@nocobase/ai 2.1.9 → 2.1.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/ai",
-  "version": "2.1.9",
+  "version": "2.1.11",
   "description": "",
   "license": "Apache-2.0",
   "main": "./lib/index.js",
@@ -17,10 +17,10 @@
     "@langchain/mcp-adapters": "1.1.3",
     "@langchain/ollama": "1.2.7",
     "@langchain/openai": "1.4.7",
-    "@nocobase/data-source-manager": "2.1.9",
-    "@nocobase/logger": "2.1.9",
-    "@nocobase/resourcer": "2.1.9",
-    "@nocobase/utils": "2.1.9",
+    "@nocobase/data-source-manager": "2.1.11",
+    "@nocobase/logger": "2.1.11",
+    "@nocobase/resourcer": "2.1.11",
+    "@nocobase/utils": "2.1.11",
     "d3-dsv": "2",
     "fast-glob": "^3.3.2",
     "flexsearch": "^0.8.2",
@@ -37,5 +37,5 @@
     "url": "git+https://github.com/nocobase/nocobase.git",
     "directory": "packages/ai"
   },
-  "gitHead": "2b612d81c6f6115af75ea7b279384751af869510"
+  "gitHead": "1ccf891d837e21089f65f84b892407b34a0a0cb9"
 }

