@neverinfamous/mysql-mcp 2.3.0 → 3.0.0

package/src/adapters/mysql/tools/security/audit.ts

@@ -4,33 +4,49 @@
  * Tools for security auditing, firewall monitoring, and compliance.
  */
 
-import { z } from "zod";
+import { z, ZodError } from "zod";
 import type { MySQLAdapter } from "../../MySQLAdapter.js";
 import type {
   ToolDefinition,
   RequestContext,
 } from "../../../../types/index.js";
 
+// =============================================================================
+// Helpers
+// =============================================================================
+
+/** Extract human-readable messages from a ZodError instead of raw JSON array */
+function formatZodError(error: ZodError): string {
+  return error.issues.map((i) => i.message).join("; ");
+}
+
+/** Strip verbose adapter prefixes from error messages */
+function stripErrorPrefix(msg: string): string {
+  return msg
+    .replace(/^Query failed:\s*/i, "")
+    .replace(/^Execute failed:\s*/i, "")
+    .trim();
+}
+
 // =============================================================================
 // Zod Schemas
 // ============================================================================
 
 const AuditLogSchema = z.object({
-  limit: z.number().default(100).describe("Maximum number of records"),
+  limit: z.number().default(20).describe("Maximum number of records"),
   user: z.string().optional().describe("Filter by username"),
   eventType: z
     .string()
     .optional()
-    .describe('Filter by event type (e.g., "CONNECT", "QUERY")'),
+    .describe(
+      'Filter by event type (e.g., "Execute", "Ping", "begin"). Uses LIKE matching against performance_schema EVENT_NAME.',
+    ),
   startTime: z.string().optional().describe("Start time filter (ISO 8601)"),
 });
 
 const FirewallRulesSchema = z.object({
   user: z.string().optional().describe("Filter by username"),
-  mode: z
-    .enum(["RECORDING", "PROTECTING", "DETECTING", "OFF"])
-    .optional()
-    .describe("Filter by mode"),
+  mode: z.string().optional().describe("Filter by mode"),
 });
 
 // =============================================================================
@@ -54,11 +70,10 @@ export function createSecurityAuditTool(adapter: MySQLAdapter): ToolDefinition {
       idempotentHint: true,
     },
     handler: async (params: unknown, _context: RequestContext) => {
-      const { limit, user, eventType, startTime } =
-        AuditLogSchema.parse(params);
-
       // First check if audit log table exists
       try {
+        const { limit, user, eventType, startTime } =
+          AuditLogSchema.parse(params);
         const checkResult = await adapter.executeQuery(`
                     SELECT TABLE_NAME 
                     FROM information_schema.TABLES 
@@ -70,36 +85,59 @@ export function createSecurityAuditTool(adapter: MySQLAdapter): ToolDefinition {
           // Try performance_schema alternative
           let query = `
                         SELECT 
-                            EVENT_NAME as event,
-                            OBJECT_TYPE as objectType,
-                            OBJECT_NAME as objectName,
-                            CURRENT_USER as user,
-                            HOST as host,
-                            TIMER_START as startTime
-                        FROM performance_schema.events_statements_history
+                            e.EVENT_NAME as event,
+                            e.OBJECT_TYPE as objectType,
+                            e.OBJECT_NAME as objectName,
+                            t.PROCESSLIST_USER as user,
+                            t.PROCESSLIST_HOST as host,
+                            e.TIMER_START as startTime
+                        FROM performance_schema.events_statements_history e
+                        JOIN performance_schema.threads t
+                          ON e.THREAD_ID = t.THREAD_ID
                     `;
 
           const conditions: string[] = [];
-          const queryParams: unknown[] = [];
+          const filtersApplied: string[] = [];
+          const filtersIgnored: string[] = [];
 
           if (user) {
-            conditions.push("CURRENT_USER LIKE ?");
-            queryParams.push(`%${user}%`);
+            // Safe: escape single quotes in user input for LIKE clause
+            const escaped = user.replace(/'/g, "''");
+            conditions.push(`t.PROCESSLIST_USER LIKE '%${escaped}%'`);
+            filtersApplied.push("user");
+          }
+          if (eventType) {
+            const escaped = eventType.replace(/'/g, "''");
+            conditions.push(`e.EVENT_NAME LIKE '%${escaped}%'`);
+            filtersApplied.push("eventType");
+          }
+          if (startTime) {
+            // TIMER_START is a picosecond counter, not an ISO timestamp —
+            // this filter is best-effort and unlikely to match user intent.
+            filtersIgnored.push("startTime");
           }
 
           if (conditions.length > 0) {
             query += " WHERE " + conditions.join(" AND ");
           }
 
