@neverinfamous/mysql-mcp 2.3.0 → 3.0.0

package/src/adapters/mysql/tools/roles.ts

@@ -2,7 +2,7 @@
  * MySQL Roles Tools - 8 tools for role management
  */
 
-import { z } from "zod";
+import { z, ZodError } from "zod";
 import type { MySQLAdapter } from "../MySQLAdapter.js";
 import type { ToolDefinition, RequestContext } from "../../../types/index.js";
 import {
@@ -12,6 +12,17 @@ import {
   escapeLikePattern,
 } from "../../../utils/validators.js";
 
+function formatZodError(error: ZodError): string {
+  return error.issues.map((i) => i.message).join("; ");
+}
+
+function stripErrorPrefix(msg: string): string {
+  return msg
+    .replace(/^Raw query failed:\s*/i, "")
+    .replace(/^Query failed:\s*/i, "")
+    .replace(/^Execute failed:\s*/i, "");
+}
+
 const RoleListSchema = z.object({
   pattern: z.string().optional().describe("Filter pattern (LIKE syntax)"),
 });
@@ -64,13 +75,21 @@ export function getRoleTools(adapter: MySQLAdapter): ToolDefinition[] {
       requiredScopes: ["read"],
       annotations: { readOnlyHint: true, idempotentHint: true },
       handler: async (params: unknown, _context: RequestContext) => {
-        const { pattern } = RoleListSchema.parse(params);
-        let query = `SELECT u.User as roleName, u.Host FROM mysql.user u
-                    WHERE u.account_locked='Y' AND u.password_expired='Y' AND u.authentication_string=''`;
-        if (pattern)
-          query += ` AND u.User LIKE '${escapeLikePattern(pattern)}'`;
-        const result = await adapter.executeQuery(query);
-        return { roles: result.rows ?? [], count: result.rows?.length ?? 0 };
+        try {
+          const { pattern } = RoleListSchema.parse(params);
+          let query = `SELECT u.User as roleName, u.Host FROM mysql.user u
+                      WHERE u.account_locked='Y' AND u.password_expired='Y' AND u.authentication_string=''`;
+          if (pattern)
+            query += ` AND u.User LIKE '${escapeLikePattern(pattern)}'`;
+          const result = await adapter.executeQuery(query);
+          return { roles: result.rows ?? [], count: result.rows?.length ?? 0 };
+        } catch (error: unknown) {
+          if (error instanceof ZodError)
+            return { success: false, error: formatZodError(error) };
+          const message =
+            error instanceof Error ? error.message : String(error);
+          return { success: false, error: stripErrorPrefix(message) };
+        }
       },
     },
     {
@@ -82,40 +101,44 @@ export function getRoleTools(adapter: MySQLAdapter): ToolDefinition[] {
       requiredScopes: ["admin"],
       annotations: { readOnlyHint: false },
       handler: async (params: unknown, _context: RequestContext) => {
-        const { name, ifNotExists } = RoleCreateSchema.parse(params);
-        if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(name))
-          throw new Error("Invalid role name");
-
-        // Pre-check existence for skipped indicator when ifNotExists is true
-        if (ifNotExists) {
-          const checkResult = await adapter.executeQuery(
-            `SELECT 1 FROM mysql.user WHERE User = ? AND account_locked = 'Y' AND password_expired = 'Y' AND authentication_string = ''`,
-            [name],
-          );
-          if (checkResult.rows && checkResult.rows.length > 0) {
-            return {
-              success: true,
-              skipped: true,
-              roleName: name,
-              reason: "Role already exists",
-            };
+        try {
+          const { name, ifNotExists } = RoleCreateSchema.parse(params);
+          if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(name))
+            return { success: false, error: "Invalid role name" };
+
+          // Pre-check existence for skipped indicator when ifNotExists is true
+          if (ifNotExists) {
+            const checkResult = await adapter.executeQuery(
+              `SELECT 1 FROM mysql.user WHERE User = ? AND account_locked = 'Y' AND password_expired = 'Y' AND authentication_string = ''`,
+              [name],
+            );
+            if (checkResult.rows && checkResult.rows.length > 0) {
+              return {
+                success: true,
+                skipped: true,
+                roleName: name,
+                reason: "Role already exists",
+              };
+            }
           }
-        }
 