package/src/__tests__/mcp-user-context.test.ts

@@ -0,0 +1,339 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+const mcpClientMock = vi.hoisted(() => {
+  const instances: any[] = [];
+
+  class MultiServerMCPClient {
+    connections: Record<string, any>;
+    close = vi.fn();
+
+    constructor(connections: Record<string, any>) {
+      this.connections = connections;
+      instances.push(this);
+    }
+
+    async initializeConnections() {
+      if (Object.values(this.connections).some((connection) => connection?.failInitialize)) {
+        throw new Error('initialize failed');
+      }
+      return Object.fromEntries(
+        Object.keys(this.connections).map((serverName) => [
+          serverName,
+          [
+            {
+              name: 'getProfile',
+              description: `Get profile from ${serverName}`,
+              schema: {},
+              invoke: vi.fn(async (args) => ({ serverName, args })),
+            },
+          ],
+        ]),
+      );
+    }
+  }
+
+  return {
+    instances,
+    MultiServerMCPClient,
+  };
+});
+
+vi.mock('@langchain/mcp-adapters', () => ({
+  MultiServerMCPClient: mcpClientMock.MultiServerMCPClient,
+}));
+
+import { DefaultMCPManager } from '../mcp-manager';
+import { normalizeMCPOptions, renderMCPOptions } from '../mcp-manager/options-renderer';
+import { UserContextMCPClientManager } from '../mcp-manager/user-context-client-manager';
+
+describe('user-bound MCP clients', () => {
+  const createApp = () => ({
+    environment: {
+      getVariables: () => ({
+        MCP_HOST: 'mcp.example.test',
+        API_TOKEN: 'env-token',
+      }),
+    },
+    log: {
+      warn: vi.fn(),
+    },
+  });
+
+  const createCtx = (id: number, extraUser: Record<string, unknown> = {}) =>
+    ({
+      state: {
+        currentUser: {
+          id,
+          name: `user-${id}`,
+          ...extraUser,
+        },
+      },
+      auth: {
+        user: {
+          id,
+          name: `user-${id}`,
+          ...extraUser,
+        },
+      },
+      db: {
+        getRepository: () => ({
+          findOne: vi.fn(),
+        }),
+      },
+      request: {
+        headers: {
+          authorization: 'Bearer request-token',
+          'x-role': 'admin',
+        },
+      },
+      getBearerToken: () => 'request-token',
+    }) as any;
+
+  beforeEach(() => {
+    mcpClientMock.instances.length = 0;
+  });
+
+  afterEach(() => {
+    vi.useRealTimers();
+  });
+
+  it('normalizes stdio records as not user-bound', () => {
+    expect(
+      normalizeMCPOptions({
+        transport: 'stdio',
+        command: 'node',
+        args: ['server.js'],
+        env: { TOKEN: '{{ $env.API_TOKEN }}' },
+        useUserContext: true,
+      }),
+    ).toMatchObject({
+      transport: 'stdio',
+      command: 'node',
+      args: ['server.js'],
+      env: { TOKEN: '{{ $env.API_TOKEN }}' },
+      useUserContext: false,
+      headers: {},
+    });
+  });
+
+  it('renders environment and current user variables in MCP options', async () => {
+    const rendered = await renderMCPOptions(
+      {
+        transport: 'http',
+        url: 'https://{{ $env.MCP_HOST }}/users/{{ currentUser.id }}',
+        headers: {
+          Authorization: 'Bearer {{ $env.API_TOKEN }}',
+          'X-User': '{{ $user.name }}',
+        },
+        useUserContext: true,
+      },
+      createApp(),
+      createCtx(7),
+    );
+
+    expect(rendered).toMatchObject({
+      transport: 'http',
+      url: 'https://mcp.example.test/users/7',
+      headers: {
+        Authorization: 'Bearer env-token',
+        'X-User': 'user-7',
+      },
+      useUserContext: true,
+    });
+  });
+
+  it('renders NocoBase request in MCP options', async () => {
+    const rendered = await renderMCPOptions(
+      {
+        transport: 'http',
+        url: 'https://{{ $env.MCP_HOST }}/mcp',
+        headers: {
+          Authorization: 'Bearer {{ request.token }}',
+          'X-Role': '{{ request.headers.x-role }}',
+        },
+        useUserContext: true,
+      },
+      createApp(),
+      createCtx(7),
+    );
+
+    expect(rendered).toMatchObject({
+      headers: {
+        Authorization: 'Bearer request-token',
+        'X-Role': 'admin',
+      },
+    });
+  });
+
+  it('does not render NocoBase request for shared MCP options', async () => {
+    const rendered = await renderMCPOptions(
+      {
+        transport: 'http',
+        url: 'https://{{ $env.MCP_HOST }}/mcp',
+        headers: {
+          Authorization: 'Bearer {{ request.token }}',
+        },
+        useUserContext: false,
+      },
+      createApp(),
+      createCtx(7),
+    );
+
+    expect(rendered.headers).toMatchObject({
+      Authorization: 'Bearer ',
+    });
+  });
+
+  it('excludes user-bound records when rebuilding the shared client', async () => {
+    const manager = new DefaultMCPManager(createApp() as any) as any;
+    manager.listMCP = vi.fn().mockResolvedValue([]);
+
+    await manager.rebuildClient();
+
+    expect(manager.listMCP).toHaveBeenCalledWith({ enabled: true, useUserContext: false });
+    expect(mcpClientMock.instances).toHaveLength(0);
+  });
+
+  it('registers user-bound tools from filter ctx', async () => {
+    const manager = new DefaultMCPManager(createApp() as any) as any;
+    manager.listMCP = vi.fn().mockResolvedValue([
+      {
+        name: 'profile',
+        enabled: true,
+        transport: 'http',
+        url: 'https://{{ $env.MCP_HOST }}/{{ currentUser.id }}',
+        headers: {},
+        useUserContext: true,
+      },
+    ]);
+    const registered: any[] = [];
+
+    await manager.getMCPToolsProvider()(
+      {
+        registerTools: (tool) => registered.push(tool),
+        registerDynamicTools: vi.fn(),
+      },
+      { ctx: createCtx(9) },
+    );
+
+    expect(registered).toHaveLength(1);
+    expect(registered[0].definition.name).toBe('mcp-profile-getProfile');
+    expect(mcpClientMock.instances[0].connections.profile.url).toBe('https://mcp.example.test/9');
+  });
+
+  it('lists user-bound tools from ctx', async () => {
+    const manager = new DefaultMCPManager(createApp() as any) as any;
+    manager.listMCP = vi.fn().mockResolvedValue([
+      {
+        name: 'profile',
+        enabled: true,
+        transport: 'http',
+        url: 'https://{{ $env.MCP_HOST }}/{{ currentUser.id }}',
+        headers: {},
+        useUserContext: true,
+      },
+    ]);
+
+    const tools = await manager.listMCPTools(createCtx(11));
+
+    expect(tools.profile).toEqual([
+      {
+        name: 'mcp-profile-getProfile',
+        title: 'getProfile',
+        description: 'Get profile from profile',
+        serverName: 'profile',
+        permission: 'ALLOW',
+      },
+    ]);
+    expect(mcpClientMock.instances[0].connections.profile.url).toBe('https://mcp.example.test/11');
+  });
+
+  it('returns empty tools and logs warning when user-bound MCP initialization fails', async () => {
+    const app = createApp();
+    const manager = new UserContextMCPClientManager({
+      app,
+      listEntries: async () => [
+        {
+          name: 'profile',
+          enabled: true,
+          transport: 'http',
+          url: 'https://{{ $env.MCP_HOST }}/{{ currentUser.id }}',
+          headers: {},
+          useUserContext: true,
+        },
+      ],
+      buildConnection: () => ({ failInitialize: true }) as any,
+    });
+
+    await expect(manager.getToolsMap(createCtx(1))).resolves.toEqual({});
+    expect(app.log.warn).toHaveBeenCalledWith('fail to get user-bound mcp tools', expect.any(Error));
+    expect(mcpClientMock.instances[0].close).toHaveBeenCalledTimes(1);
+  });
+
+  it('reuses cached user-bound tools and refreshes them after TTL', async () => {
+    vi.useFakeTimers();
+    vi.setSystemTime(0);
+
+    const manager = new UserContextMCPClientManager({
+      app: createApp(),
+      ttlMs: 10,
+      maxSize: 10,
+      listEntries: async () => [
+        {
+          name: 'profile',
+          enabled: true,
+          transport: 'http',
+          url: 'https://{{ $env.MCP_HOST }}/{{ currentUser.id }}',
+          headers: {},
+          useUserContext: true,
+        },
+      ],
+      buildConnection: (options) => options as any,
+    });
+
+    await manager.getToolsMap(createCtx(1));
+    await manager.getToolsMap(createCtx(1));
+    expect(mcpClientMock.instances).toHaveLength(1);
+
+    vi.setSystemTime(11);
+    await manager.getToolsMap(createCtx(1));
+
+    expect(mcpClientMock.instances).toHaveLength(2);
+    expect(mcpClientMock.instances[0].close).toHaveBeenCalledTimes(1);
+  });
+
+  it('evicts the oldest user-bound cache entry when max size is exceeded', async () => {
+    const manager = new UserContextMCPClientManager({
+      app: createApp(),
+      ttlMs: 1000,
+      maxSize: 1,
+      listEntries: async () => [
+        {
+          name: 'profile',
+          enabled: true,
+          transport: 'http',
+          url: 'https://{{ $env.MCP_HOST }}/{{ currentUser.id }}',
+          headers: {},
+          useUserContext: true,
+        },
+      ],
+      buildConnection: (options) => options as any,
+    });
+
+    await manager.getToolsMap(createCtx(1));
+    await manager.getToolsMap(createCtx(2));
+
+    expect(mcpClientMock.instances).toHaveLength(2);
+    expect(mcpClientMock.instances[0].close).toHaveBeenCalledTimes(1);
+
+    await manager.clear();
+    expect(mcpClientMock.instances[1].close).toHaveBeenCalledTimes(1);
+  });
+});

