@owine/unifi-protect-mcp 2.0.2 → 2.1.0

package/dist/tools/cameras.js

@@ -4,6 +4,7 @@ exports.registerCameraTools = registerCameraTools;
 const zod_1 = require("zod");
 const responses_js_1 = require("../utils/responses.js");
 const safety_js_1 = require("../utils/safety.js");
+const url_js_1 = require("../utils/url.js");
 function registerCameraTools(server, client, readOnly) {
     // --- Read-only tools (always registered) ---
     server.registerTool("protect_list_cameras", {
@@ -24,7 +25,7 @@ function registerCameraTools(server, client, readOnly) {
         annotations: safety_js_1.READ_ONLY,
     }, async ({ id }) => {
         try {
-            const data = await client.get(`/cameras/${id}`);
+            const data = await client.get((0, url_js_1.safePath) `/cameras/${id}`);
             return (0, responses_js_1.formatSuccess)(data);
         }
         catch (err) {
@@ -37,7 +38,7 @@ function registerCameraTools(server, client, readOnly) {
         annotations: safety_js_1.READ_ONLY,
     }, async ({ id }) => {
         try {
-            const { data, mimeType } = await client.getBinary(`/cameras/${id}/snapshot`);
+            const { data, mimeType } = await client.getBinary((0, url_js_1.safePath) `/cameras/${id}/snapshot`);
             return {
                 content: [
                     {
@@ -58,7 +59,7 @@ function registerCameraTools(server, client, readOnly) {
         annotations: safety_js_1.READ_ONLY,
     }, async ({ id }) => {
         try {
-            const data = await client.get(`/cameras/${id}/rtsps-stream`);
+            const data = await client.get((0, url_js_1.safePath) `/cameras/${id}/rtsps-stream`);
             return (0, responses_js_1.formatSuccess)(data);
         }
         catch (err) {
@@ -84,9 +85,9 @@ function registerCameraTools(server, client, readOnly) {
     }, async ({ id, settings, dryRun }) => {
         try {
             if (dryRun) {
-                return (0, safety_js_1.formatDryRun)("PATCH", `/cameras/${id}`, settings);
+                return (0, safety_js_1.formatDryRun)("PATCH", (0, url_js_1.safePath) `/cameras/${id}`, settings);
             }
-            const data = await client.patch(`/cameras/${id}`, settings);
+            const data = await client.patch((0, url_js_1.safePath) `/cameras/${id}`, settings);
             return (0, responses_js_1.formatSuccess)(data);
         }
         catch (err) {
@@ -106,9 +107,9 @@ function registerCameraTools(server, client, readOnly) {
     }, async ({ id, dryRun }) => {
         try {
             if (dryRun) {
-                return (0, safety_js_1.formatDryRun)("POST", `/cameras/${id}/rtsps-stream`);
+                return (0, safety_js_1.formatDryRun)("POST", (0, url_js_1.safePath) `/cameras/${id}/rtsps-stream`);
             }
-            const data = await client.post(`/cameras/${id}/rtsps-stream`);
+            const data = await client.post((0, url_js_1.safePath) `/cameras/${id}/rtsps-stream`);
             return (0, responses_js_1.formatSuccess)(data);
         }
         catch (err) {
@@ -128,9 +129,9 @@ function registerCameraTools(server, client, readOnly) {
     }, async ({ id, dryRun }) => {
         try {
             if (dryRun) {
-                return (0, safety_js_1.formatDryRun)("DELETE", `/cameras/${id}/rtsps-stream`);
+                return (0, safety_js_1.formatDryRun)("DELETE", (0, url_js_1.safePath) `/cameras/${id}/rtsps-stream`);
             }
-            const data = await client.delete(`/cameras/${id}/rtsps-stream`);
+            const data = await client.delete((0, url_js_1.safePath) `/cameras/${id}/rtsps-stream`);
             return (0, responses_js_1.formatSuccess)(data);
         }
         catch (err) {
@@ -150,9 +151,9 @@ function registerCameraTools(server, client, readOnly) {
     }, async ({ id, dryRun }) => {
         try {
             if (dryRun) {
-                return (0, safety_js_1.formatDryRun)("POST", `/cameras/${id}/talkback-session`);
+                return (0, safety_js_1.formatDryRun)("POST", (0, url_js_1.safePath) `/cameras/${id}/talkback-session`);
             }
-            const data = await client.post(`/cameras/${id}/talkback-session`);
+            const data = await client.post((0, url_js_1.safePath) `/cameras/${id}/talkback-session`);
             return (0, responses_js_1.formatSuccess)(data);
         }
         catch (err) {
@@ -173,7 +174,7 @@ function registerCameraTools(server, client, readOnly) {
         if (denied)
             return denied;
         try {
-            const data = await client.post(`/cameras/${id}/disable-mic-permanently`);
+            const data = await client.post((0, url_js_1.safePath) `/cameras/${id}/disable-mic-permanently`);
             return (0, responses_js_1.formatSuccess)(data);
         }
         catch (err) {
@@ -194,9 +195,9 @@ function registerCameraTools(server, client, readOnly) {
     }, async ({ id, slot, dryRun }) => {
         try {
             if (dryRun) {
-                return (0, safety_js_1.formatDryRun)("POST", `/cameras/${id}/ptz/patrol/start/${slot}`);
+                return (0, safety_js_1.formatDryRun)("POST", (0, url_js_1.safePath) `/cameras/${id}/ptz/patrol/start/${slot}`);
             }
-            const data = await client.post(`/cameras/${id}/ptz/patrol/start/${slot}`);
+            const data = await client.post((0, url_js_1.safePath) `/cameras/${id}/ptz/patrol/start/${slot}`);
             return (0, responses_js_1.formatSuccess)(data);
         }
         catch (err) {
@@ -216,9 +217,9 @@ function registerCameraTools(server, client, readOnly) {
     }, async ({ id, dryRun }) => {
         try {
             if (dryRun) {
-                return (0, safety_js_1.formatDryRun)("POST", `/cameras/${id}/ptz/patrol/stop`);
+                return (0, safety_js_1.formatDryRun)("POST", (0, url_js_1.safePath) `/cameras/${id}/ptz/patrol/stop`);
             }
-            const data = await client.post(`/cameras/${id}/ptz/patrol/stop`);
+            const data = await client.post((0, url_js_1.safePath) `/cameras/${id}/ptz/patrol/stop`);
             return (0, responses_js_1.formatSuccess)(data);
         }
         catch (err) {
@@ -239,9 +240,9 @@ function registerCameraTools(server, client, readOnly) {
     }, async ({ id, slot, dryRun }) => {
         try {
             if (dryRun) {
-                return (0, safety_js_1.formatDryRun)("POST", `/cameras/${id}/ptz/goto/${slot}`);
+                return (0, safety_js_1.formatDryRun)("POST", (0, url_js_1.safePath) `/cameras/${id}/ptz/goto/${slot}`);
             }
-            const data = await client.post(`/cameras/${id}/ptz/goto/${slot}`);
+            const data = await client.post((0, url_js_1.safePath) `/cameras/${id}/ptz/goto/${slot}`);
             return (0, responses_js_1.formatSuccess)(data);
         }
         catch (err) {