-        try {
           const clause = ifNotExists ? "IF NOT EXISTS " : "";
           await adapter.executeQuery(`CREATE ROLE ${clause}'${name}'`);
           return { success: true, roleName: name };
         } catch (error: unknown) {
+          if (error instanceof ZodError)
+            return { success: false, error: formatZodError(error) };
           const message =
             error instanceof Error ? error.message : String(error);
           if (message.includes("Operation CREATE ROLE failed")) {
+            const rawName = (params as Record<string, string>)["name"];
+            const roleName = rawName ?? "unknown";
             return {
               success: false,
-              reason: `Role '${name}' already exists`,
+              error: `Role '${roleName}' already exists`,
             };
           }
-          throw error;
+          return { success: false, error: stripErrorPrefix(message) };
         }
       },
     },
@@ -128,48 +151,52 @@ export function getRoleTools(adapter: MySQLAdapter): ToolDefinition[] {
       requiredScopes: ["admin"],
       annotations: { readOnlyHint: false, destructiveHint: true },
       handler: async (params: unknown, _context: RequestContext) => {
-        const { name, ifExists } = RoleDropSchema.parse(params);
-        if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(name))
-          throw new Error("Invalid role name");
-
-        // Pre-check existence for skipped indicator when ifExists is true
-        let roleAbsent = false;
-        if (ifExists) {
-          const checkResult = await adapter.executeQuery(
-            `SELECT 1 FROM mysql.user WHERE User = ? AND account_locked = 'Y' AND password_expired = 'Y' AND authentication_string = ''`,
-            [name],
-          );
-          if (!checkResult.rows || checkResult.rows.length === 0) {
-            roleAbsent = true;
+        try {
+          const { name, ifExists } = RoleDropSchema.parse(params);
+          if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(name))
+            return { success: false, error: "Invalid role name" };
+
+          // Pre-check existence for skipped indicator when ifExists is true
+          let roleAbsent = false;
+          if (ifExists) {
+            const checkResult = await adapter.executeQuery(
+              `SELECT 1 FROM mysql.user WHERE User = ? AND account_locked = 'Y' AND password_expired = 'Y' AND authentication_string = ''`,
+              [name],
+            );
+            if (!checkResult.rows || checkResult.rows.length === 0) {
+              roleAbsent = true;
+            }
           }
-        }
 
-        try {
           await adapter.executeQuery(
             `DROP ROLE ${ifExists ? "IF EXISTS " : ""}'${name}'`,
           );
+
+          if (roleAbsent) {
+            return {
+              success: true,
+              skipped: true,
+              roleName: name,
+              reason: "Role did not exist",
+            };
+          }
+
+          return { success: true, roleName: name };
         } catch (error: unknown) {
+          if (error instanceof ZodError)
+            return { success: false, error: formatZodError(error) };
           const message =
             error instanceof Error ? error.message : String(error);
           if (message.includes("Operation DROP ROLE failed")) {
+            const rawName = (params as Record<string, string>)["name"];
+            const roleName = rawName ?? "unknown";
             return {
               success: false,
-              reason: `Role '${name}' does not exist`,
+              error: `Role '${roleName}' does not exist`,
             };
           }
-          throw error;
+          return { success: false, error: stripErrorPrefix(message) };
         }
-
-        if (roleAbsent) {
-          return {
-            success: true,
-            skipped: true,
-            roleName: name,
-            reason: "Role did not exist",
-          };
-        }
-
-        return { success: true, roleName: name };
       },
     },
     {
@@ -181,24 +208,32 @@ export function getRoleTools(adapter: MySQLAdapter): ToolDefinition[] {
       requiredScopes: ["read"],
       annotations: { readOnlyHint: true, idempotentHint: true },
       handler: async (params: unknown, _context: RequestContext) => {
-        const { role } = RoleGrantsSchema.parse(params);
-
-        // Validate role identifier before interpolation
-        validateIdentifier(role, "column");
-
-        // Check if role exists first (roles are locked accounts with empty auth string)
-        const checkResult = await adapter.executeQuery(
-          `SELECT 1 FROM mysql.user WHERE User = ? AND account_locked = 'Y' AND password_expired = 'Y' AND authentication_string = ''`,
-          [role],
-        );
-        if (!checkResult.rows || checkResult.rows.length === 0) {
-          return { role, grants: [], exists: false };
-        }
+        try {
+          const { role } = RoleGrantsSchema.parse(params);
+
+          // Validate role identifier before interpolation
+          validateIdentifier(role, "role");
+
+          // Check if role exists first (roles are locked accounts with empty auth string)
+          const checkResult = await adapter.executeQuery(
+            `SELECT 1 FROM mysql.user WHERE User = ? AND account_locked = 'Y' AND password_expired = 'Y' AND authentication_string = ''`,
+            [role],
+          );
+          if (!checkResult.rows || checkResult.rows.length === 0) {
+            return { role, grants: [], exists: false };
+          }
 
