@payloadcms/plugin-mcp 3.91.0-internal.c1569dc → 4.0.0-beta.1

package/src/collections/createApiKeysCollection.ts

@@ -1,399 +0,0 @@
-import type { CollectionConfig, CollectionSlug, PayloadRequest, Where } from 'payload'
-
-import type { MCPPluginConfig } from '../types.js'
-
-import { toCamelCase } from '../utils/camelCase.js'
-import { createApiKeyFields } from '../utils/createApiKeyFields.js'
-
-export const createAPIKeysCollection = (
-  collections: MCPPluginConfig['collections'],
-  globals: MCPPluginConfig['globals'],
-  customTools: Array<{ description: string; name: string }> = [],
-  experimentalTools: NonNullable<MCPPluginConfig['experimental']>['tools'] = {},
-  pluginOptions: MCPPluginConfig,
-): CollectionConfig => {
-  const customToolsFields = customTools.map((tool) => {
-    const camelCasedName = toCamelCase(tool.name)
-    return {
-      name: camelCasedName,
-      type: 'checkbox' as const,
-      admin: {
-        description: tool.description,
-      },
-      defaultValue: true,
-      label: camelCasedName,
-    }
-  })
-
-  const customResourceFields =
-    pluginOptions.mcp?.resources?.map((resource) => {
-      const camelCasedName = toCamelCase(resource.name)
-      return {
-        name: camelCasedName,
-        type: 'checkbox' as const,
-        admin: {
-          description: resource.description,
-        },
-        defaultValue: true,
-        label: camelCasedName,
-      }
-    }) || []
-
-  const customPromptFields =
-    pluginOptions.mcp?.prompts?.map((prompt) => {
-      const camelCasedName = toCamelCase(prompt.name)
-      return {
-        name: camelCasedName,
-        type: 'checkbox' as const,
-        admin: {
-          description: prompt.description,
-        },
-        defaultValue: true,
-        label: camelCasedName,
-      }
-    }) || []
-
-  const userCollection = pluginOptions.userCollection
-
-  const isAuthenticated = ({ req }: { req: PayloadRequest }): boolean =>
-    Boolean(req.user && req.user.collection === userCollection)
-
-  const restrictToOwnKeys = ({ req }: { req: PayloadRequest }): boolean | Where =>
-    req.user && req.user.collection === userCollection ? { user: { equals: req.user.id } } : false
-
-  return {
-    slug: 'payload-mcp-api-keys',
-    access: {
-      // Fail-safe default: any authenticated user may manage only their OWN keys.
-      // Cross-user key issuance is disabled by default (see the `user` field below)
-      // and must be granted explicitly via `overrideApiKeyCollection`.
-      create: isAuthenticated,
-      delete: restrictToOwnKeys,
-      read: restrictToOwnKeys,
-      unlock: restrictToOwnKeys,
-      update: restrictToOwnKeys,
-    },
-    admin: {
-      description:
-        'API keys control which collections, resources, tools, and prompts MCP clients can access',
-      group: 'MCP',
-      useAsTitle: 'label',
-    },
-    auth: {
-      disableLocalStrategy: true,
-      useAPIKey: true,
-    },
-    fields: [
-      {
-        name: 'user',
-        type: 'relationship',
-        access: {
-          // Bind new keys to the creating user and prevent re-binding on update.
-          // A key acts as its associated user, so allowing arbitrary assignment lets
-          // any key manager impersonate anyone. Grant these via `overrideApiKeyCollection`
-          // to let trusted administrators issue keys on behalf of other users.
-          create: () => false,
-          update: () => false,
-        },
-        admin: {
-          description: 'The user that the API key is associated with.',
-        },
-        defaultValue: ({ req }: { req: PayloadRequest }) =>
-          req.user && req.user.collection === userCollection ? req.user.id : undefined,
-        relationTo: userCollection as CollectionSlug,
-        required: true,
-      },
-      {
-        name: 'label',
-        type: 'text',
-        admin: {
-          description: 'A useful label for the API key.',
-        },
-      },
-      {
-        name: 'description',
-        type: 'text',
-        admin: {
-          description: 'The purpose of the API key.',
-        },
-      },
-
-      ...createApiKeyFields({
-        config: collections,
-        configType: 'collection',
-      }),
-
-      ...createApiKeyFields({
-        config: globals,
-        configType: 'global',
-      }),
-
-      ...(customTools.length > 0
-        ? [
-            {
-              type: 'collapsible' as const,
-              admin: {
-                description: 'Manage client access to tools',
-                position: 'sidebar' as const,
-              },
-              fields: [
-                {
-                  name: 'payload-mcp-tool',
-                  type: 'group' as const,
-                  fields: customToolsFields,
-                  label: false as const,
-                },
-              ],
-              label: 'Tools',
-            },
-          ]
-        : []),
-
-      ...(pluginOptions.mcp?.resources && pluginOptions.mcp?.resources.length > 0
-        ? [
-            {
-              type: 'collapsible' as const,
-              admin: {
-                description: 'Manage client access to resources',
-                position: 'sidebar' as const,
-              },
-              fields: [
-                {
-                  name: 'payload-mcp-resource',
-                  type: 'group' as const,
-                  fields: customResourceFields,
-                  label: false as const,
-                },
-              ],
-              label: 'Resources',
-            },
-          ]
-        : []),
-
-      ...(pluginOptions.mcp?.prompts && pluginOptions.mcp?.prompts.length > 0
-        ? [
-            {
-              type: 'collapsible' as const,
-              admin: {
-                description: 'Manage client access to prompts',
-                position: 'sidebar' as const,
-              },
-              fields: [
-                {
-                  name: 'payload-mcp-prompt',
-                  type: 'group' as const,
-                  fields: customPromptFields,
-                  label: false as const,
-                },
-              ],
-              label: 'Prompts',
-            },
-          ]
-        : []),
-
-      // Experimental Tools
-      ...(process.env.NODE_ENV === 'development' &&
-      (experimentalTools?.collections?.enabled ||
-        experimentalTools?.jobs?.enabled ||
-        experimentalTools?.config?.enabled ||
-        experimentalTools?.auth?.enabled)
-        ? [
-            {
-              type: 'collapsible' as const,
-              admin: {
-                description: 'Manage client access to experimental tools',
-                position: 'sidebar' as const,
-              },
-              fields: [
-                ...(experimentalTools?.collections?.enabled
-                  ? [
-                      {
-                        name: 'collections',
-                        type: 'group' as const,
-                        fields: [
-                          {
-                            name: 'find',
-                            type: 'checkbox' as const,
-                            admin: {
-                              description:
-                                'Allow LLMs to find and list Payload collections with optional content and document counts.',
-                            },
-                            defaultValue: false,
-                          },
-                          {
-                            name: 'create',
-                            type: 'checkbox' as const,