package/src/__tests__/mcp.test.ts

@@ -85,7 +85,7 @@ describe('MCP loader test cases', () => {
         title: 'getForecast',
         description: 'Get weather forecast',
         serverName: 'weather',
-        permission: 'ASK',
+        permission: 'ALLOW',
       },
       {
         name: 'mcp-weather-setDefaultCity',

package/src/mcp-manager/index.ts

@@ -15,6 +15,8 @@ import { StructuredToolInterface } from '@langchain/core/tools';
 import { MCPEntry, MCPFilter, MCPManager, MCPOptions, MCPTestResult, MCPToolEntry } from './types';
 import type { DynamicToolsProvider, Permission, ToolsRegistration, ToolsOptions } from '../tools-manager/types';
 import type { Context } from '@nocobase/actions';
+import { normalizeMCPOptions, renderMCPOptions } from './options-renderer';
+import { UserContextMCPClientManager } from './user-context-client-manager';
 
 export class DefaultMCPManager implements MCPManager {
   private readonly mcpRegistry = new Registry<MCPEntry>();
@@ -23,9 +25,15 @@ export class DefaultMCPManager implements MCPManager {
   private client: MultiServerMCPClient | null = null;
   private toolsMap: Record<string, StructuredToolInterface[]> = {};
   private toolsPermissionMap: Record<string, Permission> = {};
+  private readonly userContextClientManager: UserContextMCPClientManager;
 
   constructor(private readonly app: any) {
     this.provideCollectionManager = () => app.mainDataSource;
+    this.userContextClientManager = new UserContextMCPClientManager({
+      app,
+      listEntries: () => this.listMCP({ enabled: true, useUserContext: true }),
+      buildConnection: (options) => this.buildMCPConnection(options),
+    });
   }
 
   async init() {
@@ -72,6 +80,14 @@ export class DefaultMCPManager implements MCPManager {
     if (filter.transport) {
       where['transport'] = filter.transport;
     }
+    if (filter.useUserContext != null) {
+      where['useUserContext'] =
+        filter.useUserContext === true
+          ? true
+          : {
+              [Op.or]: [false, null],
+            };
+    }
     return (await this.aiMcpClientsModel?.findAll({ where }))?.map((item) => item.toJSON() as MCPEntry) ?? [];
   }
 