-        // SHOW GRANTS cannot be always prepared
-        const result = await adapter.rawQuery(`SHOW GRANTS FOR '${role}'`);
-        const grants = (result.rows ?? []).map((r) => Object.values(r)[0]);
-        return { role, grants, exists: true };
+          // SHOW GRANTS cannot be always prepared
+          const result = await adapter.rawQuery(`SHOW GRANTS FOR '${role}'`);
+          const grants = (result.rows ?? []).map((r) => Object.values(r)[0]);
+          return { role, grants, exists: true };
+        } catch (error: unknown) {
+          if (error instanceof ZodError)
+            return { success: false, error: formatZodError(error) };
+          const message =
+            error instanceof Error ? error.message : String(error);
+          return { success: false, error: stripErrorPrefix(message) };
+        }
       },
     },
     {
@@ -210,57 +245,57 @@ export function getRoleTools(adapter: MySQLAdapter): ToolDefinition[] {
       requiredScopes: ["admin"],
       annotations: { readOnlyHint: false },
       handler: async (params: unknown, _context: RequestContext) => {
-        const { role, privileges, database, table } =
-          RoleGrantPrivilegeSchema.parse(params);
-        if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(role))
-          throw new Error("Invalid role name");
-
-        // Validate each privilege against allowlist
-        for (const priv of privileges) {
-          validateMySQLPrivilege(priv);
-        }
+        try {
+          const { role, privileges, database, table } =
+            RoleGrantPrivilegeSchema.parse(params);
+          if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(role))
+            return { success: false, error: "Invalid role name" };
+
+          // Validate each privilege against allowlist
+          for (const priv of privileges) {
+            validateMySQLPrivilege(priv);
+          }
 
-        // Check if role exists first
-        const checkResult = await adapter.executeQuery(
-          `SELECT 1 FROM mysql.user WHERE User = ? AND account_locked = 'Y' AND password_expired = 'Y' AND authentication_string = ''`,
-          [role],
-        );
-        if (!checkResult.rows || checkResult.rows.length === 0) {
-          return {
-            success: false,
-            role,
-            exists: false,
-            error: "Role does not exist",
-          };
-        }
+          // Check if role exists first
+          const checkResult = await adapter.executeQuery(
+            `SELECT 1 FROM mysql.user WHERE User = ? AND account_locked = 'Y' AND password_expired = 'Y' AND authentication_string = ''`,
+            [role],
+          );
+          if (!checkResult.rows || checkResult.rows.length === 0) {
+            return {
+              success: false,
+              role,
+              exists: false,
+              error: "Role does not exist",
+            };
+          }
 
-        let targetDb = database;
-        let targetTable = table;
+          let targetDb = database;
+          let targetTable = table;
 
-        // Handle schema-qualified table names (e.g. "db.table")
-        if (targetTable.includes(".") && targetTable !== "*") {
-          const [dbPart, tablePart] = targetTable.split(".");
-          if (dbPart && tablePart) {
-            targetDb = dbPart;
-            targetTable = tablePart;
+          // Handle schema-qualified table names (e.g. "db.table")
+          if (targetTable.includes(".") && targetTable !== "*") {
+            const [dbPart, tablePart] = targetTable.split(".");
+            if (dbPart && tablePart) {
+              targetDb = dbPart;
+              targetTable = tablePart;
+            }
           }
-        }
 
