch (error) {
+            logger.error('Failed to fetch JWKS', { uri: this.config.jwksUri, error: String(error) });
+            throw new JwksFetchError(`Failed to fetch JWKS from ${this.config.jwksUri}`);
+        }
+    }
+
+    /**
+     * Handle validation errors
+     */
+    private handleValidationError(error: unknown): TokenValidationResult {
+        if (error instanceof jose.errors.JWTExpired) {
+            return {
+                valid: false,
+                error: 'Token has expired',
+                errorCode: 'TOKEN_EXPIRED'
+            };
+        }
+
+        if (error instanceof jose.errors.JWSSignatureVerificationFailed) {
+            return {
+                valid: false,
+                error: 'Invalid token signature',
+                errorCode: 'INVALID_SIGNATURE'
+            };
+        }
+
+        if (error instanceof jose.errors.JWTClaimValidationFailed) {
+            return {
+                valid: false,
+                error: `Claim validation failed: ${error.message}`,
+                errorCode: 'INVALID_CLAIMS'
+            };
+        }
+
+        // Generic error
+        return {
+            valid: false,
+            error: error instanceof Error ? error.message : 'Token validation failed',
+            errorCode: 'INVALID_TOKEN'
+        };
+    }
+
+    /**
+     * Invalidate JWKS cache (for testing or forced refresh)
+     */
+    invalidateCache(): void {
+        this.jwksCache = null;
+        this.jwksCacheTime = 0;
+    }
+}
+
+/**
+ * Create a token validator instance
+ */
+export function createTokenValidator(config: TokenValidatorConfig): TokenValidator {
+    return new TokenValidator(config);
+}