@@ -88,7 +104,7 @@ export class DefaultMCPManager implements MCPManager {
     }
 
     // Get all enabled MCP entries
-    const entries = await this.listMCP({ enabled: true });
+    const entries = await this.listMCP({ enabled: true, useUserContext: false });
 
     if (entries.length === 0) {
       return;
@@ -97,7 +113,7 @@ export class DefaultMCPManager implements MCPManager {
     // Build connections object
     const connections: Record<string, StdioConnection | StreamableHTTPConnection> = {};
     for (const entry of entries) {
-      connections[entry.name] = this.buildMCPConnection(entry);
+      connections[entry.name] = this.buildMCPConnection(await renderMCPOptions(entry, this.app));
     }
 
     // Create new client and initialize connections
@@ -121,48 +137,82 @@ export class DefaultMCPManager implements MCPManager {
   }
 
   getMCPToolsProvider(): DynamicToolsProvider {
-    return async (register: ToolsRegistration): Promise<void> => {
+    return async (register: ToolsRegistration, filter): Promise<void> => {
       // Use cached tools from rebuildClient
       for (const [serverName, tools] of Object.entries(this.toolsMap)) {
-        for (const tool of tools) {
-          const toolName = `mcp-${serverName}-${tool.name}`;
-          const toolOptions: ToolsOptions = {
-            scope: 'GENERAL',
-            from: 'mcp',
-            defaultPermission: this.toolsPermissionMap[toolName],
-            introduction: {
-              title: tool.name,
-              about: tool.description,
-            },
-            definition: {
-              name: toolName,
-              description: tool.description || `MCP tool: ${tool.name} from ${serverName}`,
-              schema: tool.schema,
-            },
-            invoke: async (_ctx: Context, args: any) => {
-              try {
-                const result = await tool.invoke(args);
-                return result;
-              } catch (error: any) {
-                return {
-                  status: 'error' as const,
-                  content: error?.message || 'Tool invocation failed',
-                };
-              }
-            },
-          };
-          register.registerTools(toolOptions);
-        }
+        this.registerToolsFromMap(register, serverName, tools);
       }
+
+      if (!filter?.ctx) {
+        return;
+      }
+
+      const userToolsMap = await this.userContextClientManager.getToolsMap(filter.ctx);
+      for (const [serverName, tools] of Object.entries(userToolsMap)) {
+        this.registerToolsFromMap(register, serverName, tools);
+      }
+    };
+  }
+
+  private registerToolsFromMap(
+    register: ToolsRegistration,
+    serverName: string,
+    tools: StructuredToolInterface[],
+  ): void {
+    for (const tool of tools) {
+      const toolName = `mcp-${serverName}-${tool.name}`;
+      this.ensureToolPermission(toolName, tool.name);
+      const toolOptions: ToolsOptions = {
+        scope: 'GENERAL',
+        from: 'mcp',
+        defaultPermission: this.toolsPermissionMap[toolName],
+        introduction: {
+          title: tool.name,
+          about: tool.description,
+        },
+        definition: {
+          name: toolName,
+          description: tool.description || `MCP tool: ${tool.name} from ${serverName}`,
+          schema: tool.schema,
+        },
+        invoke: async (_ctx: Context, args: any) => {
+          try {
+            const result = await tool.invoke(args);
+            return result;
+          } catch (error: any) {
+            return {
+              status: 'error' as const,
+              content: error?.message || 'Tool invocation failed',
+            };
+          }
+        },
+      };
+      register.registerTools(toolOptions);
+    }
+  }
+
+  private ensureToolPermission(toolName: string, rawToolName: string) {
+    if (!(toolName in this.toolsPermissionMap)) {
+      this.toolsPermissionMap[toolName] = rawToolName.startsWith('get') ? 'ALLOW' : 'ASK';
+    }
+  }
+
+  async listMCPTools(ctx?: Context): Promise<Record<string, MCPToolEntry[]>> {
+    const toolsMap = {
+      ...this.toolsMap,
+      ...(ctx ? await this.userContextClientManager.getToolsMap(ctx) : {}),
     };
+
+    return this.formatMCPTools(toolsMap);
   }
 