-                            admin: {
-                              description:
-                                'Allow LLMs to create new Payload collections with specified fields and configuration.',
-                            },
-                            defaultValue: false,
-                          },
-                          {
-                            name: 'update',
-                            type: 'checkbox' as const,
-                            admin: {
-                              description:
-                                'Allow LLMs to update existing Payload collections with new fields, modifications, or configuration changes.',
-                            },
-                            defaultValue: false,
-                          },
-                          {
-                            name: 'delete',
-                            type: 'checkbox' as const,
-                            admin: {
-                              description:
-                                'Allow LLMs to delete Payload collections and optionally update the configuration.',
-                            },
-                            defaultValue: false,
-                          },
-                        ],
-                      },
-                    ]
-                  : []),
-                ...(experimentalTools?.jobs?.enabled
-                  ? [
-                      {
-                        name: 'jobs',
-                        type: 'group' as const,
-                        fields: [
-                          {
-                            name: 'create',
-                            type: 'checkbox' as const,
-                            admin: {
-                              description:
-                                'Allow LLMs to create new Payload jobs (tasks and workflows) with custom schemas and configuration.',
-                            },
-                            defaultValue: false,
-                          },
-                          {
-                            name: 'run',
-                            type: 'checkbox' as const,
-                            admin: {
-                              description:
-                                'Allow LLMs to execute Payload jobs with custom input data and queue options.',
-                            },
-                            defaultValue: false,
-                          },
-                          {
-                            name: 'update',
-                            type: 'checkbox' as const,
-                            admin: {
-                              description:
-                                'Allow LLMs to update existing Payload jobs with new schemas, configuration, or handler code.',
-                            },
-                            defaultValue: false,
-                          },
-                        ],
-                      },
-                    ]
-                  : []),
-                ...(experimentalTools?.config?.enabled
-                  ? [
-                      {
-                        name: 'config',
-                        type: 'group' as const,
-                        fields: [
-                          {
-                            name: 'find',
-                            type: 'checkbox' as const,
-                            admin: {
-                              description:
-                                'Allow LLMs to read and display a Payload configuration file.',
-                            },
-                            defaultValue: false,
-                          },
-                          {
-                            name: 'update',
-                            type: 'checkbox' as const,
-                            admin: {
-                              description:
-                                'Allow LLMs to update a Payload configuration file with various modifications.',
-                            },
-                            defaultValue: false,
-                          },
-                        ],
-                      },
-                    ]
-                  : []),
-                ...(experimentalTools?.auth?.enabled
-                  ? [
-                      {
-                        name: 'auth',
-                        type: 'group' as const,
-                        fields: [
-                          {
-                            name: 'auth',
-                            type: 'checkbox' as const,
-                            admin: {
-                              description:
-                                'Allow LLMs to check authentication status for a user by setting custom headers. (e.g. {"Authorization": "Bearer <token>"})',
-                            },
-                            defaultValue: false,
-                            label: 'Check Auth Status',
-                          },
-                          {
-                            name: 'login',
-                            type: 'checkbox' as const,
-                            admin: {
-                              description:
-                                'Allow LLMs to authenticate a user with email and password.',
-                            },
-                            defaultValue: false,
-                            label: 'User Login',
-                          },
-                          {
-                            name: 'verify',
-                            type: 'checkbox' as const,
-                            admin: {
-                              description:
-                                'Allow LLMs to verify a user email with a verification token.',
-                            },
-                            defaultValue: false,
-                            label: 'Email Verification',
-                          },
-                          {
-                            name: 'resetPassword',
-                            type: 'checkbox' as const,
-                            admin: {
-                              description:
-                                'Allow LLMs to reset a user password with a reset token.',
-                            },
-                            defaultValue: false,
-                            label: 'Reset Password',
-                          },
-                          {
-                            name: 'forgotPassword',
-                            type: 'checkbox' as const,
-                            admin: {
-                              description: 'Allow LLMs to send a password reset email to a user.',
-                            },
-                            defaultValue: false,
-                            label: 'Forgot Password',
-                          },
-                          {
-                            name: 'unlock',
-                            type: 'checkbox' as const,
-                            admin: {
-                              description:
-                                'Allow LLMs to unlock a user account that has been locked due to failed login attempts.',
-                            },
-                            defaultValue: false,
-                            label: 'Unlock Account',
-                          },
-                        ],
-                      },
-                    ]
-                  : []),
-              ],
-              label: 'Experimental Tools',
-            },
-          ]
-        : []),
-    ],
-    labels: {
-      plural: 'API Keys',
-      singular: 'API Key',
-    },
-  }
-}