package/dist/tools/devices.js

@@ -4,6 +4,7 @@ exports.registerDeviceTools = registerDeviceTools;
 const zod_1 = require("zod");
 const responses_js_1 = require("../utils/responses.js");
 const safety_js_1 = require("../utils/safety.js");
+const url_js_1 = require("../utils/url.js");
 const settingsHints = {
     light: "Known fields: name (string), isLightForceEnabled (boolean), lightModeSettings (object with mode, enableAt), lightDeviceSettings (object with isIndicatorEnabled, pirDuration, pirSensitivity, ledLevel)",
     sensor: "Known fields: name (string), mountType (string), motionSettings (object), humiditySettings (object), temperatureSettings (object), lightSettings (object), alarmSettings (object)",
@@ -31,7 +32,7 @@ function registerDeviceCrud(server, client, deviceType, readOnly) {
         annotations: safety_js_1.READ_ONLY,
     }, async ({ id }) => {
         try {
-            const data = await client.get(`/${plural}/${id}`);
+            const data = await client.get((0, url_js_1.safePath) `/${plural}/${id}`);
             return (0, responses_js_1.formatSuccess)(data);
         }
         catch (err) {
@@ -55,9 +56,9 @@ function registerDeviceCrud(server, client, deviceType, readOnly) {
         }, async ({ id, settings, dryRun }) => {
             try {
                 if (dryRun) {
-                    return (0, safety_js_1.formatDryRun)("PATCH", `/${plural}/${id}`, settings);
+                    return (0, safety_js_1.formatDryRun)("PATCH", (0, url_js_1.safePath) `/${plural}/${id}`, settings);
                 }
-                const data = await client.patch(`/${plural}/${id}`, settings);
+                const data = await client.patch((0, url_js_1.safePath) `/${plural}/${id}`, settings);
                 return (0, responses_js_1.formatSuccess)(data);
             }
             catch (err) {