-        // Validate database and table identifiers when not wildcards
-        if (targetDb !== "*") validateIdentifier(targetDb, "database");
-        if (targetTable !== "*") validateIdentifier(targetTable, "table");
+          // Validate database and table identifiers when not wildcards
+          if (targetDb !== "*") validateIdentifier(targetDb, "database");
+          if (targetTable !== "*") validateIdentifier(targetTable, "table");
 
-        const db = targetDb === "*" ? "*" : `\`${targetDb}\``;
-        const tbl = targetTable === "*" ? "*" : `\`${targetTable}\``;
+          const db = targetDb === "*" ? "*" : `\`${targetDb}\``;
+          const tbl = targetTable === "*" ? "*" : `\`${targetTable}\``;
 
-        let onClause = `${db}.${tbl}`;
-        if (targetDb === "*" && targetTable !== "*") {
-          // Cannot use * for db with specific table (MySQL syntax error)
-          // Assume current database if table is specified but db is wildcard
-          onClause = tbl;
-        }
+          let onClause = `${db}.${tbl}`;
+          if (targetDb === "*" && targetTable !== "*") {
+            // Cannot use * for db with specific table (MySQL syntax error)
+            // Assume current database if table is specified but db is wildcard
+            onClause = tbl;
+          }
 
-        try {
           await adapter.rawQuery(
             `GRANT ${privileges.join(", ")} ON ${onClause} TO '${role}'`,
           );
@@ -272,20 +307,19 @@ export function getRoleTools(adapter: MySQLAdapter): ToolDefinition[] {
             table: targetTable,
           };
         } catch (error: unknown) {
-          const rawMessage =
+          if (error instanceof ZodError)
+            return { success: false, error: formatZodError(error) };
+          const message =
             error instanceof Error ? error.message : String(error);
-          if (rawMessage.includes("doesn't exist")) {
-            // Strip adapter prefix (e.g. "Raw query failed: Query failed: ") for clean output
-            const cleanMessage = rawMessage
-              .replace(/^Raw query failed:\s*/i, "")
-              .replace(/^Query failed:\s*/i, "");
-            return {
-              success: false,
-              role,
-              error: cleanMessage,
-            };
+          const cleanMsg = stripErrorPrefix(message);
+          // Include role context for table/db-level errors when role was parsed
+          const roleName = (params as Record<string, unknown>)["role"] as
+            | string
+            | undefined;
+          if (roleName) {
+            return { success: false, role: roleName, error: cleanMsg };
           }
-          throw error;
+          return { success: false, error: cleanMsg };
         }
       },
     },
@@ -298,51 +332,54 @@ export function getRoleTools(adapter: MySQLAdapter): ToolDefinition[] {
       requiredScopes: ["admin"],
       annotations: { readOnlyHint: false },
       handler: async (params: unknown, _context: RequestContext) => {
-        const { role, user, host, withAdminOption } =
-          RoleAssignSchema.parse(params);
-
-        // Validate all interpolated identifiers
-        validateIdentifier(role, "column");
-        validateMySQLUserHost(user, "user");
-        validateMySQLUserHost(host, "host");
-
-        // Check if role exists first
-        const checkResult = await adapter.executeQuery(
-          `SELECT 1 FROM mysql.user WHERE User = ? AND account_locked = 'Y' AND password_expired = 'Y' AND authentication_string = ''`,
-          [role],
-        );
-        if (!checkResult.rows || checkResult.rows.length === 0) {
-          return {
-            success: false,
-            role,
-            user,
-            host,
-            exists: false,
-            error: "Role does not exist",
-          };
-        }
-
-        let sql = `GRANT '${role}' TO '${user}'@'${host}'`;
-        if (withAdminOption) sql += " WITH ADMIN OPTION";
         try {
+          const { role, user, host, withAdminOption } =