package/src/defaults.ts

@@ -1,3 +0,0 @@
-export const defaults = {
-  userCollection: 'users',
-}

package/src/endpoints/mcp.ts

@@ -1,26 +0,0 @@
-import type { PayloadHandler } from 'payload'
-
-import type { MCPPluginConfig } from '../types.js'
-
-import { createRequestFromPayloadRequest } from '../mcp/createRequest.js'
-import { getMcpHandler } from '../mcp/getMcpHandler.js'
-import { resolveAccessSettings } from './resolveAccessSettings.js'
-import { withRestoredWebGlobals } from './withRestoredWebGlobals.js'
-
-export const initializeMCPHandler = (pluginOptions: MCPPluginConfig) => {
-  const mcpHandler: PayloadHandler = async (req) => {
-    const useVerboseLogs = pluginOptions.mcp?.handlerOptions?.verboseLogs ?? false
-
-    req.payloadAPI = 'MCP' as const
-
-    const mcpAccessSettings = await resolveAccessSettings({ pluginOptions, req, useVerboseLogs })
-    req.user = mcpAccessSettings.user
-
-    return await withRestoredWebGlobals(async () => {
-      const handler = getMcpHandler(pluginOptions, mcpAccessSettings, req)
-      const request = createRequestFromPayloadRequest(req)
-      return await handler(request)
-    })
-  }
-  return mcpHandler
-}