-  async listMCPTools(): Promise<Record<string, MCPToolEntry[]>> {
+  private formatMCPTools(toolsMap: Record<string, StructuredToolInterface[]>): Record<string, MCPToolEntry[]> {
     return Object.fromEntries(
-      Object.entries(this.toolsMap).map(([serverName, tools]) => [
+      Object.entries(toolsMap).map(([serverName, tools]) => [
         serverName,
         tools.map((tool) => {
           const toolName = `mcp-${serverName}-${tool.name}`;
+          this.ensureToolPermission(toolName, tool.name);
           return {
             name: toolName,
             title: tool.name,
@@ -179,8 +229,13 @@ export class DefaultMCPManager implements MCPManager {
     this.toolsPermissionMap[toolName] = permission;
   }
 
-  async testConnection(options: MCPOptions): Promise<MCPTestResult> {
-    const { transport } = options;
+  async clearUserContextCache(): Promise<void> {
+    await this.userContextClientManager.clear();
+  }
+
+  async testConnection(options: MCPOptions, ctx?: Context): Promise<MCPTestResult> {
+    const renderedOptions = await renderMCPOptions(normalizeMCPOptions(options), this.app, ctx);
+    const { transport } = renderedOptions;
 
     // Validate required fields
     if (!transport) {
@@ -190,14 +245,14 @@ export class DefaultMCPManager implements MCPManager {
       };
     }
 
-    if (transport === 'stdio' && !options.command) {
+    if (transport === 'stdio' && !renderedOptions.command) {
       return {
         success: false,
         error: 'Command is required for stdio transport',
       };
     }
 
-    if ((transport === 'http' || transport === 'sse') && !options.url) {
+    if ((transport === 'http' || transport === 'sse') && !renderedOptions.url) {
       return {
         success: false,
         error: 'URL is required for HTTP/SSE transport',
@@ -207,7 +262,7 @@ export class DefaultMCPManager implements MCPManager {
     let client: MultiServerMCPClient | null = null;
 
     try {
-      const connection = this.buildMCPConnection(options);
+      const connection = this.buildMCPConnection(renderedOptions);
       const serverName = 'test-server';
 
       client = new MultiServerMCPClient({
@@ -303,18 +358,20 @@ export class DefaultMCPManager implements MCPManager {
   }
 
   private async persistenceEntry(entry: MCPEntry): Promise<void> {
+    const normalizedEntry = normalizeMCPOptions(entry) as MCPEntry;
     await this.sequelize.transaction(async (transaction) => {
-      const existed = await this.aiMcpClientsModel.findOne({ where: { name: entry.name }, transaction });
+      const existed = await this.aiMcpClientsModel.findOne({ where: { name: normalizedEntry.name }, transaction });
       if (existed) {
         await existed.update(
           {
-            transport: entry.transport,
-            command: entry.command,
-            args: entry.args,
-            env: entry.env,
-            url: entry.url,
-            headers: entry.headers,
-            restart: entry.restart,
+            transport: normalizedEntry.transport,
+            command: normalizedEntry.command,
+            args: normalizedEntry.args,
+            env: normalizedEntry.env,
+            url: normalizedEntry.url,
+            headers: normalizedEntry.headers,
+            restart: normalizedEntry.restart,
+            useUserContext: normalizedEntry.useUserContext,
           },
           { transaction },
         );
@@ -323,7 +380,7 @@ export class DefaultMCPManager implements MCPManager {
 
       await this.aiMcpClientsModel.create(
         {
-          ...entry,
+          ...normalizedEntry,
         },
         { transaction },
       );
@@ -331,13 +388,15 @@ export class DefaultMCPManager implements MCPManager {
   }
 
   private normalizeEntry(name: string, options: MCPOptions): MCPEntry {
-    return {
+    const entry: MCPEntry = {
       name,
       enabled: true,
       ...options,
       args: options.args ?? [],
       env: options.env ?? {},
+      useUserContext: options.useUserContext === true,
     };
+    return normalizeMCPOptions(entry) as MCPEntry;
   }
 
   private get aiMcpClientsCollection() {