+            RoleAssignSchema.parse(params);
+
+          // Validate all interpolated identifiers
+          validateIdentifier(role, "role");
+          validateMySQLUserHost(user, "user");
+          validateMySQLUserHost(host, "host");
+
+          // Check if role exists first
+          const checkResult = await adapter.executeQuery(
+            `SELECT 1 FROM mysql.user WHERE User = ? AND account_locked = 'Y' AND password_expired = 'Y' AND authentication_string = ''`,
+            [role],
+          );
+          if (!checkResult.rows || checkResult.rows.length === 0) {
+            return {
+              success: false,
+              role,
+              user,
+              host,
+              exists: false,
+              error: "Role does not exist",
+            };
+          }
+
+          let sql = `GRANT '${role}' TO '${user}'@'${host}'`;
+          if (withAdminOption) sql += " WITH ADMIN OPTION";
           await adapter.rawQuery(sql);
           await adapter.rawQuery(
             `SET DEFAULT ROLE '${role}' TO '${user}'@'${host}'`,
           );
           return { success: true, role, user, host };
         } catch (error: unknown) {
+          if (error instanceof ZodError)
+            return { success: false, error: formatZodError(error) };
           const message =
             error instanceof Error ? error.message : String(error);
           if (message.includes("Unknown authorization ID")) {
             return {
               success: false,
-              role,
-              user,
-              host,
+              role: (params as Record<string, unknown>)["role"] as string,
+              user: (params as Record<string, unknown>)["user"] as string,
+              host:
+                ((params as Record<string, unknown>)["host"] as string) ?? "%",
               error: "User does not exist",
             };
           }
-          throw error;
+          return { success: false, error: stripErrorPrefix(message) };
         }
       },
     },
@@ -355,76 +392,79 @@ export function getRoleTools(adapter: MySQLAdapter): ToolDefinition[] {
       requiredScopes: ["admin"],
       annotations: { readOnlyHint: false },
       handler: async (params: unknown, _context: RequestContext) => {
-        const { role, user, host } = RoleRevokeSchema.parse(params);
-
-        // Check if role exists first
-        const checkResult = await adapter.executeQuery(
-          `SELECT 1 FROM mysql.user WHERE User = ? AND account_locked = 'Y' AND password_expired = 'Y' AND authentication_string = ''`,
-          [role],
-        );
-        if (!checkResult.rows || checkResult.rows.length === 0) {
-          return {
-            success: false,
-            role,
-            user,
-            host,
-            exists: false,
-            error: "Role does not exist",
-          };
-        }
+        try {
+          const { role, user, host } = RoleRevokeSchema.parse(params);
 
-        // P154: Check if user exists before checking assignment
-        const userCheck = await adapter.executeQuery(
-          `SELECT 1 FROM mysql.user WHERE User = ? AND Host = ?`,
-          [user, host],
-        );
-        if (!userCheck.rows || userCheck.rows.length === 0) {
-          return {
-            success: false,
-            role,
-            user,
-            host,
-            error: "User does not exist",
-          };
-        }
+          // Check if role exists first
+          const checkResult = await adapter.executeQuery(
+            `SELECT 1 FROM mysql.user WHERE User = ? AND account_locked = 'Y' AND password_expired = 'Y' AND authentication_string = ''`,
+            [role],
+          );
+          if (!checkResult.rows || checkResult.rows.length === 0) {
+            return {
+              success: false,
+              role,
+              user,
+              host,
+              exists: false,
+              error: "Role does not exist",
+            };
+          }
 