-          query += ` ORDER BY TIMER_START DESC LIMIT ${String(limit)}`;
+          // limit is Zod-validated as z.number(), safe to interpolate.
+          // performance_schema does not support prepared statement parameters.
+          query += ` ORDER BY e.TIMER_START DESC LIMIT ${limit}`;
 
-          const result = await adapter.executeQuery(query, queryParams);
-          return {
+          const result = await adapter.executeQuery(query, []);
+          const response: Record<string, unknown> = {
             source: "performance_schema",
             message: "Using performance_schema as audit log is not available",
             events: result.rows ?? [],
             count: result.rows?.length ?? 0,
           };
+          if (filtersIgnored.length > 0) {
+            response["filtersIgnored"] = filtersIgnored;
+            response["note"] =
+              "startTime filter not applied: performance_schema uses picosecond counters, not ISO timestamps";
+          }
+          return response;
         }
 
         // Query actual audit log
@@ -128,7 +166,8 @@ export function createSecurityAuditTool(adapter: MySQLAdapter): ToolDefinition {
           query += " WHERE " + conditions.join(" AND ");
         }
 
-        query += ` ORDER BY timestamp DESC LIMIT ${String(limit)}`;
+        query += " ORDER BY timestamp DESC LIMIT ?";
+        queryParams.push(limit);
 
         const result = await adapter.executeQuery(query, queryParams);
         return {
@@ -136,14 +175,28 @@ export function createSecurityAuditTool(adapter: MySQLAdapter): ToolDefinition {
           events: result.rows ?? [],
           count: result.rows?.length ?? 0,
         };
-      } catch {
-        return {
-          available: false,
-          message:
-            "Audit logging is not enabled. Install MySQL Enterprise Audit or Percona Audit plugin.",
-          suggestion:
-            'Install audit plugin with: INSTALL PLUGIN audit_log SONAME "audit_log.so"',
-        };
+      } catch (error: unknown) {
+        if (error instanceof ZodError) {
+          return { success: false, error: formatZodError(error) };
+        }
+        const msg = error instanceof Error ? error.message : String(error);
+        const stripped = stripErrorPrefix(msg);
+        const lower = stripped.toLowerCase();
+        if (
+          lower.includes("doesn't exist") ||
+          lower.includes("does not exist") ||
+          lower.includes("access denied")
+        ) {
+          return {
+            success: false,
+            available: false,
+            error:
+              "Audit logging is not enabled. Install MySQL Enterprise Audit or Percona Audit plugin.",
+            suggestion:
+              'Install audit plugin with: INSTALL PLUGIN audit_log SONAME "audit_log.so"',
+          };
+        }
+        return { success: false, error: stripped };
       }
     },
   };
@@ -203,11 +256,16 @@ export function createSecurityFirewallStatusTool(
           plugins: pluginResult.rows,
           configuration: variables,
         };
-      } catch {
+      } catch (error) {
+        if (error instanceof ZodError) {
+          return { success: false, error: formatZodError(error) };
+        }
+        const message = error instanceof Error ? error.message : String(error);
         return {
+          success: false,
           installed: false,
-          message: "Firewall plugin check failed",
-          suggestion: "Ensure you have privileges to view plugin information",
+          error: `Firewall plugin check failed: ${stripErrorPrefix(message)}`,
+          suggestion: stripErrorPrefix(message),
         };
       }
     },
@@ -232,9 +290,21 @@ export function createSecurityFirewallRulesTool(
       idempotentHint: true,
     },
     handler: async (params: unknown, _context: RequestContext) => {
-      const { user, mode } = FirewallRulesSchema.parse(params);
-
       try {
+        const { user, mode } = FirewallRulesSchema.parse(params);
+
+        const validModes = [
+          "RECORDING",
+          "PROTECTING",
+          "DETECTING",
+          "OFF",
+        ] as const;
+        if (mode && !validModes.includes(mode as (typeof validModes)[number])) {
+          return {
+            success: false,
+            error: `Invalid mode: '${mode}' — expected one of: ${validModes.join(", ")}`,
+          };
+        }
         // Get firewall users
         let usersQuery = `
                     SELECT USERHOST, MODE
@@ -280,10 +350,14 @@ export function createSecurityFirewallRulesTool(
           userCount: usersResult.rows?.length ?? 0,
           ruleCount: rulesResult.rows?.length ?? 0,
         };
-      } catch {
+      } catch (error) {
+        if (error instanceof ZodError) {
+          return { success: false, error: formatZodError(error) };
+        }
         return {
+          success: false,
           available: false,
-          message:
+          error:
             "Firewall tables not accessible. Ensure MySQL Enterprise Firewall is installed and you have appropriate privileges.",
         };
       }