package/src/endpoints/resolveAccessSettings.ts

@@ -1,74 +0,0 @@
-import crypto from 'crypto'
-import { type PayloadRequest, type TypedUser, UnauthorizedError, type Where } from 'payload'
-
-import type { MCPAccessSettings, MCPPluginConfig } from '../types.js'
-
-type ResolveAccessSettingsArgs = {
-  pluginOptions: MCPPluginConfig
-  req: PayloadRequest
-  useVerboseLogs: boolean
-}
-
-const createDefaultAccessSettingsResolver = ({
-  pluginOptions,
-  req,
-  useVerboseLogs,
-}: ResolveAccessSettingsArgs) => {
-  return async (overrideApiKey?: null | string): Promise<MCPAccessSettings> => {
-    const authorization = req.headers.get('Authorization')
-    const apiKey =
-      overrideApiKey ??
-      (authorization?.startsWith('Bearer ') ? authorization.replace('Bearer ', '').trim() : null)
-
-    if (apiKey === null) {
-      throw new UnauthorizedError()
-    }
-
-    const sha256APIKeyIndex = crypto
-      .createHmac('sha256', req.payload.secret)
-      .update(apiKey || '')
-      .digest('hex')
-    const where: Where = {
-      apiKeyIndex: {
-        equals: sha256APIKeyIndex,
-      },
-    }
-    const { docs } = await req.payload.find({
-      collection: 'payload-mcp-api-keys',
-      depth: 1,
-      limit: 1,
-      pagination: false,
-      where,
-    })
-    const apiKeyDoc = docs[0]
-
-    if (!apiKeyDoc) {
-      throw new UnauthorizedError()
-    }
-
-    if (useVerboseLogs) {
-      req.payload.logger.info('[payload-mcp] API Key is valid')
-    }
-
-    const user = apiKeyDoc.user as TypedUser
-
-    if (!user || typeof user !== 'object' || !('id' in user)) {
-      throw new UnauthorizedError()
-    }
-
-    user.collection = pluginOptions.userCollection as string
-    user._strategy = 'mcp-api-key' as const
-
-    return apiKeyDoc as unknown as MCPAccessSettings
-  }
-}
-
-export const resolveAccessSettings = async (
-  args: ResolveAccessSettingsArgs,
-): Promise<MCPAccessSettings> => {
-  const getDefaultMcpAccessSettings = createDefaultAccessSettingsResolver(args)
-
-  return args.pluginOptions.overrideAuth
-    ? await args.pluginOptions.overrideAuth(args.req, getDefaultMcpAccessSettings)
-    : await getDefaultMcpAccessSettings()
-}

package/src/endpoints/withRestoredWebGlobals.ts

@@ -1,19 +0,0 @@
-/**
- * Restores globals replaced by @hono/node-server while handling an MCP request.
- */
-export const withRestoredWebGlobals = async <T>(handler: () => Promise<T>): Promise<T> => {
-  const globals = globalThis as Record<string, unknown>
-  const originalRequest = globals['Request']
-  const originalResponse = globals['Response']
-
-  try {
-    return await handler()
-  } finally {
-    if (globals['Response'] !== originalResponse) {
-      Object.defineProperty(globalThis, 'Response', { value: originalResponse })
-    }
-    if (globals['Request'] !== originalRequest) {
-      Object.defineProperty(globalThis, 'Request', { value: originalRequest })
-    }
-  }
-}

package/src/mcp/createRequest.ts

@@ -1,13 +0,0 @@
-import { AuthenticationError, type PayloadRequest } from 'payload'
-
-export const createRequestFromPayloadRequest = (req: PayloadRequest) => {
-  if (!req.url) {
-    throw new AuthenticationError()
-  }
-  return new Request(req.url, {
-    body: req.body,
-    duplex: 'half',
-    headers: req.headers,
-    method: req.method,
-  } as { duplex: 'half' } & RequestInit)
-}