-        // Check if the role is actually assigned to this user
-        const assignCheck = await adapter.executeQuery(
-          `SELECT 1 FROM mysql.role_edges WHERE FROM_USER = ? AND FROM_HOST = '%' AND TO_USER = ? AND TO_HOST = ?`,
-          [role, user, host],
-        );
-        if (!assignCheck.rows || assignCheck.rows.length === 0) {
-          return {
-            success: false,
-            role,
-            user,
-            host,
-            reason: `Role '${role}' is not assigned to user '${user}'@'${host}'`,
-          };
-        }
+          // P154: Check if user exists before checking assignment
+          const userCheck = await adapter.executeQuery(
+            `SELECT 1 FROM mysql.user WHERE User = ? AND Host = ?`,
+            [user, host],
+          );
+          if (!userCheck.rows || userCheck.rows.length === 0) {
+            return {
+              success: false,
+              role,
+              user,
+              host,
+              error: "User does not exist",
+            };
+          }
+
+          // Check if the role is actually assigned to this user
+          const assignCheck = await adapter.executeQuery(
+            `SELECT 1 FROM mysql.role_edges WHERE FROM_USER = ? AND FROM_HOST = '%' AND TO_USER = ? AND TO_HOST = ?`,
+            [role, user, host],
+          );
+          if (!assignCheck.rows || assignCheck.rows.length === 0) {
+            return {
+              success: false,
+              role,
+              user,
+              host,
+              error: `Role '${role}' is not assigned to user '${user}'@'${host}'`,
+            };
+          }
 
-        try {
           // Validate before interpolation (role/user/host already validated by earlier checks
           // but validate user/host explicitly for this rawQuery)
-          validateIdentifier(role, "column");
+          validateIdentifier(role, "role");
           validateMySQLUserHost(user, "user");
           validateMySQLUserHost(host, "host");
 
           await adapter.rawQuery(`REVOKE '${role}' FROM '${user}'@'${host}'`);
           return { success: true, role, user, host };
         } catch (error: unknown) {
+          if (error instanceof ZodError)
+            return { success: false, error: formatZodError(error) };
           const message =
             error instanceof Error ? error.message : String(error);
           if (message.includes("Unknown authorization ID")) {
             return {
               success: false,
-              role,
-              user,
-              host,
+              role: (params as Record<string, unknown>)["role"] as string,
+              user: (params as Record<string, unknown>)["user"] as string,
+              host:
+                ((params as Record<string, unknown>)["host"] as string) ?? "%",
               error: "User does not exist",
             };
           }
-          throw error;
+          return { success: false, error: stripErrorPrefix(message) };
         }
       },
     },
@@ -437,23 +477,31 @@ export function getRoleTools(adapter: MySQLAdapter): ToolDefinition[] {
       requiredScopes: ["read"],
       annotations: { readOnlyHint: true, idempotentHint: true },
       handler: async (params: unknown, _context: RequestContext) => {
-        const { user, host } = UserRolesSchema.parse(params);
-
-        // P154: Check if user exists
-        const userCheck = await adapter.executeQuery(
-          `SELECT 1 FROM mysql.user WHERE User = ? AND Host = ?`,
-          [user, host],
-        );
-        if (!userCheck.rows || userCheck.rows.length === 0) {
-          return { user, host, exists: false };
-        }
+        try {
+          const { user, host } = UserRolesSchema.parse(params);
+
+          // P154: Check if user exists
+          const userCheck = await adapter.executeQuery(
+            `SELECT 1 FROM mysql.user WHERE User = ? AND Host = ?`,
+            [user, host],
+          );
+          if (!userCheck.rows || userCheck.rows.length === 0) {
+            return { user, host, exists: false };
+          }
 
-        const result = await adapter.executeQuery(
-          `SELECT FROM_USER as roleName, FROM_HOST as roleHost, WITH_ADMIN_OPTION as admin
-                     FROM mysql.role_edges WHERE TO_USER=? AND TO_HOST=?`,
-          [user, host],
-        );
-        return { user, host, roles: result.rows ?? [] };
+          const result = await adapter.executeQuery(
+            `SELECT FROM_USER as roleName, FROM_HOST as roleHost, WITH_ADMIN_OPTION as admin
+                       FROM mysql.role_edges WHERE TO_USER=? AND TO_HOST=?`,
+            [user, host],
+          );
+          return { user, host, roles: result.rows ?? [] };
+        } catch (error: unknown) {
+          if (error instanceof ZodError)
+            return { success: false, error: formatZodError(error) };
+          const message =
+            error instanceof Error ? error.message : String(error);
+          return { success: false, error: stripErrorPrefix(message) };
+        }
       },
     },
   ];