package/dist/tools/files.js

@@ -4,6 +4,7 @@ exports.registerFileTools = registerFileTools;
 const zod_1 = require("zod");
 const responses_js_1 = require("../utils/responses.js");
 const safety_js_1 = require("../utils/safety.js");
+const url_js_1 = require("../utils/url.js");
 function registerFileTools(server, client, readOnly) {
     server.registerTool("protect_list_files", {
         description: "List files of a given type (e.g. 'video', 'timelapse')",
@@ -15,7 +16,7 @@ function registerFileTools(server, client, readOnly) {
         annotations: safety_js_1.READ_ONLY,
     }, async ({ fileType }) => {
         try {
-            const data = await client.get(`/files/${fileType}`);
+            const data = await client.get((0, url_js_1.safePath) `/files/${fileType}`);
             return (0, responses_js_1.formatSuccess)(data);
         }
         catch (err) {
@@ -38,7 +39,7 @@ function registerFileTools(server, client, readOnly) {
         if (denied)
             return denied;
         try {
-            await client.post(`/alarm-manager/webhook/${id}`);
+            await client.post((0, url_js_1.safePath) `/alarm-manager/webhook/${id}`);
             return (0, responses_js_1.formatSuccess)({ triggered: true, webhookId: id });
         }
         catch (err) {
@@ -63,13 +64,13 @@ function registerFileTools(server, client, readOnly) {
     }, async ({ fileType, base64Data, contentType, dryRun }) => {
         try {
             if (dryRun) {
-                return (0, safety_js_1.formatDryRun)("POST", `/files/${fileType}`, {
+                return (0, safety_js_1.formatDryRun)("POST", (0, url_js_1.safePath) `/files/${fileType}`, {
                     contentType,
                     dataLength: base64Data.length,
                 });
             }
             const buffer = Buffer.from(base64Data, "base64");
-            const data = await client.postBinary(`/files/${fileType}`, buffer, contentType);
+            const data = await client.postBinary((0, url_js_1.safePath) `/files/${fileType}`, buffer, contentType);
             return (0, responses_js_1.formatSuccess)(data);
         }
         catch (err) {

package/dist/tools/liveviews.js

@@ -4,6 +4,7 @@ exports.registerLiveviewTools = registerLiveviewTools;
 const zod_1 = require("zod");
 const responses_js_1 = require("../utils/responses.js");
 const safety_js_1 = require("../utils/safety.js");
+const url_js_1 = require("../utils/url.js");
 function registerLiveviewTools(server, client, readOnly) {
     server.registerTool("protect_list_liveviews", {
         description: "List all live views configured in UniFi Protect",
@@ -23,7 +24,7 @@ function registerLiveviewTools(server, client, readOnly) {
         annotations: safety_js_1.READ_ONLY,
     }, async ({ id }) => {
         try {
-            const data = await client.get(`/liveviews/${id}`);
+            const data = await client.get((0, url_js_1.safePath) `/liveviews/${id}`);
             return (0, responses_js_1.formatSuccess)(data);
         }
         catch (err) {
@@ -72,9 +73,9 @@ function registerLiveviewTools(server, client, readOnly) {
     }, async ({ id, settings, dryRun }) => {
         try {
             if (dryRun) {
-                return (0, safety_js_1.formatDryRun)("PATCH", `/liveviews/${id}`, settings);
+                return (0, safety_js_1.formatDryRun)("PATCH", (0, url_js_1.safePath) `/liveviews/${id}`, settings);
             }
-            const data = await client.patch(`/liveviews/${id}`, settings);
+            const data = await client.patch((0, url_js_1.safePath) `/liveviews/${id}`, settings);
             return (0, responses_js_1.formatSuccess)(data);
         }
         catch (err) {

package/dist/utils/url.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Tagged template that encodes interpolated values for safe URL path construction.
+ *
+ * This function URL-encodes only the interpolated values, which prevents them from
+ * introducing path traversal (`/`), query (`?`), or fragment (`#`) delimiters.
+ * The literal template segments are not modified, so they must be trusted and should
+ * not contain user-controlled data.
+ *
+ * Values must be raw (unencoded). Pre-encoded values will be double-encoded
+ * (e.g. `%2F` becomes `%252F`), which is the correct defensive behavior.
+ */
+export declare function safePath(strings: TemplateStringsArray, ...values: (string | number)[]): string;

package/dist/utils/url.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.safePath = safePath;
+/**
+ * Tagged template that encodes interpolated values for safe URL path construction.
+ *
+ * This function URL-encodes only the interpolated values, which prevents them from
+ * introducing path traversal (`/`), query (`?`), or fragment (`#`) delimiters.
+ * The literal template segments are not modified, so they must be trusted and should
+ * not contain user-controlled data.
+ *
+ * Values must be raw (unencoded). Pre-encoded values will be double-encoded
+ * (e.g. `%2F` becomes `%252F`), which is the correct defensive behavior.
+ */
+function safePath(strings, ...values) {
+    return strings.reduce((result, str, i) => i < values.length
+        ? result + str + encodeURIComponent(String(values[i]))
+        : result + str, "");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owine/unifi-protect-mcp",
-  "version": "2.0.2",
+  "version": "2.1.0",
   "description": "MCP server for UniFi Protect Integration API",
   "main": "dist/index.js",
   "bin": {